ima2-gen 3.18.0 → 3.19.0

package/bin/commands/doctor.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from "url";
 import { buildHardeningDoctorLines } from "../lib/doctor-checks.js";
 import { buildStorageDoctorLines } from "../lib/storage-doctor.js";
 import { detectCodexAuth } from "../../lib/codexDetect.js";
+import { gptAuthStatus } from "../../lib/authStatus.js";
 import { runImageDoctorProbe } from "../../lib/responsesDoctor.js";
 import { config as runtimeConfig } from "../../config.js";
 import { exitFlushed } from "../lib/output.js";
@@ -187,16 +188,20 @@ async function standardDoctor(args = []) {
     console.log("");
     for (const line of storageLines)
         console.log(line);
-    const auth = detectCodexAuth();
-    if (fileConfig.provider === "oauth" && !auth.proxyReady) {
-        console.log(auth.authed
-            ? "  ✗ Codex is keyring-authenticated, but GPT OAuth needs a file-backed session; run 'ima2 login'"
-            : "  ✗ GPT OAuth has no file-backed Codex session; run 'ima2 login'");
+    const gpt = gptAuthStatus();
+    if (fileConfig.provider === "oauth" && !gpt.loggedIn) {
+        const keyringOnly = gpt.reason === "no_session" && detectCodexAuth().probe === "authed";
+        console.log(keyringOnly
+            ? "  ✗ Codex is keyring-authenticated, but GPT OAuth needs a session file; run 'ima2 login'"
+            : `  ✗ GPT OAuth ${gpt.reason === "no_refresh_token" ? "session cannot refresh" : "has no ChatGPT session"}; run 'ima2 login'`);
         fail++;
     }
-    else if (auth.proxyReady) {
-        console.log("  ✓ GPT OAuth file-backed Codex session is ready");
-        ok++;
+    else if (gpt.loggedIn) {
+        console.log(`  ${gpt.health === "warning" ? "⚠" : "✓"} GPT OAuth ChatGPT session ready (${gpt.source}${gpt.email ? `, ${gpt.email}` : ""})`);
+        if (gpt.health === "warning")
+            console.log("    Shared with the Codex CLI; run 'ima2 login' for an ima2-owned session");
+        else
+            ok++;
     }
     const providerLines = buildProviderDoctorLines(fileConfig);
     console.log("");

package/bin/commands/gpt.js

@@ -0,0 +1,216 @@
+/**
+ * ima2 gpt — ChatGPT (GPT OAuth) session management.
+ *
+ * The session lives in ima2's own store (lib/chatgptAuth.ts, ~/.ima2/chatgpt-auth.json) and
+ * is read by the openai-oauth proxy. Codex CLI files are still accepted as a fallback, but
+ * logging in here gives ima2 an independent session that the Codex CLI never refreshes.
+ */
+import { parseArgs } from "../lib/args.js";
+import { findRunningServer, request } from "../lib/client.js";
+import { color, die, json, out } from "../lib/output.js";
+import { openUrl } from "../lib/platform.js";
+import { chatgptAuthFilePath, clearChatgptCredentials, resolveChatgptSession, } from "../../lib/chatgptAuth.js";
+import { runChatgptLogin } from "../../lib/chatgptLogin.js";
+import { gptAuthStatus } from "../../lib/authStatus.js";
+const HELP = `
+  ima2 gpt <subcommand> [options]
+
+  Manage the ChatGPT (GPT OAuth) session used by the GPT image lane.
+
+  Subcommands:
+    login [--device]       Log in with your ChatGPT account (browser, or device code)
+    status [--json]        Show which session the GPT OAuth proxy uses
+    logout                 Remove ima2's stored ChatGPT session
+
+  Notes:
+    The session is stored in ${"~"}/.ima2/chatgpt-auth.json. Existing Codex CLI sessions
+    (~/.codex/auth.json) are used only when ima2 has none of its own.
+`;
+const LOGIN_HELP = `
+  ima2 gpt login [--device] [--no-open]
+
+  Log in with your ChatGPT account. The default opens the browser and receives the
+  callback on http://localhost:1455. Use --device on a headless or remote machine:
+  it prints a code to enter at https://auth.openai.com/codex/device.
+
+  Options:
+        --device           Use the device-code flow instead of the browser callback
+        --no-open          Print the URL instead of opening a browser
+    -h, --help             Show this help
+`;
+const STATUS_HELP = `
+  ima2 gpt status [--json]
+
+  Show the ChatGPT session the GPT OAuth proxy will read: source file, account,
+  plan, access-token expiry, and whether a refresh token is present.
+
+  Options:
+        --json             Print the status as one JSON object
+    -h, --help             Show this help
+`;
+const LOGOUT_HELP = `
+  ima2 gpt logout
+
+  Remove ima2's stored ChatGPT session. Codex CLI files are never touched.
+
+  Options:
+    -h, --help             Show this help
+`;
+const LOGIN_SPEC = {
+    flags: {
+        device: { type: "boolean" },
+        "no-open": { type: "boolean" },
+        help: { short: "h", type: "boolean" },
+    },
+};
+const STATUS_SPEC = { flags: { json: { type: "boolean" }, help: { short: "h", type: "boolean" } } };
+const HELP_ONLY_SPEC = { flags: { help: { short: "h", type: "boolean" } } };
+function rejectUnknownFlags(args) {
+    if (args._unknown?.length)
+        die(2, `unknown option: ${args._unknown[0]}`);
+}
+/** Relative rendering of an absolute expiry, e.g. "in 58m" or "expired 2h ago". */
+export function relativeTime(epochMs) {
+    const deltaMs = epochMs - Date.now();
+    const minutes = Math.round(Math.abs(deltaMs) / 60_000);
+    const span = minutes < 60 ? `${minutes}m` : minutes < 1440 ? `${Math.round(minutes / 60)}h` : `${Math.round(minutes / 1440)}d`;
+    return deltaMs >= 0 ? `in ${span}` : `expired ${span} ago`;
+}
+const HEALTH_LABEL = {
+    healthy: "healthy",
+    warning: "warning",
+    reauth_required: "login required",
+    not_logged_in: "not logged in",
+};
+function healthMark(health) {
+    if (health === "healthy")
+        return color.green("✓");
+    if (health === "warning")
+        return color.yellow("⚠");
+    if (health === "reauth_required")
+        return color.red("✗");
+    return color.yellow("○");
+}
+/**
+ * Human status block shared by `ima2 status`, `ima2 gpt status` and `ima2 grok`-style output:
+ * verdict, account, source, expiry, then the note and the one action that fixes it.
+ */
+export function authStatusLines(label, status, file, indent = "  ") {
+    const who = [status.email, status.plan].filter(Boolean).join(" · ");
+    const lines = [`${healthMark(status.health)} ${label}: ${HEALTH_LABEL[status.health]}${who ? ` (${who})` : ""}`];
+    if (status.source)
+        lines.push(`${indent}source: ${status.source}`);
+    if (status.accountId)
+        lines.push(`${indent}account: ${status.accountId}`);
+    if (status.loggedIn || status.expiresAt) {
+        const expiry = status.expiresAt ? relativeTime(Date.parse(status.expiresAt)) : "expiry unknown";
+        lines.push(`${indent}access token: ${expiry}, refresh token ${status.refreshable ? "present" : "absent"}`);
+    }
+    if (file)
+        lines.push(color.dim(`${indent}file: ${file}`));
+    if (status.note)
+        lines.push(color.dim(`${indent}${status.note}`));
+    if (status.action)
+        lines.push(`${indent}Action: run '${status.action}'`);
+    return lines;
+}
+function printPrompt(prompt, openBrowser) {
+    out("");
+    if (prompt.flow === "device") {
+        out(`  Open ${color.cyan(prompt.url)}`);
+        out(`  and enter the code ${color.bold(prompt.userCode ?? "")}`);
+        out(color.dim(`  The code expires in ${Math.round(prompt.expiresIn / 60)} minutes.`));
+    }
+    else {
+        const opened = openBrowser ? openUrl(prompt.url).ok : false;
+        out(opened ? "  Opened the ChatGPT login page in your browser." : "  Open this URL in a browser on this machine:");
+        out(`  ${color.cyan(prompt.url)}`);
+        out(color.dim("  Waiting for the callback on http://localhost:1455 (5 minutes)."));
+    }
+    out("");
+}
+/** Tell a running server to pick the new session up. Best effort: an old server may lack the route. */
+export async function notifyServerOfGptLogin() {
+    try {
+        const server = await findRunningServer({ includeEnv: false });
+        if (!server)
+            return false;
+        await request(server.base, "/api/oauth/restart", { method: "POST", body: {} });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function gptLogin(options = {}) {
+    const openBrowser = options.open !== false;
+    return runChatgptLogin({
+        flow: options.device ? "device" : "browser",
+        onPrompt: (prompt) => printPrompt(prompt, openBrowser),
+    });
+}
+async function loginCmd(argv) {
+    const args = parseArgs(argv, LOGIN_SPEC);
+    if (args.help) {
+        out(LOGIN_HELP);
+        return;
+    }
+    rejectUnknownFlags(args);
+    let session;
+    try {
+        session = await gptLogin({ device: args.device === true, open: args["no-open"] !== true });
+    }
+    catch (error) {
+        die(1, `ChatGPT login failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    out(color.green("✓ ") + `ChatGPT session saved to ${session.path}${session.email ? ` (${session.email})` : ""}`);
+    if (await notifyServerOfGptLogin())
+        out(color.dim("  The running ima2 server reloaded the GPT OAuth proxy."));
+}
+function statusCmd(argv) {
+    const args = parseArgs(argv, STATUS_SPEC);
+    if (args.help) {
+        out(STATUS_HELP);
+        return;
+    }
+    rejectUnknownFlags(args);
+    const session = resolveChatgptSession();
+    const status = gptAuthStatus(session);
+    if (args.json) {
+        json({ ...status, ...(session ? { file: session.path } : {}) });
+        return;
+    }
+    for (const line of authStatusLines("ChatGPT (GPT OAuth)", status, session?.path))
+        out(line);
+}
+async function logoutCmd(argv) {
+    const args = parseArgs(argv, HELP_ONLY_SPEC);
+    if (args.help) {
+        out(LOGOUT_HELP);
+        return;
+    }
+    rejectUnknownFlags(args);
+    const removed = clearChatgptCredentials();
+    out(removed
+        ? color.green("✓ ") + `Removed ${chatgptAuthFilePath()}`
+        : color.yellow("○ ") + "ima2 had no stored ChatGPT session");
+    const fallback = resolveChatgptSession();
+    if (fallback)
+        out(color.dim(`  The GPT OAuth proxy will now use ${fallback.path} (${fallback.source}).`));
+    await notifyServerOfGptLogin();
+}
+export default async function gptCmd(argv) {
+    const sub = argv[0];
+    if (!sub || sub === "--help" || sub === "-h") {
+        out(HELP);
+        return;
+    }
+    const rest = argv.slice(1);
+    if (sub === "login")
+        return loginCmd(rest);
+    if (sub === "status")
+        return statusCmd(rest);
+    if (sub === "logout")
+        return logoutCmd(rest);
+    die(2, `unknown subcommand '${sub}'. Run 'ima2 gpt --help'.`);
+}

package/bin/ima2.js

@@ -9,8 +9,8 @@ import { spawn, execFileSync } from "child_process";
 import { confirmDestructiveAction } from "./lib/destructive-confirm.js";
 import { openUrl, killProcessTree } from "./lib/platform.js";
 import { ensureFreshUiDist } from "./lib/ui-build.js";
-import { codexFileLoginArgs, detectCodexAuth } from "../lib/codexDetect.js";
-import { packageCliCommand } from "../lib/packageCli.js";
+import { detectCodexAuth } from "../lib/codexDetect.js";
+import { resolveChatgptSession } from "../lib/chatgptAuth.js";
 import { errInfo } from "../lib/errInfo.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..");
@@ -51,12 +51,12 @@ const LEGACY_CONFIG_FILE = join(ROOT, ".ima2", "config.json");
 function runSelf(args) {
     execFileSync(process.execPath, [join(ROOT, "bin", "ima2.js"), ...args], { stdio: "inherit" });
 }
-function runCodexLogin() {
-    const codex = packageCliCommand("@openai/codex", "codex", codexFileLoginArgs());
-    execFileSync(codex.command, codex.args, { stdio: "inherit", windowsHide: true });
-    if (!detectCodexAuth().proxyReady) {
-        throw new Error("Codex login completed without a file-backed session for the GPT OAuth proxy");
-    }
+/** Native ChatGPT login into ima2's own store (lib/chatgptLogin.ts); no Codex CLI child. */
+async function runGptLogin() {
+    const { gptLogin, notifyServerOfGptLogin } = await import("./commands/gpt.js");
+    const session = await gptLogin();
+    console.log(`\n  ChatGPT session saved to ${session.path}${session.email ? ` (${session.email})` : ""}\n`);
+    await notifyServerOfGptLogin();
 }
 function loadConfig() {
     if (existsSync(CONFIG_FILE)) {
@@ -132,22 +132,19 @@ async function setup() {
         saveConfig(config);
         console.log("\n  Setting up both GPT OAuth + Grok OAuth...\n");
         // GPT OAuth
-        const auth = detectCodexAuth();
-        if (!auth.proxyReady) {
-            if (auth.authed) {
-                console.log("  Codex is signed in through the OS keyring; ima2 needs a file-backed session.\n");
-            }
+        const existing = resolveChatgptSession();
+        if (existing?.source === "ima2" && existing.refreshable) {
+            console.log(`  GPT OAuth session found (${existing.email ?? existing.path}).\n`);
+        }
+        else {
             console.log("  Running GPT OAuth login...\n");
             try {
-                runCodexLogin();
+                await runGptLogin();
             }
-            catch {
-                console.log("\n  GPT login failed. Continuing with Grok...\n");
+            catch (e) {
+                console.log(`\n  GPT login failed: ${e.message}\n  Continuing with Grok...\n`);
             }
         }
-        else {
-            console.log(`  GPT OAuth session found.\n`);
-        }
         // Grok OAuth
         console.log("  Running Grok OAuth login...\n");
         try {
@@ -166,25 +163,23 @@ async function setup() {
         delete config.apiKey;
         saveConfig(config);
         console.log("\n  Starting GPT OAuth login...\n");
-        const auth = detectCodexAuth();
-        const hasAuth = auth.proxyReady;
-        if (!hasAuth) {
-            if (auth.authed) {
-                console.log("  Codex is signed in through the OS keyring; ima2 needs a file-backed session.\n");
-            }
-            console.log("  Running 'codex login' — follow the browser prompt.\n");
+        // Setup reuses an ima2 session it already has; 'ima2 login' always signs in again.
+        const existing = resolveChatgptSession();
+        const reuse = existing?.source === "ima2" && existing.refreshable;
+        if (!reuse) {
+            console.log("  Signing in with your ChatGPT account — follow the browser prompt.\n");
             try {
-                runCodexLogin();
+                await runGptLogin();
             }
-            catch {
-                console.log("\n  Login failed or cancelled. You can retry with 'ima2 serve'.\n");
+            catch (e) {
+                console.log(`\n  Login failed: ${e.message}`);
+                console.log("  Retry with 'ima2 login' (or 'ima2 login --device' on a headless machine).\n");
                 rl.close();
                 exitFlushed(1);
             }
         }
         else {
-            const how = auth.probe === "authed" ? "codex CLI" : "auth file";
-            console.log(`  Existing GPT OAuth session found (${how}).\n`);
+            console.log(`  Existing GPT OAuth session found (${existing.email ?? existing.path}).\n`);
         }
         saveConfig(config);
         console.log("  GPT OAuth configured. Starting server...\n");
@@ -278,27 +273,54 @@ async function showStatus() {
         console.log("  Status: not configured");
         console.log("  Run 'ima2 setup' to configure.\n");
     }
-    // Check OAuth auth files + codex CLI probe
-    const auth = detectCodexAuth();
-    console.log(`  GPT OAuth sessions:`);
-    console.log(`    ${auth.files.codex}          ${auth.fileHits.codex ? "✓" : "✗"}`);
-    console.log(`    ${auth.files.chatgpt}  ${auth.fileHits.chatgpt ? "✓" : "✗"}`);
-    if (auth.fileHits.xdgCodex) {
-        console.log(`    ${auth.files.xdgCodex}  ✓`);
-    }
-    const probeLabel = auth.probe === "authed" ? "✓ authed"
-        : auth.probe === "unauthed" ? "✗ not logged in"
-            : auth.probe === "error" ? "✗ codex CLI failed"
-                : "– codex CLI not found";
-    console.log(`    codex login status           ${probeLabel}`);
-    if (auth.authed && !auth.proxyReady) {
-        console.log("    GPT OAuth proxy             ✗ keyring-only; run 'ima2 login'");
-    }
-    else if (auth.proxyReady) {
-        console.log("    GPT OAuth proxy             ✓ file-backed session ready");
+    const report = await buildAuthReport();
+    console.log("  Logins");
+    const { authStatusLines } = await import("./commands/gpt.js");
+    for (const line of authStatusLines("GPT OAuth (ChatGPT)", report.gpt, report.gptFile, "      "))
+        console.log(`    ${line}`);
+    if (report.keyringOnly) {
+        console.log("      Codex CLI is signed in through the OS keyring only; the GPT OAuth proxy cannot read that.");
+    }
+    for (const line of authStatusLines("Grok OAuth (xAI)", report.grok, undefined, "      "))
+        console.log(`    ${line}`);
+    console.log("");
+    if (report.server) {
+        const proxy = report.server.proxy ?? "unknown";
+        const mark = proxy === "ready" ? "✓" : proxy === "starting" ? "…" : "✗";
+        console.log(`  Server ${report.server.url}: GPT OAuth proxy ${mark} ${proxy}`);
+    }
+    else {
+        console.log("  Server: not running (start it with 'ima2 serve')");
     }
     console.log("");
 }
+/**
+ * Auth verdicts for `ima2 status`. When a server is advertised, its live proxy verdict is
+ * folded in: a session file can look fine while ChatGPT has already revoked it.
+ */
+async function buildAuthReport() {
+    const { gptAuthStatus, grokAuthStatus } = await import("../lib/authStatus.js");
+    const { resolveChatgptSession } = await import("../lib/chatgptAuth.js");
+    const session = resolveChatgptSession();
+    let server = null;
+    const url = advertisedServerUrl();
+    if (url) {
+        try {
+            const res = await fetch(`${url}/api/oauth/status`, { signal: AbortSignal.timeout(2500) });
+            const body = await res.json();
+            const proxy = body.status;
+            server = proxy === "ready" || proxy === "auth_required" || proxy === "starting" || proxy === "offline"
+                ? { url, proxy }
+                : { url };
+        }
+        catch {
+            server = null;
+        }
+    }
+    const gpt = gptAuthStatus(session, server?.proxy ? { proxyStatus: server.proxy } : {});
+    const keyringOnly = !session && detectCodexAuth().probe === "authed";
+    return { gpt, gptFile: session?.path, grok: grokAuthStatus(), keyringOnly, server };
+}
 function openBrowser() {
     const url = advertisedServerUrl() || `http://localhost:${runtimeConfig.server.port}`;
     const res = openUrl(url);
@@ -323,7 +345,8 @@ function showHelp() {
 
   Server commands:
     serve [--dev] [--force]  Start the server (--force allows a second instance)
-    setup, login   Configure API key or GPT OAuth (interactive)
+    setup          Choose providers and sign in (interactive)
+    login          Sign in with ChatGPT for GPT OAuth (--device for headless)
     status         Show current configuration status
     doctor         Diagnose environment and setup
     open           Open web UI in browser
@@ -353,6 +376,7 @@ function showHelp() {
     billing        API usage / quota
     providers      Configured providers
     oauth <sub>    GPT OAuth proxy status              (ima2 oauth --help)
+    gpt <sub>      ChatGPT OAuth login/status/logout (ima2 gpt --help)
     grok <sub>     xAI OAuth login/status/logout    (ima2 grok --help)
     config <sub>   Config get/set/ls/path/rm       (ima2 config --help)
     defaults <sub> Inspect/change model defaults   (ima2 defaults --help)
@@ -424,7 +448,7 @@ if (args.includes("-v") || args.includes("--version")) {
     console.log(pkg.version);
     exitFlushed(0);
 }
-const helpOwningCommands = ["doctor", "gen", "video", "edit", "vectorize", "ls", "show", "ps", "cancel", "session", "history", "prompt", "multimode", "node", "annotate", "canvas-versions", "metadata", "comfy", "cardnews", "inflight", "storage", "billing", "providers", "oauth", "grok", "config", "defaults", "models", "capabilities", "tools", "skill", "ping", "backfill-thumbs", "service"];
+const helpOwningCommands = ["doctor", "gen", "video", "edit", "vectorize", "ls", "show", "ps", "cancel", "session", "history", "prompt", "multimode", "node", "annotate", "canvas-versions", "metadata", "comfy", "cardnews", "inflight", "storage", "billing", "providers", "oauth", "grok", "gpt", "login", "config", "defaults", "models", "capabilities", "tools", "skill", "ping", "backfill-thumbs", "service"];
 if (!command) {
     showHelp();
     exitFlushed(1);
@@ -449,15 +473,26 @@ switch (command) {
         exitFlushed(Number(process.exitCode ?? 0));
         break;
     }
+    case "login": {
+        // 'ima2 login' signs in to ChatGPT now; it no longer rewrites the provider config.
+        const { default: gptCmd } = await import("./commands/gpt.js");
+        await gptCmd(["login", ...args.slice(1)]);
+        break;
+    }
     case "setup":
-    case "login":
         setup().then(() => console.log("  Done. Run 'ima2 serve' to start.")).catch((e) => {
             console.error(`Setup failed: ${e?.message || e}`);
             exitFlushed(1);
         });
         break;
     case "status":
-        showStatus();
+        if (args.includes("--json")) {
+            const report = await buildAuthReport();
+            console.log(JSON.stringify({ version: pkg.version, provider: loadConfig().provider ?? null, ...report }, null, 2));
+        }
+        else {
+            await showStatus();
+        }
         break;
     case "doctor":
         await doctor(args.slice(1));
@@ -512,6 +547,7 @@ switch (command) {
     case "tools":
     case "skill":
     case "grok":
+    case "gpt":
     case "ping": {
         const { setCliVersion } = await import("./lib/client.js");
         setCliVersion(pkg.version);

package/bin/lib/doctor-providers.js

@@ -3,6 +3,7 @@ import { listProviders } from "../../lib/providers/registry.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { detectCodexAuth } from "../../lib/codexDetect.js";
+import { gptAuthStatus } from "../../lib/authStatus.js";
 import { config as runtimeConfig } from "../../config.js";
 import { normalizeComfyOrigin } from "../../lib/comfyBridge.js";
 function firstEnv(names) {
@@ -36,10 +37,24 @@ function inspectApiKey(lane, credential, fileConfig) {
 }
 function inspectOauth(lane) {
     if (lane === "oauth") {
-        const auth = detectCodexAuth();
-        if (auth.proxyReady)
-            return { code: "OAUTH_FILE_READY", lane, kind: "pass", text: `${lane}: file-backed Codex session ready` };
-        return { code: "OAUTH_FILE_REQUIRED", lane, kind: "fail", text: `${lane}: no file-backed Codex session; run ima2 login` };
+        const status = gptAuthStatus();
+        if (status.health === "healthy") {
+            return { code: "OAUTH_FILE_READY", lane, kind: "pass", text: `${lane}: ChatGPT session ready (${status.source})` };
+        }
+        if (status.health === "warning") {
+            return { code: "OAUTH_FILE_READY", lane, kind: "warn", text: `${lane}: ChatGPT session shared with the Codex CLI; run ima2 login for an ima2-owned session` };
+        }
+        const keyringOnly = !status.loggedIn && status.reason === "no_session" && detectCodexAuth().probe === "authed";
+        return {
+            code: "OAUTH_FILE_REQUIRED",
+            lane,
+            kind: "fail",
+            text: keyringOnly
+                ? `${lane}: Codex is keyring-only; run ima2 login`
+                : status.reason === "no_refresh_token"
+                    ? `${lane}: ChatGPT session has no refresh token; run ima2 login`
+                    : `${lane}: no ChatGPT session; run ima2 login`,
+        };
     }
     if (lane === "grok") {
         const home = homedir();

package/docs/API.md

@@ -151,7 +151,7 @@ inventing a runtime `lanes` availability result.
 | `GET` | `/api/health` | Server health, version, paths, provider policy; includes `grok: { auth: "oauth" \| "none" }`, mirrored in `~/.ima2/server.json` |
 | `POST` | `/api/admin/stop` | Clean shutdown (local admin only): requires the boot-generated `X-Ima2-Admin-Nonce` from `~/.ima2/server.json`; any request with an `Origin` header is refused (browser drive-by protection). Responds `202` then self-signals SIGTERM |
 | `GET` | `/api/providers` | Provider availability and runtime ports |
-| `GET` | `/api/oauth/status` | OAuth proxy status and visible models |
+| `GET` | `/api/oauth/status` | OAuth proxy status and visible models, plus `auth` / `grokAuth` login verdicts: `{ provider, loggedIn, health: healthy\|warning\|reauth_required\|not_logged_in, reason?, source?, email?, plan?, accountId (masked), expiresAt?, refreshable, action?, note? }`. A proxy that exited because no session file exists reports `auth_required`. |
 | `GET` | `/api/grok/status` | xAI OAuth session state and visible xAI image models: `ready`, `no_image_model`, `error`, or `offline` with `reason: "login_required"` when no session is stored |
 | `GET` | `/api/billing` | Billing/status probe, including API key source when configured |
 | `GET` | `/api/quota` | Provider quota: returns `{ codex, grok, nai }`. Codex windows are `5h` and `7d`. NovelAI returns a `v5-battery` remaining-charge window when available (`resetsAt` is the ISO ETA for +1%, not full recharge), with Anlas balances in `nai.anlasFixed` / `nai.anlasPurchased`; a missing meter has no window. NovelAI account email is always null. Eligible Grok Build xAI OIDC/external auth returns a `weekly` percentage/reset window from `GET /v1/billing?format=credits`. If unavailable, the legacy endpoint may return a `monthly` window plus `billing: { usedUsd, limitUsd }`. |
@@ -160,8 +160,10 @@ inventing a runtime `lanes` availability result.
 
 | Method | Path | Notes |
 |---|---|---|
-| `POST` | `/api/auth/switch` | Start a device-code OAuth flow. Body: `{ "provider": "grok" \| "codex" }`. Returns `{ sessionId, userCode, verificationUrl }`. |
+| `POST` | `/api/auth/switch` | Start an OAuth login. Body: `{ "provider": "grok" \| "codex", "flow"?: "browser" \| "device" }`. `codex` defaults to the browser flow (callback on `localhost:1455`, so the browser must be on the server machine); `device` works from any machine. Grok always uses the device code. Returns `{ sessionId, flow, userCode, verificationUrl, expiresIn }`; `userCode` is empty for the browser flow. A completed `codex` login restarts the GPT OAuth proxy. |
 | `GET` | `/api/auth/switch/:sessionId` | Poll switch-account session status. Returns `{ status }` where status is `pending`, `complete`, `error`, or `expired`. |
+| `DELETE` | `/api/auth/switch/:sessionId` | Cancel a pending login and release its callback port. |
+| `POST` | `/api/oauth/restart` | Respawn the GPT OAuth proxy so it reads the current session file (used by `ima2 login` / `ima2 gpt login` / `ima2 gpt logout`). Returns `{ restarted, reason? }`. |
 
 The Switch Account flow opens a browser verification URL. Once the user completes the device-code step, the server saves the new credentials (Grok: `~/.progrok/auth.json`; Codex: via `codex login --device-auth`) and the session transitions to `complete`. This endpoint is surfaced as a **Switch Account** button in the Settings QuotaCard for Grok and Codex providers.
 
@@ -1053,7 +1055,8 @@ Most server routes under `/api/*` have a CLI wrapper. The exception is **Agent M
 | `GET /api/storage/status` / `POST /api/storage/open-generated-dir` | `ima2 storage status` / `ima2 storage open` |
 | `GET /api/billing` / `GET /api/providers` / `GET /api/oauth/status` / `GET /api/grok/status` | `ima2 billing` / `ima2 providers` / `ima2 oauth status` / `ima2 grok status` |
 | `GET /api/quota` | Web UI only (Grok and NovelAI quota in Settings) |
-| `POST /api/auth/switch` / `GET /api/auth/switch/:sessionId` | Web UI only (Settings > QuotaCard > Switch Account) |
+| `POST /api/auth/switch` / `GET /api/auth/switch/:sessionId` | Web UI (Settings > QuotaCard > Switch Account) and `ima2 grok login` |
+| `POST /api/oauth/restart` | `ima2 login`, `ima2 gpt login`, `ima2 gpt logout` |
 | `GET /api/health` | `ima2 ping` |
 | `GET /api/capabilities` | `ima2 capabilities` |
 | `GET /api/config/grok-planner` | — (Grok planner model query) |

package/docs/migration/runtime-test-inventory.md

@@ -4,7 +4,7 @@ Generated by `npm run test:inventory` (script: `scripts/classify-tests.mjs`).
 
 _Tests considered "runtime-importing" if they import from `../lib/`, `../routes/`, `../bin/`, `../server`, or `../config`._
 
-Total: 504 (runtime: 228, contract: 276)
+Total: 507 (runtime: 231, contract: 276)
 
 ## Runtime-importing tests
 - `tests/advertise-payload-contract.test.ts`
@@ -37,6 +37,7 @@ Total: 504 (runtime: 228, contract: 276)
 - `tests/assets-routes-contract.test.ts`
 - `tests/assets-store-contract.test.ts`
 - `tests/atlascloud-provider-contract.test.ts`
+- `tests/auth-switch-routes.test.ts`
 - `tests/backend-hardening.test.ts`
 - `tests/backend-input-lan-hardening.test.ts`
 - `tests/background-presets.test.ts`
@@ -46,6 +47,7 @@ Total: 504 (runtime: 228, contract: 276)
 - `tests/capabilities-video-modes-contract.test.ts`
 - `tests/card-news-contract.test.ts`
 - `tests/card-news-template.test.ts`
+- `tests/chatgpt-auth-contract.test.ts`
 - `tests/classic-generate-async.test.ts`
 - `tests/cli-error-hints.test.ts`
 - `tests/cli-lan-auth.test.ts`
@@ -157,6 +159,7 @@ Total: 504 (runtime: 228, contract: 276)
 - `tests/oauth-cli-dependencies.test.ts`
 - `tests/oauth-normalize.test.ts`
 - `tests/oauth-proxy-error-safety.test.ts`
+- `tests/oauth-proxy-session-reload.test.ts`
 - `tests/open-directory.test.ts`
 - `tests/openai-execution-parity.test.ts`
 - `tests/openai-transport-parity.test.ts`