thaddeus 1.0.18 → 1.0.27

package/src/services/notifier.js

@@ -0,0 +1,114 @@
+import { getGlobalConfig } from '../utils/config.js';
+import { env } from '../utils/env.js';
+import { execFileNoThrow } from '../utils/execFileNoThrow.js';
+import { executeNotificationHooks } from '../utils/hooks.js';
+import { logError } from '../utils/log.js';
+import { logEvent, } from './analytics/index.js';
+export async function sendNotification(notif, terminal) {
+    const config = getGlobalConfig();
+    const channel = config.preferredNotifChannel;
+    await executeNotificationHooks(notif);
+    const methodUsed = await sendToChannel(channel, notif, terminal);
+    logEvent('thaddeus_notification_method_used', {
+        configured_channel: channel,
+        method_used: methodUsed,
+        term: env.terminal,
+    });
+}
+const DEFAULT_TITLE = 'Thaddeus';
+async function sendToChannel(channel, opts, terminal) {
+    const title = opts.title || DEFAULT_TITLE;
+    try {
+        switch (channel) {
+            case 'auto':
+                return sendAuto(opts, terminal);
+            case 'iterm2':
+                terminal.notifyITerm2(opts);
+                return 'iterm2';
+            case 'iterm2_with_bell':
+                terminal.notifyITerm2(opts);
+                terminal.notifyBell();
+                return 'iterm2_with_bell';
+            case 'kitty':
+                terminal.notifyKitty({ ...opts, title, id: generateKittyId() });
+                return 'kitty';
+            case 'ghostty':
+                terminal.notifyGhostty({ ...opts, title });
+                return 'ghostty';
+            case 'terminal_bell':
+                terminal.notifyBell();
+                return 'terminal_bell';
+            case 'notifications_disabled':
+                return 'disabled';
+            default:
+                return 'none';
+        }
+    }
+    catch {
+        return 'error';
+    }
+}
+async function sendAuto(opts, terminal) {
+    const title = opts.title || DEFAULT_TITLE;
+    switch (env.terminal) {
+        case 'Apple_Terminal': {
+            const bellDisabled = await isAppleTerminalBellDisabled();
+            if (bellDisabled) {
+                terminal.notifyBell();
+                return 'terminal_bell';
+            }
+            return 'no_method_available';
+        }
+        case 'iTerm.app':
+            terminal.notifyITerm2(opts);
+            return 'iterm2';
+        case 'kitty':
+            terminal.notifyKitty({ ...opts, title, id: generateKittyId() });
+            return 'kitty';
+        case 'ghostty':
+            terminal.notifyGhostty({ ...opts, title });
+            return 'ghostty';
+        default:
+            return 'no_method_available';
+    }
+}
+function generateKittyId() {
+    return Math.floor(Math.random() * 10000);
+}
+async function isAppleTerminalBellDisabled() {
+    try {
+        if (env.terminal !== 'Apple_Terminal') {
+            return false;
+        }
+        const osascriptResult = await execFileNoThrow('osascript', [
+            '-e',
+            'tell application "Terminal" to name of current settings of front window',
+        ]);
+        const currentProfile = osascriptResult.stdout.trim();
+        if (!currentProfile) {
+            return false;
+        }
+        const defaultsOutput = await execFileNoThrow('defaults', [
+            'export',
+            'com.apple.Terminal',
+            '-',
+        ]);
+        if (defaultsOutput.code !== 0) {
+            return false;
+        }
+        // Lazy-load plist (~280KB with xmlbuilder+@xmldom) — only hit on
+        // Apple_Terminal with auto-channel, which is a small fraction of users.
+        const plist = await import('plist');
+        const parsed = plist.parse(defaultsOutput.stdout);
+        const windowSettings = parsed?.['Window Settings'];
+        const profileSettings = windowSettings?.[currentProfile];
+        if (!profileSettings) {
+            return false;
+        }
+        return profileSettings.Bell === false;
+    }
+    catch (error) {
+        logError(error);
+        return false;
+    }
+}

package/src/services/oauth/auth-code-listener.js

@@ -0,0 +1,165 @@
+import { createServer } from 'http';
+import { logEvent } from 'src/services/analytics/index.js';
+import { getOauthConfig } from '../../constants/oauth.js';
+import { logError } from '../../utils/log.js';
+import { shouldUseClaudeAIAuth } from './client.js';
+/**
+ * Temporary localhost HTTP server that listens for OAuth authorization code redirects.
+ *
+ * When the user authorizes in their browser, the OAuth provider redirects to:
+ * http://localhost:[port]/callback?code=AUTH_CODE&state=STATE
+ *
+ * This server captures that redirect and extracts the auth code.
+ * Note: This is NOT an OAuth server - it's just a redirect capture mechanism.
+ */
+export class AuthCodeListener {
+    localServer;
+    port = 0;
+    promiseResolver = null;
+    promiseRejecter = null;
+    expectedState = null; // State parameter for CSRF protection
+    pendingResponse = null; // Response object for final redirect
+    callbackPath; // Configurable callback path
+    constructor(callbackPath = '/callback') {
+        this.localServer = createServer();
+        this.callbackPath = callbackPath;
+    }
+    /**
+     * Starts listening on an OS-assigned port and returns the port number.
+     * This avoids race conditions by keeping the server open until it's used.
+     * @param port Optional specific port to use. If not provided, uses OS-assigned port.
+     */
+    async start(port) {
+        return new Promise((resolve, reject) => {
+            this.localServer.once('error', err => {
+                reject(new Error(`Failed to start OAuth callback server: ${err.message}`));
+            });
+            // Listen on specified port or 0 to let the OS assign an available port
+            this.localServer.listen(port ?? 0, 'localhost', () => {
+                const address = this.localServer.address();
+                this.port = address.port;
+                resolve(this.port);
+            });
+        });
+    }
+    getPort() {
+        return this.port;
+    }
+    hasPendingResponse() {
+        return this.pendingResponse !== null;
+    }
+    async waitForAuthorization(state, onReady) {
+        return new Promise((resolve, reject) => {
+            this.promiseResolver = resolve;
+            this.promiseRejecter = reject;
+            this.expectedState = state;
+            this.startLocalListener(onReady);
+        });
+    }
+    /**
+     * Completes the OAuth flow by redirecting the user's browser to a success page.
+     * Different success pages are shown based on the granted scopes.
+     * @param scopes The OAuth scopes that were granted
+     * @param customHandler Optional custom handler to serve response instead of redirecting
+     */
+    handleSuccessRedirect(scopes, customHandler) {
+        if (!this.pendingResponse)
+            return;
+        // If custom handler provided, use it instead of default redirect
+        if (customHandler) {
+            customHandler(this.pendingResponse, scopes);
+            this.pendingResponse = null;
+            logEvent('thaddeus_oauth_automatic_redirect', { custom_handler: true });
+            return;
+        }
+        // Default behavior: Choose success page based on granted permissions
+        const successUrl = shouldUseClaudeAIAuth(scopes)
+            ? getOauthConfig().CLAUDEAI_SUCCESS_URL
+            : getOauthConfig().CONSOLE_SUCCESS_URL;
+        // Send browser to success page
+        this.pendingResponse.writeHead(302, { Location: successUrl });
+        this.pendingResponse.end();
+        this.pendingResponse = null;
+        logEvent('thaddeus_oauth_automatic_redirect', {});
+    }
+    /**
+     * Handles error case by sending a redirect to the appropriate success page with an error indicator,
+     * ensuring the browser flow is completed properly.
+     */
+    handleErrorRedirect() {
+        if (!this.pendingResponse)
+            return;
+        // TODO: swap to a different url once we have an error page
+        const errorUrl = getOauthConfig().CLAUDEAI_SUCCESS_URL;
+        // Send browser to error page
+        this.pendingResponse.writeHead(302, { Location: errorUrl });
+        this.pendingResponse.end();
+        this.pendingResponse = null;
+        logEvent('thaddeus_oauth_automatic_redirect_error', {});
+    }
+    startLocalListener(onReady) {
+        // Server is already created and listening, just set up handlers
+        this.localServer.on('request', this.handleRedirect.bind(this));
+        this.localServer.on('error', this.handleError.bind(this));
+        // Server is already listening, so we can call onReady immediately
+        void onReady();
+    }
+    handleRedirect(req, res) {
+        const parsedUrl = new URL(req.url || '', `http://${req.headers.host || 'localhost'}`);
+        if (parsedUrl.pathname !== this.callbackPath) {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        const authCode = parsedUrl.searchParams.get('code') ?? undefined;
+        const state = parsedUrl.searchParams.get('state') ?? undefined;
+        this.validateAndRespond(authCode, state, res);
+    }
+    validateAndRespond(authCode, state, res) {
+        if (!authCode) {
+            res.writeHead(400);
+            res.end('Authorization code not found');
+            this.reject(new Error('No authorization code received'));
+            return;
+        }
+        if (state !== this.expectedState) {
+            res.writeHead(400);
+            res.end('Invalid state parameter');
+            this.reject(new Error('Invalid state parameter'));
+            return;
+        }
+        // Store the response for later redirect
+        this.pendingResponse = res;
+        this.resolve(authCode);
+    }
+    handleError(err) {
+        logError(err);
+        this.close();
+        this.reject(err);
+    }
+    resolve(authorizationCode) {
+        if (this.promiseResolver) {
+            this.promiseResolver(authorizationCode);
+            this.promiseResolver = null;
+            this.promiseRejecter = null;
+        }
+    }
+    reject(error) {
+        if (this.promiseRejecter) {
+            this.promiseRejecter(error);
+            this.promiseResolver = null;
+            this.promiseRejecter = null;
+        }
+    }
+    close() {
+        // If we have a pending response, send a redirect before closing
+        if (this.pendingResponse) {
+            this.handleErrorRedirect();
+        }
+        if (this.localServer) {
+            // Remove all listeners to prevent memory leaks
+            this.localServer.removeAllListeners();
+            this.localServer.close();
+        }
+    }
+}

package/src/services/oauth/client.js

@@ -0,0 +1,397 @@
+// OAuth client for handling authentication flows with Thaddeus services
+import axios from 'axios';
+import { logEvent, } from 'src/services/analytics/index.js';
+import { ALL_OAUTH_SCOPES, THADDEUS_INFERENCE_SCOPE, THADDEUS_OAUTH_SCOPES, getOauthConfig, } from '../../constants/oauth.js';
+import { checkAndRefreshOAuthTokenIfNeeded, getClaudeAIOAuthTokens, hasProfileScope, isClaudeAISubscriber, saveApiKey, } from '../../utils/auth.js';
+import { getGlobalConfig, saveGlobalConfig } from '../../utils/config.js';
+import { logForDebugging } from '../../utils/debug.js';
+import { getOauthProfileFromOauthToken } from './getOauthProfile.js';
+/**
+ * Check if the user has Claude.ai authentication scope
+ * @private Only call this if you're OAuth / auth related code!
+ */
+export function shouldUseClaudeAIAuth(scopes) {
+    return Boolean(scopes?.includes(THADDEUS_INFERENCE_SCOPE));
+}
+export function parseScopes(scopeString) {
+    return scopeString?.split(' ').filter(Boolean) ?? [];
+}
+export function buildAuthUrl({ codeChallenge, state, port, isManual, loginWithClaudeAi, inferenceOnly, orgUUID, loginHint, loginMethod, }) {
+    const authUrlBase = loginWithClaudeAi
+        ? getOauthConfig().THADDEUS_AUTHORIZE_URL
+        : getOauthConfig().CONSOLE_AUTHORIZE_URL;
+    const authUrl = new URL(authUrlBase);
+    authUrl.searchParams.append('code', 'true'); // this tells the login page to show Claude Max upsell
+    authUrl.searchParams.append('client_id', getOauthConfig().CLIENT_ID);
+    authUrl.searchParams.append('response_type', 'code');
+    authUrl.searchParams.append('redirect_uri', isManual
+        ? getOauthConfig().MANUAL_REDIRECT_URL
+        : `http://localhost:${port}/callback`);
+    const scopesToUse = inferenceOnly
+        ? [THADDEUS_INFERENCE_SCOPE] // Long-lived inference-only tokens
+        : ALL_OAUTH_SCOPES;
+    authUrl.searchParams.append('scope', scopesToUse.join(' '));
+    authUrl.searchParams.append('code_challenge', codeChallenge);
+    authUrl.searchParams.append('code_challenge_method', 'S256');
+    authUrl.searchParams.append('state', state);
+    // Add orgUUID as URL param if provided
+    if (orgUUID) {
+        authUrl.searchParams.append('orgUUID', orgUUID);
+    }
+    // Pre-populate email on the login form (standard OIDC parameter)
+    if (loginHint) {
+        authUrl.searchParams.append('login_hint', loginHint);
+    }
+    // Request a specific login method (e.g. 'sso', 'magic_link', 'google')
+    if (loginMethod) {
+        authUrl.searchParams.append('login_method', loginMethod);
+    }
+    return authUrl.toString();
+}
+export async function exchangeCodeForTokens(authorizationCode, state, codeVerifier, port, useManualRedirect = false, expiresIn) {
+    const requestBody = {
+        grant_type: 'authorization_code',
+        code: authorizationCode,
+        redirect_uri: useManualRedirect
+            ? getOauthConfig().MANUAL_REDIRECT_URL
+            : `http://localhost:${port}/callback`,
+        client_id: getOauthConfig().CLIENT_ID,
+        code_verifier: codeVerifier,
+        state,
+    };
+    if (expiresIn !== undefined) {
+        requestBody.expires_in = expiresIn;
+    }
+    const response = await axios.post(getOauthConfig().TOKEN_URL, requestBody, {
+        headers: { 'Content-Type': 'application/json' },
+        timeout: 15000,
+    });
+    if (response.status !== 200) {
+        throw new Error(response.status === 401
+            ? 'Authentication failed: Invalid authorization code'
+            : `Token exchange failed (${response.status}): ${response.statusText}`);
+    }
+    logEvent('thaddeus_oauth_token_exchange_success', {});
+    return response.data;
+}
+export async function refreshOAuthToken(refreshToken, { scopes: requestedScopes } = {}) {
+    const requestBody = {
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: getOauthConfig().CLIENT_ID,
+        // Request specific scopes, defaulting to the full Claude AI set. The
+        // backend's refresh-token grant allows scope expansion beyond what the
+        // initial authorize granted (see ALLOWED_SCOPE_EXPANSIONS), so this is
+        // safe even for tokens issued before scopes were added to the app's
+        // registered oauth_scope.
+        scope: (requestedScopes?.length
+            ? requestedScopes
+            : THADDEUS_OAUTH_SCOPES).join(' '),
+    };
+    try {
+        const response = await axios.post(getOauthConfig().TOKEN_URL, requestBody, {
+            headers: { 'Content-Type': 'application/json' },
+            timeout: 15000,
+        });
+        if (response.status !== 200) {
+            throw new Error(`Token refresh failed: ${response.statusText}`);
+        }
+        const data = response.data;
+        const { access_token: accessToken, refresh_token: newRefreshToken = refreshToken, expires_in: expiresIn, } = data;
+        const expiresAt = Date.now() + expiresIn * 1000;
+        const scopes = parseScopes(data.scope);
+        logEvent('thaddeus_oauth_token_refresh_success', {});
+        // Skip the extra /api/oauth/profile round-trip when we already have both
+        // the global-config profile fields AND the secure-storage subscription data.
+        // Routine refreshes satisfy both, so we cut ~7M req/day fleet-wide.
+        //
+        // Checking secure storage (not just config) matters for the
+        // THADDEUS_OAUTH_REFRESH_TOKEN re-login path: installOAuthTokens runs
+        // performLogout() AFTER we return, wiping secure storage. If we returned
+        // null for subscriptionType here, saveOAuthTokensIfNeeded would persist
+        // null ?? (wiped) ?? null = null, and every future refresh would see the
+        // config guard fields satisfied and skip again, permanently losing the
+        // subscription type for paying users. By passing through existing values,
+        // the re-login path writes cached ?? wiped ?? null = cached; and if secure
+        // storage was already empty we fall through to the fetch.
+        const config = getGlobalConfig();
+        const existing = getClaudeAIOAuthTokens();
+        const haveProfileAlready = config.oauthAccount?.billingType !== undefined &&
+            config.oauthAccount?.accountCreatedAt !== undefined &&
+            config.oauthAccount?.subscriptionCreatedAt !== undefined &&
+            existing?.subscriptionType != null &&
+            existing?.rateLimitTier != null;
+        const profileInfo = haveProfileAlready
+            ? null
+            : await fetchProfileInfo(accessToken);
+        // Update the stored properties if they have changed
+        if (profileInfo && config.oauthAccount) {
+            const updates = {};
+            if (profileInfo.displayName !== undefined) {
+                updates.displayName = profileInfo.displayName;
+            }
+            if (typeof profileInfo.hasExtraUsageEnabled === 'boolean') {
+                updates.hasExtraUsageEnabled = profileInfo.hasExtraUsageEnabled;
+            }
+            if (profileInfo.billingType !== null) {
+                updates.billingType = profileInfo.billingType;
+            }
+            if (profileInfo.accountCreatedAt !== undefined) {
+                updates.accountCreatedAt = profileInfo.accountCreatedAt;
+            }
+            if (profileInfo.subscriptionCreatedAt !== undefined) {
+                updates.subscriptionCreatedAt = profileInfo.subscriptionCreatedAt;
+            }
+            if (Object.keys(updates).length > 0) {
+                saveGlobalConfig(current => ({
+                    ...current,
+                    oauthAccount: current.oauthAccount
+                        ? { ...current.oauthAccount, ...updates }
+                        : current.oauthAccount,
+                }));
+            }
+        }
+        return {
+            accessToken,
+            refreshToken: newRefreshToken,
+            expiresAt,
+            scopes,
+            subscriptionType: profileInfo?.subscriptionType ?? existing?.subscriptionType ?? null,
+            rateLimitTier: profileInfo?.rateLimitTier ?? existing?.rateLimitTier ?? null,
+            profile: profileInfo?.rawProfile,
+            tokenAccount: data.account
+                ? {
+                    uuid: data.account.uuid,
+                    emailAddress: data.account.email_address,
+                    organizationUuid: data.organization?.uuid,
+                }
+                : undefined,
+        };
+    }
+    catch (error) {
+        const responseBody = axios.isAxiosError(error) && error.response?.data
+            ? JSON.stringify(error.response.data)
+            : undefined;
+        logEvent('thaddeus_oauth_token_refresh_failure', {
+            error: error
+                .message,
+            ...(responseBody && {
+                responseBody: responseBody,
+            }),
+        });
+        throw error;
+    }
+}
+export async function fetchAndStoreUserRoles(accessToken) {
+    const response = await axios.get(getOauthConfig().ROLES_URL, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (response.status !== 200) {
+        throw new Error(`Failed to fetch user roles: ${response.statusText}`);
+    }
+    const data = response.data;
+    const config = getGlobalConfig();
+    if (!config.oauthAccount) {
+        throw new Error('OAuth account information not found in config');
+    }
+    saveGlobalConfig(current => ({
+        ...current,
+        oauthAccount: current.oauthAccount
+            ? {
+                ...current.oauthAccount,
+                organizationRole: data.organization_role,
+                workspaceRole: data.workspace_role,
+                organizationName: data.organization_name,
+            }
+            : current.oauthAccount,
+    }));
+    logEvent('thaddeus_oauth_roles_stored', {
+        org_role: data.organization_role,
+    });
+}
+export async function createAndStoreApiKey(accessToken) {
+    try {
+        const response = await axios.post(getOauthConfig().API_KEY_URL, null, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        const apiKey = response.data?.raw_key;
+        if (apiKey) {
+            await saveApiKey(apiKey);
+            logEvent('thaddeus_oauth_api_key', {
+                status: 'success',
+                statusCode: response.status,
+            });
+            return apiKey;
+        }
+        return null;
+    }
+    catch (error) {
+        logEvent('thaddeus_oauth_api_key', {
+            status: 'failure',
+            error: (error instanceof Error
+                ? error.message
+                : String(error)),
+        });
+        throw error;
+    }
+}
+export function isOAuthTokenExpired(expiresAt) {
+    if (expiresAt === null) {
+        return false;
+    }
+    const bufferTime = 5 * 60 * 1000;
+    const now = Date.now();
+    const expiresWithBuffer = now + bufferTime;
+    return expiresWithBuffer >= expiresAt;
+}
+export async function fetchProfileInfo(accessToken) {
+    const profile = await getOauthProfileFromOauthToken(accessToken);
+    const orgType = profile?.organization?.organization_type;
+    // Reuse the logic from fetchSubscriptionType
+    let subscriptionType = null;
+    switch (orgType) {
+        case 'claude_max':
+            subscriptionType = 'max';
+            break;
+        case 'claude_pro':
+            subscriptionType = 'pro';
+            break;
+        case 'claude_enterprise':
+            subscriptionType = 'enterprise';
+            break;
+        case 'claude_team':
+            subscriptionType = 'team';
+            break;
+        default:
+            // Return null for unknown organization types
+            subscriptionType = null;
+            break;
+    }
+    const result = {
+        subscriptionType,
+        rateLimitTier: profile?.organization?.rate_limit_tier ?? null,
+        hasExtraUsageEnabled: profile?.organization?.has_extra_usage_enabled ?? null,
+        billingType: profile?.organization?.billing_type ?? null,
+    };
+    if (profile?.account?.display_name) {
+        result.displayName = profile.account.display_name;
+    }
+    if (profile?.account?.created_at) {
+        result.accountCreatedAt = profile.account.created_at;
+    }
+    if (profile?.organization?.subscription_created_at) {
+        result.subscriptionCreatedAt = profile.organization.subscription_created_at;
+    }
+    logEvent('thaddeus_oauth_profile_fetch_success', {});
+    return { ...result, rawProfile: profile };
+}
+/**
+ * Gets the organization UUID from the OAuth access token
+ * @returns The organization UUID or null if not authenticated
+ */
+export async function getOrganizationUUID() {
+    // Check global config first to avoid unnecessary API call
+    const globalConfig = getGlobalConfig();
+    const orgUUID = globalConfig.oauthAccount?.organizationUuid;
+    if (orgUUID) {
+        return orgUUID;
+    }
+    // Fall back to fetching from profile (requires user:profile scope)
+    const accessToken = getClaudeAIOAuthTokens()?.accessToken;
+    if (accessToken === undefined || !hasProfileScope()) {
+        return null;
+    }
+    const profile = await getOauthProfileFromOauthToken(accessToken);
+    const profileOrgUUID = profile?.organization?.uuid;
+    if (!profileOrgUUID) {
+        return null;
+    }
+    return profileOrgUUID;
+}
+/**
+ * Populate the OAuth account info if it has not already been cached in config.
+ * @returns Whether or not the oauth account info was populated.
+ */
+export async function populateOAuthAccountInfoIfNeeded() {
+    // Check env vars first (synchronous, no network call needed).
+    // SDK callers like Cowork can provide account info directly, which also
+    // eliminates the race condition where early telemetry events lack account info.
+    // NB: If/when adding additional SDK-relevant functionality requiring _other_ OAuth account properties,
+    // please reach out to #proj-cowork so the team can add additional env var fallbacks.
+    const envAccountUuid = process.env.THADDEUS_ACCOUNT_UUID;
+    const envUserEmail = process.env.THADDEUS_USER_EMAIL;
+    const envOrganizationUuid = process.env.THADDEUS_ORGANIZATION_UUID;
+    const hasEnvVars = Boolean(envAccountUuid && envUserEmail && envOrganizationUuid);
+    if (envAccountUuid && envUserEmail && envOrganizationUuid) {
+        if (!getGlobalConfig().oauthAccount) {
+            storeOAuthAccountInfo({
+                accountUuid: envAccountUuid,
+                emailAddress: envUserEmail,
+                organizationUuid: envOrganizationUuid,
+            });
+        }
+    }
+    // Wait for any in-flight token refresh to complete first, since
+    // refreshOAuthToken already fetches and stores profile info
+    await checkAndRefreshOAuthTokenIfNeeded();
+    const config = getGlobalConfig();
+    if ((config.oauthAccount &&
+        config.oauthAccount.billingType !== undefined &&
+        config.oauthAccount.accountCreatedAt !== undefined &&
+        config.oauthAccount.subscriptionCreatedAt !== undefined) ||
+        !isClaudeAISubscriber() ||
+        !hasProfileScope()) {
+        return false;
+    }
+    const tokens = getClaudeAIOAuthTokens();
+    if (tokens?.accessToken) {
+        const profile = await getOauthProfileFromOauthToken(tokens.accessToken);
+        if (profile) {
+            if (hasEnvVars) {
+                logForDebugging('OAuth profile fetch succeeded, overriding env var account info', { level: 'info' });
+            }
+            storeOAuthAccountInfo({
+                accountUuid: profile.account.uuid,
+                emailAddress: profile.account.email,
+                organizationUuid: profile.organization.uuid,
+                displayName: profile.account.display_name || undefined,
+                hasExtraUsageEnabled: profile.organization.has_extra_usage_enabled ?? false,
+                billingType: profile.organization.billing_type ?? undefined,
+                accountCreatedAt: profile.account.created_at,
+                subscriptionCreatedAt: profile.organization.subscription_created_at ?? undefined,
+            });
+            return true;
+        }
+    }
+    return false;
+}
+export function storeOAuthAccountInfo({ accountUuid, emailAddress, organizationUuid, displayName, hasExtraUsageEnabled, billingType, accountCreatedAt, subscriptionCreatedAt, }) {
+    const accountInfo = {
+        accountUuid,
+        emailAddress,
+        organizationUuid,
+        hasExtraUsageEnabled,
+        billingType,
+        accountCreatedAt,
+        subscriptionCreatedAt,
+    };
+    if (displayName) {
+        accountInfo.displayName = displayName;
+    }
+    saveGlobalConfig(current => {
+        // For oauthAccount we need to compare content since it's an object
+        if (current.oauthAccount?.accountUuid === accountInfo.accountUuid &&
+            current.oauthAccount?.emailAddress === accountInfo.emailAddress &&
+            current.oauthAccount?.organizationUuid === accountInfo.organizationUuid &&
+            current.oauthAccount?.displayName === accountInfo.displayName &&
+            current.oauthAccount?.hasExtraUsageEnabled ===
+                accountInfo.hasExtraUsageEnabled &&
+            current.oauthAccount?.billingType === accountInfo.billingType &&
+            current.oauthAccount?.accountCreatedAt === accountInfo.accountCreatedAt &&
+            current.oauthAccount?.subscriptionCreatedAt ===
+                accountInfo.subscriptionCreatedAt) {
+            return current;
+        }
+        return { ...current, oauthAccount: accountInfo };
+    });
+}