@codexhost/cli-win32-arm64 0.9.1 → 0.9.2

package/app/host-runtime.mjs

@@ -2278,7 +2278,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net5 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash10 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash11 } = __require("crypto");
     var { Duplex: Duplex2, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2946,7 +2946,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest2 = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash11("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest2) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3315,7 +3315,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex: Duplex2 } = __require("stream");
-    var { createHash: createHash10 } = __require("crypto");
+    var { createHash: createHash11 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3622,7 +3622,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest2 = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash11("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -4283,7 +4283,7 @@ async function runDelegationCli(input) {
 
 // packages/host-runtime/src/run-host-runtime.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import path21 from "node:path";
+import path22 from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -5978,10 +5978,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path26) {
-  if (!path26)
+function getElementAtPath(obj, path27) {
+  if (!path27)
     return obj;
-  return path26.reduce((acc, key) => acc?.[key], obj);
+  return path27.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6390,11 +6390,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path26, issues) {
+function prefixIssues(path27, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path26);
+    iss.path.unshift(path27);
     return iss;
   });
 }
@@ -6541,16 +6541,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path26 = []) => {
+  const processError = (error52, path27 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else {
-        const fullpath = [...path26, ...issue2.path];
+        const fullpath = [...path27, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -6577,17 +6577,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path26 = []) => {
+  const processError = (error52, path27 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else {
-        const fullpath = [...path26, ...issue2.path];
+        const fullpath = [...path27, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -6619,8 +6619,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path26 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path26) {
+  const path27 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path27) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19312,13 +19312,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path26 = ref.slice(1).split("/").filter(Boolean);
-  if (path26.length === 0) {
+  const path27 = ref.slice(1).split("/").filter(Boolean);
+  if (path27.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path26[0] === defsKey) {
-    const key = path26[1];
+  if (path27[0] === defsKey) {
+    const key = path27[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19726,6 +19726,62 @@ function date4(params) {
 // node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// packages/shared-contracts/dist/credential-imports.js
+var credentialSourceSchema = external_exports.object({
+  id: external_exports.string().min(1).max(256),
+  harnessId: external_exports.string().min(1),
+  label: external_exports.string().min(1).max(512),
+  provider: external_exports.enum(["openai-codex", "xai"])
+}).strict();
+var credentialImportNameSchema = external_exports.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+var credentialImportRecordSchema = external_exports.object({
+  name: credentialImportNameSchema,
+  source: credentialSourceSchema,
+  importedAt: external_exports.string()
+}).strict();
+var credentialImportsRequestSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({ action: external_exports.literal("list") }).strict(),
+  external_exports.object({
+    action: external_exports.literal("import"),
+    sourceId: external_exports.string().min(1).max(256),
+    name: credentialImportNameSchema,
+    confirmed: external_exports.literal(true)
+  }).strict(),
+  external_exports.object({
+    action: external_exports.literal("reimport"),
+    sourceId: external_exports.string().min(1).max(256),
+    name: credentialImportNameSchema,
+    confirmed: external_exports.literal(true)
+  }).strict(),
+  external_exports.object({
+    action: external_exports.literal("remove"),
+    name: credentialImportNameSchema,
+    confirmed: external_exports.literal(true)
+  }).strict()
+]);
+var credentialOtherLoginSchema = external_exports.object({
+  provider: external_exports.string().min(1).max(128),
+  type: external_exports.enum(["oauth", "api_key", "unknown"]),
+  /** Best-effort account label (e.g. the email in a Codex token), derived locally when present. */
+  label: external_exports.string().min(1).max(512).optional(),
+  /** Recognized credential vendor, derived from the OAuth token issuer. Absent when unknown. */
+  vendor: external_exports.enum(["openai-codex", "xai"]).optional()
+}).strict();
+var credentialImportsResultSchema = external_exports.object({
+  sources: external_exports.array(credentialSourceSchema),
+  targets: external_exports.array(external_exports.object({
+    harnessId: external_exports.string(),
+    providers: external_exports.array(external_exports.enum(["openai-codex", "xai"])),
+    imports: external_exports.array(credentialImportRecordSchema),
+    others: external_exports.array(credentialOtherLoginSchema).default([])
+  }).strict())
+}).strict();
+var credentialImportsParamsSchema = external_exports.object({
+  targetHarnessId: external_exports.string().min(1).max(128).optional(),
+  request: credentialImportsRequestSchema
+}).strict();
+var CREDENTIAL_IMPORTS_METHOD = "codexhost/harness/credential-imports";
+
 // packages/shared-contracts/dist/version.js
 var WORKSPACE_CONTRACT_VERSION = 1;
 
@@ -20630,6 +20686,97 @@ var updateStatusResultSchema = external_exports.strictObject({
 // packages/shared-contracts/dist/index.js
 var workspaceContractVersionSchema = external_exports.literal(WORKSPACE_CONTRACT_VERSION);
 
+// packages/host-runtime/src/account/codex-credential-export.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFile as readFile4 } from "node:fs/promises";
+import os from "node:os";
+import path5 from "node:path";
+async function readCodexCredential(environment) {
+  try {
+    const home = environment.CODEX_HOME ?? path5.join(environment.HOME ?? os.homedir(), ".codex");
+    const auth = JSON.parse(await readFile4(path5.join(home, "auth.json"), "utf8"));
+    if (auth.OPENAI_API_KEY || auth.auth_mode && auth.auth_mode !== "chatgpt") return [];
+    const t = auth.tokens;
+    if (!t || ![t.access_token, t.refresh_token, t.account_id].every(
+      (v) => typeof v === "string" && v.length
+    ))
+      return [];
+    const claims = JSON.parse(Buffer.from(t.access_token.split(".")[1], "base64url").toString());
+    if (claims.client_id !== "app_EMoamEEZ73f0CkXaXp7hrann" || !Number.isFinite(claims.exp * 1e3))
+      return [];
+    const account = claims["https://api.openai.com/auth"]?.chatgpt_account_id;
+    if (account !== t.account_id) return [];
+    let email3;
+    try {
+      email3 = JSON.parse(Buffer.from(t.id_token.split(".")[1], "base64url").toString()).email;
+    } catch {
+    }
+    const identity = `${t.account_id}:${claims.sub ?? ""}`;
+    return [
+      {
+        source: {
+          id: `codex:${createHash2("sha256").update(identity).digest("hex")}`,
+          harnessId: "codex",
+          provider: "openai-codex",
+          label: typeof email3 === "string" && email3 ? email3 : "Codex"
+        },
+        oauth: {
+          access: t.access_token,
+          refresh: t.refresh_token,
+          expires: claims.exp * 1e3,
+          accountId: t.account_id
+        }
+      }
+    ];
+  } catch {
+    return [];
+  }
+}
+
+// packages/host-runtime/src/credential-imports.ts
+async function handleCredentialImports(params, adapters, environment) {
+  const input = credentialImportsParamsSchema.parse(params);
+  const installed = [...adapters];
+  const sources = await readCodexCredential(environment);
+  for (const adapter of installed) {
+    if (adapter.credentialExport) sources.push(...await adapter.credentialExport.read());
+  }
+  const request = input.request;
+  if (request.action !== "list") {
+    const target = installed.find((a) => a.harnessId === input.targetHarnessId)?.credentialImports;
+    if (!target) throw new Error("Target Harness does not support credential imports");
+    if (request.action === "remove") await target.remove(request.name);
+    else {
+      const source = sources.find((s) => s.source.id === request.sourceId);
+      if (!source || !target.providers.includes(source.source.provider))
+        throw new Error("Source login changed or is unavailable; refresh and confirm again");
+      if (request.action === "reimport") await target.reimport(request.name, source);
+      else await target.add(request.name, source);
+    }
+  }
+  const targets = [];
+  for (const adapter of installed) {
+    if (!adapter.credentialImports) continue;
+    try {
+      targets.push({
+        harnessId: adapter.harnessId,
+        providers: [...adapter.credentialImports.providers],
+        imports: await adapter.credentialImports.list(),
+        others: await listOthers(adapter)
+      });
+    } catch {
+    }
+  }
+  return credentialImportsResultSchema.parse({ sources: sources.map((s) => s.source), targets });
+}
+async function listOthers(adapter) {
+  try {
+    return await adapter.credentialImports?.listOthers?.() ?? [];
+  } catch {
+    return [];
+  }
+}
+
 // packages/harness-adapter/dist/output-channel.js
 var HarnessOutputChannel = class {
   outputs;
@@ -20779,8 +20926,8 @@ var packageMetadata = {
 import { execFileSync } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { constants } from "node:fs";
-import { copyFile as copyFile2, mkdir as mkdir3, open as open3, readFile as readFile4, readdir as readdir2, rename as rename2, rm as rm3, stat } from "node:fs/promises";
-import path5 from "node:path";
+import { copyFile as copyFile2, mkdir as mkdir3, open as open3, readFile as readFile5, readdir as readdir2, rename as rename2, rm as rm3, stat } from "node:fs/promises";
+import path6 from "node:path";
 
 // packages/mapping-store/dist/records.js
 var nonBlankTextSchema6 = external_exports.string().refine((value2) => value2.trim().length > 0, {
@@ -21041,12 +21188,12 @@ var MappingStore = class {
   #initialized = false;
   #lockHandle = null;
   constructor(options2) {
-    this.#directory = path5.resolve(options2.directory);
-    this.#threadsDirectory = path5.join(this.#directory, "threads");
-    this.#delegationsDirectory = path5.join(this.#directory, "delegations");
-    this.#backupsDirectory = path5.join(this.#directory, "backups");
-    this.#quarantineDirectory = path5.join(this.#directory, "quarantine");
-    this.#lockPath = path5.join(this.#directory, "store.lock");
+    this.#directory = path6.resolve(options2.directory);
+    this.#threadsDirectory = path6.join(this.#directory, "threads");
+    this.#delegationsDirectory = path6.join(this.#directory, "delegations");
+    this.#backupsDirectory = path6.join(this.#directory, "backups");
+    this.#quarantineDirectory = path6.join(this.#directory, "quarantine");
+    this.#lockPath = path6.join(this.#directory, "store.lock");
     this.#instanceId = options2.instanceId ?? randomUUID2();
     this.#now = options2.now ?? (() => /* @__PURE__ */ new Date());
     this.#beforeReplace = options2.beforeReplace;
@@ -21065,8 +21212,8 @@ var MappingStore = class {
       await this.#cleanupResidue();
       const names = (await readdir2(this.#threadsDirectory)).filter((name) => name.endsWith(".json"));
       for (const name of names) {
-        const primary = path5.join(this.#threadsDirectory, name);
-        const backup = path5.join(this.#backupsDirectory, name);
+        const primary = path6.join(this.#threadsDirectory, name);
+        const backup = path6.join(this.#backupsDirectory, name);
         let record3 = null;
         try {
           record3 = await this.#readRecord(primary, name);
@@ -21075,7 +21222,7 @@ var MappingStore = class {
             record3 = await this.#readRecord(backup, name);
             await this.#replaceFile(primary, record3, false);
           } catch (backupError) {
-            const quarantine = path5.join(this.#quarantineDirectory, `${name}.${this.#now().getTime()}.invalid`);
+            const quarantine = path6.join(this.#quarantineDirectory, `${name}.${this.#now().getTime()}.invalid`);
             await rename2(primary, quarantine).catch(() => void 0);
             void primaryError;
             void backupError;
@@ -21091,14 +21238,14 @@ var MappingStore = class {
       }
       const delegationNames = (await readdir2(this.#delegationsDirectory)).filter((name) => name.endsWith(".json"));
       for (const name of delegationNames) {
-        const file2 = path5.join(this.#delegationsDirectory, name);
+        const file2 = path6.join(this.#delegationsDirectory, name);
         try {
-          const parsed = storedDelegationRecordV1Schema.parse(JSON.parse(await readFile4(file2, "utf8")));
+          const parsed = storedDelegationRecordV1Schema.parse(JSON.parse(await readFile5(file2, "utf8")));
           if (`${parsed.delegationId}.json` !== name)
             throw new Error("filename mismatch");
           this.#delegations.set(parsed.delegationId, parsed);
         } catch {
-          const quarantine = path5.join(this.#quarantineDirectory, `${name}.${this.#now().getTime()}.invalid-delegation`);
+          const quarantine = path6.join(this.#quarantineDirectory, `${name}.${this.#now().getTime()}.invalid-delegation`);
           await rename2(file2, quarantine).catch(() => void 0);
         }
       }
@@ -21384,7 +21531,7 @@ var MappingStore = class {
     if (handle)
       await handle.close().catch(() => void 0);
     try {
-      const current = JSON.parse(await readFile4(this.#lockPath, "utf8"));
+      const current = JSON.parse(await readFile5(this.#lockPath, "utf8"));
       if (current.instanceId === this.#instanceId)
         await rm3(this.#lockPath, { force: true });
     } catch {
@@ -21500,7 +21647,7 @@ var MappingStore = class {
     }
   }
   async #readRecord(file2, expectedName) {
-    const parsed = storedThreadRecordV1Schema.safeParse(JSON.parse(await readFile4(file2, "utf8")));
+    const parsed = storedThreadRecordV1Schema.safeParse(JSON.parse(await readFile5(file2, "utf8")));
     if (!parsed.success) {
       throw new MappingStoreError("INVALID_RECORD", "Mapping Store record is invalid", {
         cause: parsed.error
@@ -21518,10 +21665,10 @@ var MappingStore = class {
       readdir2(this.#directory)
     ]);
     await Promise.all([
-      ...threadNames.filter((name) => name.includes(".tmp-")).map((name) => rm3(path5.join(this.#threadsDirectory, name), { force: true })),
-      ...delegationNames.filter((name) => name.includes(".tmp-")).map((name) => rm3(path5.join(this.#delegationsDirectory, name), { force: true })),
+      ...threadNames.filter((name) => name.includes(".tmp-")).map((name) => rm3(path6.join(this.#threadsDirectory, name), { force: true })),
+      ...delegationNames.filter((name) => name.includes(".tmp-")).map((name) => rm3(path6.join(this.#delegationsDirectory, name), { force: true })),
       // Renamed aside by #acquireLock; nothing reads them back, and they accumulate one per run.
-      ...rootNames.filter((name) => name.startsWith(`${path5.basename(this.#lockPath)}.stale-`)).map((name) => rm3(path5.join(this.#directory, name), { force: true }))
+      ...rootNames.filter((name) => name.startsWith(`${path6.basename(this.#lockPath)}.stale-`)).map((name) => rm3(path6.join(this.#directory, name), { force: true }))
     ]);
   }
   async #acquireLock() {
@@ -21548,7 +21695,7 @@ var MappingStore = class {
     }
     let existing = {};
     try {
-      existing = JSON.parse(await readFile4(this.#lockPath, "utf8"));
+      existing = JSON.parse(await readFile5(this.#lockPath, "utf8"));
     } catch {
     }
     if (typeof existing.pid === "number" && lockOwnerIsLive(existing)) {
@@ -21622,13 +21769,13 @@ var MappingStore = class {
     await next;
   }
   #recordPath(hostThreadId) {
-    return path5.join(this.#threadsDirectory, `${hostThreadId}.json`);
+    return path6.join(this.#threadsDirectory, `${hostThreadId}.json`);
   }
   #delegationPath(delegationId) {
-    return path5.join(this.#delegationsDirectory, `${delegationId}.json`);
+    return path6.join(this.#delegationsDirectory, `${delegationId}.json`);
   }
   #backupPath(hostThreadId) {
-    return path5.join(this.#backupsDirectory, `${hostThreadId}.json`);
+    return path6.join(this.#backupsDirectory, `${hostThreadId}.json`);
   }
   #requireInitialized() {
     if (!this.#initialized) {
@@ -22316,16 +22463,16 @@ var Diff = class {
       }
     }
   }
-  addToPath(path26, added, removed, oldPosInc, options2) {
-    const last = path26.lastComponent;
+  addToPath(path27, added, removed, oldPosInc, options2) {
+    const last = path27.lastComponent;
     if (last && !options2.oneChangePerToken && last.added === added && last.removed === removed) {
       return {
-        oldPos: path26.oldPos + oldPosInc,
+        oldPos: path27.oldPos + oldPosInc,
         lastComponent: { count: last.count + 1, added, removed, previousComponent: last.previousComponent }
       };
     } else {
       return {
-        oldPos: path26.oldPos + oldPosInc,
+        oldPos: path27.oldPos + oldPosInc,
         lastComponent: { count: 1, added, removed, previousComponent: last }
       };
     }
@@ -22754,10 +22901,10 @@ function splitLines(text) {
 }
 
 // packages/protocol-core/dist/file-change-summary.js
-import path6 from "node:path";
+import path7 from "node:path";
 function filePathKey(file2, cwd) {
   const windows = /^[a-z]:[/\\]/i.test(cwd) || /^[a-z]:[/\\]/i.test(file2);
-  const paths = windows ? path6.win32 : path6.posix;
+  const paths = windows ? path7.win32 : path7.posix;
   const resolved = paths.resolve(cwd, file2).replaceAll("\\", "/");
   return windows ? resolved.toLowerCase() : resolved;
 }
@@ -23026,8 +23173,8 @@ function projectFileChangeKind(kind) {
   return { type: kind };
 }
 function projectFileChanges(changes) {
-  return changes.map(({ path: path26, kind, unifiedDiff }) => ({
-    path: path26,
+  return changes.map(({ path: path27, kind, unifiedDiff }) => ({
+    path: path27,
     kind: projectFileChangeKind(kind),
     diff: unifiedDiff
   }));
@@ -23965,13 +24112,13 @@ function decodeThreadForkRequest(request) {
   if (runtimeWorkspaceRoots !== void 0 && runtimeWorkspaceRoots !== null && (!Array.isArray(runtimeWorkspaceRoots) || runtimeWorkspaceRoots.some((root) => typeof root !== "string" || root.length === 0))) {
     throw new Error("thread/fork params.runtimeWorkspaceRoots must be text paths or null");
   }
-  const path26 = optionalText(params, "path", { allowEmpty: true });
+  const path27 = optionalText(params, "path", { allowEmpty: true });
   const ephemeral = optionalBoolean(params, "ephemeral");
   return {
     threadId: threadId2,
     ...lastTurnText ? { lastTurnId: hostTurnIdSchema.parse(lastTurnText) } : {},
     ...beforeTurnText ? { beforeTurnId: hostTurnIdSchema.parse(beforeTurnText) } : {},
-    ...path26 ? { path: path26 } : {},
+    ...path27 ? { path: path27 } : {},
     ...optionalField(params, "model"),
     ...optionalField(params, "modelProvider"),
     ...optionalField(params, "cwd"),
@@ -24064,7 +24211,7 @@ function threadForkResult(thread, input) {
 }
 
 // packages/protocol-core/dist/thread-management.js
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var HOST_CURSOR_PREFIX = "codexhost:thread-list:v1:";
 var MAX_CURSOR_LENGTH = 65536;
 var DEFAULT_PAGE_SIZE = 25;
@@ -24161,7 +24308,7 @@ function decodeSortKey(value2) {
   return value2;
 }
 function queryFingerprint(value2) {
-  return createHash2("sha256").update(JSON.stringify(value2)).digest("hex");
+  return createHash3("sha256").update(JSON.stringify(value2)).digest("hex");
 }
 function cursorPayload(value2) {
   return {
@@ -25147,22 +25294,22 @@ var HarnessAccountInspectionCache = class {
 };
 
 // packages/host-runtime/src/app-server-host.ts
-import { createHash as createHash6, randomUUID as randomUUID9 } from "node:crypto";
-import os3 from "node:os";
-import path12 from "node:path";
+import { createHash as createHash7, randomUUID as randomUUID9 } from "node:crypto";
+import os4 from "node:os";
+import path13 from "node:path";
 
 // packages/host-runtime/src/external-thread-fork.ts
 import nodePath from "node:path";
 
 // packages/host-runtime/src/external-thread-repository.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import os from "node:os";
-import path7 from "node:path";
+import os2 from "node:os";
+import path8 from "node:path";
 
 // packages/host-runtime/src/external-subagent-threads.ts
-import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
 function childCreateRequest(parent, nativeRef, id2) {
-  const key = createHash3("sha256").update(JSON.stringify([parent.hostThreadId, parent.harnessId, nativeRef.nativeSessionId, id2])).digest("hex");
+  const key = createHash4("sha256").update(JSON.stringify([parent.hostThreadId, parent.harnessId, nativeRef.nativeSessionId, id2])).digest("hex");
   return `subagent:${key}`;
 }
 function subagentMaterializer(store, parent, previousParent) {
@@ -25297,8 +25444,8 @@ function sameMapping(left, right) {
 }
 function defaultMappingStoreDirectory(environment) {
   const dataDirectory = environment.CODEXHOST_DATA_DIR;
-  return path7.join(
-    dataDirectory ? path7.resolve(dataDirectory) : path7.join(os.homedir(), ".codexhost"),
+  return path8.join(
+    dataDirectory ? path8.resolve(dataDirectory) : path8.join(os2.homedir(), ".codexhost"),
     "mapping-store"
   );
 }
@@ -27334,11 +27481,11 @@ var ExternalTurnSteering = class {
 };
 
 // packages/host-runtime/src/harness-delegation-coordinator.ts
-import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
-import path8 from "node:path";
+import { createHash as createHash6, randomUUID as randomUUID5 } from "node:crypto";
+import path9 from "node:path";
 
 // packages/host-runtime/src/delegation-snapshot.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 var CURSOR_PREFIX = "codexhost:thread-messages:v1:";
 var DEFAULT_MESSAGE_LIMIT = 25;
 var MAX_MESSAGE_LIMIT = 100;
@@ -27392,7 +27539,7 @@ function allVisibleMessages(turns) {
   return messages;
 }
 function cursorFingerprint(threadId2) {
-  return createHash4("sha256").update(threadId2).digest("hex");
+  return createHash5("sha256").update(threadId2).digest("hex");
 }
 function encodeCursor(threadId2, offset) {
   const payload = JSON.stringify({ version: 1, fingerprint: cursorFingerprint(threadId2), offset });
@@ -27487,10 +27634,10 @@ function terminal(status) {
   return status === "completed" || status === "failed" || status === "interrupted";
 }
 function taskDigest(input) {
-  return createHash5("sha256").update(
+  return createHash6("sha256").update(
     JSON.stringify({
       task: input.task,
-      cwd: path8.resolve(input.cwd),
+      cwd: path9.resolve(input.cwd),
       modelId: input.model?.id ?? null,
       thinkingOptionId: input.thinkingOptionId ?? null
     })
@@ -27561,7 +27708,7 @@ var HarnessDelegationCoordinator = class {
     return {
       harnessId: input.harnessId,
       inspection: await adapter.inspect({
-        ...input.cwd ? { cwd: path8.resolve(input.cwd) } : {},
+        ...input.cwd ? { cwd: path9.resolve(input.cwd) } : {},
         ...input.refresh !== void 0 ? { refresh: input.refresh } : {}
       })
     };
@@ -27575,7 +27722,7 @@ var HarnessDelegationCoordinator = class {
       const result = await this.#startOfficial({ ...input, parentThreadId, cwd: selectedCwd });
       return { ...result, parentThreadId, cwd: result.cwd ?? selectedCwd };
     }
-    const startInput = { ...input, parentThreadId, cwd: path8.resolve(selectedCwd) };
+    const startInput = { ...input, parentThreadId, cwd: path9.resolve(selectedCwd) };
     if (!this.#adapters.has(input.harnessId)) {
       throw new DelegationControlError(
         "HARNESS_NOT_FOUND",
@@ -28004,7 +28151,7 @@ var HarnessDelegationCoordinator = class {
 
 // packages/host-runtime/src/harness-plugin-loader.ts
 import { readdir as readdir3, realpath as realpath2 } from "node:fs/promises";
-import path10 from "node:path";
+import path11 from "node:path";
 import { pathToFileURL } from "node:url";
 
 // packages/host-runtime/src/harness-plugin-registry.ts
@@ -28042,16 +28189,16 @@ var HarnessPluginRegistry = class {
 
 // packages/host-runtime/src/plugin-files.ts
 import { open as open4, realpath, stat as stat2 } from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 function inside(root, candidate) {
-  const relative = path9.relative(root, candidate);
-  return relative !== "" && !path9.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path9.sep}`);
+  const relative = path10.relative(root, candidate);
+  return relative !== "" && !path10.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path10.sep}`);
 }
 async function pluginResourcePath(root, relative) {
-  if (path9.isAbsolute(relative) || !inside(root, path9.resolve(root, relative))) {
+  if (path10.isAbsolute(relative) || !inside(root, path10.resolve(root, relative))) {
     throw new Error("Plugin resource escapes its root");
   }
-  const resolved = await realpath(path9.resolve(root, relative));
+  const resolved = await realpath(path10.resolve(root, relative));
   if (!inside(root, resolved) || !(await stat2(resolved)).isFile()) {
     throw new Error("Plugin resource must be a regular file inside its root");
   }
@@ -28213,7 +28360,7 @@ async function loadHarnessPlugins(options2) {
   const enabledIds = /* @__PURE__ */ new Set();
   const roots = /* @__PURE__ */ new Set();
   for (const configuredRoot of options2.roots) {
-    if (!path10.isAbsolute(configuredRoot)) {
+    if (!path11.isAbsolute(configuredRoot)) {
       diagnose({ code: "invalidRoot" });
       continue;
     }
@@ -28243,7 +28390,7 @@ async function loadHarnessPlugins(options2) {
       for (const directory of directories) {
         try {
           const file2 = await pluginResourcePath(root, `${directory.name}/manifest.json`);
-          const pluginRoot = await realpath2(path10.join(root, directory.name));
+          const pluginRoot = await realpath2(path11.join(root, directory.name));
           await pluginResourcePath(pluginRoot, "manifest.json");
           const manifest = harnessPluginManifestSchema.parse(
             JSON.parse(
@@ -28339,27 +28486,27 @@ async function loadHarnessPlugins(options2) {
 
 // packages/host-runtime/src/harness-launch-settings.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { mkdir as mkdir4, readFile as readFile5, rename as rename3, rm as rm4, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
-import os2 from "node:os";
-import path11 from "node:path";
+import { mkdir as mkdir4, readFile as readFile6, rename as rename3, rm as rm4, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import os3 from "node:os";
+import path12 from "node:path";
 var HarnessLaunchSettingsStore = class {
   #directory;
   #initial = /* @__PURE__ */ new Map();
   constructor(environment) {
-    this.#directory = path11.join(
-      environment.CODEXHOST_DATA_DIR ? path11.resolve(environment.CODEXHOST_DATA_DIR) : path11.join(os2.homedir(), ".codexhost"),
+    this.#directory = path12.join(
+      environment.CODEXHOST_DATA_DIR ? path12.resolve(environment.CODEXHOST_DATA_DIR) : path12.join(os3.homedir(), ".codexhost"),
       "harness-launch-settings"
     );
   }
   #file(id2) {
-    return path11.join(this.#directory, `${harnessPluginIdSchema.parse(id2)}.json`);
+    return path12.join(this.#directory, `${harnessPluginIdSchema.parse(id2)}.json`);
   }
   async #read(id2) {
     try {
       const value2 = harnessLaunchPathSchema.parse(
-        JSON.parse(await readFile5(this.#file(id2), "utf8"))
+        JSON.parse(await readFile6(this.#file(id2), "utf8"))
       );
-      if (!path11.isAbsolute(value2)) throw new Error("Expected an absolute entrypoint path");
+      if (!path12.isAbsolute(value2)) throw new Error("Expected an absolute entrypoint path");
       return value2;
     } catch (error51) {
       if (error51 && typeof error51 === "object" && "code" in error51 && error51.code === "ENOENT")
@@ -28388,7 +28535,7 @@ var HarnessLaunchSettingsStore = class {
       await rm4(file2, { force: true });
     } else {
       value2 = harnessLaunchPathSchema.parse(value2);
-      if (!path11.isAbsolute(value2))
+      if (!path12.isAbsolute(value2))
         throw new Error("Use an absolute entrypoint path without arguments");
       const metadata = await stat3(value2).catch(() => void 0);
       if (!metadata?.isDirectory() && !metadata?.isFile())
@@ -29523,25 +29670,25 @@ function resolveExternalSessionTreeIds(records) {
   const resolve = (start) => {
     const cached2 = resolved.get(start.hostThreadId);
     if (cached2) return cached2;
-    const path26 = [];
+    const path27 = [];
     const visited = /* @__PURE__ */ new Set();
     let current = start;
     while (true) {
       const known = resolved.get(current.hostThreadId);
       if (known) {
-        for (const record3 of path26) resolved.set(record3.hostThreadId, known);
+        for (const record3 of path27) resolved.set(record3.hostThreadId, known);
         return known;
       }
       if (visited.has(current.hostThreadId)) {
         throw new Error("External Thread Fork tree contains a cycle");
       }
       visited.add(current.hostThreadId);
-      path26.push(current);
+      path27.push(current);
       const sourceId = current.subagent?.parentHostThreadId ?? current.forkSource?.hostThreadId;
       const source = sourceId ? byId.get(sourceId) : void 0;
       if (!source) {
         const root = current.hostThreadId;
-        for (const record3 of path26) resolved.set(record3.hostThreadId, root);
+        for (const record3 of path27) resolved.set(record3.hostThreadId, root);
         return root;
       }
       current = source;
@@ -29997,7 +30144,7 @@ var AppServerHost = class {
     this.#launchSettings = new HarnessLaunchSettingsStore(
       this.#options.pluginContext?.environment ?? environment
     );
-    const permanentHome = path12.resolve(environment.CODEX_HOME ?? path12.join(os3.homedir(), ".codex"));
+    const permanentHome = path13.resolve(environment.CODEX_HOME ?? path13.join(os4.homedir(), ".codex"));
     this.#ownsOfficialRuntimeScope = options2.officialRuntimeScope === void 0;
     this.#officialRuntimeScope = options2.officialRuntimeScope ?? new OfficialRuntimeScope({
       diagnosticOutput: this.#options.diagnosticOutput,
@@ -30010,7 +30157,8 @@ var AppServerHost = class {
             ...officialEnvironment(environment),
             CODEX_HOME: permanentHome
           },
-          ...this.#options.spawnOfficial ? { spawnOfficial: this.#options.spawnOfficial } : {}
+          ...this.#options.spawnOfficial ? { spawnOfficial: this.#options.spawnOfficial } : {},
+          ...this.#options.officialCloseTimeoutMs === void 0 ? {} : { closeTimeoutMs: this.#options.officialCloseTimeoutMs }
         })
       )
     });
@@ -30346,6 +30494,32 @@ var AppServerHost = class {
       this.#dispatchDesktopRequest(() => this.#handleCodexAccountRequest(request));
       return;
     }
+    if (request.method === CREDENTIAL_IMPORTS_METHOD) {
+      this.#dispatchDesktopRequest(async () => {
+        if (!credentialImportsParamsSchema.safeParse(request.params).success) {
+          await this.#writer.json(rpcError(request, -32602, "Invalid credential import request"));
+          return;
+        }
+        await this.#waitForPlugins();
+        try {
+          const result = await handleCredentialImports(
+            request.params,
+            this.#externalAdapters.values(),
+            this.#options.environment ?? process.env
+          );
+          await this.#writer.json(rpcEnvelope(request, { result: jsonValueSchema.parse(result) }));
+        } catch {
+          await this.#writer.json(
+            rpcError(
+              request,
+              -32077,
+              "Credential operation failed. Check the source login, choose an unused Provider name, and verify Pi configuration access."
+            )
+          );
+        }
+      });
+      return;
+    }
     if (request.method === "codexhost/harness/accounts/sources") {
       this.#dispatchDesktopRequest(async () => {
         if (!harnessAccountSourceListParamsSchema.safeParse(request.params).success) {
@@ -31036,7 +31210,7 @@ var AppServerHost = class {
       throw new DelegationControlError("INVALID_ARGUMENT", "Official Model Ref is invalid");
     }
     const nativeModelId = requestedModel ? decodeOfficialCodexModelRef(requestedModel) : void 0;
-    const digest2 = createHash6("sha256").update(
+    const digest2 = createHash7("sha256").update(
       JSON.stringify({
         task: input.task,
         cwd: input.cwd,
@@ -33330,17 +33504,17 @@ var AppServerHost = class {
 // packages/host-runtime/src/native-account-host.ts
 import { mkdir as mkdir7, realpath as realpath3 } from "node:fs/promises";
 import { homedir } from "node:os";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // packages/host-runtime/src/codex-runtime/owned-official-backends.ts
-import { createHash as createHash7, randomBytes } from "node:crypto";
+import { createHash as createHash8, randomBytes } from "node:crypto";
 import { Writable as Writable2 } from "node:stream";
 
 // packages/host-runtime/src/remote-app-server.ts
 import { createServer } from "node:http";
 import net from "node:net";
 import { chmod as chmod3, lstat as lstat6, mkdir as mkdir6, rm as rm6 } from "node:fs/promises";
-import path14 from "node:path";
+import path15 from "node:path";
 import { PassThrough } from "node:stream";
 
 // node_modules/ws/wrapper.mjs
@@ -33356,9 +33530,9 @@ var wrapper_default = import_websocket.default;
 
 // packages/host-runtime/src/remote-socket-lock.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
-import { chmod as chmod2, lstat as lstat5, mkdir as mkdir5, open as open5, readFile as readFile6, readdir as readdir4, rename as rename4, rm as rm5 } from "node:fs/promises";
+import { chmod as chmod2, lstat as lstat5, mkdir as mkdir5, open as open5, readFile as readFile7, readdir as readdir4, rename as rename4, rm as rm5 } from "node:fs/promises";
 import { uptime } from "node:os";
-import path13 from "node:path";
+import path14 from "node:path";
 import { setTimeout as delay4 } from "node:timers/promises";
 var LOCK_RETRY_COUNT = 200;
 var LOCK_RETRY_DELAY_MS = 25;
@@ -33421,7 +33595,7 @@ async function readLockEntrySnapshot(filePath) {
     throw error51;
   });
   if (metadata === null || !metadata.isFile()) return null;
-  const source = await readFile6(filePath, "utf8").catch((error51) => {
+  const source = await readFile7(filePath, "utf8").catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -33432,7 +33606,7 @@ async function readLockEntrySnapshot(filePath) {
     source,
     identity: { dev: metadata.dev, ino: metadata.ino },
     mtimeMs: metadata.mtimeMs,
-    record: record3 && path13.basename(filePath) === lockEntryName(record3.ownerToken) ? record3 : null
+    record: record3 && path14.basename(filePath) === lockEntryName(record3.ownerToken) ? record3 : null
   };
 }
 function lockEntryIsAbandoned(snapshot) {
@@ -33453,7 +33627,7 @@ async function readLockEntryCatalog(lockDirectory) {
   let unsettled = false;
   for (const name of names) {
     if (!name.startsWith(LOCK_ENTRY_PREFIX) || !name.endsWith(LOCK_ENTRY_SUFFIX)) continue;
-    const snapshot = await readLockEntrySnapshot(path13.join(lockDirectory, name));
+    const snapshot = await readLockEntrySnapshot(path14.join(lockDirectory, name));
     if (snapshot === null) continue;
     if (lockEntryIsAbandoned(snapshot)) {
       if (!await removeAbandonedLockEntry(snapshot)) unsettled = true;
@@ -33481,7 +33655,7 @@ async function preparePrivateLockDirectory(lockDirectory) {
   await chmod2(lockDirectory, 448);
 }
 async function writeLockRecordAtomic(lockDirectory, entryPath, record3) {
-  const temporary = path13.join(lockDirectory, `.tmp-${record3.ownerToken}-${randomUUID10()}`);
+  const temporary = path14.join(lockDirectory, `.tmp-${record3.ownerToken}-${randomUUID10()}`);
   const handle = await open5(temporary, "wx", 384);
   try {
     await handle.writeFile(`${JSON.stringify(record3)}
@@ -33508,7 +33682,7 @@ async function legacyLockState(legacyPath) {
   });
   if (metadata === null) return "absent";
   if (!metadata.isFile()) return "blocking";
-  const source = await readFile6(legacyPath, "utf8").catch((error51) => {
+  const source = await readFile7(legacyPath, "utf8").catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -33557,7 +33731,7 @@ async function withRemoteAppServerSocketInitializationLock(socketPath, action) {
   const lockDirectory = `${socketPath}.initializers`;
   await preparePrivateLockDirectory(lockDirectory);
   const ownerToken = randomUUID10();
-  const entryPath = path13.join(lockDirectory, lockEntryName(ownerToken));
+  const entryPath = path14.join(lockDirectory, lockEntryName(ownerToken));
   const baseRecord = {
     version: 2,
     ownerToken,
@@ -33731,14 +33905,14 @@ function remoteAppServerSocketPath(environment, listenUrl = "unix://") {
     throw new Error("Remote app-server listener must use a Unix URL");
   }
   const explicit = listenUrl.slice("unix://".length);
-  if (explicit.length > 0) return path14.posix.resolve(decodeURIComponent(explicit));
-  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path14.posix.join(environment.HOME, ".codex") : void 0);
+  if (explicit.length > 0) return path15.posix.resolve(decodeURIComponent(explicit));
+  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path15.posix.join(environment.HOME, ".codex") : void 0);
   if (!codexHome)
     throw new Error("CODEX_HOME or HOME is required for the remote app-server socket");
-  return path14.posix.join(codexHome, "app-server-control", "app-server-control.sock");
+  return path15.posix.join(codexHome, "app-server-control", "app-server-control.sock");
 }
 function officialListenerArgumentsForRemoteListener(arguments_2, socketPath) {
-  if (!path14.posix.isAbsolute(socketPath)) {
+  if (!path15.posix.isAbsolute(socketPath)) {
     throw new Error("Shared official app-server socket path must be absolute");
   }
   if (remoteUnixListenerUrl(arguments_2) === null) {
@@ -33849,7 +34023,7 @@ async function removeStaleSocket(socketPath) {
   await rm6(socketPath, { force: true });
 }
 async function prepareRemoteAppServerSocketDirectory(socketPath) {
-  const socketDirectory = path14.dirname(socketPath);
+  const socketDirectory = path15.dirname(socketPath);
   const existing = await lstat6(socketDirectory).catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
@@ -34056,18 +34230,18 @@ function createRemoteAppServerWebSocketListener(input) {
 import { spawn as spawn3 } from "node:child_process";
 import { randomUUID as randomUUID11 } from "node:crypto";
 import { lstat as lstat7, rm as rm7 } from "node:fs/promises";
-import path15 from "node:path";
+import path16 from "node:path";
 var DEFAULT_CLOSE_TIMEOUT_MS = 2e3;
 var DEFAULT_LISTEN_TIMEOUT_MS = 1e4;
 function remoteOfficialAppServerSocketPath(desktopControlSocketPath, token = randomUUID11()) {
-  if (!path15.posix.isAbsolute(desktopControlSocketPath)) {
+  if (!path16.posix.isAbsolute(desktopControlSocketPath)) {
     throw new Error("Desktop control socket path must be absolute");
   }
   if (!/^[A-Za-z0-9-]+$/u.test(token) || !/[A-Za-z0-9]/u.test(token)) {
     throw new Error("Shared official app-server socket token is invalid");
   }
   const compactToken = token.replaceAll("-", "").slice(0, 15);
-  return path15.posix.join(path15.posix.dirname(desktopControlSocketPath), `.c-${compactToken}.sock`);
+  return path16.posix.join(path16.posix.dirname(desktopControlSocketPath), `.c-${compactToken}.sock`);
 }
 function errorMessage4(error51) {
   return error51 instanceof Error ? error51.message : String(error51);
@@ -34500,7 +34674,7 @@ function createOwnedLoopbackBackend(input) {
       "--ws-auth",
       "capability-token",
       "--ws-token-sha256",
-      createHash7("sha256").update(capabilityToken).digest("hex")
+      createHash8("sha256").update(capabilityToken).digest("hex")
     ],
     // Managed stderr may carry credential-bearing errors. Never forward raw bytes.
     diagnosticOutput: new Writable2({
@@ -34553,19 +34727,19 @@ function createOwnedUnixBackend(input) {
 
 // packages/host-runtime/src/native-account-host.ts
 async function canonicalCodexHome(home) {
-  const absolute = path16.resolve(home);
+  const absolute = path17.resolve(home);
   try {
     return await realpath3(absolute);
   } catch (error51) {
     if (!(error51 instanceof Error && "code" in error51 && error51.code === "ENOENT")) throw error51;
-    const parent = path16.dirname(absolute);
+    const parent = path17.dirname(absolute);
     if (parent === absolute) throw error51;
-    return path16.join(await canonicalCodexHome(parent), path16.basename(absolute));
+    return path17.join(await canonicalCodexHome(parent), path17.basename(absolute));
   }
 }
 async function prepareLocalCodex(input) {
   const home = await canonicalCodexHome(
-    input.environment.CODEX_HOME ?? path16.join(homedir(), ".codex")
+    input.environment.CODEX_HOME ?? path17.join(homedir(), ".codex")
   );
   await mkdir7(home, { recursive: true });
   const scope = new OfficialRuntimeScope({
@@ -34731,18 +34905,18 @@ var DelegationControlRegistry = class {
 };
 
 // packages/host-runtime/src/installed-harness-plugins.ts
-import os4 from "node:os";
-import path18 from "node:path";
+import os5 from "node:os";
+import path19 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // packages/host-runtime/src/launcher-url-opener.ts
 import { spawn as spawn4 } from "node:child_process";
-import path17 from "node:path";
+import path18 from "node:path";
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
 var OPEN_TIMEOUT_MS = 1e4;
 function createLauncherUrlOpener(environment, spawnLauncher = (command, arguments_2, options2) => spawn4(command, arguments_2, options2)) {
   const launcher = environment.CODEXHOST_LAUNCHER_EXECUTABLE;
-  if (!launcher || !path17.isAbsolute(launcher)) return void 0;
+  if (!launcher || !path18.isAbsolute(launcher)) return void 0;
   const launcherEnvironment = Object.fromEntries(
     Object.entries(environment).filter(([name]) => {
       const normalized = name.toUpperCase();
@@ -34800,9 +34974,9 @@ function installedHarnessPluginOptions(environment, managedRemoteHost = false, h
   const opener = managedRemoteHost ? void 0 : createLauncherUrlOpener(environment);
   return {
     pluginRoots: [
-      path18.join(path18.dirname(fileURLToPath(hostRuntimeUrl)), "plugins"),
-      environment[HARNESS_PLUGIN_DIRECTORY_ENV] ?? path18.join(
-        environment.CODEXHOST_DATA_DIR ? path18.resolve(environment.CODEXHOST_DATA_DIR) : path18.join(os4.homedir(), ".codexhost"),
+      path19.join(path19.dirname(fileURLToPath(hostRuntimeUrl)), "plugins"),
+      environment[HARNESS_PLUGIN_DIRECTORY_ENV] ?? path19.join(
+        environment.CODEXHOST_DATA_DIR ? path19.resolve(environment.CODEXHOST_DATA_DIR) : path19.join(os5.homedir(), ".codexhost"),
         "plugins"
       )
     ],
@@ -34927,12 +35101,12 @@ async function startDelegationControlServer(input) {
 }
 
 // packages/host-runtime/src/delegation-skill.ts
-import { createHash as createHash8, randomUUID as randomUUID12 } from "node:crypto";
-import { mkdir as mkdir8, open as open6, readFile as readFile7, rename as rename5, rm as rm8, stat as stat4 } from "node:fs/promises";
-import os5 from "node:os";
-import path19 from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID12 } from "node:crypto";
+import { mkdir as mkdir8, open as open6, readFile as readFile8, rename as rename5, rm as rm8, stat as stat4 } from "node:fs/promises";
+import os6 from "node:os";
+import path20 from "node:path";
 var SKILL_VERSION = 7;
-var SKILL_RELATIVE_PATH = path19.join("skills", "codexhost-delegation", "SKILL.md");
+var SKILL_RELATIVE_PATH = path20.join("skills", "codexhost-delegation", "SKILL.md");
 var PREVIOUS_MANAGED_DIGESTS = [
   "9d2f491850fb0b4084a31ba9b5e4a550b5e833747af322090d8ed0ff80b88c30",
   "2bb0aebb9b06febbc6c0c0bcdb0b32506c7cdbf8dc3b734cc6b2a86621270e4e",
@@ -34987,9 +35161,9 @@ user’s request and the task:
 Report the result returned by read or a completed wait, together with the target
 agent, status, and a labeled task link. Keep internal tracking IDs in tool calls.
 `;
-var CURRENT_DIGEST = createHash8("sha256").update(CODEXHOST_DELEGATION_SKILL).digest("hex");
+var CURRENT_DIGEST = createHash9("sha256").update(CODEXHOST_DELEGATION_SKILL).digest("hex");
 function digest(value2) {
-  return createHash8("sha256").update(value2).digest("hex");
+  return createHash9("sha256").update(value2).digest("hex");
 }
 function managedVersion(value2) {
   const match = /^version:\s*(\d+)\s*$/mu.exec(value2);
@@ -34997,15 +35171,15 @@ function managedVersion(value2) {
 }
 async function readOptional(filePath) {
   try {
-    return await readFile7(filePath, "utf8");
+    return await readFile8(filePath, "utf8");
   } catch (error51) {
     if (error51.code === "ENOENT") return null;
     throw error51;
   }
 }
 async function atomicWrite(filePath, content) {
-  await mkdir8(path19.dirname(filePath), { recursive: true, mode: 448 });
-  const temporaryPath = path19.join(path19.dirname(filePath), `.SKILL.md.${randomUUID12()}.tmp`);
+  await mkdir8(path20.dirname(filePath), { recursive: true, mode: 448 });
+  const temporaryPath = path20.join(path20.dirname(filePath), `.SKILL.md.${randomUUID12()}.tmp`);
   const handle = await open6(temporaryPath, "wx", 384);
   try {
     await handle.writeFile(content, "utf8");
@@ -35020,10 +35194,10 @@ async function atomicWrite(filePath, content) {
   }
 }
 async function installDelegationSkills(input = {}) {
-  const home = input.homeDirectory ?? os5.homedir();
+  const home = input.homeDirectory ?? os6.homedir();
   const destinations = [
-    path19.join(home, ".agents", SKILL_RELATIVE_PATH),
-    path19.join(home, ".claude", SKILL_RELATIVE_PATH)
+    path20.join(home, ".agents", SKILL_RELATIVE_PATH),
+    path20.join(home, ".claude", SKILL_RELATIVE_PATH)
   ];
   const knownDigests = /* @__PURE__ */ new Set([
     CURRENT_DIGEST,
@@ -35068,7 +35242,7 @@ async function installDelegationSkills(input = {}) {
   }
   for (const result of results) {
     if (result.status === "conflict") continue;
-    const source = await readFile7(result.path, "utf8");
+    const source = await readFile8(result.path, "utf8");
     const metadata = await stat4(result.path);
     if (!metadata.isFile() || source !== CODEXHOST_DELEGATION_SKILL) {
       throw new Error(`Delegation Skill verification failed: ${result.path}`);
@@ -35079,7 +35253,7 @@ async function installDelegationSkills(input = {}) {
     throw new Error("Delegation Skill copies are inconsistent");
   }
   if (results.every((result) => result.status !== "conflict")) {
-    const copies = await Promise.all(results.map((result) => readFile7(result.path, "utf8")));
+    const copies = await Promise.all(results.map((result) => readFile8(result.path, "utf8")));
     if (copies.some((copy) => copy !== copies[0])) {
       throw new Error("Delegation Skill copies are inconsistent");
     }
@@ -35090,7 +35264,7 @@ async function installDelegationSkills(input = {}) {
 // packages/host-runtime/src/remote-control-app-server.ts
 import { randomUUID as randomUUID13 } from "node:crypto";
 import { mkdir as mkdir9, open as open7, rename as rename6, rm as rm9 } from "node:fs/promises";
-import path20 from "node:path";
+import path21 from "node:path";
 var REMOTE_CONTROL_BRIDGE_PIPE_ENV = "CODEXHOST_REMOTE_CONTROL_BRIDGE_PIPE";
 var REMOTE_CONTROL_BRIDGE_NODE_ENV = "CODEXHOST_REMOTE_CONTROL_BRIDGE_NODE_PATH";
 var REMOTE_CONTROL_BRIDGE_RUNTIME_ENV = "CODEXHOST_REMOTE_CONTROL_BRIDGE_RUNTIME_PATH";
@@ -35101,8 +35275,8 @@ var BRIDGE_READY_METHOD = "codexhost/remote-control-bridge/ready";
 function absoluteEnvironmentPath2(environment, name, fallback, platform = process.platform) {
   const value2 = environment[name] ?? fallback;
   if (!value2) return null;
-  if (path20.isAbsolute(value2)) return path20.normalize(value2);
-  return platform === "win32" && path20.win32.isAbsolute(value2) ? path20.win32.normalize(value2) : null;
+  if (path21.isAbsolute(value2)) return path21.normalize(value2);
+  return platform === "win32" && path21.win32.isAbsolute(value2) ? path21.win32.normalize(value2) : null;
 }
 function nodeCompatibleWindowsPath(value2) {
   if (value2.startsWith("\\\\?\\UNC\\")) return `\\\\${value2.slice(8)}`;
@@ -35116,13 +35290,13 @@ function remoteControlBridgePipePath(processId = process.pid, instanceId = rando
 }
 function remoteControlBridgeDescriptorPath(environment) {
   const root = environment.LOCALAPPDATA;
-  if (!root || !path20.isAbsolute(root)) return null;
-  return path20.join(path20.normalize(root), "codexhost", REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE);
+  if (!root || !path21.isAbsolute(root)) return null;
+  return path21.join(path21.normalize(root), "codexhost", REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE);
 }
 async function publishRemoteControlAppServerDescriptor(plan) {
-  const directory = path20.dirname(plan.descriptorPath);
+  const directory = path21.dirname(plan.descriptorPath);
   await mkdir9(directory, { recursive: true, mode: 448 });
-  const temporaryPath = path20.join(
+  const temporaryPath = path21.join(
     directory,
     `.${REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE}.${plan.descriptor.ownerPid}.${randomUUID13()}.tmp`
   );
@@ -35423,9 +35597,9 @@ function hasLauncherManagedUpdateRuntime(environment, hostRuntimePath) {
   if (!environment[UPDATE_RUNTIME_ENV.launcherPid]) return false;
   const npmPackageRoot = environment[UPDATE_RUNTIME_ENV.npmPackageRoot];
   if (!npmPackageRoot || !hostRuntimePath) return true;
-  if (!path21.isAbsolute(npmPackageRoot) || !path21.isAbsolute(hostRuntimePath)) return false;
-  const runtimePackageRoot = path21.dirname(path21.dirname(path21.normalize(hostRuntimePath)));
-  return path21.relative(path21.normalize(npmPackageRoot), runtimePackageRoot) === "";
+  if (!path22.isAbsolute(npmPackageRoot) || !path22.isAbsolute(hostRuntimePath)) return false;
+  const runtimePackageRoot = path22.dirname(path22.dirname(path22.normalize(hostRuntimePath)));
+  return path22.relative(path22.normalize(npmPackageRoot), runtimePackageRoot) === "";
 }
 function requiredRuntimeConfiguration(environment) {
   const stockCodexPath = environment[STOCK_CODEX_PATH_ENV];
@@ -35571,8 +35745,8 @@ async function runHostRuntime(input) {
       const socketPath = remoteAppServerSocketPath(delegationEnvironment, listenUrl);
       const officialPlan = createRemoteOfficialAppServerPlan(input.arguments, socketPath);
       const officialRuntimeScope = new OfficialRuntimeScope({
-        permanentHome: path21.resolve(
-          delegationEnvironment.CODEX_HOME ?? path21.join(homedir2(), ".codex")
+        permanentHome: path22.resolve(
+          delegationEnvironment.CODEX_HOME ?? path22.join(homedir2(), ".codex")
         ),
         diagnosticOutput: process.stderr,
         createBackend: () => createOwnedUnixBackend({
@@ -35653,7 +35827,7 @@ async function runHostRuntime(input) {
 }
 
 // packages/host-runtime/src/remote-host-install.ts
-import { createHash as createHash9, randomUUID as randomUUID14 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID14 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import {
   access,
@@ -35661,14 +35835,14 @@ import {
   copyFile as copyFile3,
   lstat as lstat8,
   mkdir as mkdir10,
-  readFile as readFile8,
+  readFile as readFile9,
   rename as rename7,
   rm as rm10,
   rmdir,
   stat as stat5,
   writeFile as writeFile4
 } from "node:fs/promises";
-import path22 from "node:path";
+import path23 from "node:path";
 var MANIFEST_FORMAT = 1;
 var WRAPPER_MARKER = "# codexhost remote SSH wrapper v1";
 var PROFILE_START = "# >>> codexhost remote SSH >>>";
@@ -35679,25 +35853,25 @@ function resolvePaths(options2) {
   if (!configuredHome) {
     throw new Error("A non-root HOME is required for remote Host installation");
   }
-  const home = path22.resolve(configuredHome);
-  if (!home || home === path22.parse(home).root) {
+  const home = path23.resolve(configuredHome);
+  if (!home || home === path23.parse(home).root) {
     throw new Error("A non-root HOME is required for remote Host installation");
   }
-  const installRoot = path22.resolve(options2.installRoot ?? path22.join(home, ".codexhost", "remote"));
-  const profilePath = path22.resolve(
-    options2.profilePath ?? path22.join(
+  const installRoot = path23.resolve(options2.installRoot ?? path23.join(home, ".codexhost", "remote"));
+  const profilePath = path23.resolve(
+    options2.profilePath ?? path23.join(
       home,
-      path22.basename(environment.SHELL ?? "") === "zsh" ? ".zshenv" : path22.basename(environment.SHELL ?? "") === "bash" ? ".bashrc" : ".profile"
+      path23.basename(environment.SHELL ?? "") === "zsh" ? ".zshenv" : path23.basename(environment.SHELL ?? "") === "bash" ? ".bashrc" : ".profile"
     )
   );
-  const binDirectory = path22.join(installRoot, "bin");
+  const binDirectory = path23.join(installRoot, "bin");
   return {
     home,
     installRoot,
     binDirectory,
-    wrapperPath: path22.join(binDirectory, "codex"),
-    manifestPath: path22.join(installRoot, "manifest.json"),
-    dataDirectory: path22.join(installRoot, "data"),
+    wrapperPath: path23.join(binDirectory, "codex"),
+    manifestPath: path23.join(installRoot, "manifest.json"),
+    dataDirectory: path23.join(installRoot, "data"),
     profilePath
   };
 }
@@ -35706,17 +35880,17 @@ function shellQuote(value2) {
 }
 async function existingText(filePath) {
   try {
-    return await readFile8(filePath, "utf8");
+    return await readFile9(filePath, "utf8");
   } catch (error51) {
     if (error51.code === "ENOENT") return null;
     throw error51;
   }
 }
 async function fileSha256(filePath) {
-  return createHash9("sha256").update(await readFile8(filePath)).digest("hex");
+  return createHash10("sha256").update(await readFile9(filePath)).digest("hex");
 }
 async function executable(filePath, label) {
-  const absolute = path22.resolve(filePath);
+  const absolute = path23.resolve(filePath);
   try {
     if (!(await stat5(absolute)).isFile()) throw new Error("not a regular file");
     await access(absolute, fsConstants.X_OK);
@@ -35726,7 +35900,7 @@ async function executable(filePath, label) {
   return absolute;
 }
 async function existingFile(filePath, label) {
-  const absolute = path22.resolve(filePath);
+  const absolute = path23.resolve(filePath);
   try {
     const metadata = await stat5(absolute);
     if (!metadata.isFile()) throw new Error("not a regular file");
@@ -35736,9 +35910,9 @@ async function existingFile(filePath, label) {
   return absolute;
 }
 async function discoverExecutable(name, environment) {
-  for (const directory of (environment.PATH ?? "").split(path22.delimiter)) {
+  for (const directory of (environment.PATH ?? "").split(path23.delimiter)) {
     if (!directory) continue;
-    const candidate = path22.resolve(directory, name);
+    const candidate = path23.resolve(directory, name);
     try {
       await access(candidate, fsConstants.X_OK);
       return candidate;
@@ -35749,10 +35923,10 @@ async function discoverExecutable(name, environment) {
   return null;
 }
 async function writeAtomic(filePath, contents, mode) {
-  await mkdir10(path22.dirname(filePath), { recursive: true, mode: 448 });
-  const temporary = path22.join(
-    path22.dirname(filePath),
-    `.${path22.basename(filePath)}.${process.pid}.${randomUUID14()}.tmp`
+  await mkdir10(path23.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = path23.join(
+    path23.dirname(filePath),
+    `.${path23.basename(filePath)}.${process.pid}.${randomUUID14()}.tmp`
   );
   try {
     if (typeof contents === "string") {
@@ -35773,10 +35947,10 @@ async function writeAtomic(filePath, contents, mode) {
   }
 }
 async function writeAtomicExecutable(filePath, sourcePath) {
-  await mkdir10(path22.dirname(filePath), { recursive: true, mode: 448 });
-  const temporary = path22.join(
-    path22.dirname(filePath),
-    `.${path22.basename(filePath)}.${process.pid}.${randomUUID14()}.tmp`
+  await mkdir10(path23.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = path23.join(
+    path23.dirname(filePath),
+    `.${path23.basename(filePath)}.${process.pid}.${randomUUID14()}.tmp`
   );
   try {
     await copyFile3(sourcePath, temporary);
@@ -35817,15 +35991,14 @@ function removeManagedProfileBlock(contents) {
 function installManagedProfileBlock(contents, manifest) {
   const base = removeManagedProfileBlock(contents);
   const environment = [
-    `export CODEX_INSTALL_DIR=${shellQuote(path22.dirname(manifest.wrapperPath))}`,
-    `export PATH=${shellQuote(path22.dirname(manifest.wrapperPath))}:${shellQuote(path22.dirname(manifest.nodePath))}:${shellQuote(path22.dirname(manifest.stockCodexPath))}:"\${PATH:-/usr/local/bin:/usr/bin:/bin}"`,
+    `export CODEX_INSTALL_DIR=${shellQuote(path23.dirname(manifest.wrapperPath))}`,
+    `export PATH=${shellQuote(path23.dirname(manifest.wrapperPath))}:${shellQuote(path23.dirname(manifest.nodePath))}:${shellQuote(path23.dirname(manifest.stockCodexPath))}:"\${PATH:-/usr/local/bin:/usr/bin:/bin}"`,
     `export CODEXHOST_STOCK_CODEX_PATH=${shellQuote(manifest.stockCodexPath)}`,
     `export CODEXHOST_HOST_NODE_PATH=${shellQuote(manifest.nodePath)}`,
     `export CODEXHOST_HOST_RUNTIME_PATH=${shellQuote(manifest.hostRuntimePath)}`,
     `export CODEXHOST_DATA_DIR=${shellQuote(manifest.dataDirectory)}`,
     "export CODEXHOST_DEFAULT_AGENT='codex'",
-    "export CODEXHOST_REMOTE_SSH_MANAGED='1'",
-    ...manifest.claudeCommand ? [`export CODEXHOST_CLAUDE_COMMAND=${shellQuote(manifest.claudeCommand)}`] : []
+    "export CODEXHOST_REMOTE_SSH_MANAGED='1'"
   ];
   const block = [
     PROFILE_START,
@@ -35835,7 +36008,7 @@ function installManagedProfileBlock(contents, manifest) {
     PROFILE_END,
     ""
   ].join("\n");
-  if (path22.basename(manifest.profilePath) === ".bashrc") return `${block}${base}`;
+  if (path23.basename(manifest.profilePath) === ".bashrc") return `${block}${base}`;
   const separator = base.length > 0 && !base.endsWith("\n") ? "\n" : "";
   return `${base}${separator}${block}`;
 }
@@ -35847,16 +36020,16 @@ async function managedEntrypointState(manifest) {
   if (metadata === null) return "missing";
   if (!metadata.isFile()) return "modified";
   if (process.platform !== "win32" && (metadata.mode & 73) === 0) return "modified";
-  const entrypoint = await readFile8(manifest.wrapperPath);
+  const entrypoint = await readFile9(manifest.wrapperPath);
   if (entrypoint.subarray(0, 256).toString("utf8").startsWith(`#!/usr/bin/env sh
 ${WRAPPER_MARKER}
 `)) {
     return "legacy-wrapper";
   }
   if (manifest.entrypointSha256 !== void 0) {
-    return createHash9("sha256").update(entrypoint).digest("hex") === manifest.entrypointSha256 ? "native" : "modified";
+    return createHash10("sha256").update(entrypoint).digest("hex") === manifest.entrypointSha256 ? "native" : "modified";
   }
-  const shim = await readFile8(manifest.shimPath).catch((error51) => {
+  const shim = await readFile9(manifest.shimPath).catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -35887,6 +36060,7 @@ async function readManifest(filePath) {
     "dataDirectory",
     "entrypointSha256",
     "claudeCommand",
+    // Inert metadata accepted from older format-1 manifests.
     "profileBackupPath"
   ]);
   const requiredPaths = [
@@ -35900,9 +36074,9 @@ async function readManifest(filePath) {
   ];
   const optionalPaths = ["claudeCommand", "profileBackupPath"];
   if (manifest.format !== MANIFEST_FORMAT || Object.keys(manifest).some((key) => !allowed.has(key)) || requiredPaths.some(
-    (key) => typeof manifest[key] !== "string" || !path22.isAbsolute(manifest[key])
+    (key) => typeof manifest[key] !== "string" || !path23.isAbsolute(manifest[key])
   ) || optionalPaths.some(
-    (key) => manifest[key] !== void 0 && (typeof manifest[key] !== "string" || !path22.isAbsolute(manifest[key]))
+    (key) => manifest[key] !== void 0 && (typeof manifest[key] !== "string" || !path23.isAbsolute(manifest[key]))
   ) || manifest.entrypointSha256 !== void 0 && (typeof manifest.entrypointSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(manifest.entrypointSha256))) {
     throw new Error("Remote Host manifest has an unsupported format");
   }
@@ -35924,7 +36098,7 @@ async function installRemoteHost(options2) {
   const paths = resolvePaths(options2);
   const previousManifest = await readManifest(paths.manifestPath);
   const previousManifestFile = previousManifest ? {
-    contents: await readFile8(paths.manifestPath),
+    contents: await readFile9(paths.manifestPath),
     mode: (await stat5(paths.manifestPath)).mode & 511
   } : null;
   const existingEntrypoint = await lstat8(paths.wrapperPath).catch(
@@ -35949,7 +36123,7 @@ async function installRemoteHost(options2) {
   }
   const profilePath = previousManifest?.profilePath ?? paths.profilePath;
   const previousEntrypoint = existingEntrypoint?.isFile() ? {
-    contents: await readFile8(paths.wrapperPath),
+    contents: await readFile9(paths.wrapperPath),
     mode: existingEntrypoint.mode & 511
   } : null;
   const discoveredStock = options2.stockCodexPath ?? previousManifest?.stockCodexPath ?? await discoverExecutable("codex", environment);
@@ -35966,8 +36140,6 @@ async function installRemoteHost(options2) {
   const nodePath2 = await executable(options2.nodePath, "Node runtime");
   const shimPath = await executable(options2.shimPath, "codexhost Shim");
   const hostRuntimePath = await existingFile(options2.hostRuntimePath, "codexhost Host Runtime");
-  const discoveredClaude = options2.claudeCommand ?? previousManifest?.claudeCommand ?? await discoverExecutable("claude", environment);
-  const claudeCommand = discoveredClaude ? await executable(discoveredClaude, "Claude Code command") : void 0;
   let manifest = {
     format: MANIFEST_FORMAT,
     wrapperPath: paths.wrapperPath,
@@ -35977,7 +36149,6 @@ async function installRemoteHost(options2) {
     shimPath,
     hostRuntimePath,
     dataDirectory: paths.dataDirectory,
-    ...claudeCommand ? { claudeCommand } : {},
     ...previousManifest?.profileBackupPath ? { profileBackupPath: previousManifest.profileBackupPath } : {}
   };
   const existingProfileSource = await existingText(profilePath);
@@ -36131,7 +36302,7 @@ async function uninstallRemoteHost(options2) {
 import { spawn as spawn5 } from "node:child_process";
 import { stat as stat6 } from "node:fs/promises";
 import net3 from "node:net";
-import path23 from "node:path";
+import path24 from "node:path";
 import { Duplex } from "node:stream";
 var CODEXHOST_STATUS_METHOD = "codexhost/update/status";
 var DIRECT_PROBE_TIMEOUT_MS = 5e3;
@@ -36150,9 +36321,9 @@ function classifyRemoteHostProbeResponse(response, socketPath) {
 }
 var lifecycleDependencyOverrides = {};
 function socketPathFor(environment) {
-  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path23.join(environment.HOME, ".codex") : void 0);
+  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path24.join(environment.HOME, ".codex") : void 0);
   if (!codexHome) throw new Error("CODEX_HOME or HOME is required for remote Host lifecycle");
-  return path23.join(codexHome, "app-server-control", "app-server-control.sock");
+  return path24.join(codexHome, "app-server-control", "app-server-control.sock");
 }
 async function defaultSocketExists(socketPath) {
   const metadata = await stat6(socketPath).catch((error51) => {
@@ -36279,15 +36450,14 @@ function installedManifest(status) {
 function managedEnvironment(manifest, environment) {
   return {
     ...environment,
-    CODEX_INSTALL_DIR: path23.dirname(manifest.wrapperPath),
+    CODEX_INSTALL_DIR: path24.dirname(manifest.wrapperPath),
     CODEXHOST_STOCK_CODEX_PATH: manifest.stockCodexPath,
     CODEXHOST_HOST_NODE_PATH: manifest.nodePath,
     CODEXHOST_HOST_RUNTIME_PATH: manifest.hostRuntimePath,
     CODEXHOST_DATA_DIR: manifest.dataDirectory,
     CODEXHOST_DEFAULT_AGENT: "codex",
     CODEXHOST_REMOTE_SSH_MANAGED: "1",
-    ...manifest.claudeCommand ? { CODEXHOST_CLAUDE_COMMAND: manifest.claudeCommand } : {},
-    PATH: `${path23.dirname(manifest.wrapperPath)}${path23.delimiter}${path23.dirname(manifest.stockCodexPath)}${path23.delimiter}${environment.PATH ?? "/usr/bin:/bin"}`
+    PATH: `${path24.dirname(manifest.wrapperPath)}${path24.delimiter}${path24.dirname(manifest.stockCodexPath)}${path24.delimiter}${environment.PATH ?? "/usr/bin:/bin"}`
   };
 }
 async function defaultRunTerminator(manifest, socketPath, role, environment) {
@@ -36435,9 +36605,6 @@ function parseRemoteCliArguments(arguments_2) {
       case "--stock-codex":
         options2.stockCodexPath = value2;
         break;
-      case "--claude-command":
-        options2.claudeCommand = value2;
-        break;
       case "--node":
         resources.nodePath = value2;
         break;
@@ -36464,7 +36631,7 @@ async function runRemoteHostCli(input) {
       output.write(
         [
           "usage:",
-          "  codexhost remote install [--stock-codex PATH] [--claude-command PATH]",
+          "  codexhost remote install [--stock-codex PATH]",
           "  codexhost remote start",
           "  codexhost remote stop",
           "  codexhost remote status",
@@ -36625,26 +36792,26 @@ function consumeBrokerFrames(socket, onFrame, onError) {
 }
 
 // packages/harness-broker/dist/paths.js
-import os6 from "node:os";
-import path24 from "node:path";
+import os7 from "node:os";
+import path25 from "node:path";
 var HARNESS_BROKER_DESCRIPTOR_ENV = "CODEXHOST_CLAUDE_BROKER_DESCRIPTOR";
 var HARNESS_BROKER_DESCRIPTOR_FILE = "claude-code-broker-v1.json";
 var HARNESS_BROKER_SOCKET_FILE = "claude-code-broker-v1.sock";
 function defaultHarnessBrokerDirectory(environment = process.env) {
-  const home = environment.HOME || os6.homedir();
-  return path24.join(home, ".codexhost", "harness-broker");
+  const home = environment.HOME || os7.homedir();
+  return path25.join(home, ".codexhost", "harness-broker");
 }
 function defaultHarnessBrokerDescriptorPath(environment = process.env, harnessId = "claude-code") {
   harnessPluginIdSchema.parse(harnessId);
   if (harnessId !== "claude-code")
-    return path24.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.json`);
-  return environment[HARNESS_BROKER_DESCRIPTOR_ENV] ?? path24.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_DESCRIPTOR_FILE);
+    return path25.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.json`);
+  return environment[HARNESS_BROKER_DESCRIPTOR_ENV] ?? path25.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_DESCRIPTOR_FILE);
 }
 function defaultHarnessBrokerSocketPath(environment = process.env, harnessId = "claude-code") {
   harnessPluginIdSchema.parse(harnessId);
   if (harnessId !== "claude-code")
-    return path24.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.sock`);
-  return path24.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_SOCKET_FILE);
+    return path25.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.sock`);
+  return path25.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_SOCKET_FILE);
 }
 
 // packages/harness-broker/dist/validation.js
@@ -36858,9 +37025,9 @@ var harnessOutputSchema = external_exports.custom((value2) => {
 
 // packages/harness-broker/dist/server.js
 import { randomBytes as randomBytes3, randomUUID as randomUUID15 } from "node:crypto";
-import { chmod as chmod5, lstat as lstat9, mkdir as mkdir11, open as open8, readFile as readFile9, rename as rename8, rm as rm11 } from "node:fs/promises";
+import { chmod as chmod5, lstat as lstat9, mkdir as mkdir11, open as open8, readFile as readFile10, rename as rename8, rm as rm11 } from "node:fs/promises";
 import net4, {} from "node:net";
-import path25 from "node:path";
+import path26 from "node:path";
 function harnessError(message, retryable = true) {
   return { code: "unavailable", message, retryable, stage: "harnessBroker" };
 }
@@ -36906,7 +37073,7 @@ async function assertNoLiveDescriptor(descriptorPath) {
         throw new Error("Harness broker descriptor is not owner-only");
       }
     }
-    const descriptor = harnessBrokerDescriptorSchema.parse(JSON.parse(await readFile9(descriptorPath, "utf8")));
+    const descriptor = harnessBrokerDescriptorSchema.parse(JSON.parse(await readFile10(descriptorPath, "utf8")));
     if (processIsAlive2(descriptor.ownerPid)) {
       throw new Error("Harness broker descriptor already has a live owner");
     }
@@ -36983,13 +37150,13 @@ async function prepareUnixSocketPath(socketPath) {
 }
 async function startHarnessBrokerServer(input) {
   harnessPluginIdSchema.parse(input.adapter.harnessId);
-  if (process.platform !== "win32" && path25.dirname(input.descriptorPath) !== path25.dirname(input.socketPath)) {
+  if (process.platform !== "win32" && path26.dirname(input.descriptorPath) !== path26.dirname(input.socketPath)) {
     throw new Error("Harness broker descriptor and socket must share one private directory");
   }
   if (process.platform === "darwin" && Buffer.byteLength(input.socketPath) > 103) {
     throw new Error("Harness broker Unix socket path is too long for macOS");
   }
-  await privateDirectory(path25.dirname(input.descriptorPath));
+  await privateDirectory(path26.dirname(input.descriptorPath));
   await assertNoLiveDescriptor(input.descriptorPath);
   if (process.platform !== "win32")
     await prepareUnixSocketPath(input.socketPath);