ima2-gen 3.18.0 → 3.19.0

package/lib/oauthLauncher.js

@@ -11,6 +11,7 @@ export function startOAuthProxy(options = {}) {
     let restartTimer = null;
     let hasBeenReady = false;
     let restartCount = 0;
+    let launchedAuthFile = null;
     const MAX_RESTARTS = 3;
     const detectAuth = options.detectAuth ?? detectCodexAuth;
     const execPath = options.execPath ?? process.execPath;
@@ -20,6 +21,7 @@ export function startOAuthProxy(options = {}) {
         // Guard: don't start if no auth file exists (avoids pointless crash loops
         // and prevents openai-oauth from corrupting state on refresh failure)
         const auth = detectAuth();
+        launchedAuthFile = typeof auth.proxyAuthFile === "string" ? auth.proxyAuthFile : null;
         if (!auth.proxyReady || typeof auth.proxyAuthFile !== "string") {
             console.log("[gpt-oauth] No file-backed Codex session found. Run `ima2 login` to enable GPT OAuth.");
             options.onExit?.({ code: 0, reason: "missing-auth-file" });
@@ -116,5 +118,35 @@ export function startOAuthProxy(options = {}) {
             }
             catch { }
         },
+        /**
+         * Stop and wait until the child has exited so its port is free. SIGTERM first; after
+         * timeoutMs, SIGKILL and wait again. Rejects if the child is still alive after both, so a
+         * caller never starts a replacement that would fall back to another port.
+         */
+        stopAndWait(timeoutMs = 3000) {
+            const child = currentChild;
+            this.stop();
+            if (!child || child.exitCode !== null || child.signalCode !== null)
+                return Promise.resolve();
+            const exited = new Promise((resolve) => { child.once("exit", () => resolve()); });
+            const within = (ms) => Promise.race([
+                exited.then(() => true),
+                new Promise((resolve) => { setTimeout(() => resolve(false), ms); }),
+            ]);
+            return within(timeoutMs).then(async (done) => {
+                if (done)
+                    return;
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch { }
+                if (!(await within(2000)))
+                    throw new Error("GPT OAuth proxy did not exit after SIGKILL");
+            });
+        },
+        /** The session file this launcher handed to the proxy (null when it found none). */
+        get authFile() {
+            return launchedAuthFile;
+        },
     };
 }

package/lib/oauthProxy/runtime.js

@@ -54,6 +54,9 @@ export function createOAuthGenerationTimeout(ctx = {}, requestId = null, scope =
 export async function waitForOAuthReady(ctx = {}) {
     if (!ctx || ctx.oauthReadyState === undefined)
         return;
+    // A new login may have landed since the proxy started (or gave up), possibly from a CLI that
+    // could not reach this server; restart onto the new session file first. Cheap: a few stats.
+    ctx.syncOAuthProxySession?.();
     const initialState = ctx.oauthReadyState;
     if (initialState === "ready" || initialState === "disabled")
         return;

package/node_modules/openai-oauth/dist/chunk-2AENSHRT.js

@@ -148,7 +148,7 @@ var readAuthFile = async (candidates) => {
       const content = await fs.readFile(candidate, "utf-8");
       const parsed = JSON.parse(content);
       if (isRecord(parsed)) {
-        return { path: candidate, data: toAuthFile(parsed) };
+        return { path: candidate, data: toAuthFile(parsed), raw: parsed };
       }
     } catch {
     }
@@ -160,10 +160,17 @@ var ensureDirectory = async (filePath) => {
 };
 var writeAuthFile = async (filePath, data) => {
   await ensureDirectory(filePath);
-  await fs.writeFile(filePath, JSON.stringify(data, null, 2), {
-    encoding: "utf-8",
-    mode: 384
-  });
+  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now().toString(36)}`;
+  try {
+    await fs.writeFile(tmpPath, JSON.stringify(data, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
+    await fs.rename(tmpPath, filePath);
+  } catch (error) {
+    await fs.rm(tmpPath, { force: true }).catch(() => {});
+    throw error;
+  }
 };
 var refreshChatGptTokens = async (refreshToken, clientId, issuer, tokenUrl, fetchFn) => {
   const resolvedTokenUrl = tokenUrl ?? `${issuer.replace(/\/$/, "")}/oauth/token`;
@@ -216,6 +223,7 @@ var loadAuthTokens = async (options) => {
     authFilePath,
     fetch,
     ensureFresh = true,
+    forceRefresh = false,
     now = () => /* @__PURE__ */ new Date()
   } = options;
   if (typeof fetch !== "function") {
@@ -231,8 +239,9 @@ var loadAuthTokens = async (options) => {
   let refreshToken = tokens.refresh_token;
   let accountId = tokens.account_id ?? deriveAccountId(idToken);
   let lastRefresh = authData.last_refresh;
-  const needsRefresh = ensureFresh && typeof refreshToken === "string" && shouldRefreshAccessToken(accessToken, lastRefresh, now());
+  const needsRefresh = typeof refreshToken === "string" && (forceRefresh || ensureFresh && shouldRefreshAccessToken(accessToken, lastRefresh, now()));
   if (needsRefresh && typeof refreshToken === "string") {
+    const usedRefreshToken = refreshToken;
     const refreshed = await refreshChatGptTokens(
       refreshToken,
       clientId,
@@ -240,16 +249,29 @@ var loadAuthTokens = async (options) => {
       tokenUrl,
       fetch
     );
-    if (refreshed) {
+    // ima2 patch: compare-before-write. If another writer (a new `ima2 login`, Codex CLI)
+    // replaced the file while the token request was in flight, its session wins: use it and
+    // do not overwrite it with this now-obsolete refresh.
+    const latest = refreshed ? await readAuthFile([resolveWritePath(readResult.path ?? authFilePath)]) : {};
+    const latestTokens = normalizeTokens(latest.data?.tokens);
+    if (refreshed && latest.data && latestTokens.refresh_token !== usedRefreshToken && latestTokens.access_token) {
+      accessToken = latestTokens.access_token;
+      idToken = latestTokens.id_token;
+      refreshToken = latestTokens.refresh_token;
+      accountId = latestTokens.account_id ?? deriveAccountId(idToken);
+      lastRefresh = latest.data.last_refresh;
+    } else if (refreshed) {
       accessToken = refreshed.accessToken;
       idToken = refreshed.idToken ?? idToken;
       refreshToken = refreshed.refreshToken ?? refreshToken;
       accountId = refreshed.accountId ?? accountId;
       lastRefresh = now().toISOString();
       const writePath = resolveWritePath(readResult.path ?? authFilePath);
+      const rawTokens = isRecord(readResult.raw?.tokens) ? readResult.raw.tokens : {};
       await writeAuthFile(writePath, {
-        ...authData,
+        ...(readResult.raw ?? authData),
         tokens: {
+          ...rawTokens,
           id_token: idToken,
           access_token: accessToken,
           refresh_token: refreshToken,
@@ -17759,30 +17781,56 @@ var AuthManager = class {
     this.settings = settings;
     this.fetch = fetch;
   }
+  // ima2 patch: the session file is the source of truth. Another client (Codex CLI, a new
+  // `ima2 login`) can rotate or replace it at any time, so every request re-reads it
+  // (single-flight) instead of reusing the first token forever.
   async ensure() {
     if (this.inflight) {
       return this.inflight;
     }
-    this.inflight = loadAuthTokens({
+    return this.load(false);
+  }
+  // One load at a time: ordinary reads and forced refreshes share a single in-flight promise,
+  // so two requests can never spend the same (rotating) refresh token concurrently.
+  load(forceRefresh) {
+    const pending = loadAuthTokens({
       authFilePath: this.settings.authFilePath,
       clientId: this.settings.clientId,
       issuer: this.settings.issuer,
       tokenUrl: this.settings.tokenUrl,
       fetch: this.fetch,
       ensureFresh: this.settings.ensureFresh,
+      forceRefresh,
       now: this.settings.now
     }).then((auth) => {
+      if (this.inflight === pending) this.inflight = void 0;
       this.current = auth;
-      this.inflight = void 0;
       return auth;
     }).catch((error40) => {
-      this.inflight = void 0;
+      if (this.inflight === pending) this.inflight = void 0;
       throw error40;
     });
-    return this.inflight;
+    this.inflight = pending;
+    return pending;
+  }
+  // Called after upstream rejected `rejectedToken`. Wait for any load already running, re-read
+  // the file (another request may have refreshed already), and only force a refresh if the file
+  // still holds the rejected token.
+  async refresh(rejectedToken) {
+    if (this.inflight) {
+      await this.inflight.catch(() => {});
+    }
+    const fresh = await this.ensure();
+    if (fresh.accessToken !== rejectedToken) {
+      return fresh;
+    }
+    if (this.inflight) {
+      return this.inflight;
+    }
+    return this.load(true);
   }
   async headers() {
-    const auth = this.current ?? await this.ensure();
+    const auth = await this.ensure();
     return {
       Authorization: `Bearer ${auth.accessToken}`,
       "chatgpt-account-id": auth.accountId,
@@ -17961,12 +18009,34 @@ var createCodexOAuthFetch = (settings = {}) => {
       settings,
       responsesState
     );
-    const response = await fetch(target.toString(), {
+    let response = await fetch(target.toString(), {
       method: request.method ?? init?.method,
       headers,
       body: preparedBody.body,
       signal: request.signal ?? void 0
     });
+    const replayable = preparedBody.body == null || typeof preparedBody.body === "string" || preparedBody.body instanceof Uint8Array || preparedBody.body instanceof ArrayBuffer;
+    if (response.status === 401 && replayable) {
+      let refreshed;
+      try {
+        refreshed = await authManager.refresh(headers.get("authorization")?.slice(7));
+      } catch {
+        refreshed = void 0;
+      }
+      if (refreshed && refreshed.accessToken && refreshed.accessToken !== headers.get("authorization")?.slice(7)) {
+        await response.body?.cancel().catch(() => {});
+        const retryHeaders = await authManager.headers();
+        for (const [key, value] of Object.entries(retryHeaders)) {
+          headers.set(key, value);
+        }
+        response = await fetch(target.toString(), {
+          method: request.method ?? init?.method,
+          headers,
+          body: preparedBody.body,
+          signal: request.signal ?? void 0
+        });
+      }
+    }
     return captureResponsesState(
       response,
       preparedBody.requestBody,

package/node_modules/openai-oauth/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "openai-oauth",
-	"version": "1.0.2-ima2.1",
+	"version": "1.0.2-ima2.2",
 	"description": "Free OpenAI API access with your ChatGPT account.",
-	"ima2Patch": "adds originator/version headers + codex client version floor 0.144.0 for GPT-5.6 rollout",
+	"ima2Patch": "adds originator/version headers + codex client version floor 0.144.0 for GPT-5.6 rollout; re-reads the session file per request (no stale cached token), one serialized forced refresh + retry on upstream 401, compare-before-write so a concurrent login is never overwritten, atomic auth.json write-back that keeps unknown keys",
 	"type": "module",
 	"bin": {
 		"openai-oauth": "./dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "packageManager": "npm@11.18.0",
   "description": "Local-first visual generation runtime and studio for people and coding agents, with reproducible image and video workflows across multiple providers.",
   "type": "module",
@@ -99,7 +99,7 @@
     "express": "^5.1.0",
     "google-auth-library": "^11.0.1",
     "openai": "^7.4.0",
-    "openai-oauth": "file:vendor/openai-oauth-1.0.2-ima2.1.tgz",
+    "openai-oauth": "file:vendor/openai-oauth-1.0.2-ima2.2.tgz",
     "sharp": "^0.35.3",
     "trash": "^10.1.1",
     "ulid": "^3.0.2",
@@ -126,5 +126,5 @@
     "typescript": "^5.9.3",
     "yaml": "2.9.0"
   },
-  "gitHead": "38f2724a181d452015a9a0ea3d6f317513d86114"
+  "gitHead": "b00ac61d6a11bd1d14a3ee987fbdb978f366c85f"
 }

package/routes/auth.js

@@ -1,232 +1,128 @@
-import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { codexFileLoginArgs, detectCodexAuth } from "../lib/codexDetect.js";
-import { packageCliCommand } from "../lib/packageCli.js";
-import { XAI_OAUTH_CLIENT_ID as GROK_CLIENT_ID, XAI_OAUTH_SCOPE as GROK_SCOPE, XAI_TOKEN_ENDPOINT_FALLBACK as GROK_TOKEN_URL, loadGrokCredentials, saveGrokCredentials, } from "../lib/xaiAuth.js";
-const CODEX_DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+import { runChatgptLogin } from "../lib/chatgptLogin.js";
+import { runXaiDeviceLogin } from "../lib/xaiDeviceLogin.js";
 const MAX_CONCURRENT_SESSIONS = 20;
+const PROMPT_TIMEOUT_MS = 30_000;
 const sessions = new Map();
 function sid() {
     return randomBytes(16).toString("hex");
 }
-function cleanup(id) {
+function finish(id, status, error) {
     const s = sessions.get(id);
-    if (s?.pollTimer)
-        clearInterval(s.pollTimer);
-    if (s?.child && !s.child.killed)
-        s.child.kill();
-    if (s)
-        delete s.deviceCode;
-    setTimeout(() => sessions.delete(id), 120_000);
-}
-function stripAnsi(s) {
-    return s.replace(/\x1B\[[0-9;]*m/g, "");
-}
-function saveGrokTokens(tokens) {
-    if (typeof tokens.access_token !== "string" || tokens.access_token.length === 0) {
-        throw new Error("xAI token response did not include an access token");
+    if (!s)
+        return;
+    if (s.status === "pending") {
+        s.status = status;
+        if (error)
+            s.error = error;
     }
-    let email;
-    if (typeof tokens.id_token === "string") {
-        try {
-            const segment = tokens.id_token.split(".")[1];
-            if (!segment)
-                throw new Error("missing jwt payload");
-            const payload = JSON.parse(Buffer.from(segment, "base64url").toString());
-            email = payload.email;
-        }
-        catch { /* ignore */ }
+    s.abort.abort();
+    setTimeout(() => sessions.delete(id), 120_000).unref?.();
+}
+/** Only one ChatGPT browser login can own localhost:1455; a new start retires the old ones. */
+function cancelPending(provider) {
+    for (const [id, s] of sessions) {
+        if (s.provider === provider && s.status === "pending")
+            finish(id, "error", "superseded by a newer login");
     }
-    // Merge over the existing file so a field only progrok writes (idToken) survives a
-    // fresh login; the atomic 0600 write itself lives in lib/xaiAuth.ts.
-    const data = {
-        ...(loadGrokCredentials() ?? {}),
-        accessToken: tokens.access_token,
-        ...(typeof tokens.refresh_token === "string" ? { refreshToken: tokens.refresh_token } : {}),
-        ...(typeof tokens.expires_in === "number" ? { expiresAt: Date.now() + tokens.expires_in * 1000 } : {}),
-        tokenEndpoint: GROK_TOKEN_URL,
-        ...(typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}),
-        ...(email ? { email } : {}),
-    };
-    saveGrokCredentials(data);
 }
-async function startGrokDeviceCode() {
-    const discovery = await fetch("https://auth.x.ai/.well-known/openid-configuration", { signal: AbortSignal.timeout(10000) });
-    const disc = await discovery.json();
-    if (!disc.device_authorization_endpoint)
-        throw new Error("xAI does not expose device_authorization_endpoint");
-    const res = await fetch(disc.device_authorization_endpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({ client_id: GROK_CLIENT_ID, scope: GROK_SCOPE }),
-        signal: AbortSignal.timeout(15000),
-    });
-    if (!res.ok)
-        throw new Error(`Device code request failed: ${res.status}`);
-    const dc = await res.json();
-    const id = sid();
-    const session = {
-        provider: "grok",
-        userCode: dc.user_code,
-        verificationUrl: dc.verification_uri_complete || dc.verification_uri,
-        expiresAt: Date.now() + dc.expires_in * 1000,
-        status: "pending",
-        deviceCode: dc.device_code,
-    };
-    sessions.set(id, session);
-    const interval = Math.max((dc.interval || 5) * 1000, 5000);
-    session.pollTimer = setInterval(async () => {
-        if (session.status !== "pending") {
-            cleanup(id);
-            return;
-        }
-        if (Date.now() > session.expiresAt) {
-            session.status = "expired";
-            cleanup(id);
-            return;
-        }
-        try {
-            const tokenRes = await fetch(disc.token_endpoint, {
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: new URLSearchParams({
-                    grant_type: CODEX_DEVICE_CODE_GRANT,
-                    client_id: GROK_CLIENT_ID,
-                    device_code: dc.device_code,
-                }),
-                signal: AbortSignal.timeout(10000),
-            });
-            if (tokenRes.ok) {
-                const tokens = await tokenRes.json();
-                saveGrokTokens(tokens);
-                session.status = "complete";
-                cleanup(id);
-                return;
-            }
-            const err = await tokenRes.json();
-            if (err.error !== "authorization_pending" && err.error !== "slow_down") {
-                session.status = "error";
-                session.error = err.error || "unknown";
-                cleanup(id);
-            }
-        }
-        catch { /* network error, keep polling */ }
-    }, interval);
-    return { sessionId: id, userCode: dc.user_code, verificationUrl: session.verificationUrl, expiresIn: dc.expires_in };
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
 }
-function startCodexDeviceCode() {
+/**
+ * Starts a flow and resolves as soon as the user has something to open. The flow keeps
+ * running in the background and records its outcome on the session.
+ */
+function startSession(provider, run, onComplete, live) {
+    const id = sid();
+    const abort = new AbortController();
+    live?.add(abort);
     return new Promise((resolve, reject) => {
-        // Don't hand other providers' secrets to the codex child — it only needs
-        // PATH/HOME/codex config to run the ChatGPT device-code login.
-        const childEnv = { ...process.env };
-        for (const k of ["OPENAI_API_KEY", "XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "VERTEX_SERVICE_ACCOUNT_JSON", "ATLASCLOUD_API_KEY", "MINIMAX_API_KEY"]) {
-            delete childEnv[k];
-        }
-        const codex = packageCliCommand("@openai/codex", "codex", codexFileLoginArgs({ deviceAuth: true }));
-        const child = spawn(codex.command, codex.args, {
-            stdio: ["ignore", "pipe", "pipe"],
-            env: childEnv,
-            shell: false,
-            windowsHide: true,
-        });
-        let stdout = "";
-        let resolved = false;
-        const id = sid();
-        const session = {
-            provider: "codex",
-            userCode: "",
-            verificationUrl: "",
-            expiresAt: Date.now() + 15 * 60 * 1000,
-            status: "pending",
-            child,
-        };
-        sessions.set(id, session);
-        // Server-side reaper: if the client abandons the flow (closes browser, stops
-        // polling), kill the lingering codex child instead of waiting for it to self-exit.
-        const reaper = setTimeout(() => {
-            if (session.status === "pending") {
-                session.status = "expired";
-                cleanup(id);
-            }
-        }, 16 * 60 * 1000);
-        reaper.unref?.();
-        child.stdout?.on("data", (chunk) => {
-            stdout += chunk.toString();
-            if (resolved)
+        let prompted = false;
+        const promptTimer = setTimeout(() => {
+            if (prompted)
                 return;
-            const clean = stripAnsi(stdout);
-            const urlMatch = clean.match(/https:\/\/auth\.openai\.com\/codex\/device/);
-            const codeMatch = clean.match(/^\s+([A-Z0-9]{4}-[A-Z0-9]{4,5})\s*$/m);
-            if (urlMatch && codeMatch) {
-                resolved = true;
-                const userCode = codeMatch[1];
-                if (!userCode)
-                    return;
-                session.userCode = userCode;
-                session.verificationUrl = urlMatch[0];
-                resolve({
-                    sessionId: id,
-                    userCode,
-                    verificationUrl: urlMatch[0],
-                    expiresIn: 900,
-                });
-            }
-        });
-        child.stderr?.on("data", () => { });
-        child.on("close", (code) => {
-            if (!resolved) {
-                sessions.delete(id);
-                reject(new Error(`codex login exited with code ${code} before providing device code`));
+            abort.abort();
+            reject(new Error("Timed out starting the login"));
+        }, PROMPT_TIMEOUT_MS);
+        run(abort.signal, (prompt) => {
+            prompted = true;
+            clearTimeout(promptTimer);
+            const session = {
+                provider,
+                flow: prompt.flow,
+                userCode: prompt.userCode ?? "",
+                verificationUrl: prompt.url,
+                expiresAt: Date.now() + prompt.expiresIn * 1000,
+                status: "pending",
+                abort,
+            };
+            sessions.set(id, session);
+            // Server-side reaper: an abandoned flow must not hold its poll loop or port forever.
+            setTimeout(() => finish(id, "expired"), prompt.expiresIn * 1000 + 5_000).unref?.();
+            resolve({ sessionId: id, flow: prompt.flow, userCode: session.userCode, verificationUrl: prompt.url, expiresIn: prompt.expiresIn });
+        }).finally(() => live?.delete(abort)).then((result) => {
+            const session = sessions.get(id);
+            if (session && result.email)
+                session.email = result.email;
+            if (session?.status === "pending")
+                onComplete?.();
+            finish(id, "complete");
+        }, (error) => {
+            clearTimeout(promptTimer);
+            if (!prompted) {
+                reject(error instanceof Error ? error : new Error(String(error)));
                 return;
             }
-            const proxyReady = code === 0 && detectCodexAuth().proxyReady;
-            session.status = proxyReady ? "complete" : "error";
-            if (code !== 0)
-                session.error = `codex exited with code ${code}`;
-            else if (!proxyReady)
-                session.error = "Codex login did not create a file-backed GPT OAuth session";
-            cleanup(id);
+            finish(id, abort.signal.aborted ? "expired" : "error", errorMessage(error));
         });
-        child.on("error", (err) => {
-            if (!resolved) {
-                sessions.delete(id);
-                reject(new Error(`codex not found: ${err.message}`));
-                return;
-            }
-            session.status = "error";
-            session.error = err.message;
-            cleanup(id);
+    });
+}
+/**
+ * Every codex login that has started but not settled, including ones still waiting for their
+ * first prompt (not yet in `sessions`). A new start aborts all of them synchronously, before
+ * its own first await, so two near-simultaneous starts can never both save a session.
+ */
+const liveCodexLogins = new Set();
+function startCodexLogin(flow, ctx) {
+    cancelPending("codex");
+    for (const controller of liveCodexLogins)
+        controller.abort();
+    liveCodexLogins.clear();
+    return startSession("codex", async (signal, onPrompt) => {
+        const session = await runChatgptLogin({
+            flow,
+            signal,
+            onPrompt: (prompt) => onPrompt(prompt),
         });
-        setTimeout(() => {
-            if (!resolved) {
-                sessions.delete(id);
-                if (!child.killed)
-                    child.kill();
-                reject(new Error("Timed out waiting for codex device code output"));
-            }
-        }, 30000);
+        return session.email ? { email: session.email } : {};
+    }, () => { ctx?.restartOAuthProxy?.(); }, liveCodexLogins);
+}
+function startGrokLogin(ctx) {
+    return startSession("grok", async (signal, onPrompt) => {
+        const creds = await runXaiDeviceLogin({
+            signal,
+            ...(ctx?.grokAuthHomeDir ? { homeDir: ctx.grokAuthHomeDir } : {}),
+            onUserCode: (info) => onPrompt({ flow: "device", url: info.verificationUrl, userCode: info.userCode, expiresIn: info.expiresIn }),
+        });
+        return creds.email ? { email: creds.email } : {};
     });
 }
-/** `_ctx` is accepted only to keep the registration signature uniform in
- *  routes/index.ts; the device-code flow writes credentials to disk and no
- *  longer notifies any in-process supervisor. */
-export function registerAuthRoutes(app, _ctx) {
+export function registerAuthRoutes(app, ctx) {
     app.post("/api/auth/switch", async (req, res) => {
         const provider = req.body?.provider;
         if (provider !== "grok" && provider !== "codex") {
             return res.status(400).json({ error: "provider must be grok or codex" });
         }
+        const flow = req.body?.flow === "device" ? "device" : "browser";
         if (sessions.size >= MAX_CONCURRENT_SESSIONS) {
             return res.status(429).json({ error: "Too many pending auth sessions" });
         }
         try {
-            const result = provider === "grok"
-                ? await startGrokDeviceCode()
-                : await startCodexDeviceCode();
-            res.json(result);
+            res.json(provider === "grok" ? await startGrokLogin(ctx) : await startCodexLogin(flow, ctx));
         }
         catch (e) {
-            res.status(502).json({ error: e.message });
+            res.status(502).json({ error: errorMessage(e) });
         }
     });
     app.get("/api/auth/switch/:sessionId", (req, res) => {
@@ -234,14 +130,25 @@ export function registerAuthRoutes(app, _ctx) {
         if (!session)
             return res.status(404).json({ status: "expired" });
         if (session.status === "complete")
-            return res.json({ status: "complete" });
+            return res.json({ status: "complete", ...(session.email ? { email: session.email } : {}) });
         if (session.status === "error")
             return res.json({ status: "error", error: session.error });
-        if (Date.now() > session.expiresAt) {
-            session.status = "expired";
-            cleanup(req.params.sessionId);
+        if (session.status === "expired" || Date.now() > session.expiresAt) {
+            finish(req.params.sessionId, "expired");
             return res.json({ status: "expired" });
         }
-        res.json({ status: "pending" });
+        res.json({ status: "pending", flow: session.flow });
+    });
+    app.delete("/api/auth/switch/:sessionId", (req, res) => {
+        const session = sessions.get(req.params.sessionId);
+        if (!session)
+            return res.status(404).json({ status: "expired" });
+        finish(req.params.sessionId, "expired", "cancelled");
+        res.json({ status: "expired" });
+    });
+    /** CLI logins write the session file directly; this lets them tell a running server. */
+    app.post("/api/oauth/restart", (_req, res) => {
+        const result = ctx?.restartOAuthProxy?.() ?? { restarted: false, reason: "oauth proxy is not managed by this server" };
+        res.json(result);
     });
 }