codex-team 0.0.7 → 0.0.9

package/dist/main.cjs

@@ -43,7 +43,7 @@ var timezone_js_default = /*#__PURE__*/ __webpack_require__.n(timezone_js_namesp
 const utc_js_namespaceObject = require("dayjs/plugin/utc.js");
 var utc_js_default = /*#__PURE__*/ __webpack_require__.n(utc_js_namespaceObject);
 var package_namespaceObject = {
-    rE: "0.0.7"
+    rE: "0.0.9"
 };
 const external_node_crypto_namespaceObject = require("node:crypto");
 const promises_namespaceObject = require("node:fs/promises");
@@ -78,10 +78,44 @@ function isSupportedChatGPTAuthMode(authMode) {
     const normalized = normalizeAuthMode(authMode);
     return "chatgpt" === normalized || "chatgpt_auth_tokens" === normalized;
 }
+function extractAuthClaim(payload) {
+    const value = payload["https://api.openai.com/auth"];
+    return isRecord(value) ? value : void 0;
+}
+function extractStringClaim(payload, key) {
+    const value = payload[key];
+    return "string" == typeof value && "" !== value.trim() ? value : void 0;
+}
+function extractSnapshotJwtPayloads(snapshot) {
+    const tokens = snapshot.tokens ?? {};
+    const payloads = [];
+    for (const tokenName of [
+        "id_token",
+        "access_token"
+    ]){
+        const token = tokens[tokenName];
+        if ("string" == typeof token && "" !== token.trim()) try {
+            payloads.push(decodeJwtPayload(token));
+        } catch  {}
+    }
+    return payloads;
+}
+function getSnapshotUserId(snapshot) {
+    for (const payload of extractSnapshotJwtPayloads(snapshot)){
+        const authClaim = extractAuthClaim(payload);
+        const chatGPTUserId = authClaim?.chatgpt_user_id;
+        if ("string" == typeof chatGPTUserId && "" !== chatGPTUserId.trim()) return chatGPTUserId;
+        const userId = extractStringClaim(payload, "user_id");
+        if (userId) return userId;
+    }
+}
 function fingerprintApiKey(apiKey) {
     return (0, external_node_crypto_namespaceObject.createHash)("sha256").update(apiKey).digest("hex").slice(0, 16);
 }
-function getSnapshotIdentity(snapshot) {
+function composeIdentity(accountId, userId) {
+    return "string" == typeof userId && "" !== userId.trim() ? `${accountId}:${userId}` : accountId;
+}
+function getSnapshotAccountId(snapshot) {
     if (isApiKeyAuthMode(snapshot.auth_mode)) {
         const apiKey = snapshot.OPENAI_API_KEY;
         if ("string" != typeof apiKey || "" === apiKey.trim()) throw new Error('Field "OPENAI_API_KEY" must be a non-empty string for apikey auth.');
@@ -91,6 +125,12 @@ function getSnapshotIdentity(snapshot) {
     if ("string" != typeof accountId || "" === accountId.trim()) throw new Error('Field "tokens.account_id" must be a non-empty string.');
     return accountId;
 }
+function getSnapshotIdentity(snapshot) {
+    return composeIdentity(getSnapshotAccountId(snapshot), isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0);
+}
+function getMetaIdentity(meta) {
+    return composeIdentity(meta.account_id, meta.user_id);
+}
 function defaultQuotaSnapshot() {
     return {
         status: "stale"
@@ -168,7 +208,8 @@ function createSnapshotMeta(name, snapshot, now, existingCreatedAt) {
     return {
         name,
         auth_mode: snapshot.auth_mode,
-        account_id: getSnapshotIdentity(snapshot),
+        account_id: getSnapshotAccountId(snapshot),
+        user_id: isSupportedChatGPTAuthMode(snapshot.auth_mode) ? getSnapshotUserId(snapshot) : void 0,
         created_at: existingCreatedAt ?? timestamp,
         updated_at: timestamp,
         last_switched_at: null,
@@ -189,6 +230,7 @@ function parseSnapshotMeta(raw) {
         name: asNonEmptyString(parsed.name, "name"),
         auth_mode: asNonEmptyString(parsed.auth_mode, "auth_mode"),
         account_id: asNonEmptyString(parsed.account_id, "account_id"),
+        user_id: asOptionalString(parsed.user_id, "user_id"),
         created_at: asNonEmptyString(parsed.created_at, "created_at"),
         updated_at: asNonEmptyString(parsed.updated_at, "updated_at"),
         last_switched_at: lastSwitchedAt,
@@ -217,11 +259,11 @@ const USER_AGENT = "codexm/0.1";
 function quota_client_isRecord(value) {
     return "object" == typeof value && null !== value && !Array.isArray(value);
 }
-function extractAuthClaim(payload) {
+function quota_client_extractAuthClaim(payload) {
     const value = payload["https://api.openai.com/auth"];
     return quota_client_isRecord(value) ? value : void 0;
 }
-function extractStringClaim(payload, key) {
+function quota_client_extractStringClaim(payload, key) {
     const value = payload[key];
     return "string" == typeof value && "" !== value.trim() ? value : void 0;
 }
@@ -234,7 +276,7 @@ function parsePlanType(snapshot) {
         const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
-            const authClaim = extractAuthClaim(payload);
+            const authClaim = quota_client_extractAuthClaim(payload);
             const planType = authClaim?.chatgpt_plan_type;
             if ("string" == typeof planType && "" !== planType.trim()) return planType;
         } catch  {}
@@ -258,7 +300,7 @@ function extractChatGPTAuth(snapshot) {
         const token = tokens[tokenName];
         if ("string" == typeof token && "" !== token.trim()) try {
             const payload = decodeJwtPayload(token);
-            const authClaim = extractAuthClaim(payload);
+            const authClaim = quota_client_extractAuthClaim(payload);
             if (!accountId) {
                 const maybeAccountId = authClaim?.chatgpt_account_id;
                 if ("string" == typeof maybeAccountId && "" !== maybeAccountId.trim()) accountId = maybeAccountId;
@@ -267,8 +309,8 @@ function extractChatGPTAuth(snapshot) {
                 const maybePlanType = authClaim?.chatgpt_plan_type;
                 if ("string" == typeof maybePlanType && "" !== maybePlanType.trim()) planType = maybePlanType;
             }
-            issuer ??= extractStringClaim(payload, "iss");
-            clientId ??= extractStringClaim(payload, "client_id") ?? extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
+            issuer ??= quota_client_extractStringClaim(payload, "iss");
+            clientId ??= quota_client_extractStringClaim(payload, "client_id") ?? quota_client_extractStringClaim(payload, "azp") ?? ("string" == typeof payload.aud ? payload.aud : void 0);
         } catch  {}
     }
     if (!supported) return {
@@ -538,6 +580,13 @@ async function pathExists(path) {
 async function readJsonFile(path) {
     return (0, promises_namespaceObject.readFile)(path, "utf8");
 }
+function canAutoMigrateLegacyChatGPTMeta(meta, snapshot) {
+    if (!isSupportedChatGPTAuthMode(meta.auth_mode) || !isSupportedChatGPTAuthMode(snapshot.auth_mode)) return false;
+    if ("string" == typeof meta.user_id && "" !== meta.user_id.trim()) return false;
+    const snapshotUserId = getSnapshotUserId(snapshot);
+    if (!snapshotUserId) return false;
+    return meta.account_id === getSnapshotAccountId(snapshot);
+}
 async function detectRunningCodexProcesses() {
     try {
         const { stdout } = await execFile("ps", [
@@ -635,6 +684,8 @@ class AccountStore {
         return {
             name: account.name,
             account_id: account.account_id,
+            user_id: account.user_id ?? null,
+            identity: account.identity,
             plan_type: planType,
             credits_balance: account.quota.credits_balance ?? null,
             status: account.quota.status,
@@ -675,11 +726,21 @@ class AccountStore {
             readJsonFile(metaPath),
             readAuthSnapshotFile(authPath)
         ]);
-        const meta = parseSnapshotMeta(rawMeta);
+        let meta = parseSnapshotMeta(rawMeta);
         if (meta.name !== name) throw new Error(`Account metadata name mismatch for "${name}".`);
-        if (meta.account_id !== getSnapshotIdentity(snapshot)) throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        const snapshotIdentity = getSnapshotIdentity(snapshot);
+        if (getMetaIdentity(meta) !== snapshotIdentity) if (canAutoMigrateLegacyChatGPTMeta(meta, snapshot)) {
+            meta = {
+                ...meta,
+                account_id: getSnapshotAccountId(snapshot),
+                user_id: getSnapshotUserId(snapshot)
+            };
+            await this.writeAccountMeta(name, meta);
+        } else throw new Error(`Account metadata account_id mismatch for "${name}".`);
+        if (getMetaIdentity(meta) !== snapshotIdentity) throw new Error(`Account metadata account_id mismatch for "${name}".`);
         return {
             ...meta,
+            identity: getMetaIdentity(meta),
             authPath,
             metaPath,
             configPath: await pathExists(this.accountConfigPath(name)) ? this.accountConfigPath(name) : null,
@@ -699,12 +760,12 @@ class AccountStore {
             warnings.push(`Account "${entry.name}" is invalid: ${error.message}`);
         }
         const counts = new Map();
-        for (const account of accounts)counts.set(account.account_id, (counts.get(account.account_id) ?? 0) + 1);
+        for (const account of accounts)counts.set(account.identity, (counts.get(account.identity) ?? 0) + 1);
         accounts.sort((left, right)=>left.name.localeCompare(right.name));
         return {
             accounts: accounts.map((account)=>({
                     ...account,
-                    duplicateAccountId: (counts.get(account.account_id) ?? 0) > 1
+                    duplicateAccountId: (counts.get(account.identity) ?? 0) > 1
                 })),
             warnings
         };
@@ -715,6 +776,8 @@ class AccountStore {
             exists: false,
             auth_mode: null,
             account_id: null,
+            user_id: null,
+            identity: null,
             matched_accounts: [],
             managed: false,
             duplicate_match: false,
@@ -722,11 +785,15 @@ class AccountStore {
         };
         const snapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
         const currentIdentity = getSnapshotIdentity(snapshot);
-        const matchedAccounts = accounts.filter((account)=>account.account_id === currentIdentity).map((account)=>account.name);
+        const currentAccountId = getSnapshotAccountId(snapshot);
+        const currentUserId = getSnapshotUserId(snapshot) ?? null;
+        const matchedAccounts = accounts.filter((account)=>account.identity === currentIdentity).map((account)=>account.name);
         return {
             exists: true,
             auth_mode: snapshot.auth_mode,
-            account_id: currentIdentity,
+            account_id: currentAccountId,
+            user_id: currentUserId,
+            identity: currentIdentity,
             matched_accounts: matchedAccounts,
             managed: matchedAccounts.length > 0,
             duplicate_match: matchedAccounts.length > 1,
@@ -744,9 +811,16 @@ class AccountStore {
         const authPath = this.accountAuthPath(name);
         const metaPath = this.accountMetaPath(name);
         const configPath = this.accountConfigPath(name);
+        const identity = getSnapshotIdentity(snapshot);
         const accountExists = await pathExists(accountDir);
         const existingMeta = accountExists && await pathExists(metaPath) ? parseSnapshotMeta(await readJsonFile(metaPath)) : void 0;
         if (accountExists && !force) throw new Error(`Account "${name}" already exists. Use --force to overwrite it.`);
+        const { accounts } = await this.listAccounts();
+        const duplicateIdentityAccounts = accounts.filter((account)=>account.name !== name && account.identity === identity);
+        if (duplicateIdentityAccounts.length > 0) {
+            const joinedNames = duplicateIdentityAccounts.map((account)=>`"${account.name}"`).join(", ");
+            throw new Error(`Identity ${identity} is already managed by ${joinedNames}.`);
+        }
         this.validateConfigSnapshot(name, snapshot, rawConfig);
         await ensureDirectory(accountDir, DIRECTORY_MODE);
         await atomicWriteFile(authPath, `${rawSnapshot.trimEnd()}\n`);
@@ -817,7 +891,7 @@ class AccountStore {
             await atomicWriteFile(this.paths.currentConfigPath, this.sanitizeConfigForAccountAuth(currentRawConfig));
         }
         const writtenSnapshot = await readAuthSnapshotFile(this.paths.currentAuthPath);
-        if (getSnapshotIdentity(writtenSnapshot) !== account.account_id) throw new Error(`Switch verification failed for account "${name}".`);
+        if (getSnapshotIdentity(writtenSnapshot) !== account.identity) throw new Error(`Switch verification failed for account "${name}".`);
         const meta = parseSnapshotMeta(await readJsonFile(account.metaPath));
         meta.last_switched_at = new Date().toISOString();
         meta.updated_at = meta.last_switched_at;
@@ -861,7 +935,8 @@ class AccountStore {
                 await this.syncCurrentAuthIfMatching(result.authSnapshot);
             }
             meta.auth_mode = result.authSnapshot.auth_mode;
-            meta.account_id = getSnapshotIdentity(result.authSnapshot);
+            meta.account_id = getSnapshotAccountId(result.authSnapshot);
+            meta.user_id = getSnapshotUserId(result.authSnapshot);
             meta.updated_at = now.toISOString();
             meta.quota = result.quota;
             await this.writeAccountMeta(name, meta);
@@ -974,7 +1049,7 @@ class AccountStore {
             if ((511 & authStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" auth permissions must be 600.`);
             if ((511 & metaStat.mode) !== FILE_MODE) issues.push(`Account "${account.name}" metadata permissions must be 600.`);
             if ("apikey" === account.auth_mode && !account.configPath) issues.push(`Account "${account.name}" is missing config.toml snapshot required for apikey auth.`);
-            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.account_id} with another saved account.`);
+            if (account.duplicateAccountId) warnings.push(`Account "${account.name}" shares identity ${account.identity} with another saved account.`);
         }
         let currentAuthPresent = false;
         if (await pathExists(this.paths.currentAuthPath)) {
@@ -1042,12 +1117,10 @@ Usage:
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
   codexm update [--json]
-  codexm quota refresh [name] [--json]
   codexm switch <name> [--json]
   codexm switch --auto [--dry-run] [--json]
   codexm remove <name> [--yes] [--json]
   codexm rename <old> <new> [--json]
-  codexm doctor [--json]
 
 Account names must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.
 `);
@@ -1057,7 +1130,7 @@ function describeCurrentStatus(status) {
     if (status.exists) {
         lines.push("Current auth: present");
         lines.push(`Auth mode: ${status.auth_mode}`);
-        lines.push(`Identity: ${maskAccountId(status.account_id ?? "")}`);
+        lines.push(`Identity: ${maskAccountId(status.identity ?? "")}`);
         if (0 === status.matched_accounts.length) lines.push("Managed account: no (unmanaged)");
         else if (1 === status.matched_accounts.length) lines.push(`Managed account: ${status.matched_accounts[0]}`);
         else lines.push(`Managed account: multiple (${status.matched_accounts.join(", ")})`);
@@ -1065,16 +1138,6 @@ function describeCurrentStatus(status) {
     for (const warning of status.warnings)lines.push(`Warning: ${warning}`);
     return lines.join("\n");
 }
-function describeDoctor(report) {
-    const lines = [
-        report.healthy ? "Doctor checks passed." : "Doctor checks found issues.",
-        `Saved accounts: ${report.account_count}`,
-        `Current auth present: ${report.current_auth_present ? "yes" : "no"}`
-    ];
-    for (const issue of report.issues)lines.push(`Issue: ${issue}`);
-    for (const warning of report.warnings)lines.push(`Warning: ${warning}`);
-    return lines.join("\n");
-}
 function formatUsagePercent(window) {
     if (!window) return "-";
     return `${window.used_percent}%`;
@@ -1120,6 +1183,7 @@ function toAutoSwitchCandidate(account) {
     return {
         name: account.name,
         account_id: account.account_id,
+        identity: account.identity,
         plan_type: account.plan_type,
         available: computeAvailability(account),
         refresh_status: "ok",
@@ -1152,7 +1216,7 @@ function rankAutoSwitchCandidates(accounts) {
 }
 function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
     const lines = [
-        dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.account_id)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.account_id)}).`,
+        dryRun ? `Best account: "${candidate.name}" (${maskAccountId(candidate.identity)}).` : `Auto-switched to "${candidate.name}" (${maskAccountId(candidate.identity)}).`,
         `Score: ${candidate.effective_score}`,
         `5H remaining: ${candidate.remain_5h}%`,
         `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1163,7 +1227,7 @@ function describeAutoSwitchSelection(candidate, dryRun, backupPath, warnings) {
 }
 function describeAutoSwitchNoop(candidate, warnings) {
     const lines = [
-        `Current account "${candidate.name}" (${maskAccountId(candidate.account_id)}) is already the best available account.`,
+        `Current account "${candidate.name}" (${maskAccountId(candidate.identity)}) is already the best available account.`,
         `Score: ${candidate.effective_score}`,
         `5H remaining: ${candidate.remain_5h}%`,
         `1W remaining (5H-equivalent): ${candidate.remain_1w_eq_5h}%`
@@ -1175,7 +1239,7 @@ function describeQuotaAccounts(accounts, warnings) {
     if (0 === accounts.length) return 0 === warnings.length ? "No saved accounts." : warnings.map((warning)=>`Warning: ${warning}`).join("\n");
     const table = formatTable(accounts.map((account)=>({
             name: account.name,
-            account_id: maskAccountId(account.account_id),
+            account_id: maskAccountId(account.identity),
             plan_type: account.plan_type ?? "-",
             available: computeAvailability(account) ?? "-",
             five_hour: formatUsagePercent(account.five_hour),
@@ -1300,11 +1364,13 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: account.name,
                             account_id: account.account_id,
+                            user_id: account.user_id ?? null,
+                            identity: account.identity,
                             auth_mode: account.auth_mode
                         }
                     };
                     if (json) writeJson(streams.stdout, payload);
-                    else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.account_id)}).\n`);
+                    else streams.stdout.write(`Saved account "${account.name}" (${maskAccountId(account.identity)}).\n`);
                     return 0;
                 }
             case "update":
@@ -1326,6 +1392,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: result.account.name,
                             account_id: result.account.account_id,
+                            user_id: result.account.user_id ?? null,
+                            identity: result.account.identity,
                             auth_mode: result.account.auth_mode
                         },
                         quota,
@@ -1333,23 +1401,11 @@ async function runCli(argv, options = {}) {
                     };
                     if (json) writeJson(streams.stdout, payload);
                     else {
-                        streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                        streams.stdout.write(`Updated managed account "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                         for (const warning of warnings)streams.stdout.write(`Warning: ${warning}\n`);
                     }
                     return 0;
                 }
-            case "quota":
-                {
-                    const quotaCommand = parsed.positionals[0];
-                    if ("refresh" === quotaCommand) {
-                        const targetName = parsed.positionals[1];
-                        const result = await store.refreshAllQuotas(targetName);
-                        if (json) writeJson(streams.stdout, toCliQuotaRefreshResult(result));
-                        else streams.stdout.write(`${describeQuotaRefresh(result)}\n`);
-                        return 0 === result.failures.length ? 0 : 1;
-                    }
-                    throw new Error("Usage: codexm quota refresh [name] [--json]");
-                }
             case "switch":
                 {
                     const auto = parsed.flags.has("--auto");
@@ -1388,7 +1444,8 @@ async function runCli(argv, options = {}) {
                                 reason: "already_current_best",
                                 account: {
                                     name: selected.name,
-                                    account_id: selected.account_id
+                                    account_id: selected.account_id,
+                                    identity: selected.identity
                                 },
                                 selected,
                                 candidates,
@@ -1408,6 +1465,8 @@ async function runCli(argv, options = {}) {
                             account: {
                                 name: result.account.name,
                                 account_id: result.account.account_id,
+                                user_id: result.account.user_id ?? null,
+                                identity: result.account.identity,
                                 auth_mode: result.account.auth_mode
                             },
                             selected,
@@ -1437,6 +1496,8 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: result.account.name,
                             account_id: result.account.account_id,
+                            user_id: result.account.user_id ?? null,
+                            identity: result.account.identity,
                             auth_mode: result.account.auth_mode
                         },
                         quota,
@@ -1445,7 +1506,7 @@ async function runCli(argv, options = {}) {
                     };
                     if (json) writeJson(streams.stdout, payload);
                     else {
-                        streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.account_id)}).\n`);
+                        streams.stdout.write(`Switched to "${result.account.name}" (${maskAccountId(result.account.identity)}).\n`);
                         if (result.backup_path) streams.stdout.write(`Backup: ${result.backup_path}\n`);
                         for (const warning of result.warnings)streams.stdout.write(`Warning: ${warning}\n`);
                     }
@@ -1487,19 +1548,14 @@ async function runCli(argv, options = {}) {
                         account: {
                             name: account.name,
                             account_id: account.account_id,
+                            user_id: account.user_id ?? null,
+                            identity: account.identity,
                             auth_mode: account.auth_mode
                         }
                     });
                     else streams.stdout.write(`Renamed "${oldName}" to "${newName}".\n`);
                     return 0;
                 }
-            case "doctor":
-                {
-                    const report = await store.doctor();
-                    if (json) writeJson(streams.stdout, report);
-                    else streams.stdout.write(`${describeDoctor(report)}\n`);
-                    return report.healthy ? 0 : 1;
-                }
             default:
                 throw new Error(`Unknown command "${parsed.command}".`);
         }