oc-codex-multi-auth 6.0.0 → 6.1.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Numman Ali
+Copyright (c) 2026 ndycode
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,12 +1,18 @@
-# oc-codex-multi-auth
-
-[![npm version](https://img.shields.io/npm/v/oc-codex-multi-auth.svg)](https://www.npmjs.com/package/oc-codex-multi-auth)
-[![npm downloads](https://img.shields.io/npm/dw/oc-codex-multi-auth.svg)](https://www.npmjs.com/package/oc-codex-multi-auth)
+# oc-codex-multi-auth
+
+<!--
+Badges: CI + OpenSSF Scorecard will turn green once Phase 3 Batch A (CI workflow + Scorecard workflow) lands and runs its first job. Until then they may render as "no status" / 404 — that is expected and self-resolves automatically.
+-->
+[![CI](https://github.com/ndycode/oc-codex-multi-auth/actions/workflows/ci.yml/badge.svg)](https://github.com/ndycode/oc-codex-multi-auth/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/oc-codex-multi-auth.svg)](https://www.npmjs.com/package/oc-codex-multi-auth)
+[![npm downloads](https://img.shields.io/npm/dw/oc-codex-multi-auth.svg)](https://www.npmjs.com/package/oc-codex-multi-auth)
+[![Node.js Version](https://img.shields.io/node/v/oc-codex-multi-auth.svg)](https://nodejs.org)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ndycode/oc-codex-multi-auth/badge)](https://securityscorecards.dev/viewer/?uri=github.com/ndycode/oc-codex-multi-auth)
 
 Use your ChatGPT Plus/Pro subscription inside OpenCode with OAuth login, GPT-5/Codex model presets, and multi-account failover.
 
-`oc-codex-multi-auth` is an OpenCode plugin for developers who want Codex-first GPT-5 workflows in OpenCode without switching to separate Platform API credentials for personal use. It uses the same official OAuth flow as the Codex CLI, adds model templates for current GPT-5 families, and can rotate across multiple ChatGPT accounts when one account is rate-limited or unavailable.
+`oc-codex-multi-auth` is an OpenCode plugin for developers who want Codex-first GPT-5 workflows in OpenCode without switching to separate Platform API credentials for personal use. It uses the same official OAuth flow as the Codex CLI, adds model templates for current GPT-5 families, and can rotate across multiple ChatGPT accounts when one account is rate-limited or unavailable.
 
 ## What This Project Does
 
@@ -19,7 +25,7 @@ Use your ChatGPT Plus/Pro subscription inside OpenCode with OAuth login, GPT-5/C
 
 ```bash
 # 1. Install or refresh the plugin config
-npx -y oc-codex-multi-auth@latest
+npx -y oc-codex-multi-auth@latest
 
 # 2. Sign in with ChatGPT Plus/Pro
 opencode auth login
@@ -32,7 +38,7 @@ What the installer does:
 
 - writes `~/.config/opencode/opencode.json`
 - backs up an existing config before changing it
-- normalizes the plugin entry to `"oc-codex-multi-auth"`
+- normalizes the plugin entry to `"oc-codex-multi-auth"`
 - clears the cached plugin copy so OpenCode reinstalls the latest package
 
 By default, the installer now writes a full catalog config that includes both:
@@ -103,7 +109,7 @@ Use the quick-start path above for the fastest setup. For full setup, local deve
 If you prefer the compact variant-only config on OpenCode `v1.0.210+`, use:
 
 ```bash
-npx -y oc-codex-multi-auth@latest --modern
+npx -y oc-codex-multi-auth@latest --modern
 ```
 
 ## Configuration
@@ -114,6 +120,36 @@ Detailed configuration lives outside this README:
 - [Configuration Reference](docs/configuration.md) for config keys, env vars, and fallback behavior
 - [Config Templates](config/README.md) for modern vs legacy OpenCode examples
 
+## Credential Storage
+
+By default, this plugin stores OAuth refresh tokens as a V3 JSON file under the per-project path determined by `lib/storage/paths.ts`. File permissions are restricted (`0o600` on the file, `0o700` on containing directories) on platforms that honour them.
+
+### Optional: OS-native keychain
+
+Set `CODEX_KEYCHAIN=1` in the environment to store credentials in the OS keychain instead:
+
+- **macOS**: Keychain
+- **Windows**: Credential Manager
+- **Linux**: libsecret (requires a running secret service such as GNOME Keyring or KWallet)
+
+The opt-in is strict: only the literal value `"1"` enables the keychain backend. Any other value (unset, `"0"`, `"false"`, `""`, `"yes"`, ...) leaves behavior identical to earlier releases. Existing users see zero change by default.
+
+When enabled on an existing install, the plugin auto-migrates the JSON file into the keychain on the next credential write and renames the original as `accounts.json.migrated-to-keychain.<timestamp>` for rollback. The original is never deleted automatically.
+
+Use the `codex-keychain` tool to inspect and manage the backend:
+
+```bash
+codex-keychain status     # which backend is active, is the keychain reachable
+codex-keychain migrate    # force-migrate on-disk JSON to the keychain now
+codex-keychain rollback   # restore the most recent .migrated-to-keychain.<ts> backup
+```
+
+### Keychain fallback
+
+If the OS keychain is unavailable (Linux without secret service, permission denied, locked session, missing native module), the plugin logs a clear warning and falls back to the JSON backend for that operation. Credentials are never silently lost.
+
+See [SECURITY.md](SECURITY.md#credential-storage-backends) for the threat model that applies to each backend.
+
 ## Troubleshooting
 
 Start here if the plugin does not load or authenticate correctly:
@@ -125,16 +161,16 @@ Start here if the plugin does not load or authenticate correctly:
 
 Common first checks:
 
-- confirm `"plugin": ["oc-codex-multi-auth"]` is present in your OpenCode config
-
-## 6.0.0 Cutover
-
-This release intentionally breaks the old package line and moves the runtime to package-aligned storage names.
-
-- Rename the GitHub repository to `ndycode/oc-codex-multi-auth`
-- Publish `oc-codex-multi-auth@6.0.0`
-- Deprecate `oc-chatgpt-multi-auth` on npm with a pointer to the new package
-- Verify docs, badges, repo links, and OpenCode config examples all resolve to `oc-codex-multi-auth`
+- confirm `"plugin": ["oc-codex-multi-auth"]` is present in your OpenCode config
+
+## 6.0.0 Cutover
+
+This release intentionally breaks the old package line and moves the runtime to package-aligned storage names.
+
+- Rename the GitHub repository to `ndycode/oc-codex-multi-auth`
+- Publish `oc-codex-multi-auth@6.0.0`
+- Deprecate the legacy npm package with a pointer to the new package
+- Verify docs, badges, repo links, and OpenCode config examples all resolve to `oc-codex-multi-auth`
 - rerun `opencode auth login`
 - inspect `~/.opencode/logs/codex-plugin/` after running one request with `ENABLE_PLUGIN_REQUEST_LOGGING=1`
 
@@ -155,6 +191,10 @@ Contributions are welcome if they keep the project accurate, maintainable, and a
 - [Code of Conduct](CODE_OF_CONDUCT.md)
 - [Security Policy](SECURITY.md)
 
+## Releases
+
+Releases are automated via [release-please](https://github.com/googleapis/release-please). Conventional Commits landed on `main` drive version bumps and CHANGELOG entries; merging the open "Release candidate" PR cuts a tagged release. Manual `npm publish` is not required for routine releases.
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

package/assets/readme-hero.svg

@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="300" viewBox="0 0 1200 300" role="img" aria-label="oc-codex-multi-auth">
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="300" viewBox="0 0 1200 300" role="img" aria-label="oc-codex-multi-auth">
   <defs>
     <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
       <stop offset="0%" stop-color="#0f172a" />
@@ -20,12 +20,12 @@
     <path d="M205 80 L235 220" />
   </g>
   <text x="420" y="120" fill="#e2e8f0" font-size="42" font-family="'IBM Plex Sans','Segoe UI',Arial,sans-serif" font-weight="600">
-    oc-codex-multi-auth
-  </text>
-  <text x="420" y="170" fill="#cbd5f5" font-size="24" font-family="'IBM Plex Sans','Segoe UI',Arial,sans-serif">
-    Codex-first ChatGPT Plus/Pro auth for OpenCode
-  </text>
-  <text x="420" y="220" fill="#7dd3fc" font-size="18" font-family="'IBM Plex Sans','Segoe UI',Arial,sans-serif">
-    One-command install, account migration, modern variants
-  </text>
-</svg>
+    oc-codex-multi-auth
+  </text>
+  <text x="420" y="170" fill="#cbd5f5" font-size="24" font-family="'IBM Plex Sans','Segoe UI',Arial,sans-serif">
+    Codex-first ChatGPT Plus/Pro auth for OpenCode
+  </text>
+  <text x="420" y="220" fill="#7dd3fc" font-size="18" font-family="'IBM Plex Sans','Segoe UI',Arial,sans-serif">
+    One-command install, account migration, modern variants
+  </text>
+</svg>

package/config/README.md

@@ -1,6 +1,6 @@
 # Configuration
 
-This directory contains the official OpenCode config templates for `oc-codex-multi-auth`.
+This directory contains the official OpenCode config templates for `oc-codex-multi-auth`.
 
 ## Required: choose the right config file
 

package/config/minimal-opencode.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugin": ["oc-codex-multi-auth"],
+  "plugin": ["oc-codex-multi-auth"],
 
   "provider": {
     "openai": {

package/config/opencode-legacy.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "oc-codex-multi-auth"
+    "oc-codex-multi-auth"
   ],
   "provider": {
     "openai": {

package/config/opencode-modern.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "oc-codex-multi-auth"
+    "oc-codex-multi-auth"
   ],
   "provider": {
     "openai": {

package/dist/index.d.ts

@@ -18,7 +18,7 @@
  * For production applications, use the OpenAI Platform API: https://platform.openai.com/
  *
  * @license MIT (see LICENSE file)
- * @author numman-ali
+ * @author ndycode
  * @repository https://github.com/ndycode/oc-codex-multi-auth
 
  */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA8M/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA++L/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAwL/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAiqG/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}