oh-my-codex 0.18.2 → 0.18.3

package/dist/auth/hotswap.js

@@ -0,0 +1,159 @@
+import { spawn } from "child_process";
+import { dirname } from "path";
+import { homedir } from "os";
+import { buildPlatformCommandSpec, classifySpawnError } from "../utils/platform-command.js";
+import { readAuthConfig } from "./config.js";
+import { isQuotaError } from "./quota-detector.js";
+import { redactAuthSecrets } from "./redact.js";
+import { buildRotationPlan, nextSlotAfter } from "./rotation.js";
+import { findLatestRolloutSession } from "./sessions.js";
+import { listSlots, markSlotQuota, readAuthMetadata, useSlot } from "./storage.js";
+export function stripHotswapArg(args) {
+    return args.filter((arg) => arg !== "--hotswap");
+}
+async function runCodexDirect(cwd, args, env) {
+    const spec = buildPlatformCommandSpec("codex", args, process.platform, env);
+    return await new Promise((resolve, reject) => {
+        const child = spawn(spec.command, spec.args, {
+            cwd,
+            env,
+            stdio: ["inherit", "inherit", "pipe"],
+            ...(process.platform === "win32" ? { windowsHide: true } : {}),
+        });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+            const text = redactAuthSecrets(chunk.toString("utf-8"));
+            stderr += text;
+            process.stderr.write(text);
+        });
+        child.on("error", (error) => {
+            const kind = classifySpawnError(error);
+            if (kind === "missing") {
+                reject(new Error("failed to launch codex: executable not found in PATH"));
+            }
+            else if (kind === "blocked") {
+                reject(new Error(`failed to launch codex: executable is blocked (${error.code || "blocked"})`));
+            }
+            else {
+                reject(error);
+            }
+        });
+        child.on("close", (status, signal) => {
+            resolve({ status: typeof status === "number" ? status : 1, signal, stderr });
+        });
+    });
+}
+export function buildResumeArgsWithPreservedFlags(originalArgs, sessionId) {
+    const preserved = [];
+    for (let index = 0; index < originalArgs.length; index++) {
+        const arg = originalArgs[index];
+        if (arg === "--")
+            break;
+        if (arg === "-c" || arg === "--config" || arg === "--model" || arg === "-m") {
+            preserved.push(arg);
+            const value = originalArgs[index + 1];
+            if (value && !value.startsWith("-")) {
+                preserved.push(value);
+                index += 1;
+            }
+            continue;
+        }
+        if (arg.startsWith("--config=") ||
+            arg.startsWith("--model=") ||
+            arg === "--dangerously-bypass-approvals-and-sandbox") {
+            preserved.push(arg);
+        }
+    }
+    return ["resume", sessionId, ...preserved];
+}
+function codexHomeFromAuthPath(authPath) {
+    return dirname(authPath);
+}
+function hotswapSessionId() {
+    return `omx-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+export async function runAuthHotswap(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const env = options.env ?? process.env;
+    const home = options.home ?? homedir();
+    const lifecycle = options.lifecycle;
+    const rawArgs = stripHotswapArg(options.argv);
+    const notifyTempResult = lifecycle.resolveNotifyTempContract(rawArgs, env);
+    const normalizedArgs = lifecycle.normalizeCodexLaunchArgs(notifyTempResult.passthroughArgs.filter((arg) => arg !== "--direct" && arg !== "--tmux"));
+    const config = await readAuthConfig(cwd, home);
+    const slots = await listSlots(home);
+    if (slots.length === 0) {
+        process.stderr.write("[omx auth] no slots configured; run `omx auth add <slot>` first.\n");
+        return 1;
+    }
+    const sessionId = hotswapSessionId();
+    const prepared = await lifecycle.prepareCodexHomeForLaunch(cwd, sessionId, env);
+    const childCodexHome = prepared.codexHomeOverride || (env.CODEX_HOME && env.CODEX_HOME.trim()) || `${home}/.codex`;
+    const liveAuthPath = `${childCodexHome}/auth.json`;
+    const metadata = await readAuthMetadata(home);
+    const plan = buildRotationPlan(slots, config, metadata.currentSlot);
+    let currentSlot = plan.order[0];
+    if (!currentSlot) {
+        process.stderr.write("[omx auth] no slots configured; run `omx auth add <slot>` first.\n");
+        return 1;
+    }
+    const exhausted = new Set();
+    let resumeArgs = null;
+    try {
+        await useSlot(currentSlot, liveAuthPath, home);
+        await lifecycle.preLaunch(cwd, sessionId, notifyTempResult.contract, prepared.codexHomeOverride, true, false);
+        const baseEnv = {
+            ...env,
+            ...(prepared.codexHomeOverride ? { CODEX_HOME: prepared.codexHomeOverride } : {}),
+            ...(prepared.sqliteHomeOverride ? { CODEX_SQLITE_HOME: prepared.sqliteHomeOverride } : {}),
+        };
+        const omxRoot = lifecycle.resolveOmxRootForLaunch(cwd, env);
+        if (omxRoot)
+            baseEnv.OMX_ROOT = omxRoot;
+        for (let attempt = 0; attempt < plan.order.length; attempt++) {
+            const attemptArgs = lifecycle.injectModelInstructionsBypassArgs(cwd, resumeArgs ?? normalizedArgs, baseEnv, lifecycle.sessionModelInstructionsPath(cwd, sessionId));
+            process.stderr.write(`[omx auth] using slot ${currentSlot}\n`);
+            const result = await runCodexDirect(cwd, attemptArgs, baseEnv);
+            if (result.status === 0)
+                return 0;
+            if (!isQuotaError({ status: result.status, signal: result.signal, stderr: result.stderr }, config)) {
+                return result.status || 1;
+            }
+            await markSlotQuota(currentSlot, home);
+            exhausted.add(currentSlot);
+            if (plan.mode === "manual") {
+                process.stderr.write(`[omx auth] quota detected for slot ${currentSlot}; rotation=manual, run \`omx auth use <slot>\` to switch accounts.\n`);
+                return 1;
+            }
+            const next = nextSlotAfter(plan.order, currentSlot, exhausted);
+            if (!next) {
+                process.stderr.write(`[omx auth] all slots exhausted: ${[...exhausted].join(", ")}\n`);
+                return 1;
+            }
+            const latest = await findLatestRolloutSession(codexHomeFromAuthPath(liveAuthPath), home);
+            if (!latest) {
+                process.stderr.write("[omx auth] quota detected but no Codex rollout session was found to resume.\n");
+                return 1;
+            }
+            currentSlot = next;
+            await useSlot(currentSlot, liveAuthPath, home);
+            resumeArgs = buildResumeArgsWithPreservedFlags(normalizedArgs, latest.id);
+            process.stderr.write(`[omx auth] quota detected; rotating to slot ${currentSlot} and resuming ${latest.id}\n`);
+        }
+        process.stderr.write(`[omx auth] all slots exhausted: ${plan.order.join(", ")}\n`);
+        return 1;
+    }
+    catch (err) {
+        process.stderr.write(`[omx auth] ${redactAuthSecrets(err)}\n`);
+        return 1;
+    }
+    finally {
+        await lifecycle.postLaunch(cwd, sessionId, prepared.codexHomeOverride, true, prepared.projectLocalCodexHomeForCleanup).catch((err) => {
+            process.stderr.write(`[omx auth] postLaunch warning: ${redactAuthSecrets(err)}\n`);
+        });
+        await lifecycle.cleanupRuntimeCodexHome(prepared.runtimeCodexHomeForCleanup, prepared.projectLocalCodexHomeForCleanup).catch((err) => {
+            process.stderr.write(`[omx auth] cleanup warning: ${redactAuthSecrets(err)}\n`);
+        });
+    }
+}
+//# sourceMappingURL=hotswap.js.map

package/dist/auth/hotswap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hotswap.js","sourceRoot":"","sources":["../../src/auth/hotswap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAmDnF,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,IAAc,EACd,GAAsB;IAEtB,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3C,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAC5E,CAAC;iBAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,KAAK,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACnC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,YAAsB,EAAE,SAAiB;IACzF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM;QACxB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5E,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1B,GAAG,KAAK,4CAA4C,EACpD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,SAAS,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,QAAQ,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC;IACnH,MAAM,YAAY,GAAG,GAAG,cAAc,YAAY,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,UAAU,GAAoB,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9G,MAAM,OAAO,GAAsB;YACjC,GAAG,GAAG;YACN,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,SAAS,CAAC,iCAAiC,CAC7D,GAAG,EACH,UAAU,IAAI,cAAc,EAC5B,OAAO,EACP,SAAS,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,CAAC,CACvD,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,WAAW,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnG,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,MAAM,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACvC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,WAAW,sEAAsE,CACxH,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;gBACtG,OAAO,CAAC,CAAC;YACX,CAAC;YACD,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/C,UAAU,GAAG,iCAAiC,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,WAAW,iBAAiB,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACjH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,uBAAuB,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./config.js";
+export * from "./paths.js";
+export * from "./quota-detector.js";
+export * from "./redact.js";
+export * from "./rotation.js";
+export * from "./sessions.js";
+export * from "./storage.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,8 @@
+export * from "./config.js";
+export * from "./paths.js";
+export * from "./quota-detector.js";
+export * from "./redact.js";
+export * from "./rotation.js";
+export * from "./sessions.js";
+export * from "./storage.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/auth/paths.d.ts

@@ -0,0 +1,12 @@
+export declare const AUTH_DIR_MODE = 448;
+export declare const AUTH_FILE_MODE = 384;
+export declare function resolveOmxAuthDir(home?: string): string;
+export declare function resolveAuthMetadataPath(home?: string): string;
+export declare function validateSlotName(slot: string): string;
+export declare function resolveSlotPath(slot: string, home?: string): string;
+export declare function resolveDefaultCodexHome(home?: string): string;
+export declare function resolveLiveAuthPath(cwd?: string, env?: NodeJS.ProcessEnv, home?: string): string;
+export declare function ensurePrivateDir(dir: string): Promise<void>;
+export declare function assertReadableFile(path: string, label: string): Promise<void>;
+export declare function assertNoSymlink(path: string, label: string): Promise<void>;
+//# sourceMappingURL=paths.d.ts.map

package/dist/auth/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,aAAa,MAAQ,CAAC;AACnC,eAAO,MAAM,cAAc,MAAQ,CAAC;AAEpC,wBAAgB,iBAAiB,CAAC,IAAI,SAAY,GAAG,MAAM,CAE1D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,SAAY,GAAG,MAAM,CAEhE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWrD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,MAAM,CAStE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,SAAY,GAAG,MAAM,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,GAAG,SAAgB,EACnB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,SAAY,GACf,MAAM,CAGR;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASjE;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnF;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF"}

package/dist/auth/paths.js

@@ -0,0 +1,78 @@
+import { homedir } from "os";
+import { basename, join, resolve } from "path";
+import { lstat, mkdir, stat } from "fs/promises";
+import { resolveCodexHomeForLaunch } from "../cli/codex-home.js";
+export const AUTH_DIR_MODE = 0o700;
+export const AUTH_FILE_MODE = 0o600;
+export function resolveOmxAuthDir(home = homedir()) {
+    return join(home, ".omx", "auth");
+}
+export function resolveAuthMetadataPath(home = homedir()) {
+    return join(resolveOmxAuthDir(home), "slots.json");
+}
+export function validateSlotName(slot) {
+    const trimmed = slot.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) {
+        throw new Error("invalid auth slot name: use 1-64 letters, numbers, '.', '_' or '-' and start with a letter or number");
+    }
+    if (trimmed === "." || trimmed === ".." || basename(trimmed) !== trimmed) {
+        throw new Error("invalid auth slot name: path traversal is not allowed");
+    }
+    return trimmed;
+}
+export function resolveSlotPath(slot, home = homedir()) {
+    const safeSlot = validateSlotName(slot);
+    const authDir = resolveOmxAuthDir(home);
+    const candidate = resolve(authDir, `${safeSlot}.json`);
+    const expected = join(resolve(authDir), `${safeSlot}.json`);
+    if (candidate !== expected) {
+        throw new Error("invalid auth slot path");
+    }
+    return candidate;
+}
+export function resolveDefaultCodexHome(home = homedir()) {
+    return join(home, ".codex");
+}
+export function resolveLiveAuthPath(cwd = process.cwd(), env = process.env, home = homedir()) {
+    const codexHome = resolveCodexHomeForLaunch(cwd, env) || resolveDefaultCodexHome(home);
+    return join(codexHome, "auth.json");
+}
+export async function ensurePrivateDir(dir) {
+    await mkdir(dir, { recursive: true, mode: AUTH_DIR_MODE });
+    const info = await lstat(dir);
+    if (info.isSymbolicLink())
+        throw new Error(`auth directory must not be a symlink: ${dir}`);
+    if (!info.isDirectory())
+        throw new Error(`auth path is not a directory: ${dir}`);
+    if (process.platform !== "win32") {
+        const { chmod } = await import("fs/promises");
+        await chmod(dir, AUTH_DIR_MODE).catch(() => undefined);
+    }
+}
+export async function assertReadableFile(path, label) {
+    try {
+        const info = await stat(path);
+        if (!info.isFile())
+            throw new Error(`${label} is not a file: ${path}`);
+    }
+    catch (err) {
+        if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+            throw new Error(`${label} not found: ${path}`);
+        }
+        throw err;
+    }
+}
+export async function assertNoSymlink(path, label) {
+    try {
+        const { lstat } = await import("fs/promises");
+        const info = await lstat(path);
+        if (info.isSymbolicLink())
+            throw new Error(`${label} must not be a symlink: ${path}`);
+    }
+    catch (err) {
+        if (err && typeof err === "object" && "code" in err && err.code === "ENOENT")
+            return;
+        throw err;
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,EAAE;IACtD,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAI,GAAG,OAAO,EAAE;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,EAAE;IACtD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,MAAyB,OAAO,CAAC,GAAG,EACpC,IAAI,GAAG,OAAO,EAAE;IAEhB,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QACrF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/auth/quota-detector.d.ts

@@ -0,0 +1,10 @@
+import type { AuthConfig } from "./config.js";
+export interface CodexExitSignal {
+    status?: number | null;
+    signal?: NodeJS.Signals | null;
+    stderr?: string;
+    stdout?: string;
+    structuredError?: unknown;
+}
+export declare function isQuotaError(signal: CodexExitSignal, config?: Pick<AuthConfig, "quotaPatterns">): boolean;
+//# sourceMappingURL=quota-detector.d.ts.map

package/dist/auth/quota-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-detector.d.ts","sourceRoot":"","sources":["../../src/auth/quota-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAsBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,OAAO,CAezG"}

package/dist/auth/quota-detector.js

@@ -0,0 +1,40 @@
+const DEFAULT_PATTERNS = [
+    /\b429\b/i,
+    /\bquota\b/i,
+    /rate\s*limit(?:ed|s)?/i,
+    /too\s+many\s+requests/i,
+];
+function structuredText(value) {
+    if (!value)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "object") {
+        const record = value;
+        const status = record.status ?? record.statusCode ?? record.code ?? "";
+        const type = record.type ?? record.error ?? "";
+        const message = record.message ?? "";
+        return `${status} ${type} ${message}`;
+    }
+    return String(value);
+}
+export function isQuotaError(signal, config) {
+    const haystack = [
+        structuredText(signal.structuredError),
+        signal.stderr ?? "",
+        signal.stdout ?? "",
+    ].join("\n");
+    if (!haystack.trim())
+        return false;
+    if (DEFAULT_PATTERNS.some((pattern) => pattern.test(haystack)))
+        return true;
+    return (config?.quotaPatterns ?? []).some((pattern) => {
+        try {
+            return new RegExp(pattern, "i").test(haystack);
+        }
+        catch {
+            return haystack.toLowerCase().includes(pattern.toLowerCase());
+        }
+    });
+}
+//# sourceMappingURL=quota-detector.js.map

package/dist/auth/quota-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-detector.js","sourceRoot":"","sources":["../../src/auth/quota-detector.ts"],"names":[],"mappings":"AAUA,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;AAEF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAuB,EAAE,MAA0C;IAC9F,MAAM,QAAQ,GAAG;QACf,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;QACtC,MAAM,CAAC,MAAM,IAAI,EAAE;QACnB,MAAM,CAAC,MAAM,IAAI,EAAE;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactAuthSecrets(value: unknown): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/auth/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/auth/redact.ts"],"names":[],"mappings":"AAUA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcxD"}

package/dist/auth/redact.js

@@ -0,0 +1,26 @@
+const JSON_OAUTH_TOKEN_FIELD_PATTERN = /(["'](?:access_token|refresh_token|id_token)["']\s*:\s*)(["'])(?:\\.|(?!\2)[^\\])*\2/gi;
+const SECRET_PATTERNS = [
+    JSON_OAUTH_TOKEN_FIELD_PATTERN,
+    /\b(?:access|refresh|id)_token\b\s*[:=]\s*["']?[^"'\s,}]+/gi,
+    /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi,
+    /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+    /\b(?:session|auth|api)[_-]?token\b\s*[:=]\s*["']?[^"'\s,}]+/gi,
+];
+export function redactAuthSecrets(value) {
+    let text = value instanceof Error ? value.message : String(value);
+    for (const pattern of SECRET_PATTERNS) {
+        text = text.replace(pattern, (match) => {
+            if (pattern === JSON_OAUTH_TOKEN_FIELD_PATTERN) {
+                return match.replace(/(:\s*)(["']).*\2$/s, "$1$2[REDACTED]$2");
+            }
+            const separator = match.match(/[:=]/)?.[0];
+            if (separator)
+                return `${match.slice(0, match.indexOf(separator) + 1)} [REDACTED]`;
+            if (/^bearer\s/i.test(match))
+                return "Bearer [REDACTED]";
+            return "[REDACTED]";
+        });
+    }
+    return text;
+}
+//# sourceMappingURL=redact.js.map

package/dist/auth/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/auth/redact.ts"],"names":[],"mappings":"AAAA,MAAM,8BAA8B,GAAG,wFAAwF,CAAC;AAEhI,MAAM,eAAe,GAAa;IAChC,8BAA8B;IAC9B,4DAA4D;IAC5D,kCAAkC;IAClC,2BAA2B;IAC3B,+DAA+D;CAChE,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACrC,IAAI,OAAO,KAAK,8BAA8B,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,SAAS;gBAAE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YACnF,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,mBAAmB,CAAC;YACzD,OAAO,YAAY,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/rotation.d.ts

@@ -0,0 +1,9 @@
+import type { AuthConfig } from "./config.js";
+import type { AuthSlotRecord } from "./storage.js";
+export interface RotationPlan {
+    mode: AuthConfig["rotation"];
+    order: string[];
+}
+export declare function buildRotationPlan(slots: AuthSlotRecord[], config: Pick<AuthConfig, "rotation" | "priority">, currentSlot?: string): RotationPlan;
+export declare function nextSlotAfter(order: string[], current: string | undefined, exhausted: Set<string>): string | undefined;
+//# sourceMappingURL=rotation.d.ts.map

package/dist/auth/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../src/auth/rotation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,cAAc,EAAE,EACvB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC,EACjD,WAAW,CAAC,EAAE,MAAM,GACnB,YAAY,CAWd;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAQtH"}

package/dist/auth/rotation.js

@@ -0,0 +1,26 @@
+export function buildRotationPlan(slots, config, currentSlot) {
+    const available = slots.map((slot) => slot.slot).sort((a, b) => a.localeCompare(b));
+    if (config.rotation === "manual")
+        return { mode: "manual", order: currentSlot ? [currentSlot] : available.slice(0, 1) };
+    if (config.rotation === "priority") {
+        const priority = config.priority.filter((slot) => available.includes(slot));
+        const rest = available.filter((slot) => !priority.includes(slot));
+        return { mode: "priority", order: [...priority, ...rest] };
+    }
+    if (!currentSlot || !available.includes(currentSlot))
+        return { mode: "round-robin", order: available };
+    const index = available.indexOf(currentSlot);
+    return { mode: "round-robin", order: [...available.slice(index), ...available.slice(0, index)] };
+}
+export function nextSlotAfter(order, current, exhausted) {
+    if (order.length === 0)
+        return undefined;
+    const start = current && order.includes(current) ? order.indexOf(current) + 1 : 0;
+    for (let offset = 0; offset < order.length; offset++) {
+        const slot = order[(start + offset) % order.length];
+        if (!exhausted.has(slot))
+            return slot;
+    }
+    return undefined;
+}
+//# sourceMappingURL=rotation.js.map

package/dist/auth/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../../src/auth/rotation.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,MAAiD,EACjD,WAAoB;IAEpB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACxH,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvG,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAe,EAAE,OAA2B,EAAE,SAAsB;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,15 @@
+export interface LatestRolloutSession {
+    id: string;
+    path: string;
+    mtimeMs: number;
+}
+export declare function extractRolloutSessionId(path: string): Promise<string>;
+/**
+ * Codex stores resumable conversations as rollout JSONL files under
+ * <CODEX_HOME>/sessions/YYYY/MM/DD/rollout-*.jsonl. Hotswap uses the newest
+ * rollout by mtime as the best available continuity heuristic after a quota
+ * exit, because upstream Codex does not currently expose the active resume id
+ * as a stable structured wrapper signal.
+ */
+export declare function findLatestRolloutSession(codexHome: string, fallbackHome?: string): Promise<LatestRolloutSession | null>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3E;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CActC"}

package/dist/auth/sessions.js

@@ -0,0 +1,62 @@
+import { existsSync } from "fs";
+import { readdir, stat, readFile } from "fs/promises";
+import { basename, join } from "path";
+import { resolveDefaultCodexHome } from "./paths.js";
+async function collectRollouts(dir, out) {
+    if (!existsSync(dir))
+        return;
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        const path = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            await collectRollouts(path, out);
+        }
+        else if (entry.isFile() && /^rollout-.+\.jsonl$/.test(entry.name)) {
+            out.push(path);
+        }
+    }
+}
+export async function extractRolloutSessionId(path) {
+    const fileMatch = basename(path).match(/^rollout-(.+)\.jsonl$/);
+    if (fileMatch?.[1])
+        return fileMatch[1];
+    const firstLine = (await readFile(path, "utf-8")).split(/\r?\n/, 1)[0] ?? "";
+    try {
+        const parsed = JSON.parse(firstLine);
+        const id = parsed.id ?? parsed.session_id ?? parsed.sessionId;
+        if (typeof id === "string" && id.trim())
+            return id.trim();
+    }
+    catch {
+        // fall through to basename fallback
+    }
+    return basename(path, ".jsonl").replace(/^rollout-/, "");
+}
+/**
+ * Codex stores resumable conversations as rollout JSONL files under
+ * <CODEX_HOME>/sessions/YYYY/MM/DD/rollout-*.jsonl. Hotswap uses the newest
+ * rollout by mtime as the best available continuity heuristic after a quota
+ * exit, because upstream Codex does not currently expose the active resume id
+ * as a stable structured wrapper signal.
+ */
+export async function findLatestRolloutSession(codexHome, fallbackHome) {
+    const roots = [join(codexHome, "sessions")];
+    const fallback = fallbackHome ? join(resolveDefaultCodexHome(fallbackHome), "sessions") : undefined;
+    if (fallback && fallback !== roots[0])
+        roots.push(fallback);
+    const files = [];
+    for (const root of roots)
+        await collectRollouts(root, files);
+    let latest = null;
+    for (const path of files) {
+        const info = await stat(path).catch(() => null);
+        if (!info?.isFile())
+            continue;
+        if (!latest || info.mtimeMs > latest.mtimeMs)
+            latest = { path, mtimeMs: info.mtimeMs };
+    }
+    if (!latest)
+        return null;
+    return { id: await extractRolloutSessionId(latest.path), path: latest.path, mtimeMs: latest.mtimeMs };
+}
+//# sourceMappingURL=sessions.js.map

package/dist/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAQrD,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAa;IACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC;QAC9D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,YAAqB;IAErB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,GAA6C,IAAI,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;YAAE,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACxG,CAAC"}

package/dist/auth/storage.d.ts

@@ -0,0 +1,27 @@
+export interface AuthSlotRecord {
+    slot: string;
+    createdAt: string;
+    updatedAt: string;
+    lastUsedAt?: string;
+    lastQuotaAt?: string;
+    exhaustedAt?: string;
+}
+export interface AuthMetadata {
+    version: 1;
+    currentSlot?: string;
+    slots: AuthSlotRecord[];
+}
+export interface AtomicWriteOptions {
+    mode?: number;
+    beforeRename?: (tempPath: string) => void | Promise<void>;
+}
+export declare function atomicWriteFile(targetPath: string, data: string | Buffer, options?: AtomicWriteOptions): Promise<void>;
+export declare function emptyMetadata(): AuthMetadata;
+export declare function readAuthMetadata(home?: string): Promise<AuthMetadata>;
+export declare function writeAuthMetadata(metadata: AuthMetadata, home?: string): Promise<void>;
+export declare function addSlotFromAuthFile(slot: string, liveAuthPath: string, home?: string, now?: Date): Promise<AuthSlotRecord>;
+export declare function listSlots(home?: string): Promise<AuthSlotRecord[]>;
+export declare function useSlot(slot: string, liveAuthPath: string, home?: string, now?: Date): Promise<AuthSlotRecord>;
+export declare function markSlotQuota(slot: string, home?: string, now?: Date): Promise<AuthMetadata>;
+export declare function clearSlotExhaustion(slot: string, home?: string): Promise<void>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/auth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAgB,aAAa,IAAI,YAAY,CAE5C;AAED,wBAAsB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAa3E;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM5F;AAeD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,OAAa,GACf,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED,wBAAsB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAGxE;AAED,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,OAAa,GACf,OAAO,CAAC,cAAc,CAAC,CAezB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,OAAa,GACf,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpF"}