ldrouter 1.14.1 → 1.16.2

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.16.2] - 2026-09-14
+
+### Fixed
+
+- npm release failed with `E409 Conflict - Failed to save packument`: the package had been renamed to `latedev-router`, which the registry still holds as an empty package after all of its versions were unpublished, so no new version can be written under that name. The package name is back to `ldrouter` (the name that last published successfully); the CLI still exposes both `ldrouter` and `latedev-router` binaries.
+
+## [1.16.1] - 2026-09-13
+
+### Fixed
+
+- **Test connection** and **Import models** on the Codex accounts group always failed with `Gateway error`: the models request omitted the `client_version` query parameter the Codex endpoint requires, and the response was read from `models[].id` while the endpoint returns `models[].slug`, so discovery came back empty or errored.
+- Deleting a Codex provider failed with `Gateway error`: `codex_accounts.provider_id` is `ON DELETE RESTRICT`, so removing the provider last raised a raw SQLite constraint error. The provider delete now removes the provider and its Codex account pool in one transaction and reports how many accounts were deleted.
+
+## [1.16.0] - 2026-09-13
+
+### Added
+
+- Codex account pool UI: a dedicated Codex accounts group on the Providers page with expand/collapse, account filtering, and pagination — separate from the generic Add provider dialog, which no longer collects Codex credentials.
+- Codex quota panel showing the 5-hour and weekly windows with live reset countdowns, per-account and refresh-all usage refresh, weekly reset-credit count, and a **Reset quota** action that spends one credit.
+- Codex 5-hour window auto-start (opt-in per account): when a window is exhausted and its reset time has passed, the gateway sends one tiny ping so the next window opens immediately. One ping per reset minute, persisted so it survives restarts.
+- Codex model import dialog with search, Select All, and existing-model detection.
+- Connect OpenAI Codex: a browser-based PKCE flow that shows the authorize URL, waits for the loopback callback, and also accepts a pasted callback URL or bare authorization code. The verifier stays server-side and the authorization code is exchanged server-side, so neither ever appears in the UI.
+  - `GET /oauth/codex/callback` captures the Codex CLI loopback redirect (`http://localhost:1455/auth/callback`) and holds the code in memory against its `state`; the dialog polls `GET /api/admin/codex/oauth/:state` and enables **Connect** as soon as a code is captured. The page never echoes the code.
+- Drag-and-drop routing order for Codex accounts (`@dnd-kit/core`, `@dnd-kit/sortable`, `@dnd-kit/modifiers`), replacing the numeric priority prompt. Rows can also be reordered with the keyboard; the saved order is the router's fallback order.
+- `migrations/0006_codex_usage.sql`: usage snapshot, usage error, auto-start flag, and ping bookkeeping columns on `codex_accounts`.
+
+### Fixed
+
+- Codex account API returned `enabled` as SQLite `0`/`1` instead of a boolean, so the enable/disable control could show the wrong state.
+- Codex credential refresh/decrypt failures returned an opaque HTTP 500 with `Gateway error`; they now return a typed 401 naming the fix (re-import the account).
+- Codex model discovery threw a bare error without an HTTP status, so a 401 never triggered the refresh-and-retry path and surfaced as `Gateway error` instead of an auth failure.
+- **Delete** on a Codex account was a soft delete that left the encrypted credentials on disk; it is now a hard delete. Past request attempts are unaffected because their account reference is `ON DELETE SET NULL`.
+- The Codex account row rendered two identical Enable/Disable controls.
+
+## [1.15.0] - 2026-09-12
+
+### Added
+
+- Native Codex OAuth account import from redacted JSON, JSON arrays, wrapper objects, and JSONL, with provider-scoped deduplication and encrypted token storage.
+- Codex token refresh/rotation, bounded unauthorized retry, account health tracking, account-aware routing, and attempt attribution.
+- Codex provider setup, account import, refresh status, enable/disable, and safe test controls in the admin UI.
+
 ## [1.14.1] - 2026-09-12
 
 ### Fixed

package/README.md

@@ -19,6 +19,7 @@ Lightweight self-hosted LLM gateway with a polished admin UI. Presents stable Op
 - Consistent backup / restore (SQLite snapshot + checksum + schema validation)
 - Prometheus `/metrics`, structured logs, graceful shutdown
 - One distributable npm package, multi-stage Dockerfile, Docker Compose
+- Native Codex OAuth account pools with encrypted JSON/JSONL import, refresh/rotation, account-aware routing, and admin management
 
 ## Quick start
 
@@ -36,12 +37,33 @@ Then visit `http://localhost:8787/` and complete the first-run admin setup.
 ### Using npm
 
 ```bash
-npx latedev-router
+npx ldrouter
 latedev-router --host 0.0.0.0 --port 8787
 ```
 
 The data directory defaults to `~/.latedev-router/` and can be overridden via `LATEDEV_DATA_DIR` or `--data-dir`.
 
+### Codex OAuth setup
+
+1. Set `LATEDEV_MASTER_KEY` before creating or importing credentials. Use a strong random base64 key; it encrypts Codex access, refresh, and ID tokens at rest.
+2. In **Providers**, create a provider with type **Codex**. Codex providers do not use the generic API-key field.
+3. Open the Codex account panel and import a redacted copy of a Codex OAuth `auth.json`, a JSON array, an `{ "accounts": [...] }` wrapper, or JSONL with one record per line. Records may contain a `tokens` object with access/refresh/ID tokens. For example:
+
+   `{ "accountId": "acct-…masked", "email": "admin@example.invalid", "tokens": { "accessToken": "[REDACTED]", "refreshToken": "[REDACTED]" } }`
+
+   JSONL stores one similarly redacted object per line; an array uses the same records: `[ { "accountId": "acct-…masked", "tokens": { "accessToken": "[REDACTED]" } } ]`.
+
+   Alternatively, use **Connect Codex** to authorize a ChatGPT account in the browser. The dialog shows the Codex CLI PKCE authorize URL, waits for the loopback callback, and also accepts a pasted callback URL or bare authorization code. The PKCE verifier and the authorization code stay server-side and never appear in the UI. The Codex CLI callback (`http://localhost:1455/auth/callback`) is captured by `GET /oauth/codex/callback`; because browsers block that cross-origin redirect, paste the address bar URL into step 2 when the auto-capture page fails to load.
+4. Review the preview and import only the records you want. Account/workspace identity is preferred for deduplication; email alone never merges unrelated accounts. Re-importing the same identity updates its encrypted tokens while preserving its enabled state.
+
+Raw tokens are accepted only by the authenticated import pipeline and are never returned in previews, API responses, UI state, audit logs, request logs, errors, or database backups. JWT claims are decoded for metadata only; token signatures are not verified locally. Tokens are refreshed proactively near expiry and once after an upstream 401/403, with rotated values persisted atomically.
+
+The import endpoint requires the normal admin session and CSRF token (`x-csrf-token`) for mutations, including multipart uploads. Use HTTPS for remote administration and protect the master key like any encryption key. Back up the SQLite data directory consistently; restoring encrypted credentials requires the matching master key, otherwise re-save/re-import credentials after restore.
+
+ZIP upload and automatic Codex CLI config-file generation/mutation are not included in this release. LateDev Router does not modify Codex CLI files.
+
+The account panel shows the 5-hour and weekly quota windows with reset countdowns, per-account and bulk usage refresh, weekly reset credits, an opt-in 5-hour window auto-start, and a **Test** control that probes the upstream account without exposing tokens. Routing order is set by dragging rows; the saved order is the fallback order the router uses. **Delete** is permanent and erases the stored encrypted credentials — past request logs are kept but lose the account reference.
+
 ## Environment variables
 
 | Variable | Description | Default |

package/dist/server/app.js

@@ -4,6 +4,7 @@ import cookie from '@fastify/cookie';
 import helmet from '@fastify/helmet';
 import cors from '@fastify/cors';
 import staticPlugin from '@fastify/static';
+import multipart from '@fastify/multipart';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -43,6 +44,7 @@ export async function buildApp(opts = {}) {
         crossOriginEmbedderPolicy: false,
     });
     await app.register(cors, { origin: false, credentials: true });
+    await app.register(multipart, { limits: { fileSize: 2_000_000, files: 20, parts: 25 } });
     // Every request is logged as structured JSON for Docker. Bodies and headers
     // are intentionally excluded; sensitive values must never reach logs.
     app.addHook('onRequest', async (req) => {
@@ -63,7 +65,12 @@ export async function buildApp(opts = {}) {
         const normalized = err instanceof ZodError
             ? new GatewayError('invalid_request_error', err.issues.map((i) => `${i.path.join('.') || 'body'}: ${i.message}`).join('; '), { status: 400 })
             : err;
-        const g = normalized instanceof GatewayError ? normalized : null;
+        const multipartTooLarge = normalized.code === 'FST_REQ_FILE_TOO_LARGE';
+        const g = normalized instanceof GatewayError
+            ? normalized
+            : multipartTooLarge
+                ? new GatewayError('invalid_request_error', 'Import exceeds maximum size', { status: 413 })
+                : null;
         const status = g?.status ?? 500;
         const requestId = req.id;
         // Fastify runs with `logger: false`, so req.log is a silent no-op — use the app
@@ -191,6 +198,8 @@ export async function startApp() {
     process.once('SIGTERM', () => void close('SIGTERM'));
     process.once('SIGINT', () => void close('SIGINT'));
     await app.listen({ host: cfg.host, port: cfg.port });
+    const { startCodexAutostart } = await import('./providers/codex-autostart.js');
+    startCodexAutostart();
     return app;
 }
 // re-export for convenience

package/dist/server/auth/middleware.js

@@ -1,9 +1,45 @@
 // Auth middleware: admin session validation.
 import { getDb, schema } from '../db/index.js';
 import { sql } from 'drizzle-orm';
-import { sha256Hex } from './ids.js';
+import { sha256Hex, uuid } from './ids.js';
+import crypto from 'node:crypto';
+const CSRF_TOKEN_MAX_AGE = 60 * 60 * 12; // 12h, aligned with admin sessions
+function csrfExpiry() {
+    return new Date(Date.now() + CSRF_TOKEN_MAX_AGE * 1000).toISOString();
+}
 import { GatewayError } from '../errors.js';
 import { recordAudit } from '../db/repositories/audit.js';
+import { timingSafeEqual } from 'node:crypto';
+const CsrfHeader = 'x-csrf-token';
+export async function requireAdminCsrf(req) {
+    const token = req.headers[CsrfHeader];
+    if (typeof token !== 'string' || !req.adminSessionId)
+        throw new GatewayError('authentication_error', 'CSRF token required', { status: 403 });
+    const row = getDb().select().from(schema.csrfTokens).where(sql `session_id = ${req.adminSessionId}`).get();
+    const expected = row?.token;
+    if (!expected || new Date(row.expiresAt).getTime() < Date.now())
+        throw new GatewayError('authentication_error', 'Invalid CSRF token', { status: 403 });
+    const actualBytes = Buffer.from(token);
+    const expectedBytes = Buffer.from(expected);
+    if (actualBytes.length !== expectedBytes.length || !timingSafeEqual(actualBytes, expectedBytes))
+        throw new GatewayError('authentication_error', 'Invalid CSRF token', { status: 403 });
+}
+export function csrfTokenForSession(sessionId) {
+    const db = getDb();
+    const row = db.select().from(schema.csrfTokens).where(sql `session_id = ${sessionId}`).get();
+    if (row && new Date(row.expiresAt).getTime() >= Date.now())
+        return row.token;
+    const token = crypto.randomBytes(32).toString('base64url');
+    const expiresAt = csrfExpiry();
+    if (row) {
+        db.update(schema.csrfTokens).set({ token, expiresAt }).where(sql `id = ${row.id}`).run();
+    }
+    else {
+        db.insert(schema.csrfTokens).values({ id: uuid(), sessionId, token, expiresAt }).run();
+    }
+    return token;
+}
+export { CsrfHeader };
 const SessionCookie = 'ld_session';
 export async function requireAdminAuth(req, _reply) {
     const token = req.cookies[SessionCookie];

package/dist/server/db/index.js

@@ -61,4 +61,9 @@ export function getDb() {
         throw new Error('Database not opened');
     return _db;
 }
+export function getRawDb() {
+    if (!_raw)
+        throw new Error('Database not opened');
+    return _raw;
+}
 export { schema };

package/dist/server/db/migrate.js

@@ -140,10 +140,10 @@ function buildInitialSchemaSql() {
       id TEXT PRIMARY KEY,
       name TEXT NOT NULL,
       slug TEXT NOT NULL UNIQUE,
-      type TEXT NOT NULL CHECK (type IN ('openai','anthropic')),
-      base_url TEXT NOT NULL,
-      encrypted_api_key TEXT NOT NULL,
-      api_key_nonce TEXT NOT NULL,
+      type TEXT NOT NULL CHECK (type IN ('openai','anthropic','codex')),
+            base_url TEXT NOT NULL,
+            encrypted_api_key TEXT,
+            api_key_nonce TEXT,
       api_key_version INTEGER NOT NULL DEFAULT 1,
       custom_headers_encrypted TEXT,
       custom_headers_nonce TEXT,
@@ -302,6 +302,37 @@ function buildInitialSchemaSql() {
     CREATE INDEX IF NOT EXISTS idx_request_requested ON requests(requested_model, created_at);
     CREATE INDEX IF NOT EXISTS idx_request_protocol ON requests(protocol, created_at);
 
+    CREATE TABLE IF NOT EXISTS codex_accounts (
+      id TEXT PRIMARY KEY,
+      provider_id TEXT NOT NULL REFERENCES providers(id) ON DELETE RESTRICT,
+      email TEXT,
+      workspace_id TEXT,
+      chatgpt_account_id TEXT,
+      plan_type TEXT,
+      encrypted_access_token TEXT NOT NULL,
+      access_token_nonce TEXT NOT NULL,
+      access_token_version INTEGER NOT NULL DEFAULT 1,
+      encrypted_refresh_token TEXT NOT NULL,
+      refresh_token_nonce TEXT NOT NULL,
+      refresh_token_version INTEGER NOT NULL DEFAULT 1,
+      encrypted_id_token TEXT,
+      id_token_nonce TEXT,
+      id_token_version INTEGER NOT NULL DEFAULT 1,
+      token_expires_at TEXT NOT NULL,
+      last_refresh_at TEXT,
+      auth_method TEXT NOT NULL DEFAULT 'oauth' CHECK (auth_method IN ('oauth','access_token')),
+      enabled INTEGER NOT NULL DEFAULT 1,
+      health_state TEXT NOT NULL DEFAULT 'unknown' CHECK (health_state IN ('healthy','degraded','down','unknown')),
+      last_error TEXT,
+      consecutive_failures INTEGER NOT NULL DEFAULT 0,
+      priority INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_codex_account_provider_enabled_priority ON codex_accounts(provider_id, enabled, priority);
+    CREATE INDEX IF NOT EXISTS idx_codex_account_provider_email ON codex_accounts(provider_id, email);
+    CREATE INDEX IF NOT EXISTS idx_codex_account_provider_chatgpt ON codex_accounts(provider_id, chatgpt_account_id);
+
     CREATE TABLE IF NOT EXISTS request_attempts (
       id TEXT PRIMARY KEY,
       request_id TEXT NOT NULL REFERENCES requests(id) ON DELETE CASCADE,
@@ -324,9 +355,11 @@ function buildInitialSchemaSql() {
       selection_reason TEXT NOT NULL,
       failure_reason TEXT,
       error_message TEXT,
-      upstream_request_id TEXT
+      upstream_request_id TEXT,
+      codex_account_id TEXT REFERENCES codex_accounts(id) ON DELETE SET NULL
     );
     CREATE INDEX IF NOT EXISTS idx_attempt_request ON request_attempts(request_id, attempt_number);
+    CREATE INDEX IF NOT EXISTS idx_attempt_codex_account ON request_attempts(codex_account_id, started_at);
     CREATE INDEX IF NOT EXISTS idx_attempt_provider_model ON request_attempts(provider_id, model_id, started_at);
 
     CREATE TABLE IF NOT EXISTS audit_logs (

package/dist/server/db/repositories/codex-accounts.js

@@ -0,0 +1,187 @@
+import { createHash } from 'node:crypto';
+import { decryptSecret, encryptSecret } from '../../auth/crypto.js';
+import { uuid } from '../../auth/ids.js';
+import { getRawDb } from '../index.js';
+const digest = (value) => createHash('sha256').update(value, 'utf8').digest('hex');
+export function maskCodexValue(value) {
+    if (!value)
+        return null;
+    return value.length <= 8 ? `${value.slice(0, 2)}…${value.slice(-2)}` : `${value.slice(0, 4)}…${value.slice(-4)}`;
+}
+export function identityFromCodexRecord(record) {
+    return {
+        chatgptAccountId: record.chatgptAccountId,
+        workspaceId: record.workspaceId,
+        email: record.email,
+        tokenDigest: digest(record.accessToken),
+    };
+}
+export function toCodexAccountSummary(row) {
+    return {
+        id: row.id,
+        email: row.email,
+        accountIdMasked: maskCodexValue(row.chatgptAccountId),
+        workspaceIdMasked: maskCodexValue(row.workspaceId),
+        planType: row.planType,
+        tokenExpiresAt: row.tokenExpiresAt,
+        // SQLite hands raw rows back as 0/1; the API contract (and the web UI) expects a boolean.
+        enabled: Boolean(row.enabled),
+        healthState: row.healthState,
+        lastRefreshAt: row.lastRefreshAt,
+        priority: row.priority,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+const client = getRawDb;
+function encrypted(value) {
+    return encryptSecret(value);
+}
+export function listCodexAccountsForProvider(providerId) {
+    return client().prepare(`SELECT id, chatgpt_account_id AS chatgptAccountId, enabled, health_state AS healthState, token_expires_at AS tokenExpiresAt, priority FROM codex_accounts WHERE provider_id=? ORDER BY priority,id`).all(providerId);
+}
+export function getCodexAccountForProvider(providerId) {
+    const row = listCodexAccountsForProvider(providerId).find((a) => a.enabled && (a.healthState === 'healthy' || a.healthState === 'unknown') && Date.parse(a.tokenExpiresAt) > Date.now());
+    return row?.chatgptAccountId ? { id: row.id, chatgptAccountId: row.chatgptAccountId } : null;
+}
+export function getCodexAccountById(id) {
+    const row = client().prepare(`SELECT id, chatgpt_account_id AS chatgptAccountId, enabled, health_state AS healthState, token_expires_at AS tokenExpiresAt FROM codex_accounts WHERE id=?`).get(id);
+    if (!row || !row.enabled || !['healthy', 'unknown'].includes(row.healthState) || Date.parse(row.tokenExpiresAt) <= Date.now())
+        return null;
+    return row.chatgptAccountId ? { id: row.id, chatgptAccountId: row.chatgptAccountId } : null;
+}
+export function listCodexAccountSummaries(providerId) {
+    const rows = client().prepare(`SELECT id,email,workspace_id AS workspaceId,chatgpt_account_id AS chatgptAccountId,plan_type AS planType,token_expires_at AS tokenExpiresAt,enabled,health_state AS healthState,last_refresh_at AS lastRefreshAt,priority,codex_autostart_enabled AS autostart,codex_usage_json AS usageJson,codex_usage_error AS usageError,codex_usage_updated_at AS usageUpdatedAt,last_pinged_reset_at AS lastPingedResetAt,last_ping_at AS lastPingAt,created_at AS createdAt,updated_at AS updatedAt FROM codex_accounts WHERE provider_id=? ORDER BY priority,id`).all(providerId);
+    return rows.map(toCodexAccountSummaryRow);
+}
+export function findCodexAccountForImport(providerId, identity) {
+    const rows = client().prepare(`SELECT id,provider_id AS providerId,email,workspace_id AS workspaceId,chatgpt_account_id AS chatgptAccountId,plan_type AS planType,encrypted_access_token AS encryptedAccessToken,access_token_nonce AS accessTokenNonce,access_token_version AS accessTokenVersion,encrypted_refresh_token AS encryptedRefreshToken,refresh_token_nonce AS refreshTokenNonce,refresh_token_version AS refreshTokenVersion,encrypted_id_token AS encryptedIdToken,id_token_nonce AS idTokenNonce,id_token_version AS idTokenVersion,token_expires_at AS tokenExpiresAt,last_refresh_at AS lastRefreshAt,auth_method AS authMethod,enabled,health_state AS healthState,last_error AS lastError,consecutive_failures AS consecutiveFailures,priority,created_at AS createdAt,updated_at AS updatedAt FROM codex_accounts WHERE provider_id=?`).all(providerId);
+    const providerRows = rows;
+    if (identity.chatgptAccountId) {
+        const account = providerRows.find((row) => row.chatgptAccountId === identity.chatgptAccountId);
+        if (account)
+            return account;
+    }
+    if (identity.workspaceId) {
+        const workspace = providerRows.find((row) => row.workspaceId === identity.workspaceId);
+        if (workspace)
+            return workspace;
+    }
+    for (const row of providerRows) {
+        const credentials = getCodexCredentials(row.id);
+        if (digest(credentials.accessToken) === identity.tokenDigest)
+            return row;
+    }
+    return null;
+}
+function persistImport(providerId, record, existingId) {
+    const raw = client();
+    const access = encrypted(record.accessToken);
+    const refresh = encrypted(record.refreshToken);
+    const idToken = record.idToken ? encrypted(record.idToken) : null;
+    const now = existingId ? nextUpdatedAt(existingId) : new Date().toISOString();
+    const transaction = raw.transaction(() => {
+        if (existingId) {
+            raw.prepare(`UPDATE codex_accounts SET email=?, workspace_id=?, chatgpt_account_id=?, plan_type=?, encrypted_access_token=?, access_token_nonce=?, access_token_version=?, encrypted_refresh_token=?, refresh_token_nonce=?, refresh_token_version=?, encrypted_id_token=?, id_token_nonce=?, id_token_version=?, token_expires_at=?, last_error=NULL, consecutive_failures=0, health_state='unknown', updated_at=? WHERE id=?`).run(record.email, record.workspaceId, record.chatgptAccountId, record.planType, access.ciphertext, access.nonce, access.version, refresh.ciphertext, refresh.nonce, refresh.version, idToken?.ciphertext ?? null, idToken?.nonce ?? null, idToken?.version ?? 1, record.expiresAt, now, existingId);
+            return existingId;
+        }
+        const priority = raw.prepare('SELECT COALESCE(MAX(priority), -1) AS value FROM codex_accounts WHERE provider_id=?').get(providerId).value + 1;
+        const id = uuid();
+        raw.prepare(`INSERT INTO codex_accounts (id, provider_id, email, workspace_id, chatgpt_account_id, plan_type, encrypted_access_token, access_token_nonce, access_token_version, encrypted_refresh_token, refresh_token_nonce, refresh_token_version, encrypted_id_token, id_token_nonce, id_token_version, token_expires_at, priority) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(id, providerId, record.email, record.workspaceId, record.chatgptAccountId, record.planType, access.ciphertext, access.nonce, access.version, refresh.ciphertext, refresh.nonce, refresh.version, idToken?.ciphertext ?? null, idToken?.nonce ?? null, idToken?.version ?? 1, record.expiresAt, priority);
+        return id;
+    });
+    return transaction();
+}
+export function insertCodexAccount(providerId, record) {
+    return persistImport(providerId, record);
+}
+export function updateCodexAccountFromImport(id, record) {
+    const row = client().prepare('SELECT provider_id FROM codex_accounts WHERE id=?').get(id);
+    if (!row)
+        throw new Error('Codex account not found');
+    return persistImport(row.provider_id, record, id);
+}
+export function getCodexCredentials(id) {
+    const row = client().prepare('SELECT encrypted_access_token, access_token_nonce, access_token_version, encrypted_refresh_token, refresh_token_nonce, refresh_token_version, encrypted_id_token, id_token_nonce, id_token_version FROM codex_accounts WHERE id=?').get(id);
+    if (!row)
+        throw new Error('Codex account not found');
+    return {
+        accessToken: decryptSecret({ ciphertext: row.encrypted_access_token, nonce: row.access_token_nonce, version: row.access_token_version }),
+        refreshToken: decryptSecret({ ciphertext: row.encrypted_refresh_token, nonce: row.refresh_token_nonce, version: row.refresh_token_version }),
+        idToken: row.encrypted_id_token ? decryptSecret({ ciphertext: row.encrypted_id_token, nonce: row.id_token_nonce, version: row.id_token_version }) : null,
+    };
+}
+export function getCodexAccountRefreshState(id) {
+    const row = client().prepare('SELECT token_expires_at AS tokenExpiresAt FROM codex_accounts WHERE id=?').get(id);
+    if (!row)
+        return null;
+    const credentials = getCodexCredentials(id);
+    return { tokenExpiresAt: row.tokenExpiresAt, refreshToken: credentials.refreshToken, idToken: credentials.idToken };
+}
+export function persistCodexRefresh(id, update) {
+    const access = encrypted(update.accessToken);
+    const refresh = encrypted(update.refreshToken);
+    const idToken = update.idToken ? encrypted(update.idToken) : null;
+    const updatedAt = nextUpdatedAt(id);
+    client().transaction(() => {
+        client().prepare(`UPDATE codex_accounts SET encrypted_access_token=?, access_token_nonce=?, access_token_version=?, encrypted_refresh_token=?, refresh_token_nonce=?, refresh_token_version=?, encrypted_id_token=?, id_token_nonce=?, id_token_version=?, token_expires_at=?, last_refresh_at=?, last_error=NULL, consecutive_failures=0, health_state='healthy', updated_at=? WHERE id=?`).run(access.ciphertext, access.nonce, access.version, refresh.ciphertext, refresh.nonce, refresh.version, idToken?.ciphertext ?? null, idToken?.nonce ?? null, idToken?.version ?? 1, update.expiresAt, updatedAt, updatedAt, id);
+    })();
+}
+function nextUpdatedAt(id) {
+    const current = client().prepare('SELECT updated_at AS updatedAt FROM codex_accounts WHERE id=?').get(id);
+    const now = Date.now();
+    const previous = current ? Date.parse(current.updatedAt) : 0;
+    return new Date(Math.max(now, previous + 1)).toISOString();
+}
+export function setCodexAccountHealth(id, healthState, lastError = null, enabled) {
+    const fields = enabled === undefined ? 'health_state=?, last_error=?, updated_at=?' : 'health_state=?, last_error=?, enabled=?, updated_at=?';
+    const updatedAt = nextUpdatedAt(id);
+    const values = enabled === undefined ? [healthState, lastError, updatedAt, id] : [healthState, lastError, enabled ? 1 : 0, updatedAt, id];
+    client().prepare(`UPDATE codex_accounts SET ${fields} WHERE id=?`).run(...values);
+}
+export function upsertCodexAccount(providerId, record) {
+    const existing = findCodexAccountForImport(providerId, identityFromCodexRecord(record));
+    return existing ? { id: updateCodexAccountFromImport(existing.id, record), status: 'updated' } : { id: insertCodexAccount(providerId, record), status: 'added' };
+}
+export function saveCodexUsage(id, usage) {
+    client().prepare('UPDATE codex_accounts SET codex_usage_json=?, codex_usage_updated_at=?, codex_usage_error=NULL, updated_at=? WHERE id=?')
+        .run(JSON.stringify(usage), usage.fetchedAt, nextUpdatedAt(id), id);
+}
+export function saveCodexUsageError(id, message) {
+    client().prepare('UPDATE codex_accounts SET codex_usage_error=?, updated_at=? WHERE id=?').run(message.slice(0, 500), nextUpdatedAt(id), id);
+}
+function parseUsage(raw) {
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export function listCodexAccountUsage(providerId) {
+    const rows = client().prepare('SELECT id,provider_id AS providerId,chatgpt_account_id AS accountId,enabled,codex_autostart_enabled AS autostart,last_pinged_reset_at AS lastPingedResetAt,last_pinged_reset_key AS lastPingedResetKey,last_ping_at AS lastPingAt,codex_usage_json AS usageJson,codex_usage_error AS usageError FROM codex_accounts WHERE provider_id=? ORDER BY priority,id').all(providerId);
+    return rows.map(({ usageJson, ...row }) => ({ ...row, autostart: Boolean(row.autostart), enabled: Boolean(row.enabled), usage: parseUsage(usageJson) }));
+}
+/** Auto-start targets: enabled accounts that opted in, for the 10-minute scheduler tick. */
+export function listCodexAutostartTargets() {
+    const rows = client().prepare('SELECT id,provider_id AS providerId,last_ping_at AS lastPingAt FROM codex_accounts WHERE enabled=1 AND codex_autostart_enabled=1').all();
+    return rows;
+}
+export function markCodexAccountPinged(id, resetAt, resetKey) {
+    const now = new Date().toISOString();
+    client().prepare('UPDATE codex_accounts SET last_pinged_reset_at=?, last_pinged_reset_key=?, last_ping_at=?, updated_at=? WHERE id=?')
+        .run(resetAt, resetKey, now, nextUpdatedAt(id), id);
+}
+export function toCodexAccountSummaryRow(row) {
+    return {
+        ...toCodexAccountSummary(row),
+        autostart: Boolean(row.autostart),
+        usage: parseUsage(row.usageJson ?? null),
+        usageError: row.usageError ?? null,
+        usageUpdatedAt: row.usageUpdatedAt ?? null,
+        lastPingedResetAt: row.lastPingedResetAt ?? null,
+        lastPingAt: row.lastPingAt ?? null,
+    };
+}

package/dist/server/db/schema.js

@@ -81,10 +81,10 @@ export const providers = sqliteTable('providers', {
     id: text('id').primaryKey(),
     name: text('name').notNull(),
     slug: text('slug').notNull().unique(),
-    type: text('type', { enum: ['openai', 'anthropic'] }).notNull(),
+    type: text('type', { enum: ['openai', 'anthropic', 'codex'] }).notNull(),
     baseUrl: text('base_url').notNull(),
-    encryptedApiKey: text('encrypted_api_key').notNull(),
-    apiKeyNonce: text('api_key_nonce').notNull(),
+    encryptedApiKey: text('encrypted_api_key'),
+    apiKeyNonce: text('api_key_nonce'),
     apiKeyVersion: integer('api_key_version').notNull().default(1),
     customHeadersEncrypted: text('custom_headers_encrypted'),
     customHeadersNonce: text('custom_headers_nonce'),
@@ -106,6 +106,45 @@ export const providers = sqliteTable('providers', {
 }, (t) => ({
     slugIdx: uniqueIndex('uniq_provider_slug').on(t.slug),
 }));
+export const codexAccounts = sqliteTable('codex_accounts', {
+    id: text('id').primaryKey(),
+    providerId: text('provider_id').notNull().references(() => providers.id, { onDelete: 'restrict' }),
+    email: text('email'),
+    workspaceId: text('workspace_id'),
+    chatgptAccountId: text('chatgpt_account_id'),
+    planType: text('plan_type'),
+    encryptedAccessToken: text('encrypted_access_token').notNull(),
+    accessTokenNonce: text('access_token_nonce').notNull(),
+    accessTokenVersion: integer('access_token_version').notNull().default(1),
+    encryptedRefreshToken: text('encrypted_refresh_token').notNull(),
+    refreshTokenNonce: text('refresh_token_nonce').notNull(),
+    refreshTokenVersion: integer('refresh_token_version').notNull().default(1),
+    encryptedIdToken: text('encrypted_id_token'),
+    idTokenNonce: text('id_token_nonce'),
+    idTokenVersion: integer('id_token_version').notNull().default(1),
+    tokenExpiresAt: text('token_expires_at').notNull(),
+    lastRefreshAt: text('last_refresh_at'),
+    authMethod: text('auth_method', { enum: ['oauth', 'access_token'] }).notNull().default('oauth'),
+    enabled: integer('enabled', { mode: 'boolean' }).notNull().default(true),
+    healthState: text('health_state', { enum: ['healthy', 'degraded', 'down', 'unknown'] }).notNull().default('unknown'),
+    lastError: text('last_error'),
+    consecutiveFailures: integer('consecutive_failures').notNull().default(0),
+    priority: integer('priority').notNull().default(0),
+    // Codex quota snapshot (wham/usage) and 5-hour window auto-start state (v1.15.0).
+    codexUsageJson: text('codex_usage_json'),
+    codexUsageUpdatedAt: text('codex_usage_updated_at'),
+    codexUsageError: text('codex_usage_error'),
+    codexAutostartEnabled: integer('codex_autostart_enabled', { mode: 'boolean' }).notNull().default(false),
+    lastPingedResetAt: text('last_pinged_reset_at'),
+    lastPingedResetKey: text('last_pinged_reset_key'),
+    lastPingAt: text('last_ping_at'),
+    createdAt: text('created_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
+    updatedAt: text('updated_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
+}, (t) => ({
+    providerEnabledPriorityIdx: index('idx_codex_account_provider_enabled_priority').on(t.providerId, t.enabled, t.priority),
+    providerEmailIdx: index('idx_codex_account_provider_email').on(t.providerId, t.email),
+    providerChatgptIdx: index('idx_codex_account_provider_chatgpt').on(t.providerId, t.chatgptAccountId),
+}));
 // ============================================================================
 // Models
 // ============================================================================
@@ -287,6 +326,7 @@ export const requestAttempts = sqliteTable('request_attempts', {
     attemptNumber: integer('attempt_number').notNull(),
     providerId: text('provider_id').notNull(),
     modelId: text('model_id').notNull(),
+    codexAccountId: text('codex_account_id').references(() => codexAccounts.id, { onDelete: 'set null' }),
     startedAt: text('started_at').notNull(),
     completedAt: text('completed_at'),
     statusCode: integer('status_code'),
@@ -307,6 +347,7 @@ export const requestAttempts = sqliteTable('request_attempts', {
 }, (t) => ({
     requestIdx: index('idx_attempt_request').on(t.requestId, t.attemptNumber),
     providerModelIdx: index('idx_attempt_provider_model').on(t.providerId, t.modelId, t.startedAt),
+    codexAccountIdx: index('idx_attempt_codex_account').on(t.codexAccountId, t.startedAt),
 }));
 // ============================================================================
 // Audit logs (immutable, excluded from request retention)