oh-my-codex-pennix 0.18.13

package/dist/auth/__tests__/storage.test.js

@@ -0,0 +1,108 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { atomicWriteFile, addSlotFromAuthFile, listSlots, readAuthMetadata, useSlot } from "../storage.js";
+import { resolveLiveAuthPath, resolveOmxAuthDir, resolveSlotPath, validateSlotName } from "../paths.js";
+async function tempHome() {
+    return await mkdtemp(join(tmpdir(), "omx-auth-storage-"));
+}
+describe("auth slot storage", () => {
+    it("adds, lists, and uses auth slots without exposing blob contents", async () => {
+        const home = await tempHome();
+        try {
+            const live = join(home, ".codex", "auth.json");
+            await mkdir(join(home, ".codex"), { recursive: true });
+            await writeFile(live, '{"access_token":"sentinel-secret"}\n');
+            await addSlotFromAuthFile("work", live, home, new Date("2026-05-24T00:00:00.000Z"));
+            const slots = await listSlots(home);
+            assert.deepEqual(slots.map((slot) => slot.slot), ["work"]);
+            assert.equal(await readFile(resolveSlotPath("work", home), "utf-8"), '{"access_token":"sentinel-secret"}\n');
+            await writeFile(live, '{"access_token":"other"}\n');
+            await useSlot("work", live, home, new Date("2026-05-24T01:00:00.000Z"));
+            assert.equal(await readFile(live, "utf-8"), '{"access_token":"sentinel-secret"}\n');
+            const metadata = await readAuthMetadata(home);
+            assert.equal(metadata.currentSlot, "work");
+            assert.equal(metadata.slots[0]?.lastUsedAt, "2026-05-24T01:00:00.000Z");
+        }
+        finally {
+            await rm(home, { recursive: true, force: true });
+        }
+    });
+    it("uses owner-only modes for auth directory and files", async () => {
+        if (process.platform === "win32")
+            return;
+        const home = await tempHome();
+        try {
+            const live = join(home, ".codex", "auth.json");
+            await mkdir(join(home, ".codex"), { recursive: true });
+            await writeFile(live, "{}\n");
+            await addSlotFromAuthFile("personal", live, home);
+            const dirMode = (await stat(resolveOmxAuthDir(home))).mode & 0o777;
+            const slotMode = (await stat(resolveSlotPath("personal", home))).mode & 0o777;
+            assert.equal(dirMode, 0o700);
+            assert.equal(slotMode, 0o600);
+        }
+        finally {
+            await rm(home, { recursive: true, force: true });
+        }
+    });
+    it("rejects unsafe slot names", () => {
+        assert.throws(() => validateSlotName("../bad"), /invalid auth slot name/);
+        assert.throws(() => validateSlotName("bad/name"), /invalid auth slot name/);
+    });
+    it("rejects a symlinked auth directory", async () => {
+        if (process.platform === "win32")
+            return;
+        const home = await tempHome();
+        const outside = await tempHome();
+        try {
+            await mkdir(join(home, ".omx"), { recursive: true });
+            await symlink(outside, join(home, ".omx", "auth"));
+            const live = join(home, ".codex", "auth.json");
+            await mkdir(join(home, ".codex"), { recursive: true });
+            await writeFile(live, "{}\n");
+            await assert.rejects(addSlotFromAuthFile("work", live, home), /auth directory must not be a symlink/);
+        }
+        finally {
+            await rm(home, { recursive: true, force: true });
+            await rm(outside, { recursive: true, force: true });
+        }
+    });
+    it("keeps the original file when atomic write fails before rename", async () => {
+        const home = await tempHome();
+        try {
+            const target = join(home, ".codex", "auth.json");
+            await mkdir(join(home, ".codex"), { recursive: true });
+            await writeFile(target, "original\n");
+            await assert.rejects(atomicWriteFile(target, "partial\n", {
+                beforeRename: () => {
+                    throw new Error("simulated interrupt");
+                },
+            }), /simulated interrupt/);
+            assert.equal(await readFile(target, "utf-8"), "original\n");
+            assert.equal(existsSync(`${target}.tmp`), false);
+        }
+        finally {
+            await rm(home, { recursive: true, force: true });
+        }
+    });
+    it("resolves CODEX_HOME, project-scope, and default auth paths", async () => {
+        const home = await tempHome();
+        const wd = await mkdtemp(join(tmpdir(), "omx-auth-project-"));
+        try {
+            assert.equal(resolveLiveAuthPath(wd, { CODEX_HOME: join(home, "custom") }, home), join(home, "custom", "auth.json"));
+            await mkdir(join(wd, ".omx"), { recursive: true });
+            await writeFile(join(wd, ".omx", "setup-scope.json"), '{"scope":"project"}\n');
+            assert.equal(resolveLiveAuthPath(wd, {}, home), join(wd, ".codex", "auth.json"));
+            assert.equal(resolveLiveAuthPath(wd, { CODEX_HOME: "" }, home), join(wd, ".codex", "auth.json"));
+        }
+        finally {
+            await rm(home, { recursive: true, force: true });
+            await rm(wd, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=storage.test.js.map

package/dist/auth/__tests__/storage.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/storage.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAExG,KAAK,UAAU,QAAQ;IACrB,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;YAE9D,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,sCAAsC,CAAC,CAAC;YAE7G,MAAM,SAAS,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,sCAAsC,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;YACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;YAC9E,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,sCAAsC,CAAC,CAAC;QACxG,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtC,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE;gBACnC,YAAY,EAAE,GAAG,EAAE;oBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACzC,CAAC;aACF,CAAC,EACF,qBAAqB,CACtB,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YACrH,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC/E,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACnG,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/config.d.ts

@@ -0,0 +1,9 @@
+export type AuthRotationMode = "round-robin" | "priority" | "manual";
+export interface AuthConfig {
+    rotation: AuthRotationMode;
+    priority: string[];
+    quotaPatterns: string[];
+    sources: string[];
+}
+export declare function readAuthConfig(cwd?: string, home?: string): Promise<AuthConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+BD,wBAAsB,cAAc,CAClC,GAAG,SAAgB,EACnB,IAAI,SAAY,GACf,OAAO,CAAC,UAAU,CAAC,CA2CrB"}

package/dist/auth/config.js

@@ -0,0 +1,77 @@
+import { existsSync } from "fs";
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+import { parse as parseToml } from "@iarna/toml";
+const DEFAULT_AUTH_CONFIG = {
+    rotation: "round-robin",
+    priority: [],
+    quotaPatterns: [],
+    sources: [],
+};
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function extractAuthTable(parsed) {
+    const root = asRecord(parsed);
+    const omx = asRecord(root?.omx);
+    return asRecord(omx?.auth);
+}
+function parseRotation(value) {
+    if (value === "round-robin" || value === "priority" || value === "manual")
+        return value;
+    return undefined;
+}
+function parseStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
+}
+export async function readAuthConfig(cwd = process.cwd(), home = homedir()) {
+    const candidates = [
+        join(cwd, ".omx", "config.toml"),
+        join(cwd, "omx.toml"),
+        join(home, ".omx", "config.toml"),
+    ];
+    const merged = { ...DEFAULT_AUTH_CONFIG, sources: [] };
+    const seen = { rotation: false, priority: false, quotaPatterns: false };
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        let table;
+        try {
+            table = extractAuthTable(parseToml(await readFile(path, "utf-8")));
+        }
+        catch {
+            continue;
+        }
+        if (!table)
+            continue;
+        merged.sources.push(path);
+        if (!seen.rotation) {
+            const rotation = parseRotation(table.rotation);
+            if (rotation) {
+                merged.rotation = rotation;
+                seen.rotation = true;
+            }
+        }
+        if (!seen.priority) {
+            const priority = parseStringArray(table.priority);
+            if (priority) {
+                merged.priority = priority;
+                seen.priority = true;
+            }
+        }
+        if (!seen.quotaPatterns) {
+            const patterns = parseStringArray(table.quota_patterns ?? table.quotaPatterns);
+            if (patterns) {
+                merged.quotaPatterns = patterns;
+                seen.quotaPatterns = true;
+            }
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AAWjD,MAAM,mBAAmB,GAAe;IACtC,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,IAAI,GAAG,OAAO,EAAE;IAEhB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QACrB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC;KAClC,CAAC;IACF,MAAM,MAAM,GAAe,EAAE,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAExE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YAC/E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC;gBAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/hotswap.d.ts

@@ -0,0 +1,36 @@
+export interface PreparedHotswapCodexHome {
+    codexHomeOverride?: string;
+    sqliteHomeOverride?: string;
+    projectLocalCodexHomeForCleanup?: string;
+    runtimeCodexHomeForCleanup?: string;
+}
+export interface HotswapLifecycle {
+    prepareCodexHomeForLaunch: (cwd: string, sessionId: string, env: NodeJS.ProcessEnv) => Promise<PreparedHotswapCodexHome>;
+    preLaunch: (cwd: string, sessionId: string, notifyTempContract: unknown, codexHomeOverride: string | undefined, enableNotifyFallbackAuthority: boolean, worktreeDirty: boolean) => Promise<void>;
+    postLaunch: (cwd: string, sessionId: string, codexHomeOverride: string | undefined, enableNotifyFallbackAuthority: boolean, projectLocalCodexHomeForCleanup?: string) => Promise<void>;
+    cleanupRuntimeCodexHome: (runtimeCodexHome?: string, projectCodexHome?: string) => Promise<void>;
+    normalizeCodexLaunchArgs: (args: string[]) => string[];
+    injectModelInstructionsBypassArgs: (cwd: string, args: string[], env: NodeJS.ProcessEnv, defaultFilePath?: string) => string[];
+    sessionModelInstructionsPath: (cwd: string, sessionId: string) => string;
+    resolveOmxRootForLaunch: (cwd: string, env: NodeJS.ProcessEnv) => string | undefined;
+    resolveNotifyTempContract: (args: string[], env: NodeJS.ProcessEnv) => {
+        contract: unknown;
+        passthroughArgs: string[];
+    };
+}
+export interface HotswapOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    argv: string[];
+    lifecycle: HotswapLifecycle;
+}
+export interface CodexRunResult {
+    status: number;
+    signal: NodeJS.Signals | null;
+    stderr: string;
+}
+export declare function stripHotswapArg(args: string[]): string[];
+export declare function buildResumeArgsWithPreservedFlags(originalArgs: string[], sessionId: string): string[];
+export declare function runAuthHotswap(options: HotswapOptions): Promise<number>;
+//# sourceMappingURL=hotswap.d.ts.map

package/dist/auth/hotswap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hotswap.d.ts","sourceRoot":"","sources":["../../src/auth/hotswap.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzH,SAAS,EAAE,CACT,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,OAAO,EAC3B,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,6BAA6B,EAAE,OAAO,EACtC,aAAa,EAAE,OAAO,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,UAAU,EAAE,CACV,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,6BAA6B,EAAE,OAAO,EACtC,+BAA+B,CAAC,EAAE,MAAM,KACrC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,uBAAuB,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,wBAAwB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACvD,iCAAiC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC/H,4BAA4B,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,CAAC;IACrF,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK;QACrE,QAAQ,EAAE,OAAO,CAAC;QAClB,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAExD;AAqCD,wBAAgB,iCAAiC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBrG;AAUD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4F7E"}

package/dist/auth/hotswap.js

@@ -0,0 +1,159 @@
+import { spawn } from "child_process";
+import { dirname } from "path";
+import { homedir } from "os";
+import { buildPlatformCommandSpec, classifySpawnError } from "../utils/platform-command.js";
+import { readAuthConfig } from "./config.js";
+import { isQuotaError } from "./quota-detector.js";
+import { redactAuthSecrets } from "./redact.js";
+import { buildRotationPlan, nextSlotAfter } from "./rotation.js";
+import { findLatestRolloutSession } from "./sessions.js";
+import { listSlots, markSlotQuota, readAuthMetadata, useSlot } from "./storage.js";
+export function stripHotswapArg(args) {
+    return args.filter((arg) => arg !== "--hotswap");
+}
+async function runCodexDirect(cwd, args, env) {
+    const spec = buildPlatformCommandSpec("codex", args, process.platform, env);
+    return await new Promise((resolve, reject) => {
+        const child = spawn(spec.command, spec.args, {
+            cwd,
+            env,
+            stdio: ["inherit", "inherit", "pipe"],
+            ...(process.platform === "win32" ? { windowsHide: true } : {}),
+        });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+            const text = redactAuthSecrets(chunk.toString("utf-8"));
+            stderr += text;
+            process.stderr.write(text);
+        });
+        child.on("error", (error) => {
+            const kind = classifySpawnError(error);
+            if (kind === "missing") {
+                reject(new Error("failed to launch codex: executable not found in PATH"));
+            }
+            else if (kind === "blocked") {
+                reject(new Error(`failed to launch codex: executable is blocked (${error.code || "blocked"})`));
+            }
+            else {
+                reject(error);
+            }
+        });
+        child.on("close", (status, signal) => {
+            resolve({ status: typeof status === "number" ? status : 1, signal, stderr });
+        });
+    });
+}
+export function buildResumeArgsWithPreservedFlags(originalArgs, sessionId) {
+    const preserved = [];
+    for (let index = 0; index < originalArgs.length; index++) {
+        const arg = originalArgs[index];
+        if (arg === "--")
+            break;
+        if (arg === "-c" || arg === "--config" || arg === "--model" || arg === "-m") {
+            preserved.push(arg);
+            const value = originalArgs[index + 1];
+            if (value && !value.startsWith("-")) {
+                preserved.push(value);
+                index += 1;
+            }
+            continue;
+        }
+        if (arg.startsWith("--config=") ||
+            arg.startsWith("--model=") ||
+            arg === "--dangerously-bypass-approvals-and-sandbox") {
+            preserved.push(arg);
+        }
+    }
+    return ["resume", sessionId, ...preserved];
+}
+function codexHomeFromAuthPath(authPath) {
+    return dirname(authPath);
+}
+function hotswapSessionId() {
+    return `omx-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+export async function runAuthHotswap(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const env = options.env ?? process.env;
+    const home = options.home ?? homedir();
+    const lifecycle = options.lifecycle;
+    const rawArgs = stripHotswapArg(options.argv);
+    const notifyTempResult = lifecycle.resolveNotifyTempContract(rawArgs, env);
+    const normalizedArgs = lifecycle.normalizeCodexLaunchArgs(notifyTempResult.passthroughArgs.filter((arg) => arg !== "--direct" && arg !== "--tmux"));
+    const config = await readAuthConfig(cwd, home);
+    const slots = await listSlots(home);
+    if (slots.length === 0) {
+        process.stderr.write("[omx auth] no slots configured; run `omx auth add <slot>` first.\n");
+        return 1;
+    }
+    const sessionId = hotswapSessionId();
+    const prepared = await lifecycle.prepareCodexHomeForLaunch(cwd, sessionId, env);
+    const childCodexHome = prepared.codexHomeOverride || (env.CODEX_HOME && env.CODEX_HOME.trim()) || `${home}/.codex`;
+    const liveAuthPath = `${childCodexHome}/auth.json`;
+    const metadata = await readAuthMetadata(home);
+    const plan = buildRotationPlan(slots, config, metadata.currentSlot);
+    let currentSlot = plan.order[0];
+    if (!currentSlot) {
+        process.stderr.write("[omx auth] no slots configured; run `omx auth add <slot>` first.\n");
+        return 1;
+    }
+    const exhausted = new Set();
+    let resumeArgs = null;
+    try {
+        await useSlot(currentSlot, liveAuthPath, home);
+        await lifecycle.preLaunch(cwd, sessionId, notifyTempResult.contract, prepared.codexHomeOverride, true, false);
+        const baseEnv = {
+            ...env,
+            ...(prepared.codexHomeOverride ? { CODEX_HOME: prepared.codexHomeOverride } : {}),
+            ...(prepared.sqliteHomeOverride ? { CODEX_SQLITE_HOME: prepared.sqliteHomeOverride } : {}),
+        };
+        const omxRoot = lifecycle.resolveOmxRootForLaunch(cwd, env);
+        if (omxRoot)
+            baseEnv.OMX_ROOT = omxRoot;
+        for (let attempt = 0; attempt < plan.order.length; attempt++) {
+            const attemptArgs = lifecycle.injectModelInstructionsBypassArgs(cwd, resumeArgs ?? normalizedArgs, baseEnv, lifecycle.sessionModelInstructionsPath(cwd, sessionId));
+            process.stderr.write(`[omx auth] using slot ${currentSlot}\n`);
+            const result = await runCodexDirect(cwd, attemptArgs, baseEnv);
+            if (result.status === 0)
+                return 0;
+            if (!isQuotaError({ status: result.status, signal: result.signal, stderr: result.stderr }, config)) {
+                return result.status || 1;
+            }
+            await markSlotQuota(currentSlot, home);
+            exhausted.add(currentSlot);
+            if (plan.mode === "manual") {
+                process.stderr.write(`[omx auth] quota detected for slot ${currentSlot}; rotation=manual, run \`omx auth use <slot>\` to switch accounts.\n`);
+                return 1;
+            }
+            const next = nextSlotAfter(plan.order, currentSlot, exhausted);
+            if (!next) {
+                process.stderr.write(`[omx auth] all slots exhausted: ${[...exhausted].join(", ")}\n`);
+                return 1;
+            }
+            const latest = await findLatestRolloutSession(codexHomeFromAuthPath(liveAuthPath), home);
+            if (!latest) {
+                process.stderr.write("[omx auth] quota detected but no Codex rollout session was found to resume.\n");
+                return 1;
+            }
+            currentSlot = next;
+            await useSlot(currentSlot, liveAuthPath, home);
+            resumeArgs = buildResumeArgsWithPreservedFlags(normalizedArgs, latest.id);
+            process.stderr.write(`[omx auth] quota detected; rotating to slot ${currentSlot} and resuming ${latest.id}\n`);
+        }
+        process.stderr.write(`[omx auth] all slots exhausted: ${plan.order.join(", ")}\n`);
+        return 1;
+    }
+    catch (err) {
+        process.stderr.write(`[omx auth] ${redactAuthSecrets(err)}\n`);
+        return 1;
+    }
+    finally {
+        await lifecycle.postLaunch(cwd, sessionId, prepared.codexHomeOverride, true, prepared.projectLocalCodexHomeForCleanup).catch((err) => {
+            process.stderr.write(`[omx auth] postLaunch warning: ${redactAuthSecrets(err)}\n`);
+        });
+        await lifecycle.cleanupRuntimeCodexHome(prepared.runtimeCodexHomeForCleanup, prepared.projectLocalCodexHomeForCleanup).catch((err) => {
+            process.stderr.write(`[omx auth] cleanup warning: ${redactAuthSecrets(err)}\n`);
+        });
+    }
+}
+//# sourceMappingURL=hotswap.js.map

package/dist/auth/hotswap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hotswap.js","sourceRoot":"","sources":["../../src/auth/hotswap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAmDnF,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,IAAc,EACd,GAAsB;IAEtB,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3C,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAC5E,CAAC;iBAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,KAAK,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACnC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,YAAsB,EAAE,SAAiB;IACzF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM;QACxB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5E,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1B,GAAG,KAAK,4CAA4C,EACpD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,SAAS,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,QAAQ,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC;IACnH,MAAM,YAAY,GAAG,GAAG,cAAc,YAAY,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,UAAU,GAAoB,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9G,MAAM,OAAO,GAAsB;YACjC,GAAG,GAAG;YACN,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,SAAS,CAAC,iCAAiC,CAC7D,GAAG,EACH,UAAU,IAAI,cAAc,EAC5B,OAAO,EACP,SAAS,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,CAAC,CACvD,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,WAAW,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnG,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACvC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,WAAW,sEAAsE,CACxH,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;gBACtG,OAAO,CAAC,CAAC;YACX,CAAC;YACD,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/C,UAAU,GAAG,iCAAiC,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,WAAW,iBAAiB,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACjH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,uBAAuB,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./config.js";
+export * from "./paths.js";
+export * from "./quota-detector.js";
+export * from "./redact.js";
+export * from "./rotation.js";
+export * from "./sessions.js";
+export * from "./storage.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,8 @@
+export * from "./config.js";
+export * from "./paths.js";
+export * from "./quota-detector.js";
+export * from "./redact.js";
+export * from "./rotation.js";
+export * from "./sessions.js";
+export * from "./storage.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/auth/paths.d.ts

@@ -0,0 +1,12 @@
+export declare const AUTH_DIR_MODE = 448;
+export declare const AUTH_FILE_MODE = 384;
+export declare function resolveOmxAuthDir(home?: string): string;
+export declare function resolveAuthMetadataPath(home?: string): string;
+export declare function validateSlotName(slot: string): string;
+export declare function resolveSlotPath(slot: string, home?: string): string;
+export declare function resolveDefaultCodexHome(home?: string): string;
+export declare function resolveLiveAuthPath(cwd?: string, env?: NodeJS.ProcessEnv, home?: string): string;
+export declare function ensurePrivateDir(dir: string): Promise<void>;
+export declare function assertReadableFile(path: string, label: string): Promise<void>;
+export declare function assertNoSymlink(path: string, label: string): Promise<void>;
+//# sourceMappingURL=paths.d.ts.map

package/dist/auth/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,aAAa,MAAQ,CAAC;AACnC,eAAO,MAAM,cAAc,MAAQ,CAAC;AAEpC,wBAAgB,iBAAiB,CAAC,IAAI,SAAY,GAAG,MAAM,CAE1D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,SAAY,GAAG,MAAM,CAEhE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWrD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,MAAM,CAStE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,SAAY,GAAG,MAAM,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,GAAG,SAAgB,EACnB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,SAAY,GACf,MAAM,CAGR;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASjE;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnF;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF"}

package/dist/auth/paths.js

@@ -0,0 +1,78 @@
+import { homedir } from "os";
+import { basename, join, resolve } from "path";
+import { lstat, mkdir, stat } from "fs/promises";
+import { resolveCodexHomeForLaunch } from "../cli/codex-home.js";
+export const AUTH_DIR_MODE = 0o700;
+export const AUTH_FILE_MODE = 0o600;
+export function resolveOmxAuthDir(home = homedir()) {
+    return join(home, ".omx", "auth");
+}
+export function resolveAuthMetadataPath(home = homedir()) {
+    return join(resolveOmxAuthDir(home), "slots.json");
+}
+export function validateSlotName(slot) {
+    const trimmed = slot.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) {
+        throw new Error("invalid auth slot name: use 1-64 letters, numbers, '.', '_' or '-' and start with a letter or number");
+    }
+    if (trimmed === "." || trimmed === ".." || basename(trimmed) !== trimmed) {
+        throw new Error("invalid auth slot name: path traversal is not allowed");
+    }
+    return trimmed;
+}
+export function resolveSlotPath(slot, home = homedir()) {
+    const safeSlot = validateSlotName(slot);
+    const authDir = resolveOmxAuthDir(home);
+    const candidate = resolve(authDir, `${safeSlot}.json`);
+    const expected = join(resolve(authDir), `${safeSlot}.json`);
+    if (candidate !== expected) {
+        throw new Error("invalid auth slot path");
+    }
+    return candidate;
+}
+export function resolveDefaultCodexHome(home = homedir()) {
+    return join(home, ".codex");
+}
+export function resolveLiveAuthPath(cwd = process.cwd(), env = process.env, home = homedir()) {
+    const codexHome = resolveCodexHomeForLaunch(cwd, env) || resolveDefaultCodexHome(home);
+    return join(codexHome, "auth.json");
+}
+export async function ensurePrivateDir(dir) {
+    await mkdir(dir, { recursive: true, mode: AUTH_DIR_MODE });
+    const info = await lstat(dir);
+    if (info.isSymbolicLink())
+        throw new Error(`auth directory must not be a symlink: ${dir}`);
+    if (!info.isDirectory())
+        throw new Error(`auth path is not a directory: ${dir}`);
+    if (process.platform !== "win32") {
+        const { chmod } = await import("fs/promises");
+        await chmod(dir, AUTH_DIR_MODE).catch(() => undefined);
+    }
+}
+export async function assertReadableFile(path, label) {
+    try {
+        const info = await stat(path);
+        if (!info.isFile())
+            throw new Error(`${label} is not a file: ${path}`);
+    }
+    catch (err) {
+        if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+            throw new Error(`${label} not found: ${path}`);
+        }
+        throw err;
+    }
+}
+export async function assertNoSymlink(path, label) {
+    try {
+        const { lstat } = await import("fs/promises");
+        const info = await lstat(path);
+        if (info.isSymbolicLink())
+            throw new Error(`${label} must not be a symlink: ${path}`);
+    }
+    catch (err) {
+        if (err && typeof err === "object" && "code" in err && err.code === "ENOENT")
+            return;
+        throw err;
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,EAAE;IACtD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAI,GAAG,OAAO,EAAE;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,EAAE;IACtD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,MAAyB,OAAO,CAAC,GAAG,EACpC,IAAI,GAAG,OAAO,EAAE;IAEhB,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QACrF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/auth/quota-detector.d.ts

@@ -0,0 +1,10 @@
+import type { AuthConfig } from "./config.js";
+export interface CodexExitSignal {
+    status?: number | null;
+    signal?: NodeJS.Signals | null;
+    stderr?: string;
+    stdout?: string;
+    structuredError?: unknown;
+}
+export declare function isQuotaError(signal: CodexExitSignal, config?: Pick<AuthConfig, "quotaPatterns">): boolean;
+//# sourceMappingURL=quota-detector.d.ts.map

package/dist/auth/quota-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-detector.d.ts","sourceRoot":"","sources":["../../src/auth/quota-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAsBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,OAAO,CAezG"}

package/dist/auth/quota-detector.js

@@ -0,0 +1,40 @@
+const DEFAULT_PATTERNS = [
+    /\b429\b/i,
+    /\bquota\b/i,
+    /rate\s*limit(?:ed|s)?/i,
+    /too\s+many\s+requests/i,
+];
+function structuredText(value) {
+    if (!value)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "object") {
+        const record = value;
+        const status = record.status ?? record.statusCode ?? record.code ?? "";
+        const type = record.type ?? record.error ?? "";
+        const message = record.message ?? "";
+        return `${status} ${type} ${message}`;
+    }
+    return String(value);
+}
+export function isQuotaError(signal, config) {
+    const haystack = [
+        structuredText(signal.structuredError),
+        signal.stderr ?? "",
+        signal.stdout ?? "",
+    ].join("\n");
+    if (!haystack.trim())
+        return false;
+    if (DEFAULT_PATTERNS.some((pattern) => pattern.test(haystack)))
+        return true;
+    return (config?.quotaPatterns ?? []).some((pattern) => {
+        try {
+            return new RegExp(pattern, "i").test(haystack);
+        }
+        catch {
+            return haystack.toLowerCase().includes(pattern.toLowerCase());
+        }
+    });
+}
+//# sourceMappingURL=quota-detector.js.map

package/dist/auth/quota-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-detector.js","sourceRoot":"","sources":["../../src/auth/quota-detector.ts"],"names":[],"mappings":"AAUA,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;AAEF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAuB,EAAE,MAA0C;IAC9F,MAAM,QAAQ,GAAG;QACf,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;QACtC,MAAM,CAAC,MAAM,IAAI,EAAE;QACnB,MAAM,CAAC,MAAM,IAAI,EAAE;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactAuthSecrets(value: unknown): string;
+//# sourceMappingURL=redact.d.ts.map