oc-codex-multi-auth 6.14.4 → 6.16.0

package/README.md

@@ -263,6 +263,8 @@ Most of these also run as a **direct CLI** with no agent/model involvement (no t
 - unsupported-model handling is strict by default, with opt-in fallback controls
 - TUI quota status follows the account/workspace used by the latest request
 - Business workspace memberships and Personal accounts keep separate usage and quota windows. Business members sharing one workspace are distinguished by their member/seat identity, so their usage is not collapsed into one row.
+- An account identifies itself by its own ChatGPT email and the last 6 characters of its account id, with the email masked when `maskEmail` is on. The OAuth id_token also lists the API-platform organizations the login belongs to; those are not ChatGPT workspaces and are never used to name an account, so logging in clears a label left behind by one. A label you set with `codex-label` is always kept.
+- The ChatGPT plan (`Free`, `Plus`, `Pro`, `Business`, `Business Premium`) is read from the access token, refreshed on every token refresh, and shown by `codex-list` and `codex-status`. `codex-limits` and the TUI read the plan live from the usage endpoint and name it the same way. An unrecognized plan is reported verbatim rather than renamed.
 
 ---
 
@@ -293,6 +295,53 @@ Primary config files:
 - `~/.config/opencode/tui.json`
 - `~/.opencode/openai-codex-auth-config.json`
 
+### Desktop quota notifications
+
+Quota notifications are an optional macOS-only feature. While the plugin is
+running, it checks all enabled accounts and alerts through Notification Center
+when the best remaining 5-hour or weekly pool quota crosses 25%, 10%, or 0%.
+The feature is disabled by default.
+
+Each line reports the enabled account with the most headroom in that window,
+together with that same account's reset time, so the pair always describes a
+quota that one account actually has. When a different account recovers sooner,
+that reset is appended under its own label rather than folded into the first
+one. Windows a plan has switched off are skipped rather than counted as full.
+Account identities are omitted for readability and lock-screen privacy:
+
+```text
+5h: 10% | resets 02:00 | another account resets 22:30
+Weekly: 72% | resets 22:30 on Aug 30
+```
+
+```json
+{
+  "quotaNotifications": {
+    "enabled": true,
+    "intervalMs": 1800000,
+    "notifyEveryCheck": false,
+    "thresholds": [25, 10, 0]
+  }
+}
+```
+
+Add the object above to `~/.opencode/openai-codex-auth-config.json`, or set
+`CODEX_AUTH_QUOTA_NOTIFICATIONS=1`, then quit and restart OpenCode. The minimum
+interval is 30 seconds. If macOS blocks the alert, allow notifications for
+the process shown in **System Settings > Notifications**. The setting is
+ignored on Windows and Linux.
+
+Set `"notifyEveryCheck": true` to show the aggregate quota notification after
+every successful poll interval instead of only when a configured threshold is
+crossed. Set `"thresholds": []` to turn threshold alerts off entirely; pair it
+with `"notifyEveryCheck": true` or the monitor has nothing to deliver and stops
+polling.
+
+Delivery state lives beside the accounts file the alerts are computed from, so
+OpenCode processes working in the same account scope show only one alert per
+interval. With the default `perProjectAccounts`, that scope is one project:
+two projects have separate account pools and therefore alert independently.
+
 ### Route models to preferred accounts
 
 Use `modelAccountPools` to assign one or more preferred ChatGPT accounts or Business seats to a

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAsU/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAu8H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA2U/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAqjI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -27,15 +27,16 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
+import { formatPlanType } from "./lib/auth/plan-tier.js";
+import { startLoopbackFlow, } from "./lib/auth/loopback-flow.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
 import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
-import { openBrowserUrl } from "./lib/auth/browser.js";
-import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
 import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
+import { createQuotaMonitor } from "./lib/quota-notifications.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, } from "./lib/accounts.js";
@@ -304,39 +305,76 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             }
         }
     };
+    const listenerUnavailableMessage = () => `OAuth callback server failed to start on localhost loopback port 1455. ` +
+        `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+    const callbackCancelledMessage = () => `OAuth callback timed out or was cancelled. ` +
+        `If you are on SSH, WSL, or a headless machine, retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+    // The login is still live when this fires: the listener is bound and
+    // waiting, so opening the URL printed above finishes it. That is the
+    // whole recovery path on a host with no opener on PATH.
+    const browserOpenFailedMessage = () => `Could not launch your default browser. Open the OAuth URL above in any browser to finish signing in; ` +
+        `this login is still waiting on the localhost callback. ` +
+        `"${AUTH_LABELS.OAUTH_MANUAL_BROWSER}" does the same thing without trying to launch a browser, ` +
+        `and "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}" avoid the callback entirely.`;
+    const unavailableMessage = (lifecycle) => {
+        switch (lifecycle) {
+            case "listener_unavailable":
+                return listenerUnavailableMessage();
+            default: {
+                const unreachable = lifecycle;
+                return unreachable;
+            }
+        }
+    };
+    /**
+     * Every accepted paste must carry this attempt's `state`, a raw code
+     * included.
+     *
+     * That comparison is the manual flow's only in-plugin binding between
+     * the pasted value and this login. Accepting a bare code delegates the
+     * binding entirely to the authorization server's PKCE enforcement, and
+     * hands anything a user is talked into pasting to
+     * `exchangeAuthorizationCode` with this attempt's verifier — which is
+     * the shape of the attack the state check exists to stop. The raw
+     * branch of `parseAuthorizationInput` also returns the whole trimmed
+     * input as the code, so a noisy paste would be forwarded verbatim.
+     */
+    const manualInputRejection = (parsed, expectedState) => {
+        if (!parsed.code) {
+            return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...&state=...). If browser callback keeps failing, retry with Device Code.";
+        }
+        switch (parsed.source) {
+            case "raw":
+                return "That is a bare authorization code. This flow needs the full callback URL, including the state parameter (e.g., http://localhost:1455/auth/callback?code=...&state=...), which is what ties the code to this login attempt. If needed, retry with Device Code.";
+            case "url":
+            case "query":
+            case "fragment":
+                if (!parsed.state) {
+                    return "That callback URL carries no OAuth state, so it cannot be matched to this login attempt. Paste the complete callback URL including its state parameter, or retry with Device Code.";
+                }
+                if (parsed.state !== expectedState) {
+                    return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt, or retry with Device Code.";
+                }
+                return undefined;
+            default: {
+                const unreachable = parsed;
+                return unreachable;
+            }
+        }
+    };
     const buildManualOAuthFlow = (pkce, url, expectedState, replaceAll) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
-        validate: (input) => {
-            const parsed = parseAuthorizationInput(input);
-            if (!parsed.code) {
-                return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...). If browser callback keeps failing, retry with Device Code.";
-            }
-            if (!parsed.state) {
-                return parsed.source === "raw"
-                    ? "That is a bare authorization code. This flow needs the full callback URL, including the state parameter (e.g., http://localhost:1455/auth/callback?code=...&state=...). If needed, retry with Device Code."
-                    : "Missing OAuth state. Paste the full callback URL including both code and state parameters. If needed, retry with Device Code.";
-            }
-            if (parsed.state !== expectedState) {
-                return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt, or retry with Device Code.";
-            }
-            return undefined;
-        },
+        validate: (input) => manualInputRejection(parseAuthorizationInput(input), expectedState),
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
-            if (!parsed.code || !parsed.state) {
-                return {
-                    type: "failed",
-                    reason: "invalid_response",
-                    message: "Missing authorization code or OAuth state",
-                };
-            }
-            if (parsed.state !== expectedState) {
+            const rejection = manualInputRejection(parsed, expectedState);
+            if (rejection !== undefined || !parsed.code) {
                 return {
                     type: "failed",
                     reason: "invalid_response",
-                    message: "OAuth state mismatch. Restart login and try again, or retry with Device Code.",
+                    message: rejection ?? "Missing authorization code",
                 };
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -353,21 +391,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         },
     });
     const runOAuthFlow = async (forceNewLogin = false) => {
-        const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
-        logInfo(`OAuth URL: ${url}`);
-        let serverInfo = null;
-        try {
-            serverInfo = await startLocalOAuthServer({ state });
-        }
-        catch (err) {
-            logDebug(`[${PLUGIN_NAME}] Failed to start OAuth server: ${err?.message ?? String(err)}`);
-            serverInfo = null;
-        }
-        openBrowserUrl(url);
-        if (!serverInfo || !serverInfo.ready) {
-            serverInfo?.close();
-            const message = `OAuth callback server failed to start on localhost loopback port 1455. ` +
-                `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+        const session = await startLoopbackFlow({
+            openBrowser: true,
+            forceNewLogin,
+        });
+        if (session.type === "unavailable") {
+            const message = unavailableMessage(session.lifecycle);
             logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
             return {
                 type: "failed",
@@ -375,17 +404,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 message,
             };
         }
-        const result = await serverInfo.waitForCode(state);
-        serverInfo.close();
-        if (!result) {
+        logInfo(`OAuth URL: ${session.url}`);
+        // Printed first, so the recovery instruction points at a URL the
+        // user can already see. The session stays open either way.
+        if (!session.browserOpened) {
+            logWarn(`\n[${PLUGIN_NAME}] ${browserOpenFailedMessage()}\n`);
+        }
+        const result = await session.waitAndExchange();
+        if (result.type === "cancelled") {
             return {
                 type: "failed",
                 reason: "unknown",
-                message: `OAuth callback timed out or was cancelled. ` +
-                    `If you are on SSH, WSL, or a headless machine, retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`,
+                message: callbackCancelledMessage(),
             };
         }
-        return await exchangeAuthorizationCode(result.code, pkce.verifier, REDIRECT_URI);
+        return result;
     };
     const showToast = async (message, variant = "success", options) => {
         try {
@@ -1128,10 +1161,22 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             });
         }
     };
+    // Created here, after `invalidateAccountManagerCache`, because the
+    // monitor refreshes access tokens unattended. A refresh rotates the
+    // single-use refresh token durably on disk, so the cached
+    // AccountManager holding the old one must be dropped or its debounced
+    // save clobbers the rotation (see `reloadCachedAccountManager` above).
+    const quotaMonitor = createQuotaMonitor({
+        onCredentialsPersisted: invalidateAccountManagerCache,
+    });
     // Event handler for session recovery and account selection
     const eventHandler = async (input) => {
         try {
             const { event } = input;
+            if (event.type === "server.instance.disposed") {
+                quotaMonitor.dispose();
+                return;
+            }
             // Handle TUI account selection events
             // Accepts generic selection events with an index property
             if (event.type === "account.select" ||
@@ -1238,6 +1283,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     const startupPerProjectAccounts = getPerProjectAccounts(startupPluginConfig);
     setStoragePath(startupPerProjectAccounts ? process.cwd() : null);
     await backfillHostOpenAIAuthFromPool();
+    quotaMonitor.start();
     return {
         event: eventHandler,
         auth: {
@@ -2530,9 +2576,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         const authPerProjectAccounts = getPerProjectAccounts(authPluginConfig);
                         setStoragePath(authPerProjectAccounts ? process.cwd() : null);
                         const accounts = [];
+                        // Programmatic input, not a menu choice: a headless caller or
+                        // script passes it to say "never launch a browser". Ignoring it
+                        // would silently do the opposite — enter the multi-account loop,
+                        // try to launch a browser, and bind port 1455 — and would also
+                        // drop the replaceAll semantics the manual path carries.
                         const noBrowser = inputs?.noBrowser === "true" ||
                             inputs?.["no-browser"] === "true";
-                        const useManualMode = noBrowser;
                         const explicitLoginMode = inputs?.loginMode === "fresh" || inputs?.loginMode === "add"
                             ? inputs.loginMode
                             : null;
@@ -2580,8 +2630,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window)}`);
                                 }
                             }
-                            if (usage.planType)
-                                parts.push(`plan:${usage.planType}`);
+                            const planLabel = formatPlanType(usage.planType);
+                            if (planLabel)
+                                parts.push(`plan:${planLabel}`);
                             if (usage.credits)
                                 parts.push(`credits:${usage.credits}`);
                             return parts.length > 0 ? parts.join(", ") : "quota unavailable";
@@ -3166,10 +3217,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         if (refreshAccountIndex !== undefined) {
                             targetCount = 1;
                         }
-                        if (useManualMode) {
+                        if (noBrowser) {
                             targetCount = 1;
-                        }
-                        if (useManualMode) {
+                            // Paste-the-code, not the loopback listener: this is the one
+                            // path that needs neither a browser on this host nor a
+                            // reachable localhost:1455 from wherever the browser runs.
                             const { pkce, state, url } = await createAuthorizationFlow();
                             return buildManualOAuthFlow(pkce, url, state, startFresh);
                         }
@@ -3260,6 +3312,57 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         };
                     },
                 },
+                {
+                    label: AUTH_LABELS.OAUTH_MANUAL_BROWSER,
+                    type: "oauth",
+                    authorize: async () => {
+                        // Must happen BEFORE the callback persists, to ensure correct
+                        // storage location: OpenCode invokes callback() separately from
+                        // authorize(), so the path has to be pinned here.
+                        const manualBrowserPluginConfig = loadPluginConfig();
+                        applyUiRuntimeFromConfig(manualBrowserPluginConfig);
+                        const manualBrowserPerProjectAccounts = getPerProjectAccounts(manualBrowserPluginConfig);
+                        setStoragePath(manualBrowserPerProjectAccounts ? process.cwd() : null);
+                        const session = await startLoopbackFlow({ openBrowser: false });
+                        if (session.type === "unavailable") {
+                            const message = unavailableMessage(session.lifecycle);
+                            logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
+                            return {
+                                url: "",
+                                instructions: message,
+                                method: "auto",
+                                callback: () => Promise.resolve({
+                                    type: "failed",
+                                    reason: "invalid_response",
+                                    message,
+                                }),
+                            };
+                        }
+                        return {
+                            url: session.url,
+                            instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL_BROWSER,
+                            method: "auto",
+                            callback: async () => {
+                                const result = await session.waitAndExchange();
+                                if (result.type === "cancelled") {
+                                    return {
+                                        type: "failed",
+                                        reason: "unknown",
+                                        message: callbackCancelledMessage(),
+                                    };
+                                }
+                                if (result.type !== "success") {
+                                    return result;
+                                }
+                                const resolved = await resolveAndPersistAccountSelection(result, {
+                                    persistSelections: persistAuthenticatedSelections,
+                                    replaceAll: false,
+                                });
+                                return resolved.primary;
+                            },
+                        };
+                    },
+                },
                 {
                     label: AUTH_LABELS.OAUTH_DEVICE_CODE,
                     type: "oauth",
@@ -3299,8 +3402,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     label: AUTH_LABELS.OAUTH_MANUAL,
                     type: "oauth",
                     authorize: async () => {
-                        // Initialize storage path for manual OAuth flow
-                        // Must happen BEFORE persistAccountPool to ensure correct storage location
+                        // Must happen BEFORE the callback persists, to ensure correct
+                        // storage location: OpenCode invokes callback() separately from
+                        // authorize(), so the path has to be pinned here.
                         const manualPluginConfig = loadPluginConfig();
                         applyUiRuntimeFromConfig(manualPluginConfig);
                         const manualPerProjectAccounts = getPerProjectAccounts(manualPluginConfig);