opencode-copilot-account-switcher 0.14.27 → 0.14.28

package/dist/plugin.js

@@ -10,6 +10,7 @@ import { brokerStartupDiagnosticsPath, ensureWechatStateLayout } from "./wechat/
 import { createCodexMenuAdapter } from "./providers/codex-menu-adapter.js";
 import { createCopilotMenuAdapter } from "./providers/copilot-menu-adapter.js";
 import { createProviderRegistry } from "./providers/registry.js";
+import { loadOfficialCodexAuthMethods } from "./upstream/codex-loader-adapter.js";
 import { isTTY } from "./ui/ansi.js";
 import { showMenu } from "./ui/menu.js";
 import { select, selectMany } from "./ui/select.js";
@@ -73,6 +74,14 @@ function toSharedRuntimeAction(action) {
         return { type: "provider", name: "toggle-experimental-slash-commands" };
     if (action.type === "toggle-network-retry")
         return { type: "provider", name: "toggle-network-retry" };
+    if (action.type === "toggle-wechat-notifications")
+        return { type: "provider", name: "toggle-wechat-notifications" };
+    if (action.type === "toggle-wechat-question-notify")
+        return { type: "provider", name: "toggle-wechat-question-notify" };
+    if (action.type === "toggle-wechat-permission-notify")
+        return { type: "provider", name: "toggle-wechat-permission-notify" };
+    if (action.type === "toggle-wechat-session-error-notify")
+        return { type: "provider", name: "toggle-wechat-session-error-notify" };
     if (action.type === "wechat-bind")
         return { type: "provider", name: "wechat-bind" };
     if (action.type === "wechat-rebind")
@@ -386,6 +395,13 @@ async function createAccountSwitcherPlugin(input, provider) {
         }
         const adapter = createCodexMenuAdapter({
             client: codexClient,
+            loadOfficialCodexAuthMethods: () => loadOfficialCodexAuthMethods({
+                client: {
+                    auth: {
+                        set: async (value) => client.auth.set(value),
+                    },
+                },
+            }),
             readCommonSettings: readCommonSettingsStore,
             writeCommonSettings: async (settings) => {
                 await writeCommonSettingsStore(settings);

package/dist/providers/codex-menu-adapter.d.ts

@@ -1,5 +1,5 @@
 import { type CodexStatusFetcherResult } from "../codex-status-fetcher.js";
-import { type CodexOAuthAccount } from "../codex-oauth.js";
+import { type OfficialCodexAuthMethod } from "../upstream/codex-loader-adapter.js";
 import { type CodexAccountEntry, type CodexStoreFile } from "../codex-store.js";
 import type { ProviderMenuAdapter } from "../menu-runtime.js";
 import { type AccountEntry } from "../store.js";
@@ -42,7 +42,7 @@ type AdapterDependencies = {
         };
         accountId?: string;
     }) => Promise<CodexStatusFetcherResult>;
-    runCodexOAuth?: () => Promise<CodexOAuthAccount | undefined>;
+    loadOfficialCodexAuthMethods?: () => Promise<OfficialCodexAuthMethod[]>;
     readCommonSettings?: () => Promise<CommonSettingsStore>;
     writeCommonSettings?: (settings: CommonSettingsStore, meta?: WriteMeta) => Promise<void>;
 };

package/dist/providers/codex-menu-adapter.js

@@ -1,12 +1,34 @@
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fetchCodexStatus } from "../codex-status-fetcher.js";
-import { runCodexOAuth } from "../codex-oauth.js";
+import { loadOfficialCodexAuthMethods, } from "../upstream/codex-loader-adapter.js";
 import { getActiveCodexAccount, readCodexStore, writeCodexStore, } from "../codex-store.js";
 import { recoverInvalidCodexAccount } from "../codex-invalid-account.js";
 import { readAuth } from "../store.js";
 import { readCommonSettingsStore, writeCommonSettingsStore, } from "../common-settings-store.js";
 import { applyCommonSettingsAction } from "../common-settings-actions.js";
+function pickOfficialOauthMethodByKind(methods, kind) {
+    return methods.find((method) => {
+        if (method.type !== "oauth")
+            return false;
+        if (typeof method.authorize !== "function")
+            return false;
+        const label = method.label.toLowerCase();
+        if (kind === "browser")
+            return label.includes("browser");
+        return label.includes("headless") || label.includes("device");
+    });
+}
+function parseOfficialOauthSelection(raw) {
+    const value = raw.trim().toLowerCase();
+    if (!value)
+        return "cancel";
+    if (value === "1" || value === "browser" || value === "b")
+        return "browser";
+    if (value === "2" || value === "headless" || value === "h" || value === "device")
+        return "headless";
+    return undefined;
+}
 function pickName(input) {
     const accountId = input.accountId?.trim();
     if (accountId)
@@ -73,7 +95,14 @@ export function createCodexMenuAdapter(inputDeps) {
     });
     const loadAuth = inputDeps.readAuthEntries ?? readAuth;
     const fetchStatus = inputDeps.fetchStatus ?? ((input) => fetchCodexStatus(input));
-    const authorizeOpenAIOAuth = inputDeps.runCodexOAuth ?? runCodexOAuth;
+    const loadOfficialMethods = inputDeps.loadOfficialCodexAuthMethods
+        ?? (() => loadOfficialCodexAuthMethods({
+            client: {
+                auth: {
+                    set: async (value) => inputDeps.client.auth.set(value),
+                },
+            },
+        }));
     const readCommonSettings = inputDeps.readCommonSettings ?? readCommonSettingsStore;
     const writeCommonSettings = async (settings, meta) => {
         if (inputDeps.writeCommonSettings) {
@@ -243,34 +272,46 @@ export function createCodexMenuAdapter(inputDeps) {
             return true;
         },
         authorizeNewAccount: async () => {
-            const oauth = await authorizeOpenAIOAuth();
-            if (!oauth || (!oauth.refresh && !oauth.access))
+            const methods = await loadOfficialMethods();
+            const browserMethod = pickOfficialOauthMethodByKind(methods, "browser");
+            const headlessMethod = pickOfficialOauthMethodByKind(methods, "headless");
+            const selectedKey = parseOfficialOauthSelection(await prompt("Choose Codex auth method (1/browser/b, 2/headless/h/device, Enter to cancel): "));
+            if (selectedKey === "cancel" || !selectedKey)
+                return undefined;
+            const selectedMethod = selectedKey === "browser" ? browserMethod : headlessMethod;
+            if (!selectedMethod || typeof selectedMethod.authorize !== "function")
+                return undefined;
+            const pending = await selectedMethod.authorize();
+            if (pending.method && pending.method !== "auto") {
+                throw new Error(`Unsupported official Codex auth method: ${pending.method}`);
+            }
+            if (typeof pending.callback !== "function")
+                return undefined;
+            const result = await pending.callback();
+            if (result.type !== "success" || (!result.refresh && !result.access))
                 return undefined;
-            const refresh = oauth.refresh ?? oauth.access;
-            const access = oauth.access ?? oauth.refresh;
+            const refresh = result.refresh ?? result.access;
+            const access = result.access ?? result.refresh;
             await inputDeps.client.auth.set({
                 path: { id: "openai" },
                 body: {
                     type: "oauth",
                     refresh,
                     access,
-                    expires: oauth.expires,
-                    accountId: oauth.accountId,
+                    expires: result.expires,
+                    accountId: result.accountId,
                 },
             });
             return {
                 name: pickName({
-                    accountId: oauth.accountId,
-                    email: oauth.email,
+                    accountId: result.accountId,
                     fallback: `openai-${now()}`,
                 }),
                 providerId: "openai",
-                workspaceName: oauth.workspaceName,
                 refresh,
                 access,
-                expires: oauth.expires,
-                accountId: oauth.accountId,
-                email: oauth.email,
+                expires: result.expires,
+                accountId: result.accountId,
                 source: "manual",
                 addedAt: now(),
             };

package/dist/upstream/codex-loader-adapter.d.ts

@@ -36,6 +36,35 @@ export type OfficialCodexChatHeadersHook = (input: {
 }, output: {
     headers: Record<string, string>;
 }) => Promise<void>;
+type OfficialCodexAuthResult = {
+    type: "success";
+    refresh: string;
+    access: string;
+    expires: number;
+    accountId?: string;
+} | {
+    type: "failed";
+};
+type OfficialCodexAuthorizePending = {
+    url: string;
+    instructions?: string;
+    method?: string;
+    callback?: () => Promise<OfficialCodexAuthResult>;
+};
+export type OfficialCodexAuthMethod = {
+    label: string;
+    type: string;
+    authorize?: () => Promise<OfficialCodexAuthorizePending>;
+};
+export declare function loadOfficialCodexAuthMethods(input?: {
+    client?: {
+        auth?: {
+            set?: (value: unknown) => Promise<unknown>;
+        };
+    };
+    baseFetch?: typeof fetch;
+    version?: string;
+}): Promise<OfficialCodexAuthMethod[]>;
 export declare function loadOfficialCodexConfig(input: {
     getAuth: () => Promise<CodexAuthState | undefined>;
     provider?: CodexProviderConfig;
@@ -67,3 +96,4 @@ export declare function loadOfficialCodexChatHeaders(input?: {
     baseFetch?: typeof fetch;
     version?: string;
 }): Promise<OfficialCodexChatHeadersHook>;
+export {};

package/dist/upstream/codex-loader-adapter.js

@@ -13,6 +13,31 @@ async function loadOfficialHooks(input) {
         return hooks;
     });
 }
+export async function loadOfficialCodexAuthMethods(input = {}) {
+    const hooks = await loadOfficialHooks(input);
+    const methods = hooks.auth?.methods;
+    if (!Array.isArray(methods)) {
+        return [];
+    }
+    return methods.map((method) => {
+        if (typeof method.authorize !== "function") {
+            return method;
+        }
+        return {
+            ...method,
+            authorize: async () => {
+                const pending = await runWithOfficialBridge(input, () => method.authorize());
+                if (!pending || typeof pending.callback !== "function") {
+                    return pending;
+                }
+                return {
+                    ...pending,
+                    callback: () => runWithOfficialBridge(input, () => pending.callback()),
+                };
+            },
+        };
+    });
+}
 export async function loadOfficialCodexConfig(input) {
     const hooks = await loadOfficialHooks({
         client: input.client,

package/dist/upstream/codex-plugin.snapshot.d.ts

@@ -9,5 +9,24 @@ declare const officialCodexExportBridge: {
         version?: string;
     } | undefined, fn: () => Promise<any>): Promise<any>;
 };
+export interface IdTokenClaims {
+    chatgpt_account_id?: string;
+    organizations?: Array<{
+        id: string;
+    }>;
+    email?: string;
+    "https://api.openai.com/auth"?: {
+        chatgpt_account_id?: string;
+    };
+}
+export declare function parseJwtClaims(token: string): IdTokenClaims | undefined;
+export declare function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined;
+export declare function extractAccountId(tokens: TokenResponse): string | undefined;
+interface TokenResponse {
+    id_token: string;
+    access_token: string;
+    refresh_token: string;
+    expires_in?: number;
+}
 export declare function CodexAuthPlugin(input: PluginInput): Promise<Hooks>;
 export { officialCodexExportBridge };

package/dist/upstream/codex-plugin.snapshot.js

@@ -1,5 +1,6 @@
 // @ts-nocheck
 import { AsyncLocalStorage } from "node:async_hooks";
+import { createServer } from "node:http";
 import os from "node:os";
 const officialCodexExportBridgeStorage = new AsyncLocalStorage();
 const officialCodexExportBridge = {
@@ -26,8 +27,384 @@ const OAUTH_DUMMY_KEY = "official-codex-oauth";
 function fetch(request, init) {
     return (officialCodexExportBridgeStorage.getStore()?.fetchImpl ?? officialCodexExportBridge.fetchImpl)(request, init);
 }
+function sleep(ms) {
+    return Bun.sleep(ms);
+}
+const Bun = {
+    serve(options) {
+        let closed = false;
+        let listening = false;
+        let closePromise;
+        let resolveReady;
+        let rejectReady;
+        const ready = new Promise((resolve, reject) => {
+            resolveReady = resolve;
+            rejectReady = reject;
+        });
+        const server = createServer((req, res) => {
+            const chunks = [];
+            req.on("data", (chunk) => {
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            req.on("error", (error) => {
+                res.statusCode = 500;
+                res.end(String(error));
+            });
+            req.on("end", () => {
+                const body = chunks.length > 0 ? Buffer.concat(chunks) : undefined;
+                const request = new Request("http://127.0.0.1:" + options.port + (req.url ?? "/"), {
+                    method: req.method,
+                    headers: req.headers,
+                    body,
+                    duplex: "half",
+                });
+                Promise.resolve(options.fetch(request))
+                    .then(async (response) => {
+                    res.statusCode = response.status;
+                    response.headers.forEach((value, key) => res.setHeader(key, value));
+                    const payload = Buffer.from(await response.arrayBuffer());
+                    res.end(payload);
+                })
+                    .catch((error) => {
+                    res.statusCode = 500;
+                    res.end(String(error));
+                });
+            });
+        });
+        server.once("listening", () => {
+            listening = true;
+            resolveReady?.();
+            resolveReady = undefined;
+            rejectReady = undefined;
+        });
+        server.once("error", (error) => {
+            if (!listening) {
+                rejectReady?.(error);
+                resolveReady = undefined;
+                rejectReady = undefined;
+            }
+        });
+        server.listen(options.port);
+        return {
+            ready,
+            stop() {
+                if (closePromise)
+                    return closePromise;
+                closePromise = new Promise((resolve, reject) => {
+                    if (closed) {
+                        resolve();
+                        return;
+                    }
+                    server.close((error) => {
+                        if (error) {
+                            reject(error);
+                            return;
+                        }
+                        closed = true;
+                        resolve();
+                    });
+                });
+                return closePromise;
+            },
+        };
+    },
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    },
+};
+const Log = {
+    create() {
+        return {
+            info() { },
+            warn() { },
+            error() { },
+        };
+    },
+};
 /* LOCAL_SHIMS_END */
+const log = Log.create({ service: "plugin.codex" });
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const ISSUER = "https://auth.openai.com";
 const CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+const OAUTH_PORT = 1455;
+const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000;
+async function generatePKCE() {
+    const verifier = generateRandomString(43);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hash = await crypto.subtle.digest("SHA-256", data);
+    const challenge = base64UrlEncode(hash);
+    return { verifier, challenge };
+}
+function generateRandomString(length) {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const bytes = crypto.getRandomValues(new Uint8Array(length));
+    return Array.from(bytes)
+        .map((b) => chars[b % chars.length])
+        .join("");
+}
+function base64UrlEncode(buffer) {
+    const bytes = new Uint8Array(buffer);
+    const binary = String.fromCharCode(...bytes);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateState() {
+    return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)).buffer);
+}
+export function parseJwtClaims(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    }
+    catch {
+        return undefined;
+    }
+}
+export function extractAccountIdFromClaims(claims) {
+    return (claims.chatgpt_account_id ||
+        claims["https://api.openai.com/auth"]?.chatgpt_account_id ||
+        claims.organizations?.[0]?.id);
+}
+export function extractAccountId(tokens) {
+    if (tokens.id_token) {
+        const claims = parseJwtClaims(tokens.id_token);
+        const accountId = claims && extractAccountIdFromClaims(claims);
+        if (accountId)
+            return accountId;
+    }
+    if (tokens.access_token) {
+        const claims = parseJwtClaims(tokens.access_token);
+        return claims ? extractAccountIdFromClaims(claims) : undefined;
+    }
+    return undefined;
+}
+function buildAuthorizeUrl(redirectUri, pkce, state) {
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: CLIENT_ID,
+        redirect_uri: redirectUri,
+        scope: "openid profile email offline_access",
+        code_challenge: pkce.challenge,
+        code_challenge_method: "S256",
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+        state,
+        originator: "opencode",
+    });
+    return `${ISSUER}/oauth/authorize?${params.toString()}`;
+}
+async function exchangeCodeForTokens(code, redirectUri, pkce) {
+    const response = await fetch(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+            client_id: CLIENT_ID,
+            code_verifier: pkce.verifier,
+        }).toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token exchange failed: ${response.status}`);
+    }
+    return response.json();
+}
+async function refreshAccessToken(refreshToken) {
+    const response = await fetch(`${ISSUER}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: CLIENT_ID,
+        }).toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token refresh failed: ${response.status}`);
+    }
+    return response.json();
+}
+const HTML_SUCCESS = `<!doctype html>
+<html>
+  <head>
+    <title>OpenCode - Codex Authorization Successful</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #f1ecec;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Successful</h1>
+      <p>You can close this window and return to OpenCode.</p>
+    </div>
+    <script>
+      setTimeout(() => window.close(), 2000)
+    </script>
+  </body>
+</html>`;
+const HTML_ERROR = (error) => `<!doctype html>
+<html>
+  <head>
+    <title>OpenCode - Codex Authorization Failed</title>
+    <style>
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        display: flex;
+        justify-content: center;
+        align-items: center;
+        height: 100vh;
+        margin: 0;
+        background: #131010;
+        color: #f1ecec;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+      }
+      h1 {
+        color: #fc533a;
+        margin-bottom: 1rem;
+      }
+      p {
+        color: #b7b1b1;
+      }
+      .error {
+        color: #ff917b;
+        font-family: monospace;
+        margin-top: 1rem;
+        padding: 1rem;
+        background: #3c140d;
+        border-radius: 0.5rem;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Authorization Failed</h1>
+      <p>An error occurred during authorization.</p>
+      <div class="error">${error}</div>
+    </div>
+  </body>
+</html>`;
+let oauthServer;
+let pendingOAuth;
+async function startOAuthServer() {
+    if (oauthServer) {
+        return { port: OAUTH_PORT, redirectUri: `http://localhost:${OAUTH_PORT}/auth/callback` };
+    }
+    oauthServer = Bun.serve({
+        port: OAUTH_PORT,
+        fetch(req) {
+            const url = new URL(req.url);
+            if (url.pathname === "/auth/callback") {
+                const code = url.searchParams.get("code");
+                const state = url.searchParams.get("state");
+                const error = url.searchParams.get("error");
+                const errorDescription = url.searchParams.get("error_description");
+                if (error) {
+                    const errorMsg = errorDescription || error;
+                    pendingOAuth?.reject(new Error(errorMsg));
+                    pendingOAuth = undefined;
+                    return new Response(HTML_ERROR(errorMsg), {
+                        headers: { "Content-Type": "text/html" },
+                    });
+                }
+                if (!code) {
+                    const errorMsg = "Missing authorization code";
+                    pendingOAuth?.reject(new Error(errorMsg));
+                    pendingOAuth = undefined;
+                    return new Response(HTML_ERROR(errorMsg), {
+                        status: 400,
+                        headers: { "Content-Type": "text/html" },
+                    });
+                }
+                if (!pendingOAuth || state !== pendingOAuth.state) {
+                    const errorMsg = "Invalid state - potential CSRF attack";
+                    pendingOAuth?.reject(new Error(errorMsg));
+                    pendingOAuth = undefined;
+                    return new Response(HTML_ERROR(errorMsg), {
+                        status: 400,
+                        headers: { "Content-Type": "text/html" },
+                    });
+                }
+                const current = pendingOAuth;
+                pendingOAuth = undefined;
+                exchangeCodeForTokens(code, `http://localhost:${OAUTH_PORT}/auth/callback`, current.pkce)
+                    .then((tokens) => current.resolve(tokens))
+                    .catch((err) => current.reject(err));
+                return new Response(HTML_SUCCESS, {
+                    headers: { "Content-Type": "text/html" },
+                });
+            }
+            if (url.pathname === "/cancel") {
+                pendingOAuth?.reject(new Error("Login cancelled"));
+                pendingOAuth = undefined;
+                return new Response("Login cancelled", { status: 200 });
+            }
+            return new Response("Not found", { status: 404 });
+        },
+    });
+    log.info("codex oauth server started", { port: OAUTH_PORT });
+    return { port: OAUTH_PORT, redirectUri: `http://localhost:${OAUTH_PORT}/auth/callback` };
+}
+function stopOAuthServer() {
+    if (oauthServer) {
+        oauthServer.stop();
+        oauthServer = undefined;
+        log.info("codex oauth server stopped");
+    }
+}
+function waitForOAuthCallback(pkce, state) {
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            if (pendingOAuth) {
+                pendingOAuth = undefined;
+                reject(new Error("OAuth callback timeout - authorization took too long"));
+            }
+        }, 5 * 60 * 1000); // 5 minute timeout
+        pendingOAuth = {
+            pkce,
+            state,
+            resolve: (tokens) => {
+                clearTimeout(timeout);
+                resolve(tokens);
+            },
+            reject: (error) => {
+                clearTimeout(timeout);
+                reject(error);
+            },
+        };
+    });
+}
 export async function CodexAuthPlugin(input) {
     return {
         auth: {
@@ -36,28 +413,98 @@ export async function CodexAuthPlugin(input) {
                 const auth = await getAuth();
                 if (auth.type !== "oauth")
                     return {};
-                if (provider?.models) {
-                    for (const model of Object.values(provider.models)) {
-                        model.cost = {
-                            input: 0,
-                            output: 0,
-                            cache: { read: 0, write: 0 },
-                        };
-                    }
+                // Filter models to only allowed Codex models for OAuth
+                const allowedModels = new Set([
+                    "gpt-5.1-codex",
+                    "gpt-5.1-codex-max",
+                    "gpt-5.1-codex-mini",
+                    "gpt-5.2",
+                    "gpt-5.2-codex",
+                    "gpt-5.3-codex",
+                    "gpt-5.4",
+                    "gpt-5.4-mini",
+                ]);
+                for (const modelId of Object.keys(provider.models)) {
+                    if (modelId.includes("codex"))
+                        continue;
+                    if (allowedModels.has(modelId))
+                        continue;
+                    delete provider.models[modelId];
+                }
+                // Zero out costs for Codex (included with ChatGPT subscription)
+                for (const model of Object.values(provider.models)) {
+                    model.cost = {
+                        input: 0,
+                        output: 0,
+                        cache: { read: 0, write: 0 },
+                    };
                 }
                 return {
                     apiKey: OAUTH_DUMMY_KEY,
                     async fetch(requestInput, init) {
+                        // Remove dummy API key authorization header
+                        if (init?.headers) {
+                            if (init.headers instanceof Headers) {
+                                init.headers.delete("authorization");
+                                init.headers.delete("Authorization");
+                            }
+                            else if (Array.isArray(init.headers)) {
+                                init.headers = init.headers.filter(([key]) => key.toLowerCase() !== "authorization");
+                            }
+                            else {
+                                delete init.headers["authorization"];
+                                delete init.headers["Authorization"];
+                            }
+                        }
                         const currentAuth = await getAuth();
                         if (currentAuth.type !== "oauth")
                             return fetch(requestInput, init);
-                        const headers = new Headers(init?.headers);
-                        headers.delete("authorization");
-                        headers.delete("Authorization");
+                        // Cast to include accountId field
+                        const authWithAccount = currentAuth;
+                        // Check if token needs refresh
+                        if (!currentAuth.access || currentAuth.expires < Date.now()) {
+                            log.info("refreshing codex access token");
+                            const tokens = await refreshAccessToken(currentAuth.refresh);
+                            const newAccountId = extractAccountId(tokens) || authWithAccount.accountId;
+                            await input.client.auth.set({
+                                path: { id: "openai" },
+                                body: {
+                                    type: "oauth",
+                                    refresh: tokens.refresh_token,
+                                    access: tokens.access_token,
+                                    expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                                    ...(newAccountId && { accountId: newAccountId }),
+                                },
+                            });
+                            currentAuth.access = tokens.access_token;
+                            authWithAccount.accountId = newAccountId;
+                        }
+                        // Build headers
+                        const headers = new Headers();
+                        if (init?.headers) {
+                            if (init.headers instanceof Headers) {
+                                init.headers.forEach((value, key) => headers.set(key, value));
+                            }
+                            else if (Array.isArray(init.headers)) {
+                                for (const [key, value] of init.headers) {
+                                    if (value !== undefined)
+                                        headers.set(key, String(value));
+                                }
+                            }
+                            else {
+                                for (const [key, value] of Object.entries(init.headers)) {
+                                    if (value !== undefined)
+                                        headers.set(key, String(value));
+                                }
+                            }
+                        }
+                        // Set authorization header with access token
                         headers.set("authorization", `Bearer ${currentAuth.access}`);
-                        if (currentAuth.accountId) {
-                            headers.set("ChatGPT-Account-Id", currentAuth.accountId);
+                        // Set ChatGPT-Account-Id header for organization subscriptions
+                        if (authWithAccount.accountId) {
+                            headers.set("ChatGPT-Account-Id", authWithAccount.accountId);
                         }
+                        // Rewrite URL to Codex endpoint
                         const parsed = requestInput instanceof URL
                             ? requestInput
                             : new URL(typeof requestInput === "string" ? requestInput : requestInput.url);
@@ -75,12 +522,101 @@ export async function CodexAuthPlugin(input) {
                 {
                     label: "ChatGPT Pro/Plus (browser)",
                     type: "oauth",
-                    authorize: async () => ({
-                        url: "",
-                        instructions: "",
-                        method: "auto",
-                        callback: async () => ({ type: "failed" }),
-                    }),
+                    authorize: async () => {
+                        const { redirectUri } = await startOAuthServer();
+                        const pkce = await generatePKCE();
+                        const state = generateState();
+                        const authUrl = buildAuthorizeUrl(redirectUri, pkce, state);
+                        const callbackPromise = waitForOAuthCallback(pkce, state);
+                        return {
+                            url: authUrl,
+                            instructions: "Complete authorization in your browser. This window will close automatically.",
+                            method: "auto",
+                            callback: async () => {
+                                const tokens = await callbackPromise;
+                                stopOAuthServer();
+                                const accountId = extractAccountId(tokens);
+                                return {
+                                    type: "success",
+                                    refresh: tokens.refresh_token,
+                                    access: tokens.access_token,
+                                    expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                                    accountId,
+                                };
+                            },
+                        };
+                    },
+                },
+                {
+                    label: "ChatGPT Pro/Plus (headless)",
+                    type: "oauth",
+                    authorize: async () => {
+                        const deviceResponse = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+                            method: "POST",
+                            headers: {
+                                "Content-Type": "application/json",
+                                "User-Agent": `opencode/${Installation.VERSION}`,
+                            },
+                            body: JSON.stringify({ client_id: CLIENT_ID }),
+                        });
+                        if (!deviceResponse.ok)
+                            throw new Error("Failed to initiate device authorization");
+                        const deviceData = (await deviceResponse.json());
+                        const interval = Math.max(parseInt(deviceData.interval) || 5, 1) * 1000;
+                        return {
+                            url: `${ISSUER}/codex/device`,
+                            instructions: `Enter code: ${deviceData.user_code}`,
+                            method: "auto",
+                            async callback() {
+                                while (true) {
+                                    const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
+                                        method: "POST",
+                                        headers: {
+                                            "Content-Type": "application/json",
+                                            "User-Agent": `opencode/${Installation.VERSION}`,
+                                        },
+                                        body: JSON.stringify({
+                                            device_auth_id: deviceData.device_auth_id,
+                                            user_code: deviceData.user_code,
+                                        }),
+                                    });
+                                    if (response.ok) {
+                                        const data = (await response.json());
+                                        const tokenResponse = await fetch(`${ISSUER}/oauth/token`, {
+                                            method: "POST",
+                                            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                                            body: new URLSearchParams({
+                                                grant_type: "authorization_code",
+                                                code: data.authorization_code,
+                                                redirect_uri: `${ISSUER}/deviceauth/callback`,
+                                                client_id: CLIENT_ID,
+                                                code_verifier: data.code_verifier,
+                                            }).toString(),
+                                        });
+                                        if (!tokenResponse.ok) {
+                                            throw new Error(`Token exchange failed: ${tokenResponse.status}`);
+                                        }
+                                        const tokens = await tokenResponse.json();
+                                        return {
+                                            type: "success",
+                                            refresh: tokens.refresh_token,
+                                            access: tokens.access_token,
+                                            expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                                            accountId: extractAccountId(tokens),
+                                        };
+                                    }
+                                    if (response.status !== 403 && response.status !== 404) {
+                                        return { type: "failed" };
+                                    }
+                                    await sleep(interval + OAUTH_POLLING_SAFETY_MARGIN_MS);
+                                }
+                            },
+                        };
+                    },
+                },
+                {
+                    label: "Manually enter API Key",
+                    type: "api",
                 },
             ],
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-copilot-account-switcher",
-  "version": "0.14.27",
+  "version": "0.14.28",
   "description": "GitHub Copilot account switcher plugin for OpenCode",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/codex-oauth.d.ts

@@ -1,64 +0,0 @@
-export type TokenResponse = {
-    id_token?: string;
-    access_token?: string;
-    refresh_token?: string;
-    expires_in?: number;
-};
-export type IdTokenClaims = {
-    chatgpt_account_id?: string;
-    organizations?: Array<{
-        id?: string;
-        name?: string;
-        display_name?: string;
-        workspace_name?: string;
-        slug?: string;
-    }>;
-    organization?: {
-        id?: string;
-        name?: string;
-        display_name?: string;
-        workspace_name?: string;
-        slug?: string;
-    };
-    workspace?: {
-        id?: string;
-        name?: string;
-        display_name?: string;
-        workspace_name?: string;
-        slug?: string;
-    };
-    workspace_name?: string;
-    email?: string;
-    "https://api.openai.com/auth"?: {
-        chatgpt_account_id?: string;
-        workspace_name?: string;
-        workspace_id?: string;
-        organization_id?: string;
-    };
-};
-export type CodexOAuthAccount = {
-    refresh?: string;
-    access?: string;
-    expires?: number;
-    accountId?: string;
-    email?: string;
-    workspaceName?: string;
-};
-type OAuthMode = "browser" | "headless";
-type RunCodexOAuthInput = {
-    now?: () => number;
-    timeoutMs?: number;
-    fetchImpl?: typeof globalThis.fetch;
-    selectMode?: () => Promise<OAuthMode | undefined>;
-    runBrowserAuth?: () => Promise<TokenResponse>;
-    runDeviceAuth?: () => Promise<TokenResponse>;
-    openUrl?: (url: string) => Promise<void>;
-    log?: (message: string) => void;
-};
-export declare function parseJwtClaims(token: string): IdTokenClaims | undefined;
-export declare function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined;
-export declare function extractAccountId(tokens: TokenResponse): string | undefined;
-export declare function extractWorkspaceNameFromClaims(claims: IdTokenClaims): string | undefined;
-export declare function extractWorkspaceName(tokens: TokenResponse): string | undefined;
-export declare function runCodexOAuth(input?: RunCodexOAuthInput): Promise<CodexOAuthAccount | undefined>;
-export {};

package/dist/codex-oauth.js

@@ -1,344 +0,0 @@
-import { randomBytes, createHash } from "node:crypto";
-import { createServer } from "node:http";
-import { spawn } from "node:child_process";
-import os from "node:os";
-import { createInterface } from "node:readline/promises";
-import { stdin as input, stdout as output, platform } from "node:process";
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const ISSUER = "https://auth.openai.com";
-const OAUTH_PORT = 1455;
-const OAUTH_TIMEOUT_MS = 5 * 60 * 1000;
-const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000;
-const USER_AGENT = `opencode-copilot-account-switcher (${platform} ${os.release()}; ${os.arch()})`;
-const HTML_SUCCESS = `<!doctype html>
-<html>
-  <head>
-    <title>Codex Authorization Successful</title>
-  </head>
-  <body>
-    <h1>Authorization Successful</h1>
-    <p>You can close this window and return to OpenCode.</p>
-    <script>
-      setTimeout(() => window.close(), 2000)
-    </script>
-  </body>
-</html>`;
-const htmlError = (message) => `<!doctype html>
-<html>
-  <head>
-    <title>Codex Authorization Failed</title>
-  </head>
-  <body>
-    <h1>Authorization Failed</h1>
-    <p>${message}</p>
-  </body>
-</html>`;
-function base64UrlEncode(input) {
-    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
-    return Buffer.from(bytes)
-        .toString("base64")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/g, "");
-}
-function generateRandomString(length) {
-    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
-    const bytes = randomBytes(length);
-    return Array.from(bytes, (byte) => chars[byte % chars.length]).join("");
-}
-async function generatePKCE() {
-    const verifier = generateRandomString(43);
-    const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
-    return { verifier, challenge };
-}
-function generateState() {
-    return base64UrlEncode(randomBytes(32));
-}
-export function parseJwtClaims(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3)
-        return undefined;
-    try {
-        return JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    }
-    catch {
-        return undefined;
-    }
-}
-export function extractAccountIdFromClaims(claims) {
-    return (claims.chatgpt_account_id
-        || claims["https://api.openai.com/auth"]?.chatgpt_account_id
-        || claims.organizations?.[0]?.id);
-}
-export function extractAccountId(tokens) {
-    if (tokens.id_token) {
-        const claims = parseJwtClaims(tokens.id_token);
-        const accountId = claims && extractAccountIdFromClaims(claims);
-        if (accountId)
-            return accountId;
-    }
-    if (!tokens.access_token)
-        return undefined;
-    const claims = parseJwtClaims(tokens.access_token);
-    return claims ? extractAccountIdFromClaims(claims) : undefined;
-}
-function pickWorkspaceLikeLabel(input) {
-    if (!input)
-        return undefined;
-    return input.workspace_name ?? input.display_name ?? input.name ?? input.slug ?? input.id;
-}
-export function extractWorkspaceNameFromClaims(claims) {
-    return (claims.workspace_name
-        || claims["https://api.openai.com/auth"]?.workspace_name
-        || claims["https://api.openai.com/auth"]?.workspace_id
-        || claims["https://api.openai.com/auth"]?.organization_id
-        || pickWorkspaceLikeLabel(claims.workspace)
-        || pickWorkspaceLikeLabel(claims.organization)
-        || pickWorkspaceLikeLabel(claims.organizations?.[0]));
-}
-export function extractWorkspaceName(tokens) {
-    if (tokens.id_token) {
-        const claims = parseJwtClaims(tokens.id_token);
-        const workspaceName = claims && extractWorkspaceNameFromClaims(claims);
-        if (workspaceName)
-            return workspaceName;
-    }
-    if (!tokens.access_token)
-        return undefined;
-    const claims = parseJwtClaims(tokens.access_token);
-    return claims ? extractWorkspaceNameFromClaims(claims) : undefined;
-}
-function extractEmail(tokens) {
-    if (tokens.id_token) {
-        const claims = parseJwtClaims(tokens.id_token);
-        if (claims?.email)
-            return claims.email;
-    }
-    if (!tokens.access_token)
-        return undefined;
-    return parseJwtClaims(tokens.access_token)?.email;
-}
-function buildAuthorizeUrl(redirectUri, pkce, state) {
-    const params = new URLSearchParams({
-        response_type: "code",
-        client_id: CLIENT_ID,
-        redirect_uri: redirectUri,
-        scope: "openid profile email offline_access",
-        code_challenge: pkce.challenge,
-        code_challenge_method: "S256",
-        id_token_add_organizations: "true",
-        codex_cli_simplified_flow: "true",
-        state,
-        originator: "opencode",
-    });
-    return `${ISSUER}/oauth/authorize?${params.toString()}`;
-}
-async function promptText(message) {
-    const rl = createInterface({ input, output });
-    try {
-        return (await rl.question(message)).trim();
-    }
-    finally {
-        rl.close();
-    }
-}
-async function selectModeDefault() {
-    const value = (await promptText("OpenAI/Codex login mode ([1] browser, [2] headless, Enter to cancel): ")).toLowerCase();
-    if (!value)
-        return undefined;
-    if (value === "1" || value === "browser" || value === "b")
-        return "browser";
-    if (value === "2" || value === "headless" || value === "h" || value === "device")
-        return "headless";
-    return undefined;
-}
-async function openUrlDefault(url) {
-    if (process.platform === "win32") {
-        await new Promise((resolve, reject) => {
-            const child = spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", windowsHide: true });
-            child.on("error", reject);
-            child.on("exit", (code) => {
-                if (code && code !== 0)
-                    reject(new Error(`failed to open browser: ${code}`));
-                else
-                    resolve();
-            });
-        });
-        return;
-    }
-    const command = process.platform === "darwin" ? "open" : "xdg-open";
-    await new Promise((resolve, reject) => {
-        const child = spawn(command, [url], { stdio: "ignore" });
-        child.on("error", reject);
-        child.on("exit", (code) => {
-            if (code && code !== 0)
-                reject(new Error(`failed to open browser: ${code}`));
-            else
-                resolve();
-        });
-    });
-}
-async function exchangeCodeForTokens(input) {
-    const response = await input.fetchImpl(`${ISSUER}/oauth/token`, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-            grant_type: "authorization_code",
-            code: input.code,
-            redirect_uri: input.redirectUri,
-            client_id: CLIENT_ID,
-            code_verifier: input.verifier,
-        }).toString(),
-    });
-    if (!response.ok) {
-        throw new Error(`Token exchange failed: ${response.status}`);
-    }
-    return response.json();
-}
-async function runBrowserAuthDefault(input) {
-    const pkce = await generatePKCE();
-    const state = generateState();
-    const redirectUri = `http://localhost:${OAUTH_PORT}/auth/callback`;
-    const authUrl = buildAuthorizeUrl(redirectUri, pkce, state);
-    const tokens = await new Promise((resolve, reject) => {
-        let closed = false;
-        const finish = (handler) => {
-            if (closed)
-                return;
-            closed = true;
-            clearTimeout(timeout);
-            void server.close(() => handler());
-        };
-        const respond = (res, status, body) => {
-            res.statusCode = status;
-            res.setHeader("Content-Type", "text/html");
-            res.end(body);
-        };
-        const server = createServer((req, res) => {
-            const url = new URL(req.url ?? "/", redirectUri);
-            if (url.pathname !== "/auth/callback") {
-                respond(res, 404, htmlError("Not found"));
-                return;
-            }
-            const code = url.searchParams.get("code");
-            const returnedState = url.searchParams.get("state");
-            const error = url.searchParams.get("error");
-            const errorDescription = url.searchParams.get("error_description");
-            if (error) {
-                const message = errorDescription || error;
-                respond(res, 400, htmlError(message));
-                finish(() => reject(new Error(message)));
-                return;
-            }
-            if (!code) {
-                respond(res, 400, htmlError("Missing authorization code"));
-                finish(() => reject(new Error("Missing authorization code")));
-                return;
-            }
-            if (returnedState !== state) {
-                respond(res, 400, htmlError("Invalid state - potential CSRF attack"));
-                finish(() => reject(new Error("Invalid state - potential CSRF attack")));
-                return;
-            }
-            respond(res, 200, HTML_SUCCESS);
-            void exchangeCodeForTokens({
-                code,
-                redirectUri,
-                verifier: pkce.verifier,
-                fetchImpl: input.fetchImpl,
-            }).then((result) => finish(() => resolve(result)), (error) => finish(() => reject(error instanceof Error ? error : new Error(String(error)))));
-        });
-        server.on("error", reject);
-        server.listen(OAUTH_PORT, async () => {
-            try {
-                input.log("Opening browser for OpenAI/Codex authorization...");
-                await input.openUrl(authUrl);
-            }
-            catch (error) {
-                finish(() => reject(error instanceof Error ? error : new Error(String(error))));
-            }
-        });
-        const timeout = setTimeout(() => {
-            finish(() => reject(new Error("OAuth callback timeout - authorization took too long")));
-        }, input.timeoutMs);
-    });
-    return tokens;
-}
-async function runDeviceAuthDefault(input) {
-    const deadline = Date.now() + input.timeoutMs;
-    const deviceResponse = await input.fetchImpl(`${ISSUER}/api/accounts/deviceauth/usercode`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "User-Agent": USER_AGENT,
-        },
-        body: JSON.stringify({ client_id: CLIENT_ID }),
-    });
-    if (!deviceResponse.ok)
-        throw new Error("Failed to initiate device authorization");
-    const deviceData = await deviceResponse.json();
-    const interval = Math.max(parseInt(deviceData.interval) || 5, 1) * 1000;
-    input.log(`Open ${ISSUER}/codex/device and enter code: ${deviceData.user_code}`);
-    while (true) {
-        if (Date.now() >= deadline) {
-            throw new Error("Device authorization timeout - authorization took too long");
-        }
-        const response = await input.fetchImpl(`${ISSUER}/api/accounts/deviceauth/token`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "User-Agent": USER_AGENT,
-            },
-            body: JSON.stringify({
-                device_auth_id: deviceData.device_auth_id,
-                user_code: deviceData.user_code,
-            }),
-        });
-        if (response.ok) {
-            const data = await response.json();
-            return exchangeCodeForTokens({
-                code: data.authorization_code,
-                redirectUri: `${ISSUER}/deviceauth/callback`,
-                verifier: data.code_verifier,
-                fetchImpl: input.fetchImpl,
-            });
-        }
-        if (response.status !== 403 && response.status !== 404) {
-            throw new Error(`Device authorization failed: ${response.status}`);
-        }
-        if (Date.now() + interval + OAUTH_POLLING_SAFETY_MARGIN_MS >= deadline) {
-            throw new Error("Device authorization timeout - authorization took too long");
-        }
-        await new Promise((resolve) => setTimeout(resolve, interval + OAUTH_POLLING_SAFETY_MARGIN_MS));
-    }
-}
-function normalizeTokens(tokens, now) {
-    const refresh = tokens.refresh_token;
-    const access = tokens.access_token;
-    if (!refresh && !access)
-        return undefined;
-    const workspaceName = extractWorkspaceName(tokens);
-    return {
-        refresh,
-        access,
-        expires: now() + (tokens.expires_in ?? 3600) * 1000,
-        accountId: extractAccountId(tokens),
-        email: extractEmail(tokens),
-        ...(workspaceName ? { workspaceName } : {}),
-    };
-}
-export async function runCodexOAuth(input = {}) {
-    const now = input.now ?? Date.now;
-    const timeoutMs = input.timeoutMs ?? OAUTH_TIMEOUT_MS;
-    const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-    const selectMode = input.selectMode ?? selectModeDefault;
-    const openUrl = input.openUrl ?? openUrlDefault;
-    const log = input.log ?? console.log;
-    const mode = await selectMode();
-    if (!mode)
-        return undefined;
-    const runBrowserAuth = input.runBrowserAuth ?? (() => runBrowserAuthDefault({ fetchImpl, openUrl, log, timeoutMs }));
-    const runDeviceAuth = input.runDeviceAuth ?? (() => runDeviceAuthDefault({ fetchImpl, log, timeoutMs }));
-    const tokens = mode === "headless" ? await runDeviceAuth() : await runBrowserAuth();
-    return normalizeTokens(tokens, now);
-}