oc-codex-multi-auth 6.10.1 → 6.11.0

package/README.md

@@ -46,7 +46,7 @@ Use it when you want OpenCode to run Codex-style coding workflows from your own
 
 | Surface | Purpose |
 | --- | --- |
-| `oc-codex-multi-auth` | npm installer bin; updates `~/.config/opencode/opencode.json`, manages `tui.json`, normalizes stale plugin entries, and clears OpenCode plugin cache. Also runs standalone commands: `doctor`, `status`, `list`, `limits`, `dashboard`, `health`, `diag`, `warm` |
+| `oc-codex-multi-auth` | npm CLI; explicit install modes manage OpenCode provider/TUI config, while `update` only clears the managed package cache. Also runs standalone commands: `doctor`, `status`, `list`, `limits`, `dashboard`, `health`, `diag`, `warm` |
 | OpenCode plugin entry (`index.ts`) | auth loader, OAuth login modes, provider fetch pipeline, account rotation, retry/failover, and `codex-*` tool registry |
 | OpenCode TUI plugin (`tui.ts`) | prompt quota status, quota details, shared quota cache, and active-account-aware display |
 | 24 `codex-*` tools | setup, help, status, list, switch, warm, limits, health, metrics, doctor, dashboard, pool, backup, keychain, diagnostics, and recovery actions |
@@ -76,9 +76,9 @@ The plugin does not replace OpenCode. OpenCode remains the host; this package in
 <details open>
 <summary><b>For Humans</b></summary>
 
-### Option A: Standard install (compact modern)
+### Option A: Standard install (preserve provider config)
 
-Default mode writes 12 base OAuth model families and leaves reasoning depth to OpenCode's variant picker.
+Default mode registers the OpenCode and TUI plugin entries without changing `provider.openai`.
 
 ```bash
 npx -y oc-codex-multi-auth@latest
@@ -88,13 +88,22 @@ Installer flags:
 
 | Flag | Effect |
 | --- | --- |
-| (default) / `--modern` | Compact modern catalog: 12 bases, 53 variants |
+| (default) / `--plugin-only` | Register the plugin and TUI integration without changing `provider.openai` |
+| `--modern` | Install compact modern catalog: 12 bases, 53 variants |
 | `--full` | Compact bases plus 53 explicit selector IDs |
 | `--legacy` | Explicit-only catalog for older OpenCode |
-| `--dry-run` | Show actions without writing |
+| `--dry-run` | Show changed config paths without values or writes |
 | `--no-cache-clear` | Skip clearing the OpenCode plugin cache |
 
-### Option B: Full explicit model catalog
+### Option B: Compact modern model catalog
+
+```bash
+npx -y oc-codex-multi-auth@latest --modern
+```
+
+Use this when OpenCode does not already provide the OAuth model definitions or you want the shipped variant presets.
+
+### Option C: Full explicit model catalog
 
 Use this when you want direct selector IDs such as `openai/gpt-5.5-medium` in addition to OpenCode variants.
 
@@ -102,7 +111,15 @@ Use this when you want direct selector IDs such as `openai/gpt-5.5-medium` in ad
 npx -y oc-codex-multi-auth@latest --full
 ```
 
-### Option C: Verify wiring
+### Updating without config changes
+
+```bash
+npx -y oc-codex-multi-auth@latest update
+```
+
+`update` clears only the OpenCode-managed package cache. It does not read or write `opencode.json` or `tui.json`; restart OpenCode afterward to install the current package.
+
+### Option D: Verify wiring
 
 ```bash
 opencode --version
@@ -110,7 +127,7 @@ opencode debug config
 opencode auth login
 ```
 
-The installer updates `~/.config/opencode/opencode.json`, backs up the previous config, normalizes the plugin entry to `"oc-codex-multi-auth"`, enables the TUI status plugin in `~/.config/opencode/tui.json`, and clears the OpenCode cached plugin copy so OpenCode reinstalls the latest package.
+The default installer only normalizes the plugin entry in `~/.config/opencode/opencode.json`, enables the TUI status plugin in `~/.config/opencode/tui.json`, and clears the cached plugin copy. Catalog modes additionally merge their selected `provider.openai` definitions. Changed config files are backed up before writing.
 
 ### Standalone CLI (no agent / no token cost)
 
@@ -133,13 +150,14 @@ oc-codex-multi-auth diag
 
 ### Step-by-step
 
-1. Install or refresh config:
+1. Register the plugin without changing `provider.openai`:
    - `npx -y oc-codex-multi-auth@latest`
+   - Use `--modern` only when the shipped compact model catalog is required.
 2. Run first login flow:
    - `opencode auth login`
 3. Validate config:
    - `opencode debug config`
-4. Run a smoke request (compact modern selectors):
+4. Run a smoke request (after OpenCode or `--modern` supplies the selector):
    - `opencode run "Explain this repository" --model=openai/gpt-5.5 --variant=medium`
 5. Inspect plugin state with the OpenCode tool surface:
    - `codex-status`

package/config/README.md

@@ -13,17 +13,19 @@ This directory contains the official OpenCode config templates for `oc-codex-mul
 
 | Installer flag | What gets written |
 |----------------|-------------------|
-| default / `--modern` | Compact modern: 12 base OAuth families + variant picker |
+| default / `--plugin-only` | Register plugin entries; preserve `provider.openai` |
+| `--modern` | Compact modern: 12 base OAuth families + variant picker |
 | `--full` | Modern bases **plus** explicit legacy selector IDs |
 | `--legacy` | Explicit-only catalog (53 preset model entries) |
 
 ```bash
-npx -y oc-codex-multi-auth@latest          # compact modern (default)
+npx -y oc-codex-multi-auth@latest          # plugin entries only
+npx -y oc-codex-multi-auth@latest --modern # compact modern catalog
 npx -y oc-codex-multi-auth@latest --full   # modern + explicit IDs
 npx -y oc-codex-multi-auth@latest --legacy # explicit only
 ```
 
-Rerun the default installer to remove explicit preset IDs and stale base models left by earlier plugin catalogs.
+Run the installer with `--modern` to remove explicit preset IDs and stale base models left by earlier plugin catalogs.
 
 ## Quick pick
 
@@ -76,7 +78,7 @@ Shared template requirements:
   - `gpt-5.4-mini` / `gpt-5.4-nano` / Codex models (`gpt-5-codex`, `gpt-5.1-codex*`, …): context **400,000**, output **128,000**
   - `gpt-5.1`: context **272,000**, output **128,000**
 
-Use `opencode debug config` to verify that these template entries were merged into your effective config. The default compact install shows base OAuth entries such as `gpt-5.5` / `gpt-5.6-sol`; the separate OpenCode variant picker exposes the reasoning presets.
+Use `opencode debug config` to verify that these template entries were merged into your effective config. A `--modern` install shows base OAuth entries such as `gpt-5.5` / `gpt-5.6-sol`; the separate OpenCode variant picker exposes the reasoning presets. The default install writes no catalog, so these entries appear only if OpenCode supplies them itself.
 
 If your OpenCode runtime supports global compaction tuning, you can also set values near the largest context windows (for example ~1M context / slightly lower auto-compact limit). Prefer values that match your selected model family.
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA8M/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA8wH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAqN/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA+hH/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -43,7 +43,7 @@ import { CodexAuthError } from "./lib/errors.js";
 import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, loadFlaggedAccounts, saveFlaggedAccounts, withFlaggedAccountStorageTransaction, clearFlaggedAccounts, getWorkspaceIdentityKey, StorageError, formatStorageErrorHint, } from "./lib/storage.js";
 import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, isDeactivatedWorkspaceError, isInvalidatedAuthTokenError, createAbortError, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
 import { shapeBodyForModel } from "./lib/request/helpers/responses-lite.js";
-import { createDeactivatedWorkspaceError, DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, isInvalidatedAuthTokenMessage, } from "./lib/error-sentinels.js";
+import { DEACTIVATED_WORKSPACE_ERROR_CODE, isDeactivatedWorkspaceErrorMessage, isInvalidatedAuthTokenMessage, } from "./lib/error-sentinels.js";
 import { applyFastSessionDefaults, clampReasoningForModel, upsertBackendModelIdentityMessage, } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
@@ -58,7 +58,7 @@ import { prewarmOpenCodeCodexPrompt } from "./lib/prompts/opencode-codex.js";
 import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getRecoveryToastContent, } from "./lib/recovery.js";
 import { matchesWorkspaceIdentity, upsertFlaggedAccountRecord, createRetryBudgetUsage, serializeSelectionExplainability, formatRoutingValue, formatExplainabilitySummary, } from "./lib/runtime.js";
 import { createToolRegistry, } from "./lib/tools/index.js";
-import { createUsageAccountFingerprint } from "./lib/codex-usage.js";
+import { createUsageAccountFingerprint, fetchCodexUsage, formatUsageLimitSummary, formatUsageLimitTitle, hasUsageWindow, parseCodexUsagePayload, } from "./lib/codex-usage.js";
 import { clearTuiQuotaSnapshot, parseTuiQuotaSnapshotFromHeaders, writeTuiQuotaSnapshot, } from "./lib/tui-quota-cache.js";
 /**
  * OpenAI Codex OAuth authentication plugin for opencode
@@ -2187,226 +2187,26 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 message.includes("invalid refresh") ||
                                 message.includes("token has been revoked"));
                         };
-                        const parseFiniteNumberHeader = (headers, name) => {
-                            const raw = headers.get(name);
-                            if (!raw)
-                                return undefined;
-                            const parsed = Number(raw);
-                            return Number.isFinite(parsed) ? parsed : undefined;
-                        };
-                        const parseFiniteIntHeader = (headers, name) => {
-                            const raw = headers.get(name);
-                            if (!raw)
-                                return undefined;
-                            const parsed = Number.parseInt(raw, 10);
-                            return Number.isFinite(parsed) ? parsed : undefined;
-                        };
-                        const parseResetAtMs = (headers, prefix) => {
-                            const resetAfterSeconds = parseFiniteIntHeader(headers, `${prefix}-reset-after-seconds`);
-                            if (typeof resetAfterSeconds === "number" &&
-                                Number.isFinite(resetAfterSeconds) &&
-                                resetAfterSeconds > 0) {
-                                return Date.now() + resetAfterSeconds * 1000;
+                        const formatCodexQuotaLine = (usage) => {
+                            const parts = [];
+                            for (const window of [usage.primary, usage.secondary]) {
+                                if (!hasUsageWindow(window))
+                                    continue;
+                                parts.push(`${formatUsageLimitTitle(window.windowMinutes)} ${formatUsageLimitSummary(window)}`);
                             }
-                            const resetAtRaw = headers.get(`${prefix}-reset-at`);
-                            if (!resetAtRaw)
-                                return undefined;
-                            const trimmed = resetAtRaw.trim();
-                            if (/^\d+$/.test(trimmed)) {
-                                const parsedNumber = Number.parseInt(trimmed, 10);
-                                if (Number.isFinite(parsedNumber) && parsedNumber > 0) {
-                                    // Upstream sometimes returns seconds since epoch.
-                                    return parsedNumber < 10_000_000_000 ? parsedNumber * 1000 : parsedNumber;
-                                }
+                            if (hasUsageWindow(usage.codeReview)) {
+                                parts.push(`Code review ${formatUsageLimitSummary(usage.codeReview)}`);
                             }
-                            const parsedDate = Date.parse(trimmed);
-                            return Number.isFinite(parsedDate) ? parsedDate : undefined;
-                        };
-                        const hasCodexQuotaHeaders = (headers) => {
-                            const keys = [
-                                "x-codex-primary-used-percent",
-                                "x-codex-primary-window-minutes",
-                                "x-codex-primary-reset-at",
-                                "x-codex-primary-reset-after-seconds",
-                                "x-codex-secondary-used-percent",
-                                "x-codex-secondary-window-minutes",
-                                "x-codex-secondary-reset-at",
-                                "x-codex-secondary-reset-after-seconds",
-                            ];
-                            return keys.some((key) => headers.get(key) !== null);
-                        };
-                        const parseCodexQuotaSnapshot = (headers, status) => {
-                            if (!hasCodexQuotaHeaders(headers))
-                                return null;
-                            const primaryPrefix = "x-codex-primary";
-                            const secondaryPrefix = "x-codex-secondary";
-                            const primary = {
-                                usedPercent: parseFiniteNumberHeader(headers, `${primaryPrefix}-used-percent`),
-                                windowMinutes: parseFiniteIntHeader(headers, `${primaryPrefix}-window-minutes`),
-                                resetAtMs: parseResetAtMs(headers, primaryPrefix),
-                            };
-                            const secondary = {
-                                usedPercent: parseFiniteNumberHeader(headers, `${secondaryPrefix}-used-percent`),
-                                windowMinutes: parseFiniteIntHeader(headers, `${secondaryPrefix}-window-minutes`),
-                                resetAtMs: parseResetAtMs(headers, secondaryPrefix),
-                            };
-                            const planTypeRaw = headers.get("x-codex-plan-type");
-                            const planType = planTypeRaw && planTypeRaw.trim() ? planTypeRaw.trim() : undefined;
-                            const activeLimit = parseFiniteIntHeader(headers, "x-codex-active-limit");
-                            return { status, planType, activeLimit, primary, secondary };
-                        };
-                        const formatQuotaWindowLabel = (windowMinutes) => {
-                            if (!windowMinutes || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
-                                return "quota";
-                            }
-                            if (windowMinutes % 1440 === 0)
-                                return `${windowMinutes / 1440}d`;
-                            if (windowMinutes % 60 === 0)
-                                return `${windowMinutes / 60}h`;
-                            return `${windowMinutes}m`;
-                        };
-                        const formatResetAt = (resetAtMs) => {
-                            if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0)
-                                return undefined;
-                            const date = new Date(resetAtMs);
-                            if (!Number.isFinite(date.getTime()))
-                                return undefined;
-                            const now = new Date();
-                            const sameDay = now.getFullYear() === date.getFullYear() &&
-                                now.getMonth() === date.getMonth() &&
-                                now.getDate() === date.getDate();
-                            const time = date.toLocaleTimeString(undefined, {
-                                hour: "2-digit",
-                                minute: "2-digit",
-                                hour12: false,
-                            });
-                            if (sameDay)
-                                return time;
-                            const day = date.toLocaleDateString(undefined, { month: "short", day: "2-digit" });
-                            return `${time} on ${day}`;
-                        };
-                        const formatCodexQuotaLine = (snapshot) => {
-                            const summarizeWindow = (label, window) => {
-                                const used = window.usedPercent;
-                                const left = typeof used === "number" && Number.isFinite(used)
-                                    ? Math.max(0, Math.min(100, Math.round(100 - used)))
-                                    : undefined;
-                                const reset = formatResetAt(window.resetAtMs);
-                                let summary = label;
-                                if (left !== undefined)
-                                    summary = `${summary} ${left}% left`;
-                                if (reset)
-                                    summary = `${summary} (resets ${reset})`;
-                                return summary;
-                            };
-                            const primaryLabel = formatQuotaWindowLabel(snapshot.primary.windowMinutes);
-                            const secondaryLabel = formatQuotaWindowLabel(snapshot.secondary.windowMinutes);
-                            const parts = [
-                                summarizeWindow(primaryLabel, snapshot.primary),
-                                summarizeWindow(secondaryLabel, snapshot.secondary),
-                            ];
-                            if (snapshot.planType)
-                                parts.push(`plan:${snapshot.planType}`);
-                            if (typeof snapshot.activeLimit === "number" && Number.isFinite(snapshot.activeLimit)) {
-                                parts.push(`active:${snapshot.activeLimit}`);
-                            }
-                            if (snapshot.status === 429)
-                                parts.push("rate-limited");
-                            return parts.join(", ");
-                        };
-                        const fetchCodexQuotaSnapshot = async (params) => {
-                            const QUOTA_PROBE_MODELS = ["gpt-5.4", "gpt-5-codex", "gpt-5.3-codex", "gpt-5.2-codex"];
-                            let lastError = null;
-                            for (const model of QUOTA_PROBE_MODELS) {
-                                try {
-                                    const instructions = await getCodexInstructions(model);
-                                    const probeBody = {
-                                        model,
-                                        stream: true,
-                                        store: false,
-                                        include: ["reasoning.encrypted_content"],
-                                        instructions,
-                                        input: [
-                                            {
-                                                type: "message",
-                                                role: "user",
-                                                content: [{ type: "input_text", text: "quota ping" }],
-                                            },
-                                        ],
-                                        reasoning: { effort: "none", summary: "auto" },
-                                        text: { verbosity: "low" },
-                                    };
-                                    const headers = createCodexHeaders(undefined, params.accountId, params.accessToken, {
-                                        model,
-                                        organizationId: params.organizationId,
-                                    });
-                                    headers.set("content-type", "application/json");
-                                    const controller = new AbortController();
-                                    const timeout = setTimeout(() => controller.abort(), 15_000);
-                                    let response;
-                                    try {
-                                        response = await fetch(`${CODEX_BASE_URL}/codex/responses`, {
-                                            method: "POST",
-                                            headers,
-                                            body: JSON.stringify(probeBody),
-                                            signal: controller.signal,
-                                        });
-                                    }
-                                    finally {
-                                        clearTimeout(timeout);
-                                    }
-                                    const snapshot = parseCodexQuotaSnapshot(response.headers, response.status);
-                                    if (snapshot) {
-                                        // We only need headers; cancel the SSE stream immediately.
-                                        try {
-                                            await response.body?.cancel();
-                                        }
-                                        catch {
-                                            // Ignore cancellation failures.
-                                        }
-                                        return snapshot;
-                                    }
-                                    if (!response.ok) {
-                                        const bodyText = await response.text().catch(() => "");
-                                        let errorBody = undefined;
-                                        try {
-                                            errorBody = bodyText ? JSON.parse(bodyText) : undefined;
-                                        }
-                                        catch {
-                                            errorBody = { error: { message: bodyText } };
-                                        }
-                                        const unsupportedInfo = getUnsupportedCodexModelInfo(errorBody);
-                                        if (unsupportedInfo.isUnsupported) {
-                                            lastError = new Error(unsupportedInfo.message ?? `Model '${model}' unsupported for this account`);
-                                            continue;
-                                        }
-                                        const message = (typeof errorBody?.error?.message === "string"
-                                            ? errorBody.error?.message
-                                            : bodyText) || `HTTP ${response.status}`;
-                                        if (isDeactivatedWorkspaceError(errorBody, response.status)) {
-                                            throw createDeactivatedWorkspaceError();
-                                        }
-                                        // A 401 here proves the token is invalid even when the body
-                                        // carries only a generic "Unauthorized" string. The status is
-                                        // dropped once we throw a plain Error, so normalize to the
-                                        // canonical message the catch below matches — otherwise a
-                                        // non-specific 401 would leave a dead routing slot unflagged
-                                        // for codex-doctor --fix (issue #171).
-                                        if (isInvalidatedAuthTokenError(errorBody, response.status)) {
-                                            throw new Error("Your authentication token has been invalidated. Please try signing in again.");
-                                        }
-                                        throw new Error(message);
-                                    }
-                                    lastError = new Error("Codex response did not include quota headers");
-                                }
-                                catch (error) {
-                                    lastError = error instanceof Error ? error : new Error(String(error));
-                                    if (isDeactivatedWorkspaceErrorMessage(lastError.message)) {
-                                        throw lastError;
-                                    }
+                            for (const limit of usage.additionalLimits) {
+                                if (hasUsageWindow(limit.window)) {
+                                    parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window)}`);
                                 }
                             }
-                            throw lastError ?? new Error("Failed to fetch quotas");
+                            if (usage.planType)
+                                parts.push(`plan:${usage.planType}`);
+                            if (usage.credits)
+                                parts.push(`credits:${usage.credits}`);
+                            return parts.length > 0 ? parts.join(", ") : "quota unavailable";
                         };
                         const runAccountCheck = async (deepProbe) => {
                             const loadedStorage = await hydrateEmails(await loadAccounts());
@@ -2575,13 +2375,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         if (!requestAccountId) {
                                             throw new Error("Missing accountId for quota probe");
                                         }
-                                        const snapshot = await fetchCodexQuotaSnapshot({
+                                        const payload = await fetchCodexUsage({
                                             accountId: requestAccountId,
                                             accessToken,
                                             organizationId: account.organizationId,
+                                            normalizeAccountErrors: true,
                                         });
+                                        const usage = parseCodexUsagePayload(payload);
                                         ok += 1;
-                                        console.log(`[${i + 1}/${total}] ${label}: ${formatCodexQuotaLine(snapshot)}`);
+                                        console.log(`[${i + 1}/${total}] ${label}: ${formatCodexQuotaLine(usage)}`);
                                     }
                                     catch (error) {
                                         errors += 1;