oc-codex-multi-auth 6.19.0 → 6.21.0

package/scripts/install-oc-codex-multi-auth-core.js

@@ -257,8 +257,28 @@ async function readStandaloneStorage(path) {
 	try {
 		const raw = await readFile(path, "utf-8");
 		const parsed = JSON.parse(raw);
+		// Shape validation, not just parse validation: a JSON array, scalar, or
+		// object without an `accounts` array is unreadable by the plugin runtime
+		// too (normalizeAccountStorage rejects it), so reporting it as a healthy
+		// empty pool (exit 0, "No accounts configured") hides the corruption
+		// from scripted callers that key on exit codes.
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+			return { storage: null, error: "Storage file must be a JSON object with an accounts array." };
+		}
+		// Forward-compat mirror of the runtime guard: a newer schema version
+		// must not be shown as readable accounts by this build.
+		const version = parsed.version;
+		if (typeof version === "number" && Number.isFinite(version) && version > 3) {
+			return {
+				storage: null,
+				error: `Unsupported account storage schema version ${version}; this build supports up to version 3.`,
+			};
+		}
+		if (!Array.isArray(parsed.accounts)) {
+			return { storage: null, error: "Storage file must be a JSON object with an accounts array." };
+		}
 		return {
-			storage: parsed && typeof parsed === "object" ? normalizeStandaloneStorage(parsed) : null,
+			storage: normalizeStandaloneStorage(parsed),
 			error: null,
 		};
 	} catch (error) {
@@ -417,6 +437,7 @@ function summarizeStandaloneAccounts(storage, includeSensitive, tag) {
 				tags: Array.isArray(account?.accountTags) ? account.accountTags : [],
 				note: account?.accountNote,
 				rateLimitResetTimes: account?.rateLimitResetTimes ?? {},
+				quotaExhaustedUntil: account?.quotaExhaustedUntil,
 			};
 		});
 }
@@ -440,6 +461,8 @@ function printStandaloneResult(command, payload, json) {
 		}
 	}
 	if (payload.error) console.log(`Error: ${payload.error}`);
+	for (const fix of payload.appliedFixes ?? []) console.log(`Fixed: ${fix}`);
+	for (const error of payload.fixErrors ?? []) console.log(`Repair failed: ${error}`);
 	if (payload.nextAction) console.log(`Next: ${payload.nextAction}`);
 }
 
@@ -462,13 +485,14 @@ async function loadDistModules(relativePaths, label) {
 }
 
 async function loadWarmRuntime(env) {
-	const [storageMod, usageMod, warmReqMod, warmMod, shutdownMod] = await loadDistModules(
+	const [storageMod, usageMod, warmReqMod, warmMod, shutdownMod, recoveryMod] = await loadDistModules(
 		[
 			"storage.js",
 			"codex-usage.js",
 			"accounts/warm-request.js",
 			"accounts/warm.js",
 			"shutdown.js",
+			"accounts/warm-recovery.js",
 		],
 		"warm",
 	);
@@ -477,7 +501,7 @@ async function loadWarmRuntime(env) {
 	// Refreshing a token here persists credentials, which registers the
 	// shutdown handler via the storage lock.
 	shutdownMod.setShutdownOwnsProcess(true);
-	return { storageMod, usageMod, warmReqMod, warmMod, shutdownMod };
+	return { storageMod, usageMod, warmReqMod, warmMod, shutdownMod, recoveryMod };
 }
 
 async function loadLimitsRuntime(env) {
@@ -497,26 +521,47 @@ export async function runWarmCommand(parsed, options = {}) {
 
 	let runtime;
 	try {
-		runtime = await loadWarmRuntime(env);
+		runtime = await (options.loadWarmRuntime ?? loadWarmRuntime)(env);
 	} catch (error) {
 		const payload = { command: "warm", storagePath, error: formatErrorForLog(error) };
 		printWarmResult(payload, parsed.json);
 		return { exitCode: 1, action: "warm", storagePath };
 	}
 
-	const { storageMod, usageMod, warmReqMod, warmMod } = runtime;
+	const { storageMod, usageMod, warmReqMod, warmMod, recoveryMod } = runtime;
 	// Point dist storage at the resolved accounts file so a refreshed token is
 	// persisted to the SAME file the rest of the toolchain reads.
 	storageMod.setStoragePathDirect(storagePath);
 
-	const storage = await storageMod.loadAccounts();
+	let storage = null;
+	try {
+		storage = await storageMod.loadAccounts();
+	} catch (error) {
+		// Typed storage errors (e.g. UNSUPPORTED_SCHEMA_VERSION) carry the
+		// upgrade hint; surface them rather than crashing the CLI.
+		const hint = error && typeof error.hint === "string" ? ` ${error.hint}` : "";
+		const payload = { command: "warm", storagePath, error: `${formatErrorForLog(error)}${hint}` };
+		printWarmResult(payload, parsed.json);
+		return { exitCode: 1, action: "warm", storagePath };
+	}
 	const accounts = Array.isArray(storage?.accounts) ? storage.accounts : [];
 	if (accounts.length === 0) {
+		// `loadAccounts` swallows parse/IO errors and returns null. Probe the
+		// file so a corrupt storage fails like `status`/`doctor` do (exit 1)
+		// instead of reporting a healthy empty pool. ENOENT stays a silent
+		// empty pool: a missing file legitimately means no accounts yet.
+		const probe = await readStandaloneStorage(storagePath);
+		if (probe.error) {
+			const payload = { command: "warm", storagePath, error: probe.error };
+			printWarmResult(payload, parsed.json);
+			return { exitCode: 1, action: "warm", storagePath };
+		}
 		const payload = {
 			command: "warm",
 			storagePath,
 			totalAccounts: 0,
 			warmed: 0,
+			blocksCleared: 0,
 			failed: 0,
 			skipped: 0,
 			results: [],
@@ -530,7 +575,9 @@ export async function runWarmCommand(parsed, options = {}) {
 	// Same adapter as lib/tools/codex-warm.ts createWarmOne: refresh → resolve
 	// account id → open the usage window; map an exhausted (quota-429) account
 	// to a failure so it is not reported as warmed.
+	const succeeded = [];
 	const warmOne = async (account) => {
+		const snapshot = { ...account, rateLimitResetTimes: { ...account.rateLimitResetTimes } };
 		const { accessToken } = await usageMod.ensureCodexUsageAccessToken({ storage, account });
 		const accountId = usageMod.resolveCodexUsageAccountId({ account, accessToken });
 		if (!accountId) {
@@ -544,12 +591,29 @@ export async function runWarmCommand(parsed, options = {}) {
 		if (result.status === "exhausted") {
 			return { status: "failed", detail: result.detail ?? "quota/usage limit reached" };
 		}
+		if (!result.rateLimited && result.model) succeeded.push({
+			account: { ...snapshot, refreshToken: account.refreshToken }, model: result.model, accessToken,
+		});
 		return { status: "warmed" };
 	};
 
 	const summary = await warmMod.warmAccounts(accounts, warmOne);
+	let blocksCleared = 0;
+	let blockClearError;
+	for (const observation of succeeded) {
+		let changed = false;
+		try {
+			const completed = await recoveryMod.recoverWarmedAccount(observation, () => { changed = true; });
+			changed = completed || changed;
+		} catch {
+			blockClearError = "Failed to clear local blocks; warm results are unchanged.";
+		}
+		if (changed) blocksCleared++;
+	}
 	const payload = {
 		command: "warm",
+		blocksCleared,
+		blockClearError,
 		storagePath,
 		totalAccounts: summary.total,
 		warmed: summary.warmedCount,
@@ -585,6 +649,8 @@ function printWarmResult(payload, json) {
 		console.log(`- ${label}: ${r.status}${detail}`);
 	}
 	console.log(`Summary: ${payload.warmed} warmed, ${payload.failed} failed, ${payload.skipped} skipped`);
+	console.log(`Blocks cleared: ${payload.blocksCleared ?? 0}`);
+	if (payload.blockClearError) console.log(payload.blockClearError);
 	if (payload.nextAction) console.log(`Next: ${payload.nextAction}`);
 }
 
@@ -603,7 +669,7 @@ export async function runLimitsCommand(parsed, options = {}) {
 
 	let runtime;
 	try {
-		runtime = await loadLimitsRuntime(env);
+		runtime = await (options.loadLimitsRuntime ?? loadLimitsRuntime)(env);
 	} catch (error) {
 		const payload = { command: "limits", storagePath, error: formatErrorForLog(error) };
 		printLimitsResult(payload, parsed.json);
@@ -615,9 +681,27 @@ export async function runLimitsCommand(parsed, options = {}) {
 	// persisted to the SAME file the rest of the toolchain reads.
 	storageMod.setStoragePathDirect(storagePath);
 
-	const storage = await storageMod.loadAccounts();
+	let storage = null;
+	try {
+		storage = await storageMod.loadAccounts();
+	} catch (error) {
+		// Typed storage errors (e.g. UNSUPPORTED_SCHEMA_VERSION) carry the
+		// upgrade hint; surface them rather than crashing the CLI.
+		const hint = error && typeof error.hint === "string" ? ` ${error.hint}` : "";
+		const payload = { command: "limits", storagePath, error: `${formatErrorForLog(error)}${hint}` };
+		printLimitsResult(payload, parsed.json);
+		return { exitCode: 1, action: "limits", storagePath };
+	}
 	const accounts = Array.isArray(storage?.accounts) ? storage.accounts : [];
 	if (accounts.length === 0) {
+		// Same probe contract as `warm`: a corrupt file exits 1 like
+		// `status`/`doctor`; a missing file stays a silent empty pool.
+		const probe = await readStandaloneStorage(storagePath);
+		if (probe.error) {
+			const payload = { command: "limits", storagePath, error: probe.error };
+			printLimitsResult(payload, parsed.json);
+			return { exitCode: 1, action: "limits", storagePath };
+		}
 		const payload = {
 			command: "limits",
 			storagePath,
@@ -658,6 +742,7 @@ export async function runLimitsCommand(parsed, options = {}) {
 			label: account.accountLabel ?? `Account ${index + 1}`,
 			email: maskValue(account.email, parsed.includeSensitive),
 			rateLimitResetTimes: account.rateLimitResetTimes ?? {},
+			quotaExhaustedUntil: account.quotaExhaustedUntil,
 		};
 		try {
 			const { accessToken } = await usageMod.ensureCodexUsageAccessToken({ storage, account });
@@ -685,6 +770,13 @@ export async function runLimitsCommand(parsed, options = {}) {
 					);
 				}
 			}
+			if (usageMod.isUsageQuotaRecovered([usage.primary, usage.secondary])) {
+				try {
+					await usageMod.persistUsageQuotaRecovery(account);
+				} catch {
+					loggerMod.logWarn("Failed to persist recovered usage quota");
+				}
+			}
 			entry.planType = usage.planType;
 			entry.credits = usage.credits;
 			// Raw counts stay in `resetCredits` and the rendered line lives in
@@ -771,7 +863,68 @@ export async function runStandaloneCommand(command, argv = [], options = {}) {
 	}
 	const { env = process.env } = options;
 	const storagePath = getStandaloneStoragePath(parsed, env);
-	const { storage, error } = await readStandaloneStorage(storagePath);
+	const repairRequested = command === "doctor" && parsed.fix;
+	let storage = null;
+	let error = null;
+	if (parsed.configPath || !repairRequested) {
+		({ storage, error } = await readStandaloneStorage(storagePath));
+	}
+	const appliedFixes = [];
+	const fixErrors = [];
+	if (repairRequested && !error) {
+		const previousKeychain = process.env.CODEX_KEYCHAIN;
+		try {
+			const loadDoctorRuntime = options.loadDoctorRuntime ?? (() => loadDistModules(
+				["storage.js", "tools/doctor-repair.js", "shutdown.js"], "doctor",
+			));
+			const [storageMod, repairMod, shutdownMod] = await loadDoctorRuntime();
+			// A CLI file selection must not read or replace the global keychain pool.
+			if (parsed.configPath) process.env.CODEX_KEYCHAIN = "0";
+			storageMod.setStoragePathDirect(storagePath);
+			shutdownMod.setShutdownOwnsProcess(true);
+			try {
+				storage = await storageMod.loadAccounts();
+			} catch (loadError) {
+				// Typed storage errors (UNSUPPORTED_SCHEMA_VERSION, unknown V2)
+				// carry exact in-tree copy plus an upgrade/recovery hint, and the
+				// load never got far enough to attempt a repair. Surface them on
+				// the error channel (exit 1) instead of the generic catch below,
+				// which is reserved for unknown throws so upstream failure text
+				// never reaches output unredacted.
+				if (loadError && typeof loadError.code === "string") {
+					const hint = typeof loadError.hint === "string" ? ` ${loadError.hint}` : "";
+					error = `${formatErrorForLog(loadError)}${hint}`;
+				} else {
+					throw loadError;
+				}
+			}
+			if (!storage && !error) {
+				// `loadAccounts` swallows JSON parse/IO errors and returns null. In
+				// default-path mode the pre-read above was skipped (keychain routing
+				// may own the pool), so probe the JSON file here: a corrupt file must
+				// surface as a parse error (exit 1) instead of "No accounts
+				// configured" (exit 0). ENOENT stays silent - a missing file with an
+				// empty keychain legitimately means no accounts yet. Skipped when a
+				// typed load error already set `error`; the probe would only
+				// overwrite the precise schema message with its own paraphrase.
+				const probe = await readStandaloneStorage(storagePath);
+				if (probe.error) error = probe.error;
+			}
+			if (!error) {
+				const repair = await repairMod.repairDoctorAccounts(storage?.accounts ?? []);
+				appliedFixes.push(...repair.appliedFixes);
+				fixErrors.push(...repair.fixErrors);
+				storage = (await storageMod.loadAccounts()) ?? storage;
+			}
+		} catch {
+			fixErrors.push("Doctor repair could not complete. Check the selected storage file and installed runtime.");
+		} finally {
+			if (parsed.configPath) {
+				if (previousKeychain === undefined) delete process.env.CODEX_KEYCHAIN;
+				else process.env.CODEX_KEYCHAIN = previousKeychain;
+			}
+		}
+	}
 	const accounts = summarizeStandaloneAccounts(storage, parsed.includeSensitive, parsed.tag);
 	const totalAccounts = Array.isArray(storage?.accounts) ? storage.accounts.length : 0;
 	const payload = {
@@ -790,7 +943,11 @@ export async function runStandaloneCommand(command, argv = [], options = {}) {
 	} else if (command === "doctor") {
 		payload.message = error ? "Storage could not be parsed." : totalAccounts > 0 ? "Local diagnostics completed." : "No accounts configured.";
 		payload.deep = parsed.deep;
-		payload.fixApplied = parsed.fix ? false : undefined;
+		payload.fixApplied = parsed.fix ? appliedFixes.length > 0 : undefined;
+		if (parsed.fix) {
+			payload.appliedFixes = appliedFixes;
+			payload.fixErrors = fixErrors;
+		}
 		payload.nextAction = totalAccounts > 0 ? "Run oc-codex-multi-auth health --json for scriptable checks." : "Run opencode auth login.";
 	} else if (command === "health") {
 		payload.healthyCount = accounts.filter((account) => account.enabled && account.hasRefreshToken).length;
@@ -799,7 +956,7 @@ export async function runStandaloneCommand(command, argv = [], options = {}) {
 		payload.message = totalAccounts > 0 ? "Account storage loaded." : "No accounts configured.";
 	}
 	printStandaloneResult(command, payload, parsed.json);
-	return { exitCode: error ? 1 : 0, action: command, storagePath };
+	return { exitCode: error || fixErrors.length > 0 ? 1 : 0, action: command, storagePath };
 }
 
 // Top-level keys inside `provider.openai` that the installer owns absolutely.