oc-codex-multi-auth 6.18.0 → 6.20.0

package/scripts/install-oc-codex-multi-auth-core.js

@@ -257,8 +257,28 @@ async function readStandaloneStorage(path) {
 	try {
 		const raw = await readFile(path, "utf-8");
 		const parsed = JSON.parse(raw);
+		// Shape validation, not just parse validation: a JSON array, scalar, or
+		// object without an `accounts` array is unreadable by the plugin runtime
+		// too (normalizeAccountStorage rejects it), so reporting it as a healthy
+		// empty pool (exit 0, "No accounts configured") hides the corruption
+		// from scripted callers that key on exit codes.
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+			return { storage: null, error: "Storage file must be a JSON object with an accounts array." };
+		}
+		// Forward-compat mirror of the runtime guard: a newer schema version
+		// must not be shown as readable accounts by this build.
+		const version = parsed.version;
+		if (typeof version === "number" && Number.isFinite(version) && version > 3) {
+			return {
+				storage: null,
+				error: `Unsupported account storage schema version ${version}; this build supports up to version 3.`,
+			};
+		}
+		if (!Array.isArray(parsed.accounts)) {
+			return { storage: null, error: "Storage file must be a JSON object with an accounts array." };
+		}
 		return {
-			storage: parsed && typeof parsed === "object" ? normalizeStandaloneStorage(parsed) : null,
+			storage: normalizeStandaloneStorage(parsed),
 			error: null,
 		};
 	} catch (error) {
@@ -307,6 +327,29 @@ function mergeStandaloneAccounts(target, source) {
 	return mergeStandaloneAccounts(source, target);
 }
 
+// Mirror of `isStaleGeneratedAccountLabel` / `dropStaleGeneratedLabel` in
+// lib/auth/token-utils.ts and lib/storage/normalize.ts. The standalone CLI
+// reads the pool through this normalizer and never through the compiled
+// `normalizeAccountStorage`, so without the mirror `status`, `list`, `health`,
+// `doctor` and `dashboard` keep printing the org-derived label the plugin
+// itself now drops - next to the account id, which is the identity the label
+// was misnaming. The marker must hold this account's own id suffix so a name
+// set with `codex-label` survives.
+const GENERATED_LABEL_PATTERN = /\s\[id:[^\]]*\]$/;
+
+function dropStaleStandaloneLabel(account) {
+	const label = typeof account?.accountLabel === "string" ? account.accountLabel.trim() : "";
+	const accountId = typeof account?.accountId === "string" ? account.accountId.trim() : "";
+	if (!label || !accountId) return account;
+	const marker = label.match(GENERATED_LABEL_PATTERN)?.[0];
+	if (!marker) return account;
+	const suffix = accountId.length > 6 ? accountId.slice(-6) : accountId;
+	if (marker !== ` [id:${suffix}]`) return account;
+	const next = { ...account };
+	delete next.accountLabel;
+	return next;
+}
+
 function normalizeStandaloneStorage(storage) {
 	if (!Array.isArray(storage.accounts)) return storage;
 	const accounts = [...storage.accounts];
@@ -324,7 +367,9 @@ function normalizeStandaloneStorage(storage) {
 			if (sourceIndex === i) break;
 		}
 	}
-	const normalizedAccounts = accounts.filter((_, index) => !removed.has(index));
+	const normalizedAccounts = accounts
+		.filter((_, index) => !removed.has(index))
+		.map(dropStaleStandaloneLabel);
 	return {
 		...storage,
 		accounts: normalizedAccounts,
@@ -332,9 +377,37 @@ function normalizeStandaloneStorage(storage) {
 	};
 }
 
+const MASKED_VALUE = "*****";
+// The head/tail mask keeps eight characters, so it conceals nothing worth
+// concealing below thirteen: `me@x.io` would print in full and `me@x.io12`
+// all but its middle character. `doctor` output is what users paste into
+// issues, so anything shorter is replaced outright instead. Input is trimmed
+// first, or `" me@x.io "` clears the cutoff on padding alone and drops back
+// into the partial mask.
+const MASK_MIN_LENGTH = 13;
+
 function maskValue(value, includeSensitive) {
-	if (includeSensitive || typeof value !== "string" || value.length <= 8) return value;
-	return `${value.slice(0, 4)}...${value.slice(-4)}`;
+	if (includeSensitive || typeof value !== "string") return value;
+	const trimmed = value.trim();
+	if (!trimmed) return trimmed;
+	if (trimmed.length < MASK_MIN_LENGTH) return MASKED_VALUE;
+	return `${trimmed.slice(0, 4)}...${trimmed.slice(-4)}`;
+}
+
+// Six characters when the id is shown in full, matching what the
+// in-conversation surfaces print as `id:`. Four when it is head/tail masked,
+// which is the tail `maskValue` already discloses as `accountId` in the same
+// payload, so the printed identity never reveals more of an id than the field
+// beside it. Nothing at all when the id was too short for that mask: the
+// `accountId` next to it is then `*****`, and four raw characters of a short
+// id can be the whole id.
+function accountIdSuffix(accountId, includeSensitive) {
+	if (!accountId) return undefined;
+	if (includeSensitive) {
+		return accountId.length > 6 ? accountId.slice(-6) : accountId;
+	}
+	if (accountId.length < MASK_MIN_LENGTH) return undefined;
+	return accountId.slice(-4);
 }
 
 function summarizeStandaloneAccounts(storage, includeSensitive, tag) {
@@ -345,21 +418,28 @@ function summarizeStandaloneAccounts(storage, includeSensitive, tag) {
 		.filter(({ account }) => !normalizedTag ||
 			(Array.isArray(account?.accountTags) &&
 				account.accountTags.some((entry) => String(entry).toLowerCase() === normalizedTag)))
-		.map(({ account, index }) => ({
-			index,
-			label: account?.accountLabel ?? `Account ${index + 1}`,
-			email: maskValue(account?.email, includeSensitive),
-			accountId: maskValue(account?.accountId, includeSensitive),
-			accountIdSource: account?.accountIdSource,
-			enabled: account?.enabled !== false,
-			hasRefreshToken: typeof account?.refreshToken === "string" && account.refreshToken.length > 0,
-			hasAccessToken: typeof account?.accessToken === "string" && account.accessToken.length > 0,
-			expiresAt: account?.expiresAt,
-			expired: typeof account?.expiresAt === "number" ? account.expiresAt <= Date.now() : undefined,
-			tags: Array.isArray(account?.accountTags) ? account.accountTags : [],
-			note: account?.accountNote,
-			rateLimitResetTimes: account?.rateLimitResetTimes ?? {},
-		}));
+		.map(({ account, index }) => {
+			const trimmedId =
+				typeof account?.accountId === "string" ? account.accountId.trim() : "";
+			const accountId = trimmedId || undefined;
+			return {
+				index,
+				label: account?.accountLabel ?? `Account ${index + 1}`,
+				email: maskValue(account?.email, includeSensitive),
+				accountId: maskValue(accountId, includeSensitive),
+				idSuffix: accountIdSuffix(accountId, includeSensitive),
+				accountIdSource: account?.accountIdSource,
+				enabled: account?.enabled !== false,
+				hasRefreshToken: typeof account?.refreshToken === "string" && account.refreshToken.length > 0,
+				hasAccessToken: typeof account?.accessToken === "string" && account.accessToken.length > 0,
+				expiresAt: account?.expiresAt,
+				expired: typeof account?.expiresAt === "number" ? account.expiresAt <= Date.now() : undefined,
+				tags: Array.isArray(account?.accountTags) ? account.accountTags : [],
+				note: account?.accountNote,
+				rateLimitResetTimes: account?.rateLimitResetTimes ?? {},
+				quotaExhaustedUntil: account?.quotaExhaustedUntil,
+			};
+		});
 }
 
 function printStandaloneResult(command, payload, json) {
@@ -373,10 +453,16 @@ function printStandaloneResult(command, payload, json) {
 	console.log(`Accounts: ${payload.totalAccounts}`);
 	if (Array.isArray(payload.accounts)) {
 		for (const account of payload.accounts) {
-			console.log(`- [${account.index}] ${account.label} enabled=${account.enabled} refresh=${account.hasRefreshToken} access=${account.hasAccessToken}`);
+			const identity = [account.email, account.idSuffix ? `id:${account.idSuffix}` : undefined]
+				.filter(Boolean)
+				.join(", ");
+			const name = identity ? `${account.label} (${identity})` : account.label;
+			console.log(`- [${account.index}] ${name} enabled=${account.enabled} refresh=${account.hasRefreshToken} access=${account.hasAccessToken}`);
 		}
 	}
 	if (payload.error) console.log(`Error: ${payload.error}`);
+	for (const fix of payload.appliedFixes ?? []) console.log(`Fixed: ${fix}`);
+	for (const error of payload.fixErrors ?? []) console.log(`Repair failed: ${error}`);
 	if (payload.nextAction) console.log(`Next: ${payload.nextAction}`);
 }
 
@@ -446,9 +532,29 @@ export async function runWarmCommand(parsed, options = {}) {
 	// persisted to the SAME file the rest of the toolchain reads.
 	storageMod.setStoragePathDirect(storagePath);
 
-	const storage = await storageMod.loadAccounts();
+	let storage = null;
+	try {
+		storage = await storageMod.loadAccounts();
+	} catch (error) {
+		// Typed storage errors (e.g. UNSUPPORTED_SCHEMA_VERSION) carry the
+		// upgrade hint; surface them rather than crashing the CLI.
+		const hint = error && typeof error.hint === "string" ? ` ${error.hint}` : "";
+		const payload = { command: "warm", storagePath, error: `${formatErrorForLog(error)}${hint}` };
+		printWarmResult(payload, parsed.json);
+		return { exitCode: 1, action: "warm", storagePath };
+	}
 	const accounts = Array.isArray(storage?.accounts) ? storage.accounts : [];
 	if (accounts.length === 0) {
+		// `loadAccounts` swallows parse/IO errors and returns null. Probe the
+		// file so a corrupt storage fails like `status`/`doctor` do (exit 1)
+		// instead of reporting a healthy empty pool. ENOENT stays a silent
+		// empty pool: a missing file legitimately means no accounts yet.
+		const probe = await readStandaloneStorage(storagePath);
+		if (probe.error) {
+			const payload = { command: "warm", storagePath, error: probe.error };
+			printWarmResult(payload, parsed.json);
+			return { exitCode: 1, action: "warm", storagePath };
+		}
 		const payload = {
 			command: "warm",
 			storagePath,
@@ -552,9 +658,27 @@ export async function runLimitsCommand(parsed, options = {}) {
 	// persisted to the SAME file the rest of the toolchain reads.
 	storageMod.setStoragePathDirect(storagePath);
 
-	const storage = await storageMod.loadAccounts();
+	let storage = null;
+	try {
+		storage = await storageMod.loadAccounts();
+	} catch (error) {
+		// Typed storage errors (e.g. UNSUPPORTED_SCHEMA_VERSION) carry the
+		// upgrade hint; surface them rather than crashing the CLI.
+		const hint = error && typeof error.hint === "string" ? ` ${error.hint}` : "";
+		const payload = { command: "limits", storagePath, error: `${formatErrorForLog(error)}${hint}` };
+		printLimitsResult(payload, parsed.json);
+		return { exitCode: 1, action: "limits", storagePath };
+	}
 	const accounts = Array.isArray(storage?.accounts) ? storage.accounts : [];
 	if (accounts.length === 0) {
+		// Same probe contract as `warm`: a corrupt file exits 1 like
+		// `status`/`doctor`; a missing file stays a silent empty pool.
+		const probe = await readStandaloneStorage(storagePath);
+		if (probe.error) {
+			const payload = { command: "limits", storagePath, error: probe.error };
+			printLimitsResult(payload, parsed.json);
+			return { exitCode: 1, action: "limits", storagePath };
+		}
 		const payload = {
 			command: "limits",
 			storagePath,
@@ -595,6 +719,7 @@ export async function runLimitsCommand(parsed, options = {}) {
 			label: account.accountLabel ?? `Account ${index + 1}`,
 			email: maskValue(account.email, parsed.includeSensitive),
 			rateLimitResetTimes: account.rateLimitResetTimes ?? {},
+			quotaExhaustedUntil: account.quotaExhaustedUntil,
 		};
 		try {
 			const { accessToken } = await usageMod.ensureCodexUsageAccessToken({ storage, account });
@@ -624,6 +749,14 @@ export async function runLimitsCommand(parsed, options = {}) {
 			}
 			entry.planType = usage.planType;
 			entry.credits = usage.credits;
+			// Raw counts stay in `resetCredits` and the rendered line lives in
+			// its own field: embedding the English summary inside the counts
+			// object would make `--json` consumers parse presentation text to
+			// reach a number that is already beside it.
+			entry.resetCredits = usage.resetCredits;
+			entry.resetCreditsSummary = usage.resetCredits
+				? usageMod.formatResetCredits(usage.resetCredits)
+				: null;
 			entry.limits = usage.limits;
 		} catch (error) {
 			// `ensureCodexUsageAccessToken` can surface a raw OAuth refresh
@@ -675,6 +808,9 @@ function printLimitsResult(payload, json) {
 		}
 		if (account.planType) console.log(`  Plan: ${account.planType}`);
 		if (account.credits) console.log(`  Credits: ${account.credits}`);
+		if (account.resetCredits && account.resetCredits.available > 0) {
+			console.log(`  Resets: ${account.resetCreditsSummary}`);
+		}
 	}
 	if (payload.nextAction) console.log(`Next: ${payload.nextAction}`);
 }
@@ -697,7 +833,68 @@ export async function runStandaloneCommand(command, argv = [], options = {}) {
 	}
 	const { env = process.env } = options;
 	const storagePath = getStandaloneStoragePath(parsed, env);
-	const { storage, error } = await readStandaloneStorage(storagePath);
+	const repairRequested = command === "doctor" && parsed.fix;
+	let storage = null;
+	let error = null;
+	if (parsed.configPath || !repairRequested) {
+		({ storage, error } = await readStandaloneStorage(storagePath));
+	}
+	const appliedFixes = [];
+	const fixErrors = [];
+	if (repairRequested && !error) {
+		const previousKeychain = process.env.CODEX_KEYCHAIN;
+		try {
+			const loadDoctorRuntime = options.loadDoctorRuntime ?? (() => loadDistModules(
+				["storage.js", "tools/doctor-repair.js", "shutdown.js"], "doctor",
+			));
+			const [storageMod, repairMod, shutdownMod] = await loadDoctorRuntime();
+			// A CLI file selection must not read or replace the global keychain pool.
+			if (parsed.configPath) process.env.CODEX_KEYCHAIN = "0";
+			storageMod.setStoragePathDirect(storagePath);
+			shutdownMod.setShutdownOwnsProcess(true);
+			try {
+				storage = await storageMod.loadAccounts();
+			} catch (loadError) {
+				// Typed storage errors (UNSUPPORTED_SCHEMA_VERSION, unknown V2)
+				// carry exact in-tree copy plus an upgrade/recovery hint, and the
+				// load never got far enough to attempt a repair. Surface them on
+				// the error channel (exit 1) instead of the generic catch below,
+				// which is reserved for unknown throws so upstream failure text
+				// never reaches output unredacted.
+				if (loadError && typeof loadError.code === "string") {
+					const hint = typeof loadError.hint === "string" ? ` ${loadError.hint}` : "";
+					error = `${formatErrorForLog(loadError)}${hint}`;
+				} else {
+					throw loadError;
+				}
+			}
+			if (!storage && !error) {
+				// `loadAccounts` swallows JSON parse/IO errors and returns null. In
+				// default-path mode the pre-read above was skipped (keychain routing
+				// may own the pool), so probe the JSON file here: a corrupt file must
+				// surface as a parse error (exit 1) instead of "No accounts
+				// configured" (exit 0). ENOENT stays silent - a missing file with an
+				// empty keychain legitimately means no accounts yet. Skipped when a
+				// typed load error already set `error`; the probe would only
+				// overwrite the precise schema message with its own paraphrase.
+				const probe = await readStandaloneStorage(storagePath);
+				if (probe.error) error = probe.error;
+			}
+			if (!error) {
+				const repair = await repairMod.repairDoctorAccounts(storage?.accounts ?? []);
+				appliedFixes.push(...repair.appliedFixes);
+				fixErrors.push(...repair.fixErrors);
+				storage = (await storageMod.loadAccounts()) ?? storage;
+			}
+		} catch {
+			fixErrors.push("Doctor repair could not complete. Check the selected storage file and installed runtime.");
+		} finally {
+			if (parsed.configPath) {
+				if (previousKeychain === undefined) delete process.env.CODEX_KEYCHAIN;
+				else process.env.CODEX_KEYCHAIN = previousKeychain;
+			}
+		}
+	}
 	const accounts = summarizeStandaloneAccounts(storage, parsed.includeSensitive, parsed.tag);
 	const totalAccounts = Array.isArray(storage?.accounts) ? storage.accounts.length : 0;
 	const payload = {
@@ -716,7 +913,11 @@ export async function runStandaloneCommand(command, argv = [], options = {}) {
 	} else if (command === "doctor") {
 		payload.message = error ? "Storage could not be parsed." : totalAccounts > 0 ? "Local diagnostics completed." : "No accounts configured.";
 		payload.deep = parsed.deep;
-		payload.fixApplied = parsed.fix ? false : undefined;
+		payload.fixApplied = parsed.fix ? appliedFixes.length > 0 : undefined;
+		if (parsed.fix) {
+			payload.appliedFixes = appliedFixes;
+			payload.fixErrors = fixErrors;
+		}
 		payload.nextAction = totalAccounts > 0 ? "Run oc-codex-multi-auth health --json for scriptable checks." : "Run opencode auth login.";
 	} else if (command === "health") {
 		payload.healthyCount = accounts.filter((account) => account.enabled && account.hasRefreshToken).length;
@@ -725,7 +926,7 @@ export async function runStandaloneCommand(command, argv = [], options = {}) {
 		payload.message = totalAccounts > 0 ? "Account storage loaded." : "No accounts configured.";
 	}
 	printStandaloneResult(command, payload, parsed.json);
-	return { exitCode: error ? 1 : 0, action: command, storagePath };
+	return { exitCode: error || fixErrors.length > 0 ? 1 : 0, action: command, storagePath };
 }
 
 // Top-level keys inside `provider.openai` that the installer owns absolutely.