oc-chatgpt-multi-auth 5.2.1 → 5.2.3

package/dist/index.js

@@ -28,13 +28,13 @@ import { queuedRefresh } from "./lib/refresh-queue.js";
 import { openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, loadPluginConfig, } from "./lib/config.js";
+import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
-import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
+import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
@@ -124,7 +124,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             accountLabel: choice.label,
         };
     };
-    const buildManualOAuthFlow = (pkce, url, onSuccess) => ({
+    const buildManualOAuthFlow = (pkce, url, expectedState, onSuccess) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
@@ -133,12 +133,29 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             if (!parsed.code) {
                 return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...)";
             }
+            if (!parsed.state) {
+                return "Missing OAuth state. Paste the full callback URL including both code and state parameters.";
+            }
+            if (parsed.state !== expectedState) {
+                return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt.";
+            }
             return undefined;
         },
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
-            if (!parsed.code) {
-                return { type: "failed", reason: "invalid_response", message: "No authorization code provided" };
+            if (!parsed.code || !parsed.state) {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: "Missing authorization code or OAuth state",
+                };
+            }
+            if (parsed.state !== expectedState) {
+                return {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: "OAuth state mismatch. Restart login and try again.",
+                };
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
             if (tokens?.type === "success") {
@@ -182,121 +199,123 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const persistAccountPool = async (results, replaceAll = false) => {
         if (results.length === 0)
             return;
-        const now = Date.now();
-        const stored = replaceAll ? null : await loadAccounts();
-        const accounts = stored?.accounts ? [...stored.accounts] : [];
-        const indexByRefreshToken = new Map();
-        const indexByAccountId = new Map();
-        const indexByEmail = new Map();
-        for (let i = 0; i < accounts.length; i += 1) {
-            const account = accounts[i];
-            if (!account)
-                continue;
-            if (account.refreshToken) {
-                indexByRefreshToken.set(account.refreshToken, i);
-            }
-            if (account.accountId) {
-                indexByAccountId.set(account.accountId, i);
-            }
-            if (account.email) {
-                indexByEmail.set(account.email, i);
+        await withAccountStorageTransaction(async (loadedStorage, persist) => {
+            const now = Date.now();
+            const stored = replaceAll ? null : loadedStorage;
+            const accounts = stored?.accounts ? [...stored.accounts] : [];
+            const indexByRefreshToken = new Map();
+            const indexByAccountId = new Map();
+            const indexByEmail = new Map();
+            for (let i = 0; i < accounts.length; i += 1) {
+                const account = accounts[i];
+                if (!account)
+                    continue;
+                if (account.refreshToken) {
+                    indexByRefreshToken.set(account.refreshToken, i);
+                }
+                if (account.accountId) {
+                    indexByAccountId.set(account.accountId, i);
+                }
+                if (account.email) {
+                    indexByEmail.set(account.email, i);
+                }
             }
-        }
-        for (const result of results) {
-            const accountId = result.accountIdOverride ?? extractAccountId(result.access);
-            const accountIdSource = accountId
-                ? result.accountIdSource ??
-                    (result.accountIdOverride ? "manual" : "token")
-                : undefined;
-            const accountLabel = result.accountLabel;
-            const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
-            const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
-                ? indexByEmail.get(accountEmail)
-                : undefined;
-            const existingById = accountId && indexByAccountId.has(accountId)
-                ? indexByAccountId.get(accountId)
-                : undefined;
-            const existingByToken = indexByRefreshToken.get(result.refresh);
-            const existingIndex = existingById ?? existingByEmail ?? existingByToken;
-            if (existingIndex === undefined) {
-                const newIndex = accounts.length;
-                accounts.push({
-                    accountId,
-                    accountIdSource,
-                    accountLabel,
-                    email: accountEmail,
+            for (const result of results) {
+                const accountId = result.accountIdOverride ?? extractAccountId(result.access);
+                const accountIdSource = accountId
+                    ? result.accountIdSource ??
+                        (result.accountIdOverride ? "manual" : "token")
+                    : undefined;
+                const accountLabel = result.accountLabel;
+                const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
+                const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
+                    ? indexByEmail.get(accountEmail)
+                    : undefined;
+                const existingById = accountId && indexByAccountId.has(accountId)
+                    ? indexByAccountId.get(accountId)
+                    : undefined;
+                const existingByToken = indexByRefreshToken.get(result.refresh);
+                const existingIndex = existingById ?? existingByEmail ?? existingByToken;
+                if (existingIndex === undefined) {
+                    const newIndex = accounts.length;
+                    accounts.push({
+                        accountId,
+                        accountIdSource,
+                        accountLabel,
+                        email: accountEmail,
+                        refreshToken: result.refresh,
+                        accessToken: result.access,
+                        expiresAt: result.expires,
+                        addedAt: now,
+                        lastUsed: now,
+                    });
+                    indexByRefreshToken.set(result.refresh, newIndex);
+                    if (accountId) {
+                        indexByAccountId.set(accountId, newIndex);
+                    }
+                    if (accountEmail) {
+                        indexByEmail.set(accountEmail, newIndex);
+                    }
+                    continue;
+                }
+                const existing = accounts[existingIndex];
+                if (!existing)
+                    continue;
+                const oldToken = existing.refreshToken;
+                const oldEmail = existing.email;
+                const nextEmail = accountEmail ?? existing.email;
+                const nextAccountId = accountId ?? existing.accountId;
+                const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
+                const nextAccountLabel = accountLabel ?? existing.accountLabel;
+                accounts[existingIndex] = {
+                    ...existing,
+                    accountId: nextAccountId,
+                    accountIdSource: nextAccountIdSource,
+                    accountLabel: nextAccountLabel,
+                    email: nextEmail,
                     refreshToken: result.refresh,
                     accessToken: result.access,
                     expiresAt: result.expires,
-                    addedAt: now,
                     lastUsed: now,
-                });
-                indexByRefreshToken.set(result.refresh, newIndex);
+                };
+                if (oldToken !== result.refresh) {
+                    indexByRefreshToken.delete(oldToken);
+                    indexByRefreshToken.set(result.refresh, existingIndex);
+                }
                 if (accountId) {
-                    indexByAccountId.set(accountId, newIndex);
+                    indexByAccountId.set(accountId, existingIndex);
                 }
-                if (accountEmail) {
-                    indexByEmail.set(accountEmail, newIndex);
+                if (oldEmail && oldEmail !== nextEmail) {
+                    indexByEmail.delete(oldEmail);
+                }
+                if (nextEmail) {
+                    indexByEmail.set(nextEmail, existingIndex);
                 }
-                continue;
-            }
-            const existing = accounts[existingIndex];
-            if (!existing)
-                continue;
-            const oldToken = existing.refreshToken;
-            const oldEmail = existing.email;
-            const nextEmail = accountEmail ?? existing.email;
-            const nextAccountId = accountId ?? existing.accountId;
-            const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
-            const nextAccountLabel = accountLabel ?? existing.accountLabel;
-            accounts[existingIndex] = {
-                ...existing,
-                accountId: nextAccountId,
-                accountIdSource: nextAccountIdSource,
-                accountLabel: nextAccountLabel,
-                email: nextEmail,
-                refreshToken: result.refresh,
-                accessToken: result.access,
-                expiresAt: result.expires,
-                lastUsed: now,
-            };
-            if (oldToken !== result.refresh) {
-                indexByRefreshToken.delete(oldToken);
-                indexByRefreshToken.set(result.refresh, existingIndex);
-            }
-            if (accountId) {
-                indexByAccountId.set(accountId, existingIndex);
-            }
-            if (oldEmail && oldEmail !== nextEmail) {
-                indexByEmail.delete(oldEmail);
-            }
-            if (nextEmail) {
-                indexByEmail.set(nextEmail, existingIndex);
             }
-        }
-        if (accounts.length === 0)
-            return;
-        const activeIndex = replaceAll
-            ? 0
-            : typeof stored?.activeIndex === "number" && Number.isFinite(stored.activeIndex)
-                ? stored.activeIndex
-                : 0;
-        const clampedActiveIndex = Math.max(0, Math.min(activeIndex, accounts.length - 1));
-        const activeIndexByFamily = {};
-        for (const family of MODEL_FAMILIES) {
-            const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
-            const rawFamilyIndex = replaceAll
+            if (accounts.length === 0)
+                return;
+            const activeIndex = replaceAll
                 ? 0
-                : typeof storedFamilyIndex === "number" && Number.isFinite(storedFamilyIndex)
-                    ? storedFamilyIndex
-                    : clampedActiveIndex;
-            activeIndexByFamily[family] = Math.max(0, Math.min(Math.floor(rawFamilyIndex), accounts.length - 1));
-        }
-        await saveAccounts({
-            version: 3,
-            accounts,
-            activeIndex: clampedActiveIndex,
-            activeIndexByFamily,
+                : typeof stored?.activeIndex === "number" && Number.isFinite(stored.activeIndex)
+                    ? stored.activeIndex
+                    : 0;
+            const clampedActiveIndex = Math.max(0, Math.min(activeIndex, accounts.length - 1));
+            const activeIndexByFamily = {};
+            for (const family of MODEL_FAMILIES) {
+                const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
+                const rawFamilyIndex = replaceAll
+                    ? 0
+                    : typeof storedFamilyIndex === "number" && Number.isFinite(storedFamilyIndex)
+                        ? storedFamilyIndex
+                        : clampedActiveIndex;
+                activeIndexByFamily[family] = Math.max(0, Math.min(Math.floor(rawFamilyIndex), accounts.length - 1));
+            }
+            await persist({
+                version: 3,
+                accounts,
+                activeIndex: clampedActiveIndex,
+                activeIndexByFamily,
+            });
         });
     };
     const showToast = async (message, variant = "success", options) => {
@@ -549,6 +568,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     // Load plugin configuration and determine CODEX_MODE
                     // Priority: CODEX_MODE env var > config file > default (true)
                     const codexMode = getCodexMode(pluginConfig);
+                    const requestTransformMode = getRequestTransformMode(pluginConfig);
+                    const useLegacyRequestTransform = requestTransformMode === "legacy";
                     const fastSessionEnabled = getFastSession(pluginConfig);
                     const fastSessionStrategy = getFastSessionStrategy(pluginConfig);
                     const fastSessionMaxInputItems = getFastSessionMaxInputItems(pluginConfig);
@@ -584,7 +605,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     const prewarmEnabled = process.env.CODEX_AUTH_PREWARM !== "0" &&
                         process.env.VITEST !== "true" &&
                         process.env.NODE_ENV !== "test";
-                    if (!startupPrewarmTriggered && prewarmEnabled) {
+                    if (!startupPrewarmTriggered && prewarmEnabled && useLegacyRequestTransform) {
                         startupPrewarmTriggered = true;
                         const configuredModels = Object.keys(userConfig.models ?? {});
                         prewarmCodexInstructions(configuredModels);
@@ -688,6 +709,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     fastSession: fastSessionEnabled,
                                     fastSessionStrategy,
                                     fastSessionMaxInputItems,
+                                    requestTransformMode,
                                 });
                                 let requestInit = transformation?.updatedInit ?? baseInit;
                                 let transformedBody = transformation?.body;
@@ -748,6 +770,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 while (true) {
                                     const accountCount = accountManager.getAccountCount();
                                     const attempted = new Set();
+                                    let restartAccountTraversalWithFallback = false;
                                     while (attempted.size < Math.max(1, accountCount)) {
                                         const account = accountManager.getCurrentOrNextForFamilyHybrid(modelFamily, model, { pidOffsetEnabled });
                                         if (!account || attempted.has(account.index)) {
@@ -803,12 +826,20 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
                                             accountManager.markToastShown(account.index);
                                         }
-                                        let headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
+                                        const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
                                             model,
                                             promptCacheKey,
                                         });
                                         // Consume a token before making the request for proactive rate limiting
-                                        accountManager.consumeToken(account, modelFamily, model);
+                                        const tokenConsumed = accountManager.consumeToken(account, modelFamily, model);
+                                        if (!tokenConsumed) {
+                                            accountManager.recordRateLimit(account, modelFamily, model);
+                                            runtimeMetrics.accountRotations++;
+                                            runtimeMetrics.lastError =
+                                                `Local token bucket depleted for account ${account.index + 1} (${modelFamily}${model ? `:${model}` : ""})`;
+                                            logWarn(`Skipping account ${account.index + 1}: local token bucket depleted for ${modelFamily}${model ? `:${model}` : ""}`);
+                                            break;
+                                        }
                                         while (true) {
                                             let response;
                                             const fetchStart = performance.now();
@@ -896,7 +927,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     customChain: unsupportedCodexFallbackChain,
                                                 });
                                                 if (fallbackModel) {
-                                                    const previousModel = model ?? "gpt-5.3-codex";
+                                                    const previousModel = model ?? "gpt-5-codex";
                                                     const previousModelFamily = modelFamily;
                                                     attemptedUnsupportedFallbackModels.add(previousModel);
                                                     attemptedUnsupportedFallbackModels.add(fallbackModel);
@@ -924,11 +955,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         ...(requestInit ?? {}),
                                                         body: JSON.stringify(transformedBody),
                                                     };
-                                                    headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
-                                                        model,
-                                                        promptCacheKey,
-                                                    });
-                                                    accountManager.consumeToken(account, modelFamily, model);
                                                     runtimeMetrics.lastError = `Model fallback: ${previousModel} -> ${model}`;
                                                     logWarn(`Model ${previousModel} is unsupported for this ChatGPT account. Falling back to ${model}.`, {
                                                         unsupportedCodexPolicy,
@@ -938,7 +964,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         fallbackReason: "unsupported-model-entitlement",
                                                     });
                                                     await showToast(`Model ${previousModel} is not available for this account. Retrying with ${model}.`, "warning", { duration: toastDurationMs });
-                                                    continue;
+                                                    restartAccountTraversalWithFallback = true;
+                                                    break;
                                                 }
                                                 if (unsupportedModelInfo.isUnsupported && !fallbackOnUnsupportedCodexModel) {
                                                     const blockedModel = unsupportedModelInfo.unsupportedModel ?? model ?? "requested model";
@@ -1003,6 +1030,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             const successResponse = await handleSuccessResponse(response, isStreaming, {
                                                 streamStallTimeoutMs,
                                             });
+                                            if (!successResponse.ok) {
+                                                runtimeMetrics.failedRequests++;
+                                                runtimeMetrics.lastError = `HTTP ${successResponse.status}`;
+                                                return successResponse;
+                                            }
                                             if (!isStreaming && emptyResponseMaxRetries > 0) {
                                                 const clonedResponse = successResponse.clone();
                                                 try {
@@ -1031,6 +1063,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.lastError = null;
                                             return successResponse;
                                         }
+                                        if (restartAccountTraversalWithFallback) {
+                                            break;
+                                        }
+                                    }
+                                    if (restartAccountTraversalWithFallback) {
+                                        continue;
                                     }
                                     const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
                                     const count = accountManager.getAccountCount();
@@ -1245,7 +1283,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             return parts.join(", ");
                         };
                         const fetchCodexQuotaSnapshot = async (params) => {
-                            const QUOTA_PROBE_MODELS = ["gpt-5.3-codex", "gpt-5.2-codex", "gpt-5.1-codex"];
+                            const QUOTA_PROBE_MODELS = ["gpt-5-codex", "gpt-5.3-codex", "gpt-5.2-codex"];
                             let lastError = null;
                             for (const model of QUOTA_PROBE_MODELS) {
                                 try {
@@ -1753,8 +1791,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             targetCount = 1;
                         }
                         if (useManualMode) {
-                            const { pkce, url } = await createAuthorizationFlow();
-                            return buildManualOAuthFlow(pkce, url, async (tokens) => {
+                            const { pkce, state, url } = await createAuthorizationFlow();
+                            return buildManualOAuthFlow(pkce, url, state, async (tokens) => {
                                 try {
                                     await persistAccountPool([tokens], startFresh);
                                     invalidateAccountManagerCache();
@@ -1880,8 +1918,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         applyUiRuntimeFromConfig(manualPluginConfig);
                         const manualPerProjectAccounts = getPerProjectAccounts(manualPluginConfig);
                         setStoragePath(manualPerProjectAccounts ? process.cwd() : null);
-                        const { pkce, url } = await createAuthorizationFlow();
-                        return buildManualOAuthFlow(pkce, url, async (tokens) => {
+                        const { pkce, state, url } = await createAuthorizationFlow();
+                        return buildManualOAuthFlow(pkce, url, state, async (tokens) => {
                             try {
                                 await persistAccountPool([tokens], false);
                             }