ima2-gen 3.18.0 → 3.19.0

package/lib/authStatus.js

@@ -0,0 +1,93 @@
+/**
+ * One status projection for every OAuth login, shared by `ima2 status`, `ima2 gpt status`,
+ * `ima2 doctor`, and GET /api/oauth/status. Modelled on OpenCodex `getLoginStatus` +
+ * `src/oauth/health.ts`: a health verdict, the account (masked), and the one action that fixes
+ * it. No tokens and no full account ids ever leave this module.
+ *
+ * MUST stay a leaf module apart from the two credential stores.
+ */
+import { resolveChatgptSession } from "./chatgptAuth.js";
+import { loadGrokCredentials } from "./xaiAuth.js";
+export function maskAccountId(id) {
+    if (!id)
+        return undefined;
+    return id.length <= 8 ? `${id.slice(0, 2)}…` : `${id.slice(0, 8)}…`;
+}
+/**
+ * An expired access token with a refresh token is still a usable session: the proxy refreshes
+ * it on the next request (OpenCodex getLoginStatus treats it the same way).
+ */
+export function gptSessionState(session, now = Date.now()) {
+    if (!session)
+        return "none";
+    if (!session.refreshable)
+        return "no_refresh_token";
+    if (session.accessExpiresAt !== undefined && session.accessExpiresAt <= now)
+        return "access_expired";
+    return "ready";
+}
+export function gptAuthStatus(session = resolveChatgptSession(), options = {}) {
+    const state = gptSessionState(session, options.now);
+    if (!session) {
+        return { provider: "gpt", loggedIn: false, health: "not_logged_in", reason: "no_session", refreshable: false, action: "ima2 login" };
+    }
+    const base = {
+        provider: "gpt",
+        loggedIn: true,
+        health: "healthy",
+        source: session.source,
+        refreshable: session.refreshable,
+        ...(session.email ? { email: session.email } : {}),
+        ...(session.plan ? { plan: session.plan } : {}),
+        ...(session.accountId ? { accountId: maskAccountId(session.accountId) } : {}),
+        ...(session.accessExpiresAt !== undefined ? { expiresAt: new Date(session.accessExpiresAt).toISOString() } : {}),
+    };
+    if (state === "no_refresh_token") {
+        return { ...base, loggedIn: false, health: "reauth_required", reason: "no_refresh_token", action: "ima2 login" };
+    }
+    if (options.proxyStatus === "auth_required") {
+        return {
+            ...base,
+            loggedIn: false,
+            health: "reauth_required",
+            reason: "proxy_rejected_session",
+            action: "ima2 login",
+            note: "The GPT OAuth proxy was refused by ChatGPT with this session (revoked, or its refresh token was rotated by another client).",
+        };
+    }
+    if (session.source !== "ima2") {
+        return {
+            ...base,
+            health: "warning",
+            reason: "shared_with_codex_cli",
+            action: "ima2 login",
+            note: "Shared with the Codex CLI: whichever client refreshes second can be logged out. Logging in with ima2 gives it its own session.",
+        };
+    }
+    if (state === "access_expired")
+        return { ...base, note: "The access token refreshes on the next request." };
+    return base;
+}
+export function grokAuthStatus(creds = loadGrokCredentials(), now = Date.now()) {
+    if (!creds) {
+        return { provider: "grok", loggedIn: false, health: "not_logged_in", reason: "no_session", refreshable: false, action: "ima2 grok login" };
+    }
+    const refreshable = typeof creds.refreshToken === "string" && creds.refreshToken.length > 0;
+    const base = {
+        provider: "grok",
+        loggedIn: true,
+        health: "healthy",
+        source: "progrok",
+        refreshable,
+        ...(creds.email ? { email: creds.email } : {}),
+        ...(creds.accountId ? { accountId: maskAccountId(creds.accountId) } : {}),
+        ...(creds.expiresAt !== undefined ? { expiresAt: new Date(creds.expiresAt).toISOString() } : {}),
+    };
+    const expired = creds.expiresAt !== undefined && creds.expiresAt <= now;
+    if (expired && !refreshable) {
+        return { ...base, loggedIn: false, health: "reauth_required", reason: "session_expired", action: "ima2 grok login" };
+    }
+    if (expired)
+        return { ...base, note: "The access token refreshes on the next request." };
+    return base;
+}

package/lib/chatgptAuth.js

@@ -0,0 +1,236 @@
+/**
+ * ChatGPT (GPT OAuth) credential store owned by ima2.
+ *
+ * Ported from OpenCodex `src/oauth/chatgpt.ts` (constants, JWT identity helpers) and its
+ * store discipline (atomic 0600 writes, 0700 directory). ima2 keeps its own session file so
+ * the openai-oauth proxy and the Codex CLI never rotate the same refresh token: a shared
+ * ~/.codex/auth.json made whichever process refreshed second lose the session
+ * (refresh_token_reused), which surfaced as "logged in, but GPT OAuth still says log in".
+ *
+ * The file keeps the Codex auth.json shape (`tokens.{id_token,access_token,refresh_token,
+ * account_id}` + `last_refresh`) because openai-oauth reads it through `--oauth-file` and
+ * writes refreshed tokens back into it.
+ *
+ * MUST stay a leaf module: only node:fs, node:crypto, node:os, node:path.
+ */
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const CHATGPT_OAUTH_ISSUER = "https://auth.openai.com";
+export const CHATGPT_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export const CHATGPT_AUTHORIZE_URL = `${CHATGPT_OAUTH_ISSUER}/oauth/authorize`;
+export const CHATGPT_TOKEN_URL = `${CHATGPT_OAUTH_ISSUER}/oauth/token`;
+export const CHATGPT_OAUTH_SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const CHATGPT_AUTH_NAMESPACE = "https://api.openai.com/auth";
+const AUTH_FILENAME = "chatgpt-auth.json";
+export function ima2ConfigDir() {
+    return process.env.IMA2_CONFIG_DIR || join(homedir(), ".ima2");
+}
+export function chatgptAuthFilePath(configDir = ima2ConfigDir()) {
+    return join(configDir, AUTH_FILENAME);
+}
+/** Candidate session files in priority order: ima2's own store first, then Codex CLI files. */
+export function chatgptSessionCandidates(configDir) {
+    const home = homedir();
+    const codexHome = process.env.CODEX_HOME || join(home, ".codex");
+    return [
+        { source: "ima2", path: chatgptAuthFilePath(configDir) },
+        { source: "codex", path: join(codexHome, "auth.json") },
+        { source: "chatgpt-local", path: join(home, ".chatgpt-local", "auth.json") },
+        { source: "xdg-codex", path: join(home, ".config", "codex", "auth.json") },
+    ];
+}
+// ---------------------------------------------------------------------------
+// JWT identity (display/routing metadata only; signatures are never verified here)
+// ---------------------------------------------------------------------------
+export function decodeJwtPayload(token) {
+    if (!token)
+        return undefined;
+    const parts = token.split(".");
+    if (parts.length !== 3 || !parts[1])
+        return undefined;
+    try {
+        const parsed = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function authNamespace(payload) {
+    const ns = payload[CHATGPT_AUTH_NAMESPACE];
+    return ns && typeof ns === "object" && !Array.isArray(ns) ? ns : undefined;
+}
+/** OpenCodex precedence: top-level claim, namespaced claim, then organizations[0].id. */
+export function extractChatgptAccountId(idToken, accessToken) {
+    for (const token of [idToken, accessToken]) {
+        const payload = decodeJwtPayload(token);
+        if (!payload)
+            continue;
+        if (typeof payload.chatgpt_account_id === "string" && payload.chatgpt_account_id)
+            return payload.chatgpt_account_id;
+        const ns = authNamespace(payload);
+        if (typeof ns?.chatgpt_account_id === "string" && ns.chatgpt_account_id)
+            return ns.chatgpt_account_id;
+        const orgs = payload.organizations;
+        if (Array.isArray(orgs) && orgs[0] && typeof orgs[0].id === "string")
+            return orgs[0].id;
+    }
+    return undefined;
+}
+export function extractChatgptEmail(idToken, accessToken) {
+    for (const token of [idToken, accessToken]) {
+        const payload = decodeJwtPayload(token);
+        if (typeof payload?.email === "string" && payload.email)
+            return payload.email.toLowerCase();
+        const profile = payload?.["https://api.openai.com/profile"];
+        if (profile && typeof profile === "object" && typeof profile.email === "string") {
+            return profile.email.toLowerCase();
+        }
+    }
+    return undefined;
+}
+export function extractChatgptPlan(idToken, accessToken) {
+    for (const token of [idToken, accessToken]) {
+        const payload = decodeJwtPayload(token);
+        if (!payload)
+            continue;
+        if (typeof payload.chatgpt_plan_type === "string" && payload.chatgpt_plan_type)
+            return payload.chatgpt_plan_type;
+        const ns = authNamespace(payload);
+        if (typeof ns?.chatgpt_plan_type === "string" && ns.chatgpt_plan_type)
+            return ns.chatgpt_plan_type;
+    }
+    return undefined;
+}
+export function jwtExpiryMs(token) {
+    const exp = decodeJwtPayload(token)?.exp;
+    return typeof exp === "number" && Number.isFinite(exp) ? exp * 1000 : undefined;
+}
+// ---------------------------------------------------------------------------
+// File I/O
+// ---------------------------------------------------------------------------
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/** Never throws: a missing, unreadable, or malformed file is simply "no session". */
+export function readChatgptAuthFile(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const record = parsed;
+        const tokens = record.tokens;
+        if (!tokens || typeof tokens !== "object" || !nonEmpty(tokens.access_token))
+            return null;
+        return record;
+    }
+    catch {
+        return null;
+    }
+}
+function describeSession(source, path, file) {
+    const tokens = file.tokens ?? {};
+    const accountId = nonEmpty(tokens.account_id) ?? extractChatgptAccountId(tokens.id_token, tokens.access_token);
+    const email = extractChatgptEmail(tokens.id_token, tokens.access_token);
+    const plan = extractChatgptPlan(tokens.id_token, tokens.access_token);
+    const accessExpiresAt = jwtExpiryMs(tokens.access_token);
+    const lastRefresh = nonEmpty(file.last_refresh);
+    return {
+        source,
+        path,
+        refreshable: Boolean(nonEmpty(tokens.refresh_token)),
+        ...(accountId ? { accountId } : {}),
+        ...(email ? { email } : {}),
+        ...(plan ? { plan } : {}),
+        ...(accessExpiresAt !== undefined ? { accessExpiresAt } : {}),
+        ...(lastRefresh ? { lastRefresh } : {}),
+    };
+}
+/** Path of the first candidate that holds a usable session (what the proxy must be given). */
+export function resolveChatgptSessionFile(configDir) {
+    for (const candidate of chatgptSessionCandidates(configDir)) {
+        if (readChatgptAuthFile(candidate.path))
+            return candidate;
+    }
+    return null;
+}
+/** The session the GPT OAuth proxy will use: the first readable candidate file. */
+export function resolveChatgptSession(configDir) {
+    for (const candidate of chatgptSessionCandidates(configDir)) {
+        const file = readChatgptAuthFile(candidate.path);
+        if (file)
+            return describeSession(candidate.source, candidate.path, file);
+    }
+    return null;
+}
+/** Access token + account id for direct backend calls (quota). Reads the resolved file. */
+export function readChatgptAccess(configDir) {
+    for (const candidate of chatgptSessionCandidates(configDir)) {
+        const file = readChatgptAuthFile(candidate.path);
+        const accessToken = nonEmpty(file?.tokens?.access_token);
+        if (!file || !accessToken)
+            continue;
+        const accountId = nonEmpty(file.tokens?.account_id)
+            ?? extractChatgptAccountId(file.tokens?.id_token, accessToken)
+            ?? "";
+        return { accessToken, accountId, source: candidate.source };
+    }
+    return null;
+}
+/** Atomic 0600 write (tmp + rename); the directory is forced to 0700. */
+function writeAtomic(target, data) {
+    const dir = dirname(target);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = join(dir, `.${AUTH_FILENAME}.tmp-${randomBytes(6).toString("hex")}`);
+    try {
+        writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+        renameSync(tmp, target);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+/**
+ * Persist a token endpoint response into ima2's store. Rejects a response that cannot drive
+ * the proxy (no access token, no refresh token, or no account identity) instead of writing
+ * a file the proxy would later refuse.
+ */
+export function saveChatgptTokenResponse(payload, configDir) {
+    const accessToken = nonEmpty(payload.access_token);
+    const refreshToken = nonEmpty(payload.refresh_token);
+    const idToken = nonEmpty(payload.id_token);
+    if (!accessToken)
+        throw new Error("ChatGPT token response did not include an access token");
+    if (!refreshToken)
+        throw new Error("ChatGPT token response did not include a refresh token");
+    const accountId = extractChatgptAccountId(idToken, accessToken);
+    if (!accountId)
+        throw new Error("ChatGPT token response did not identify a ChatGPT account");
+    const target = chatgptAuthFilePath(configDir);
+    const file = {
+        auth_mode: "chatgpt",
+        OPENAI_API_KEY: null,
+        tokens: {
+            ...(idToken ? { id_token: idToken } : {}),
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            account_id: accountId,
+        },
+        last_refresh: new Date().toISOString(),
+    };
+    writeAtomic(target, file);
+    return describeSession("ima2", target, file);
+}
+export function hasIma2ChatgptSession(configDir) {
+    return existsSync(chatgptAuthFilePath(configDir));
+}
+/** Explicit logout of ima2's own store. Codex CLI files are never touched. */
+export function clearChatgptCredentials(configDir) {
+    const target = chatgptAuthFilePath(configDir);
+    const existed = existsSync(target);
+    rmSync(target, { force: true });
+    return existed;
+}

package/lib/chatgptLogin.js

@@ -0,0 +1,257 @@
+/**
+ * Native ChatGPT (GPT OAuth) login, ported from OpenCodex `src/oauth/chatgpt.ts` (browser
+ * PKCE on localhost:1455) and `src/oauth/chatgpt-device.ts` (deviceauth grant).
+ *
+ * Replaces spawning `codex login` and scraping its terminal output for the device code: that
+ * regex broke whenever the Codex CLI changed its banner, and the session it wrote landed in
+ * ~/.codex/auth.json, shared with the Codex CLI's own refreshes.
+ *
+ * Both flows write only through lib/chatgptAuth.ts. Nothing is persisted unless the token
+ * endpoint actually returned a usable session.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { CHATGPT_AUTHORIZE_URL, CHATGPT_OAUTH_CLIENT_ID, CHATGPT_OAUTH_SCOPE, CHATGPT_TOKEN_URL, saveChatgptTokenResponse, } from "./chatgptAuth.js";
+const USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+export const CHATGPT_DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
+export const CHATGPT_CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const REDIRECT_URI = `http://localhost:${CHATGPT_CALLBACK_PORT}${CALLBACK_PATH}`;
+const ORIGINATOR = "codex_cli_rs";
+/** The device grant's own lifetime. */
+export const CHATGPT_DEVICE_TTL_MS = 15 * 60 * 1000;
+export const CHATGPT_BROWSER_TTL_MS = 5 * 60 * 1000;
+/** A fresh deadline per fetch; one shared timeout would kill the 15-minute grant. */
+const FETCH_TIMEOUT_MS = 30_000;
+const DEFAULT_POLL_INTERVAL_MS = 5_000;
+const MIN_POLL_INTERVAL_MS = 1_000;
+function fetchSignal(signal) {
+    const timeout = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function defaultSleep(ms, signal) {
+    if (signal?.aborted)
+        return Promise.reject(new Error("Login cancelled"));
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new Error("Login cancelled"));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/** Upstream sends `interval` as a number or a string; a string must not become a hot loop. */
+function normalizeIntervalMs(raw) {
+    const seconds = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return DEFAULT_POLL_INTERVAL_MS;
+    return Math.min(CHATGPT_DEVICE_TTL_MS, Math.max(MIN_POLL_INTERVAL_MS, Math.round(seconds * 1000)));
+}
+/** Only the OAuth error code and description, never the raw body (it may echo request data). */
+async function tokenError(stage, response) {
+    let detail = `HTTP ${response.status}`;
+    try {
+        const parsed = JSON.parse(await response.text());
+        const code = typeof parsed.error === "string" ? parsed.error : typeof parsed.error?.code === "string" ? parsed.error.code : undefined;
+        const description = typeof parsed.error_description === "string" ? parsed.error_description : undefined;
+        detail = [detail, code, description].filter(Boolean).join(" ");
+    }
+    catch {
+        // Non-JSON body: the status alone.
+    }
+    return new Error(`ChatGPT ${stage} failed: ${detail}`);
+}
+async function exchangeCode(doFetch, params, signal) {
+    const response = await doFetch(CHATGPT_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: CHATGPT_OAUTH_CLIENT_ID,
+            code: params.code,
+            code_verifier: params.codeVerifier,
+            redirect_uri: params.redirectUri,
+        }).toString(),
+        signal: fetchSignal(signal),
+    });
+    if (!response.ok)
+        throw await tokenError("token exchange", response);
+    return (await response.json());
+}
+// ---------------------------------------------------------------------------
+// Device flow
+// ---------------------------------------------------------------------------
+async function runDeviceFlow(opts, doFetch) {
+    const sleep = opts.sleep ?? defaultSleep;
+    const start = await doFetch(USERCODE_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ client_id: CHATGPT_OAUTH_CLIENT_ID }),
+        signal: fetchSignal(opts.signal),
+    });
+    if (!start.ok) {
+        // A 404 here is most often the account-level switch for device code login.
+        if (start.status === 404) {
+            throw new Error("ChatGPT device authorization request failed: HTTP 404. Device code login may be disabled for this account (ChatGPT Settings → Security); the browser login does not need it.");
+        }
+        throw await tokenError("device authorization request", start);
+    }
+    const payload = (await start.json());
+    const deviceAuthId = nonEmpty(payload.device_auth_id);
+    const userCode = nonEmpty(payload.user_code) ?? nonEmpty(payload.usercode);
+    if (!deviceAuthId || !userCode)
+        throw new Error("ChatGPT device authorization response missing required fields");
+    const intervalMs = normalizeIntervalMs(payload.interval);
+    opts.onPrompt({ flow: "device", url: CHATGPT_DEVICE_VERIFICATION_URL, userCode, expiresIn: CHATGPT_DEVICE_TTL_MS / 1000 });
+    // Pending is 403/404 rather than an authorization_pending body. The clock is the larger of
+    // wall time and slept time so an injected no-op sleep still reaches the deadline.
+    const startedAt = Date.now();
+    let slept = 0;
+    while (Math.max(Date.now() - startedAt, slept) < CHATGPT_DEVICE_TTL_MS) {
+        if (opts.signal?.aborted)
+            throw new Error("Login cancelled");
+        const poll = await doFetch(DEVICE_TOKEN_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),
+            signal: fetchSignal(opts.signal),
+        });
+        if (poll.status === 403 || poll.status === 404) {
+            await sleep(intervalMs, opts.signal);
+            slept += intervalMs;
+            continue;
+        }
+        if (!poll.ok)
+            throw await tokenError("device authorization poll", poll);
+        const grant = (await poll.json());
+        const code = nonEmpty(grant.authorization_code);
+        const codeVerifier = nonEmpty(grant.code_verifier);
+        if (!code || !codeVerifier)
+            throw new Error("ChatGPT device authorization response missing required fields");
+        return exchangeCode(doFetch, { code, codeVerifier, redirectUri: DEVICE_REDIRECT_URI }, opts.signal);
+    }
+    throw new Error("ChatGPT device authorization expired before it was approved");
+}
+// ---------------------------------------------------------------------------
+// Browser (PKCE callback) flow
+// ---------------------------------------------------------------------------
+export function generatePkce() {
+    const verifier = randomBytes(64).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export function buildChatgptAuthorizeUrl(params) {
+    const query = new URLSearchParams({
+        response_type: "code",
+        client_id: CHATGPT_OAUTH_CLIENT_ID,
+        redirect_uri: params.redirectUri ?? REDIRECT_URI,
+        scope: CHATGPT_OAUTH_SCOPE,
+        code_challenge: params.challenge,
+        code_challenge_method: "S256",
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+        state: params.state,
+        originator: ORIGINATOR,
+    });
+    return `${CHATGPT_AUTHORIZE_URL}?${query}`;
+}
+function page(title, body) {
+    return "<!doctype html><html><head><meta charset='utf-8'><title>ima2</title></head>"
+        + "<body style='font-family:system-ui,sans-serif;text-align:center;padding:4rem;color:#111'>"
+        + `<h2>${title}</h2><p>${body}</p></body></html>`;
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error.code === "EADDRINUSE"
+                ? new Error(`Port ${port} is busy (another Codex or ima2 login may be open). Close it, or use the device-code login.`)
+                : error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, "127.0.0.1");
+    });
+}
+async function runBrowserFlow(opts, doFetch) {
+    const pkce = generatePkce();
+    const state = randomBytes(32).toString("base64url");
+    const port = opts.callbackPort ?? CHATGPT_CALLBACK_PORT;
+    let settle;
+    const codePromise = new Promise((resolve, reject) => { settle = { resolve, reject }; });
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+        res.setHeader("Connection", "close");
+        if (url.pathname !== CALLBACK_PATH) {
+            res.writeHead(404, { "Content-Type": "text/plain" }).end("Not found");
+            return;
+        }
+        // State first, for errors too: any page can navigate the browser to this loopback URL, and
+        // without the unguessable state it must not be able to end (or complete) this login.
+        if (url.searchParams.get("state") !== state) {
+            res.writeHead(400, { "Content-Type": "text/html" }).end(page("&#9888; Login failed", "State mismatch. Start the login again from ima2."));
+            return;
+        }
+        const error = url.searchParams.get("error");
+        if (error) {
+            res.writeHead(400, { "Content-Type": "text/html" }).end(page("&#9888; Login failed", "Return to ima2 and try again."));
+            settle?.reject(new Error(`ChatGPT login was not approved: ${error.replace(/[^\w.-]/g, "")}`));
+            return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+            res.writeHead(400, { "Content-Type": "text/html" }).end(page("&#9888; Login failed", "The callback carried no code. Start the login again from ima2."));
+            return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" }).end(page("&#9989; Login complete", "You can close this tab and return to ima2."));
+        settle?.resolve(code);
+    });
+    await listen(server, port);
+    const timer = setTimeout(() => settle?.reject(new Error("ChatGPT browser login timed out")), CHATGPT_BROWSER_TTL_MS);
+    const onAbort = () => settle?.reject(new Error("Login cancelled"));
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+        opts.onPrompt({
+            flow: "browser",
+            url: buildChatgptAuthorizeUrl({ state, challenge: pkce.challenge }),
+            expiresIn: CHATGPT_BROWSER_TTL_MS / 1000,
+        });
+        const code = await codePromise;
+        return await exchangeCode(doFetch, { code, codeVerifier: pkce.verifier, redirectUri: REDIRECT_URI }, opts.signal);
+    }
+    finally {
+        clearTimeout(timer);
+        opts.signal?.removeEventListener("abort", onAbort);
+        server.closeAllConnections?.();
+        server.close();
+    }
+}
+/**
+ * Runs one complete ChatGPT login and writes the session into ima2's store
+ * (lib/chatgptAuth.ts). Rejects on cancel, expiry, or a token response that cannot drive the
+ * GPT OAuth proxy.
+ */
+export async function runChatgptLogin(opts) {
+    const doFetch = opts.fetchImpl ?? ((...args) => fetch(...args));
+    const payload = opts.flow === "device"
+        ? await runDeviceFlow(opts, doFetch)
+        : await runBrowserFlow(opts, doFetch);
+    // A login that was cancelled or superseded while its token request was in flight must not
+    // overwrite the session a newer login just saved.
+    if (opts.signal?.aborted)
+        throw new Error("Login cancelled");
+    return saveChatgptTokenResponse(payload, opts.configDir);
+}

package/lib/codexDetect.js

@@ -10,6 +10,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { errInfo } from "./errInfo.js";
 import { resolvePackageBin } from "./packageCli.js";
+import { chatgptAuthFilePath, resolveChatgptSessionFile } from "./chatgptAuth.js";
 const HOME = homedir();
 export const CODEX_FILE_AUTH_CONFIG = 'cli_auth_credentials_store="file"';
 export function codexFileLoginArgs(options = {}) {
@@ -23,6 +24,7 @@ export function codexFileLoginArgs(options = {}) {
 export function codexAuthPaths() {
     const codexHome = process.env.CODEX_HOME || join(HOME, ".codex");
     return {
+        ima2: chatgptAuthFilePath(),
         codex: join(codexHome, "auth.json"),
         chatgpt: join(HOME, ".chatgpt-local", "auth.json"),
         xdgCodex: join(HOME, ".config", "codex", "auth.json"),
@@ -30,7 +32,7 @@ export function codexAuthPaths() {
 }
 export function hasAuthFile() {
     const p = codexAuthPaths();
-    return existsSync(p.codex) || existsSync(p.chatgpt) || existsSync(p.xdgCodex);
+    return existsSync(p.ima2) || existsSync(p.codex) || existsSync(p.chatgpt) || existsSync(p.xdgCodex);
 }
 function commandErrorText(error) {
     if (!error || typeof error !== "object")
@@ -89,21 +91,25 @@ export function codexLoginStatus(timeoutMs = 2000, options = {}) {
     }
     return sawError ? "error" : "missing";
 }
-export function detectCodexAuth() {
+/**
+ * Which file the GPT OAuth proxy will read. ima2's own store (lib/chatgptAuth.ts, written by
+ * `ima2 login`) wins over Codex CLI files so the two never rotate one refresh token.
+ * The `codex login status` probe only runs when no file exists (keyring-only detection),
+ * because it spawns the Codex CLI synchronously.
+ */
+export function detectCodexAuth(options = {}) {
     const files = codexAuthPaths();
     const fileHits = {
+        ima2: existsSync(files.ima2),
         codex: existsSync(files.codex),
         chatgpt: existsSync(files.chatgpt),
         xdgCodex: existsSync(files.xdgCodex),
     };
-    const proxyAuthFile = fileHits.codex
-        ? files.codex
-        : fileHits.chatgpt
-            ? files.chatgpt
-            : fileHits.xdgCodex
-                ? files.xdgCodex
-                : null;
-    const probe = codexLoginStatus();
+    // Same validated choice as status and quota (lib/chatgptAuth.ts): a malformed or
+    // token-less file must not win just because it exists.
+    const proxyAuthFile = resolveChatgptSessionFile()?.path ?? null;
+    const shouldProbe = options.probe ?? proxyAuthFile === null;
+    const probe = shouldProbe ? codexLoginStatus() : "skipped";
     const authed = probe === "authed" || proxyAuthFile !== null;
     return {
         authed,