oc-codex-multi-auth 6.13.0 → 6.14.0

package/dist/lib/tools/refresh-account.js

@@ -1,118 +1,22 @@
 /**
  * Shared token refresh persistence for the account-management tools.
  *
- * OpenAI refresh tokens are single-use and rotate on exchange. Any tool that
- * calls `queuedRefresh()` must persist the rotated credential immediately;
- * otherwise the on-disk refresh token is already consumed and the next load
- * reports `refresh_token_reused` for every account.
+ * OpenAI refresh tokens are single-use and rotate on exchange. Production
+ * refreshes flow through `coordinatePersistedRefresh()`, which owns the
+ * authoritative reload, exchange, and durable commit under one lease.
  */
-import { queuedRefresh } from "../refresh-queue.js";
 import { extractAccountUserId } from "../auth/token-utils.js";
-import { withAccountStorageTransaction, } from "../storage.js";
 import { findAccountIndexByIdentityKeys, toAccountIdentityKeys, } from "../storage/identity.js";
+import { coordinatePersistedRefresh } from "../storage/coordinated-refresh.js";
 export function findAccountIndexByIdentity(accounts, identity) {
     return findAccountIndexByIdentityKeys(accounts, toAccountIdentityKeys(identity));
 }
-/**
- * Persists one successful refresh in a short storage transaction. The account
- * is re-located from a freshly re-read snapshot, and sibling accounts that
- * share the consumed single-use refresh token are rotated atomically with it.
- */
-export async function persistRefreshResult(index, identity, refreshResult) {
-    const rotated = refreshResult.refresh !== identity.refreshToken;
-    const rotatedAt = rotated ? Date.now() : undefined;
-    try {
-        return await withAccountStorageTransaction(async (current, persist) => {
-            if (!current) {
-                throw new Error("Account storage is unavailable");
-            }
-            const idx = findAccountIndexByIdentity(current.accounts, identity);
-            if (idx < 0) {
-                throw new Error("Account was removed while its token was refreshing");
-            }
-            const target = current.accounts[idx];
-            if (!target) {
-                throw new Error("Account was removed while its token was refreshing");
-            }
-            if (target.refreshToken === identity.refreshToken) {
-                if (rotated) {
-                    // A login can produce sibling org/workspace records sharing one
-                    // single-use refresh token. Mirror the account-state propagation used
-                    // by request-time refresh: update those records with the new token and
-                    // expire their workspace-specific access tokens so they refresh cleanly.
-                    // Do this before assigning the target, since siblings are matched by
-                    // the consumed token and the target starts with that token too.
-                    for (const sibling of current.accounts) {
-                        if (sibling === target)
-                            continue;
-                        if (sibling.refreshToken !== identity.refreshToken)
-                            continue;
-                        sibling.refreshToken = refreshResult.refresh;
-                        sibling.expiresAt = 0;
-                        if (rotatedAt !== undefined) {
-                            sibling.tokenRotatedAt = rotatedAt;
-                        }
-                    }
-                }
-                target.refreshToken = refreshResult.refresh;
-                target.accountUserId =
-                    extractAccountUserId(refreshResult.access) ?? target.accountUserId;
-                target.accessToken = refreshResult.access;
-                target.expiresAt = refreshResult.expires;
-                if (rotatedAt !== undefined) {
-                    target.tokenRotatedAt = rotatedAt;
-                }
-            }
-            else if (target.refreshToken === refreshResult.refresh) {
-                // A sibling account in this process just persisted the same rotation
-                // and propagated the new token to this workspace record. Apply only
-                // this workspace's freshly returned access token; do not overwrite
-                // non-credential state in the fresh snapshot.
-                target.accessToken = refreshResult.access;
-                target.accountUserId =
-                    extractAccountUserId(refreshResult.access) ?? target.accountUserId;
-                target.expiresAt = refreshResult.expires;
-            }
-            else {
-                // The refresh was keyed off `identity.refreshToken` (the consumed,
-                // pre-rotation value). If storage carries neither that token nor the
-                // exact rotation returned by this refresh, another process rotated
-                // this credential while this network-bound refresh was in flight. We
-                // cannot know which resulting chain is live, so fail this
-                // verification rather than clobber whatever the other process wrote.
-                throw new Error("Refresh token changed concurrently while verification was in progress");
-            }
-            await persist(current);
-            return {
-                index,
-                identity,
-                refreshToken: refreshResult.refresh,
-                accessToken: refreshResult.access,
-                expiresAt: refreshResult.expires,
-                rotatedAt,
-                persisted: true,
-            };
-        });
-    }
-    catch (error) {
-        return {
-            index,
-            identity,
-            refreshToken: refreshResult.refresh,
-            accessToken: refreshResult.access,
-            expiresAt: refreshResult.expires,
-            rotatedAt,
-            persisted: false,
-            persistError: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
 /**
  * Refreshes one account and persists the rotated credential before reporting
  * success. Disabled standalone accounts are skipped: refreshing them is wrong
  * (they may intentionally retain a dead duplicate credential), while disabled
  * siblings sharing an enabled account's consumed token are still updated by
- * `persistRefreshResult()` so the shared credential remains consistent.
+ * `coordinatePersistedRefresh()` so the shared credential remains consistent.
  */
 export async function refreshAndPersistAccount(account) {
     const { index, identity } = account;
@@ -121,7 +25,7 @@ export async function refreshAndPersistAccount(account) {
     }
     let refreshResult;
     try {
-        refreshResult = await queuedRefresh(identity.refreshToken);
+        refreshResult = await coordinatePersistedRefresh(identity);
     }
     catch (error) {
         return {
@@ -139,16 +43,19 @@ export async function refreshAndPersistAccount(account) {
             error: refreshResult.message ?? refreshResult.reason ?? "token refresh failed",
         };
     }
-    const persisted = await persistRefreshResult(index, identity, refreshResult);
-    if (!persisted.persisted) {
-        return {
-            status: "failed",
+    return {
+        status: "refreshed",
+        index,
+        result: {
             index,
             identity,
-            error: persisted.persistError ?? "Failed to persist rotated credential",
-        };
-    }
-    return { status: "refreshed", index, result: persisted };
+            refreshToken: refreshResult.refresh,
+            accessToken: refreshResult.access,
+            expiresAt: refreshResult.expires,
+            rotatedAt: refreshResult.rotatedAt,
+            persisted: true,
+        },
+    };
 }
 export function buildRefreshInputs(accounts) {
     return accounts.map((account, index) => ({

package/dist/lib/tools/refresh-account.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-account.js","sourceRoot":"","sources":["../../../lib/tools/refresh-account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EACN,6BAA6B,GAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,8BAA8B,EAC9B,qBAAqB,GACrB,MAAM,wBAAwB,CAAC;AAgChC,MAAM,UAAU,0BAA0B,CACzC,QAAkC,EAClC,QAAgC;IAEhC,OAAO,8BAA8B,CAAC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,KAAa,EACb,QAAgC,EAChC,aAAwD;IAExD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,KAAK,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnD,IAAI,CAAC;QACJ,OAAO,MAAM,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;YACrE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,GAAG,GAAG,0BAA0B,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACnD,IAAI,OAAO,EAAE,CAAC;oBACb,gEAAgE;oBAChE,sEAAsE;oBACtE,uEAAuE;oBACvE,yEAAyE;oBACzE,qEAAqE;oBACrE,gEAAgE;oBAChE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;wBACxC,IAAI,OAAO,KAAK,MAAM;4BAAE,SAAS;wBACjC,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;4BAAE,SAAS;wBAC7D,OAAO,CAAC,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC;wBAC7C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;wBACtB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;4BAC7B,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;wBACpC,CAAC;oBACF,CAAC;gBACF,CAAC;gBAED,MAAM,CAAC,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC;gBAC5C,MAAM,CAAC,aAAa;oBACnB,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC;gBACpE,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC;gBAC1C,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC;gBACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;gBACnC,CAAC;YACF,CAAC;iBAAM,IAAI,MAAM,CAAC,YAAY,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC1D,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,8CAA8C;gBAC9C,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC;gBAC1C,MAAM,CAAC,aAAa;oBACnB,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC;gBACpE,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACP,mEAAmE;gBACnE,qEAAqE;gBACrE,mEAAmE;gBACnE,qEAAqE;gBACrE,0DAA0D;gBAC1D,qEAAqE;gBACrE,MAAM,IAAI,KAAK,CACd,uEAAuE,CACvE,CAAC;YACH,CAAC;YAED,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO;gBACN,KAAK;gBACL,QAAQ;gBACR,YAAY,EAAE,aAAa,CAAC,OAAO;gBACnC,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,SAAS,EAAE,aAAa,CAAC,OAAO;gBAChC,SAAS;gBACT,SAAS,EAAE,IAAI;aACf,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,KAAK;YACL,QAAQ;YACR,YAAY,EAAE,aAAa,CAAC,OAAO;YACnC,WAAW,EAAE,aAAa,CAAC,MAAM;YACjC,SAAS,EAAE,aAAa,CAAC,OAAO;YAChC,SAAS;YACT,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACpE,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA4B;IAE5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,aAA0B,CAAC;IAC/B,IAAI,CAAC;QACJ,aAAa,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,QAAQ;YACR,KAAK,EACJ,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,IAAI,sBAAsB;SACxE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,QAAQ;YACR,KAAK,EAAE,SAAS,CAAC,YAAY,IAAI,sCAAsC;SACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,QAA6B;IAE7B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE;YACT,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EACZ,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC;YAC3E,YAAY,EAAE,OAAO,CAAC,YAAY;SAClC;KACD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"refresh-account.js","sourceRoot":"","sources":["../../../lib/tools/refresh-account.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EACN,8BAA8B,EAC9B,qBAAqB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AA+B/E,MAAM,UAAU,0BAA0B,CACzC,QAAkC,EAClC,QAAgC;IAEhC,OAAO,8BAA8B,CAAC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA4B;IAE5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,aAAqE,CAAC;IAC1E,IAAI,CAAC;QACJ,aAAa,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,QAAQ;YACR,KAAK,EACJ,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,IAAI,sBAAsB;SACxE,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM,EAAE,WAAW;QACnB,KAAK;QACL,MAAM,EAAE;YACP,KAAK;YACL,QAAQ;YACR,YAAY,EAAE,aAAa,CAAC,OAAO;YACnC,WAAW,EAAE,aAAa,CAAC,MAAM;YACjC,SAAS,EAAE,aAAa,CAAC,OAAO;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,SAAS,EAAE,IAAI;SACf;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,QAA6B;IAE7B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE;YACT,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EACZ,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC;YAC3E,YAAY,EAAE,OAAO,CAAC,YAAY;SAClC;KACD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oc-codex-multi-auth",
-  "version": "6.13.0",
+  "version": "6.14.0",
   "description": "OpenCode plugin for ChatGPT Plus/Pro OAuth with Codex/GPT-5 routing, multi-account rotation, account switching, health checks, diagnostics, and recovery tools",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",