dsh-codex-oauth 0.2.7 → 0.3.0

package/client/index.jsx

@@ -1,53 +1,101 @@
 import React, { useCallback, useEffect, useState } from "react";
 
-const STATUS = "/plugins/dsh-codex-oauth/auth/status";
-const LOGIN = "/plugins/dsh-codex-oauth/auth/login";
-const LOGOUT = "/plugins/dsh-codex-oauth/auth/logout";
+const BASE = "/plugins/dsh-codex-oauth/auth";
 const h = React.createElement;
-
 async function request(path, method = "GET") {
-  const response = await fetch(path, { method, credentials: "same-origin", headers: { accept: "application/json" } });
+  const response = await fetch(`${BASE}/${path}`, { method, credentials: "same-origin", headers: { accept: "application/json" } });
   const value = await response.json().catch(() => ({}));
-  if (!response.ok) throw new Error(value && typeof value === "object" && typeof value.error === "string" ? value.error : `HTTP ${response.status}`);
+  if (!response.ok) throw new Error(typeof value.error === "string" ? value.error : `HTTP ${response.status}`);
   return value;
 }
-
+function QuotaPanel({ quota }) {
+  if (!quota?.available) return h("div", { role: "status" }, "Quota unavailable. No current quota data is available.");
+  return h("div", { style: { display: "flex", flexDirection: "column", gap: 12 } },
+    ...quota.buckets.map((bucket) => h("section", { key: bucket.id },
+      h("strong", null, bucket.name ?? bucket.id),
+      ...bucket.windows.map((window, index) => {
+        const remaining = Math.round(window.remainingPercent);
+        const color = window.stale ? "#888" : remaining <= 10 ? "#c44" : remaining <= 30 ? "#b88020" : "#38875c";
+        return h("div", { key: index, style: { marginTop: 8 } },
+          h("div", null, `${window.label}: ${remaining}% remaining${window.stale ? " (stale)" : ""}`),
+          h("div", { role: "progressbar", "aria-label": `${window.label} quota remaining`, "aria-valuemin": 0, "aria-valuemax": 100, "aria-valuenow": window.remainingPercent,
+            style: { height: 7, background: "var(--dsw-alias-border-l2)", borderRadius: 4, marginTop: 4 } },
+            h("div", { style: { width: `${window.remainingPercent}%`, height: "100%", background: color, borderRadius: 4 } })),
+          h("small", null, window.resetsAt ? `Reset: ${new Date(window.resetsAt * 1000).toLocaleString("en-US")}` : "Reset time unavailable"),
+          h("small", { style: { display: "block" } }, `Updated: ${new Date(window.checkedAt).toLocaleString("en-US")}`));
+      }))),
+    h("small", null, "Quota checks do not call a model."));
+}
 function CodexSettings() {
   const [state, setState] = useState({ status: "loading" });
   const [busy, setBusy] = useState(false);
-  const refresh = useCallback(() => request(STATUS).then(setState).catch((error) => setState({ status: "error", message: error.message })), []);
+  const [notice, setNotice] = useState("");
+  const refresh = useCallback(() => request("status").then(setState).catch((error) => setState({ status: "error", message: error.message })), []);
   useEffect(() => { refresh(); }, [refresh]);
   useEffect(() => {
     if (state.status !== "signing-in") return undefined;
     const timer = setInterval(refresh, 1000);
     return () => clearInterval(timer);
   }, [refresh, state.status]);
-  const signIn = async () => {
+  const signIn = async (newAccount = false) => {
     const popup = window.open("about:blank", "_blank");
-    if (!popup) { setState({ status: "error", message: "Please allow popups to sign in" }); return; }
+    if (!popup) { setState({ ...state, status: "error", message: "Allow pop-ups to complete sign-in." }); return; }
     popup.opener = null;
-    setBusy(true); setState({ status: "signing-in" });
+    setBusy(true); setState({ ...state, status: "signing-in" }); setNotice("");
+    try { const challenge = await request(`login${newAccount ? "?new_account=1" : ""}`, "POST"); popup.location.replace(challenge.url); }
+    catch (error) { popup.close(); setState({ ...state, status: "error", message: error.message }); }
+    finally { setBusy(false); }
+  };
+  const signOut = async () => {
+    setBusy(true);
     try {
-      const challenge = await request(LOGIN, "POST");
-      popup.location.replace(challenge.url);
-    } catch (error) {
-      popup?.close();
-      setState({ status: "error", message: error.message });
-    } finally { setBusy(false); }
+      const result = await request("logout", "POST");
+      if (!result.remoteRevoked) setNotice("Signed out locally. Remote revocation was not confirmed; disconnect the app in ChatGPT usage settings.");
+      await refresh();
+    } catch (error) { setState({ ...state, status: "error", message: error.message }); }
+    finally { setBusy(false); }
+  };
+  const selectAccount = async (clientId) => {
+    setBusy(true); setNotice("");
+    try { setState(await request(`account?client_id=${encodeURIComponent(clientId)}`, "POST")); }
+    catch (error) { setState({ ...state, status: "error", message: error.message }); }
+    finally { setBusy(false); }
   };
-  const signOut = async () => { setBusy(true); try { await request(LOGOUT, "POST"); setState({ status: "signed-out" }); } catch (error) { setState({ status: "error", message: error.message }); } finally { setBusy(false); } };
-  const signedIn = state.status === "signed-in";
-  const label = state.status === "signed-in" ? "已登录" : state.status === "signing-in" ? "等待浏览器完成登录…" : state.status === "loading" ? "检查登录状态…" : state.status === "error" ? "登录失败" : "未登录";
+  const refreshModels = async () => {
+    setBusy(true);
+    try { const { models } = await request("models", "POST"); setNotice(`Refreshed ${models.length} available models.`); }
+    catch (error) { setNotice(error.message); }
+    finally { setBusy(false); }
+  };
+  const signedIn = state.authenticated && state.planUsage;
+  useEffect(() => {
+    if (!signedIn) return undefined;
+    const timer = setInterval(refresh, 30_000);
+    return () => clearInterval(timer);
+  }, [signedIn, refresh]);
+  const signingIn = state.status === "signing-in";
+  const label = signingIn ? "Waiting for browser sign-in…" : signedIn ? `Signed in${state.label ? `: ${state.label}` : ""}`
+    : state.status === "loading" ? "Checking sign-in status…" : state.authenticated ? "Signed in; ChatGPT plan usage is not authorized" : "Signed out";
   return h("section", { style: { display: "flex", flexDirection: "column", gap: 12, maxWidth: 640 } },
     h("h2", { style: { margin: 0 } }, "OpenAI Codex"),
-    h("p", { style: { margin: 0, color: "var(--dsw-alias-label-secondary)" } }, "使用 ChatGPT Plus/Pro 的 Codex 订阅，无需 OpenAI API Key。"),
-    h("div", { style: { display: "flex", alignItems: "center", justifyContent: "space-between", padding: 16, border: "1px solid var(--dsw-alias-border-l2)", borderRadius: 10 } },
+    h("p", { style: { margin: 0 } }, "Use your ChatGPT plan without an OpenAI API key. Models are provided by the active account."),
+    h("div", { style: { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 12, padding: 16, border: "1px solid var(--dsw-alias-border-l2)", borderRadius: 10 } },
       h("span", null, label),
-      state.status === "loading" ? null : h("button", { type: "button", disabled: busy || state.status === "signing-in", onClick: signedIn ? signOut : signIn }, signedIn ? "退出登录" : "使用 ChatGPT 登录")),
+      state.status === "loading" ? null : h("button", { type: "button", disabled: busy, onClick: signedIn || signingIn ? signOut : () => signIn() }, signedIn ? "Sign out" : signingIn ? "Cancel sign-in" : "Continue with ChatGPT")),
+    state.accounts?.length ? h("div", { style: { display: "flex", gap: 8 } },
+      h("select", { "aria-label": "ChatGPT account", disabled: busy || signingIn, value: state.accounts.find((account) => account.active)?.clientId ?? "", onChange: (event) => selectAccount(event.target.value) },
+        ...state.accounts.map((account) => h("option", { key: account.clientId, value: account.clientId }, `${account.label}${account.authenticated ? "" : " (signed out)"}`))),
+      h("button", { type: "button", disabled: busy || signingIn, onClick: () => signIn(true) }, "Add account")) : null,
+    state.authenticated && !state.planUsage && !signingIn ? h("button", { type: "button", disabled: busy, onClick: signOut }, "Sign out") : null,
+    signedIn && !signingIn ? h("div", { style: { display: "flex", alignItems: "center", gap: 12 } },
+      h("span", null, "Using ChatGPT plan"),
+      h("a", { href: "https://chatgpt.com/settings/usage", target: "_blank", rel: "noopener noreferrer" }, "Manage usage"),
+      h("button", { type: "button", disabled: busy, onClick: refreshModels }, "Refresh models")) : null,
+    signedIn ? h(QuotaPanel, { quota: state.quota }) : null,
     state.status === "error" ? h("p", { style: { color: "var(--dsw-alias-state-error-primary)" } }, state.message) : null,
+    notice ? h("p", { role: "status" }, notice) : null,
   );
 }
-
 export const name = "dsh-codex-oauth-client";
 export const inject = ["slots"];
 export function apply(ctx) {

package/lib/adapter.js

@@ -1,44 +1,131 @@
-import { createModels } from "@earendil-works/pi-ai";
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
-import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
-import { OPENAI_CODEX_PROVIDER } from "./store.js";
+import { LlmAdapter, LlmError, resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { getCredential } from "./auth.js";
+import { CodexModelCatalog } from "./models.js";
+import { OPENAI_CODEX_PROVIDER, authPath } from "./store.js";
+import { openaiFetch, OPENAI_API, readJSON, responseError } from "./openai-http.js";
+import { responsesRequest } from "./responses-request.js";
+import { readSSE, responsesStream } from "./responses-stream.js";
+import { QuotaTracker, quotaHeaders, quotaEvent } from "./quota.js";
+import { CodexQuotaLookup } from "./quota-lookup.js";
 
 const STREAM_IDLE_TIMEOUT_MS = 300_000;
-
-function tokenProvider(provider) {
-  return {
-    ...provider,
-    auth: {
-      ...provider.auth,
-      apiKey: {
-        name: "OpenAI Codex OAuth bearer token",
-        async resolve({ credential }) {
-          const access = credential?.access ?? credential?.key;
-          return access
-            ? { auth: { apiKey: access }, source: "DSH Codex OAuth" }
-            : undefined;
-        },
-      },
-    },
-  };
-}
-
-export function createCodexAdapter(credentials, resolveAttachments) {
-  const provider = openaiCodexProvider();
-  const profiles = new Map([[OPENAI_CODEX_PROVIDER, {
-    provider: OPENAI_CODEX_PROVIDER,
-    displayName: "OpenAI Codex",
-    streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
-    retryPolicy: resolveRetryPolicy(undefined, "dsh-codex-oauth retryPolicy"),
-    configuredMaxTokens: new Map(),
-    piProvider: tokenProvider(provider),
-  }]]);
-  const models = createModels({ credentials });
-  models.setProvider(provider);
-  return new PiAiAdapter({
-    profiles: () => profiles,
-    resolveApiKey: async () => (await models.getAuth(OPENAI_CODEX_PROVIDER))?.auth.apiKey,
-    resolveAttachments,
-  });
+export class CodexAdapter extends LlmAdapter {
+  #active = new Set();
+  #requestSequence = 0;
+  constructor(credentials, resolveAttachments, options = {}) {
+    super();
+    this.credentials = credentials;
+    this.resolveAttachments = resolveAttachments;
+    this.options = options;
+    this.quotas = new QuotaTracker();
+    this.quotaLookup = new CodexQuotaLookup(credentials.filename ?? authPath(), { fetch: options.fetch, now: options.now });
+    this.catalog = new CodexModelCatalog(credentials, options);
+    this.retryPolicy = resolveRetryPolicy(undefined, "dsh-codex-oauth retryPolicy");
+    this.unsubscribe = credentials.subscribe((state) => {
+      this.quotas.accountChanged(state);
+      this.quotaLookup.reset();
+      this.catalog.invalidate();
+      for (const request of this.#active) if (!state.authenticated || request.clientId !== state.clientId) request.controller.abort(new LlmError("ChatGPT account changed or signed out", "ABORTED"));
+      options.onModelsChanged?.();
+    });
+  }
+  providerInfo(provider) { this.assertProvider(provider); return { id: provider, name: "OpenAI Codex (ChatGPT plan)" }; }
+  providerRetryPolicy(provider) { this.assertProvider(provider); return this.retryPolicy; }
+  assertProvider(provider) { if (provider !== OPENAI_CODEX_PROVIDER) throw new LlmError("Codex adapter does not own this provider", "NO_ADAPTER"); }
+  async listModels(provider, options) { this.assertProvider(provider); return this.catalog.list(options); }
+  async resolveModel(provider, model, signal) { this.assertProvider(provider); return this.catalog.resolve(model, signal); }
+  async quotaSnapshot() {
+    const document = await this.credentials.readDocument();
+    const account = document?.registrations.find((entry) => entry.clientId === document.activeClientId);
+    if (!account?.access) { this.quotas.clear(); this.quotaLookup.reset(); return this.quotas.snapshot(); }
+    const binding = { clientId: document.activeClientId, generation: document.generation ?? 0 };
+    this.quotas.activate(binding);
+    const passive = this.quotas.snapshot();
+    if (passive.available && passive.buckets.every((bucket) => bucket.windows.every((window) => !window.stale))) return passive;
+    const queried = await this.quotaLookup.snapshot(account, binding);
+    const current = await this.credentials.readDocument();
+    if (current?.activeClientId !== binding.clientId || (current?.generation ?? 0) !== binding.generation || !current?.registrations.find((entry) => entry.clientId === binding.clientId)?.access) {
+      this.quotaLookup.reset(); return { available: false, buckets: [] };
+    }
+    return queried.available ? queried : this.quotas.snapshot();
+  }
+  async prepareCall(provider, model, signal) {
+    const initial = await this.credentials.readDocument();
+    const info = await this.resolveModel(provider, model, signal);
+    const document = await this.credentials.readDocument();
+    if (document?.activeClientId !== initial?.activeClientId || (document?.generation ?? 0) !== (initial?.generation ?? 0)) throw new LlmError("The selected ChatGPT account changed during call preparation", "AUTH");
+    const binding = { clientId: document?.activeClientId, generation: document?.generation ?? 0, model, info };
+    return { model: info, stream: (options) => this.streamPrepared(options, binding) };
+  }
+  async *stream(options) {
+    const prepared = await this.prepareCall(options.provider, options.model, options.signal);
+    yield* prepared.stream(options);
+  }
+  async *streamPrepared(options, binding) {
+    this.assertProvider(options.provider);
+    if (options.model !== binding.model) throw new LlmError("Prepared Codex model does not match the request", "INVALID_REQUEST");
+    const controller = new AbortController();
+    const signal = AbortSignal.any([...(options.signal ? [options.signal] : []), controller.signal]);
+    let watchdog;
+    const activity = () => {
+      clearTimeout(watchdog);
+      watchdog = setTimeout(() => controller.abort(new LlmError("OpenAI stream idle timeout", "TIMEOUT")), this.options.streamIdleTimeoutMs ?? STREAM_IDLE_TIMEOUT_MS);
+      watchdog.unref?.();
+    };
+    const request = { controller, clientId: binding.clientId };
+    this.#active.add(request);
+    try {
+      const document = await this.credentials.readDocument();
+      if (document?.activeClientId !== binding.clientId || (document?.generation ?? 0) !== binding.generation) throw new LlmError("The selected ChatGPT account changed after call preparation", "AUTH");
+      const credential = await getCredential(this.credentials, { ...this.options, clientId: binding.clientId, signal });
+      const attachments = this.resolveAttachments?.();
+      const resolveAccess = (ref, hostPath) => {
+        if (!hostPath) return attachments?.imageHostPath ? resolveImageAttachmentAccess(attachments, (path) => this.options.mapHostPath?.(path), ref) : undefined;
+        const readonlyPath = this.options.mapHostPath?.(hostPath);
+        return readonlyPath ? { readonlyPath } : undefined;
+      };
+      const { body, names } = await responsesRequest({ ...options, signal }, binding, attachments, resolveAccess);
+      signal.throwIfAborted();
+      const current = await this.credentials.readDocument();
+      if (current?.activeClientId !== binding.clientId || (current?.generation ?? 0) !== binding.generation) throw new LlmError("The selected ChatGPT account changed during request preparation", "AUTH");
+      // The ChatGPT plan gateway needs stable session headers to reuse its
+      // prompt cache, including the summarizer's calls within the same session.
+      const sessionHeaders = options.sessionId === undefined ? {} : {
+        "session-id": String(options.sessionId), "x-client-request-id": String(options.sessionId),
+      };
+      this.quotas.activate(binding);
+      const sequence = ++this.#requestSequence;
+      activity();
+      const response = await openaiFetch(`${OPENAI_API}/responses`, {
+        method: "POST", signal, headers: { authorization: `Bearer ${credential.access}`, "content-type": "application/json", accept: "text/event-stream", ...sessionHeaders }, body: JSON.stringify(body),
+      }, this.options.fetch);
+      this.quotas.update(binding, quotaHeaders(response.headers), sequence);
+      if (!response.ok) throw responseError(await readJSON(response), response.status, response.headers, [credential.access]);
+      // The ChatGPT plan route can omit Content-Type on a valid SSE response.
+      const contentType = response.headers.get("content-type");
+      if (contentType && !contentType.startsWith("text/event-stream")) throw new LlmError("OpenAI did not return an event stream", "INVALID_RESPONSE");
+      const quotas = this.quotas;
+      async function* observedEvents() {
+        for await (const event of readSSE(response.body, signal, activity)) {
+          quotas.update(binding, quotaEvent(event), sequence);
+          yield event;
+        }
+      }
+      yield* responsesStream(observedEvents(), binding, names, response.headers);
+    } catch (error) {
+      if (signal.aborted) throw signal.reason;
+      throw error;
+    } finally {
+      clearTimeout(watchdog);
+      this.#active.delete(request);
+      controller.abort(new LlmError("OpenAI request finished", "ABORTED"));
+    }
+  }
+  dispose() {
+    this.quotaLookup.dispose();
+    this.unsubscribe();
+    for (const request of this.#active) request.controller.abort(new LlmError("Codex adapter disposed", "ABORTED"));
+    this.#active.clear();
+  }
 }
+export function createCodexAdapter(credentials, resolveAttachments, options) { return new CodexAdapter(credentials, resolveAttachments, options); }

package/lib/auth.js

@@ -1,21 +1,240 @@
-import { createModels } from "@earendil-works/pi-ai";
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-import { CodexCredentialStore, OPENAI_CODEX_PROVIDER, authPath } from "./store.js";
+import { createHash, createPublicKey, randomBytes, timingSafeEqual, verify } from "node:crypto";
+import { createServer } from "node:http";
+import { LlmError } from "@deepseek-ai/dsh-llm";
+import { activeRegistration, clearTokens, CodexCredentialStore, OPENAI_CODEX_PROVIDER, authPath } from "./store.js";
+import { fetchJSON, openaiFetch, OPENAI_API, OPENAI_ISSUER, responseError, readJSON } from "./openai-http.js";
 
-function models(store) {
-  const value = createModels({ credentials: store });
-  value.setProvider(openaiCodexProvider());
+const SCOPES = "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct";
+const TERMINAL_REFRESH_ERRORS = new Set(["invalid_grant", "invalid_refresh_token", "token_expired", "refresh_token_expired", "refresh_token_invalidated", "refresh_token_reused"]);
+const random = () => randomBytes(32).toString("base64url");
+const same = (left, right) => typeof left === "string" && typeof right === "string" && Buffer.byteLength(left) === Buffer.byteLength(right)
+  && timingSafeEqual(Buffer.from(left), Buffer.from(right));
+const nowOf = (options) => options.now?.() ?? Date.now();
+
+async function metadata(options) {
+  const value = await fetchJSON(`${OPENAI_ISSUER}/.well-known/openid-configuration`, { signal: options.signal }, options.fetch);
+  if (value.issuer !== OPENAI_ISSUER) throw new Error("OpenAI discovery returned an unexpected issuer");
+  for (const field of ["jwks_uri", "revocation_endpoint"]) {
+    const url = new URL(value[field]);
+    if (url.origin !== OPENAI_ISSUER) throw new Error("OpenAI discovery returned an unexpected endpoint");
+  }
   return value;
 }
 
-export async function login(store = new CodexCredentialStore(), interaction) {
-  await models(store).login(OPENAI_CODEX_PROVIDER, "oauth", interaction);
+async function validateIdentity(token, clientId, options, nonce, subject) {
+  if (typeof token !== "string") throw new Error("OpenAI did not return an ID token");
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new Error("OpenAI returned an invalid ID token");
+  let header, claims;
+  try {
+    header = JSON.parse(Buffer.from(parts[0], "base64url").toString());
+    claims = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+  } catch { throw new Error("OpenAI returned an invalid ID token"); }
+  if (header.alg !== "RS256" || typeof header.kid !== "string" || header.crit !== undefined) throw new Error("Unsupported OpenAI ID-token signature");
+  const discovery = await metadata(options);
+  const jwks = await fetchJSON(discovery.jwks_uri, { signal: options.signal }, options.fetch);
+  const key = jwks.keys?.find((key) => key.kid === header.kid && key.kty === "RSA" && (!key.use || key.use === "sig") && (!key.alg || key.alg === "RS256"));
+  if (!key || !verify("RSA-SHA256", Buffer.from(`${parts[0]}.${parts[1]}`), createPublicKey({ key, format: "jwk" }), Buffer.from(parts[2], "base64url"))) {
+    throw new Error("OpenAI ID-token signature validation failed");
+  }
+  const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+  const now = nowOf(options) / 1000;
+  if (claims.iss !== OPENAI_ISSUER || !audiences.includes(clientId) || (audiences.length > 1 && claims.azp !== clientId) || (claims.azp !== undefined && claims.azp !== clientId)
+    || !Number.isFinite(claims.exp) || claims.exp <= now || (claims.nbf !== undefined && (!Number.isFinite(claims.nbf) || claims.nbf > now + 30))
+    || typeof claims.sub !== "string" || !claims.sub || (nonce !== undefined && !same(claims.nonce, nonce))
+    || (subject !== undefined && claims.sub !== subject)) throw new Error("OpenAI ID-token identity validation failed");
+  return { subject: claims.sub, issuer: claims.iss, ...(typeof claims.email === "string" ? { email: claims.email } : {}) };
+}
+
+function tokenFields(token, options, previous) {
+  if (typeof token.access_token !== "string" || !token.access_token || !Number.isFinite(token.expires_in) || token.expires_in <= 0
+    || String(token.token_type).toLowerCase() !== "bearer") throw new Error("OpenAI returned an invalid token response");
+  if (token.refresh_token !== undefined && (typeof token.refresh_token !== "string" || !token.refresh_token)) throw new Error("OpenAI returned an invalid refresh token");
+  if (token.scope !== undefined && typeof token.scope !== "string") throw new Error("OpenAI returned invalid granted scopes");
+  const scopes = token.scope === undefined ? previous?.scopes ?? [] : token.scope.split(/\s+/).filter(Boolean);
+  if (scopes.includes("offline_access") && !token.refresh_token) throw new Error("OpenAI did not return a rotating refresh token");
+  const earliest = typeof token.earliest_refresh_at === "number"
+    ? token.earliest_refresh_at * (token.earliest_refresh_at < 1e12 ? 1000 : 1)
+    : Date.parse(token.earliest_refresh_at);
+  return {
+    access: token.access_token,
+    ...(token.refresh_token ? { refresh: token.refresh_token } : {}),
+    expires: nowOf(options) + token.expires_in * 1000,
+    scopes,
+    ...(Number.isFinite(earliest) ? { earliestRefreshAt: earliest } : {}),
+  };
+}
+
+async function callbackListener(state, requestedClientId, signal, port) {
+  let resolveCallback, rejectCallback;
+  const callback = new Promise((resolve, reject) => { resolveCallback = resolve; rejectCallback = reject; });
+  // Attach a handler immediately: cancellation can precede the caller awaiting the callback.
+  callback.catch(() => {});
+  const server = createServer((req, res) => {
+    const reply = (status, text) => { res.writeHead(status, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" }); res.end(text); };
+    let url;
+    try { url = new URL(req.url, "http://127.0.0.1"); }
+    catch { return reply(400, "Invalid callback URL"); }
+    if (req.method !== "GET" || url.pathname !== "/auth/callback") return reply(404, "Not found");
+    if (!same(url.searchParams.get("state"), state)) return reply(400, "Invalid OAuth state");
+    if (url.searchParams.has("error")) {
+      reply(400, "ChatGPT authorization was not completed. Return to DSH.");
+      rejectCallback(new Error("ChatGPT authorization was declined or could not be completed"));
+      return;
+    }
+    const clientId = url.searchParams.get("client_id") ?? requestedClientId;
+    if (!clientId || clientId === "dynamic_agent_client" || (requestedClientId && clientId !== requestedClientId) || !url.searchParams.get("code")) {
+      reply(400, "Invalid OAuth registration result");
+      rejectCallback(new Error("OpenAI returned an incomplete or mismatched registration"));
+      return;
+    }
+    reply(200, "Authorization received. Return to DSH to check that sign-in completed.");
+    resolveCallback({ clientId, code: url.searchParams.get("code") });
+  });
+  server.requestTimeout = 10_000;
+  server.headersTimeout = 10_000;
+  const abort = () => { rejectCallback(signal.reason); server.close(); server.closeAllConnections(); };
+  signal.addEventListener("abort", abort, { once: true });
+  try {
+    const listen = (listenPort) => new Promise((resolve, reject) => {
+      const error = (error) => { server.off("listening", ready); reject(error); };
+      const ready = () => { server.off("error", error); resolve(); };
+      server.once("error", error); server.once("listening", ready); server.listen(listenPort, "127.0.0.1");
+    });
+    signal.throwIfAborted();
+    try { await listen(port ?? 1455); }
+    catch (error) { if (error.code !== "EADDRINUSE" || port !== undefined) throw error; await listen(0); }
+    signal.throwIfAborted();
+    return {
+      redirectUri: `http://127.0.0.1:${server.address().port}/auth/callback`,
+      callback,
+      close() { signal.removeEventListener("abort", abort); server.close(); server.closeAllConnections(); },
+    };
+  } catch (error) { signal.removeEventListener("abort", abort); server.close(); throw error; }
+}
+
+export async function login(store = new CodexCredentialStore(), interaction = {}, options = {}) {
+  const signal = AbortSignal.any([...(interaction.signal ? [interaction.signal] : []), ...(options.signal ? [options.signal] : []), AbortSignal.timeout(10 * 60_000)]);
+  options = { ...options, signal };
+  const document = await store.initialize();
+  const selected = options.newAccount ? undefined : activeRegistration(document);
+  const state = random(), nonce = random(), verifier = random();
+  const listener = await callbackListener(state, selected?.clientId, signal, options.callbackPort);
+  try {
+    const url = new URL(`${OPENAI_ISSUER}/api/accounts/authorize`);
+    url.search = new URLSearchParams({
+      client_id: selected?.clientId ?? "dynamic_agent_client",
+      ext_agent_host_id: document.hostId,
+      response_type: "code", redirect_uri: listener.redirectUri, scope: SCOPES, resource: OPENAI_API,
+      state, nonce, code_challenge_method: "S256", code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+      ...(!selected ? { agent_name_hint: "dsh-codex-oauth" } : {}),
+      ...(selected?.idToken ? { id_token_hint: selected.idToken } : {}),
+      ...(selected?.email ? { login_hint: selected.email } : {}),
+      ...(selected?.access && !selected.scopes?.includes("chatgpt.tokens.use.direct") ? { prompt: "consent" } : {}),
+    }).toString();
+    if (!interaction.notify) throw new Error("OAuth login requires an authorization-URL handler");
+    interaction.notify({ type: "auth_url", url: url.href });
+    const { clientId, code } = await listener.callback;
+    const tokens = await fetchJSON(`${OPENAI_ISSUER}/api/accounts/oauth/token`, {
+      method: "POST", signal,
+      body: new URLSearchParams({ grant_type: "authorization_code", client_id: clientId, code, code_verifier: verifier, redirect_uri: listener.redirectUri, resource: OPENAI_API }),
+    }, options.fetch);
+    const identity = await validateIdentity(tokens.id_token, clientId, options, nonce, selected?.subject);
+    const registration = { ...identity, clientId, idToken: tokens.id_token, ...tokenFields(tokens, options) };
+    await store.transaction((current) => {
+      signal.throwIfAborted();
+      if ((current.generation ?? 0) !== (document.generation ?? 0)) throw new Error("The selected account changed during sign-in; please retry");
+      const existing = current.registrations.find((account) => account.clientId === clientId);
+      if (existing && existing.subject !== identity.subject) throw new Error("OAuth registration identity changed");
+      if (existing) { clearTokens(existing); Object.assign(existing, registration); }
+      else current.registrations.push(registration);
+      current.activeClientId = clientId;
+      current.generation = (current.generation ?? 0) + 1;
+    });
+    return status(store);
+  } finally { listener.close(); }
+}
+
+export async function getCredential(store, options = {}) {
+  const initial = await store.read(OPENAI_CODEX_PROVIDER);
+  if (!initial || (options.clientId && initial.clientId !== options.clientId)) throw new LlmError("Sign in to the selected ChatGPT account with dsh-openai-codex login", "AUTH");
+  if (!initial.scopes.includes("chatgpt.tokens.use.direct")) throw new LlmError("ChatGPT plan usage was not authorized; sign in again to enable it", "AUTH");
+  const now = nowOf(options);
+  if (initial.expires > now + 60_000 || (initial.expires > now && initial.earliestRefreshAt > now)) return initial;
+  let terminalError;
+  const credential = await store.transaction(async (document) => {
+    const current = activeRegistration(document);
+    if (!current?.access || current.clientId !== initial.clientId) throw new LlmError("The selected ChatGPT account changed", "AUTH");
+    const now = nowOf(options);
+    if (current.expires > now + 60_000 || (current.expires > now && current.earliestRefreshAt > now)) return current;
+    if (!current.refresh) throw new LlmError("ChatGPT sign-in has expired; sign in again", "AUTH");
+    try {
+      const tokens = await fetchJSON(`${OPENAI_ISSUER}/api/accounts/oauth/token`, {
+        method: "POST", signal: options.signal,
+        body: new URLSearchParams({ grant_type: "refresh_token", client_id: current.clientId, refresh_token: current.refresh, resource: OPENAI_API }),
+      }, options.fetch);
+      if (tokens.id_token) await validateIdentity(tokens.id_token, current.clientId, options, undefined, current.subject);
+      const fields = tokenFields(tokens, options, current);
+      delete current.earliestRefreshAt;
+      Object.assign(current, fields, ...(tokens.id_token ? [{ idToken: tokens.id_token }] : []));
+      return current;
+    } catch (error) {
+      if (!TERMINAL_REFRESH_ERRORS.has(error.providerCode)) throw error;
+      clearTokens(current);
+      document.generation = (document.generation ?? 0) + 1;
+      terminalError = new LlmError("ChatGPT sign-in is no longer valid; sign in again", "AUTH");
+      return undefined;
+    }
+  });
+  if (terminalError) throw terminalError;
+  if (!credential?.scopes.includes("chatgpt.tokens.use.direct")) throw new LlmError("ChatGPT plan usage is no longer authorized", "AUTH");
+  return credential;
 }
-export async function logout(store = new CodexCredentialStore()) {
-  await store.delete(OPENAI_CODEX_PROVIDER);
+
+export async function logout(store = new CodexCredentialStore(), options = {}) {
+  let remoteRevoked = true;
+  await store.transaction(async (document) => {
+    const registration = activeRegistration(document);
+    if (!registration?.access) return;
+    if (registration.refresh) {
+      remoteRevoked = false;
+      for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+          const discovery = await metadata(options);
+          const response = await openaiFetch(discovery.revocation_endpoint, {
+            method: "POST", signal: AbortSignal.any([...(options.signal ? [options.signal] : []), AbortSignal.timeout(15_000)]),
+            body: new URLSearchParams({ token: registration.refresh, token_type_hint: "refresh_token", client_id: registration.clientId }),
+          }, options.fetch);
+          if (!response.ok) throw responseError(await readJSON(response), response.status, response.headers, [registration.refresh]);
+          remoteRevoked = true;
+          break;
+        } catch (error) {
+          if (attempt || (error.failure?.status && error.failure.status < 500)) break;
+          await new Promise((resolve) => setTimeout(resolve, 200));
+        }
+      }
+    }
+    clearTokens(registration);
+    document.generation = (document.generation ?? 0) + 1;
+  });
+  return { remoteRevoked };
+}
+
+export async function accounts(store = new CodexCredentialStore()) {
+  const document = await store.readDocument();
+  return document?.registrations.map((registration) => ({
+    clientId: registration.clientId,
+    label: registration.email ? `${registration.email} (${registration.clientId.slice(-8)})` : `ChatGPT (${registration.clientId.slice(-8)})`,
+    active: registration.clientId === document.activeClientId,
+    authenticated: !!registration.access,
+  })) ?? [];
 }
 export async function status(store = new CodexCredentialStore()) {
   const credential = await store.read(OPENAI_CODEX_PROVIDER);
-  return credential?.type === "oauth" ? { authenticated: true, expiresAt: new Date(credential.expires) } : { authenticated: false };
+  return credential ? {
+    authenticated: true, planUsage: credential.scopes.includes("chatgpt.tokens.use.direct"),
+    expiresAt: new Date(credential.expires), clientId: credential.clientId,
+    label: (await accounts(store)).find((account) => account.active)?.label,
+  } : { authenticated: false };
 }
 export { authPath };