oc-codex-multi-auth 6.15.0 → 6.16.0

package/README.md

@@ -263,6 +263,8 @@ Most of these also run as a **direct CLI** with no agent/model involvement (no t
 - unsupported-model handling is strict by default, with opt-in fallback controls
 - TUI quota status follows the account/workspace used by the latest request
 - Business workspace memberships and Personal accounts keep separate usage and quota windows. Business members sharing one workspace are distinguished by their member/seat identity, so their usage is not collapsed into one row.
+- An account identifies itself by its own ChatGPT email and the last 6 characters of its account id, with the email masked when `maskEmail` is on. The OAuth id_token also lists the API-platform organizations the login belongs to; those are not ChatGPT workspaces and are never used to name an account, so logging in clears a label left behind by one. A label you set with `codex-label` is always kept.
+- The ChatGPT plan (`Free`, `Plus`, `Pro`, `Business`, `Business Premium`) is read from the access token, refreshed on every token refresh, and shown by `codex-list` and `codex-status`. `codex-limits` and the TUI read the plan live from the usage endpoint and name it the same way. An unrecognized plan is reported verbatim rather than renamed.
 
 ---
 
@@ -302,12 +304,13 @@ The feature is disabled by default.
 
 Each line reports the enabled account with the most headroom in that window,
 together with that same account's reset time, so the pair always describes a
-quota that one account actually has. Windows a plan has switched off are
-skipped rather than counted as full. Account identities are omitted for
-readability and lock-screen privacy:
+quota that one account actually has. When a different account recovers sooner,
+that reset is appended under its own label rather than folded into the first
+one. Windows a plan has switched off are skipped rather than counted as full.
+Account identities are omitted for readability and lock-screen privacy:
 
 ```text
-5h: 10% | resets 22:30
+5h: 10% | resets 02:00 | another account resets 22:30
 Weekly: 72% | resets 22:30 on Aug 30
 ```
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AAuU/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAq9H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,qBAAqB,CAAC;AA2U/D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAqjI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -27,11 +27,11 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
+import { formatPlanType } from "./lib/auth/plan-tier.js";
+import { startLoopbackFlow, } from "./lib/auth/loopback-flow.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
 import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
-import { openBrowserUrl } from "./lib/auth/browser.js";
-import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
 import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
@@ -305,39 +305,76 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             }
         }
     };
+    const listenerUnavailableMessage = () => `OAuth callback server failed to start on localhost loopback port 1455. ` +
+        `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+    const callbackCancelledMessage = () => `OAuth callback timed out or was cancelled. ` +
+        `If you are on SSH, WSL, or a headless machine, retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+    // The login is still live when this fires: the listener is bound and
+    // waiting, so opening the URL printed above finishes it. That is the
+    // whole recovery path on a host with no opener on PATH.
+    const browserOpenFailedMessage = () => `Could not launch your default browser. Open the OAuth URL above in any browser to finish signing in; ` +
+        `this login is still waiting on the localhost callback. ` +
+        `"${AUTH_LABELS.OAUTH_MANUAL_BROWSER}" does the same thing without trying to launch a browser, ` +
+        `and "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}" avoid the callback entirely.`;
+    const unavailableMessage = (lifecycle) => {
+        switch (lifecycle) {
+            case "listener_unavailable":
+                return listenerUnavailableMessage();
+            default: {
+                const unreachable = lifecycle;
+                return unreachable;
+            }
+        }
+    };
+    /**
+     * Every accepted paste must carry this attempt's `state`, a raw code
+     * included.
+     *
+     * That comparison is the manual flow's only in-plugin binding between
+     * the pasted value and this login. Accepting a bare code delegates the
+     * binding entirely to the authorization server's PKCE enforcement, and
+     * hands anything a user is talked into pasting to
+     * `exchangeAuthorizationCode` with this attempt's verifier — which is
+     * the shape of the attack the state check exists to stop. The raw
+     * branch of `parseAuthorizationInput` also returns the whole trimmed
+     * input as the code, so a noisy paste would be forwarded verbatim.
+     */
+    const manualInputRejection = (parsed, expectedState) => {
+        if (!parsed.code) {
+            return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...&state=...). If browser callback keeps failing, retry with Device Code.";
+        }
+        switch (parsed.source) {
+            case "raw":
+                return "That is a bare authorization code. This flow needs the full callback URL, including the state parameter (e.g., http://localhost:1455/auth/callback?code=...&state=...), which is what ties the code to this login attempt. If needed, retry with Device Code.";
+            case "url":
+            case "query":
+            case "fragment":
+                if (!parsed.state) {
+                    return "That callback URL carries no OAuth state, so it cannot be matched to this login attempt. Paste the complete callback URL including its state parameter, or retry with Device Code.";
+                }
+                if (parsed.state !== expectedState) {
+                    return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt, or retry with Device Code.";
+                }
+                return undefined;
+            default: {
+                const unreachable = parsed;
+                return unreachable;
+            }
+        }
+    };
     const buildManualOAuthFlow = (pkce, url, expectedState, replaceAll) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
-        validate: (input) => {
-            const parsed = parseAuthorizationInput(input);
-            if (!parsed.code) {
-                return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...). If browser callback keeps failing, retry with Device Code.";
-            }
-            if (!parsed.state) {
-                return parsed.source === "raw"
-                    ? "That is a bare authorization code. This flow needs the full callback URL, including the state parameter (e.g., http://localhost:1455/auth/callback?code=...&state=...). If needed, retry with Device Code."
-                    : "Missing OAuth state. Paste the full callback URL including both code and state parameters. If needed, retry with Device Code.";
-            }
-            if (parsed.state !== expectedState) {
-                return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt, or retry with Device Code.";
-            }
-            return undefined;
-        },
+        validate: (input) => manualInputRejection(parseAuthorizationInput(input), expectedState),
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
-            if (!parsed.code || !parsed.state) {
-                return {
-                    type: "failed",
-                    reason: "invalid_response",
-                    message: "Missing authorization code or OAuth state",
-                };
-            }
-            if (parsed.state !== expectedState) {
+            const rejection = manualInputRejection(parsed, expectedState);
+            if (rejection !== undefined || !parsed.code) {
                 return {
                     type: "failed",
                     reason: "invalid_response",
-                    message: "OAuth state mismatch. Restart login and try again, or retry with Device Code.",
+                    message: rejection ?? "Missing authorization code",
                 };
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -354,21 +391,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         },
     });
     const runOAuthFlow = async (forceNewLogin = false) => {
-        const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
-        logInfo(`OAuth URL: ${url}`);
-        let serverInfo = null;
-        try {
-            serverInfo = await startLocalOAuthServer({ state });
-        }
-        catch (err) {
-            logDebug(`[${PLUGIN_NAME}] Failed to start OAuth server: ${err?.message ?? String(err)}`);
-            serverInfo = null;
-        }
-        openBrowserUrl(url);
-        if (!serverInfo || !serverInfo.ready) {
-            serverInfo?.close();
-            const message = `OAuth callback server failed to start on localhost loopback port 1455. ` +
-                `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+        const session = await startLoopbackFlow({
+            openBrowser: true,
+            forceNewLogin,
+        });
+        if (session.type === "unavailable") {
+            const message = unavailableMessage(session.lifecycle);
             logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
             return {
                 type: "failed",
@@ -376,17 +404,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 message,
             };
         }
-        const result = await serverInfo.waitForCode(state);
-        serverInfo.close();
-        if (!result) {
+        logInfo(`OAuth URL: ${session.url}`);
+        // Printed first, so the recovery instruction points at a URL the
+        // user can already see. The session stays open either way.
+        if (!session.browserOpened) {
+            logWarn(`\n[${PLUGIN_NAME}] ${browserOpenFailedMessage()}\n`);
+        }
+        const result = await session.waitAndExchange();
+        if (result.type === "cancelled") {
             return {
                 type: "failed",
                 reason: "unknown",
-                message: `OAuth callback timed out or was cancelled. ` +
-                    `If you are on SSH, WSL, or a headless machine, retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`,
+                message: callbackCancelledMessage(),
             };
         }
-        return await exchangeAuthorizationCode(result.code, pkce.verifier, REDIRECT_URI);
+        return result;
     };
     const showToast = async (message, variant = "success", options) => {
         try {
@@ -2544,9 +2576,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         const authPerProjectAccounts = getPerProjectAccounts(authPluginConfig);
                         setStoragePath(authPerProjectAccounts ? process.cwd() : null);
                         const accounts = [];
+                        // Programmatic input, not a menu choice: a headless caller or
+                        // script passes it to say "never launch a browser". Ignoring it
+                        // would silently do the opposite — enter the multi-account loop,
+                        // try to launch a browser, and bind port 1455 — and would also
+                        // drop the replaceAll semantics the manual path carries.
                         const noBrowser = inputs?.noBrowser === "true" ||
                             inputs?.["no-browser"] === "true";
-                        const useManualMode = noBrowser;
                         const explicitLoginMode = inputs?.loginMode === "fresh" || inputs?.loginMode === "add"
                             ? inputs.loginMode
                             : null;
@@ -2594,8 +2630,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window)}`);
                                 }
                             }
-                            if (usage.planType)
-                                parts.push(`plan:${usage.planType}`);
+                            const planLabel = formatPlanType(usage.planType);
+                            if (planLabel)
+                                parts.push(`plan:${planLabel}`);
                             if (usage.credits)
                                 parts.push(`credits:${usage.credits}`);
                             return parts.length > 0 ? parts.join(", ") : "quota unavailable";
@@ -3180,10 +3217,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         if (refreshAccountIndex !== undefined) {
                             targetCount = 1;
                         }
-                        if (useManualMode) {
+                        if (noBrowser) {
                             targetCount = 1;
-                        }
-                        if (useManualMode) {
+                            // Paste-the-code, not the loopback listener: this is the one
+                            // path that needs neither a browser on this host nor a
+                            // reachable localhost:1455 from wherever the browser runs.
                             const { pkce, state, url } = await createAuthorizationFlow();
                             return buildManualOAuthFlow(pkce, url, state, startFresh);
                         }
@@ -3274,6 +3312,57 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         };
                     },
                 },
+                {
+                    label: AUTH_LABELS.OAUTH_MANUAL_BROWSER,
+                    type: "oauth",
+                    authorize: async () => {
+                        // Must happen BEFORE the callback persists, to ensure correct
+                        // storage location: OpenCode invokes callback() separately from
+                        // authorize(), so the path has to be pinned here.
+                        const manualBrowserPluginConfig = loadPluginConfig();
+                        applyUiRuntimeFromConfig(manualBrowserPluginConfig);
+                        const manualBrowserPerProjectAccounts = getPerProjectAccounts(manualBrowserPluginConfig);
+                        setStoragePath(manualBrowserPerProjectAccounts ? process.cwd() : null);
+                        const session = await startLoopbackFlow({ openBrowser: false });
+                        if (session.type === "unavailable") {
+                            const message = unavailableMessage(session.lifecycle);
+                            logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
+                            return {
+                                url: "",
+                                instructions: message,
+                                method: "auto",
+                                callback: () => Promise.resolve({
+                                    type: "failed",
+                                    reason: "invalid_response",
+                                    message,
+                                }),
+                            };
+                        }
+                        return {
+                            url: session.url,
+                            instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL_BROWSER,
+                            method: "auto",
+                            callback: async () => {
+                                const result = await session.waitAndExchange();
+                                if (result.type === "cancelled") {
+                                    return {
+                                        type: "failed",
+                                        reason: "unknown",
+                                        message: callbackCancelledMessage(),
+                                    };
+                                }
+                                if (result.type !== "success") {
+                                    return result;
+                                }
+                                const resolved = await resolveAndPersistAccountSelection(result, {
+                                    persistSelections: persistAuthenticatedSelections,
+                                    replaceAll: false,
+                                });
+                                return resolved.primary;
+                            },
+                        };
+                    },
+                },
                 {
                     label: AUTH_LABELS.OAUTH_DEVICE_CODE,
                     type: "oauth",
@@ -3313,8 +3402,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     label: AUTH_LABELS.OAUTH_MANUAL,
                     type: "oauth",
                     authorize: async () => {
-                        // Initialize storage path for manual OAuth flow
-                        // Must happen BEFORE persistAccountPool to ensure correct storage location
+                        // Must happen BEFORE the callback persists, to ensure correct
+                        // storage location: OpenCode invokes callback() separately from
+                        // authorize(), so the path has to be pinned here.
                         const manualPluginConfig = loadPluginConfig();
                         applyUiRuntimeFromConfig(manualPluginConfig);
                         const manualPerProjectAccounts = getPerProjectAccounts(manualPluginConfig);