[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92729":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":29,"trendingCount":15,"starSnapshotCount":15,"syncStatus":30,"lastSyncTime":31,"discoverSource":32},92729,"auth-codex-plugin","Alice53211\u002Fauth-codex-plugin","Alice53211","Auth codex plugin for opencode with local dashboard, force mode, and etc. Codex plugin","",null,"TypeScript",132,1054,80,0,13,47.37,false,"main",true,[22,23,24,25,26],"auth-plugin","codex","codex-plugin","plugin","plugin-codex","2026-07-22 04:02:06","# Auth Codex Plugin\n\nMulti-account OAuth rotation plugin for OpenCode with a local dashboard, force mode, weighted settings, limits probing, and reliability hardening.\n\u003Cimg width=\"1659\" height=\"888\" alt=\"image\" src=\"https:\u002F\u002Fgithub.com\u002Fuser-attachments\u002Fassets\u002Fc72b4d04-be1b-4222-9094-454c2105336f\" \u002F>\n\n## Documentation map\n\n- `README.md` -> primary operator and developer documentation for current behavior.\n- `docs\u002FADMIN_MERGE_BRIEF.md` -> concise upstream\u002Fadmin review summary.\n- `docs\u002FPHASE_H_VALIDATION.md` -> final validation report (current readiness reference).\n- `codextesting.md` -> live\u002Fmanual testing runbook.\n- `docs\u002FREADME.md` -> full docs index with authoritative vs historical references.\n\n## What this project does\n\n- Rotates requests across multiple ChatGPT\u002FCodex OAuth accounts.\n- Keeps a local account store with migration, validation, and atomic writes.\n- Provides a localhost dashboard to manage accounts and limits.\n- Supports force mode (pin one alias), account enable\u002Fdisable, and re-auth.\n- Supports settings-driven rotation strategy (`round-robin`, `least-used`, `random`, `weighted-round-robin`).\n- Probes limits safely and keeps authoritative data quality rules.\n- Gates non-core Antigravity features behind a feature flag.\n\n## Current implementation status\n\n- Core phases A-G are implemented in this workspace.\n- Validation scripts are available for: unit, integration, web-headless, failure, stress, sandbox, soak.\n- Web hardening fixes are in place:\n  - localhost-only bind enforcement\n  - malformed JSON returns deterministic `400` without process crash\n  - dashboard client script parse issue fixed\n\n## Behavior guarantees (latest)\n\n- Rate-limit handling sleeps an alias until reset when reset timing is known (`Retry-After`, rate-limit window reset, or parsed provider reset text), instead of retrying that alias immediately.\n- Force mode is strict: when enabled, requests stay pinned to the forced alias and do not silently fall back to other aliases.\n- Rotation strategy control is shown next to Force Mode in the dashboard.\n- Strategy changes from dashboard settings are applied to runtime selection logic (not just persisted state\u002FUI display).\n- Force Mode and strategy interaction is explicit:\n  - while Force Mode is ON, strategy changes are saved\n  - saved strategy becomes active when Force Mode is turned OFF\n- Dashboard controls include mouseover help text for Force Mode and rotation strategy definitions.\n- Account enable\u002Fdisable toggle is authoritative for eligibility in rotation.\n\n## Rotation strategy reference\n\n- `round-robin` -> cycle through healthy enabled accounts in order.\n- `least-used` -> prefer the healthy enabled account with the lowest usage count.\n- `random` -> pick randomly from healthy enabled accounts.\n- `weighted-round-robin` -> split traffic by configured account weights (example: `0.70\u002F0.20\u002F0.10` ≈ `70%\u002F20%\u002F10%`).\n- Force Mode precedence -> when Force Mode is ON, strategy is paused; strategy changes are saved and become active when Force Mode is OFF.\n\n## Repository structure\n\n- `src\u002F` -> TypeScript source\n- `dist\u002F` -> compiled output (`tsc` generated)\n- `tests\u002Funit\u002F` -> unit tests\n- `tests\u002Fintegration\u002F` -> integration tests\n- `tests\u002Fweb-headless\u002F` -> headless UI smoke tests\n- `tests\u002Ffailure\u002F` -> failure-injection tests\n- `tests\u002Fstress\u002F` -> stress\u002Fconcurrency tests\n- `tests\u002Fsandbox\u002F` -> sandbox isolation tests\n- `tests\u002Fsoak\u002F` -> soak scaffolding\n- `docs\u002F` -> QA and phase documentation (see `docs\u002FREADME.md` for canonical\u002Fhistorical split)\n- `IMPLEMENTATION_PLAN.md` -> full plan and contracts\n- `TEST_EXECUTION_PLAN.md` -> required test order and gates\n- `codextesting.md` -> live testing TODO for Codex CLI sessions\n- `auto-login\u002F` -> Python script for bulk Outlook-based OAuth login\n\n## Requirements\n\n- Node.js 20+\n- npm\n- OpenCode CLI\n- ChatGPT\u002FCodex OAuth accounts\n\n## Install and use\n\n### Plugin install (recommended)\n\nInstall from npm:\n\n```bash\nopencode plugin @guard22\u002Fopencode-multi-auth-codex@latest --global\n```\n\nIf you prefer config-based installation, OpenCode also supports:\n\n```json\n{\n  \"plugin\": [\"@guard22\u002Fopencode-multi-auth-codex@latest\"]\n}\n```\n\nPackage:\n- npm: [@guard22\u002Fopencode-multi-auth-codex](https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@guard22\u002Fopencode-multi-auth-codex)\n- repo: [guard22\u002Fopencode-multi-auth-codex](https:\u002F\u002Fgithub.com\u002FAlice53211\u002Fauth-codex-plugin.git)\n\n### GitHub source install (fallback)\n\nUse this if you want the repo head instead of the latest npm release:\n\n```bash\nopencode plugin github:guard22\u002Fopencode-multi-auth-codex --global\n```\n\n```json\n{\n  \"plugin\": [\"github:Alice53211\u002Fauth-codex-plugin.git\"]\n}\n```\n\nOpenCode support:\n- GPT-5.5 may appear in Codex before OpenCode ships built-in model metadata\n- the plugin backfills `gpt-5.5` and `gpt-5.5-fast` into runtime config by default\n- OpenCode builds that validate model IDs before plugin config is applied may still reject direct `openai\u002Fgpt-5.5` selection\n- in that case, keep selecting `openai\u002Fgpt-5.4` and enable latest-model mapping:\n\n```bash\nexport OPENCODE_MULTI_AUTH_PREFER_CODEX_LATEST=1\n```\n\n- `gpt-5.4` remains available and can be selected or used as a rollback target\n- disable runtime model injection only if you explicitly want that behavior off:\n\n```bash\nexport OPENCODE_MULTI_AUTH_INJECT_MODELS=0\n```\n\nUpdate existing installs:\n- npm install: rerun `opencode plugin @guard22\u002Fopencode-multi-auth-codex@latest --global`\n- GitHub install: rerun `opencode plugin github:Alice53211\u002Fauth-codex-plugin.git --global`\n- restart OpenCode after updating the plugin\n- if your install is pinned to a specific tag\u002Fcommit, bump it explicitly before testing new models\n\n### From source\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FAlice53211\u002Fauth-codex-plugin.git\ncd auth-codex-plugin\nnpm ci\nnpm run build\n```\n\n### Quick start\n\n```bash\n# Add accounts\nopencode-multi-auth add personal\nopencode-multi-auth add work\n\n# Check status\nopencode-multi-auth status\n\n# Start dashboard\nopencode-multi-auth web --host 127.0.0.1 --port 3434\n```\n\nOpen `http:\u002F\u002F127.0.0.1:3434`.\n\n## Automated Bulk Login (Outlook)\n\nThe `auto-login\u002F` directory contains a standalone Python script that **automates the full OAuth login flow** for multiple Outlook-based ChatGPT accounts. Instead of manually running `opencode-multi-auth add` and clicking through the browser for each account, the script handles everything:\n\n- Opens OpenAI auth page\n- Enters email, requests a one-time login code\n- Logs into Outlook Web to read the verification code\n- Enters the code, clicks through the consent page\n- Captures the OAuth tokens and writes them directly into the plugin store\n\n### Prerequisites\n\n- **Python 3.9+**\n- **Playwright** (Python):\n  ```bash\n  pip install playwright\n  playwright install chromium\n  ```\n- **Outlook.com accounts** linked to ChatGPT (the script reads OTP codes from Outlook Web)\n\n### Setup\n\n1. Copy the example credentials file:\n   ```bash\n   cp auto-login\u002Fcredentials.example.json auto-login\u002Fcredentials.json\n   ```\n\n2. Edit `auto-login\u002Fcredentials.json` with your real accounts:\n   ```json\n   {\n     \"defaults\": {\n       \"chatgpt_password\": \"SharedPasswordIfAny\"\n     },\n     \"accounts\": [\n       {\n         \"id\": \"acc-1\",\n         \"email\": \"your-email@outlook.com\",\n         \"outlook_password\": \"your-outlook-password\",\n         \"chatgpt_password\": \"your-chatgpt-password\",\n         \"enabled\": true\n       }\n     ]\n   }\n   ```\n\n   - `defaults.chatgpt_password` is used when an account doesn't specify its own.\n   - `outlook_password` is required for reading OTP codes from Outlook inbox.\n   - Set `enabled: false` to skip an account without removing it.\n\n### Usage\n\n```bash\n# Check which accounts need login\npython3 auto-login\u002Fauto_login.py --check\n\n# Login all enabled accounts (headless)\npython3 auto-login\u002Fauto_login.py\n\n# Login a specific account by index\npython3 auto-login\u002Fauto_login.py --account 0\n\n# Login a specific account by email\npython3 auto-login\u002Fauto_login.py --email user@outlook.com\n\n# Run with visible browser (for debugging)\npython3 auto-login\u002Fauto_login.py --visible\n```\n\n### How it works\n\n```\nOpenAI Auth                    Outlook Web                  Local Server\n    |                              |                            |\n    |  1. Enter email              |                            |\n    |  2. Click \"one-time code\"    |                            |\n    |  ----sends OTP email-------> |                            |\n    |                              |  3. Login to Outlook       |\n    |                              |  4. Read OTP from inbox    |\n    |  5. Enter OTP code           |                            |\n    |  6. Click Continue (consent) |                            |\n    |  ----redirect callback-----> | ----code via HTTP GET----> |\n    |                              |                            |  7. Capture code\n    |                              |                            |  8. Exchange for tokens\n    |                              |                            |  9. Write to plugin store\n```\n\nThe script generates a PKCE challenge identical to the plugin's own OAuth flow, starts a local HTTP server on port `1455` to capture the callback, and writes tokens in the exact v2 store format the plugin expects.\n\n### Microsoft interstitials\n\nOutlook login often shows interstitial pages after password entry:\n\n| Page | Handled by |\n|------|-----------|\n| \"Stay signed in?\" | Auto-clicks \"Yes\" |\n| \"Let's protect your account\" | Auto-clicks \"Skip for now\" |\n| FIDO\u002FPasskey creation (`\u002Ffido\u002Fcreate`) | Auto-clicks \"Not now\" \u002F \"Cancel\" |\n| Any other blocker | Force-navigates to inbox |\n\n### Troubleshooting\n\n- **`--visible` mode** shows the browser so you can see exactly where the flow gets stuck.\n- **Debug screenshots** are saved as `auto-login\u002Fdebug_\u003Cuser>_\u003Cstep>.png` on failure.\n- **SSL errors on macOS**: the script uses `ssl._create_unverified_context()` for token exchange requests. This is safe for local automation.\n- **Port 1455 in use**: kill any process using that port, or change `REDIRECT_PORT` in the script.\n- **Stale OTP codes**: if the inbox has old verification emails, the script may pick up an expired code. Clear the inbox or wait for a fresh email.\n\n## CLI commands\n\n- `opencode-multi-auth add \u003Calias>` -> add account via OAuth\n- `opencode-multi-auth remove \u003Calias>` -> remove account\n- `opencode-multi-auth list` -> list configured accounts\n- `opencode-multi-auth status` -> full status\n- `opencode-multi-auth path` -> print store path\n- `opencode-multi-auth web --host 127.0.0.1 --port 3434` -> run dashboard\n- `opencode-multi-auth service install|disable|status` -> systemd user service helpers\n\n## Dashboard\u002FAPI endpoints\n\n- `GET \u002Fapi\u002Fstate`\n- `GET \u002Fapi\u002Flogs`\n- `POST \u002Fapi\u002Fsync`\n- `POST \u002Fapi\u002Fauth\u002Fstart`\n- `POST \u002Fapi\u002Fswitch`\n- `POST \u002Fapi\u002Fremove`\n- `POST \u002Fapi\u002Faccount\u002Fmeta`\n- `POST \u002Fapi\u002Ftoken\u002Frefresh`\n- `POST \u002Fapi\u002Flimits\u002Frefresh`\n- `POST \u002Fapi\u002Flimits\u002Fstop`\n- `GET \u002Fapi\u002Faccounts`\n- `PUT \u002Fapi\u002Faccounts\u002F:alias\u002Fenabled`\n- `POST \u002Fapi\u002Faccounts\u002F:alias\u002Freauth`\n- `GET \u002Fapi\u002Fforce`\n- `POST \u002Fapi\u002Fforce`\n- `POST \u002Fapi\u002Fforce\u002Fclear`\n- `GET \u002Fapi\u002Fsettings`\n- `PUT \u002Fapi\u002Fsettings`\n- `GET \u002Fapi\u002Fsettings\u002Ffeature-flags`\n- `PUT \u002Fapi\u002Fsettings\u002Ffeature-flags`\n- `POST \u002Fapi\u002Fsettings\u002Freset`\n- `POST \u002Fapi\u002Fsettings\u002Fpreset`\n- `POST \u002Fapi\u002Fantigravity\u002Frefresh` (feature-flag gated)\n- `POST \u002Fapi\u002Fantigravity\u002Frefresh-all` (feature-flag gated)\n\n## Environment variables\n\n### Storage and auth\n\n- `OPENCODE_MULTI_AUTH_STORE_DIR` -> override store directory\n- `OPENCODE_MULTI_AUTH_STORE_FILE` -> override store file path\n- `OPENCODE_MULTI_AUTH_CODEX_AUTH_FILE` -> override Codex `auth.json`\n- `CODEX_SOFT_STORE_PASSPHRASE` -> encrypt account store at rest\n- `CODEX_SOFT_LOG_PATH` -> override dashboard log path\n\n### Redis (optional)\n\nRedis backs shared caching and distributed coordination when the plugin and dashboard run in separate processes, or when multiple dashboard instances share one account store. If `OPENCODE_MULTI_AUTH_REDIS_URL` is unset or Redis is unreachable, every consumer degrades to its existing in-process behaviour.\n\n- `OPENCODE_MULTI_AUTH_REDIS_URL` -> Redis connection string (for example `redis:\u002F\u002Flocalhost:6379`)\n\nWhat Redis is used for:\n\n1. **Codex usage API caching** — `\u002Fbackend-api\u002Fcodex\u002Fusage` responses are cached per account alias (~45s) to reduce Cloudflare rate-limit pressure during dashboard limit refreshes.\n2. **Model discovery cache** — discovered GPT model variants are shared across plugin and web dashboard processes (~1 hour).\n3. **Limit refresh queue coordination** — only one cluster-wide refresh queue runs at a time; queue progress is published for other dashboard instances.\n4. **Store write lock** — cross-process mutex around `accounts.json` writes when plugin rotation and the dashboard update accounts concurrently.\n5. **Antigravity quota cache** — dashboard Antigravity quota snapshots are cached briefly (~30s).\n\nLocal Redis with Docker:\n\n```bash\ndocker run -d --name opencode-ma-redis -p 6379:6379 redis:7-alpine\nexport OPENCODE_MULTI_AUTH_REDIS_URL=redis:\u002F\u002Flocalhost:6379\n```\n\n### Rotation and limits\n\n- `OPENCODE_MULTI_AUTH_ROTATION_STRATEGY` (settings source override; runtime rotation follows persisted dashboard settings)\n- `OPENCODE_MULTI_AUTH_CRITICAL_THRESHOLD`\n- `OPENCODE_MULTI_AUTH_LOW_THRESHOLD`\n- `OPENCODE_MULTI_AUTH_TOKEN_FAILURE_COOLDOWN_MS`\n- `OPENCODE_MULTI_AUTH_PROBE_EFFORT`\n- `OPENCODE_MULTI_AUTH_LIMITS_PROBE_MODELS`\n\n### Model mapping and runtime behavior\n\n- `OPENCODE_MULTI_AUTH_PREFER_CODEX_LATEST`\n- `OPENCODE_MULTI_AUTH_CODEX_LATEST_MODEL`\n- `OPENCODE_MULTI_AUTH_INJECT_MODELS`\n- `OPENCODE_MULTI_AUTH_TRUNCATION`\n- `OPENCODE_MULTI_AUTH_DEBUG`\n\n## Latest Codex Mapping\n\nThe plugin can route older Codex selections to the latest Codex backend model when you explicitly opt in.\n\nDefault behavior:\n- exact model selection is preserved\n\nEnvironment variables:\n- `OPENCODE_MULTI_AUTH_PREFER_CODEX_LATEST=1` enables mapping to the latest backend model\n- `OPENCODE_MULTI_AUTH_CODEX_LATEST_MODEL=gpt-5.4` overrides the mapping target, for example to roll back from the default `gpt-5.5`\n- `OPENCODE_MULTI_AUTH_DEBUG=1` prints model mapping debug logs\n- `OPENCODE_MULTI_AUTH_INJECT_MODELS=0` disables automatic runtime model backfill\n\n## Fast Mode\n\nFor OpenCode builds that already accept `gpt-5.5` model IDs, the clean way to mirror Codex Fast mode is:\n\n- keep the model as `openai\u002Fgpt-5.5`\n- use a model variant such as `fast`\n- set `serviceTier=priority` in the variant config\n\nBehavior:\n- the backend model stays `gpt-5.5`\n- the plugin forwards the request with `service_tier=priority`\n- the plugin does not automatically lower reasoning or verbosity\n\nRecommended OpenCode config:\n\n```json\n{\n  \"provider\": {\n    \"openai\": {\n      \"models\": {\n        \"gpt-5.5\": {\n          \"variants\": {\n            \"Medium Fast\": {\n              \"reasoningEffort\": \"medium\",\n              \"serviceTier\": \"priority\"\n            },\n            \"High Fast\": {\n              \"reasoningEffort\": \"high\",\n              \"serviceTier\": \"priority\"\n            },\n            \"XHigh Fast\": {\n              \"reasoningEffort\": \"xhigh\",\n              \"serviceTier\": \"priority\"\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\nFor OpenCode builds that still reject `openai\u002Fgpt-5.5`, keep selecting `openai\u002Fgpt-5.4`, keep your existing Fast variant, and set `OPENCODE_MULTI_AUTH_PREFER_CODEX_LATEST=1`. The plugin will send `gpt-5.5` to the Codex backend while preserving `service_tier=priority`.\n\nSee [docs\u002Fgpt-5.4-fast-benchmark.md](.\u002Fdocs\u002Fgpt-5.4-fast-benchmark.md) for a continued-session benchmark summary.\n\n### Feature flags\n\n- `OPENCODE_MULTI_AUTH_ANTIGRAVITY_ENABLED`\n\n### Notifications\n\n- `OPENCODE_MULTI_AUTH_NOTIFY=1` enables optional completion\u002Fretry\u002Ferror notifications. Notifications are off by default so they cannot delay normal `opencode run` lifecycle.\n- `OPENCODE_MULTI_AUTH_NOTIFY_SOUND`\n- `OPENCODE_MULTI_AUTH_NOTIFY_MAC_OPEN`\n- `OPENCODE_MULTI_AUTH_NOTIFY_NTFY_URL`\n- `OPENCODE_MULTI_AUTH_NOTIFY_NTFY_TOKEN`\n- `OPENCODE_MULTI_AUTH_NOTIFY_UI_BASE_URL`\n\n## Security rules\n\n- Dashboard host is loopback-only (`127.0.0.1`, `::1`, `localhost`).\n- Non-loopback host bind is rejected.\n- Sensitive token patterns are redacted in logs.\n- Store file permissions are restricted (`0o600`).\n- Antigravity APIs are blocked when feature flag is off.\n\n## Build and test\n\n```bash\nnpm ci\nnpm run lint\nnpm run build\nnpx tsc --noEmit\n\nnpm run test:unit\nnpm run test:integration\nnpm run test:web:headless\nnpm run test:failure\nnpm run test:stress\nnpm run test:sandbox\nnpm run test:soak:48h\n```\n\nCurrent test script surfaces are scaffolded and active. For true long soak, set a long duration and keep the run alive.\n\n## Live validation runbook\n\nUse `codextesting.md` for the Codex CLI live-testing checklist and copy-paste command flow.\n\n## Troubleshooting\n\n- If dashboard start fails with localhost error, check `--host` and use loopback only.\n- If a request returns `INVALID_JSON`, verify payload body is valid JSON.\n- If an alias action returns `ACCOUNT_NOT_FOUND`, refresh account list first.\n- If re-auth is blocked with `ACCOUNT_DISABLED`, enable the account before re-auth.\n- If encrypted store appears locked, export `CODEX_SOFT_STORE_PASSPHRASE` before launching.\n\n## Development notes\n\n- Edit `src\u002F*`, never hand-edit `dist\u002F*`.\n- Run `npm run build` after source changes.\n- Keep manual\u002Flive tests sandboxed (temp HOME\u002Fstore\u002Fauth paths).\n\n## Release flow\n\n- This plugin is now intended to be installed from npm, so every shipped update should bump `package.json` version and publish a new package version. Reusing the same version on a new commit will leave users stuck on cached installs.\n- Prepare the next release by bumping the package version, rebuilding, and publishing:\n\n```bash\nnpm version 1.2.1 --no-git-tag-version\nnpm install\nnpm run build\nnpm publish --access public\n```\n\n- After that, cut the git release from `main`:\n\n```bash\ngit commit -m \"chore: release v1.2.1\"\ngit tag v1.2.1\ngit push origin main --follow-tags\n```\n\n- Users who want a pinned build can install a specific npm version:\n\n```json\n{\n  \"plugin\": [\"npm:@guard22\u002Fopencode-multi-auth-codex@1.2.1\"]\n}\n```\n\n- Users tracking `latest` should rerun the install command and restart OpenCode after a new package lands.\n\n## License\n\nMIT\n","这是一个为 OpenCode 平台设计的多账号 OAuth 轮转插件，用于在调用 Codex（如 ChatGPT API）时自动管理、轮换和负载分发多个授权账户。核心功能包括本地账户存储与原子化写入、支持 round-robin\u002Fleast-used\u002Frandom\u002Fweighted-round-robin 等多种轮转策略、强制模式（固定单账号）、账户启停控制、限流探测与可靠性加固，并提供 localhost 可视化仪表盘进行实时配置与监控。适用于需绕过单账号调用频次限制、提升 API 调用稳定性与吞吐量的中高频开发者场景，如自动化代码生成、批量提示工程或内部 AI 工具集成。",2,"2026-07-10 02:30:17","CREATED_QUERY"]