oc-codex-multi-auth 6.1.2 → 6.1.6

package/dist/index.js

@@ -22,6 +22,9 @@
  * @repository https://github.com/ndycode/oc-codex-multi-auth
 
  */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
@@ -38,7 +41,7 @@ import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLab
 import { getStoragePath, loadAccounts, saveAccounts, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, } from "./lib/error-sentinels.js";
-import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
+import { applyFastSessionDefaults, upsertBackendModelIdentityMessage, } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
 import { getCircuitBreaker } from "./lib/circuit-breaker.js";
@@ -52,6 +55,8 @@ import { prewarmOpenCodeCodexPrompt } from "./lib/prompts/opencode-codex.js";
 import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getRecoveryToastContent, } from "./lib/recovery.js";
 import { matchesWorkspaceIdentity, upsertFlaggedAccountRecord, createRetryBudgetUsage, serializeSelectionExplainability, formatRoutingValue, formatExplainabilitySummary, } from "./lib/runtime.js";
 import { createToolRegistry, } from "./lib/tools/index.js";
+import { createUsageAccountFingerprint } from "./lib/codex-usage.js";
+import { clearTuiQuotaSnapshot, parseTuiQuotaSnapshotFromHeaders, writeTuiQuotaSnapshot, } from "./lib/tui-quota-cache.js";
 /**
  * OpenAI Codex OAuth authentication plugin for opencode
  *
@@ -68,7 +73,6 @@ import { createToolRegistry, } from "./lib/tools/index.js";
  * }
  * ```
  */
-// eslint-disable-next-line @typescript-eslint/require-await
 export const OpenAIOAuthPlugin = async ({ client }) => {
     initLogger(client);
     let cachedAccountManager = null;
@@ -252,7 +256,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         openBrowserUrl(url);
         if (!serverInfo || !serverInfo.ready) {
             serverInfo?.close();
-            const message = `OAuth callback server failed to start on http://127.0.0.1:1455. ` +
+            const message = `OAuth callback server failed to start on localhost loopback port 1455. ` +
                 `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
             logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
             return {
@@ -288,6 +292,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             // Ignore when TUI is not available.
         }
     };
+    const clearPromptQuotaCache = async () => {
+        try {
+            await clearTuiQuotaSnapshot();
+        }
+        catch (error) {
+            logDebug(`[${PLUGIN_NAME}] Failed to clear TUI quota cache: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    const recordPromptQuotaHeaders = async (response, account, accountCount) => {
+        try {
+            const snapshot = parseTuiQuotaSnapshotFromHeaders(response.headers, {
+                fingerprint: createUsageAccountFingerprint(account),
+                accountIndex: account.index + 1,
+                accountCount,
+                accountEmail: account.email?.trim() || undefined,
+                accountLabel: formatAccountLabel(account, account.index),
+            });
+            if (!snapshot)
+                return;
+            await writeTuiQuotaSnapshot(snapshot);
+        }
+        catch (error) {
+            logDebug(`[${PLUGIN_NAME}] Failed to record TUI quota headers: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
     const resolveActiveIndex = (storage, family = "codex") => {
         const total = storage.accounts.length;
         if (total === 0)
@@ -296,6 +325,67 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
         return Math.max(0, Math.min(raw, total - 1));
     };
+    const backfillHostOpenAIAuthFromPool = async () => {
+        const authPath = join(homedir(), ".local", "share", "opencode", "auth.json");
+        let authStore = {};
+        try {
+            const authRaw = await readFile(authPath, "utf8");
+            const parsed = JSON.parse(authRaw);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                authStore = parsed;
+            }
+        }
+        catch (error) {
+            const errorCode = error?.code;
+            if (errorCode !== "ENOENT") {
+                logWarn(`[${PLUGIN_NAME}] Failed to read host auth store for OpenAI backfill: ${error?.message ?? String(error)}`);
+                return;
+            }
+        }
+        const existing = authStore[PROVIDER_ID];
+        const hasExistingOAuth = existing?.type === "oauth" &&
+            typeof existing.access === "string" &&
+            existing.access.trim().length > 0 &&
+            typeof existing.refresh === "string" &&
+            existing.refresh.trim().length > 0 &&
+            typeof existing.expires === "number" &&
+            Number.isFinite(existing.expires);
+        if (hasExistingOAuth) {
+            return;
+        }
+        const storage = await loadAccounts();
+        if (!storage || storage.accounts.length === 0) {
+            return;
+        }
+        const hasUsableTokens = (account) => typeof account?.accessToken === "string" &&
+            account.accessToken.trim().length > 0 &&
+            typeof account?.refreshToken === "string" &&
+            account.refreshToken.trim().length > 0 &&
+            typeof account?.expiresAt === "number" &&
+            Number.isFinite(account.expiresAt);
+        const activeIndex = resolveActiveIndex(storage, "codex");
+        const activeAccount = storage.accounts[activeIndex];
+        const candidate = hasUsableTokens(activeAccount)
+            ? activeAccount
+            : storage.accounts.find(hasUsableTokens);
+        if (!candidate || !hasUsableTokens(candidate)) {
+            return;
+        }
+        authStore[PROVIDER_ID] = {
+            type: "oauth",
+            access: candidate.accessToken,
+            refresh: candidate.refreshToken,
+            expires: candidate.expiresAt,
+        };
+        try {
+            await mkdir(join(homedir(), ".local", "share", "opencode"), { recursive: true });
+            await writeFile(authPath, `${JSON.stringify(authStore, null, 2)}\n`, "utf8");
+            logInfo(`[${PLUGIN_NAME}] Restored missing host OpenAI auth entry from stored account pool`);
+        }
+        catch (error) {
+            logWarn(`[${PLUGIN_NAME}] Failed to backfill host OpenAI auth entry: ${error?.message ?? String(error)}`);
+        }
+    };
     const hydrateEmails = async (storage) => {
         if (!storage)
             return storage;
@@ -339,6 +429,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         account.expiresAt = refreshed.expires;
                         changed = true;
                     }
+                    if (refreshed.scope && refreshed.scope !== account.oauthScope) {
+                        account.oauthScope = refreshed.scope;
+                        changed = true;
+                    }
                     if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
                         account.refreshToken = refreshed.refresh;
                         changed = true;
@@ -777,6 +871,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         storage.activeIndexByFamily[family] = index;
                     }
                     await saveAccounts(storage);
+                    await clearPromptQuotaCache();
                     // Reload manager from disk so we don't overwrite newer rotated
                     // refresh tokens with stale in-memory state.
                     if (cachedAccountManager) {
@@ -844,6 +939,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         invalidateAccountManagerCache,
         upsertFlaggedAccountRecord,
     };
+    const startupPluginConfig = loadPluginConfig();
+    const startupPerProjectAccounts = getPerProjectAccounts(startupPluginConfig);
+    setStoragePath(startupPerProjectAccounts ? process.cwd() : null);
+    await backfillHostOpenAIAuthFromPool();
     return {
         event: eventHandler,
         auth: {
@@ -900,9 +999,17 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     if (needsPersist) {
                         await accountManager.saveToDisk();
                     }
-                    if (accountManager.getAccountCount() === 0) {
-                        logDebug(`[${PLUGIN_NAME}] No Codex accounts available (run opencode auth login)`);
-                        return {};
+                    const accountCount = accountManager.getAccountCount();
+                    const storagePath = getStoragePath();
+                    logDebug(`[${PLUGIN_NAME}] Loader auth bootstrap`, {
+                        authType: auth.type,
+                        authHasRefresh: !!authFallback?.refresh,
+                        authHasMultiAccount: !!authWithMulti?.multiAccount,
+                        accountCount,
+                        storagePath,
+                    });
+                    if (accountCount === 0) {
+                        logWarn(`[${PLUGIN_NAME}] No Codex accounts available (run opencode auth login)`);
                     }
                     // Extract user configuration (global + per-model options)
                     const providerConfig = provider;
@@ -1278,6 +1385,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         }
                                         account.email =
                                             extractAccountEmail(accountAuth.access) ?? account.email;
+                                        // Keep the persisted active identity in step with the account used
+                                        // for this request so the TUI quota cache accepts the next real
+                                        // response-header snapshot instead of filtering it as stale.
+                                        accountManager.saveToDiskDebounced();
                                         if (accountCount > 1 &&
                                             accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                             const accountLabel = formatAccountLabel(account, account.index);
@@ -1401,6 +1512,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 latencyMs: fetchLatencyMs,
                                                 headers: Object.fromEntries(response.headers.entries()),
                                             });
+                                            void recordPromptQuotaHeaders(response, account, accountCount);
                                             if (!response.ok) {
                                                 const contextOverflowResult = await handleContextOverflow(response, model);
                                                 if (contextOverflowResult.handled) {
@@ -1500,15 +1612,31 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     fallbackFrom = previousModel;
                                                     fallbackTo = model;
                                                     fallbackReason = "fallback-unsupported-model-entitlement";
+                                                    const fallbackInstructions = await getCodexInstructions(model);
                                                     if (transformedBody && typeof transformedBody === "object") {
-                                                        transformedBody = { ...transformedBody, model };
+                                                        transformedBody = {
+                                                            ...transformedBody,
+                                                            model,
+                                                            instructions: fallbackInstructions,
+                                                            input: upsertBackendModelIdentityMessage(transformedBody.input, model),
+                                                        };
                                                     }
                                                     else {
-                                                        let fallbackBody = { model };
+                                                        let fallbackBody = {
+                                                            model,
+                                                            instructions: fallbackInstructions,
+                                                        };
                                                         if (requestInit?.body && typeof requestInit.body === "string") {
                                                             try {
                                                                 const parsed = JSON.parse(requestInit.body);
-                                                                fallbackBody = { ...parsed, model };
+                                                                fallbackBody = {
+                                                                    ...parsed,
+                                                                    model,
+                                                                    instructions: fallbackInstructions,
+                                                                };
+                                                                if (Array.isArray(fallbackBody.input)) {
+                                                                    fallbackBody.input = upsertBackendModelIdentityMessage(fallbackBody.input, model);
+                                                                }
                                                             }
                                                             catch {
                                                                 // Keep minimal fallback body if parsing fails.
@@ -1715,14 +1843,28 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         continue;
                                     }
                                     const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
+                                    const wasEntitlementExhaustion = runtimeMetrics.lastErrorCategory === "unsupported-model";
+                                    const entitlementModel = typeof runtimeMetrics.lastError === "string"
+                                        ? runtimeMetrics.lastError.replace(/^Unsupported model.*?:\s*/i, "").trim()
+                                        : "";
+                                    const entitlementDetail = entitlementModel.length > 0
+                                        ? ` The backend rejected '${entitlementModel}' as not entitled for Codex OAuth on every pooled account.`
+                                        : "";
                                     const message = count === 0
                                         ? "No Codex accounts configured. Run `opencode auth login`."
                                         : waitMs > 0
                                             ? `All ${count} account(s) are rate-limited. Try again in ${waitLabel} or add another account with \`opencode auth login\`.`
-                                            : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
+                                            : wasEntitlementExhaustion
+                                                ? `All ${count} account(s) returned 'model not supported' for the requested model.${entitlementDetail} If this is a GPT-5.5 request during the rollout period, set \`unsupportedCodexPolicy: "fallback"\` (or \`CODEX_AUTH_UNSUPPORTED_MODEL_POLICY=fallback\`) to auto-fallback to gpt-5.4. See \`codex-health\` for per-account details.`
+                                                : `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
                                     runtimeMetrics.failedRequests++;
                                     runtimeMetrics.lastError = message;
-                                    runtimeMetrics.lastErrorCategory = waitMs > 0 ? "rate-limit" : "account-failure";
+                                    runtimeMetrics.lastErrorCategory =
+                                        waitMs > 0
+                                            ? "rate-limit"
+                                            : wasEntitlementExhaustion
+                                                ? "unsupported-model"
+                                                : "account-failure";
                                     return new Response(JSON.stringify({ error: { message } }), {
                                         status: waitMs > 0 ? 429 : 503,
                                         headers: {
@@ -2127,6 +2269,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             account.expiresAt = refreshResult.expires;
                                             storageChanged = true;
                                         }
+                                        if (refreshResult.scope && refreshResult.scope !== account.oauthScope) {
+                                            account.oauthScope = refreshResult.scope;
+                                            storageChanged = true;
+                                        }
                                         const hydratedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
                                         if (hydratedEmail && hydratedEmail !== account.email) {
                                             account.email = hydratedEmail;