codex-team 0.0.4 → 0.0.6

package/README.md

@@ -15,6 +15,7 @@ After install, use the `codexm` command.
 ## Commands
 
 ```bash
+codexm --version
 codexm current
 codexm list [name]
 codexm save <name>

package/dist/cli.cjs

@@ -12,6 +12,10 @@ var __webpack_modules__ = {
         var timezone_js_default = /*#__PURE__*/ __webpack_require__.n(timezone_js_namespaceObject);
         const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
         var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
+        var package_namespaceObject = {
+            rE: "0.0.6"
+        };
+        const external_node_crypto_namespaceObject = require("node:crypto");
         const promises_namespaceObject = require("node:fs/promises");
         function isRecord(value) {
             return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -34,6 +38,29 @@ var __webpack_modules__ = {
             if ("number" != typeof value || Number.isNaN(value)) throw new Error(`Field "${fieldName}" must be a number.`);
             return value;
         }
+        function normalizeAuthMode(authMode) {
+            return authMode.trim().toLowerCase();
+        }
+        function isApiKeyAuthMode(authMode) {
+            return "apikey" === normalizeAuthMode(authMode);
+        }
+        function isSupportedChatGPTAuthMode(authMode) {
+            const normalized = normalizeAuthMode(authMode);
+            return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
+        }
+        function fingerprintApiKey(apiKey) {
+            return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
+        }
+        function getSnapshotIdentity(snapshot) {
+            if (isApiKeyAuthMode(snapshot.auth_mode)) {
+                const apiKey = snapshot.OPENAI_API_KEY;
+                if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+                return `key_${fingerprintApiKey(apiKey)}`;
+            }
+            const accountId = snapshot.tokens?.account_id;
+            if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
+            return accountId;
+        }
         function defaultQuotaSnapshot() {
             return {
                 status: "stale"
@@ -78,15 +105,28 @@ var __webpack_modules__ = {
             }
             if (!isRecord(parsed)) throw new Error("Auth snapshot must be a JSON object.");
             const authMode = asNonEmptyString(parsed.auth_mode, "auth_mode");
-            if (!isRecord(parsed.tokens)) throw new Error('Field "tokens" must be an object.');
-            const accountId = asNonEmptyString(parsed.tokens.account_id, "tokens.account_id");
+            const tokens = parsed.tokens;
+            if (null != tokens && !isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+            const apiKeyMode = isApiKeyAuthMode(authMode);
+            const normalizedApiKey = null === parsed.OPENAI_API_KEY || void 0 === parsed.OPENAI_API_KEY ? parsed.OPENAI_API_KEY : asNonEmptyString(parsed.OPENAI_API_KEY, "OPENAI_API_KEY");
+            if (apiKeyMode) {
+                if ("string" != typeof normalizedApiKey || "" === normalizedApiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+            } else {
+                if (!isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+                asNonEmptyString(tokens.account_id, "tokens.account_id");
+            }
             return {
                 ...parsed,
                 auth_mode: authMode,
-                tokens: {
-                    ...parsed.tokens,
-                    account_id: accountId
-                }
+                OPENAI_API_KEY: normalizedApiKey,
+                ...isRecord(tokens) ? {
+                    tokens: {
+                        ...tokens,
+                        ..."string" == typeof tokens.account_id && "" !== tokens.account_id.trim() ? {
+                            account_id: tokens.account_id
+                        } : {}
+                    }
+                } : {}
             };
         }
         async function readAuthSnapshotFile(filePath) {
@@ -98,7 +138,7 @@ var __webpack_modules__ = {
             return {
                 name,
                 auth_mode: snapshot.auth_mode,
-                account_id: snapshot.tokens.account_id,
+                account_id: getSnapshotIdentity(snapshot),
                 created_at: existingCreatedAt ?? timestamp,
                 updated_at: timestamp,
                 last_switched_at: null,
@@ -155,16 +195,13 @@ var __webpack_modules__ = {
             const value = payload[key];
             return "string" == typeof value && "" !== value.trim() ? value : void 0;
         }
-        function isSupportedChatGPTMode(authMode) {
-            const normalized = authMode.trim().toLowerCase();
-            return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
-        }
         function parsePlanType(snapshot) {
+            const tokens = snapshot.tokens ?? {};
             for (const tokenName of [
                 "id_token",
                 "access_token"
             ]){
-                const token = snapshot.tokens[tokenName];
+                const token = tokens[tokenName];
                 if ("string" == typeof token && "" !== token.trim()) try {
                     const payload = decodeJwtPayload(token);
                     const authClaim = extractAuthClaim(payload);
@@ -175,10 +212,11 @@ var __webpack_modules__ = {
         }
         function extractChatGPTAuth(snapshot) {
             const authMode = snapshot.auth_mode ?? "";
-            const supported = isSupportedChatGPTMode(authMode);
-            const accessTokenValue = snapshot.tokens.access_token;
-            const refreshTokenValue = snapshot.tokens.refresh_token;
-            const directAccountId = snapshot.tokens.account_id;
+            const supported = isSupportedChatGPTAuthMode(authMode);
+            const tokens = snapshot.tokens ?? {};
+            const accessTokenValue = tokens.access_token;
+            const refreshTokenValue = tokens.refresh_token;
+            const directAccountId = tokens.account_id;
             let accountId = "string" == typeof directAccountId && "" !== directAccountId.trim() ? directAccountId : void 0;
             let planType;
             let issuer;
@@ -187,7 +225,7 @@ var __webpack_modules__ = {
                 "id_token",
                 "access_token"
             ]){
-                const token = snapshot.tokens[tokenName];
+                const token = tokens[tokenName];
                 if ("string" == typeof token && "" !== token.trim()) try {
                     const payload = decodeJwtPayload(token);
                     const authClaim = extractAuthClaim(payload);
@@ -369,7 +407,7 @@ var __webpack_modules__ = {
                 ...snapshot,
                 last_refresh: (options.now ?? new Date()).toISOString(),
                 tokens: {
-                    ...snapshot.tokens,
+                    ...snapshot.tokens ?? {},
                     access_token: payload.access_token,
                     id_token: payload.id_token,
                     refresh_token: payload.refresh_token ?? extracted.refreshToken,
@@ -520,7 +558,7 @@ var __webpack_modules__ = {
                 if (!await pathExists(this.paths.currentAuthPath)) return;
                 try {
                     const currentSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                    if (currentSnapshot.tokens.account_id !== snapshot.tokens.account_id) return;
+                    if (getSnapshotIdentity(currentSnapshot) !== getSnapshotIdentity(snapshot)) return;
                     await atomicWriteFile(this.paths.currentAuthPath, stringifyJson(snapshot));
                 } catch  {}
             }
@@ -576,7 +614,7 @@ var __webpack_modules__ = {
                 ]);
                 const meta = parseSnapshotMeta(rawMeta);
                 if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-                if (meta.account_id !== snapshot.tokens.account_id) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+                if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
                 return {
                     ...meta,
                     authPath,
@@ -619,11 +657,12 @@ var __webpack_modules__ = {
                     warnings
                 };
                 const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                const matchedAccounts = accounts.filter((account)=>account.account_id === snapshot.tokens.account_id).map((account)=>account.name);
+                const currentIdentity = getSnapshotIdentity(snapshot);
+                const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
                 return {
                     exists: true,
                     auth_mode: snapshot.auth_mode,
-                    account_id: snapshot.tokens.account_id,
+                    account_id: currentIdentity,
                     matched_accounts: matchedAccounts,
                     managed: matchedAccounts.length > 0,
                     duplicate_match: matchedAccounts.length > 1,
@@ -686,7 +725,7 @@ var __webpack_modules__ = {
                 const rawAuth = await readJsonFile(account.authPath);
                 await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
                 const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-                if (writtenSnapshot.tokens.account_id !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+                if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
                 const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
                 meta.last_switched_at = new Date().toISOString();
                 meta.updated_at = meta.last_switched_at;
@@ -730,7 +769,7 @@ var __webpack_modules__ = {
                         await this.syncCurrentAuthIfMatching(result.authSnapshot);
                     }
                     meta.auth_mode = result.authSnapshot.auth_mode;
-                    meta.account_id = result.authSnapshot.tokens.account_id;
+                    meta.account_id = getSnapshotIdentity(result.authSnapshot);
                     meta.updated_at = now.toISOString();
                     meta.quota = result.quota;
                     await this.writeAccountMeta(name, meta);
@@ -842,7 +881,7 @@ var __webpack_modules__ = {
                     const metaStat = await (0, promises_namespaceObject.stat)(account.metaPath);
                     if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
                     if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
-                    if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares account_id ${account.account_id} with another saved account.`);
+                    if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
                 }
                 let currentAuthPresent = false;
                 if (await pathExists(this.paths.currentAuthPath)) {
@@ -904,6 +943,8 @@ var __webpack_modules__ = {
             stream.write(`codexm - manage multiple Codex ChatGPT auth snapshots
 
 Usage:
+  codexm --version
+  codexm --help
   codexm current [--json]
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
@@ -923,7 +964,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             if (status.exists) {
                 lines.push("Current auth: present");
                 lines.push(`Auth mode: ${status.auth_mode}`);
-                lines.push(`Account ID: ${maskAccountId(status.account_id ?? "")}`);
+                lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
                 if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
                 else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
                 else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1056,7 +1097,7 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
                 },
                 {
                     key: "account_id",
-                    label: "ACCOUNT ID"
+                    label: "IDENTITY"
                 },
                 {
                     key: "plan_type",
@@ -1131,6 +1172,10 @@ Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
             const parsed = parseArgs(argv);
             const json = parsed.flags.has("--json");
             try {
+                if (parsed.flags.has("--version")) {
+                    streams.stdout.write(`${package_namespaceObject.rE}\n`);
+                    return 0;
+                }
                 if (!parsed.command || parsed.flags.has("--help")) {
                     printHelp(streams.stdout);
                     return 0;

package/dist/main.cjs

@@ -42,6 +42,10 @@ const timezone_js_namespaceObject = require("dayjs/plugin/timezone.js");
 var timezone_js_default = /*#__PURE__*/ __webpack_require__.n(timezone_js_namespaceObject);
 const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
 var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
+var package_namespaceObject = {
+    rE: "0.0.6"
+};
+const external_node_crypto_namespaceObject = require("node:crypto");
 const promises_namespaceObject = require("node:fs/promises");
 function isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
@@ -64,6 +68,29 @@ function asOptionalNumber(value, fieldName) {
     if ("number" != typeof value || Number.isNaN(value)) throw new Error(`Field "${fieldName}" must be a number.`);
     return value;
 }
+function normalizeAuthMode(authMode) {
+    return authMode.trim().toLowerCase();
+}
+function isApiKeyAuthMode(authMode) {
+    return "apikey" === normalizeAuthMode(authMode);
+}
+function isSupportedChatGPTAuthMode(authMode) {
+    const normalized = normalizeAuthMode(authMode);
+    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
+}
+function fingerprintApiKey(apiKey) {
+    return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+function getSnapshotIdentity(snapshot) {
+    if (isApiKeyAuthMode(snapshot.auth_mode)) {
+        const apiKey = snapshot.OPENAI_API_KEY;
+        if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+        return `key_${fingerprintApiKey(apiKey)}`;
+    }
+    const accountId = snapshot.tokens?.account_id;
+    if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
+    return accountId;
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -108,15 +135,28 @@ function parseAuthSnapshot(raw) {
     }
     if (!isRecord(parsed)) throw new Error("Auth snapshot must be a JSON object.");
     const authMode = asNonEmptyString(parsed.auth_mode, "auth_mode");
-    if (!isRecord(parsed.tokens)) throw new Error('Field "tokens" must be an object.');
-    const accountId = asNonEmptyString(parsed.tokens.account_id, "tokens.account_id");
+    const tokens = parsed.tokens;
+    if (null != tokens && !isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+    const apiKeyMode = isApiKeyAuthMode(authMode);
+    const normalizedApiKey = null === parsed.OPENAI_API_KEY || void 0 === parsed.OPENAI_API_KEY ? parsed.OPENAI_API_KEY : asNonEmptyString(parsed.OPENAI_API_KEY, "OPENAI_API_KEY");
+    if (apiKeyMode) {
+        if ("string" != typeof normalizedApiKey || "" === normalizedApiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+    } else {
+        if (!isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+        asNonEmptyString(tokens.account_id, "tokens.account_id");
+    }
     return {
         ...parsed,
         auth_mode: authMode,
-        tokens: {
-            ...parsed.tokens,
-            account_id: accountId
-        }
+        OPENAI_API_KEY: normalizedApiKey,
+        ...isRecord(tokens) ? {
+            tokens: {
+                ...tokens,
+                ..."string" == typeof tokens.account_id && "" !== tokens.account_id.trim() ? {
+                    account_id: tokens.account_id
+                } : {}
+            }
+        } : {}
     };
 }
 async function readAuthSnapshotFile(filePath) {
@@ -128,7 +168,7 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: snapshot.tokens.account_id,
+        account_id: getSnapshotIdentity(snapshot),
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -185,16 +225,13 @@ function extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
-function isSupportedChatGPTMode(authMode) {
-    const normalized = authMode.trim().toLowerCase();
-    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
-}
 function parsePlanType(snapshot) {
+    const tokens = snapshot.tokens ?? {};
     for (const tokenName of [
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -205,10 +242,11 @@ function parsePlanType(snapshot) {
 }
 function extractChatGPTAuth(snapshot) {
     const authMode = snapshot.auth_mode ?? "";
-    const supported = isSupportedChatGPTMode(authMode);
-    const accessTokenValue = snapshot.tokens.access_token;
-    const refreshTokenValue = snapshot.tokens.refresh_token;
-    const directAccountId = snapshot.tokens.account_id;
+    const supported = isSupportedChatGPTAuthMode(authMode);
+    const tokens = snapshot.tokens ?? {};
+    const accessTokenValue = tokens.access_token;
+    const refreshTokenValue = tokens.refresh_token;
+    const directAccountId = tokens.account_id;
     let accountId = "string" == typeof directAccountId && "" !== directAccountId.trim() ? directAccountId : void 0;
     let planType;
     let issuer;
@@ -217,7 +255,7 @@ function extractChatGPTAuth(snapshot) {
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -399,7 +437,7 @@ async function refreshChatGPTAuthTokens(snapshot, options) {
         ...snapshot,
         last_refresh: (options.now ?? new Date()).toISOString(),
         tokens: {
-            ...snapshot.tokens,
+            ...snapshot.tokens ?? {},
             access_token: payload.access_token,
             id_token: payload.id_token,
             refresh_token: payload.refresh_token ?? extracted.refreshToken,
@@ -550,7 +588,7 @@ class AccountStore {
         if (!await pathExists(this.paths.currentAuthPath)) return;
         try {
             const currentSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-            if (currentSnapshot.tokens.account_id !== snapshot.tokens.account_id) return;
+            if (getSnapshotIdentity(currentSnapshot) !== getSnapshotIdentity(snapshot)) return;
             await atomicWriteFile(this.paths.currentAuthPath, stringifyJson(snapshot));
         } catch  {}
     }
@@ -606,7 +644,7 @@ class AccountStore {
         ]);
         const meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== snapshot.tokens.account_id) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
             authPath,
@@ -649,11 +687,12 @@ class AccountStore {
             warnings
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === snapshot.tokens.account_id).map((account)=>account.name);
+        const currentIdentity = getSnapshotIdentity(snapshot);
+        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: snapshot.tokens.account_id,
+            account_id: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -716,7 +755,7 @@ class AccountStore {
         const rawAuth = await readJsonFile(account.authPath);
         await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (writtenSnapshot.tokens.account_id !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -760,7 +799,7 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = result.authSnapshot.tokens.account_id;
+            meta.account_id = getSnapshotIdentity(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -872,7 +911,7 @@ class AccountStore {
             const metaStat = await (0, promises_namespaceObject.stat)(account.metaPath);
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares account_id ${account.account_id} with another saved account.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -934,6 +973,8 @@ function printHelp(stream) {
     stream.write(`codexm - manage multiple Codex ChatGPT auth snapshots
 
 Usage:
+  codexm --version
+  codexm --help
   codexm current [--json]
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
@@ -953,7 +994,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Account ID: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1086,7 +1127,7 @@ function describeQuotaAccounts(accounts, warnings) {
         },
         {
             key: "account_id",
-            label: "ACCOUNT ID"
+            label: "IDENTITY"
         },
         {
             key: "plan_type",
@@ -1161,6 +1202,10 @@ async function runCli(argv, options = {}) {
     const parsed = parseArgs(argv);
     const json = parsed.flags.has("--json");
     try {
+        if (parsed.flags.has("--version")) {
+            streams.stdout.write(`${package_namespaceObject.rE}\n`);
+            return 0;
+        }
         if (!parsed.command || parsed.flags.has("--help")) {
             printHelp(streams.stdout);
             return 0;

package/dist/main.js

@@ -2,11 +2,15 @@ import { stderr, stdin, stdout as external_node_process_stdout } from "node:proc
 import dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
+import { createHash } from "node:crypto";
 import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+var package_namespaceObject = {
+    rE: "0.0.6"
+};
 function isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
 }
@@ -28,6 +32,29 @@ function asOptionalNumber(value, fieldName) {
     if ("number" != typeof value || Number.isNaN(value)) throw new Error(`Field "${fieldName}" must be a number.`);
     return value;
 }
+function normalizeAuthMode(authMode) {
+    return authMode.trim().toLowerCase();
+}
+function isApiKeyAuthMode(authMode) {
+    return "apikey" === normalizeAuthMode(authMode);
+}
+function isSupportedChatGPTAuthMode(authMode) {
+    const normalized = normalizeAuthMode(authMode);
+    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
+}
+function fingerprintApiKey(apiKey) {
+    return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+function getSnapshotIdentity(snapshot) {
+    if (isApiKeyAuthMode(snapshot.auth_mode)) {
+        const apiKey = snapshot.OPENAI_API_KEY;
+        if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+        return `key_${fingerprintApiKey(apiKey)}`;
+    }
+    const accountId = snapshot.tokens?.account_id;
+    if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
+    return accountId;
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -72,15 +99,28 @@ function parseAuthSnapshot(raw) {
     }
     if (!isRecord(parsed)) throw new Error("Auth snapshot must be a JSON object.");
     const authMode = asNonEmptyString(parsed.auth_mode, "auth_mode");
-    if (!isRecord(parsed.tokens)) throw new Error('Field "tokens" must be an object.');
-    const accountId = asNonEmptyString(parsed.tokens.account_id, "tokens.account_id");
+    const tokens = parsed.tokens;
+    if (null != tokens && !isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+    const apiKeyMode = isApiKeyAuthMode(authMode);
+    const normalizedApiKey = null === parsed.OPENAI_API_KEY || void 0 === parsed.OPENAI_API_KEY ? parsed.OPENAI_API_KEY : asNonEmptyString(parsed.OPENAI_API_KEY, "OPENAI_API_KEY");
+    if (apiKeyMode) {
+        if ("string" != typeof normalizedApiKey || "" === normalizedApiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
+    } else {
+        if (!isRecord(tokens)) throw new Error('Field "tokens" must be an object.');
+        asNonEmptyString(tokens.account_id, "tokens.account_id");
+    }
     return {
         ...parsed,
         auth_mode: authMode,
-        tokens: {
-            ...parsed.tokens,
-            account_id: accountId
-        }
+        OPENAI_API_KEY: normalizedApiKey,
+        ...isRecord(tokens) ? {
+            tokens: {
+                ...tokens,
+                ..."string" == typeof tokens.account_id && "" !== tokens.account_id.trim() ? {
+                    account_id: tokens.account_id
+                } : {}
+            }
+        } : {}
     };
 }
 async function readAuthSnapshotFile(filePath) {
@@ -92,7 +132,7 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: snapshot.tokens.account_id,
+        account_id: getSnapshotIdentity(snapshot),
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -145,16 +185,13 @@ function extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
-function isSupportedChatGPTMode(authMode) {
-    const normalized = authMode.trim().toLowerCase();
-    return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
-}
 function parsePlanType(snapshot) {
+    const tokens = snapshot.tokens ?? {};
     for (const tokenName of [
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -165,10 +202,11 @@ function parsePlanType(snapshot) {
 }
 function extractChatGPTAuth(snapshot) {
     const authMode = snapshot.auth_mode ?? "";
-    const supported = isSupportedChatGPTMode(authMode);
-    const accessTokenValue = snapshot.tokens.access_token;
-    const refreshTokenValue = snapshot.tokens.refresh_token;
-    const directAccountId = snapshot.tokens.account_id;
+    const supported = isSupportedChatGPTAuthMode(authMode);
+    const tokens = snapshot.tokens ?? {};
+    const accessTokenValue = tokens.access_token;
+    const refreshTokenValue = tokens.refresh_token;
+    const directAccountId = tokens.account_id;
     let accountId = "string" == typeof directAccountId && "" !== directAccountId.trim() ? directAccountId : void 0;
     let planType;
     let issuer;
@@ -177,7 +215,7 @@ function extractChatGPTAuth(snapshot) {
         "id_token",
         "access_token"
     ]){
-        const token = snapshot.tokens[tokenName];
+        const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
             const authClaim = extractAuthClaim(payload);
@@ -359,7 +397,7 @@ async function refreshChatGPTAuthTokens(snapshot, options) {
         ...snapshot,
         last_refresh: (options.now ?? new Date()).toISOString(),
         tokens: {
-            ...snapshot.tokens,
+            ...snapshot.tokens ?? {},
             access_token: payload.access_token,
             id_token: payload.id_token,
             refresh_token: payload.refresh_token ?? extracted.refreshToken,
@@ -510,7 +548,7 @@ class AccountStore {
         if (!await pathExists(this.paths.currentAuthPath)) return;
         try {
             const currentSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-            if (currentSnapshot.tokens.account_id !== snapshot.tokens.account_id) return;
+            if (getSnapshotIdentity(currentSnapshot) !== getSnapshotIdentity(snapshot)) return;
             await atomicWriteFile(this.paths.currentAuthPath, stringifyJson(snapshot));
         } catch  {}
     }
@@ -566,7 +604,7 @@ class AccountStore {
         ]);
         const meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== snapshot.tokens.account_id) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
             authPath,
@@ -609,11 +647,12 @@ class AccountStore {
             warnings
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === snapshot.tokens.account_id).map((account)=>account.name);
+        const currentIdentity = getSnapshotIdentity(snapshot);
+        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: snapshot.tokens.account_id,
+            account_id: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -676,7 +715,7 @@ class AccountStore {
         const rawAuth = await readJsonFile(account.authPath);
         await atomicWriteFile(this.paths.currentAuthPath, `${rawAuth.trimEnd()}\n`);
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (writtenSnapshot.tokens.account_id !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -720,7 +759,7 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = result.authSnapshot.tokens.account_id;
+            meta.account_id = getSnapshotIdentity(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -832,7 +871,7 @@ class AccountStore {
             const metaStat = await stat(account.metaPath);
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares account_id ${account.account_id} with another saved account.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -894,6 +933,8 @@ function printHelp(stream) {
     stream.write(`codexm - manage multiple Codex ChatGPT auth snapshots
 
 Usage:
+  codexm --version
+  codexm --help
   codexm current [--json]
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
@@ -913,7 +954,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Account ID: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1046,7 +1087,7 @@ function describeQuotaAccounts(accounts, warnings) {
         },
         {
             key: "account_id",
-            label: "ACCOUNT ID"
+            label: "IDENTITY"
         },
         {
             key: "plan_type",
@@ -1121,6 +1162,10 @@ async function runCli(argv, options = {}) {
     const parsed = parseArgs(argv);
     const json = parsed.flags.has("--json");
     try {
+        if (parsed.flags.has("--version")) {
+            streams.stdout.write(`${package_namespaceObject.rE}\n`);
+            return 0;
+        }
         if (!parsed.command || parsed.flags.has("--help")) {
             printHelp(streams.stdout);
             return 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-team",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Manage multiple Codex ChatGPT auth snapshots and quota usage from the command line.",
   "license": "MIT",
   "type": "module",
@@ -36,14 +36,6 @@
     "LICENSE",
     "README.md"
   ],
-  "scripts": {
-    "build": "rslib build",
-    "dev": "rslib build --watch",
-    "prepack": "pnpm build",
-    "test": "rstest run",
-    "test:watch": "rstest watch",
-    "typecheck": "tsc --noEmit"
-  },
   "engines": {
     "node": ">=20"
   },
@@ -59,5 +51,12 @@
   },
   "dependencies": {
     "dayjs": "^1.11.20"
+  },
+  "scripts": {
+    "build": "rslib build",
+    "dev": "rslib build --watch",
+    "test": "rstest run",
+    "test:watch": "rstest watch",
+    "typecheck": "tsc --noEmit"
   }
-}
+}