oc-codex-multi-auth 6.15.0 → 6.17.0

package/dist/index.js

@@ -27,11 +27,11 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./lib/auth/auth.js";
+import { formatPlanType } from "./lib/auth/plan-tier.js";
+import { startLoopbackFlow, } from "./lib/auth/loopback-flow.js";
 import { buildDeviceCodeInstructions, completeDeviceCodeSession, createDeviceCodeSession, } from "./lib/auth/device-code.js";
 import { applyAccountSelectionFallbacks, persistResolvedAccountSelection, persistAccountPool, resolveAndPersistAccountSelection, resolveAccountSelection, } from "./lib/auth/login-runner.js";
 import { coordinateFlaggedPersistedRefresh, coordinatePersistedRefresh, } from "./lib/storage/coordinated-refresh.js";
-import { openBrowserUrl } from "./lib/auth/browser.js";
-import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
 import { getCodexMode, getRequestTransformMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRetryProfile, getRetryBudgetOverrides, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getAutoUpdate, getToastDurationMs, getAccountToastsEnabled, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getRotationStrategy, getModelAccountPool, getModelAccountPoolMode, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getBeginnerSafeMode, getCodexTuiMaskEmail, loadPluginConfig, } from "./lib/config.js";
 import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
@@ -305,39 +305,76 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             }
         }
     };
+    const listenerUnavailableMessage = () => `OAuth callback server failed to start on localhost loopback port 1455. ` +
+        `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+    const callbackCancelledMessage = () => `OAuth callback timed out or was cancelled. ` +
+        `If you are on SSH, WSL, or a headless machine, retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+    // The login is still live when this fires: the listener is bound and
+    // waiting, so opening the URL printed above finishes it. That is the
+    // whole recovery path on a host with no opener on PATH.
+    const browserOpenFailedMessage = () => `Could not launch your default browser. Open the OAuth URL above in any browser to finish signing in; ` +
+        `this login is still waiting on the localhost callback. ` +
+        `"${AUTH_LABELS.OAUTH_MANUAL_BROWSER}" does the same thing without trying to launch a browser, ` +
+        `and "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}" avoid the callback entirely.`;
+    const unavailableMessage = (lifecycle) => {
+        switch (lifecycle) {
+            case "listener_unavailable":
+                return listenerUnavailableMessage();
+            default: {
+                const unreachable = lifecycle;
+                return unreachable;
+            }
+        }
+    };
+    /**
+     * Every accepted paste must carry this attempt's `state`, a raw code
+     * included.
+     *
+     * That comparison is the manual flow's only in-plugin binding between
+     * the pasted value and this login. Accepting a bare code delegates the
+     * binding entirely to the authorization server's PKCE enforcement, and
+     * hands anything a user is talked into pasting to
+     * `exchangeAuthorizationCode` with this attempt's verifier — which is
+     * the shape of the attack the state check exists to stop. The raw
+     * branch of `parseAuthorizationInput` also returns the whole trimmed
+     * input as the code, so a noisy paste would be forwarded verbatim.
+     */
+    const manualInputRejection = (parsed, expectedState) => {
+        if (!parsed.code) {
+            return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...&state=...). If browser callback keeps failing, retry with Device Code.";
+        }
+        switch (parsed.source) {
+            case "raw":
+                return "That is a bare authorization code. This flow needs the full callback URL, including the state parameter (e.g., http://localhost:1455/auth/callback?code=...&state=...), which is what ties the code to this login attempt. If needed, retry with Device Code.";
+            case "url":
+            case "query":
+            case "fragment":
+                if (!parsed.state) {
+                    return "That callback URL carries no OAuth state, so it cannot be matched to this login attempt. Paste the complete callback URL including its state parameter, or retry with Device Code.";
+                }
+                if (parsed.state !== expectedState) {
+                    return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt, or retry with Device Code.";
+                }
+                return undefined;
+            default: {
+                const unreachable = parsed;
+                return unreachable;
+            }
+        }
+    };
     const buildManualOAuthFlow = (pkce, url, expectedState, replaceAll) => ({
         url,
         method: "code",
         instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
-        validate: (input) => {
-            const parsed = parseAuthorizationInput(input);
-            if (!parsed.code) {
-                return "No authorization code found. Paste the full callback URL (e.g., http://localhost:1455/auth/callback?code=...). If browser callback keeps failing, retry with Device Code.";
-            }
-            if (!parsed.state) {
-                return parsed.source === "raw"
-                    ? "That is a bare authorization code. This flow needs the full callback URL, including the state parameter (e.g., http://localhost:1455/auth/callback?code=...&state=...). If needed, retry with Device Code."
-                    : "Missing OAuth state. Paste the full callback URL including both code and state parameters. If needed, retry with Device Code.";
-            }
-            if (parsed.state !== expectedState) {
-                return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt, or retry with Device Code.";
-            }
-            return undefined;
-        },
+        validate: (input) => manualInputRejection(parseAuthorizationInput(input), expectedState),
         callback: async (input) => {
             const parsed = parseAuthorizationInput(input);
-            if (!parsed.code || !parsed.state) {
-                return {
-                    type: "failed",
-                    reason: "invalid_response",
-                    message: "Missing authorization code or OAuth state",
-                };
-            }
-            if (parsed.state !== expectedState) {
+            const rejection = manualInputRejection(parsed, expectedState);
+            if (rejection !== undefined || !parsed.code) {
                 return {
                     type: "failed",
                     reason: "invalid_response",
-                    message: "OAuth state mismatch. Restart login and try again, or retry with Device Code.",
+                    message: rejection ?? "Missing authorization code",
                 };
             }
             const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
@@ -354,21 +391,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         },
     });
     const runOAuthFlow = async (forceNewLogin = false) => {
-        const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
-        logInfo(`OAuth URL: ${url}`);
-        let serverInfo = null;
-        try {
-            serverInfo = await startLocalOAuthServer({ state });
-        }
-        catch (err) {
-            logDebug(`[${PLUGIN_NAME}] Failed to start OAuth server: ${err?.message ?? String(err)}`);
-            serverInfo = null;
-        }
-        openBrowserUrl(url);
-        if (!serverInfo || !serverInfo.ready) {
-            serverInfo?.close();
-            const message = `OAuth callback server failed to start on localhost loopback port 1455. ` +
-                `Retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`;
+        const session = await startLoopbackFlow({
+            openBrowser: true,
+            forceNewLogin,
+        });
+        if (session.type === "unavailable") {
+            const message = unavailableMessage(session.lifecycle);
             logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
             return {
                 type: "failed",
@@ -376,17 +404,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 message,
             };
         }
-        const result = await serverInfo.waitForCode(state);
-        serverInfo.close();
-        if (!result) {
+        logInfo(`OAuth URL: ${session.url}`);
+        // Printed first, so the recovery instruction points at a URL the
+        // user can already see. The session stays open either way.
+        if (!session.browserOpened) {
+            logWarn(`\n[${PLUGIN_NAME}] ${browserOpenFailedMessage()}\n`);
+        }
+        const result = await session.waitAndExchange();
+        if (result.type === "cancelled") {
             return {
                 type: "failed",
                 reason: "unknown",
-                message: `OAuth callback timed out or was cancelled. ` +
-                    `If you are on SSH, WSL, or a headless machine, retry with "${AUTH_LABELS.OAUTH_DEVICE_CODE}" or "${AUTH_LABELS.OAUTH_MANUAL}".`,
+                message: callbackCancelledMessage(),
             };
         }
-        return await exchangeAuthorizationCode(result.code, pkce.verifier, REDIRECT_URI);
+        return result;
     };
     const showToast = async (message, variant = "success", options) => {
         try {
@@ -2544,9 +2576,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         const authPerProjectAccounts = getPerProjectAccounts(authPluginConfig);
                         setStoragePath(authPerProjectAccounts ? process.cwd() : null);
                         const accounts = [];
+                        // Programmatic input, not a menu choice: a headless caller or
+                        // script passes it to say "never launch a browser". Ignoring it
+                        // would silently do the opposite — enter the multi-account loop,
+                        // try to launch a browser, and bind port 1455 — and would also
+                        // drop the replaceAll semantics the manual path carries.
                         const noBrowser = inputs?.noBrowser === "true" ||
                             inputs?.["no-browser"] === "true";
-                        const useManualMode = noBrowser;
                         const explicitLoginMode = inputs?.loginMode === "fresh" || inputs?.loginMode === "add"
                             ? inputs.loginMode
                             : null;
@@ -2594,8 +2630,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     parts.push(`${limit.name} ${formatUsageLimitSummary(limit.window)}`);
                                 }
                             }
-                            if (usage.planType)
-                                parts.push(`plan:${usage.planType}`);
+                            const planLabel = formatPlanType(usage.planType);
+                            if (planLabel)
+                                parts.push(`plan:${planLabel}`);
                             if (usage.credits)
                                 parts.push(`credits:${usage.credits}`);
                             return parts.length > 0 ? parts.join(", ") : "quota unavailable";
@@ -3180,10 +3217,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         if (refreshAccountIndex !== undefined) {
                             targetCount = 1;
                         }
-                        if (useManualMode) {
+                        if (noBrowser) {
                             targetCount = 1;
-                        }
-                        if (useManualMode) {
+                            // Paste-the-code, not the loopback listener: this is the one
+                            // path that needs neither a browser on this host nor a
+                            // reachable localhost:1455 from wherever the browser runs.
                             const { pkce, state, url } = await createAuthorizationFlow();
                             return buildManualOAuthFlow(pkce, url, state, startFresh);
                         }
@@ -3274,6 +3312,57 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         };
                     },
                 },
+                {
+                    label: AUTH_LABELS.OAUTH_MANUAL_BROWSER,
+                    type: "oauth",
+                    authorize: async () => {
+                        // Must happen BEFORE the callback persists, to ensure correct
+                        // storage location: OpenCode invokes callback() separately from
+                        // authorize(), so the path has to be pinned here.
+                        const manualBrowserPluginConfig = loadPluginConfig();
+                        applyUiRuntimeFromConfig(manualBrowserPluginConfig);
+                        const manualBrowserPerProjectAccounts = getPerProjectAccounts(manualBrowserPluginConfig);
+                        setStoragePath(manualBrowserPerProjectAccounts ? process.cwd() : null);
+                        const session = await startLoopbackFlow({ openBrowser: false });
+                        if (session.type === "unavailable") {
+                            const message = unavailableMessage(session.lifecycle);
+                            logWarn(`\n[${PLUGIN_NAME}] ${message}\n`);
+                            return {
+                                url: "",
+                                instructions: message,
+                                method: "auto",
+                                callback: () => Promise.resolve({
+                                    type: "failed",
+                                    reason: "invalid_response",
+                                    message,
+                                }),
+                            };
+                        }
+                        return {
+                            url: session.url,
+                            instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL_BROWSER,
+                            method: "auto",
+                            callback: async () => {
+                                const result = await session.waitAndExchange();
+                                if (result.type === "cancelled") {
+                                    return {
+                                        type: "failed",
+                                        reason: "unknown",
+                                        message: callbackCancelledMessage(),
+                                    };
+                                }
+                                if (result.type !== "success") {
+                                    return result;
+                                }
+                                const resolved = await resolveAndPersistAccountSelection(result, {
+                                    persistSelections: persistAuthenticatedSelections,
+                                    replaceAll: false,
+                                });
+                                return resolved.primary;
+                            },
+                        };
+                    },
+                },
                 {
                     label: AUTH_LABELS.OAUTH_DEVICE_CODE,
                     type: "oauth",
@@ -3313,8 +3402,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     label: AUTH_LABELS.OAUTH_MANUAL,
                     type: "oauth",
                     authorize: async () => {
-                        // Initialize storage path for manual OAuth flow
-                        // Must happen BEFORE persistAccountPool to ensure correct storage location
+                        // Must happen BEFORE the callback persists, to ensure correct
+                        // storage location: OpenCode invokes callback() separately from
+                        // authorize(), so the path has to be pinned here.
                         const manualPluginConfig = loadPluginConfig();
                         applyUiRuntimeFromConfig(manualPluginConfig);
                         const manualPerProjectAccounts = getPerProjectAccounts(manualPluginConfig);