@huui/cdx-switcher 1.8.7 → 1.9.0

package/account-switch-BDEmlyn5.mjs

@@ -0,0 +1,1536 @@
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import * as p from "@clack/prompts";
+import { spawn } from "node:child_process";
+import { deletePassword, getPassword, listBackends, setPassword, useBackend } from "@bjesuiter/cross-keychain";
+import { createInterface } from "node:readline/promises";
+import { createHash, randomBytes } from "node:crypto";
+import { Decrypter, Encrypter } from "age-encryption";
+//#region lib/platform/path-resolver.ts
+const envValue = (env, key) => {
+	const value = env[key];
+	if (!value) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+};
+const resolvePiAuthPath = (env, homeDir, platform) => {
+	const piAgentDir = envValue(env, "PI_CODING_AGENT_DIR");
+	if (piAgentDir) return platform === "win32" ? path.win32.join(piAgentDir, "auth.json") : path.join(piAgentDir, "auth.json");
+	return platform === "win32" ? path.win32.join(homeDir, ".pi", "agent", "auth.json") : path.join(homeDir, ".pi", "agent", "auth.json");
+};
+const resolveXdgPaths = (env, homeDir, platform) => {
+	const configHome = envValue(env, "XDG_CONFIG_HOME") ?? path.join(homeDir, ".config");
+	const dataHome = envValue(env, "XDG_DATA_HOME") ?? path.join(homeDir, ".local", "share");
+	const configDir = path.join(configHome, "cdx");
+	return {
+		profile: "xdg",
+		configDir,
+		configPath: path.join(configDir, "accounts.json"),
+		authPath: path.join(dataHome, "opencode", "auth.json"),
+		codexAuthPath: path.join(homeDir, ".codex", "auth.json"),
+		piAuthPath: resolvePiAuthPath(env, homeDir, platform)
+	};
+};
+const resolveWindowsPaths = (env, homeDir) => {
+	const winPath = path.win32;
+	const appData = envValue(env, "APPDATA") ?? winPath.join(homeDir, "AppData", "Roaming");
+	const localAppData = envValue(env, "LOCALAPPDATA") ?? winPath.join(homeDir, "AppData", "Local");
+	const configDir = winPath.join(appData, "cdx");
+	return {
+		profile: "windows-appdata",
+		configDir,
+		configPath: winPath.join(configDir, "accounts.json"),
+		authPath: winPath.join(localAppData, "opencode", "auth.json"),
+		codexAuthPath: winPath.join(homeDir, ".codex", "auth.json"),
+		piAuthPath: resolvePiAuthPath(env, homeDir, "win32")
+	};
+};
+const resolveRuntimePaths = (input) => {
+	if (input.platform === "win32") return resolveWindowsPaths(input.env, input.homeDir);
+	return resolveXdgPaths(input.env, input.homeDir, input.platform);
+};
+//#endregion
+//#region lib/paths.ts
+const toPathConfig = (paths) => ({
+	configDir: paths.configDir,
+	configPath: paths.configPath,
+	authPath: paths.authPath,
+	codexAuthPath: paths.codexAuthPath,
+	piAuthPath: paths.piAuthPath
+});
+const createDefaultPaths = () => {
+	const resolved = resolveRuntimePaths({
+		platform: process.platform,
+		env: process.env,
+		homeDir: os.homedir()
+	});
+	return {
+		paths: toPathConfig(resolved),
+		resolution: {
+			platform: process.platform,
+			profile: resolved.profile
+		}
+	};
+};
+const initial = createDefaultPaths();
+let currentPaths = initial.paths;
+let currentResolution = initial.resolution;
+const getPaths = () => currentPaths;
+const getPathResolutionInfo = () => currentResolution;
+const setPaths = (paths) => {
+	currentPaths = {
+		...currentPaths,
+		...paths
+	};
+	if (paths.configDir && !paths.configPath) currentPaths.configPath = path.join(paths.configDir, "accounts.json");
+};
+const resetPaths = () => {
+	const next = createDefaultPaths();
+	currentPaths = next.paths;
+	currentResolution = next.resolution;
+};
+const createTestPaths = (testDir) => ({
+	configDir: path.join(testDir, "config"),
+	configPath: path.join(testDir, "config", "accounts.json"),
+	authPath: path.join(testDir, "auth", "auth.json"),
+	codexAuthPath: path.join(testDir, "codex", "auth.json"),
+	piAuthPath: path.join(testDir, "pi", "auth.json")
+});
+//#endregion
+//#region lib/config.ts
+const isSecretStoreSelection = (value) => value === "auto" || value === "legacy-keychain";
+const loadConfiguredSecretStoreSelection = async () => {
+	const { configPath } = getPaths();
+	if (!existsSync(configPath)) return;
+	try {
+		const raw = await readFile(configPath, "utf8");
+		const parsed = JSON.parse(raw);
+		return isSecretStoreSelection(parsed.secretStore) ? parsed.secretStore : void 0;
+	} catch {
+		return;
+	}
+};
+const loadConfig = async () => {
+	const { configPath } = getPaths();
+	if (!existsSync(configPath)) throw new Error(`Missing config at ${configPath}. Create accounts.json to list Keychain services.`);
+	const raw = await readFile(configPath, "utf8");
+	const parsed = JSON.parse(raw);
+	if (!Array.isArray(parsed.accounts) || parsed.accounts.length === 0) throw new Error("accounts.json must include a non-empty accounts array.");
+	if (typeof parsed.current !== "number" || Number.isNaN(parsed.current)) parsed.current = 0;
+	if (!isSecretStoreSelection(parsed.secretStore)) delete parsed.secretStore;
+	return parsed;
+};
+const saveConfig = async (config) => {
+	const { configDir, configPath } = getPaths();
+	await mkdir(configDir, { recursive: true });
+	await writeFile(configPath, JSON.stringify(config, null, 2), "utf8");
+};
+const configExists = () => {
+	const { configPath } = getPaths();
+	return existsSync(configPath);
+};
+//#endregion
+//#region lib/auth.ts
+const readExistingJson = async (filePath) => {
+	if (!existsSync(filePath)) return {};
+	try {
+		const raw = await readFile(filePath, "utf8");
+		const parsed = JSON.parse(raw);
+		return typeof parsed === "object" && parsed !== null ? parsed : {};
+	} catch {
+		return {};
+	}
+};
+const writeAuthFile = async (payload) => {
+	const { authPath } = getPaths();
+	await mkdir(path.dirname(authPath), { recursive: true });
+	const existing = await readExistingJson(authPath);
+	existing.openai = {
+		type: "oauth",
+		refresh: payload.refresh,
+		access: payload.access,
+		expires: payload.expires,
+		accountId: payload.accountId
+	};
+	await writeFile(authPath, JSON.stringify(existing, null, 2), "utf8");
+};
+const writeCodexAuthFile = async (payload) => {
+	const { codexAuthPath } = getPaths();
+	await mkdir(path.dirname(codexAuthPath), { recursive: true });
+	const existing = await readExistingJson(codexAuthPath);
+	const existingTokens = typeof existing.tokens === "object" && existing.tokens !== null ? existing.tokens : {};
+	existing.auth_mode = "chatgpt";
+	if (!("OPENAI_API_KEY" in existing)) existing.OPENAI_API_KEY = null;
+	existing.tokens = {
+		...existingTokens,
+		id_token: payload.idToken ?? null,
+		access_token: payload.access,
+		refresh_token: payload.refresh,
+		account_id: payload.accountId
+	};
+	existing.last_refresh = (/* @__PURE__ */ new Date()).toISOString();
+	await writeFile(codexAuthPath, JSON.stringify(existing, null, 2), "utf8");
+};
+const writePiAuthFile = async (payload) => {
+	const { piAuthPath } = getPaths();
+	await mkdir(path.dirname(piAuthPath), { recursive: true });
+	const existing = await readExistingJson(piAuthPath);
+	existing["openai-codex"] = {
+		type: "oauth",
+		access: payload.access,
+		refresh: payload.refresh,
+		expires: payload.expires,
+		accountId: payload.accountId
+	};
+	await writeFile(piAuthPath, JSON.stringify(existing, null, 2), "utf8");
+};
+const writeAllAuthFiles = async (payload) => {
+	await writeAuthFile(payload);
+	await writePiAuthFile(payload);
+	if (payload.idToken) {
+		await writeCodexAuthFile(payload);
+		return {
+			piWritten: true,
+			codexWritten: true,
+			codexMissingIdToken: false,
+			codexCleared: false
+		};
+	}
+	const { codexAuthPath } = getPaths();
+	let codexCleared = false;
+	if (existsSync(codexAuthPath)) try {
+		await rm(codexAuthPath);
+		codexCleared = true;
+	} catch {
+		codexCleared = false;
+	}
+	return {
+		piWritten: true,
+		codexWritten: false,
+		codexMissingIdToken: true,
+		codexCleared
+	};
+};
+//#endregion
+//#region lib/keychain.ts
+const SERVICE_PREFIX$3 = "cdx-openai-";
+const getKeychainService = (accountId) => {
+	return `${SERVICE_PREFIX$3}${accountId}`;
+};
+const runSecurity = (args) => {
+	const result = Bun.spawnSync({
+		cmd: ["security", ...args],
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	if (result.exitCode !== 0) {
+		const message = result.stderr.toString().trim();
+		throw new Error(message || "Keychain command failed");
+	}
+	return result.stdout.toString();
+};
+const runSecuritySafe = (args) => {
+	const result = Bun.spawnSync({
+		cmd: ["security", ...args],
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	return {
+		success: result.exitCode === 0,
+		output: result.exitCode === 0 ? result.stdout.toString() : result.stderr.toString()
+	};
+};
+const runSecuritySafeAsync = async (args) => {
+	const childProcess = Bun.spawn(["security", ...args], {
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	const stdoutPromise = childProcess.stdout ? new Response(childProcess.stdout).text() : Promise.resolve("");
+	const stderrPromise = childProcess.stderr ? new Response(childProcess.stderr).text() : Promise.resolve("");
+	const [exitCode, stdout, stderr] = await Promise.all([
+		childProcess.exited,
+		stdoutPromise,
+		stderrPromise
+	]);
+	return {
+		success: exitCode === 0,
+		output: exitCode === 0 ? stdout : stderr
+	};
+};
+const saveKeychainPayload = (accountId, payload) => {
+	runSecurity([
+		"add-generic-password",
+		"-a",
+		accountId,
+		"-s",
+		getKeychainService(accountId),
+		"-w",
+		JSON.stringify(payload),
+		"-U"
+	]);
+};
+const loadKeychainPayload = (accountId) => {
+	const raw = runSecurity([
+		"find-generic-password",
+		"-s",
+		getKeychainService(accountId),
+		"-w"
+	]).trim();
+	if (!raw) throw new Error(`No Keychain payload found for account ${accountId}.`);
+	const parsed = JSON.parse(raw);
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Keychain payload for account ${accountId} is missing required fields.`);
+	return parsed;
+};
+const deleteKeychainPayload = (accountId) => {
+	runSecurity([
+		"delete-generic-password",
+		"-s",
+		getKeychainService(accountId)
+	]);
+};
+const keychainPayloadExists = (accountId) => {
+	return runSecuritySafe([
+		"find-generic-password",
+		"-s",
+		getKeychainService(accountId)
+	]).success;
+};
+const listKeychainAccounts = () => {
+	const result = Bun.spawnSync({
+		cmd: ["security", "dump-keychain"],
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	if (result.exitCode !== 0) return [];
+	const output = result.stdout.toString();
+	const accounts = [];
+	const serviceRegex = new RegExp(`"svce"<blob>="${SERVICE_PREFIX$3}([^"]+)"`, "g");
+	let match;
+	while ((match = serviceRegex.exec(output)) !== null) if (match[1]) accounts.push(match[1]);
+	return [...new Set(accounts)];
+};
+//#endregion
+//#region lib/secrets/cross-keychain-overrides.ts
+const LEGACY_MAX_PASSWORD_LENGTH = 4096;
+const parseMaxPasswordLength = (value) => {
+	if (!value) return null;
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isInteger(parsed) || parsed <= LEGACY_MAX_PASSWORD_LENGTH) return null;
+	return parsed;
+};
+const getCrossKeychainBackendOverrides = () => {
+	return { max_password_length: parseMaxPasswordLength(process.env.CDX_CROSS_KEYCHAIN_MAX_PASSWORD_LENGTH) ?? 16384 };
+};
+//#endregion
+//#region lib/secrets/fallback-consent.ts
+const CONSENT_FILE = "secure-store-fallback-consent.json";
+const CONSENT_ENV_BYPASS = "CDX_ALLOW_SECURE_STORE_FALLBACK";
+const isBypassEnabled = () => {
+	const value = process.env[CONSENT_ENV_BYPASS];
+	if (!value) return false;
+	return [
+		"1",
+		"true",
+		"yes",
+		"y"
+	].includes(value.trim().toLowerCase());
+};
+const consentFilePath = () => path.join(getPaths().configDir, CONSENT_FILE);
+const loadConsentMap = async () => {
+	try {
+		const raw = await readFile(consentFilePath(), "utf8");
+		return JSON.parse(raw).accepted ?? {};
+	} catch {
+		return {};
+	}
+};
+const saveConsentMap = async (accepted) => {
+	const { configDir } = getPaths();
+	await mkdir(configDir, { recursive: true });
+	const payload = { accepted };
+	await writeFile(consentFilePath(), JSON.stringify(payload, null, 2), "utf8");
+};
+const promptConsent = async (message) => {
+	if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+	process.stdout.write(`\n${message}\n\n`);
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const normalized = (await rl.question("Do you want to continue with this fallback? [y/N]: ")).trim().toLowerCase();
+		return normalized === "y" || normalized === "yes";
+	} finally {
+		rl.close();
+	}
+};
+const ensureFallbackConsent = async (scope, warningMessage) => {
+	if (isBypassEnabled()) return;
+	const accepted = await loadConsentMap();
+	if (accepted[scope]) return;
+	if (!await promptConsent(warningMessage)) throw new Error(`Secure-store fallback usage was not approved for '${scope}'. Re-run in an interactive terminal to confirm, or set ${CONSENT_ENV_BYPASS}=1 if you accept the fallback risk.`);
+	accepted[scope] = { acceptedAt: (/* @__PURE__ */ new Date()).toISOString() };
+	await saveConsentMap(accepted);
+};
+//#endregion
+//#region lib/secrets/linux-cross-keychain.ts
+const SERVICE_PREFIX$2 = "cdx-openai-";
+const LINUX_FALLBACK_SCOPE = "linux:cross-keychain:secret-service";
+const MISSING_ENTRY_MARKERS = [
+	"no matching entry found in secure storage",
+	"password not found",
+	"no stored credentials found",
+	"credential not found",
+	"no result found"
+];
+const STORE_UNAVAILABLE_MARKERS = [
+	"unable to initialize linux secure-store backend",
+	"no keyring backend could be initialized",
+	"native keyring module not available",
+	"linux secure store is unavailable",
+	"secret service operation failed",
+	"couldn't access platform secure storage",
+	"dbus",
+	"d-bus",
+	"org.freedesktop.secrets",
+	"service unavailable"
+];
+let backendInitPromise$2 = null;
+let selectedBackend$2 = null;
+const getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
+const classifyLinuxSecureStoreError = (error) => {
+	const message = getErrorMessage(error).toLowerCase();
+	if (MISSING_ENTRY_MARKERS.some((marker) => message.includes(marker))) return "missing_entry";
+	if (STORE_UNAVAILABLE_MARKERS.some((marker) => message.includes(marker))) return "store_unavailable";
+	return "other";
+};
+const createLinuxSecureStoreUnavailableError = (details) => {
+	const guidance = "Linux secure store is unavailable. Ensure Secret Service is installed/running (for example gnome-keyring with secret-tool), then retry login.";
+	if (!details) return new Error(guidance);
+	return /* @__PURE__ */ new Error(`${guidance} Technical details: ${details}`);
+};
+const tryUseBackend$2 = async (backendId) => {
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		return true;
+	} catch {
+		return false;
+	}
+};
+const selectBackend$2 = async () => {
+	const backends = await listBackends();
+	const available = new Set(backends.map((backend) => backend.id));
+	if (available.has("native-linux") && await tryUseBackend$2("native-linux")) return "native-linux";
+	if (available.has("secret-service") && await tryUseBackend$2("secret-service")) return "secret-service";
+	if (await tryUseBackend$2("native-linux")) return "native-linux";
+	if (await tryUseBackend$2("secret-service")) return "secret-service";
+	throw new Error("Unable to initialize Linux secure-store backend via cross-keychain.");
+};
+const setActiveBackend = (backendId) => {
+	selectedBackend$2 = backendId;
+	backendInitPromise$2 = Promise.resolve();
+};
+const trySwitchBackend = async (backendId, options = {}) => {
+	if (options.forWrite && backendId === "secret-service") await ensureFallbackConsent(LINUX_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain Linux fallback backend is available.\nThis path relies on shell-based `secret-tool` operations for Secret Service access.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while helper commands run.");
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		setActiveBackend(backendId);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const ensureLinuxBackend = async (options = {}) => {
+	if (!backendInitPromise$2) backendInitPromise$2 = (async () => {
+		selectedBackend$2 = await selectBackend$2();
+	})();
+	try {
+		await backendInitPromise$2;
+	} catch {
+		backendInitPromise$2 = null;
+		selectedBackend$2 = null;
+		throw new Error("Unable to initialize Linux secure-store backend via cross-keychain.");
+	}
+	if (options.forWrite && selectedBackend$2 === "secret-service") await ensureFallbackConsent(LINUX_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain Linux fallback backend is available.\nThis path relies on shell-based `secret-tool` operations for Secret Service access.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while helper commands run.");
+};
+const getLinuxCrossKeychainService = (accountId) => `${SERVICE_PREFIX$2}${accountId}`;
+const parsePayload$2 = (accountId, raw) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	}
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Stored credential payload for account ${accountId} is missing required fields.`);
+	return parsed;
+};
+const withService$1 = async (accountId, run, options = {}) => {
+	try {
+		await ensureLinuxBackend(options);
+	} catch (error) {
+		throw createLinuxSecureStoreUnavailableError(getErrorMessage(error));
+	}
+	try {
+		return await run(getLinuxCrossKeychainService(accountId));
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "store_unavailable") throw createLinuxSecureStoreUnavailableError(getErrorMessage(error));
+		throw error;
+	}
+};
+const isInteractiveTerminal = () => Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+const applyEnvAssignments = (raw) => {
+	const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (const line of lines) {
+		const match = line.match(/^([A-Z0-9_]+)=(.*);?$/);
+		if (!match) continue;
+		const key = match[1];
+		const value = match[2].replace(/;$/, "");
+		if (key) process.env[key] = value;
+	}
+};
+const runCommandWithInput = async (command, args, input) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: [
+		"pipe",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	let stderr = "";
+	let spawnError = null;
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	child.once("error", (error) => {
+		spawnError = error.message;
+	});
+	child.once("close", (code) => {
+		resolve({
+			ok: spawnError === null && code === 0,
+			stdout: stdout.trim(),
+			stderr: stderr.trim(),
+			...spawnError ? { error: spawnError } : {}
+		});
+	});
+	child.stdin?.write(input);
+	child.stdin?.end();
+});
+const attemptInteractiveLinuxKeyringUnlock = async () => {
+	if (!isInteractiveTerminal()) return false;
+	const shouldUnlock = await p.confirm({
+		message: "Linux keyring appears locked. Unlock it now?",
+		initialValue: true
+	});
+	if (p.isCancel(shouldUnlock) || !shouldUnlock) return false;
+	const passphrase = await p.password({
+		message: "Enter Linux keyring password:",
+		validate: (value) => {
+			if (!value || !value.trim()) return "Password is required to unlock keyring.";
+		}
+	});
+	if (p.isCancel(passphrase) || !passphrase) return false;
+	const result = await runCommandWithInput("gnome-keyring-daemon", ["--unlock", "--components=secrets"], `${passphrase}\n`);
+	if (!result.ok) {
+		const details = result.error || result.stderr || result.stdout;
+		if (details) process.stderr.write(`cdx: keyring unlock failed (${details})\n`);
+		return false;
+	}
+	applyEnvAssignments(result.stdout);
+	return true;
+};
+const withLinuxUnlockRetry = async (run, options = {}) => {
+	let unlockAttempted = false;
+	while (true) try {
+		return await run();
+	} catch (error) {
+		const kind = classifyLinuxSecureStoreError(error);
+		if (!(!unlockAttempted && (kind === "store_unavailable" || kind === "missing_entry" && options.forWrite && options.retryOnMissingEntryForNativeWrite && selectedBackend$2 === "native-linux"))) throw error;
+		unlockAttempted = true;
+		if (!await attemptInteractiveLinuxKeyringUnlock()) throw error;
+		backendInitPromise$2 = null;
+		selectedBackend$2 = null;
+	}
+};
+const trySaveWithSecretServiceFallback = async (accountId, serializedPayload) => {
+	if (!await trySwitchBackend("secret-service", { forWrite: true })) return {
+		ok: false,
+		error: /* @__PURE__ */ new Error("Unable to switch Linux secure-store backend to secret-service fallback.")
+	};
+	try {
+		await setPassword(getLinuxCrossKeychainService(accountId), accountId, serializedPayload);
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error
+		};
+	}
+};
+const saveLinuxCrossKeychainPayload = async (accountId, payload) => {
+	const serialized = JSON.stringify(payload);
+	try {
+		await withLinuxUnlockRetry(() => withService$1(accountId, (service) => setPassword(service, accountId, serialized), { forWrite: true }), {
+			forWrite: true,
+			retryOnMissingEntryForNativeWrite: true
+		});
+		return;
+	} catch (error) {
+		const kind = classifyLinuxSecureStoreError(error);
+		if (kind === "missing_entry" && selectedBackend$2 === "native-linux") {
+			const fallbackResult = await trySaveWithSecretServiceFallback(accountId, serialized);
+			if (fallbackResult.ok) return;
+			throw createLinuxSecureStoreUnavailableError(`Native backend could not create the credential entry (${getErrorMessage(error)}). Fallback secret-service backend also failed (${getErrorMessage(fallbackResult.error)}).`);
+		}
+		if (kind === "store_unavailable") throw createLinuxSecureStoreUnavailableError(getErrorMessage(error));
+		throw error;
+	}
+};
+const loadLinuxCrossKeychainPayload = async (accountId) => {
+	try {
+		const raw = await withLinuxUnlockRetry(() => withService$1(accountId, (service) => getPassword(service, accountId)));
+		if (raw === null) throw new Error(`No stored credentials found for account ${accountId}.`);
+		return parsePayload$2(accountId, raw);
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "missing_entry") throw new Error(`No stored credentials found for account ${accountId}.`);
+		throw error;
+	}
+};
+const deleteLinuxCrossKeychainPayload = async (accountId) => {
+	try {
+		await withLinuxUnlockRetry(() => withService$1(accountId, (service) => deletePassword(service, accountId)));
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "missing_entry") return;
+		throw error;
+	}
+};
+const linuxCrossKeychainPayloadExists = async (accountId) => {
+	try {
+		return await withLinuxUnlockRetry(() => withService$1(accountId, async (service) => await getPassword(service, accountId) !== null));
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "missing_entry") return false;
+		throw error;
+	}
+};
+//#endregion
+//#region lib/secrets/macos-cross-keychain.ts
+const SERVICE_PREFIX$1 = "cdx-openai-";
+const MACOS_FALLBACK_SCOPE = "darwin:cross-keychain:macos";
+let backendInitPromise$1 = null;
+let selectedBackend$1 = null;
+const tryUseBackend$1 = async (backendId) => {
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		return true;
+	} catch {
+		return false;
+	}
+};
+const selectBackend$1 = async () => {
+	const backends = await listBackends();
+	const available = new Set(backends.map((backend) => backend.id));
+	if (available.has("native-macos") && await tryUseBackend$1("native-macos")) return "native-macos";
+	if (available.has("macos") && await tryUseBackend$1("macos")) return "macos";
+	if (await tryUseBackend$1("native-macos")) return "native-macos";
+	if (await tryUseBackend$1("macos")) return "macos";
+	throw new Error("Unable to initialize macOS keychain backend via cross-keychain.");
+};
+const ensureMacOSBackend = async (options = {}) => {
+	if (!backendInitPromise$1) backendInitPromise$1 = (async () => {
+		selectedBackend$1 = await selectBackend$1();
+	})();
+	try {
+		await backendInitPromise$1;
+	} catch {
+		backendInitPromise$1 = null;
+		selectedBackend$1 = null;
+		throw new Error("Unable to initialize macOS keychain backend via cross-keychain.");
+	}
+	if (options.forWrite && selectedBackend$1 === "macos") await ensureFallbackConsent(MACOS_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain macOS fallback backend is available.\nThis path uses the `security` command to access Keychain.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while helper commands run.");
+};
+const resolveMacOSCrossKeychainBackendId$1 = async () => {
+	await ensureMacOSBackend();
+	if (!selectedBackend$1) throw new Error("Unable to initialize macOS keychain backend via cross-keychain.");
+	return selectedBackend$1;
+};
+const getMacOSCrossKeychainService = (accountId) => `${SERVICE_PREFIX$1}${accountId}`;
+const parsePayload$1 = (accountId, raw) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	}
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Stored credential payload for account ${accountId} is missing required fields.`);
+	return parsed;
+};
+const withService = async (accountId, run, options = {}) => {
+	await ensureMacOSBackend(options);
+	return run(getMacOSCrossKeychainService(accountId));
+};
+const saveMacOSCrossKeychainPayload = async (accountId, payload) => withService(accountId, (service) => setPassword(service, accountId, JSON.stringify(payload)), { forWrite: true });
+const loadMacOSCrossKeychainPayload = async (accountId) => {
+	const raw = await withService(accountId, (service) => getPassword(service, accountId));
+	if (raw === null) throw new Error(`No stored credentials found for account ${accountId}.`);
+	return parsePayload$1(accountId, raw);
+};
+const deleteMacOSCrossKeychainPayload = async (accountId) => withService(accountId, (service) => deletePassword(service, accountId));
+const macosCrossKeychainPayloadExists = async (accountId) => withService(accountId, async (service) => await getPassword(service, accountId) !== null);
+//#endregion
+//#region lib/secrets/windows-cross-keychain.ts
+const SERVICE_PREFIX = "cdx-openai-";
+const WINDOWS_FALLBACK_SCOPE = "win32:cross-keychain:windows";
+const WINDOWS_VAULT_FILE = "accounts.windows.age";
+const WINDOWS_VAULT_VERSION = 1;
+const WINDOWS_VAULT_KEY_SERVICE = "cdx-openai-vault-passphrase";
+const WINDOWS_VAULT_KEY_ACCOUNT = "windows-v1";
+let backendInitPromise = null;
+let selectedBackend = null;
+const tryUseBackend = async (backendId) => {
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		return true;
+	} catch {
+		return false;
+	}
+};
+const selectBackend = async () => {
+	const backends = await listBackends();
+	const available = new Set(backends.map((backend) => backend.id));
+	if (available.has("native-windows") && await tryUseBackend("native-windows")) return "native-windows";
+	if (available.has("windows") && await tryUseBackend("windows")) return "windows";
+	if (await tryUseBackend("native-windows")) return "native-windows";
+	if (await tryUseBackend("windows")) return "windows";
+	throw new Error("Unable to initialize Windows credential backend via cross-keychain.");
+};
+const ensureWindowsBackend = async (options = {}) => {
+	if (!backendInitPromise) backendInitPromise = (async () => {
+		selectedBackend = await selectBackend();
+	})();
+	try {
+		await backendInitPromise;
+	} catch {
+		backendInitPromise = null;
+		selectedBackend = null;
+		throw new Error("Unable to initialize Windows credential backend via cross-keychain.");
+	}
+	if (options.forWrite && selectedBackend === "windows") await ensureFallbackConsent(WINDOWS_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain Windows fallback backend is available.\nThis path runs a PowerShell helper to access Windows Credential Manager.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while the helper runs.");
+};
+const withWindowsBackend = async (run, options = {}) => {
+	await ensureWindowsBackend(options);
+	return run();
+};
+const getWindowsVaultPath = () => path.join(getPaths().configDir, WINDOWS_VAULT_FILE);
+const createVaultPassphrase = () => randomBytes(32).toString("hex");
+const getVaultPassphrase = async (options = {}) => {
+	const current = await getPassword(WINDOWS_VAULT_KEY_SERVICE, WINDOWS_VAULT_KEY_ACCOUNT);
+	if (current) return current;
+	if (!options.createIfMissing) return null;
+	const generated = createVaultPassphrase();
+	await setPassword(WINDOWS_VAULT_KEY_SERVICE, WINDOWS_VAULT_KEY_ACCOUNT, generated);
+	return generated;
+};
+const createEmptyVault = () => ({
+	version: WINDOWS_VAULT_VERSION,
+	accounts: {}
+});
+const parsePayload = (accountId, input) => {
+	if (!input || typeof input !== "object") throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	const parsed = input;
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Stored credential payload for account ${accountId} is missing required fields.`);
+	return {
+		refresh: parsed.refresh,
+		access: parsed.access,
+		expires: parsed.expires,
+		accountId: parsed.accountId,
+		...parsed.idToken ? { idToken: parsed.idToken } : {}
+	};
+};
+const parseVault = (raw, source) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored Windows credential vault (${source}) is not valid JSON.`);
+	}
+	if (!parsed || typeof parsed !== "object") throw new Error(`Stored Windows credential vault (${source}) is not valid JSON.`);
+	const vault = parsed;
+	const rawAccounts = vault.accounts;
+	if (!rawAccounts || typeof rawAccounts !== "object") throw new Error(`Stored Windows credential vault (${source}) is missing account data.`);
+	const accounts = {};
+	for (const [accountId, payload] of Object.entries(rawAccounts)) accounts[accountId] = parsePayload(accountId, payload);
+	return {
+		version: typeof vault.version === "number" ? vault.version : WINDOWS_VAULT_VERSION,
+		accounts
+	};
+};
+const decryptVault = async (ciphertext, passphrase, source) => {
+	const decrypter = new Decrypter();
+	decrypter.addPassphrase(passphrase);
+	let plaintext;
+	try {
+		plaintext = await decrypter.decrypt(ciphertext, "text");
+	} catch {
+		throw new Error(`Failed to decrypt Windows credential vault (${source}). Stored passphrase or vault file may be invalid.`);
+	}
+	return parseVault(plaintext, source);
+};
+const encryptVault = async (vault, passphrase) => {
+	const encrypter = new Encrypter();
+	encrypter.setPassphrase(passphrase);
+	return encrypter.encrypt(JSON.stringify(vault));
+};
+const loadVault = async (passphrase) => {
+	const vaultPath = getWindowsVaultPath();
+	let ciphertext;
+	try {
+		ciphertext = await readFile(vaultPath);
+	} catch (error) {
+		if (error?.code === "ENOENT") return createEmptyVault();
+		throw error;
+	}
+	if (ciphertext.length === 0) return createEmptyVault();
+	return decryptVault(ciphertext, passphrase, vaultPath);
+};
+const saveVault = async (vault, passphrase) => {
+	const { configDir } = getPaths();
+	const vaultPath = getWindowsVaultPath();
+	await mkdir(configDir, { recursive: true });
+	await writeFile(vaultPath, await encryptVault(vault, passphrase));
+};
+const loadLegacyPayload = async (accountId) => {
+	const raw = await getPassword(getWindowsCrossKeychainService(accountId), accountId);
+	if (raw === null) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	}
+	return parsePayload(accountId, parsed);
+};
+const deleteLegacyPayload = async (accountId) => {
+	const service = getWindowsCrossKeychainService(accountId);
+	try {
+		await deletePassword(service, accountId);
+	} catch {}
+};
+const getWindowsCrossKeychainService = (accountId) => `${SERVICE_PREFIX}${accountId}`;
+const saveWindowsCrossKeychainPayload = async (accountId, payload) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase({ createIfMissing: true });
+	if (!passphrase) throw new Error("Unable to resolve Windows credential vault passphrase.");
+	const vault = await loadVault(passphrase);
+	vault.accounts[accountId] = payload;
+	await saveVault(vault, passphrase);
+	await deleteLegacyPayload(accountId);
+}, { forWrite: true });
+const loadWindowsCrossKeychainPayload = async (accountId) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase();
+	if (passphrase) {
+		const payload = (await loadVault(passphrase)).accounts[accountId];
+		if (payload) return payload;
+	}
+	const legacyPayload = await loadLegacyPayload(accountId);
+	if (legacyPayload) return legacyPayload;
+	throw new Error(`No stored credentials found for account ${accountId}.`);
+});
+const deleteWindowsCrossKeychainPayload = async (accountId) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase();
+	if (passphrase) {
+		const vault = await loadVault(passphrase);
+		if (vault.accounts[accountId]) {
+			delete vault.accounts[accountId];
+			if (Object.keys(vault.accounts).length === 0) await rm(getWindowsVaultPath(), { force: true });
+			else await saveVault(vault, passphrase);
+		}
+	}
+	await deleteLegacyPayload(accountId);
+});
+const windowsCrossKeychainPayloadExists = async (accountId) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase();
+	if (passphrase) {
+		if ((await loadVault(passphrase)).accounts[accountId]) return true;
+	}
+	return await loadLegacyPayload(accountId) !== null;
+});
+//#endregion
+//#region lib/secrets/store.ts
+const MISSING_SECRET_STORE_ERROR_MARKERS = [
+	"no stored credentials found",
+	"no keychain payload found",
+	"password not found",
+	"no matching entry found in secure storage",
+	"no result found"
+];
+const isMissingSecretStoreEntryError = (error) => {
+	if (!(error instanceof Error)) return false;
+	const message = error.message.toLowerCase();
+	return MISSING_SECRET_STORE_ERROR_MARKERS.some((marker) => message.includes(marker));
+};
+const createMissingSecretStoreEntryError = (accountId) => /* @__PURE__ */ new Error(`No stored credentials found for account ${accountId}.`);
+const CACHED_ADAPTER_SYMBOL = Symbol.for("cdx.secretStore.cachedAdapter");
+const withSecretStoreCache = (adapter) => {
+	if (adapter[CACHED_ADAPTER_SYMBOL]) return adapter;
+	const payloadCache = /* @__PURE__ */ new Map();
+	const existsCache = /* @__PURE__ */ new Map();
+	const missingAccounts = /* @__PURE__ */ new Set();
+	const inFlightLoads = /* @__PURE__ */ new Map();
+	const markPresent = (accountId, payload) => {
+		payloadCache.set(accountId, payload);
+		existsCache.set(accountId, true);
+		missingAccounts.delete(accountId);
+	};
+	const markMissing = (accountId) => {
+		payloadCache.delete(accountId);
+		existsCache.set(accountId, false);
+		missingAccounts.add(accountId);
+	};
+	const loadAndCache = async (accountId) => {
+		const existingPromise = inFlightLoads.get(accountId);
+		if (existingPromise) return existingPromise;
+		const promise = (async () => {
+			try {
+				const payload = await adapter.load(accountId);
+				markPresent(accountId, payload);
+				return payload;
+			} catch (error) {
+				if (isMissingSecretStoreEntryError(error)) markMissing(accountId);
+				throw error;
+			} finally {
+				inFlightLoads.delete(accountId);
+			}
+		})();
+		inFlightLoads.set(accountId, promise);
+		return promise;
+	};
+	return {
+		id: adapter.id,
+		label: adapter.label,
+		getServiceName: (accountId) => adapter.getServiceName(accountId),
+		save: async (accountId, payload) => {
+			await adapter.save(accountId, payload);
+			markPresent(accountId, payload);
+		},
+		load: async (accountId) => {
+			const cachedPayload = payloadCache.get(accountId);
+			if (cachedPayload) return cachedPayload;
+			if (missingAccounts.has(accountId)) throw createMissingSecretStoreEntryError(accountId);
+			return loadAndCache(accountId);
+		},
+		delete: async (accountId) => {
+			try {
+				await adapter.delete(accountId);
+			} catch (error) {
+				if (isMissingSecretStoreEntryError(error)) markMissing(accountId);
+				throw error;
+			}
+			markMissing(accountId);
+		},
+		exists: async (accountId) => {
+			if (payloadCache.has(accountId)) return true;
+			if (missingAccounts.has(accountId)) return false;
+			const cachedExists = existsCache.get(accountId);
+			if (cachedExists !== void 0) return cachedExists;
+			try {
+				await loadAndCache(accountId);
+				return true;
+			} catch (error) {
+				if (isMissingSecretStoreEntryError(error)) return false;
+			}
+			const exists = await adapter.exists(accountId);
+			existsCache.set(accountId, exists);
+			if (!exists) missingAccounts.add(accountId);
+			return exists;
+		},
+		listAccountIds: async () => {
+			const accountIds = await adapter.listAccountIds();
+			for (const accountId of accountIds) {
+				existsCache.set(accountId, true);
+				missingAccounts.delete(accountId);
+			}
+			return accountIds;
+		},
+		getCapability: () => adapter.getCapability(),
+		[CACHED_ADAPTER_SYMBOL]: true
+	};
+};
+const unsupportedError = (platform) => /* @__PURE__ */ new Error(`No default secret store adapter configured for platform '${platform}'. Only macOS, Windows, and Linux adapters are wired by default right now.`);
+const loadConfiguredAccountIds = async () => {
+	if (!configExists()) return [];
+	return (await loadConfig()).accounts.map((account) => account.accountId);
+};
+const createMacOSCrossKeychainAdapter = () => ({
+	id: "macos-cross-keychain",
+	label: "macOS Keychain (cross-keychain)",
+	getServiceName: getMacOSCrossKeychainService,
+	save: saveMacOSCrossKeychainPayload,
+	load: loadMacOSCrossKeychainPayload,
+	delete: deleteMacOSCrossKeychainPayload,
+	exists: macosCrossKeychainPayloadExists,
+	listAccountIds: async () => {
+		const accountIds = await loadConfiguredAccountIds();
+		return (await Promise.all(accountIds.map(async (accountId) => ({
+			accountId,
+			exists: await macosCrossKeychainPayloadExists(accountId)
+		})))).filter((item) => item.exists).map((item) => item.accountId);
+	},
+	getCapability: () => ({ available: true })
+});
+const createMacOSLegacyKeychainAdapter = () => ({
+	id: "macos-legacy-keychain",
+	label: "macOS Keychain (legacy security CLI)",
+	getServiceName: getKeychainService,
+	save: async (accountId, payload) => {
+		saveKeychainPayload(accountId, payload);
+	},
+	load: async (accountId) => loadKeychainPayload(accountId),
+	delete: async (accountId) => {
+		deleteKeychainPayload(accountId);
+	},
+	exists: async (accountId) => keychainPayloadExists(accountId),
+	listAccountIds: async () => listKeychainAccounts(),
+	getCapability: () => ({ available: true })
+});
+const createWindowsCrossKeychainAdapter = () => ({
+	id: "windows-cross-keychain",
+	label: "Windows Credential Manager (cross-keychain)",
+	getServiceName: getWindowsCrossKeychainService,
+	save: saveWindowsCrossKeychainPayload,
+	load: loadWindowsCrossKeychainPayload,
+	delete: deleteWindowsCrossKeychainPayload,
+	exists: windowsCrossKeychainPayloadExists,
+	listAccountIds: async () => {
+		const accountIds = await loadConfiguredAccountIds();
+		return (await Promise.all(accountIds.map(async (accountId) => ({
+			accountId,
+			exists: await windowsCrossKeychainPayloadExists(accountId)
+		})))).filter((item) => item.exists).map((item) => item.accountId);
+	},
+	getCapability: () => ({ available: true })
+});
+const createLinuxCrossKeychainAdapter = () => ({
+	id: "linux-cross-keychain",
+	label: "Linux Secret Service (cross-keychain)",
+	getServiceName: getLinuxCrossKeychainService,
+	save: saveLinuxCrossKeychainPayload,
+	load: loadLinuxCrossKeychainPayload,
+	delete: deleteLinuxCrossKeychainPayload,
+	exists: linuxCrossKeychainPayloadExists,
+	listAccountIds: async () => {
+		const accountIds = await loadConfiguredAccountIds();
+		return (await Promise.all(accountIds.map(async (accountId) => ({
+			accountId,
+			exists: await linuxCrossKeychainPayloadExists(accountId)
+		})))).filter((item) => item.exists).map((item) => item.accountId);
+	},
+	getCapability: () => ({ available: true })
+});
+const createUnsupportedAdapter = (platform) => ({
+	id: "unsupported",
+	label: "Unsupported (no adapter configured)",
+	getServiceName: (accountId) => `cdx-openai-${accountId}`,
+	save: async () => {
+		throw unsupportedError(platform);
+	},
+	load: async () => {
+		throw unsupportedError(platform);
+	},
+	delete: async () => {
+		throw unsupportedError(platform);
+	},
+	exists: async () => false,
+	listAccountIds: async () => [],
+	getCapability: () => ({
+		available: false,
+		reason: "No default secure-store adapter available for this platform."
+	})
+});
+const createRuntimeSecretStoreAdapter = (platform = process.platform) => {
+	if (platform === "darwin") return createMacOSCrossKeychainAdapter();
+	if (platform === "win32") return createWindowsCrossKeychainAdapter();
+	if (platform === "linux") return createLinuxCrossKeychainAdapter();
+	return createUnsupportedAdapter(platform);
+};
+const createSecretStoreAdapterFromSelection = (selection = "auto", platform = process.platform) => {
+	if (selection === "legacy-keychain") {
+		if (platform !== "darwin") throw new Error("The legacy keychain adapter is only available on macOS (darwin).");
+		return createMacOSLegacyKeychainAdapter();
+	}
+	return createRuntimeSecretStoreAdapter(platform);
+};
+const resolveMacOSCrossKeychainBackendId = async (platform = process.platform) => {
+	if (platform !== "darwin") return null;
+	return resolveMacOSCrossKeychainBackendId$1();
+};
+let currentSecretStoreAdapter = withSecretStoreCache(createRuntimeSecretStoreAdapter());
+const getSecretStoreAdapter = () => currentSecretStoreAdapter;
+const setSecretStoreAdapter = (adapter) => {
+	currentSecretStoreAdapter = withSecretStoreCache(adapter);
+};
+const resetSecretStoreAdapter = () => {
+	currentSecretStoreAdapter = withSecretStoreCache(createRuntimeSecretStoreAdapter());
+};
+const getSecretStoreCapability = () => {
+	const adapter = getSecretStoreAdapter();
+	const capability = adapter.getCapability();
+	return {
+		id: adapter.id,
+		label: adapter.label,
+		available: capability.available,
+		...capability.reason ? { reason: capability.reason } : {}
+	};
+};
+//#endregion
+//#region lib/oauth/constants.ts
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const DEVICE_CODE_URL = "https://auth.openai.com/oauth/device/code";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const CALLBACK_PORT = 1455;
+/**
+* Preserve an explicit Codex Desktop originator override when it is present.
+* Regular terminals use the Desktop default above.
+*/
+const resolveOriginator = (env = process.env) => {
+	return env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE?.trim() || "Codex Desktop";
+};
+//#endregion
+//#region lib/oauth/auth.ts
+/**
+* Create an RFC 7636 S256 PKCE verifier/challenge pair using Node's built-in
+* cryptography. Keeping this small primitive local avoids shipping an OAuth
+* helper dependency solely for PKCE generation.
+*/
+const createPKCE = () => {
+	const verifier = randomBytes(32).toString("base64url");
+	return {
+		verifier,
+		challenge: createHash("sha256").update(verifier).digest("base64url")
+	};
+};
+const createState = () => {
+	return randomBytes(32).toString("base64url");
+};
+const createAuthorizationFlow = async () => {
+	const pkce = createPKCE();
+	const state = createState();
+	const url = new URL(AUTHORIZE_URL);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("redirect_uri", REDIRECT_URI);
+	url.searchParams.set("scope", SCOPE);
+	url.searchParams.set("code_challenge", pkce.challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	url.searchParams.set("id_token_add_organizations", "true");
+	url.searchParams.set("codex_cli_simplified_flow", "true");
+	url.searchParams.set("state", state);
+	url.searchParams.set("originator", resolveOriginator());
+	return {
+		pkce,
+		state,
+		url: url.toString().replaceAll("+", "%20")
+	};
+};
+const truncateForLog = (value, maxLength = 300) => {
+	if (value.length <= maxLength) return value;
+	return `${value.slice(0, maxLength)}…`;
+};
+const isCloudflareChallengeResponse = (headers, bodyText) => {
+	if (headers.get("cf-mitigated")?.toLowerCase() === "challenge") return true;
+	if (!bodyText) return false;
+	return [
+		/<title>Just a moment\.\.\.<\/title>/i,
+		/Enable JavaScript and cookies to continue/i,
+		/challenge-platform/i,
+		/_cf_chl_opt/i
+	].some((pattern) => pattern.test(bodyText));
+};
+const parseOAuthErrorResponse = async (res) => {
+	let rawBody;
+	try {
+		rawBody = await res.text();
+	} catch {
+		rawBody = void 0;
+	}
+	const failureReason = isCloudflareChallengeResponse(res.headers, rawBody) ? "cloudflare_challenge" : void 0;
+	if (!rawBody) return { ...failureReason ? { failureReason } : {} };
+	const trimmed = rawBody.trim();
+	if (!trimmed) return { ...failureReason ? { failureReason } : {} };
+	try {
+		const json = JSON.parse(trimmed);
+		return {
+			...json.error ? { oauthError: json.error } : {},
+			...typeof json.interval === "number" ? { interval: json.interval } : {},
+			responseBody: truncateForLog(JSON.stringify({
+				...json.error ? { error: json.error } : {},
+				...json.error_description ? { error_description: json.error_description } : {},
+				...typeof json.interval === "number" ? { interval: json.interval } : {}
+			})),
+			...failureReason ? { failureReason } : {}
+		};
+	} catch {
+		return {
+			responseBody: failureReason === "cloudflare_challenge" ? "Cloudflare challenge response detected (HTML page)" : truncateForLog(trimmed),
+			...failureReason ? { failureReason } : {}
+		};
+	}
+};
+const startDeviceAuthorizationFlow = async () => {
+	try {
+		const res = await fetch(DEVICE_CODE_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: CLIENT_ID,
+				scope: SCOPE
+			})
+		});
+		if (!res.ok) {
+			const { oauthError, responseBody, failureReason } = await parseOAuthErrorResponse(res);
+			return {
+				type: "failed",
+				error: failureReason === "cloudflare_challenge" ? "Device code request was blocked by a Cloudflare challenge response." : `Device code request failed with HTTP ${res.status} ${res.statusText}`,
+				status: res.status,
+				...oauthError ? { oauthError } : {},
+				...responseBody ? { responseBody } : {},
+				...failureReason ? { failureReason } : {}
+			};
+		}
+		const json = await res.json();
+		if (!json?.device_code || !json?.user_code || !json?.verification_uri || typeof json?.expires_in !== "number") return {
+			type: "failed",
+			error: "Device code response is missing required fields.",
+			responseBody: truncateForLog(JSON.stringify(json))
+		};
+		return {
+			type: "success",
+			flow: {
+				deviceCode: json.device_code,
+				userCode: json.user_code,
+				verificationUri: json.verification_uri,
+				verificationUriComplete: json.verification_uri_complete,
+				expiresIn: json.expires_in,
+				interval: typeof json.interval === "number" && json.interval > 0 ? json.interval : 5
+			}
+		};
+	} catch (error) {
+		return {
+			type: "failed",
+			error: `Device code request failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+};
+const pollDeviceAuthorizationToken = async (deviceCode) => {
+	try {
+		const res = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				device_code: deviceCode,
+				client_id: CLIENT_ID
+			})
+		});
+		if (res.ok) {
+			const json = await res.json();
+			if (!json?.access_token || !json?.refresh_token || typeof json?.expires_in !== "number") return {
+				type: "failed",
+				error: "Device token response is missing access_token/refresh_token/expires_in.",
+				responseBody: truncateForLog(JSON.stringify(json))
+			};
+			return {
+				type: "success",
+				access: json.access_token,
+				refresh: json.refresh_token,
+				expires: Date.now() + json.expires_in * 1e3,
+				idToken: json.id_token
+			};
+		}
+		const { oauthError: errorCode, interval, responseBody, failureReason } = await parseOAuthErrorResponse(res);
+		if (errorCode === "authorization_pending") return {
+			type: "pending",
+			interval: typeof interval === "number" && interval > 0 ? interval : 5
+		};
+		if (errorCode === "slow_down") return {
+			type: "slow_down",
+			interval: typeof interval === "number" && interval > 0 ? interval : 10
+		};
+		if (errorCode === "access_denied") return { type: "access_denied" };
+		if (errorCode === "expired_token") return { type: "expired" };
+		return {
+			type: "failed",
+			error: failureReason === "cloudflare_challenge" ? "Device token polling was blocked by a Cloudflare challenge response." : `Device token polling failed with HTTP ${res.status} ${res.statusText}`,
+			status: res.status,
+			...errorCode ? { oauthError: errorCode } : {},
+			...responseBody ? { responseBody } : {},
+			...failureReason ? { failureReason } : {}
+		};
+	} catch (error) {
+		return {
+			type: "failed",
+			error: `Device token polling request failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+};
+const exchangeAuthorizationCode = async (code, verifier) => {
+	const res = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: REDIRECT_URI
+		})
+	});
+	if (!res.ok) return { type: "failed" };
+	const json = await res.json();
+	if (!json?.access_token || !json?.refresh_token || typeof json?.expires_in !== "number") return { type: "failed" };
+	return {
+		type: "success",
+		access: json.access_token,
+		refresh: json.refresh_token,
+		expires: Date.now() + json.expires_in * 1e3,
+		idToken: json.id_token
+	};
+};
+const refreshAccessToken = async (refreshToken) => {
+	try {
+		const response = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID
+			})
+		});
+		if (!response.ok) return { type: "failed" };
+		const json = await response.json();
+		if (!json?.access_token || !json?.refresh_token || typeof json?.expires_in !== "number") return { type: "failed" };
+		return {
+			type: "success",
+			access: json.access_token,
+			refresh: json.refresh_token,
+			expires: Date.now() + json.expires_in * 1e3,
+			idToken: json.id_token
+		};
+	} catch {
+		return { type: "failed" };
+	}
+};
+const decodeJWT = (token) => {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1];
+		const decoded = Buffer.from(payload, "base64url").toString("utf-8");
+		return JSON.parse(decoded);
+	} catch {
+		return null;
+	}
+};
+const extractAccountId = (accessToken) => {
+	const payload = decodeJWT(accessToken);
+	if (!payload) return null;
+	const authClaim = payload["https://api.openai.com/auth"];
+	if (payload.chatgpt_account_id) return payload.chatgpt_account_id;
+	if (authClaim?.chatgpt_account_id) return authClaim.chatgpt_account_id;
+	const organizationId = payload.organizations?.find((organization) => typeof organization?.id === "string" && organization.id.length > 0)?.id;
+	if (organizationId) return organizationId;
+	if (authClaim?.user_id) return authClaim.user_id;
+	return payload.sub ?? null;
+};
+/**
+* Codex persists the ChatGPT account ID from the ID token. Prefer that token
+* because its claims are tailored for the Codex CLI, then fall back to the
+* access token for OAuth responses that do not include an ID token.
+*/
+const extractAccountIdFromTokens = (idToken, accessToken) => {
+	return (idToken ? extractAccountId(idToken) : null) ?? extractAccountId(accessToken);
+};
+//#endregion
+//#region lib/usage.ts
+const USAGE_ENDPOINT = "https://chatgpt.com/backend-api/wham/usage";
+const USER_AGENT = "cdx-cli";
+/**
+* Hits the undocumented OpenAI usage endpoint (may change without notice).
+*/
+const fetchUsageRaw = async (accessToken, accountId) => {
+	const headers = {
+		Authorization: `Bearer ${accessToken}`,
+		"User-Agent": USER_AGENT,
+		Accept: "application/json"
+	};
+	if (accountId) headers["ChatGPT-Account-Id"] = accountId;
+	return fetch(USAGE_ENDPOINT, { headers });
+};
+/**
+* Fetches usage for an account. On 401, refreshes the token and retries once.
+*/
+const fetchUsage = async (accountId, secretStore = getSecretStoreAdapter()) => {
+	let payload;
+	try {
+		payload = await secretStore.load(accountId);
+	} catch (err) {
+		return {
+			ok: false,
+			error: {
+				type: "auth_failed",
+				message: err instanceof Error ? err.message : "Failed to load credentials"
+			}
+		};
+	}
+	try {
+		let response = await fetchUsageRaw(payload.access, payload.accountId);
+		if (response.status === 401) {
+			const refreshResult = await refreshAccessToken(payload.refresh);
+			if (refreshResult.type === "failed") return {
+				ok: false,
+				error: {
+					type: "auth_failed",
+					message: "Token expired and refresh failed. Try 'cdx login' to re-authenticate."
+				}
+			};
+			const updatedPayload = {
+				...payload,
+				access: refreshResult.access,
+				refresh: refreshResult.refresh,
+				expires: refreshResult.expires,
+				idToken: refreshResult.idToken ?? payload.idToken
+			};
+			await secretStore.save(accountId, updatedPayload);
+			response = await fetchUsageRaw(updatedPayload.access, updatedPayload.accountId);
+			if (!response.ok) return {
+				ok: false,
+				error: {
+					type: "auth_failed",
+					message: `Usage API returned ${response.status} after token refresh.`
+				}
+			};
+		} else if (!response.ok) return {
+			ok: false,
+			error: {
+				type: "unexpected",
+				message: `Usage API returned ${response.status}: ${response.statusText}`
+			}
+		};
+		return {
+			ok: true,
+			data: await response.json()
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: {
+				type: "network_error",
+				message: err instanceof Error ? err.message : "Network request failed"
+			}
+		};
+	}
+};
+const formatWindowLabel = (seconds) => {
+	const hours = seconds / 3600;
+	if (hours >= 24) {
+		const days = Math.round(hours / 24);
+		return days === 7 ? "weekly" : `${days}d`;
+	}
+	return `${Math.round(hours)}h`;
+};
+const formatResetCountdown = (resetAtUnix) => {
+	const diff = resetAtUnix * 1e3 - Date.now();
+	if (diff <= 0) return "now";
+	const minutes = Math.floor(diff / 6e4);
+	const hours = Math.floor(minutes / 60);
+	const remainingMinutes = minutes % 60;
+	if (hours > 0) return remainingMinutes > 0 ? `${hours}h ${remainingMinutes}m` : `${hours}h`;
+	return `${minutes}m`;
+};
+const formatPercentageBar = (usedPercent) => {
+	const width = 20;
+	const filled = Math.round(usedPercent / 100 * width);
+	const empty = width - filled;
+	return `[${"█".repeat(filled)}${"░".repeat(empty)}] ${usedPercent}% used`;
+};
+const formatWindow = (label, w) => {
+	return [
+		`${label} (${formatWindowLabel(w.limit_window_seconds)} window):`,
+		`  ${formatPercentageBar(w.used_percent)}`,
+		`  Resets in: ${formatResetCountdown(w.reset_at)}`
+	];
+};
+const formatUsage = (usage) => {
+	const lines = [];
+	const plan = usage.plan_type ?? "unknown";
+	lines.push(`Plan: ${plan}`);
+	lines.push("");
+	if (usage.rate_limit?.primary_window) lines.push(...formatWindow("Primary", usage.rate_limit.primary_window));
+	if (usage.rate_limit?.secondary_window) lines.push(...formatWindow("Secondary", usage.rate_limit.secondary_window));
+	if (usage.credits) {
+		lines.push("");
+		if (usage.credits.unlimited) lines.push("Credits: unlimited");
+		else if (usage.credits.has_credits && usage.credits.balance !== void 0) lines.push(`Credits: $${Number(usage.credits.balance).toFixed(2)}`);
+		else if (!usage.credits.has_credits) lines.push("Credits: none");
+	}
+	return lines.join("\n");
+};
+const formatUsageBars = (usage, indent = "    ") => {
+	const windows = [];
+	if (usage.rate_limit?.primary_window) windows.push({
+		label: formatWindowLabel(usage.rate_limit.primary_window.limit_window_seconds),
+		window: usage.rate_limit.primary_window
+	});
+	if (usage.rate_limit?.secondary_window) windows.push({
+		label: formatWindowLabel(usage.rate_limit.secondary_window.limit_window_seconds),
+		window: usage.rate_limit.secondary_window
+	});
+	const maxLabelLen = Math.max(...windows.map((w) => w.label.length), 0);
+	return windows.map(({ label, window: w }) => {
+		return `${indent}${label.padEnd(maxLabelLen)}  ${formatPercentageBar(w.used_percent)}  resets in ${formatResetCountdown(w.reset_at)}`;
+	});
+};
+const formatUsageOverview = (entries) => {
+	const lines = [];
+	for (let i = 0; i < entries.length; i++) {
+		const entry = entries[i];
+		const marker = entry.isCurrent ? "→ " : "  ";
+		if (entry.result.ok) {
+			const usage = entry.result.data;
+			const plan = usage.plan_type ?? "unknown";
+			lines.push(`${marker}${entry.displayName} (${plan})`);
+			lines.push(...formatUsageBars(usage));
+		} else lines.push(`${marker}${entry.displayName}: [error] ${entry.result.error.message}`);
+		if (i < entries.length - 1) lines.push("");
+	}
+	return lines.join("\n");
+};
+//#endregion
+//#region lib/account-switch.ts
+/**
+* Executes the existing account-switch sequence without producing CLI output.
+* Callers are responsible for presenting the result to their own interface.
+*/
+const switchAccountAtIndex = async (config, targetIndex, secretStore = getSecretStoreAdapter()) => {
+	const account = config.accounts[targetIndex];
+	if (!account?.accountId) throw new Error("Account entry missing accountId.");
+	const previousIndex = config.current;
+	const payload = await secretStore.load(account.accountId);
+	const authResult = await writeAllAuthFiles(payload);
+	config.current = targetIndex;
+	await saveConfig(config);
+	return {
+		previousIndex,
+		currentIndex: targetIndex,
+		account,
+		payload,
+		authResult
+	};
+};
+//#endregion
+export { createTestPaths as A, writeAuthFile as C, loadConfig as D, configExists as E, getPaths as M, resetPaths as N, loadConfiguredSecretStoreSelection as O, setPaths as P, writeAllAuthFiles as S, writePiAuthFile as T, isMissingSecretStoreEntryError as _, formatUsageOverview as a, setSecretStoreAdapter as b, extractAccountIdFromTokens as c, CALLBACK_PORT as d, createMacOSLegacyKeychainAdapter as f, getSecretStoreCapability as g, getSecretStoreAdapter as h, formatUsageBars as i, getPathResolutionInfo as j, saveConfig as k, pollDeviceAuthorizationToken as l, createSecretStoreAdapterFromSelection as m, fetchUsage as n, createAuthorizationFlow as o, createRuntimeSecretStoreAdapter as p, formatUsage as r, exchangeAuthorizationCode as s, switchAccountAtIndex as t, startDeviceAuthorizationFlow as u, resetSecretStoreAdapter as v, writeCodexAuthFile as w, runSecuritySafeAsync as x, resolveMacOSCrossKeychainBackendId as y };