@huui/cdx-switcher 1.8.7

package/cdx.mjs

@@ -0,0 +1,4671 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync } from "node:fs";
+import tab from "@bomb.sh/tab/commander";
+import { Command, InvalidArgumentError } from "commander";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import * as p from "@clack/prompts";
+import { spawn, spawnSync } from "node:child_process";
+import { deletePassword, getPassword, listBackends, setPassword, useBackend } from "@bjesuiter/cross-keychain";
+import { createInterface } from "node:readline/promises";
+import { createHash, randomBytes } from "node:crypto";
+import { Decrypter, Encrypter } from "age-encryption";
+import http from "node:http";
+//#region package.json
+var version = "1.8.7";
+//#endregion
+//#region lib/platform/path-resolver.ts
+const envValue = (env, key) => {
+	const value = env[key];
+	if (!value) return void 0;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+};
+const resolvePiAuthPath = (env, homeDir, platform) => {
+	const piAgentDir = envValue(env, "PI_CODING_AGENT_DIR");
+	if (piAgentDir) return platform === "win32" ? path.win32.join(piAgentDir, "auth.json") : path.join(piAgentDir, "auth.json");
+	return platform === "win32" ? path.win32.join(homeDir, ".pi", "agent", "auth.json") : path.join(homeDir, ".pi", "agent", "auth.json");
+};
+const resolveXdgPaths = (env, homeDir, platform) => {
+	const configHome = envValue(env, "XDG_CONFIG_HOME") ?? path.join(homeDir, ".config");
+	const dataHome = envValue(env, "XDG_DATA_HOME") ?? path.join(homeDir, ".local", "share");
+	const configDir = path.join(configHome, "cdx");
+	return {
+		profile: "xdg",
+		configDir,
+		configPath: path.join(configDir, "accounts.json"),
+		authPath: path.join(dataHome, "opencode", "auth.json"),
+		codexAuthPath: path.join(homeDir, ".codex", "auth.json"),
+		piAuthPath: resolvePiAuthPath(env, homeDir, platform)
+	};
+};
+const resolveWindowsPaths = (env, homeDir) => {
+	const winPath = path.win32;
+	const appData = envValue(env, "APPDATA") ?? winPath.join(homeDir, "AppData", "Roaming");
+	const localAppData = envValue(env, "LOCALAPPDATA") ?? winPath.join(homeDir, "AppData", "Local");
+	const configDir = winPath.join(appData, "cdx");
+	return {
+		profile: "windows-appdata",
+		configDir,
+		configPath: winPath.join(configDir, "accounts.json"),
+		authPath: winPath.join(localAppData, "opencode", "auth.json"),
+		codexAuthPath: winPath.join(homeDir, ".codex", "auth.json"),
+		piAuthPath: resolvePiAuthPath(env, homeDir, "win32")
+	};
+};
+const resolveRuntimePaths = (input) => {
+	if (input.platform === "win32") return resolveWindowsPaths(input.env, input.homeDir);
+	return resolveXdgPaths(input.env, input.homeDir, input.platform);
+};
+//#endregion
+//#region lib/paths.ts
+const toPathConfig = (paths) => ({
+	configDir: paths.configDir,
+	configPath: paths.configPath,
+	authPath: paths.authPath,
+	codexAuthPath: paths.codexAuthPath,
+	piAuthPath: paths.piAuthPath
+});
+const createDefaultPaths = () => {
+	const resolved = resolveRuntimePaths({
+		platform: process.platform,
+		env: process.env,
+		homeDir: os.homedir()
+	});
+	return {
+		paths: toPathConfig(resolved),
+		resolution: {
+			platform: process.platform,
+			profile: resolved.profile
+		}
+	};
+};
+const initial = createDefaultPaths();
+let currentPaths = initial.paths;
+let currentResolution = initial.resolution;
+const getPaths = () => currentPaths;
+const getPathResolutionInfo = () => currentResolution;
+const setPaths = (paths) => {
+	currentPaths = {
+		...currentPaths,
+		...paths
+	};
+	if (paths.configDir && !paths.configPath) currentPaths.configPath = path.join(paths.configDir, "accounts.json");
+};
+const resetPaths = () => {
+	const next = createDefaultPaths();
+	currentPaths = next.paths;
+	currentResolution = next.resolution;
+};
+const createTestPaths = (testDir) => ({
+	configDir: path.join(testDir, "config"),
+	configPath: path.join(testDir, "config", "accounts.json"),
+	authPath: path.join(testDir, "auth", "auth.json"),
+	codexAuthPath: path.join(testDir, "codex", "auth.json"),
+	piAuthPath: path.join(testDir, "pi", "auth.json")
+});
+//#endregion
+//#region lib/config.ts
+const isSecretStoreSelection = (value) => value === "auto" || value === "legacy-keychain";
+const loadConfiguredSecretStoreSelection = async () => {
+	const { configPath } = getPaths();
+	if (!existsSync(configPath)) return;
+	try {
+		const raw = await readFile(configPath, "utf8");
+		const parsed = JSON.parse(raw);
+		return isSecretStoreSelection(parsed.secretStore) ? parsed.secretStore : void 0;
+	} catch {
+		return;
+	}
+};
+const loadConfig = async () => {
+	const { configPath } = getPaths();
+	if (!existsSync(configPath)) throw new Error(`Missing config at ${configPath}. Create accounts.json to list Keychain services.`);
+	const raw = await readFile(configPath, "utf8");
+	const parsed = JSON.parse(raw);
+	if (!Array.isArray(parsed.accounts) || parsed.accounts.length === 0) throw new Error("accounts.json must include a non-empty accounts array.");
+	if (typeof parsed.current !== "number" || Number.isNaN(parsed.current)) parsed.current = 0;
+	if (!isSecretStoreSelection(parsed.secretStore)) delete parsed.secretStore;
+	return parsed;
+};
+const saveConfig = async (config) => {
+	const { configDir, configPath } = getPaths();
+	await mkdir(configDir, { recursive: true });
+	await writeFile(configPath, JSON.stringify(config, null, 2), "utf8");
+};
+const configExists = () => {
+	const { configPath } = getPaths();
+	return existsSync(configPath);
+};
+//#endregion
+//#region lib/commands/errors.ts
+const exitWithCommandError = (error) => {
+	const message = error instanceof Error ? error.message : String(error);
+	process.stderr.write(`${message}\n`);
+	process.exit(1);
+};
+//#endregion
+//#region lib/auth.ts
+const readExistingJson = async (filePath) => {
+	if (!existsSync(filePath)) return {};
+	try {
+		const raw = await readFile(filePath, "utf8");
+		const parsed = JSON.parse(raw);
+		return typeof parsed === "object" && parsed !== null ? parsed : {};
+	} catch {
+		return {};
+	}
+};
+const writeAuthFile = async (payload) => {
+	const { authPath } = getPaths();
+	await mkdir(path.dirname(authPath), { recursive: true });
+	const existing = await readExistingJson(authPath);
+	existing.openai = {
+		type: "oauth",
+		refresh: payload.refresh,
+		access: payload.access,
+		expires: payload.expires,
+		accountId: payload.accountId
+	};
+	await writeFile(authPath, JSON.stringify(existing, null, 2), "utf8");
+};
+const writeCodexAuthFile = async (payload) => {
+	const { codexAuthPath } = getPaths();
+	await mkdir(path.dirname(codexAuthPath), { recursive: true });
+	const existing = await readExistingJson(codexAuthPath);
+	const existingTokens = typeof existing.tokens === "object" && existing.tokens !== null ? existing.tokens : {};
+	existing.auth_mode = "chatgpt";
+	if (!("OPENAI_API_KEY" in existing)) existing.OPENAI_API_KEY = null;
+	existing.tokens = {
+		...existingTokens,
+		id_token: payload.idToken ?? null,
+		access_token: payload.access,
+		refresh_token: payload.refresh,
+		account_id: payload.accountId
+	};
+	existing.last_refresh = (/* @__PURE__ */ new Date()).toISOString();
+	await writeFile(codexAuthPath, JSON.stringify(existing, null, 2), "utf8");
+};
+const writePiAuthFile = async (payload) => {
+	const { piAuthPath } = getPaths();
+	await mkdir(path.dirname(piAuthPath), { recursive: true });
+	const existing = await readExistingJson(piAuthPath);
+	existing["openai-codex"] = {
+		type: "oauth",
+		access: payload.access,
+		refresh: payload.refresh,
+		expires: payload.expires,
+		accountId: payload.accountId
+	};
+	await writeFile(piAuthPath, JSON.stringify(existing, null, 2), "utf8");
+};
+const writeAllAuthFiles = async (payload) => {
+	await writeAuthFile(payload);
+	await writePiAuthFile(payload);
+	if (payload.idToken) {
+		await writeCodexAuthFile(payload);
+		return {
+			piWritten: true,
+			codexWritten: true,
+			codexMissingIdToken: false,
+			codexCleared: false
+		};
+	}
+	const { codexAuthPath } = getPaths();
+	let codexCleared = false;
+	if (existsSync(codexAuthPath)) try {
+		await rm(codexAuthPath);
+		codexCleared = true;
+	} catch {
+		codexCleared = false;
+	}
+	return {
+		piWritten: true,
+		codexWritten: false,
+		codexMissingIdToken: true,
+		codexCleared
+	};
+};
+//#endregion
+//#region lib/platform/browser.ts
+const getBrowserLauncher = (platform = process.platform, url) => {
+	if (platform === "darwin") return {
+		command: "open",
+		args: [url],
+		label: "open"
+	};
+	if (platform === "win32") return {
+		command: "rundll32.exe",
+		args: ["url.dll,FileProtocolHandler", url],
+		label: "rundll32.exe url.dll,FileProtocolHandler"
+	};
+	return {
+		command: "xdg-open",
+		args: [url],
+		label: "xdg-open"
+	};
+};
+const isCommandAvailable$3 = (command, platform = process.platform) => {
+	const probe = platform === "win32" ? "where" : "which";
+	return Bun.spawnSync({
+		cmd: [probe, command],
+		stdout: "pipe",
+		stderr: "pipe"
+	}).exitCode === 0;
+};
+const getBrowserLauncherCapability = (platform = process.platform) => {
+	const launcher = getBrowserLauncher(platform, "https://example.com");
+	return {
+		command: launcher.command,
+		label: launcher.label,
+		available: isCommandAvailable$3(launcher.command, platform)
+	};
+};
+const openBrowserUrl = (url, options = {}) => {
+	const platform = options.platform ?? process.platform;
+	const spawnImpl = options.spawnImpl ?? spawn;
+	const commandAvailable = options.isCommandAvailableImpl ?? isCommandAvailable$3;
+	const launcher = getBrowserLauncher(platform, url);
+	if (!commandAvailable(launcher.command, platform)) return {
+		ok: false,
+		launcher,
+		reason: "launcher_missing",
+		error: `${launcher.command} not found in PATH`
+	};
+	try {
+		const child = spawnImpl(launcher.command, launcher.args, {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.once("error", () => {});
+		child.unref();
+		return {
+			ok: true,
+			launcher
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			launcher,
+			reason: "spawn_failed",
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+};
+//#endregion
+//#region lib/platform/clipboard.ts
+const isCommandAvailable$2 = (command, platform = process.platform) => {
+	const probe = platform === "win32" ? "where" : "which";
+	return Bun.spawnSync({
+		cmd: [probe, command],
+		stdout: "pipe",
+		stderr: "pipe"
+	}).exitCode === 0;
+};
+const isLikelyMoshSession = (env = process.env) => Boolean(env.MOSH_IP || env.MOSH_KEY || env.MOSH_PREDICTION_DISPLAY);
+const isLikelyRemoteSession = (env = process.env) => {
+	if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY) return true;
+	return isLikelyMoshSession(env);
+};
+const hasDisplayServer = (env) => Boolean(env.WAYLAND_DISPLAY || env.DISPLAY);
+const supportsOsc52 = (isTTY, env) => {
+	if (!isTTY) return false;
+	if ((env.TERM ?? "").toLowerCase() === "dumb") return false;
+	return true;
+};
+const getLocalClipboardTargets = (platform, env, commandExists) => {
+	if (platform === "darwin") return commandExists("pbcopy", platform) ? [{
+		kind: "command",
+		method: "pbcopy",
+		command: "pbcopy",
+		args: []
+	}] : [];
+	if (platform === "win32") {
+		const targets = [];
+		if (commandExists("clip", platform)) targets.push({
+			kind: "command",
+			method: "clip",
+			command: "cmd",
+			args: ["/c", "clip"]
+		});
+		if (commandExists("powershell", platform)) targets.push({
+			kind: "command",
+			method: "powershell",
+			command: "powershell",
+			args: [
+				"-NoProfile",
+				"-Command",
+				"$v=[Console]::In.ReadToEnd(); Set-Clipboard -Value $v"
+			]
+		});
+		if (commandExists("pwsh", platform)) targets.push({
+			kind: "command",
+			method: "powershell",
+			command: "pwsh",
+			args: [
+				"-NoProfile",
+				"-Command",
+				"$v=[Console]::In.ReadToEnd(); Set-Clipboard -Value $v"
+			]
+		});
+		return targets;
+	}
+	const targets = [];
+	const wayland = Boolean(env.WAYLAND_DISPLAY);
+	const x11 = Boolean(env.DISPLAY);
+	if (isLikelyRemoteSession(env) && !hasDisplayServer(env)) return targets;
+	if (wayland && commandExists("wl-copy", platform)) targets.push({
+		kind: "command",
+		method: "wl-copy",
+		command: "wl-copy",
+		args: []
+	});
+	if ((x11 || !wayland) && commandExists("xclip", platform)) targets.push({
+		kind: "command",
+		method: "xclip",
+		command: "xclip",
+		args: ["-selection", "clipboard"]
+	});
+	if ((x11 || !wayland) && commandExists("xsel", platform)) targets.push({
+		kind: "command",
+		method: "xsel",
+		command: "xsel",
+		args: ["--clipboard", "--input"]
+	});
+	if (!wayland && commandExists("wl-copy", platform)) targets.push({
+		kind: "command",
+		method: "wl-copy",
+		command: "wl-copy",
+		args: []
+	});
+	return targets;
+};
+const resolveClipboardTargets = (context = {}, commandExists = isCommandAvailable$2) => {
+	const platform = context.platform ?? process.platform;
+	const env = context.env ?? process.env;
+	const isTTY = context.isTTY ?? (Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY));
+	const localTargets = getLocalClipboardTargets(platform, env, commandExists);
+	const remote = isLikelyRemoteSession(env);
+	const allowOsc52 = supportsOsc52(isTTY, env);
+	const result = [];
+	if (remote && allowOsc52) result.push({
+		kind: "osc52",
+		method: "osc52"
+	});
+	result.push(...localTargets);
+	if (!remote && allowOsc52) result.push({
+		kind: "osc52",
+		method: "osc52"
+	});
+	return result;
+};
+const buildOsc52Sequence = (text, env = process.env) => {
+	const osc = `\u001b]52;c;${Buffer.from(text, "utf8").toString("base64")}\u0007`;
+	if (env.TMUX) return `\u001bPtmux;\u001b${osc}\u001b\\`;
+	const term = (env.TERM ?? "").toLowerCase();
+	if (env.STY || term.startsWith("screen")) return `\u001bP${osc}\u001b\\`;
+	return osc;
+};
+const defaultRunCommand = (command, args, input) => {
+	const result = spawnSync(command, args, {
+		input,
+		encoding: "utf8",
+		windowsHide: true
+	});
+	if (result.status === 0) return { ok: true };
+	const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+	const stdout = typeof result.stdout === "string" ? result.stdout.trim() : "";
+	return {
+		ok: false,
+		error: stderr || stdout || `exit status ${result.status ?? "unknown"}`
+	};
+};
+const tryCopyToClipboard = (text, options = {}) => {
+	const commandExists = options.commandExistsImpl ?? isCommandAvailable$2;
+	const runCommand = options.runCommandImpl ?? defaultRunCommand;
+	const writeStdout = options.writeStdoutImpl ?? ((chunk) => {
+		process.stdout.write(chunk);
+	});
+	const targets = resolveClipboardTargets(options, commandExists);
+	if (targets.length === 0) return {
+		ok: false,
+		method: "none",
+		error: "No clipboard method available in this environment"
+	};
+	const errors = [];
+	for (const target of targets) {
+		if (target.kind === "osc52") {
+			const env = options.env ?? process.env;
+			try {
+				writeStdout(buildOsc52Sequence(text, env));
+				if (isLikelyMoshSession(env)) return {
+					ok: true,
+					method: "osc52",
+					warning: "Mosh session detected: OSC52 clipboard updates may not work reliably. If clipboard did not update, copy the URL manually from above."
+				};
+				return {
+					ok: true,
+					method: "osc52"
+				};
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				errors.push(`osc52: ${message}`);
+				continue;
+			}
+		}
+		const commandResult = runCommand(target.command, target.args, text);
+		if (commandResult.ok) return {
+			ok: true,
+			method: target.method
+		};
+		errors.push(`${target.method}: ${commandResult.error ?? "unknown error"}`);
+	}
+	return {
+		ok: false,
+		method: "none",
+		error: errors.join("; ")
+	};
+};
+const escapePosixSingleQuoted = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+const buildClipboardHelperCommand = (text, context = {}, commandExists = isCommandAvailable$2) => {
+	const commandTarget = resolveClipboardTargets(context, commandExists).find((target) => target.kind === "command");
+	if (!commandTarget) return null;
+	if (commandTarget.method === "powershell") {
+		const escaped = text.replace(/'/g, "''");
+		return `${commandTarget.command} -NoProfile -Command "Set-Clipboard -Value '${escaped}'"`;
+	}
+	if (commandTarget.method === "clip") return `printf '%s' ${escapePosixSingleQuoted(text)} | cmd /c clip`;
+	return `printf '%s' ${escapePosixSingleQuoted(text)} | ${commandTarget.command} ${commandTarget.args.join(" ")}`.trim();
+};
+//#endregion
+//#region lib/keychain.ts
+const SERVICE_PREFIX$3 = "cdx-openai-";
+const getKeychainService = (accountId) => {
+	return `${SERVICE_PREFIX$3}${accountId}`;
+};
+const runSecurity = (args) => {
+	const result = Bun.spawnSync({
+		cmd: ["security", ...args],
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	if (result.exitCode !== 0) {
+		const message = result.stderr.toString().trim();
+		throw new Error(message || "Keychain command failed");
+	}
+	return result.stdout.toString();
+};
+const runSecuritySafe = (args) => {
+	const result = Bun.spawnSync({
+		cmd: ["security", ...args],
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	return {
+		success: result.exitCode === 0,
+		output: result.exitCode === 0 ? result.stdout.toString() : result.stderr.toString()
+	};
+};
+const runSecuritySafeAsync = async (args) => {
+	const childProcess = Bun.spawn(["security", ...args], {
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	const stdoutPromise = childProcess.stdout ? new Response(childProcess.stdout).text() : Promise.resolve("");
+	const stderrPromise = childProcess.stderr ? new Response(childProcess.stderr).text() : Promise.resolve("");
+	const [exitCode, stdout, stderr] = await Promise.all([
+		childProcess.exited,
+		stdoutPromise,
+		stderrPromise
+	]);
+	return {
+		success: exitCode === 0,
+		output: exitCode === 0 ? stdout : stderr
+	};
+};
+const saveKeychainPayload = (accountId, payload) => {
+	runSecurity([
+		"add-generic-password",
+		"-a",
+		accountId,
+		"-s",
+		getKeychainService(accountId),
+		"-w",
+		JSON.stringify(payload),
+		"-U"
+	]);
+};
+const loadKeychainPayload = (accountId) => {
+	const raw = runSecurity([
+		"find-generic-password",
+		"-s",
+		getKeychainService(accountId),
+		"-w"
+	]).trim();
+	if (!raw) throw new Error(`No Keychain payload found for account ${accountId}.`);
+	const parsed = JSON.parse(raw);
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Keychain payload for account ${accountId} is missing required fields.`);
+	return parsed;
+};
+const deleteKeychainPayload = (accountId) => {
+	runSecurity([
+		"delete-generic-password",
+		"-s",
+		getKeychainService(accountId)
+	]);
+};
+const keychainPayloadExists = (accountId) => {
+	return runSecuritySafe([
+		"find-generic-password",
+		"-s",
+		getKeychainService(accountId)
+	]).success;
+};
+const listKeychainAccounts = () => {
+	const result = Bun.spawnSync({
+		cmd: ["security", "dump-keychain"],
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	if (result.exitCode !== 0) return [];
+	const output = result.stdout.toString();
+	const accounts = [];
+	const serviceRegex = new RegExp(`"svce"<blob>="${SERVICE_PREFIX$3}([^"]+)"`, "g");
+	let match;
+	while ((match = serviceRegex.exec(output)) !== null) if (match[1]) accounts.push(match[1]);
+	return [...new Set(accounts)];
+};
+//#endregion
+//#region lib/secrets/cross-keychain-overrides.ts
+const LEGACY_MAX_PASSWORD_LENGTH = 4096;
+const parseMaxPasswordLength = (value) => {
+	if (!value) return null;
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isInteger(parsed) || parsed <= LEGACY_MAX_PASSWORD_LENGTH) return null;
+	return parsed;
+};
+const getCrossKeychainBackendOverrides = () => {
+	return { max_password_length: parseMaxPasswordLength(process.env.CDX_CROSS_KEYCHAIN_MAX_PASSWORD_LENGTH) ?? 16384 };
+};
+//#endregion
+//#region lib/secrets/fallback-consent.ts
+const CONSENT_FILE = "secure-store-fallback-consent.json";
+const CONSENT_ENV_BYPASS = "CDX_ALLOW_SECURE_STORE_FALLBACK";
+const isBypassEnabled = () => {
+	const value = process.env[CONSENT_ENV_BYPASS];
+	if (!value) return false;
+	return [
+		"1",
+		"true",
+		"yes",
+		"y"
+	].includes(value.trim().toLowerCase());
+};
+const consentFilePath = () => path.join(getPaths().configDir, CONSENT_FILE);
+const loadConsentMap = async () => {
+	try {
+		const raw = await readFile(consentFilePath(), "utf8");
+		return JSON.parse(raw).accepted ?? {};
+	} catch {
+		return {};
+	}
+};
+const saveConsentMap = async (accepted) => {
+	const { configDir } = getPaths();
+	await mkdir(configDir, { recursive: true });
+	const payload = { accepted };
+	await writeFile(consentFilePath(), JSON.stringify(payload, null, 2), "utf8");
+};
+const promptConsent = async (message) => {
+	if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+	process.stdout.write(`\n${message}\n\n`);
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const normalized = (await rl.question("Do you want to continue with this fallback? [y/N]: ")).trim().toLowerCase();
+		return normalized === "y" || normalized === "yes";
+	} finally {
+		rl.close();
+	}
+};
+const ensureFallbackConsent = async (scope, warningMessage) => {
+	if (isBypassEnabled()) return;
+	const accepted = await loadConsentMap();
+	if (accepted[scope]) return;
+	if (!await promptConsent(warningMessage)) throw new Error(`Secure-store fallback usage was not approved for '${scope}'. Re-run in an interactive terminal to confirm, or set ${CONSENT_ENV_BYPASS}=1 if you accept the fallback risk.`);
+	accepted[scope] = { acceptedAt: (/* @__PURE__ */ new Date()).toISOString() };
+	await saveConsentMap(accepted);
+};
+//#endregion
+//#region lib/secrets/linux-cross-keychain.ts
+const SERVICE_PREFIX$2 = "cdx-openai-";
+const LINUX_FALLBACK_SCOPE = "linux:cross-keychain:secret-service";
+const MISSING_ENTRY_MARKERS = [
+	"no matching entry found in secure storage",
+	"password not found",
+	"no stored credentials found",
+	"credential not found",
+	"no result found"
+];
+const STORE_UNAVAILABLE_MARKERS = [
+	"unable to initialize linux secure-store backend",
+	"no keyring backend could be initialized",
+	"native keyring module not available",
+	"linux secure store is unavailable",
+	"secret service operation failed",
+	"couldn't access platform secure storage",
+	"dbus",
+	"d-bus",
+	"org.freedesktop.secrets",
+	"service unavailable"
+];
+let backendInitPromise$2 = null;
+let selectedBackend$2 = null;
+const getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
+const classifyLinuxSecureStoreError = (error) => {
+	const message = getErrorMessage(error).toLowerCase();
+	if (MISSING_ENTRY_MARKERS.some((marker) => message.includes(marker))) return "missing_entry";
+	if (STORE_UNAVAILABLE_MARKERS.some((marker) => message.includes(marker))) return "store_unavailable";
+	return "other";
+};
+const createLinuxSecureStoreUnavailableError = (details) => {
+	const guidance = "Linux secure store is unavailable. Ensure Secret Service is installed/running (for example gnome-keyring with secret-tool), then retry login.";
+	if (!details) return new Error(guidance);
+	return /* @__PURE__ */ new Error(`${guidance} Technical details: ${details}`);
+};
+const tryUseBackend$2 = async (backendId) => {
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		return true;
+	} catch {
+		return false;
+	}
+};
+const selectBackend$2 = async () => {
+	const backends = await listBackends();
+	const available = new Set(backends.map((backend) => backend.id));
+	if (available.has("native-linux") && await tryUseBackend$2("native-linux")) return "native-linux";
+	if (available.has("secret-service") && await tryUseBackend$2("secret-service")) return "secret-service";
+	if (await tryUseBackend$2("native-linux")) return "native-linux";
+	if (await tryUseBackend$2("secret-service")) return "secret-service";
+	throw new Error("Unable to initialize Linux secure-store backend via cross-keychain.");
+};
+const setActiveBackend = (backendId) => {
+	selectedBackend$2 = backendId;
+	backendInitPromise$2 = Promise.resolve();
+};
+const trySwitchBackend = async (backendId, options = {}) => {
+	if (options.forWrite && backendId === "secret-service") await ensureFallbackConsent(LINUX_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain Linux fallback backend is available.\nThis path relies on shell-based `secret-tool` operations for Secret Service access.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while helper commands run.");
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		setActiveBackend(backendId);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const ensureLinuxBackend = async (options = {}) => {
+	if (!backendInitPromise$2) backendInitPromise$2 = (async () => {
+		selectedBackend$2 = await selectBackend$2();
+	})();
+	try {
+		await backendInitPromise$2;
+	} catch {
+		backendInitPromise$2 = null;
+		selectedBackend$2 = null;
+		throw new Error("Unable to initialize Linux secure-store backend via cross-keychain.");
+	}
+	if (options.forWrite && selectedBackend$2 === "secret-service") await ensureFallbackConsent(LINUX_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain Linux fallback backend is available.\nThis path relies on shell-based `secret-tool` operations for Secret Service access.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while helper commands run.");
+};
+const getLinuxCrossKeychainService = (accountId) => `${SERVICE_PREFIX$2}${accountId}`;
+const parsePayload$2 = (accountId, raw) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	}
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Stored credential payload for account ${accountId} is missing required fields.`);
+	return parsed;
+};
+const withService$1 = async (accountId, run, options = {}) => {
+	try {
+		await ensureLinuxBackend(options);
+	} catch (error) {
+		throw createLinuxSecureStoreUnavailableError(getErrorMessage(error));
+	}
+	try {
+		return await run(getLinuxCrossKeychainService(accountId));
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "store_unavailable") throw createLinuxSecureStoreUnavailableError(getErrorMessage(error));
+		throw error;
+	}
+};
+const isInteractiveTerminal$2 = () => Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+const applyEnvAssignments$1 = (raw) => {
+	const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (const line of lines) {
+		const match = line.match(/^([A-Z0-9_]+)=(.*);?$/);
+		if (!match) continue;
+		const key = match[1];
+		const value = match[2].replace(/;$/, "");
+		if (key) process.env[key] = value;
+	}
+};
+const runCommandWithInput = async (command, args, input) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: [
+		"pipe",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	let stderr = "";
+	let spawnError = null;
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	child.once("error", (error) => {
+		spawnError = error.message;
+	});
+	child.once("close", (code) => {
+		resolve({
+			ok: spawnError === null && code === 0,
+			stdout: stdout.trim(),
+			stderr: stderr.trim(),
+			...spawnError ? { error: spawnError } : {}
+		});
+	});
+	child.stdin?.write(input);
+	child.stdin?.end();
+});
+const attemptInteractiveLinuxKeyringUnlock = async () => {
+	if (!isInteractiveTerminal$2()) return false;
+	const shouldUnlock = await p.confirm({
+		message: "Linux keyring appears locked. Unlock it now?",
+		initialValue: true
+	});
+	if (p.isCancel(shouldUnlock) || !shouldUnlock) return false;
+	const passphrase = await p.password({
+		message: "Enter Linux keyring password:",
+		validate: (value) => {
+			if (!value || !value.trim()) return "Password is required to unlock keyring.";
+		}
+	});
+	if (p.isCancel(passphrase) || !passphrase) return false;
+	const result = await runCommandWithInput("gnome-keyring-daemon", ["--unlock", "--components=secrets"], `${passphrase}\n`);
+	if (!result.ok) {
+		const details = result.error || result.stderr || result.stdout;
+		if (details) process.stderr.write(`cdx: keyring unlock failed (${details})\n`);
+		return false;
+	}
+	applyEnvAssignments$1(result.stdout);
+	return true;
+};
+const withLinuxUnlockRetry = async (run, options = {}) => {
+	let unlockAttempted = false;
+	while (true) try {
+		return await run();
+	} catch (error) {
+		const kind = classifyLinuxSecureStoreError(error);
+		if (!(!unlockAttempted && (kind === "store_unavailable" || kind === "missing_entry" && options.forWrite && options.retryOnMissingEntryForNativeWrite && selectedBackend$2 === "native-linux"))) throw error;
+		unlockAttempted = true;
+		if (!await attemptInteractiveLinuxKeyringUnlock()) throw error;
+		backendInitPromise$2 = null;
+		selectedBackend$2 = null;
+	}
+};
+const trySaveWithSecretServiceFallback = async (accountId, serializedPayload) => {
+	if (!await trySwitchBackend("secret-service", { forWrite: true })) return {
+		ok: false,
+		error: /* @__PURE__ */ new Error("Unable to switch Linux secure-store backend to secret-service fallback.")
+	};
+	try {
+		await setPassword(getLinuxCrossKeychainService(accountId), accountId, serializedPayload);
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error
+		};
+	}
+};
+const saveLinuxCrossKeychainPayload = async (accountId, payload) => {
+	const serialized = JSON.stringify(payload);
+	try {
+		await withLinuxUnlockRetry(() => withService$1(accountId, (service) => setPassword(service, accountId, serialized), { forWrite: true }), {
+			forWrite: true,
+			retryOnMissingEntryForNativeWrite: true
+		});
+		return;
+	} catch (error) {
+		const kind = classifyLinuxSecureStoreError(error);
+		if (kind === "missing_entry" && selectedBackend$2 === "native-linux") {
+			const fallbackResult = await trySaveWithSecretServiceFallback(accountId, serialized);
+			if (fallbackResult.ok) return;
+			throw createLinuxSecureStoreUnavailableError(`Native backend could not create the credential entry (${getErrorMessage(error)}). Fallback secret-service backend also failed (${getErrorMessage(fallbackResult.error)}).`);
+		}
+		if (kind === "store_unavailable") throw createLinuxSecureStoreUnavailableError(getErrorMessage(error));
+		throw error;
+	}
+};
+const loadLinuxCrossKeychainPayload = async (accountId) => {
+	try {
+		const raw = await withLinuxUnlockRetry(() => withService$1(accountId, (service) => getPassword(service, accountId)));
+		if (raw === null) throw new Error(`No stored credentials found for account ${accountId}.`);
+		return parsePayload$2(accountId, raw);
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "missing_entry") throw new Error(`No stored credentials found for account ${accountId}.`);
+		throw error;
+	}
+};
+const deleteLinuxCrossKeychainPayload = async (accountId) => {
+	try {
+		await withLinuxUnlockRetry(() => withService$1(accountId, (service) => deletePassword(service, accountId)));
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "missing_entry") return;
+		throw error;
+	}
+};
+const linuxCrossKeychainPayloadExists = async (accountId) => {
+	try {
+		return await withLinuxUnlockRetry(() => withService$1(accountId, async (service) => await getPassword(service, accountId) !== null));
+	} catch (error) {
+		if (classifyLinuxSecureStoreError(error) === "missing_entry") return false;
+		throw error;
+	}
+};
+//#endregion
+//#region lib/secrets/macos-cross-keychain.ts
+const SERVICE_PREFIX$1 = "cdx-openai-";
+const MACOS_FALLBACK_SCOPE = "darwin:cross-keychain:macos";
+let backendInitPromise$1 = null;
+let selectedBackend$1 = null;
+const tryUseBackend$1 = async (backendId) => {
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		return true;
+	} catch {
+		return false;
+	}
+};
+const selectBackend$1 = async () => {
+	const backends = await listBackends();
+	const available = new Set(backends.map((backend) => backend.id));
+	if (available.has("native-macos") && await tryUseBackend$1("native-macos")) return "native-macos";
+	if (available.has("macos") && await tryUseBackend$1("macos")) return "macos";
+	if (await tryUseBackend$1("native-macos")) return "native-macos";
+	if (await tryUseBackend$1("macos")) return "macos";
+	throw new Error("Unable to initialize macOS keychain backend via cross-keychain.");
+};
+const ensureMacOSBackend = async (options = {}) => {
+	if (!backendInitPromise$1) backendInitPromise$1 = (async () => {
+		selectedBackend$1 = await selectBackend$1();
+	})();
+	try {
+		await backendInitPromise$1;
+	} catch {
+		backendInitPromise$1 = null;
+		selectedBackend$1 = null;
+		throw new Error("Unable to initialize macOS keychain backend via cross-keychain.");
+	}
+	if (options.forWrite && selectedBackend$1 === "macos") await ensureFallbackConsent(MACOS_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain macOS fallback backend is available.\nThis path uses the `security` command to access Keychain.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while helper commands run.");
+};
+const resolveMacOSCrossKeychainBackendId$1 = async () => {
+	await ensureMacOSBackend();
+	if (!selectedBackend$1) throw new Error("Unable to initialize macOS keychain backend via cross-keychain.");
+	return selectedBackend$1;
+};
+const getMacOSCrossKeychainService = (accountId) => `${SERVICE_PREFIX$1}${accountId}`;
+const parsePayload$1 = (accountId, raw) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	}
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Stored credential payload for account ${accountId} is missing required fields.`);
+	return parsed;
+};
+const withService = async (accountId, run, options = {}) => {
+	await ensureMacOSBackend(options);
+	return run(getMacOSCrossKeychainService(accountId));
+};
+const saveMacOSCrossKeychainPayload = async (accountId, payload) => withService(accountId, (service) => setPassword(service, accountId, JSON.stringify(payload)), { forWrite: true });
+const loadMacOSCrossKeychainPayload = async (accountId) => {
+	const raw = await withService(accountId, (service) => getPassword(service, accountId));
+	if (raw === null) throw new Error(`No stored credentials found for account ${accountId}.`);
+	return parsePayload$1(accountId, raw);
+};
+const deleteMacOSCrossKeychainPayload = async (accountId) => withService(accountId, (service) => deletePassword(service, accountId));
+const macosCrossKeychainPayloadExists = async (accountId) => withService(accountId, async (service) => await getPassword(service, accountId) !== null);
+//#endregion
+//#region lib/secrets/windows-cross-keychain.ts
+const SERVICE_PREFIX = "cdx-openai-";
+const WINDOWS_FALLBACK_SCOPE = "win32:cross-keychain:windows";
+const WINDOWS_VAULT_FILE = "accounts.windows.age";
+const WINDOWS_VAULT_VERSION = 1;
+const WINDOWS_VAULT_KEY_SERVICE = "cdx-openai-vault-passphrase";
+const WINDOWS_VAULT_KEY_ACCOUNT = "windows-v1";
+let backendInitPromise = null;
+let selectedBackend = null;
+const tryUseBackend = async (backendId) => {
+	try {
+		await useBackend(backendId, getCrossKeychainBackendOverrides());
+		return true;
+	} catch {
+		return false;
+	}
+};
+const selectBackend = async () => {
+	const backends = await listBackends();
+	const available = new Set(backends.map((backend) => backend.id));
+	if (available.has("native-windows") && await tryUseBackend("native-windows")) return "native-windows";
+	if (available.has("windows") && await tryUseBackend("windows")) return "windows";
+	if (await tryUseBackend("native-windows")) return "native-windows";
+	if (await tryUseBackend("windows")) return "windows";
+	throw new Error("Unable to initialize Windows credential backend via cross-keychain.");
+};
+const ensureWindowsBackend = async (options = {}) => {
+	if (!backendInitPromise) backendInitPromise = (async () => {
+		selectedBackend = await selectBackend();
+	})();
+	try {
+		await backendInitPromise;
+	} catch {
+		backendInitPromise = null;
+		selectedBackend = null;
+		throw new Error("Unable to initialize Windows credential backend via cross-keychain.");
+	}
+	if (options.forWrite && selectedBackend === "windows") await ensureFallbackConsent(WINDOWS_FALLBACK_SCOPE, "⚠ Security warning: only the cross-keychain Windows fallback backend is available.\nThis path runs a PowerShell helper to access Windows Credential Manager.\nCompared to native bindings, secrets may be more exposed to process inspection/logging while the helper runs.");
+};
+const withWindowsBackend = async (run, options = {}) => {
+	await ensureWindowsBackend(options);
+	return run();
+};
+const getWindowsVaultPath = () => path.join(getPaths().configDir, WINDOWS_VAULT_FILE);
+const createVaultPassphrase = () => randomBytes(32).toString("hex");
+const getVaultPassphrase = async (options = {}) => {
+	const current = await getPassword(WINDOWS_VAULT_KEY_SERVICE, WINDOWS_VAULT_KEY_ACCOUNT);
+	if (current) return current;
+	if (!options.createIfMissing) return null;
+	const generated = createVaultPassphrase();
+	await setPassword(WINDOWS_VAULT_KEY_SERVICE, WINDOWS_VAULT_KEY_ACCOUNT, generated);
+	return generated;
+};
+const createEmptyVault = () => ({
+	version: WINDOWS_VAULT_VERSION,
+	accounts: {}
+});
+const parsePayload = (accountId, input) => {
+	if (!input || typeof input !== "object") throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	const parsed = input;
+	if (!parsed.refresh || !parsed.access || !parsed.expires || !parsed.accountId) throw new Error(`Stored credential payload for account ${accountId} is missing required fields.`);
+	return {
+		refresh: parsed.refresh,
+		access: parsed.access,
+		expires: parsed.expires,
+		accountId: parsed.accountId,
+		...parsed.idToken ? { idToken: parsed.idToken } : {}
+	};
+};
+const parseVault = (raw, source) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored Windows credential vault (${source}) is not valid JSON.`);
+	}
+	if (!parsed || typeof parsed !== "object") throw new Error(`Stored Windows credential vault (${source}) is not valid JSON.`);
+	const vault = parsed;
+	const rawAccounts = vault.accounts;
+	if (!rawAccounts || typeof rawAccounts !== "object") throw new Error(`Stored Windows credential vault (${source}) is missing account data.`);
+	const accounts = {};
+	for (const [accountId, payload] of Object.entries(rawAccounts)) accounts[accountId] = parsePayload(accountId, payload);
+	return {
+		version: typeof vault.version === "number" ? vault.version : WINDOWS_VAULT_VERSION,
+		accounts
+	};
+};
+const decryptVault = async (ciphertext, passphrase, source) => {
+	const decrypter = new Decrypter();
+	decrypter.addPassphrase(passphrase);
+	let plaintext;
+	try {
+		plaintext = await decrypter.decrypt(ciphertext, "text");
+	} catch {
+		throw new Error(`Failed to decrypt Windows credential vault (${source}). Stored passphrase or vault file may be invalid.`);
+	}
+	return parseVault(plaintext, source);
+};
+const encryptVault = async (vault, passphrase) => {
+	const encrypter = new Encrypter();
+	encrypter.setPassphrase(passphrase);
+	return encrypter.encrypt(JSON.stringify(vault));
+};
+const loadVault = async (passphrase) => {
+	const vaultPath = getWindowsVaultPath();
+	let ciphertext;
+	try {
+		ciphertext = await readFile(vaultPath);
+	} catch (error) {
+		if (error?.code === "ENOENT") return createEmptyVault();
+		throw error;
+	}
+	if (ciphertext.length === 0) return createEmptyVault();
+	return decryptVault(ciphertext, passphrase, vaultPath);
+};
+const saveVault = async (vault, passphrase) => {
+	const { configDir } = getPaths();
+	const vaultPath = getWindowsVaultPath();
+	await mkdir(configDir, { recursive: true });
+	await writeFile(vaultPath, await encryptVault(vault, passphrase));
+};
+const loadLegacyPayload = async (accountId) => {
+	const raw = await getPassword(getWindowsCrossKeychainService(accountId), accountId);
+	if (raw === null) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`Stored credential payload for account ${accountId} is not valid JSON.`);
+	}
+	return parsePayload(accountId, parsed);
+};
+const deleteLegacyPayload = async (accountId) => {
+	const service = getWindowsCrossKeychainService(accountId);
+	try {
+		await deletePassword(service, accountId);
+	} catch {}
+};
+const getWindowsCrossKeychainService = (accountId) => `${SERVICE_PREFIX}${accountId}`;
+const saveWindowsCrossKeychainPayload = async (accountId, payload) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase({ createIfMissing: true });
+	if (!passphrase) throw new Error("Unable to resolve Windows credential vault passphrase.");
+	const vault = await loadVault(passphrase);
+	vault.accounts[accountId] = payload;
+	await saveVault(vault, passphrase);
+	await deleteLegacyPayload(accountId);
+}, { forWrite: true });
+const loadWindowsCrossKeychainPayload = async (accountId) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase();
+	if (passphrase) {
+		const payload = (await loadVault(passphrase)).accounts[accountId];
+		if (payload) return payload;
+	}
+	const legacyPayload = await loadLegacyPayload(accountId);
+	if (legacyPayload) return legacyPayload;
+	throw new Error(`No stored credentials found for account ${accountId}.`);
+});
+const deleteWindowsCrossKeychainPayload = async (accountId) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase();
+	if (passphrase) {
+		const vault = await loadVault(passphrase);
+		if (vault.accounts[accountId]) {
+			delete vault.accounts[accountId];
+			if (Object.keys(vault.accounts).length === 0) await rm(getWindowsVaultPath(), { force: true });
+			else await saveVault(vault, passphrase);
+		}
+	}
+	await deleteLegacyPayload(accountId);
+});
+const windowsCrossKeychainPayloadExists = async (accountId) => withWindowsBackend(async () => {
+	const passphrase = await getVaultPassphrase();
+	if (passphrase) {
+		if ((await loadVault(passphrase)).accounts[accountId]) return true;
+	}
+	return await loadLegacyPayload(accountId) !== null;
+});
+//#endregion
+//#region lib/secrets/store.ts
+const MISSING_SECRET_STORE_ERROR_MARKERS = [
+	"no stored credentials found",
+	"no keychain payload found",
+	"password not found",
+	"no matching entry found in secure storage",
+	"no result found"
+];
+const isMissingSecretStoreEntryError = (error) => {
+	if (!(error instanceof Error)) return false;
+	const message = error.message.toLowerCase();
+	return MISSING_SECRET_STORE_ERROR_MARKERS.some((marker) => message.includes(marker));
+};
+const createMissingSecretStoreEntryError = (accountId) => /* @__PURE__ */ new Error(`No stored credentials found for account ${accountId}.`);
+const CACHED_ADAPTER_SYMBOL = Symbol.for("cdx.secretStore.cachedAdapter");
+const withSecretStoreCache = (adapter) => {
+	if (adapter[CACHED_ADAPTER_SYMBOL]) return adapter;
+	const payloadCache = /* @__PURE__ */ new Map();
+	const existsCache = /* @__PURE__ */ new Map();
+	const missingAccounts = /* @__PURE__ */ new Set();
+	const inFlightLoads = /* @__PURE__ */ new Map();
+	const markPresent = (accountId, payload) => {
+		payloadCache.set(accountId, payload);
+		existsCache.set(accountId, true);
+		missingAccounts.delete(accountId);
+	};
+	const markMissing = (accountId) => {
+		payloadCache.delete(accountId);
+		existsCache.set(accountId, false);
+		missingAccounts.add(accountId);
+	};
+	const loadAndCache = async (accountId) => {
+		const existingPromise = inFlightLoads.get(accountId);
+		if (existingPromise) return existingPromise;
+		const promise = (async () => {
+			try {
+				const payload = await adapter.load(accountId);
+				markPresent(accountId, payload);
+				return payload;
+			} catch (error) {
+				if (isMissingSecretStoreEntryError(error)) markMissing(accountId);
+				throw error;
+			} finally {
+				inFlightLoads.delete(accountId);
+			}
+		})();
+		inFlightLoads.set(accountId, promise);
+		return promise;
+	};
+	return {
+		id: adapter.id,
+		label: adapter.label,
+		getServiceName: (accountId) => adapter.getServiceName(accountId),
+		save: async (accountId, payload) => {
+			await adapter.save(accountId, payload);
+			markPresent(accountId, payload);
+		},
+		load: async (accountId) => {
+			const cachedPayload = payloadCache.get(accountId);
+			if (cachedPayload) return cachedPayload;
+			if (missingAccounts.has(accountId)) throw createMissingSecretStoreEntryError(accountId);
+			return loadAndCache(accountId);
+		},
+		delete: async (accountId) => {
+			try {
+				await adapter.delete(accountId);
+			} catch (error) {
+				if (isMissingSecretStoreEntryError(error)) markMissing(accountId);
+				throw error;
+			}
+			markMissing(accountId);
+		},
+		exists: async (accountId) => {
+			if (payloadCache.has(accountId)) return true;
+			if (missingAccounts.has(accountId)) return false;
+			const cachedExists = existsCache.get(accountId);
+			if (cachedExists !== void 0) return cachedExists;
+			try {
+				await loadAndCache(accountId);
+				return true;
+			} catch (error) {
+				if (isMissingSecretStoreEntryError(error)) return false;
+			}
+			const exists = await adapter.exists(accountId);
+			existsCache.set(accountId, exists);
+			if (!exists) missingAccounts.add(accountId);
+			return exists;
+		},
+		listAccountIds: async () => {
+			const accountIds = await adapter.listAccountIds();
+			for (const accountId of accountIds) {
+				existsCache.set(accountId, true);
+				missingAccounts.delete(accountId);
+			}
+			return accountIds;
+		},
+		getCapability: () => adapter.getCapability(),
+		[CACHED_ADAPTER_SYMBOL]: true
+	};
+};
+const unsupportedError = (platform) => /* @__PURE__ */ new Error(`No default secret store adapter configured for platform '${platform}'. Only macOS, Windows, and Linux adapters are wired by default right now.`);
+const loadConfiguredAccountIds = async () => {
+	if (!configExists()) return [];
+	return (await loadConfig()).accounts.map((account) => account.accountId);
+};
+const createMacOSCrossKeychainAdapter = () => ({
+	id: "macos-cross-keychain",
+	label: "macOS Keychain (cross-keychain)",
+	getServiceName: getMacOSCrossKeychainService,
+	save: saveMacOSCrossKeychainPayload,
+	load: loadMacOSCrossKeychainPayload,
+	delete: deleteMacOSCrossKeychainPayload,
+	exists: macosCrossKeychainPayloadExists,
+	listAccountIds: async () => {
+		const accountIds = await loadConfiguredAccountIds();
+		return (await Promise.all(accountIds.map(async (accountId) => ({
+			accountId,
+			exists: await macosCrossKeychainPayloadExists(accountId)
+		})))).filter((item) => item.exists).map((item) => item.accountId);
+	},
+	getCapability: () => ({ available: true })
+});
+const createMacOSLegacyKeychainAdapter = () => ({
+	id: "macos-legacy-keychain",
+	label: "macOS Keychain (legacy security CLI)",
+	getServiceName: getKeychainService,
+	save: async (accountId, payload) => {
+		saveKeychainPayload(accountId, payload);
+	},
+	load: async (accountId) => loadKeychainPayload(accountId),
+	delete: async (accountId) => {
+		deleteKeychainPayload(accountId);
+	},
+	exists: async (accountId) => keychainPayloadExists(accountId),
+	listAccountIds: async () => listKeychainAccounts(),
+	getCapability: () => ({ available: true })
+});
+const createWindowsCrossKeychainAdapter = () => ({
+	id: "windows-cross-keychain",
+	label: "Windows Credential Manager (cross-keychain)",
+	getServiceName: getWindowsCrossKeychainService,
+	save: saveWindowsCrossKeychainPayload,
+	load: loadWindowsCrossKeychainPayload,
+	delete: deleteWindowsCrossKeychainPayload,
+	exists: windowsCrossKeychainPayloadExists,
+	listAccountIds: async () => {
+		const accountIds = await loadConfiguredAccountIds();
+		return (await Promise.all(accountIds.map(async (accountId) => ({
+			accountId,
+			exists: await windowsCrossKeychainPayloadExists(accountId)
+		})))).filter((item) => item.exists).map((item) => item.accountId);
+	},
+	getCapability: () => ({ available: true })
+});
+const createLinuxCrossKeychainAdapter = () => ({
+	id: "linux-cross-keychain",
+	label: "Linux Secret Service (cross-keychain)",
+	getServiceName: getLinuxCrossKeychainService,
+	save: saveLinuxCrossKeychainPayload,
+	load: loadLinuxCrossKeychainPayload,
+	delete: deleteLinuxCrossKeychainPayload,
+	exists: linuxCrossKeychainPayloadExists,
+	listAccountIds: async () => {
+		const accountIds = await loadConfiguredAccountIds();
+		return (await Promise.all(accountIds.map(async (accountId) => ({
+			accountId,
+			exists: await linuxCrossKeychainPayloadExists(accountId)
+		})))).filter((item) => item.exists).map((item) => item.accountId);
+	},
+	getCapability: () => ({ available: true })
+});
+const createUnsupportedAdapter = (platform) => ({
+	id: "unsupported",
+	label: "Unsupported (no adapter configured)",
+	getServiceName: (accountId) => `cdx-openai-${accountId}`,
+	save: async () => {
+		throw unsupportedError(platform);
+	},
+	load: async () => {
+		throw unsupportedError(platform);
+	},
+	delete: async () => {
+		throw unsupportedError(platform);
+	},
+	exists: async () => false,
+	listAccountIds: async () => [],
+	getCapability: () => ({
+		available: false,
+		reason: "No default secure-store adapter available for this platform."
+	})
+});
+const createRuntimeSecretStoreAdapter = (platform = process.platform) => {
+	if (platform === "darwin") return createMacOSCrossKeychainAdapter();
+	if (platform === "win32") return createWindowsCrossKeychainAdapter();
+	if (platform === "linux") return createLinuxCrossKeychainAdapter();
+	return createUnsupportedAdapter(platform);
+};
+const createSecretStoreAdapterFromSelection = (selection = "auto", platform = process.platform) => {
+	if (selection === "legacy-keychain") {
+		if (platform !== "darwin") throw new Error("The legacy keychain adapter is only available on macOS (darwin).");
+		return createMacOSLegacyKeychainAdapter();
+	}
+	return createRuntimeSecretStoreAdapter(platform);
+};
+const resolveMacOSCrossKeychainBackendId = async (platform = process.platform) => {
+	if (platform !== "darwin") return null;
+	return resolveMacOSCrossKeychainBackendId$1();
+};
+let currentSecretStoreAdapter = withSecretStoreCache(createRuntimeSecretStoreAdapter());
+const getSecretStoreAdapter = () => currentSecretStoreAdapter;
+const setSecretStoreAdapter = (adapter) => {
+	currentSecretStoreAdapter = withSecretStoreCache(adapter);
+};
+const resetSecretStoreAdapter = () => {
+	currentSecretStoreAdapter = withSecretStoreCache(createRuntimeSecretStoreAdapter());
+};
+const getSecretStoreCapability = () => {
+	const adapter = getSecretStoreAdapter();
+	const capability = adapter.getCapability();
+	return {
+		id: adapter.id,
+		label: adapter.label,
+		available: capability.available,
+		...capability.reason ? { reason: capability.reason } : {}
+	};
+};
+//#endregion
+//#region lib/oauth/constants.ts
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const DEVICE_CODE_URL = "https://auth.openai.com/oauth/device/code";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const CALLBACK_PORT = 1455;
+/**
+* Preserve an explicit Codex Desktop originator override when it is present.
+* Regular terminals use the Desktop default above.
+*/
+const resolveOriginator = (env = process.env) => {
+	return env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE?.trim() || "Codex Desktop";
+};
+//#endregion
+//#region lib/oauth/auth.ts
+/**
+* Create an RFC 7636 S256 PKCE verifier/challenge pair using Node's built-in
+* cryptography. Keeping this small primitive local avoids shipping an OAuth
+* helper dependency solely for PKCE generation.
+*/
+const createPKCE = () => {
+	const verifier = randomBytes(32).toString("base64url");
+	return {
+		verifier,
+		challenge: createHash("sha256").update(verifier).digest("base64url")
+	};
+};
+const createState = () => {
+	return randomBytes(32).toString("base64url");
+};
+const createAuthorizationFlow = async () => {
+	const pkce = createPKCE();
+	const state = createState();
+	const url = new URL(AUTHORIZE_URL);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("redirect_uri", REDIRECT_URI);
+	url.searchParams.set("scope", SCOPE);
+	url.searchParams.set("code_challenge", pkce.challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	url.searchParams.set("id_token_add_organizations", "true");
+	url.searchParams.set("codex_cli_simplified_flow", "true");
+	url.searchParams.set("state", state);
+	url.searchParams.set("originator", resolveOriginator());
+	return {
+		pkce,
+		state,
+		url: url.toString().replaceAll("+", "%20")
+	};
+};
+const truncateForLog = (value, maxLength = 300) => {
+	if (value.length <= maxLength) return value;
+	return `${value.slice(0, maxLength)}…`;
+};
+const isCloudflareChallengeResponse = (headers, bodyText) => {
+	if (headers.get("cf-mitigated")?.toLowerCase() === "challenge") return true;
+	if (!bodyText) return false;
+	return [
+		/<title>Just a moment\.\.\.<\/title>/i,
+		/Enable JavaScript and cookies to continue/i,
+		/challenge-platform/i,
+		/_cf_chl_opt/i
+	].some((pattern) => pattern.test(bodyText));
+};
+const parseOAuthErrorResponse = async (res) => {
+	let rawBody;
+	try {
+		rawBody = await res.text();
+	} catch {
+		rawBody = void 0;
+	}
+	const failureReason = isCloudflareChallengeResponse(res.headers, rawBody) ? "cloudflare_challenge" : void 0;
+	if (!rawBody) return { ...failureReason ? { failureReason } : {} };
+	const trimmed = rawBody.trim();
+	if (!trimmed) return { ...failureReason ? { failureReason } : {} };
+	try {
+		const json = JSON.parse(trimmed);
+		return {
+			...json.error ? { oauthError: json.error } : {},
+			...typeof json.interval === "number" ? { interval: json.interval } : {},
+			responseBody: truncateForLog(JSON.stringify({
+				...json.error ? { error: json.error } : {},
+				...json.error_description ? { error_description: json.error_description } : {},
+				...typeof json.interval === "number" ? { interval: json.interval } : {}
+			})),
+			...failureReason ? { failureReason } : {}
+		};
+	} catch {
+		return {
+			responseBody: failureReason === "cloudflare_challenge" ? "Cloudflare challenge response detected (HTML page)" : truncateForLog(trimmed),
+			...failureReason ? { failureReason } : {}
+		};
+	}
+};
+const startDeviceAuthorizationFlow = async () => {
+	try {
+		const res = await fetch(DEVICE_CODE_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: CLIENT_ID,
+				scope: SCOPE
+			})
+		});
+		if (!res.ok) {
+			const { oauthError, responseBody, failureReason } = await parseOAuthErrorResponse(res);
+			return {
+				type: "failed",
+				error: failureReason === "cloudflare_challenge" ? "Device code request was blocked by a Cloudflare challenge response." : `Device code request failed with HTTP ${res.status} ${res.statusText}`,
+				status: res.status,
+				...oauthError ? { oauthError } : {},
+				...responseBody ? { responseBody } : {},
+				...failureReason ? { failureReason } : {}
+			};
+		}
+		const json = await res.json();
+		if (!json?.device_code || !json?.user_code || !json?.verification_uri || typeof json?.expires_in !== "number") return {
+			type: "failed",
+			error: "Device code response is missing required fields.",
+			responseBody: truncateForLog(JSON.stringify(json))
+		};
+		return {
+			type: "success",
+			flow: {
+				deviceCode: json.device_code,
+				userCode: json.user_code,
+				verificationUri: json.verification_uri,
+				verificationUriComplete: json.verification_uri_complete,
+				expiresIn: json.expires_in,
+				interval: typeof json.interval === "number" && json.interval > 0 ? json.interval : 5
+			}
+		};
+	} catch (error) {
+		return {
+			type: "failed",
+			error: `Device code request failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+};
+const pollDeviceAuthorizationToken = async (deviceCode) => {
+	try {
+		const res = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				device_code: deviceCode,
+				client_id: CLIENT_ID
+			})
+		});
+		if (res.ok) {
+			const json = await res.json();
+			if (!json?.access_token || !json?.refresh_token || typeof json?.expires_in !== "number") return {
+				type: "failed",
+				error: "Device token response is missing access_token/refresh_token/expires_in.",
+				responseBody: truncateForLog(JSON.stringify(json))
+			};
+			return {
+				type: "success",
+				access: json.access_token,
+				refresh: json.refresh_token,
+				expires: Date.now() + json.expires_in * 1e3,
+				idToken: json.id_token
+			};
+		}
+		const { oauthError: errorCode, interval, responseBody, failureReason } = await parseOAuthErrorResponse(res);
+		if (errorCode === "authorization_pending") return {
+			type: "pending",
+			interval: typeof interval === "number" && interval > 0 ? interval : 5
+		};
+		if (errorCode === "slow_down") return {
+			type: "slow_down",
+			interval: typeof interval === "number" && interval > 0 ? interval : 10
+		};
+		if (errorCode === "access_denied") return { type: "access_denied" };
+		if (errorCode === "expired_token") return { type: "expired" };
+		return {
+			type: "failed",
+			error: failureReason === "cloudflare_challenge" ? "Device token polling was blocked by a Cloudflare challenge response." : `Device token polling failed with HTTP ${res.status} ${res.statusText}`,
+			status: res.status,
+			...errorCode ? { oauthError: errorCode } : {},
+			...responseBody ? { responseBody } : {},
+			...failureReason ? { failureReason } : {}
+		};
+	} catch (error) {
+		return {
+			type: "failed",
+			error: `Device token polling request failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+};
+const exchangeAuthorizationCode = async (code, verifier) => {
+	const res = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: REDIRECT_URI
+		})
+	});
+	if (!res.ok) return { type: "failed" };
+	const json = await res.json();
+	if (!json?.access_token || !json?.refresh_token || typeof json?.expires_in !== "number") return { type: "failed" };
+	return {
+		type: "success",
+		access: json.access_token,
+		refresh: json.refresh_token,
+		expires: Date.now() + json.expires_in * 1e3,
+		idToken: json.id_token
+	};
+};
+const refreshAccessToken = async (refreshToken) => {
+	try {
+		const response = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID
+			})
+		});
+		if (!response.ok) return { type: "failed" };
+		const json = await response.json();
+		if (!json?.access_token || !json?.refresh_token || typeof json?.expires_in !== "number") return { type: "failed" };
+		return {
+			type: "success",
+			access: json.access_token,
+			refresh: json.refresh_token,
+			expires: Date.now() + json.expires_in * 1e3,
+			idToken: json.id_token
+		};
+	} catch {
+		return { type: "failed" };
+	}
+};
+const decodeJWT = (token) => {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1];
+		const decoded = Buffer.from(payload, "base64url").toString("utf-8");
+		return JSON.parse(decoded);
+	} catch {
+		return null;
+	}
+};
+const extractAccountId = (accessToken) => {
+	const payload = decodeJWT(accessToken);
+	if (!payload) return null;
+	const authClaim = payload["https://api.openai.com/auth"];
+	if (payload.chatgpt_account_id) return payload.chatgpt_account_id;
+	if (authClaim?.chatgpt_account_id) return authClaim.chatgpt_account_id;
+	const organizationId = payload.organizations?.find((organization) => typeof organization?.id === "string" && organization.id.length > 0)?.id;
+	if (organizationId) return organizationId;
+	if (authClaim?.user_id) return authClaim.user_id;
+	return payload.sub ?? null;
+};
+/**
+* Codex persists the ChatGPT account ID from the ID token. Prefer that token
+* because its claims are tailored for the Codex CLI, then fall back to the
+* access token for OAuth responses that do not include an ID token.
+*/
+const extractAccountIdFromTokens = (idToken, accessToken) => {
+	return (idToken ? extractAccountId(idToken) : null) ?? extractAccountId(accessToken);
+};
+//#endregion
+//#region lib/oauth/server.ts
+const AUTH_TIMEOUT_MS = 300 * 1e3;
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html>
+<head>
+  <title>cdx - Login Successful</title>
+  <style>
+    body { font-family: system-ui, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a1a; color: #fff; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #10b981; margin-bottom: 1rem; }
+    p { color: #9ca3af; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Login Successful!</h1>
+    <p>You can close this window and return to the terminal.</p>
+  </div>
+</body>
+</html>`;
+const startOAuthServer = (state) => {
+	let resolveCode = null;
+	let hasResolved = false;
+	const codePromise = new Promise((resolve) => {
+		resolveCode = resolve;
+	});
+	let server;
+	const finalize = (result) => {
+		if (hasResolved) return;
+		hasResolved = true;
+		if (resolveCode) resolveCode(result);
+		try {
+			server.close();
+		} catch {}
+	};
+	server = http.createServer((req, res) => {
+		try {
+			const url = new URL(req.url || "", "http://localhost");
+			if (url.pathname !== "/auth/callback") {
+				res.statusCode = 404;
+				res.end("Not found");
+				return;
+			}
+			if (url.searchParams.get("state") !== state) {
+				res.statusCode = 400;
+				res.end("State mismatch");
+				finalize(null);
+				return;
+			}
+			const code = url.searchParams.get("code");
+			if (!code) {
+				res.statusCode = 400;
+				res.end("Missing authorization code");
+				finalize(null);
+				return;
+			}
+			res.statusCode = 200;
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			res.end(SUCCESS_HTML);
+			finalize({ code });
+		} catch {
+			res.statusCode = 500;
+			res.end("Internal error");
+			finalize(null);
+		}
+	});
+	return new Promise((resolve) => {
+		server.listen(CALLBACK_PORT, "127.0.0.1", () => {
+			const timeout = setTimeout(() => finalize(null), AUTH_TIMEOUT_MS);
+			resolve({
+				port: CALLBACK_PORT,
+				ready: true,
+				close: () => {
+					clearTimeout(timeout);
+					server.close();
+				},
+				waitForCode: () => codePromise
+			});
+		}).on("error", (error) => {
+			const err = error;
+			resolve({
+				port: CALLBACK_PORT,
+				ready: false,
+				reason: err?.code === "EADDRINUSE" ? "port_in_use" : "listen_failed",
+				...typeof err?.message === "string" ? { error: err.message } : {},
+				...typeof err?.code === "string" ? { errorCode: err.code } : {},
+				close: () => {
+					try {
+						server.close();
+					} catch {}
+				},
+				waitForCode: async () => null
+			});
+		});
+	});
+};
+//#endregion
+//#region lib/oauth/login.ts
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const isLikelyRemoteEnvironment = () => {
+	if (process.platform !== "linux") return false;
+	if (process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY) return true;
+	return !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+};
+const parseLsofListeningProcess = (output) => {
+	const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	let pid = null;
+	let command;
+	for (const line of lines) {
+		if (line.startsWith("p") && pid === null) {
+			const parsedPid = Number.parseInt(line.slice(1), 10);
+			if (!Number.isNaN(parsedPid) && parsedPid > 0) pid = parsedPid;
+			continue;
+		}
+		if (line.startsWith("c") && pid !== null && !command) {
+			const parsedCommand = line.slice(1).trim();
+			if (parsedCommand) command = parsedCommand;
+		}
+		if (pid !== null && command) break;
+	}
+	if (pid === null) return null;
+	return {
+		pid,
+		...command ? { command } : {}
+	};
+};
+const parseWindowsNetstatListeningPid = (output, port) => {
+	const lines = output.split(/\r?\n/);
+	const portSuffix = `:${port}`;
+	for (const rawLine of lines) {
+		const line = rawLine.trim();
+		if (!line || !/LISTENING/i.test(line) || !line.includes(portSuffix)) continue;
+		const pidRaw = line.split(/\s+/).at(-1);
+		const parsedPid = pidRaw ? Number.parseInt(pidRaw, 10) : NaN;
+		if (!Number.isNaN(parsedPid) && parsedPid > 0) return parsedPid;
+	}
+	return null;
+};
+const findListeningProcessOnPort = (port, platform = process.platform) => {
+	if (platform === "win32") {
+		const netstat = Bun.spawnSync({
+			cmd: [
+				"netstat",
+				"-ano",
+				"-p",
+				"tcp"
+			],
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		if (netstat.exitCode !== 0) return null;
+		const pid = parseWindowsNetstatListeningPid(Buffer.from(netstat.stdout).toString("utf8"), port);
+		if (!pid) return null;
+		const tasklist = Bun.spawnSync({
+			cmd: [
+				"tasklist",
+				"/FI",
+				`PID eq ${pid}`,
+				"/FO",
+				"CSV",
+				"/NH"
+			],
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		if (tasklist.exitCode !== 0) return { pid };
+		const line = Buffer.from(tasklist.stdout).toString("utf8").trim().split(/\r?\n/)[0] ?? "";
+		if (!line || /No tasks are running/i.test(line)) return { pid };
+		const command = line.replace(/^"|"$/g, "").split("\",\"")[0]?.trim();
+		return {
+			pid,
+			...command ? { command } : {}
+		};
+	}
+	const lsof = Bun.spawnSync({
+		cmd: [
+			"lsof",
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-FpPc"
+		],
+		stdout: "pipe",
+		stderr: "pipe"
+	});
+	if (lsof.exitCode !== 0) return null;
+	return parseLsofListeningProcess(Buffer.from(lsof.stdout).toString("utf8"));
+};
+const killProcessByPid = (pid) => {
+	try {
+		process.kill(pid, "SIGTERM");
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+};
+const parseOAuthCallbackInput = (input) => {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	if (!trimmed.includes("://") && !trimmed.includes("code=") && !trimmed.includes("?")) return { code: trimmed };
+	try {
+		const parsedUrl = new URL(trimmed);
+		const code = parsedUrl.searchParams.get("code");
+		if (code) return {
+			code,
+			state: parsedUrl.searchParams.get("state") ?? void 0
+		};
+	} catch {}
+	const queryLike = trimmed.startsWith("?") || trimmed.startsWith("#") ? trimmed.slice(1) : trimmed.includes("?") ? trimmed.slice(trimmed.indexOf("?") + 1) : trimmed;
+	const params = new URLSearchParams(queryLike);
+	const code = params.get("code");
+	if (!code) return null;
+	return {
+		code,
+		state: params.get("state") ?? void 0
+	};
+};
+const promptBrowserFallbackChoice = async () => {
+	const remoteHint = isLikelyRemoteEnvironment();
+	if (!process.stdin.isTTY || !process.stdout.isTTY) {
+		const selected = remoteHint ? "device" : "manual";
+		p.log.info(`Non-interactive terminal detected. Falling back to ${selected === "device" ? "device OAuth flow" : "manual URL copy/paste flow"}.`);
+		if (selected === "device") p.log.info("When interactive, manual URL copy/paste flow is recommended because device flow may be blocked by Cloudflare on some VPS/server IPs.");
+		return selected;
+	}
+	const options = [
+		{
+			value: "manual",
+			label: "Finish manually by copying URL (recommended)",
+			hint: remoteHint ? "Best on SSH/VPS: open URL on any machine and paste callback URL/code back here" : "Open URL on any machine and paste callback URL/code back here"
+		},
+		{
+			value: "device",
+			label: "Use device OAuth flow",
+			hint: "May fail on some VPS/servers due to Cloudflare challenge"
+		},
+		{
+			value: "cancel",
+			label: "Cancel login"
+		}
+	];
+	const selection = await p.select({
+		message: "Browser launcher is unavailable. How do you want to continue?",
+		options
+	});
+	if (p.isCancel(selection)) return "cancel";
+	return selection;
+};
+const promptPortConflictChoice = async (listeningProcess) => {
+	if (!process.stdin.isTTY || !process.stdout.isTTY) {
+		p.log.info("Non-interactive terminal detected. Falling back to device OAuth flow.");
+		return "device";
+	}
+	const killHint = listeningProcess ? `PID ${listeningProcess.pid}${listeningProcess.command ? ` (${listeningProcess.command})` : ""}` : "Attempt to free port and retry";
+	const selection = await p.select({
+		message: `Port ${CALLBACK_PORT} is already in use. How do you want to continue?`,
+		options: [
+			{
+				value: "kill_and_retry",
+				label: `Kill existing listener on port ${CALLBACK_PORT} and retry browser flow`,
+				hint: killHint
+			},
+			{
+				value: "device",
+				label: "Continue with OAuth device flow",
+				hint: "No local callback server required"
+			},
+			{
+				value: "cancel",
+				label: "Cancel login"
+			}
+		]
+	});
+	if (p.isCancel(selection)) return "cancel";
+	return selection;
+};
+const maybeCopyAuthorizationUrlToClipboard = async (authorizationUrl) => {
+	if (Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)) {
+		const shouldCopy = await p.confirm({
+			message: "Copy login URL to clipboard now?",
+			initialValue: true
+		});
+		if (p.isCancel(shouldCopy) || !shouldCopy) return;
+	}
+	const copyResult = tryCopyToClipboard(authorizationUrl);
+	if (copyResult.ok) {
+		p.log.success(`Copied login URL to clipboard via ${copyResult.method}.`);
+		if (copyResult.warning) {
+			p.log.warning(copyResult.warning);
+			const helper = buildClipboardHelperCommand(authorizationUrl);
+			if (helper) p.log.message(`If needed, run this copy command instead:\n${helper}`);
+		}
+		return;
+	}
+	p.log.warning(`Could not copy login URL automatically${copyResult.error ? ` (${copyResult.error})` : ""}.`);
+	const helper = buildClipboardHelperCommand(authorizationUrl);
+	if (helper) p.log.message(`Try this copy command:\n${helper}`);
+};
+const promptManualAuthorizationCode = async (authorizationUrl, expectedState) => {
+	p.log.info("Manual login selected.");
+	p.log.message(`Open this URL in a browser:\n${authorizationUrl}`);
+	p.log.message("After approving, copy the full callback URL (or just the 'code' value) and paste it below.");
+	await maybeCopyAuthorizationUrlToClipboard(authorizationUrl);
+	for (let attempt = 1; attempt <= 3; attempt += 1) {
+		const response = await p.text({
+			message: "Paste callback URL or authorization code:",
+			placeholder: "http://localhost:1455/auth/callback?code=...&state=..."
+		});
+		if (p.isCancel(response)) {
+			p.log.info("Login cancelled.");
+			return null;
+		}
+		const parsed = parseOAuthCallbackInput(String(response));
+		if (!parsed) {
+			p.log.warning("Could not parse input. Please paste a callback URL or code.");
+			continue;
+		}
+		if (parsed.state && parsed.state !== expectedState) {
+			p.log.error("State mismatch in callback URL. Please retry the login flow.");
+			return null;
+		}
+		return parsed.code;
+	}
+	p.log.error("Failed to parse callback input after multiple attempts.");
+	return null;
+};
+const runDeviceOAuthFlow = async (useSpinner) => {
+	p.log.info("Device OAuth flow may fail on some VPS/servers because auth.openai.com can return a Cloudflare challenge.");
+	p.log.info("Recommended alternative: run login without --device-flow and use manual URL copy/paste callback completion.");
+	const deviceFlowResult = await startDeviceAuthorizationFlow();
+	if (deviceFlowResult.type !== "success") {
+		p.log.error("Device OAuth flow is not available right now.");
+		p.log.error(`Technical details: ${deviceFlowResult.error}`);
+		if (typeof deviceFlowResult.status === "number") p.log.error(`HTTP status: ${deviceFlowResult.status}`);
+		if (deviceFlowResult.oauthError) p.log.error(`OAuth error: ${deviceFlowResult.oauthError}`);
+		if (deviceFlowResult.responseBody) p.log.error(`Response: ${deviceFlowResult.responseBody}`);
+		if (deviceFlowResult.failureReason === "cloudflare_challenge") {
+			p.log.warning("Detected Cloudflare challenge on auth.openai.com.");
+			p.log.info("Retry without --device-flow to use browser/manual callback flow.");
+		}
+		return null;
+	}
+	const deviceFlow = deviceFlowResult.flow;
+	p.log.info("Using device OAuth flow.");
+	p.log.message(`Verification URL: ${deviceFlow.verificationUri}`);
+	p.log.message(`User code: ${deviceFlow.userCode}`);
+	const launchResult = openBrowserUrl(deviceFlow.verificationUriComplete ?? deviceFlow.verificationUri);
+	if (!launchResult.ok) {
+		const msg = launchResult.error ?? "unknown error";
+		p.log.warning(`Could not auto-open verification URL via ${launchResult.launcher.label} (${msg}).`);
+	}
+	const spinner = useSpinner ? p.spinner() : null;
+	if (spinner) spinner.start("Waiting for device authorization...");
+	else p.log.message("Waiting for device authorization...");
+	let intervalMs = Math.max(deviceFlow.interval, 1) * 1e3;
+	const deadline = Date.now() + deviceFlow.expiresIn * 1e3;
+	while (Date.now() < deadline) {
+		await sleep(intervalMs);
+		const pollResult = await pollDeviceAuthorizationToken(deviceFlow.deviceCode);
+		if (pollResult.type === "success") {
+			if (spinner) spinner.stop("Device authorization completed.");
+			else p.log.success("Device authorization completed.");
+			return pollResult;
+		}
+		if (pollResult.type === "pending") {
+			intervalMs = Math.max(pollResult.interval, 1) * 1e3;
+			continue;
+		}
+		if (pollResult.type === "slow_down") {
+			intervalMs = Math.max(pollResult.interval, Math.ceil(intervalMs / 1e3) + 5) * 1e3;
+			continue;
+		}
+		if (pollResult.type === "access_denied") {
+			if (spinner) spinner.stop("Device authorization was denied.");
+			else p.log.error("Device authorization was denied.");
+			return null;
+		}
+		if (pollResult.type === "expired") {
+			if (spinner) spinner.stop("Device authorization expired.");
+			else p.log.error("Device authorization expired.");
+			return null;
+		}
+		if (spinner) spinner.stop("Device authorization failed.");
+		else p.log.error("Device authorization failed.");
+		if (pollResult.type === "failed") {
+			if (pollResult.error) p.log.error(`Technical details: ${pollResult.error}`);
+			if (typeof pollResult.status === "number") p.log.error(`HTTP status: ${pollResult.status}`);
+			if (pollResult.oauthError) p.log.error(`OAuth error: ${pollResult.oauthError}`);
+			if (pollResult.responseBody) p.log.error(`Response: ${pollResult.responseBody}`);
+			if (pollResult.failureReason === "cloudflare_challenge") {
+				p.log.warning("Detected Cloudflare challenge on auth.openai.com.");
+				p.log.info("Retry without --device-flow to use browser/manual callback flow.");
+			}
+		}
+		return null;
+	}
+	if (spinner) spinner.stop("Device authorization timed out.");
+	else p.log.error("Device authorization timed out.");
+	return null;
+};
+const requestTokenViaOAuth = async (flow, options) => {
+	if (options.authFlow === "device") return runDeviceOAuthFlow(options.useSpinner);
+	let server = await startOAuthServer(flow.state);
+	if (!server.ready) if (server.reason === "port_in_use") {
+		p.log.warning(`Local callback server port ${CALLBACK_PORT} is already in use.`);
+		const listeningProcess = findListeningProcessOnPort(CALLBACK_PORT);
+		if (listeningProcess) p.log.info(`Detected listener on port ${CALLBACK_PORT}: PID ${listeningProcess.pid}${listeningProcess.command ? ` (${listeningProcess.command})` : ""}`);
+		const choice = await promptPortConflictChoice(listeningProcess);
+		if (choice === "cancel") {
+			p.log.info("Login cancelled.");
+			return null;
+		}
+		if (choice === "device") return runDeviceOAuthFlow(options.useSpinner);
+		if (listeningProcess) {
+			const confirmed = await p.confirm({
+				message: `Kill PID ${listeningProcess.pid}${listeningProcess.command ? ` (${listeningProcess.command})` : ""}?`,
+				initialValue: false
+			});
+			if (p.isCancel(confirmed) || !confirmed) {
+				p.log.info("Cancelled. No process was terminated.");
+				return null;
+			}
+			const killResult = killProcessByPid(listeningProcess.pid);
+			if (!killResult.ok) {
+				p.log.error(`Failed to terminate PID ${listeningProcess.pid}.`);
+				p.log.error(`Technical details: ${killResult.error ?? "unknown error"}`);
+				p.log.info("Try device flow instead: cdx login --device-flow");
+				return null;
+			}
+			p.log.success(`Sent SIGTERM to PID ${listeningProcess.pid}. Retrying local server...`);
+			await sleep(250);
+		} else p.log.warning(`Could not identify which process is listening on port ${CALLBACK_PORT}. Retrying once...`);
+		server = await startOAuthServer(flow.state);
+		if (!server.ready) {
+			p.log.error(`Failed to start local server on port ${CALLBACK_PORT} after retry.`);
+			if (server.error) p.log.error(`Technical details: ${server.error}`);
+			if (server.errorCode) p.log.error(`Error code: ${server.errorCode}`);
+			p.log.info("Try device flow instead: cdx login --device-flow");
+			return null;
+		}
+	} else {
+		p.log.error(`Failed to start local server on port ${CALLBACK_PORT}.`);
+		if (server.error) p.log.error(`Technical details: ${server.error}`);
+		if (server.errorCode) p.log.error(`Error code: ${server.errorCode}`);
+		p.log.info("Please ensure the port is not in use.");
+		return null;
+	}
+	const spinner = options.useSpinner ? p.spinner() : null;
+	let spinnerStarted = false;
+	p.log.info("Opening browser for authentication...");
+	const launchResult = openBrowserUrl(flow.url);
+	if (!launchResult.ok) {
+		const msg = launchResult.error ?? "unknown error";
+		p.log.warning(`Could not auto-open browser via ${launchResult.launcher.label} (${msg}).`);
+	}
+	p.log.message(`If your browser did not open, paste this URL:\n${flow.url}`);
+	if (launchResult.ok) {
+		if (spinner) {
+			spinner.start("Waiting for authentication...");
+			spinnerStarted = true;
+		}
+		const result = await server.waitForCode();
+		server.close();
+		if (!result) {
+			if (spinner) spinner.stop("Authentication timed out or failed.");
+			else p.log.warning("Authentication timed out or failed.");
+			return null;
+		}
+		if (spinner) spinner.message("Exchanging authorization code...");
+		else p.log.message("Exchanging authorization code...");
+		const tokenResult = await exchangeAuthorizationCode(result.code, flow.pkce.verifier);
+		if (tokenResult.type !== "success") {
+			if (spinner) spinner.stop("Failed to exchange authorization code.");
+			else p.log.error("Failed to exchange authorization code.");
+			return null;
+		}
+		if (spinner) spinner.stop("Authentication completed.");
+		return tokenResult;
+	}
+	const fallbackChoice = await promptBrowserFallbackChoice();
+	if (fallbackChoice === "cancel") {
+		server.close();
+		p.log.info("Login cancelled.");
+		return null;
+	}
+	if (fallbackChoice === "device") {
+		server.close();
+		return runDeviceOAuthFlow(options.useSpinner);
+	}
+	server.close();
+	const code = await promptManualAuthorizationCode(flow.url, flow.state);
+	if (!code) return null;
+	if (spinner) if (spinnerStarted) spinner.message("Exchanging authorization code...");
+	else {
+		spinner.start("Exchanging authorization code...");
+		spinnerStarted = true;
+	}
+	else p.log.message("Exchanging authorization code...");
+	const tokenResult = await exchangeAuthorizationCode(code, flow.pkce.verifier);
+	if (tokenResult.type !== "success") {
+		if (spinner) spinner.stop("Failed to exchange authorization code.");
+		else p.log.error("Failed to exchange authorization code.");
+		return null;
+	}
+	if (spinner) spinner.stop("Authentication completed.");
+	return tokenResult;
+};
+const addAccountToConfig = async (accountId, label) => {
+	let config;
+	const secretStore = getSecretStoreAdapter();
+	if (configExists()) {
+		config = await loadConfig();
+		if (!config.accounts.some((a) => a.accountId === accountId)) config.accounts.push({
+			accountId,
+			keychainService: secretStore.getServiceName(accountId),
+			...label ? { label } : {}
+		});
+	} else config = {
+		current: 0,
+		accounts: [{
+			accountId,
+			keychainService: secretStore.getServiceName(accountId),
+			...label ? { label } : {}
+		}]
+	};
+	await saveConfig(config);
+};
+const performRefresh = async (targetAccountId, label, options = {}) => {
+	const keepAlive = setInterval(() => {}, 1e3);
+	try {
+		const displayName = label ?? targetAccountId;
+		p.log.step(`Re-authenticating account "${displayName}"...`);
+		const useSpinner = options.useSpinner ?? true;
+		const authFlow = options.authFlow ?? "auto";
+		let tokenResult = null;
+		if (authFlow === "device") tokenResult = await runDeviceOAuthFlow(useSpinner);
+		else {
+			let flow;
+			try {
+				flow = await createAuthorizationFlow();
+			} catch (error) {
+				const msg = error instanceof Error ? error.message : String(error);
+				p.log.error(`Failed to create authorization flow: ${msg}`);
+				process.stderr.write(`Failed to create authorization flow: ${msg}\n`);
+				return null;
+			}
+			tokenResult = await requestTokenViaOAuth(flow, {
+				useSpinner,
+				authFlow
+			});
+		}
+		if (!tokenResult) return null;
+		const newAccountId = extractAccountIdFromTokens(tokenResult.idToken, tokenResult.access);
+		if (!newAccountId) {
+			p.log.error("Failed to extract account ID from token.");
+			return null;
+		}
+		if (newAccountId !== targetAccountId) {
+			p.log.error("Authentication completed for a different account.");
+			throw new Error(`Account mismatch: expected "${targetAccountId}" but got "${newAccountId}". Make sure you log in with the correct OpenAI account.`);
+		}
+		if (!useSpinner) p.log.message("Updating credentials...");
+		const payload = {
+			refresh: tokenResult.refresh,
+			access: tokenResult.access,
+			expires: tokenResult.expires,
+			accountId: newAccountId,
+			...tokenResult.idToken ? { idToken: tokenResult.idToken } : {}
+		};
+		await getSecretStoreAdapter().save(newAccountId, payload);
+		p.log.success("Credentials refreshed!");
+		p.log.success(`Account "${displayName}" credentials updated in secure store.`);
+		return { accountId: newAccountId };
+	} finally {
+		clearInterval(keepAlive);
+	}
+};
+const performLogin = async (options = {}) => {
+	p.intro("cdx login - Add OpenAI account");
+	const authFlow = options.authFlow ?? "auto";
+	let tokenResult = null;
+	if (authFlow === "device") tokenResult = await runDeviceOAuthFlow(true);
+	else tokenResult = await requestTokenViaOAuth(await createAuthorizationFlow(), {
+		useSpinner: true,
+		authFlow
+	});
+	if (!tokenResult) return null;
+	const accountId = extractAccountIdFromTokens(tokenResult.idToken, tokenResult.access);
+	if (!accountId) {
+		p.log.error("Failed to extract account ID from token.");
+		return null;
+	}
+	p.log.message("Saving credentials...");
+	const payload = {
+		refresh: tokenResult.refresh,
+		access: tokenResult.access,
+		expires: tokenResult.expires,
+		accountId,
+		...tokenResult.idToken ? { idToken: tokenResult.idToken } : {}
+	};
+	await getSecretStoreAdapter().save(accountId, payload);
+	p.log.success("Login successful!");
+	const labelInput = await p.text({
+		message: "Enter a label for this account (or press Enter to skip):",
+		placeholder: "e.g. Work, Personal"
+	});
+	const label = !p.isCancel(labelInput) && labelInput?.trim() ? labelInput.trim() : void 0;
+	await addAccountToConfig(accountId, label);
+	const displayName = label ?? accountId;
+	p.log.success(`Account "${displayName}" saved to secure store and config.`);
+	p.outro("You can now use 'cdx switch' to activate this account.");
+	return { accountId };
+};
+//#endregion
+//#region lib/refresh.ts
+const writeActiveAuthFilesIfCurrent = async (accountId) => {
+	if (!configExists()) return null;
+	const config = await loadConfig();
+	const current = config.accounts[config.current];
+	if (!current || current.accountId !== accountId) return null;
+	return writeAllAuthFiles(await getSecretStoreAdapter().load(accountId));
+};
+//#endregion
+//#region lib/platform/capabilities.ts
+const getRuntimeCapabilities = () => {
+	const pathResolution = getPathResolutionInfo();
+	return {
+		platform: process.platform,
+		pathProfile: pathResolution.profile,
+		secretStore: getSecretStoreCapability(),
+		browserLauncher: getBrowserLauncherCapability(process.platform)
+	};
+};
+//#endregion
+//#region lib/status.ts
+const formatDuration = (ms) => {
+	const absMs = Math.abs(ms);
+	const seconds = Math.floor(absMs / 1e3);
+	const minutes = Math.floor(seconds / 60);
+	const hours = Math.floor(minutes / 60);
+	const days = Math.floor(hours / 24);
+	if (days > 0) {
+		const remainingHours = hours % 24;
+		return remainingHours > 0 ? `${days}d ${remainingHours}h` : `${days}d`;
+	}
+	if (hours > 0) {
+		const remainingMinutes = minutes % 60;
+		return remainingMinutes > 0 ? `${hours}h ${remainingMinutes}m` : `${hours}h`;
+	}
+	if (minutes > 0) return `${minutes}m`;
+	return `${seconds}s`;
+};
+const formatExpiry = (expiresAt) => {
+	if (expiresAt === null) return "unknown";
+	const remaining = expiresAt - Date.now();
+	if (remaining <= 0) return `EXPIRED ${formatDuration(remaining)} ago`;
+	return `expires in ${formatDuration(remaining)}`;
+};
+const readOpenCodeAuthAccount = async () => {
+	const { authPath } = getPaths();
+	if (!existsSync(authPath)) return {
+		exists: false,
+		accountId: null
+	};
+	try {
+		const raw = await readFile(authPath, "utf8");
+		return {
+			exists: true,
+			accountId: JSON.parse(raw).openai?.accountId ?? null
+		};
+	} catch {
+		return {
+			exists: true,
+			accountId: null
+		};
+	}
+};
+const readCodexAuthAccount = async () => {
+	const { codexAuthPath } = getPaths();
+	if (!existsSync(codexAuthPath)) return {
+		exists: false,
+		accountId: null
+	};
+	try {
+		const raw = await readFile(codexAuthPath, "utf8");
+		return {
+			exists: true,
+			accountId: JSON.parse(raw).tokens?.account_id ?? null
+		};
+	} catch {
+		return {
+			exists: true,
+			accountId: null
+		};
+	}
+};
+const readPiAuthAccount = async () => {
+	const { piAuthPath } = getPaths();
+	if (!existsSync(piAuthPath)) return {
+		exists: false,
+		accountId: null
+	};
+	try {
+		const raw = await readFile(piAuthPath, "utf8");
+		return {
+			exists: true,
+			accountId: JSON.parse(raw)["openai-codex"]?.accountId ?? null
+		};
+	} catch {
+		return {
+			exists: true,
+			accountId: null
+		};
+	}
+};
+const getAccountStatus = async (accountId, isCurrent, label) => {
+	const secretStore = getSecretStoreAdapter();
+	let secureStoreExists = false;
+	let expiresAt = null;
+	let hasIdToken = false;
+	try {
+		const payload = await secretStore.load(accountId);
+		secureStoreExists = true;
+		expiresAt = payload.expires;
+		hasIdToken = !!payload.idToken;
+	} catch (error) {
+		secureStoreExists = !isMissingSecretStoreEntryError(error);
+	}
+	return {
+		accountId,
+		label,
+		isCurrent,
+		secureStoreExists,
+		hasIdToken,
+		expiresAt,
+		expiresIn: formatExpiry(expiresAt)
+	};
+};
+const getStatus = async () => {
+	const accounts = [];
+	if (configExists()) {
+		const config = await loadConfig();
+		for (let i = 0; i < config.accounts.length; i++) {
+			const account = config.accounts[i];
+			accounts.push(await getAccountStatus(account.accountId, i === config.current, account.label));
+		}
+	}
+	const [opencodeAuth, codexAuth, piAuth] = await Promise.all([
+		readOpenCodeAuthAccount(),
+		readCodexAuthAccount(),
+		readPiAuthAccount()
+	]);
+	return {
+		accounts,
+		opencodeAuth,
+		codexAuth,
+		piAuth,
+		capabilities: getRuntimeCapabilities()
+	};
+};
+//#endregion
+//#region lib/interactive.ts
+const getAccountDisplay = (accountId, isCurrent, label) => {
+	const name = label ? `${label} (${accountId})` : accountId;
+	return isCurrent ? `${name} (current)` : name;
+};
+const hasStoredCredentials = async (accountId) => getSecretStoreAdapter().exists(accountId);
+const loadStoredCredentials = async (accountId) => getSecretStoreAdapter().load(accountId);
+const getStoredAccountIds = async () => getSecretStoreAdapter().listAccountIds();
+const removeStoredCredentials = async (accountId) => {
+	await getSecretStoreAdapter().delete(accountId);
+};
+const getRefreshExpiryState = async (accountId) => {
+	if (!await hasStoredCredentials(accountId)) return "unknown [no secure store entry]";
+	try {
+		return formatExpiry((await loadStoredCredentials(accountId)).expires);
+	} catch {
+		return "unknown";
+	}
+};
+const handleListAccounts = async () => {
+	if (!configExists()) {
+		p.log.warning("No accounts configured. Use 'Add account' to get started.");
+		return;
+	}
+	const config = await loadConfig();
+	const currentAccountId = config.accounts[config.current]?.accountId;
+	p.log.info("Configured accounts:");
+	for (const account of config.accounts) {
+		const marker = account.accountId === currentAccountId ? "→ " : "  ";
+		const displayName = account.label ? `${account.label} (${account.accountId})` : account.accountId;
+		const status = await hasStoredCredentials(account.accountId) ? "" : " (missing credentials)";
+		p.log.message(`${marker}${displayName}${status}`);
+	}
+};
+const handleSwitchAccount = async () => {
+	if (!configExists()) {
+		p.log.warning("No accounts configured. Use 'Add account' first.");
+		return;
+	}
+	const config = await loadConfig();
+	if (config.accounts.length === 0) {
+		p.log.warning("No accounts found. Use 'Add account' first.");
+		return;
+	}
+	if (config.accounts.length === 1) {
+		p.log.info("Only one account configured. Nothing to switch.");
+		return;
+	}
+	const currentAccountId = config.accounts[config.current]?.accountId;
+	const options = config.accounts.map((account, index) => ({
+		value: index,
+		label: getAccountDisplay(account.accountId, account.accountId === currentAccountId, account.label)
+	}));
+	const selected = await p.select({
+		message: "Select account to activate:",
+		options
+	});
+	if (p.isCancel(selected)) {
+		p.log.info("Cancelled.");
+		return;
+	}
+	const selectedAccount = config.accounts[selected];
+	if (!selectedAccount) {
+		p.log.error("Invalid selection.");
+		return;
+	}
+	let payload;
+	try {
+		payload = await loadStoredCredentials(selectedAccount.accountId);
+	} catch {
+		p.log.error(`Missing credentials for account ${selectedAccount.label ?? selectedAccount.accountId}. Re-login with 'cdx login'.`);
+		return;
+	}
+	const result = await writeAllAuthFiles(payload);
+	config.current = selected;
+	await saveConfig(config);
+	const displayName = selectedAccount.label ?? selectedAccount.accountId;
+	const opencodeMark = "✓";
+	const piMark = result.piWritten ? "✓" : "✗";
+	const codexMark = result.codexWritten ? "✓" : result.codexCleared ? "⚠ missing id_token (cleared)" : "⚠ missing id_token";
+	p.log.success(`Switched to account ${displayName}`);
+	p.log.message(`  OpenCode:  ${opencodeMark}`);
+	p.log.message(`  Pi Agent:  ${piMark}`);
+	p.log.message(`  Codex CLI: ${codexMark}`);
+};
+const handleAddAccount = async () => {
+	await performLogin();
+};
+const handleReloginAccount = async (reloginOptions = {}) => {
+	if (!configExists()) {
+		p.log.warning("No accounts configured. Use 'Add account' first.");
+		return;
+	}
+	const config = await loadConfig();
+	if (config.accounts.length === 0) {
+		p.log.warning("No accounts to re-login.");
+		return;
+	}
+	const currentAccountId = config.accounts[config.current]?.accountId;
+	const options = await Promise.all(config.accounts.map(async (account) => ({
+		value: account.accountId,
+		label: `${getAccountDisplay(account.accountId, account.accountId === currentAccountId, account.label)} — ${await getRefreshExpiryState(account.accountId)}`
+	})));
+	const selected = await p.select({
+		message: "Select account to re-login:",
+		options
+	});
+	if (p.isCancel(selected)) {
+		p.log.info("Cancelled.");
+		return;
+	}
+	const accountId = selected;
+	const account = config.accounts.find((a) => a.accountId === accountId);
+	const expiryState = await getRefreshExpiryState(accountId);
+	const displayName = account?.label ?? accountId;
+	p.log.info(`Current token status for ${displayName}: ${expiryState}`);
+	try {
+		const result = await performRefresh(accountId, account?.label, {
+			useSpinner: false,
+			authFlow: reloginOptions.authFlow
+		});
+		if (!result) p.log.warning("Re-login was not completed.");
+		else {
+			const authResult = await writeActiveAuthFilesIfCurrent(result.accountId);
+			if (authResult) {
+				const piMark = authResult.piWritten ? "✓" : "✗";
+				const codexMark = authResult.codexWritten ? "✓" : authResult.codexCleared ? "⚠ missing id_token (cleared)" : "⚠ missing id_token";
+				p.log.message("Updated active auth files:");
+				p.log.message("  OpenCode:  ✓");
+				p.log.message(`  Pi Agent:  ${piMark}`);
+				p.log.message(`  Codex CLI: ${codexMark}`);
+			}
+		}
+	} catch (error) {
+		const msg = error instanceof Error ? error.message : String(error);
+		p.log.error(`Re-login failed: ${msg}`);
+	}
+};
+const handleRemoveAccount = async () => {
+	if (!configExists()) {
+		p.log.warning("No accounts configured.");
+		return;
+	}
+	const config = await loadConfig();
+	if (config.accounts.length === 0) {
+		p.log.warning("No accounts to remove.");
+		return;
+	}
+	const currentAccountId = config.accounts[config.current]?.accountId;
+	const options = config.accounts.map((account) => ({
+		value: account.accountId,
+		label: getAccountDisplay(account.accountId, account.accountId === currentAccountId, account.label)
+	}));
+	const selected = await p.select({
+		message: "Select account to remove:",
+		options
+	});
+	if (p.isCancel(selected)) {
+		p.log.info("Cancelled.");
+		return;
+	}
+	const accountId = selected;
+	const confirmed = await p.confirm({
+		message: `Are you sure you want to remove account ${accountId}?`,
+		initialValue: false
+	});
+	if (p.isCancel(confirmed) || !confirmed) {
+		p.log.info("Cancelled.");
+		return;
+	}
+	try {
+		await removeStoredCredentials(accountId);
+	} catch {}
+	const previousAccountId = config.accounts[config.current]?.accountId;
+	config.accounts = config.accounts.filter((a) => a.accountId !== accountId);
+	if (config.accounts.length === 0) config.current = 0;
+	else if (accountId === previousAccountId) config.current = 0;
+	else {
+		const newIndex = config.accounts.findIndex((a) => a.accountId === previousAccountId);
+		config.current = newIndex >= 0 ? newIndex : 0;
+	}
+	await saveConfig(config);
+	p.log.success(`Removed account ${accountId}`);
+};
+const handleLabelAccount = async () => {
+	if (!configExists()) {
+		p.log.warning("No accounts configured.");
+		return;
+	}
+	const config = await loadConfig();
+	if (config.accounts.length === 0) {
+		p.log.warning("No accounts to label.");
+		return;
+	}
+	const currentAccountId = config.accounts[config.current]?.accountId;
+	const options = config.accounts.map((account) => ({
+		value: account.accountId,
+		label: getAccountDisplay(account.accountId, account.accountId === currentAccountId, account.label)
+	}));
+	const selected = await p.select({
+		message: "Select account to label:",
+		options
+	});
+	if (p.isCancel(selected)) {
+		p.log.info("Cancelled.");
+		return;
+	}
+	const accountId = selected;
+	const account = config.accounts.find((a) => a.accountId === accountId);
+	const labelInput = await p.text({
+		message: "Enter new label (or leave empty to remove label):",
+		placeholder: "e.g. Work, Personal",
+		initialValue: account?.label ?? ""
+	});
+	if (p.isCancel(labelInput)) {
+		p.log.info("Cancelled.");
+		return;
+	}
+	const newLabel = labelInput?.trim() || void 0;
+	const target = config.accounts.find((a) => a.accountId === accountId);
+	if (target) target.label = newLabel;
+	await saveConfig(config);
+	if (newLabel) p.log.success(`Account ${accountId} labeled as "${newLabel}".`);
+	else p.log.success(`Label removed from account ${accountId}.`);
+};
+const handleStatus = async () => {
+	const status = await getStatus();
+	if (status.accounts.length === 0) {
+		p.log.warning("No accounts configured. Use 'Add account' to get started.");
+		return;
+	}
+	p.log.info("Account status:");
+	for (const account of status.accounts) {
+		const marker = account.isCurrent ? "→ " : "  ";
+		const name = account.label ? `${account.label} (${account.accountId})` : account.accountId;
+		const secureStore = account.secureStoreExists ? "" : " [no secure store entry]";
+		const idToken = account.hasIdToken ? "" : " [no id_token]";
+		p.log.message(`${marker}${name} — ${account.expiresIn}${secureStore}${idToken}`);
+	}
+	const ocStatus = status.opencodeAuth.exists ? `active: ${status.opencodeAuth.accountId ?? "unknown"}` : "not found";
+	const cxStatus = status.codexAuth.exists ? `active: ${status.codexAuth.accountId ?? "unknown"}` : "not found";
+	const piStatus = status.piAuth.exists ? `active: ${status.piAuth.accountId ?? "unknown"}` : "not found";
+	p.log.info(`Auth files:`);
+	p.log.message(`  OpenCode: ${ocStatus}`);
+	p.log.message(`  Codex CLI: ${cxStatus}`);
+	p.log.message(`  Pi Agent: ${piStatus}`);
+};
+const runInteractiveMode = async () => {
+	p.intro("cdx - OpenAI Account Switcher");
+	let running = true;
+	while (running) {
+		const storedAccounts = await getStoredAccountIds();
+		let currentInfo = "";
+		if (configExists()) try {
+			const config = await loadConfig();
+			const current = config.accounts[config.current];
+			if (current) currentInfo = ` (current: ${current.label ?? current.accountId})`;
+		} catch {}
+		const action = await p.select({
+			message: `What would you like to do?${currentInfo}`,
+			options: [
+				{
+					value: "list",
+					label: `List accounts (${storedAccounts.length} in secure store)`
+				},
+				{
+					value: "switch",
+					label: "Switch account"
+				},
+				{
+					value: "add",
+					label: "Add account (OAuth login)"
+				},
+				{
+					value: "relogin",
+					label: "Re-login account"
+				},
+				{
+					value: "remove",
+					label: "Remove account"
+				},
+				{
+					value: "label",
+					label: "Label account"
+				},
+				{
+					value: "status",
+					label: "Account status & token expiry"
+				},
+				{
+					value: "exit",
+					label: "Exit"
+				}
+			]
+		});
+		if (p.isCancel(action)) {
+			running = false;
+			continue;
+		}
+		switch (action) {
+			case "list":
+				await handleListAccounts();
+				break;
+			case "switch":
+				await handleSwitchAccount();
+				break;
+			case "add":
+				await handleAddAccount();
+				break;
+			case "relogin":
+				await handleReloginAccount();
+				break;
+			case "remove":
+				await handleRemoveAccount();
+				break;
+			case "label":
+				await handleLabelAccount();
+				break;
+			case "status":
+				await handleStatus();
+				break;
+			case "exit":
+				running = false;
+				break;
+		}
+		if (running && action !== "exit") p.log.message("");
+	}
+	p.outro("Goodbye!");
+};
+//#endregion
+//#region lib/commands/interactive.ts
+const registerDefaultInteractiveAction = (program) => {
+	program.action(async () => {
+		try {
+			await runInteractiveMode();
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/keychain-acl.ts
+const getDefaultMap = (services) => {
+	const map = /* @__PURE__ */ new Map();
+	for (const service of services) map.set(service, {
+		service,
+		mode: "missing",
+		applications: []
+	});
+	return map;
+};
+const parseItemEntries = (block) => {
+	const entries = [];
+	const entryRegex = /entry\s+\d+:\n([\s\S]*?)(?=\n\s*entry\s+\d+:|$)/g;
+	let match;
+	while ((match = entryRegex.exec(block)) !== null) if (match[1]) entries.push(match[1]);
+	return entries;
+};
+const parseApplicationsFromEntry = (entry) => {
+	const applications = [];
+	const appRegex = /^\s*\d+:\s+(.+?)(?:\s+\([^\n]*\))?\s*$/gm;
+	let match;
+	while ((match = appRegex.exec(entry)) !== null) {
+		const app = match[1]?.trim();
+		if (app) applications.push(app);
+	}
+	return applications;
+};
+const parseKeychainDecryptAccessFromDump = (dumpOutput, services) => {
+	const dedupedServices = [...new Set(services.filter((service) => service.length > 0))];
+	const result = getDefaultMap(dedupedServices);
+	if (dedupedServices.length === 0 || !dumpOutput.trim()) return result;
+	const targetServices = new Set(dedupedServices);
+	const blocks = dumpOutput.split(/\n(?=keychain:\s+")/g);
+	for (const block of blocks) {
+		if (!block.startsWith("keychain:")) continue;
+		const service = block.match(/"svce"<blob>="([^"]+)"/)?.[1];
+		if (!service || !targetServices.has(service)) continue;
+		const entries = parseItemEntries(block);
+		let mode = "missing";
+		const applications = [];
+		for (const entry of entries) {
+			const authorizationsLine = entry.match(/authorizations\s*\(\d+\):\s*([^\n]+)/)?.[1] ?? "";
+			if (!/\bdecrypt\b/.test(authorizationsLine)) continue;
+			if (/applications:\s*<null>/.test(entry)) {
+				mode = "all-apps";
+				applications.length = 0;
+				break;
+			}
+			const entryApplications = parseApplicationsFromEntry(entry);
+			if (entryApplications.length > 0) {
+				mode = "explicit-list";
+				for (const app of entryApplications) if (!applications.includes(app)) applications.push(app);
+			}
+		}
+		result.set(service, {
+			service,
+			mode,
+			applications
+		});
+	}
+	return result;
+};
+const getKeychainDecryptAccessByServiceAsync = async (services) => {
+	const dedupedServices = [...new Set(services.filter((service) => service.length > 0))];
+	const defaultResult = getDefaultMap(dedupedServices);
+	if (process.platform !== "darwin" || dedupedServices.length === 0) return defaultResult;
+	const dumpResult = await runSecuritySafeAsync(["dump-keychain", "-a"]);
+	if (!dumpResult.success) return defaultResult;
+	return parseKeychainDecryptAccessFromDump(dumpResult.output, dedupedServices);
+};
+//#endregion
+//#region lib/secrets/probe.ts
+const toError = (error) => error instanceof Error ? error : new Error(String(error));
+const createProbePayload = (accountId, now) => ({
+	refresh: `probe-refresh-${accountId}`,
+	access: `probe-access-${accountId}`,
+	expires: now + 6e4,
+	accountId
+});
+const payloadMatches = (expected, actual) => expected.accountId === actual.accountId && expected.refresh === actual.refresh && expected.access === actual.access && expected.expires === actual.expires;
+const runSecretStoreWriteReadProbe = async (secretStore, options = {}) => {
+	const probeAccountId = options.probeAccountId ?? `cdx-doctor-probe-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+	const payload = createProbePayload(probeAccountId, options.now ?? Date.now());
+	let saveSucceeded = false;
+	let result = { ok: true };
+	try {
+		await secretStore.save(probeAccountId, payload);
+		saveSucceeded = true;
+	} catch (error) {
+		result = {
+			ok: false,
+			stage: "save",
+			error: toError(error)
+		};
+	}
+	if (result.ok) try {
+		if (!payloadMatches(payload, await secretStore.load(probeAccountId))) result = {
+			ok: false,
+			stage: "verify",
+			error: /* @__PURE__ */ new Error("Secure-store probe loaded payload does not match the saved payload.")
+		};
+	} catch (error) {
+		result = {
+			ok: false,
+			stage: "load",
+			error: toError(error)
+		};
+	}
+	if (saveSucceeded) try {
+		await secretStore.delete(probeAccountId);
+	} catch (error) {
+		if (result.ok) result = {
+			ok: false,
+			stage: "delete",
+			error: toError(error)
+		};
+	}
+	return result;
+};
+//#endregion
+//#region lib/commands/doctor.ts
+const hasRuntimeTrustedApp = (trustedApplications, runtimeExecutablePath) => {
+	const runtimeBaseName = path.basename(runtimeExecutablePath).toLowerCase();
+	return trustedApplications.some((trustedApp) => {
+		if (trustedApp === runtimeExecutablePath) return true;
+		return path.basename(trustedApp).toLowerCase() === runtimeBaseName;
+	});
+};
+const getSecretStoreProbeHeading = (platform) => {
+	if (platform === "linux") return "Linux secure-store probe";
+	if (platform === "darwin") return "macOS secure-store probe";
+	if (platform === "win32") return "Windows secure-store probe";
+	return null;
+};
+const createProbeAdapterForCurrentPlatform = () => {
+	const currentAdapter = getSecretStoreAdapter();
+	if (process.platform === "darwin" && currentAdapter.id === "macos-legacy-keychain") return createSecretStoreAdapterFromSelection("legacy-keychain", "darwin");
+	return createRuntimeSecretStoreAdapter(process.platform);
+};
+const getSecretStoreProbeGuidance = (platform) => {
+	if (platform === "linux") return "Suggested fix: ensure Secret Service is running/unlocked (for example gnome-keyring + secret-tool), then retry login.";
+	if (platform === "darwin") return "Suggested fix: ensure Keychain Access is unlocked and allows this runtime/toolchain to store/read passwords, then retry login.";
+	if (platform === "win32") return "Suggested fix: ensure Windows Credential Manager is available for this user session, then retry login.";
+	return null;
+};
+const isInteractiveTerminal$1 = () => Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+const runCommandCapture$1 = async (command, args) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	let stderr = "";
+	let spawnError = null;
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	child.once("error", (error) => {
+		spawnError = error.message;
+	});
+	child.once("close", (code) => {
+		resolve({
+			ok: spawnError === null && code === 0,
+			stdout: stdout.trim(),
+			stderr: stderr.trim(),
+			...spawnError ? { error: spawnError } : {}
+		});
+	});
+});
+const runCommandCaptureWithInput = async (command, args, input) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: [
+		"pipe",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	let stderr = "";
+	let spawnError = null;
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	child.once("error", (error) => {
+		spawnError = error.message;
+	});
+	child.stdin?.write(input);
+	child.stdin?.end();
+	child.once("close", (code) => {
+		resolve({
+			ok: spawnError === null && code === 0,
+			stdout: stdout.trim(),
+			stderr: stderr.trim(),
+			...spawnError ? { error: spawnError } : {}
+		});
+	});
+});
+const runCommandDetached = async (command, args) => {
+	try {
+		spawn(command, args, {
+			detached: true,
+			stdio: "ignore"
+		}).unref();
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+};
+const extractCommandFailureDetails$1 = (result) => result.error || result.stderr || result.stdout || void 0;
+const isCommandAvailable$1 = async (commandName) => {
+	return (await runCommandCapture$1("sh", ["-lc", `command -v ${commandName} >/dev/null 2>&1`])).ok;
+};
+const GNOME_KEYRING_CMDLINE_PATTERN$1 = /(^|\/)gnome-keyring-daemon(\s|$)/;
+const checkGnomeKeyringRunning$1 = async () => {
+	if (await isCommandAvailable$1("ps")) {
+		const psResult = await runCommandCapture$1("ps", [
+			"-A",
+			"-o",
+			"args="
+		]);
+		if (psResult.ok) {
+			if (psResult.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).some((line) => GNOME_KEYRING_CMDLINE_PATTERN$1.test(line))) return { ok: true };
+			return {
+				ok: false,
+				details: "No gnome-keyring-daemon process found."
+			};
+		}
+	}
+	if (await isCommandAvailable$1("pgrep")) {
+		const pgrepResult = await runCommandCapture$1("pgrep", ["-f", "gnome-keyring-daemon"]);
+		if (pgrepResult.ok) return { ok: true };
+		return {
+			ok: false,
+			details: extractCommandFailureDetails$1(pgrepResult) ?? "No gnome-keyring-daemon process found."
+		};
+	}
+	return {
+		ok: false,
+		details: "Neither ps nor pgrep is available to check gnome-keyring-daemon."
+	};
+};
+const parseSystemctlEnabledState$1 = (output) => {
+	const normalized = output.trim().toLowerCase();
+	if ([
+		"enabled",
+		"enabled-runtime",
+		"static",
+		"indirect",
+		"generated"
+	].includes(normalized)) return "enabled";
+	if ([
+		"disabled",
+		"masked",
+		"not-found",
+		"linked",
+		"linked-runtime"
+	].includes(normalized)) return "disabled";
+	return "unknown";
+};
+const getLinuxGnomeKeyringAutoStartStatus$1 = async () => {
+	if (!await isCommandAvailable$1("systemctl")) return {
+		state: "unknown",
+		details: "systemctl is not available; autostart detection depends on your desktop/session config."
+	};
+	const units = ["gnome-keyring-daemon.socket", "gnome-keyring-daemon.service"];
+	let sawDisabled = false;
+	const details = [];
+	for (const unit of units) {
+		const result = await runCommandCapture$1("systemctl", [
+			"--user",
+			"is-enabled",
+			unit
+		]);
+		const state = parseSystemctlEnabledState$1(result.stdout || result.stderr);
+		if (state === "enabled") return {
+			state: "enabled",
+			details: `${unit} is enabled (${result.stdout || "enabled"}).`
+		};
+		if (state === "disabled") {
+			sawDisabled = true;
+			details.push(`${unit}: ${result.stdout || result.stderr || "disabled"}`);
+			continue;
+		}
+		const maybeDetail = extractCommandFailureDetails$1(result);
+		if (maybeDetail) details.push(`${unit}: ${maybeDetail}`);
+	}
+	if (sawDisabled) return {
+		state: "disabled",
+		details: details.join("; ")
+	};
+	return {
+		state: "unknown",
+		details: details.join("; ") || "Unable to determine gnome-keyring autostart state."
+	};
+};
+const applyKeyringEnvAssignments = (raw) => {
+	const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (const line of lines) {
+		const match = line.match(/^([A-Z0-9_]+)=(.*);?$/);
+		if (!match) continue;
+		const key = match[1];
+		const value = match[2].replace(/;$/, "");
+		if (key) process.env[key] = value;
+	}
+};
+const startGnomeKeyringNow$1 = async () => {
+	const directStart = await runCommandCapture$1("gnome-keyring-daemon", ["--start", "--components=secrets"]);
+	if (directStart.ok) {
+		applyKeyringEnvAssignments(directStart.stdout);
+		const runningCheck = await checkGnomeKeyringRunning$1();
+		if (runningCheck.ok) return { ok: true };
+		return {
+			ok: false,
+			details: runningCheck.details ?? "gnome-keyring-daemon start command succeeded, but process was not detected afterwards."
+		};
+	}
+	if (await isCommandAvailable$1("systemctl")) {
+		const serviceStart = await runCommandCapture$1("systemctl", [
+			"--user",
+			"start",
+			"gnome-keyring-daemon.service"
+		]);
+		if (serviceStart.ok) {
+			const runningCheck = await checkGnomeKeyringRunning$1();
+			if (runningCheck.ok) return { ok: true };
+			return {
+				ok: false,
+				details: runningCheck.details ?? "systemctl start succeeded, but gnome-keyring-daemon was not detected afterwards."
+			};
+		}
+		return {
+			ok: false,
+			details: extractCommandFailureDetails$1(directStart) ?? extractCommandFailureDetails$1(serviceStart) ?? "Failed to start gnome-keyring-daemon."
+		};
+	}
+	return {
+		ok: false,
+		details: extractCommandFailureDetails$1(directStart) ?? "Failed to start gnome-keyring-daemon."
+	};
+};
+const enableGnomeKeyringAutoStart = async () => {
+	if (!await isCommandAvailable$1("systemctl")) return {
+		ok: false,
+		details: "systemctl is not available, so cdx cannot automatically enable startup in this session manager."
+	};
+	const units = ["gnome-keyring-daemon.socket", "gnome-keyring-daemon.service"];
+	const failures = [];
+	for (const unit of units) {
+		const result = await runCommandCapture$1("systemctl", [
+			"--user",
+			"enable",
+			unit
+		]);
+		if (result.ok) return {
+			ok: true,
+			details: `${unit} enabled.`
+		};
+		const detail = extractCommandFailureDetails$1(result);
+		failures.push(`${unit}: ${detail ?? "enable failed"}`);
+	}
+	return {
+		ok: false,
+		details: failures.join("; ")
+	};
+};
+const maybeOfferToStartGnomeKeyring = async () => {
+	const autoStartStatus = await getLinuxGnomeKeyringAutoStartStatus$1();
+	if (autoStartStatus.state === "enabled") {
+		const shouldStartNow = await p.confirm({
+			message: "gnome-keyring autostart appears enabled, but it is not running right now. Start it now?",
+			initialValue: true
+		});
+		if (p.isCancel(shouldStartNow) || !shouldStartNow) return false;
+		const startResult = await startGnomeKeyringNow$1();
+		if (!startResult.ok) {
+			process.stdout.write(`      failed to start gnome-keyring-daemon: ${startResult.details ?? "unknown error"}\n`);
+			return false;
+		}
+		process.stdout.write("      started gnome-keyring-daemon for this session.\n");
+		return true;
+	}
+	if (autoStartStatus.details) process.stdout.write(`      autostart check: ${autoStartStatus.details}\n`);
+	const action = await p.select({
+		message: autoStartStatus.state === "disabled" ? "gnome-keyring autostart seems disabled. What should cdx do?" : "Could not confirm gnome-keyring autostart. What should cdx do?",
+		options: [
+			{
+				value: "start-now",
+				label: "Start now only"
+			},
+			{
+				value: "enable-and-start",
+				label: "Enable on system start and start now"
+			},
+			{
+				value: "skip",
+				label: "Skip"
+			}
+		],
+		initialValue: "start-now"
+	});
+	if (p.isCancel(action) || action === "skip") return false;
+	if (action === "enable-and-start") {
+		const enableResult = await enableGnomeKeyringAutoStart();
+		if (!enableResult.ok) {
+			process.stdout.write(`      failed to enable autostart: ${enableResult.details ?? "unknown error"}\n`);
+			return false;
+		}
+		process.stdout.write(`      autostart enabled${enableResult.details ? ` (${enableResult.details})` : ""}.\n`);
+	}
+	const startResult = await startGnomeKeyringNow$1();
+	if (!startResult.ok) {
+		process.stdout.write(`      failed to start gnome-keyring-daemon: ${startResult.details ?? "unknown error"}\n`);
+		return false;
+	}
+	process.stdout.write("      started gnome-keyring-daemon for this session.\n");
+	return true;
+};
+const runLinuxSecretStoreChecklist = async () => {
+	const gnomeKeyringInstalled = await isCommandAvailable$1("gnome-keyring-daemon");
+	const secretToolInstalled = await isCommandAvailable$1("secret-tool");
+	const gnomeKeyringRunning = await checkGnomeKeyringRunning$1();
+	return [
+		{
+			id: "gnome-keyring-installed",
+			question: "Is gnome-keyring installed?",
+			ok: gnomeKeyringInstalled,
+			hint: "Install the `gnome-keyring` package, then log out/in (or restart your session)."
+		},
+		{
+			id: "secret-tool-installed",
+			question: "Is secret-tool installed?",
+			ok: secretToolInstalled,
+			hint: "Install the package that provides `secret-tool` (often `libsecret-tools`)."
+		},
+		{
+			id: "gnome-keyring-running",
+			question: "Is gnome-keyring running?",
+			ok: gnomeKeyringRunning.ok,
+			details: gnomeKeyringRunning.details,
+			hint: "Start/unlock gnome-keyring-daemon in your session (cdx can do this interactively)."
+		}
+	];
+};
+const runSecretToolRoundTripCheck = async () => {
+	const id = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+	const service = `cdx-doctor-secret-service-${id}`;
+	const account = `cdx-doctor-account-${id}`;
+	const value = `cdx-doctor-value-${id}`;
+	const storeResult = await runCommandCaptureWithInput("secret-tool", [
+		"store",
+		"--label=cdx doctor Secret Service probe",
+		"service",
+		service,
+		"account",
+		account
+	], `${value}\n`);
+	if (!storeResult.ok) return {
+		ok: false,
+		details: extractCommandFailureDetails$1(storeResult) ?? "secret-tool store failed."
+	};
+	const lookupResult = await runCommandCapture$1("secret-tool", [
+		"lookup",
+		"service",
+		service,
+		"account",
+		account
+	]);
+	if (!lookupResult.ok) return {
+		ok: false,
+		details: extractCommandFailureDetails$1(lookupResult) ?? "secret-tool lookup failed."
+	};
+	if (lookupResult.stdout.trim() !== value) return {
+		ok: false,
+		details: "secret-tool lookup returned an unexpected value after store."
+	};
+	const clearResult = await runCommandCapture$1("secret-tool", [
+		"clear",
+		"service",
+		service,
+		"account",
+		account
+	]);
+	if (!clearResult.ok) return {
+		ok: false,
+		details: extractCommandFailureDetails$1(clearResult) ?? "secret-tool clear failed."
+	};
+	return { ok: true };
+};
+const runLinuxSecretStoreDeepRemediation = async () => {
+	if (!isInteractiveTerminal$1()) return;
+	const hasSecretTool = await isCommandAvailable$1("secret-tool");
+	const hasSeahorse = await isCommandAvailable$1("seahorse");
+	const shouldStart = await p.confirm({
+		message: "Run deeper Linux Secret Service remediation now? (interactive actions, no copy/paste commands)",
+		initialValue: true
+	});
+	if (p.isCancel(shouldStart) || !shouldStart) return;
+	while (true) {
+		const action = await p.select({
+			message: "Choose next remediation action:",
+			options: [
+				{
+					value: "secret-tool-test",
+					label: hasSecretTool ? "Run Secret Service write/read/clear test now" : "Run Secret Service write/read/clear test now (secret-tool not found)"
+				},
+				{
+					value: "open-keyring-manager",
+					label: hasSeahorse ? "Open keyring manager now" : "Open keyring manager now (seahorse not found)"
+				},
+				{
+					value: "retry-probe",
+					label: "Retry cdx secure-store probe now"
+				},
+				{
+					value: "done",
+					label: "Done"
+				}
+			],
+			initialValue: "secret-tool-test"
+		});
+		if (p.isCancel(action) || action === "done") return;
+		if (action === "secret-tool-test") {
+			if (!hasSecretTool) {
+				process.stdout.write("    secret-tool is not installed; install it first, then rerun this remediation action.\n");
+				continue;
+			}
+			const result = await runSecretToolRoundTripCheck();
+			if (result.ok) process.stdout.write("    secret-tool roundtrip test passed.\n");
+			else process.stdout.write(`    secret-tool roundtrip test failed: ${result.details ?? "unknown error"}\n`);
+			continue;
+		}
+		if (action === "open-keyring-manager") {
+			if (!hasSeahorse) {
+				process.stdout.write("    keyring manager app was not found (seahorse). Install it to manage collections/locks interactively.\n");
+				continue;
+			}
+			const opened = await runCommandDetached("seahorse", []);
+			if (!opened.ok) process.stdout.write(`    failed to open keyring manager: ${opened.error ?? "unknown error"}\n`);
+			else process.stdout.write("    opened keyring manager. Unlock/create the default keyring, then return here and retry probe.\n");
+			continue;
+		}
+		const probeResult = await runSecretStoreWriteReadProbe(createProbeAdapterForCurrentPlatform());
+		if (probeResult.ok) {
+			process.stdout.write("    cdx secure-store probe now passes.\n");
+			return;
+		}
+		process.stdout.write(`    probe still failing (${probeResult.stage}): ${probeResult.error.message}\n`);
+	}
+};
+const maybeRunLinuxSecretStoreChecklist = async () => {
+	if (!isInteractiveTerminal$1()) {
+		process.stdout.write("  Tip: run `cdx doctor` in an interactive terminal to start guided Linux secret-store checks.\n");
+		return;
+	}
+	const shouldRunChecklist = await p.confirm({
+		message: "Run guided Linux secret-store checks now? (gnome-keyring installed, secret-tool installed, gnome-keyring running)",
+		initialValue: true
+	});
+	if (p.isCancel(shouldRunChecklist) || !shouldRunChecklist) {
+		process.stdout.write("  Guided Linux checks skipped.\n");
+		return;
+	}
+	process.stdout.write("  Guided Linux checks:\n");
+	const checklist = await runLinuxSecretStoreChecklist();
+	let passed = 0;
+	for (let i = 0; i < checklist.length; i++) {
+		const item = checklist[i];
+		if (item.ok) {
+			passed += 1;
+			process.stdout.write(`    ${i + 1}/3 ${item.question} yes\n`);
+			continue;
+		}
+		process.stdout.write(`    ${i + 1}/3 ${item.question} no\n`);
+		if (item.details) process.stdout.write(`      details: ${item.details}\n`);
+		if (item.hint) process.stdout.write(`      hint: ${item.hint}\n`);
+		if (item.id === "gnome-keyring-running") {
+			if (await maybeOfferToStartGnomeKeyring()) {
+				const runningNow = await checkGnomeKeyringRunning$1();
+				if (runningNow.ok) {
+					passed += 1;
+					process.stdout.write("      re-check: gnome-keyring-daemon is now running.\n");
+				} else process.stdout.write(`      re-check still failing: ${runningNow.details ?? "process not detected"}\n`);
+			}
+		}
+	}
+	process.stdout.write(`  Guided checklist summary: ${passed}/${checklist.length} checks passed.\n`);
+	if (passed === checklist.length) {
+		process.stdout.write("  Note: basic checks passed, but secure-store probe still failed. This can happen when the keyring is locked, has no default collection, or your D-Bus/session setup prevents Secret Service writes.\n");
+		await runLinuxSecretStoreDeepRemediation();
+	}
+};
+const registerDoctorCommand = (program) => {
+	program.command("doctor").description("Show auth file paths and runtime capabilities").option("--check-keychain-acl", "Run keychain trusted-app/ACL checks on macOS (can be slow)").action(async (options) => {
+		try {
+			const status = await getStatus();
+			const paths = getPaths();
+			const resolveLabel = (accountId) => {
+				if (!accountId) return "unknown";
+				return status.accounts.find((account) => account.accountId === accountId)?.label ?? accountId;
+			};
+			process.stdout.write("\nAuth files:\n");
+			const ocStatus = status.opencodeAuth.exists ? `active: ${resolveLabel(status.opencodeAuth.accountId)}` : "not found";
+			process.stdout.write(`  OpenCode: ${ocStatus}\n`);
+			process.stdout.write(`    Path: ${paths.authPath}\n`);
+			const cxStatus = status.codexAuth.exists ? `active: ${resolveLabel(status.codexAuth.accountId)}` : "not found";
+			process.stdout.write(`  Codex CLI: ${cxStatus}\n`);
+			process.stdout.write(`    Path: ${paths.codexAuthPath}\n`);
+			const piStatus = status.piAuth.exists ? `active: ${resolveLabel(status.piAuth.accountId)}` : "not found";
+			process.stdout.write(`  Pi Agent: ${piStatus}\n`);
+			process.stdout.write(`    Path: ${paths.piAuthPath}\n`);
+			process.stdout.write("\nCapabilities:\n");
+			process.stdout.write(`  Platform: ${status.capabilities.platform}\n`);
+			process.stdout.write(`  Path profile: ${status.capabilities.pathProfile}\n`);
+			const secretStoreState = status.capabilities.secretStore.available ? "available" : `unavailable${status.capabilities.secretStore.reason ? ` (${status.capabilities.secretStore.reason})` : ""}`;
+			process.stdout.write(`  Secret store: ${status.capabilities.secretStore.label} — ${secretStoreState}\n`);
+			const browserState = status.capabilities.browserLauncher.available ? "available" : "not found";
+			process.stdout.write(`  Browser launcher: ${status.capabilities.browserLauncher.label} — ${browserState}\n`);
+			if (process.platform === "win32") {
+				const secretStore = getSecretStoreAdapter();
+				process.stdout.write("\nWindows secure-store checks:\n");
+				if (status.accounts.length === 0) process.stdout.write("  No accounts configured in config.\n");
+				else {
+					let okCount = 0;
+					for (const account of status.accounts) {
+						const accountLabel = resolveLabel(account.accountId);
+						try {
+							await secretStore.load(account.accountId);
+							okCount += 1;
+							process.stdout.write(`  ${accountLabel}: credential payload load OK\n`);
+						} catch (error) {
+							if (isMissingSecretStoreEntryError(error)) {
+								process.stdout.write(`  ⚠ ${accountLabel}: missing secure-store entry for configured account\n`);
+								continue;
+							}
+							const message = error instanceof Error ? error.message : String(error);
+							process.stdout.write(`  ⚠ ${accountLabel}: secure-store load failed (${message})\n`);
+						}
+					}
+					process.stdout.write(`  Summary: ${okCount}/${status.accounts.length} configured account(s) passed secure-store load checks.\n`);
+				}
+			}
+			const probeHeading = getSecretStoreProbeHeading(process.platform);
+			if (probeHeading) {
+				process.stdout.write(`\n${probeHeading}:\n`);
+				const probeResult = await runSecretStoreWriteReadProbe(createProbeAdapterForCurrentPlatform());
+				if (probeResult.ok) process.stdout.write("  write/read/delete probe: OK\n");
+				else {
+					process.stdout.write(`  ⚠ ${probeResult.stage} failed: ${probeResult.error.message}\n`);
+					const guidance = getSecretStoreProbeGuidance(process.platform);
+					if (guidance) process.stdout.write(`  ${guidance}\n`);
+					if (process.platform === "linux") await maybeRunLinuxSecretStoreChecklist();
+				}
+			}
+			if (process.platform === "darwin" && !options.checkKeychainAcl) {
+				process.stdout.write("  ┌─ Optional keychain ACL check\n");
+				process.stdout.write("  │  Run: cdx doctor --check-keychain-acl\n");
+				process.stdout.write("  │  Verifies whether your current runtime is trusted by Keychain.\n");
+				process.stdout.write("  └─ Expected duration: ~30-60 seconds\n");
+			}
+			if (process.platform === "darwin" && options.checkKeychainAcl) {
+				const secretStore = getSecretStoreAdapter();
+				const accountsWithSecrets = status.accounts.filter((account) => account.secureStoreExists);
+				if (accountsWithSecrets.length > 0) {
+					const runtimeExecutablePath = process.execPath;
+					const services = accountsWithSecrets.map((account) => secretStore.getServiceName(account.accountId));
+					process.stdout.write("\nKeychain ACL checks:\n");
+					process.stdout.write(`  Runtime executable: ${runtimeExecutablePath}\n`);
+					const aclSpinner = p.spinner();
+					const accountWord = accountsWithSecrets.length === 1 ? "account" : "accounts";
+					aclSpinner.start(`Checking keychain ACLs for ${accountsWithSecrets.length} ${accountWord}...`);
+					const decryptAccessByService = await getKeychainDecryptAccessByServiceAsync(services);
+					aclSpinner.stop("Keychain ACL checks complete.");
+					for (const account of accountsWithSecrets) {
+						const service = secretStore.getServiceName(account.accountId);
+						const decryptAccess = decryptAccessByService.get(service);
+						const accountLabel = resolveLabel(account.accountId);
+						if (!decryptAccess || decryptAccess.mode === "missing") {
+							process.stdout.write(`  ${accountLabel}: unable to read decrypt trusted apps (service: ${service})\n`);
+							continue;
+						}
+						if (decryptAccess.mode === "all-apps") {
+							process.stdout.write(`  ${accountLabel}: decrypt access allows all apps (<null>)\n`);
+							continue;
+						}
+						const runtimeTrusted = hasRuntimeTrustedApp(decryptAccess.applications, runtimeExecutablePath);
+						const trustedAppsList = decryptAccess.applications.join(", ");
+						if (runtimeTrusted) {
+							process.stdout.write(`  ${accountLabel}: runtime is in trusted apps\n`);
+							continue;
+						}
+						process.stdout.write(`  ⚠ ${accountLabel}: runtime not found in trusted apps\n`);
+						process.stdout.write(`    Service: ${service}\n`);
+						process.stdout.write(`    Trusted apps: ${trustedAppsList || "(none)"}\n`);
+						process.stdout.write("    This secret may have been created with a different runtime/toolchain (for example node vs bun).\n");
+						process.stdout.write("    Suggested fix: run `cdx migrate-secrets` to recreate keychain entries with the current runtime ACL.\n");
+					}
+				}
+			}
+			process.stdout.write("\n");
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/help.ts
+const registerHelpCommand = (program) => {
+	program.command("help").description("Show available commands and usage information").argument("[command]", "Show help for a specific command").action((commandName) => {
+		if (commandName) {
+			const command = program.commands.find((entry) => entry.name() === commandName || entry.aliases().includes(commandName));
+			if (command) {
+				command.outputHelp();
+				return;
+			}
+			process.stderr.write(`Unknown command: ${commandName}\n`);
+			program.outputHelp();
+			process.exit(1);
+		}
+		program.outputHelp();
+	});
+};
+//#endregion
+//#region lib/commands/keyring.ts
+const APT_INSTALL_COMMAND = "sudo apt-get update && sudo apt-get install -y gnome-keyring libsecret-tools dbus-user-session xdg-utils libpam-gnome-keyring";
+const GNOME_KEYRING_CMDLINE_PATTERN = /(^|\/)gnome-keyring-daemon(\s|$)/;
+const isInteractiveTerminal = () => Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+const runCommandCapture = async (command, args) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	let stderr = "";
+	let spawnError = null;
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	child.once("error", (error) => {
+		spawnError = error.message;
+	});
+	child.once("close", (code) => {
+		resolve({
+			ok: spawnError === null && code === 0,
+			stdout: stdout.trim(),
+			stderr: stderr.trim(),
+			...spawnError ? { error: spawnError } : {}
+		});
+	});
+});
+const runCommandInherit = async (command, args) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: "inherit" });
+	child.once("error", () => resolve(1));
+	child.once("close", (code) => resolve(code ?? 1));
+});
+const extractCommandFailureDetails = (result) => result.error || result.stderr || result.stdout || void 0;
+const isCommandAvailable = async (commandName) => {
+	return (await runCommandCapture("sh", ["-lc", `command -v ${commandName} >/dev/null 2>&1`])).ok;
+};
+const parseSystemctlEnabledState = (output) => {
+	const normalized = output.trim().toLowerCase();
+	if ([
+		"enabled",
+		"enabled-runtime",
+		"static",
+		"indirect",
+		"generated"
+	].includes(normalized)) return "enabled";
+	if ([
+		"disabled",
+		"masked",
+		"not-found",
+		"linked",
+		"linked-runtime"
+	].includes(normalized)) return "disabled";
+	return "unknown";
+};
+const applyEnvAssignments = (raw) => {
+	const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	for (const line of lines) {
+		const match = line.match(/^([A-Z0-9_]+)=(.*);?$/);
+		if (!match) continue;
+		const key = match[1];
+		const value = match[2].replace(/;$/, "");
+		if (key) process.env[key] = value;
+	}
+};
+const checkGnomeKeyringRunning = async () => {
+	if (await isCommandAvailable("ps")) {
+		const psResult = await runCommandCapture("ps", [
+			"-A",
+			"-o",
+			"args="
+		]);
+		if (psResult.ok) {
+			if (psResult.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).some((line) => GNOME_KEYRING_CMDLINE_PATTERN.test(line))) return { ok: true };
+			return {
+				ok: false,
+				details: "No gnome-keyring-daemon process found."
+			};
+		}
+	}
+	if (await isCommandAvailable("pgrep")) {
+		const pgrepResult = await runCommandCapture("pgrep", ["-f", "gnome-keyring-daemon"]);
+		if (pgrepResult.ok) return { ok: true };
+		return {
+			ok: false,
+			details: extractCommandFailureDetails(pgrepResult) ?? "No gnome-keyring-daemon process found."
+		};
+	}
+	return {
+		ok: false,
+		details: "Neither ps nor pgrep is available to check gnome-keyring-daemon."
+	};
+};
+const getLinuxGnomeKeyringAutoStartStatus = async () => {
+	if (!await isCommandAvailable("systemctl")) return {
+		state: "unknown",
+		details: "systemctl is not available; autostart detection depends on your desktop/session config."
+	};
+	const units = ["gnome-keyring-daemon.socket", "gnome-keyring-daemon.service"];
+	let sawDisabled = false;
+	const details = [];
+	for (const unit of units) {
+		const result = await runCommandCapture("systemctl", [
+			"--user",
+			"is-enabled",
+			unit
+		]);
+		const state = parseSystemctlEnabledState(result.stdout || result.stderr);
+		if (state === "enabled") return {
+			state: "enabled",
+			details: `${unit} is enabled (${result.stdout || "enabled"}).`
+		};
+		if (state === "disabled") {
+			sawDisabled = true;
+			details.push(`${unit}: ${result.stdout || result.stderr || "disabled"}`);
+			continue;
+		}
+		const maybeDetail = extractCommandFailureDetails(result);
+		if (maybeDetail) details.push(`${unit}: ${maybeDetail}`);
+	}
+	if (sawDisabled) return {
+		state: "disabled",
+		details: details.join("; ")
+	};
+	return {
+		state: "unknown",
+		details: details.join("; ") || "Unable to determine gnome-keyring autostart state."
+	};
+};
+const startGnomeKeyringNow = async () => {
+	const directStart = await runCommandCapture("gnome-keyring-daemon", ["--start", "--components=secrets"]);
+	if (directStart.ok) {
+		applyEnvAssignments(directStart.stdout);
+		const runningCheck = await checkGnomeKeyringRunning();
+		if (runningCheck.ok) return { ok: true };
+		return {
+			ok: false,
+			details: runningCheck.details ?? "gnome-keyring-daemon start command succeeded, but process was not detected afterwards."
+		};
+	}
+	if (await isCommandAvailable("systemctl")) {
+		const serviceStart = await runCommandCapture("systemctl", [
+			"--user",
+			"start",
+			"gnome-keyring-daemon.service"
+		]);
+		if (serviceStart.ok) {
+			const runningCheck = await checkGnomeKeyringRunning();
+			if (runningCheck.ok) return { ok: true };
+			return {
+				ok: false,
+				details: runningCheck.details ?? "systemctl start succeeded, but gnome-keyring-daemon was not detected afterwards."
+			};
+		}
+		return {
+			ok: false,
+			details: extractCommandFailureDetails(directStart) ?? extractCommandFailureDetails(serviceStart) ?? "Failed to start gnome-keyring-daemon."
+		};
+	}
+	return {
+		ok: false,
+		details: extractCommandFailureDetails(directStart) ?? "Failed to start gnome-keyring-daemon."
+	};
+};
+const detectLinuxDistro = async () => {
+	try {
+		const pairs = (await readFile("/etc/os-release", "utf8")).split(/\r?\n/).map((line) => line.trim()).filter(Boolean).filter((line) => !line.startsWith("#")).map((line) => {
+			const idx = line.indexOf("=");
+			if (idx === -1) return null;
+			const key = line.slice(0, idx);
+			let value = line.slice(idx + 1);
+			value = value.replace(/^"|"$/g, "");
+			return {
+				key,
+				value
+			};
+		}).filter((entry) => Boolean(entry));
+		const map = new Map(pairs.map((entry) => [entry.key, entry.value]));
+		const id = (map.get("ID") ?? "unknown").toLowerCase();
+		return {
+			id,
+			idLike: (map.get("ID_LIKE") ?? "").toLowerCase().split(/\s+/).map((item) => item.trim()).filter(Boolean),
+			prettyName: map.get("PRETTY_NAME") ?? map.get("NAME") ?? id
+		};
+	} catch {
+		return {
+			id: "unknown",
+			idLike: [],
+			prettyName: "Unknown Linux"
+		};
+	}
+};
+const isDebianUbuntuMint = (distro) => {
+	if ([
+		"debian",
+		"ubuntu",
+		"linuxmint",
+		"mint"
+	].includes(distro.id)) return true;
+	return distro.idLike.some((item) => [
+		"debian",
+		"ubuntu",
+		"linuxmint",
+		"mint"
+	].includes(item));
+};
+const printChecklist = (title, items) => {
+	process.stdout.write(`${title}:\n`);
+	let passed = 0;
+	items.forEach((item, index) => {
+		if (item.ok) {
+			passed += 1;
+			process.stdout.write(`  ${index + 1}. ${item.question}: yes\n`);
+			return;
+		}
+		process.stdout.write(`  ${index + 1}. ${item.question}: no\n`);
+		if (item.details) process.stdout.write(`     details: ${item.details}\n`);
+		if (item.hint) process.stdout.write(`     hint: ${item.hint}\n`);
+	});
+	process.stdout.write(`  Summary: ${passed}/${items.length} checks passed.\n`);
+	return passed;
+};
+const runLinuxKeyringCheck = async (options = {}) => {
+	const distro = await detectLinuxDistro();
+	process.stdout.write("\nLinux keyring diagnostics:\n");
+	process.stdout.write(`  Distro: ${distro.prettyName} (id=${distro.id})\n`);
+	process.stdout.write(`  DBUS_SESSION_BUS_ADDRESS: ${process.env.DBUS_SESSION_BUS_ADDRESS ?? "<unset>"}\n`);
+	process.stdout.write(`  XDG_RUNTIME_DIR: ${process.env.XDG_RUNTIME_DIR ?? "<unset>"}\n`);
+	const gnomeKeyringInstalled = await isCommandAvailable("gnome-keyring-daemon");
+	const secretToolInstalled = await isCommandAvailable("secret-tool");
+	const xdgOpenInstalled = await isCommandAvailable("xdg-open");
+	const dbusSendInstalled = await isCommandAvailable("dbus-send");
+	const running = await checkGnomeKeyringRunning();
+	const autostart = await getLinuxGnomeKeyringAutoStartStatus();
+	const checklistPassed = printChecklist("\nDependency and runtime checks", [
+		{
+			question: "gnome-keyring-daemon installed",
+			ok: gnomeKeyringInstalled,
+			hint: "Install package: gnome-keyring"
+		},
+		{
+			question: "secret-tool installed",
+			ok: secretToolInstalled,
+			hint: "Install package: libsecret-tools"
+		},
+		{
+			question: "dbus-send installed",
+			ok: dbusSendInstalled,
+			hint: "Install package: dbus"
+		},
+		{
+			question: "xdg-open installed",
+			ok: xdgOpenInstalled,
+			hint: "Install package: xdg-utils"
+		},
+		{
+			question: "gnome-keyring-daemon running",
+			ok: running.ok,
+			details: running.details,
+			hint: "Start daemon: gnome-keyring-daemon --start --components=secrets"
+		}
+	]);
+	process.stdout.write("\nAutostart status:\n");
+	process.stdout.write(`  gnome-keyring autostart: ${autostart.state}`);
+	if (autostart.details) process.stdout.write(` (${autostart.details})`);
+	process.stdout.write("\n");
+	if (options.allowInteractiveStart !== false && isInteractiveTerminal() && gnomeKeyringInstalled && !running.ok) {
+		const shouldStart = await p.confirm({
+			message: "gnome-keyring-daemon is not running. Start it now for this session?",
+			initialValue: true
+		});
+		if (!p.isCancel(shouldStart) && shouldStart) {
+			const started = await startGnomeKeyringNow();
+			if (started.ok) process.stdout.write("  Started gnome-keyring-daemon for this session.\n");
+			else process.stdout.write(`  Failed to start gnome-keyring-daemon (${started.details ?? "unknown error"}).\n`);
+		}
+	}
+	process.stdout.write("\nSecret-store write/read/delete probe:\n");
+	const probeResult = await runSecretStoreWriteReadProbe(createRuntimeSecretStoreAdapter("linux"));
+	if (probeResult.ok) process.stdout.write("  write/read/delete probe: OK\n");
+	else {
+		process.stdout.write(`  ${probeResult.stage} failed: ${probeResult.error.message}\n`);
+		process.stdout.write("  Suggested fix: ensure Secret Service is running and unlocked (gnome-keyring + secret-tool), then run `cdx keyring check` again.\n");
+	}
+	const checksOk = checklistPassed === 5 && probeResult.ok;
+	process.stdout.write(`\nResult: ${checksOk ? "OK" : "NOT READY"}\n\n`);
+	return checksOk;
+};
+const runLinuxKeyringInstall = async (options) => {
+	const distro = await detectLinuxDistro();
+	process.stdout.write("\nLinux keyring setup:\n");
+	process.stdout.write(`  Distro: ${distro.prettyName} (id=${distro.id})\n`);
+	if (!isDebianUbuntuMint(distro)) {
+		process.stdout.write("\nAutomatic install is currently only implemented for Debian/Ubuntu/Mint.\n");
+		process.stdout.write("Install these packages manually, then run `cdx keyring check`:\n");
+		process.stdout.write("  - gnome-keyring\n");
+		process.stdout.write("  - libsecret-tools\n");
+		process.stdout.write("  - dbus-user-session\n");
+		process.stdout.write("  - xdg-utils\n");
+		process.stdout.write("  - libpam-gnome-keyring (optional, for PAM auto-unlock)\n\n");
+		return;
+	}
+	process.stdout.write("\nInstall command:\n");
+	process.stdout.write(`  ${APT_INSTALL_COMMAND}\n`);
+	let shouldRun = true;
+	if (!options.yes) {
+		if (!isInteractiveTerminal()) {
+			process.stdout.write("\nNon-interactive terminal detected. Re-run with --yes to execute install automatically.\n\n");
+			return;
+		}
+		const confirmed = await p.confirm({
+			message: "Run this install command now?",
+			initialValue: true
+		});
+		shouldRun = !p.isCancel(confirmed) && confirmed;
+	}
+	if (!shouldRun) {
+		process.stdout.write("\nInstall skipped.\n\n");
+		return;
+	}
+	const exitCode = await runCommandInherit("sh", ["-lc", APT_INSTALL_COMMAND]);
+	if (exitCode !== 0) throw new Error(`Install command failed with exit code ${exitCode}.`);
+	process.stdout.write("\nInstall completed.\n");
+	if (!options.skipCheck) {
+		if (!await runLinuxKeyringCheck({ allowInteractiveStart: true })) process.exitCode = 1;
+	} else process.stdout.write("Run `cdx keyring check` to verify setup.\n\n");
+};
+const registerKeyringCommand = (program) => {
+	const keyring = program.command("keyring").description("Setup and diagnose Linux gnome-keyring/Secret Service support");
+	keyring.command("check").description("Run focused Linux keyring dependency and probe checks").action(async () => {
+		try {
+			if (process.platform !== "linux") {
+				process.stdout.write("This command currently targets Linux only.\n\n");
+				return;
+			}
+			if (!await runLinuxKeyringCheck({ allowInteractiveStart: true })) process.exitCode = 1;
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+	keyring.command("install").description("Install gnome-keyring dependencies on Debian/Ubuntu/Mint").option("--yes", "Run installation without interactive confirmation").option("--skip-check", "Skip automatic post-install verification").action(async (options) => {
+		try {
+			if (process.platform !== "linux") {
+				process.stdout.write("This command currently targets Linux only.\n\n");
+				return;
+			}
+			await runLinuxKeyringInstall(options);
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/label.ts
+const registerLabelCommand = (program) => {
+	program.command("label").description("Add or change label for an account").argument("[account]", "Account ID or current label to relabel").argument("[new-label]", "New label to assign").action(async (account, newLabel) => {
+		try {
+			if (account && newLabel) {
+				const config = await loadConfig();
+				const target = config.accounts.find((entry) => entry.accountId === account || entry.label === account);
+				if (!target) throw new Error(`Account "${account}" not found. Use 'cdx login' to add it.`);
+				target.label = newLabel;
+				await saveConfig(config);
+				process.stdout.write(`Account ${target.accountId} labeled as "${newLabel}".\n`);
+				return;
+			}
+			await handleLabelAccount();
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/login.ts
+const registerLoginCommand = (program, deps = {}) => {
+	const runLogin = deps.performLogin ?? performLogin;
+	program.command("login").description("Add a new OpenAI account via OAuth").option("--device-flow", "Use OAuth device flow instead of browser callback flow (manual/browser flow is recommended; device flow may fail on some VPS due to Cloudflare)").action(async (options) => {
+		try {
+			if (!await runLogin({ authFlow: options.deviceFlow ? "device" : "auto" })) {
+				process.stderr.write("Login failed.\n");
+				process.exit(1);
+			}
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/secrets/migrate.ts
+const asErrorMessage = (error) => error instanceof Error ? error.message : String(error);
+const migrateLegacyMacOSSecrets = async (options = {}) => {
+	if ((options.platform ?? process.platform) !== "darwin") throw new Error("'migrate-secrets' is only available on macOS (darwin).");
+	const loadConfigFn = options.loadConfigFn ?? loadConfig;
+	const saveConfigFn = options.saveConfigFn ?? saveConfig;
+	const sourceAdapter = options.sourceAdapter ?? createMacOSLegacyKeychainAdapter();
+	const targetAdapter = options.targetAdapter ?? createRuntimeSecretStoreAdapter("darwin");
+	const config = await loadConfigFn();
+	const accountResults = [];
+	for (const account of config.accounts) {
+		const accountId = account.accountId;
+		try {
+			if (!await sourceAdapter.exists(accountId)) {
+				accountResults.push({
+					accountId,
+					label: account.label,
+					status: "skipped",
+					message: "No legacy keychain entry found."
+				});
+				continue;
+			}
+			const loaded = await sourceAdapter.load(accountId);
+			const payload = loaded.accountId === accountId ? loaded : {
+				...loaded,
+				accountId
+			};
+			await sourceAdapter.delete(accountId);
+			try {
+				await targetAdapter.save(accountId, payload);
+			} catch (error) {
+				try {
+					await sourceAdapter.save(accountId, payload);
+				} catch {}
+				throw error;
+			}
+			accountResults.push({
+				accountId,
+				label: account.label,
+				status: "migrated",
+				message: "Legacy entry migrated to cross-keychain backend."
+			});
+		} catch (error) {
+			accountResults.push({
+				accountId,
+				label: account.label,
+				status: "failed",
+				message: asErrorMessage(error)
+			});
+		}
+	}
+	const failed = accountResults.filter((entry) => entry.status === "failed").length;
+	const skipped = accountResults.filter((entry) => entry.status === "skipped").length;
+	const migrated = accountResults.filter((entry) => entry.status === "migrated").length;
+	let configUpdated = false;
+	if (failed === 0) {
+		let changed = false;
+		for (const account of config.accounts) {
+			const expectedService = targetAdapter.getServiceName(account.accountId);
+			if (account.keychainService !== expectedService) {
+				account.keychainService = expectedService;
+				changed = true;
+			}
+		}
+		if (config.secretStore !== "auto") {
+			config.secretStore = "auto";
+			changed = true;
+		}
+		if (changed) {
+			await saveConfigFn(config);
+			configUpdated = true;
+		}
+	}
+	return {
+		migrated,
+		skipped,
+		failed,
+		configUpdated,
+		accountResults
+	};
+};
+//#endregion
+//#region lib/commands/migrate-secrets.ts
+const statusPrefix = (result) => {
+	if (result.status === "migrated") return "✓";
+	if (result.status === "skipped") return "-";
+	return "✗";
+};
+const formatName = (result) => result.label ? `${result.label} (${result.accountId})` : result.accountId;
+const registerMigrateSecretsCommand = (program) => {
+	program.command("migrate-secrets").description("Migrate macOS legacy keychain entries to cross-keychain and update config").action(async () => {
+		try {
+			const result = await migrateLegacyMacOSSecrets();
+			process.stdout.write("\nSecret migration results:\n");
+			for (const accountResult of result.accountResults) process.stdout.write(`  ${statusPrefix(accountResult)} ${formatName(accountResult)}: ${accountResult.message}\n`);
+			process.stdout.write("\nSummary:\n");
+			process.stdout.write(`  Migrated: ${result.migrated}\n`);
+			process.stdout.write(`  Skipped:  ${result.skipped}\n`);
+			process.stdout.write(`  Failed:   ${result.failed}\n`);
+			if (result.failed === 0) {
+				process.stdout.write(result.configUpdated ? "  Config:   updated (secretStore=auto, service names normalized)\n\n" : "  Config:   already up to date\n\n");
+				return;
+			}
+			process.stdout.write("  Config:   not updated because at least one account failed\n\n");
+			throw new Error(`Migration finished with ${result.failed} failed account(s). Resolve them and run 'cdx migrate-secrets' again.`);
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/output.ts
+const formatCodexMark = (result) => {
+	if (result.codexWritten) return "✓";
+	if (result.codexCleared) return "⚠ missing id_token (cleared)";
+	return "⚠ missing id_token";
+};
+const writeSwitchSummary = (displayName, result) => {
+	const piMark = result.piWritten ? "✓" : "✗";
+	const codexMark = formatCodexMark(result);
+	process.stdout.write(`Switched to account ${displayName}\n`);
+	process.stdout.write("  OpenCode:  ✓\n");
+	process.stdout.write(`  Pi Agent:  ${piMark}\n`);
+	process.stdout.write(`  Codex CLI: ${codexMark}\n`);
+};
+const writeUpdatedAuthSummary = (result) => {
+	const piMark = result.piWritten ? "✓" : "✗";
+	const codexMark = formatCodexMark(result);
+	process.stdout.write("Updated active auth files:\n");
+	process.stdout.write("  OpenCode:  ✓\n");
+	process.stdout.write(`  Pi Agent:  ${piMark}\n`);
+	process.stdout.write(`  Codex CLI: ${codexMark}\n`);
+};
+//#endregion
+//#region lib/commands/refresh.ts
+const registerReloginCommand = (program) => {
+	program.command("relogin").description("Re-authenticate an existing account with full OAuth login (no duplicate account)").option("--device-flow", "Use OAuth device flow instead of browser callback flow (manual/browser flow is recommended; device flow may fail on some VPS due to Cloudflare)").argument("[account]", "Account ID or label to re-login").action(async (account, options) => {
+		try {
+			const authFlow = options.deviceFlow ? "device" : "auto";
+			if (account) {
+				const target = (await loadConfig()).accounts.find((entry) => entry.accountId === account || entry.label === account);
+				if (!target) throw new Error(`Account "${account}" not found. Use 'cdx login' to add it.`);
+				const displayName = target.label ?? target.accountId;
+				let expiryState = "unknown";
+				let secureStoreState = "";
+				const secretStore = getSecretStoreAdapter();
+				if (await secretStore.exists(target.accountId)) try {
+					expiryState = formatExpiry((await secretStore.load(target.accountId)).expires);
+				} catch {
+					expiryState = "unknown";
+				}
+				else secureStoreState = " [no secure store entry]";
+				process.stdout.write(`Current token status for ${displayName}: ${expiryState}${secureStoreState}\n`);
+				const result = await performRefresh(target.accountId, target.label, { authFlow });
+				if (!result) {
+					process.stderr.write("Re-login failed.\n");
+					process.exit(1);
+				}
+				const authResult = await writeActiveAuthFilesIfCurrent(result.accountId);
+				if (authResult) writeUpdatedAuthSummary(authResult);
+				return;
+			}
+			await handleReloginAccount({ authFlow });
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/usage.ts
+const USAGE_ENDPOINT = "https://chatgpt.com/backend-api/wham/usage";
+const USER_AGENT = "cdx-cli";
+/**
+* Hits the undocumented OpenAI usage endpoint (may change without notice).
+*/
+const fetchUsageRaw = async (accessToken, accountId) => {
+	const headers = {
+		Authorization: `Bearer ${accessToken}`,
+		"User-Agent": USER_AGENT,
+		Accept: "application/json"
+	};
+	if (accountId) headers["ChatGPT-Account-Id"] = accountId;
+	return fetch(USAGE_ENDPOINT, { headers });
+};
+/**
+* Fetches usage for an account. On 401, refreshes the token and retries once.
+*/
+const fetchUsage = async (accountId) => {
+	const secretStore = getSecretStoreAdapter();
+	let payload;
+	try {
+		payload = await secretStore.load(accountId);
+	} catch (err) {
+		return {
+			ok: false,
+			error: {
+				type: "auth_failed",
+				message: err instanceof Error ? err.message : "Failed to load credentials"
+			}
+		};
+	}
+	try {
+		let response = await fetchUsageRaw(payload.access, payload.accountId);
+		if (response.status === 401) {
+			const refreshResult = await refreshAccessToken(payload.refresh);
+			if (refreshResult.type === "failed") return {
+				ok: false,
+				error: {
+					type: "auth_failed",
+					message: "Token expired and refresh failed. Try 'cdx login' to re-authenticate."
+				}
+			};
+			const updatedPayload = {
+				...payload,
+				access: refreshResult.access,
+				refresh: refreshResult.refresh,
+				expires: refreshResult.expires,
+				idToken: refreshResult.idToken ?? payload.idToken
+			};
+			await secretStore.save(accountId, updatedPayload);
+			response = await fetchUsageRaw(updatedPayload.access, updatedPayload.accountId);
+			if (!response.ok) return {
+				ok: false,
+				error: {
+					type: "auth_failed",
+					message: `Usage API returned ${response.status} after token refresh.`
+				}
+			};
+		} else if (!response.ok) return {
+			ok: false,
+			error: {
+				type: "unexpected",
+				message: `Usage API returned ${response.status}: ${response.statusText}`
+			}
+		};
+		return {
+			ok: true,
+			data: await response.json()
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: {
+				type: "network_error",
+				message: err instanceof Error ? err.message : "Network request failed"
+			}
+		};
+	}
+};
+const formatWindowLabel = (seconds) => {
+	const hours = seconds / 3600;
+	if (hours >= 24) {
+		const days = Math.round(hours / 24);
+		return days === 7 ? "weekly" : `${days}d`;
+	}
+	return `${Math.round(hours)}h`;
+};
+const formatResetCountdown = (resetAtUnix) => {
+	const diff = resetAtUnix * 1e3 - Date.now();
+	if (diff <= 0) return "now";
+	const minutes = Math.floor(diff / 6e4);
+	const hours = Math.floor(minutes / 60);
+	const remainingMinutes = minutes % 60;
+	if (hours > 0) return remainingMinutes > 0 ? `${hours}h ${remainingMinutes}m` : `${hours}h`;
+	return `${minutes}m`;
+};
+const formatPercentageBar = (usedPercent) => {
+	const width = 20;
+	const filled = Math.round(usedPercent / 100 * width);
+	const empty = width - filled;
+	return `[${"█".repeat(filled)}${"░".repeat(empty)}] ${usedPercent}% used`;
+};
+const formatWindow = (label, w) => {
+	return [
+		`${label} (${formatWindowLabel(w.limit_window_seconds)} window):`,
+		`  ${formatPercentageBar(w.used_percent)}`,
+		`  Resets in: ${formatResetCountdown(w.reset_at)}`
+	];
+};
+const formatUsage = (usage) => {
+	const lines = [];
+	const plan = usage.plan_type ?? "unknown";
+	lines.push(`Plan: ${plan}`);
+	lines.push("");
+	if (usage.rate_limit?.primary_window) lines.push(...formatWindow("Primary", usage.rate_limit.primary_window));
+	if (usage.rate_limit?.secondary_window) lines.push(...formatWindow("Secondary", usage.rate_limit.secondary_window));
+	if (usage.credits) {
+		lines.push("");
+		if (usage.credits.unlimited) lines.push("Credits: unlimited");
+		else if (usage.credits.has_credits && usage.credits.balance !== void 0) lines.push(`Credits: $${Number(usage.credits.balance).toFixed(2)}`);
+		else if (!usage.credits.has_credits) lines.push("Credits: none");
+	}
+	return lines.join("\n");
+};
+const formatUsageBars = (usage, indent = "    ") => {
+	const windows = [];
+	if (usage.rate_limit?.primary_window) windows.push({
+		label: formatWindowLabel(usage.rate_limit.primary_window.limit_window_seconds),
+		window: usage.rate_limit.primary_window
+	});
+	if (usage.rate_limit?.secondary_window) windows.push({
+		label: formatWindowLabel(usage.rate_limit.secondary_window.limit_window_seconds),
+		window: usage.rate_limit.secondary_window
+	});
+	const maxLabelLen = Math.max(...windows.map((w) => w.label.length), 0);
+	return windows.map(({ label, window: w }) => {
+		return `${indent}${label.padEnd(maxLabelLen)}  ${formatPercentageBar(w.used_percent)}  resets in ${formatResetCountdown(w.reset_at)}`;
+	});
+};
+const formatUsageOverview = (entries) => {
+	const lines = [];
+	for (let i = 0; i < entries.length; i++) {
+		const entry = entries[i];
+		const marker = entry.isCurrent ? "→ " : "  ";
+		if (entry.result.ok) {
+			const usage = entry.result.data;
+			const plan = usage.plan_type ?? "unknown";
+			lines.push(`${marker}${entry.displayName} (${plan})`);
+			lines.push(...formatUsageBars(usage));
+		} else lines.push(`${marker}${entry.displayName}: [error] ${entry.result.error.message}`);
+		if (i < entries.length - 1) lines.push("");
+	}
+	return lines.join("\n");
+};
+//#endregion
+//#region lib/commands/status.ts
+const registerStatusCommand = (program) => {
+	program.command("status").description("Show account status, token expiry, and usage").action(async () => {
+		try {
+			const status = await getStatus();
+			if (status.accounts.length === 0) {
+				process.stdout.write("No accounts configured. Use 'cdx login' to add one.\n");
+				return;
+			}
+			process.stdout.write("\n");
+			for (let i = 0; i < status.accounts.length; i++) {
+				const account = status.accounts[i];
+				const marker = account.isCurrent ? "→ " : "  ";
+				const warnings = [];
+				if (!account.secureStoreExists) warnings.push("[no secure store entry]");
+				if (!account.hasIdToken) warnings.push("[no id_token]");
+				const warnStr = warnings.length > 0 ? `  ${warnings.join(" ")}` : "";
+				const displayName = account.label ?? account.accountId;
+				process.stdout.write(`${marker}${displayName}${warnStr}\n`);
+				if (account.label) process.stdout.write(`    ${account.accountId}\n`);
+				process.stdout.write(`    ${account.expiresIn}\n`);
+				if (i < status.accounts.length - 1) process.stdout.write("\n");
+			}
+			const usageSpinner = p.spinner();
+			const accountWord = status.accounts.length === 1 ? "account" : "accounts";
+			usageSpinner.start(`Fetching usage for ${status.accounts.length} ${accountWord}...`);
+			const usageResults = await Promise.allSettled(status.accounts.map((account) => fetchUsage(account.accountId)));
+			const failedUsageCount = usageResults.filter((result) => result.status === "rejected" || result.status === "fulfilled" && !result.value.ok).length;
+			if (failedUsageCount === 0) usageSpinner.stop("Usage loaded.");
+			else {
+				const failedWord = failedUsageCount === 1 ? "account" : "accounts";
+				usageSpinner.stop(`Usage loaded (${failedUsageCount} ${failedWord} failed).`);
+			}
+			process.stdout.write("\nUsage:\n");
+			for (let i = 0; i < status.accounts.length; i++) {
+				const account = status.accounts[i];
+				const marker = account.isCurrent ? "→ " : "  ";
+				const displayName = account.label ?? account.accountId;
+				process.stdout.write(`${marker}${displayName}\n`);
+				if (account.label) process.stdout.write(`    ${account.accountId}\n`);
+				const usageResult = usageResults[i];
+				if (usageResult.status === "rejected") {
+					const message = usageResult.reason instanceof Error ? usageResult.reason.message : "Fetch failed";
+					process.stdout.write(`    [usage unavailable] ${message}\n`);
+				} else if (usageResult.value.ok) {
+					const bars = formatUsageBars(usageResult.value.data);
+					if (bars.length === 0) process.stdout.write("    Usage data unavailable\n");
+					for (const bar of bars) process.stdout.write(`${bar}\n`);
+				} else process.stdout.write(`    [usage unavailable] ${usageResult.value.error.message}\n`);
+				if (i < status.accounts.length - 1) process.stdout.write("\n");
+			}
+			process.stdout.write("\n");
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/switch.ts
+const switchNext = async () => {
+	const config = await loadConfig();
+	const nextIndex = (config.current + 1) % config.accounts.length;
+	const nextAccount = config.accounts[nextIndex];
+	if (!nextAccount?.accountId) throw new Error("Account entry missing accountId.");
+	const payload = await getSecretStoreAdapter().load(nextAccount.accountId);
+	const result = await writeAllAuthFiles(payload);
+	config.current = nextIndex;
+	await saveConfig(config);
+	writeSwitchSummary(nextAccount.label ?? payload.accountId, result);
+};
+const switchToAccount = async (identifier) => {
+	const config = await loadConfig();
+	const index = config.accounts.findIndex((account) => account.accountId === identifier || account.label === identifier);
+	if (index === -1) throw new Error(`Account "${identifier}" not found. Use 'cdx login' to add it.`);
+	const account = config.accounts[index];
+	const result = await writeAllAuthFiles(await getSecretStoreAdapter().load(account.accountId));
+	config.current = index;
+	await saveConfig(config);
+	writeSwitchSummary(account.label ?? account.accountId, result);
+};
+const registerSwitchCommand = (program) => {
+	program.command("switch").description("Switch OpenAI account (interactive picker, by name, or --next)").argument("[account-id]", "Account ID to switch to directly").option("-n, --next", "Cycle to the next configured account").action(async (accountId, options) => {
+		try {
+			if (options.next) await switchNext();
+			else if (accountId) await switchToAccount(accountId);
+			else await handleSwitchAccount();
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/usage.ts
+const registerUsageCommand = (program) => {
+	program.command("usage").description("Show OpenAI usage for all accounts (or detailed view for one)").argument("[account]", "Account ID or label (shows detailed single-account view)").action(async (account) => {
+		try {
+			const config = await loadConfig();
+			if (account) {
+				const found = config.accounts.find((entry) => entry.accountId === account || entry.label === account);
+				if (!found) throw new Error(`Account "${account}" not found. Use 'cdx login' to add it.`);
+				const result = await fetchUsage(found.accountId);
+				if (!result.ok) throw new Error(result.error.message);
+				const displayName = found.label ? `${found.label} (${found.accountId})` : found.accountId;
+				process.stdout.write(`\n${displayName}\n${formatUsage(result.data)}\n\n`);
+				return;
+			}
+			if (config.accounts.length === 0) throw new Error("No accounts configured. Use 'cdx login' to add one.");
+			const results = await Promise.allSettled(config.accounts.map((entry) => fetchUsage(entry.accountId)));
+			const entries = config.accounts.map((entry, index) => {
+				const settled = results[index];
+				const displayName = entry.label ? `${entry.label} (${entry.accountId})` : entry.accountId;
+				const result = settled.status === "fulfilled" ? settled.value : {
+					ok: false,
+					error: {
+						type: "network_error",
+						message: settled.reason?.message ?? "Fetch failed"
+					}
+				};
+				return {
+					displayName,
+					isCurrent: index === config.current,
+					result
+				};
+			});
+			process.stdout.write(`\n${formatUsageOverview(entries)}\n\n`);
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/runtime/update-manager.ts
+const detectRuntime = (input = {}) => {
+	const hasDenoGlobal = input.hasDenoGlobal ?? ("Deno" in globalThis && typeof globalThis.Deno !== "undefined");
+	const versions = input.versions ?? process.versions;
+	if (hasDenoGlobal) return "deno";
+	if (typeof versions.bun === "string" && versions.bun.length > 0) return "bun";
+	if (typeof versions.node === "string" && versions.node.length > 0) return "node";
+	return "unknown";
+};
+const normalizePath = (value) => value.replaceAll("\\", "/").toLowerCase();
+const detectInstallManagerFromPath = (executablePath) => {
+	if (!executablePath) return "unknown";
+	const normalizedPath = normalizePath(executablePath);
+	if (normalizedPath.includes("/.bun/install/global/node_modules/")) return "bun";
+	if (normalizedPath.includes("/lib/node_modules/") || normalizedPath.includes("/npm/node_modules/")) return "npm";
+	if (normalizedPath.includes("/.deno/") || normalizedPath.includes("/deno/bin/")) return "deno";
+	return "unknown";
+};
+const classifyInstallContextFromPath = (executablePath) => {
+	if (!executablePath) return "unknown";
+	if (detectInstallManagerFromPath(executablePath) !== "unknown") return "global";
+	const normalizedPath = normalizePath(executablePath);
+	if (normalizedPath.endsWith("/cdx.ts") || normalizedPath.includes("/codex-switcher/") || normalizedPath.includes("/node_modules/.bin/")) return "local-or-dev";
+	return "unknown";
+};
+const resolveFromRuntime = (runtime) => {
+	if (runtime === "bun") return "bun";
+	if (runtime === "node") return "npm";
+	if (runtime === "deno") return "deno";
+	return null;
+};
+const resolveUpdateManager = (input) => {
+	if (input.requestedManager !== "auto") return {
+		ok: true,
+		manager: input.requestedManager,
+		source: "explicit"
+	};
+	if (input.installManager !== "unknown") return {
+		ok: true,
+		manager: input.installManager,
+		source: "install-manager"
+	};
+	const fromRuntime = resolveFromRuntime(input.runtime);
+	if (fromRuntime) return {
+		ok: true,
+		manager: fromRuntime,
+		source: "runtime"
+	};
+	return { ok: false };
+};
+const buildUpdateInstallCommand = (manager, packageName) => {
+	if (manager === "bun") return {
+		command: "bun",
+		args: [
+			"add",
+			"-g",
+			`${packageName}@latest`
+		]
+	};
+	if (manager === "npm") return {
+		command: "npm",
+		args: [
+			"i",
+			"-g",
+			`${packageName}@latest`
+		]
+	};
+	return {
+		command: "deno",
+		args: [
+			"install",
+			"-g",
+			"-f",
+			"-A",
+			"-n",
+			"cdx",
+			`npm:${packageName}@latest`
+		]
+	};
+};
+//#endregion
+//#region lib/commands/update-self.ts
+const PACKAGE_NAME = "@bjesuiter/codex-switcher";
+const quoteIfNeeded = (value) => {
+	if (value.includes(" ")) return JSON.stringify(value);
+	return value;
+};
+const formatShellCommand = (command, args) => [command, ...args].map(quoteIfNeeded).join(" ");
+const executeUpdate = async (command, args) => {
+	await new Promise((resolve, reject) => {
+		const child = spawn(command, args, { stdio: "inherit" });
+		child.once("error", (error) => {
+			reject(error);
+		});
+		child.once("close", (code) => {
+			if (code === 0) {
+				resolve();
+				return;
+			}
+			reject(/* @__PURE__ */ new Error(`Update command failed with exit code ${code ?? "unknown"}.`));
+		});
+	});
+};
+const executeCapture = async (command, args) => await new Promise((resolve) => {
+	const child = spawn(command, args, { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	let stdout = "";
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+	});
+	child.once("error", () => {
+		resolve({
+			ok: false,
+			output: ""
+		});
+	});
+	child.once("close", (code) => {
+		resolve({
+			ok: code === 0,
+			output: stdout.trim()
+		});
+	});
+});
+const getInstalledCdxVersion = async () => {
+	const attempts = [{
+		command: "cdx",
+		args: ["--version"]
+	}];
+	if (process.argv[0] && process.argv[1]) attempts.push({
+		command: process.argv[0],
+		args: [process.argv[1], "--version"]
+	});
+	for (const attempt of attempts) {
+		const result = await executeCapture(attempt.command, attempt.args);
+		if (!result.ok || !result.output) continue;
+		const version = result.output.split(/\r?\n/).at(-1)?.trim();
+		if (version) return version;
+	}
+	return null;
+};
+const registerUpdateSelfCommand = (program) => {
+	program.command("update-self").aliases([
+		"self-update",
+		"update",
+		"updte"
+	]).description("Update cdx to the latest version").option("--manager <manager>", "Select update manager (auto|bun|npm|deno)", "auto").option("--dry-run", "Print selected manager and update command without executing").option("-y, --yes", "Skip confirmation prompt").action(async (options) => {
+		try {
+			const requestedManager = options.manager ?? "auto";
+			if (![
+				"auto",
+				"bun",
+				"npm",
+				"deno"
+			].includes(requestedManager)) {
+				process.stderr.write(`Invalid value '${requestedManager}' for --manager. Allowed values: auto, bun, npm, deno.\n`);
+				process.exit(1);
+			}
+			const runtime = detectRuntime();
+			const executablePath = process.argv[1];
+			const installManager = detectInstallManagerFromPath(executablePath);
+			const installContext = classifyInstallContextFromPath(executablePath);
+			if (requestedManager === "auto" && installManager === "unknown" && installContext === "local-or-dev") {
+				process.stderr.write("Refusing to auto-update from a local/dev checkout. Re-run with --manager bun|npm|deno.\n");
+				process.exit(1);
+			}
+			const resolvedManager = resolveUpdateManager({
+				requestedManager,
+				runtime,
+				installManager
+			});
+			process.stdout.write(`Runtime: ${runtime}\n`);
+			process.stdout.write(`Detected install manager: ${installManager}\n`);
+			if (!resolvedManager.ok) {
+				process.stderr.write("Could not determine update manager automatically. Re-run with --manager bun|npm|deno.\n");
+				process.stderr.write("Manual update commands:\n");
+				process.stderr.write(`  bun: ${formatShellCommand("bun", [
+					"add",
+					"-g",
+					`${PACKAGE_NAME}@latest`
+				])}\n`);
+				process.stderr.write(`  npm: ${formatShellCommand("npm", [
+					"i",
+					"-g",
+					`${PACKAGE_NAME}@latest`
+				])}\n`);
+				process.stderr.write(`  deno: ${formatShellCommand("deno", [
+					"install",
+					"-g",
+					"-f",
+					"-A",
+					"-n",
+					"cdx",
+					`npm:${PACKAGE_NAME}@latest`
+				])}\n`);
+				process.exit(1);
+			}
+			const selectedManager = resolvedManager.manager;
+			const command = buildUpdateInstallCommand(selectedManager, PACKAGE_NAME);
+			const printableCommand = formatShellCommand(command.command, command.args);
+			process.stdout.write(`Selected manager: ${selectedManager}\n`);
+			process.stdout.write(`Source: ${resolvedManager.source}\n`);
+			process.stdout.write(`Command: ${printableCommand}\n`);
+			if (options.dryRun) return;
+			if (!options.yes) {
+				const confirmed = await p.confirm({
+					message: `Run update command now?\n${printableCommand}`,
+					initialValue: true
+				});
+				if (p.isCancel(confirmed) || !confirmed) {
+					process.stderr.write("Update cancelled.\n");
+					process.exit(1);
+				}
+			}
+			await executeUpdate(command.command, command.args);
+			const installedVersion = await getInstalledCdxVersion();
+			process.stdout.write("Update completed.\n");
+			process.stdout.write(`Installed version: ${installedVersion ?? "unknown"}\n`);
+		} catch (error) {
+			exitWithCommandError(error);
+		}
+	});
+};
+//#endregion
+//#region lib/commands/version.ts
+const registerVersionCommand = (program, version) => {
+	program.command("version").description("Show CLI version").action(() => {
+		process.stdout.write(`${version}\n`);
+	});
+};
+//#endregion
+//#region cdx.ts
+const interactiveMode = runInteractiveMode;
+const parseSecretStoreSelection = (value) => {
+	if (value === "auto" || value === "legacy-keychain") return value;
+	throw new InvalidArgumentError(`Invalid value '${value}' for --secret-store. Allowed values: auto, legacy-keychain.`);
+};
+const getCompletionParseArgs = (argv) => {
+	const completeIndex = argv.findIndex((arg) => arg === "complete");
+	if (completeIndex === -1) return null;
+	const separatorIndex = argv.findIndex((arg) => arg === "--");
+	if (separatorIndex === -1 || separatorIndex <= completeIndex) return null;
+	return argv.slice(separatorIndex + 1);
+};
+const readCompletionAccounts = () => {
+	try {
+		const { configPath } = getPaths();
+		if (!existsSync(configPath)) return [];
+		const raw = readFileSync(configPath, "utf8");
+		const parsed = JSON.parse(raw);
+		if (!Array.isArray(parsed.accounts)) return [];
+		const accounts = [];
+		for (const account of parsed.accounts) {
+			if (typeof account.accountId !== "string" || !account.accountId.trim()) continue;
+			accounts.push({
+				accountId: account.accountId,
+				...typeof account.label === "string" && account.label.trim() ? { label: account.label } : {}
+			});
+		}
+		return accounts;
+	} catch {
+		return [];
+	}
+};
+const addConfiguredAccountCompletions = (complete) => {
+	const accounts = readCompletionAccounts();
+	const seen = /* @__PURE__ */ new Set();
+	for (const account of accounts) {
+		if (!seen.has(account.accountId)) {
+			seen.add(account.accountId);
+			const description = account.label ? `Account ID (${account.label})` : "Account ID";
+			complete(account.accountId, description);
+		}
+		if (account.label && !seen.has(account.label)) {
+			seen.add(account.label);
+			complete(account.label, `Label for ${account.accountId}`);
+		}
+	}
+};
+const attachAccountArgumentCompletion = (completion, commandName, argumentName) => {
+	const command = completion.commands.get(commandName);
+	if (!command) return;
+	command.argument(argumentName, (complete) => {
+		addConfiguredAccountCompletions(complete);
+	});
+};
+const configureTabCompletion = (completion) => {
+	const secretStoreOption = completion.options.get("secret-store");
+	if (secretStoreOption) secretStoreOption.handler = (complete) => {
+		complete("auto", "Automatic backend selection");
+		complete("legacy-keychain", "macOS legacy keychain backend");
+	};
+	attachAccountArgumentCompletion(completion, "switch", "account-id");
+	attachAccountArgumentCompletion(completion, "relogin", "account");
+	attachAccountArgumentCompletion(completion, "usage", "account");
+	attachAccountArgumentCompletion(completion, "label", "account");
+	const helpCommand = completion.commands.get("help");
+	if (helpCommand) helpCommand.argument("command", (complete) => {
+		for (const [name, command] of completion.commands.entries()) {
+			if (name === "") continue;
+			complete(name, command.description || "Command");
+		}
+	});
+};
+const getMacOSKeychainPromptWarning = (selection, platform = process.platform, backendId = null) => {
+	if (platform !== "darwin") return null;
+	if (selection === "legacy-keychain") return "⚠ macOS keychain is using the legacy security CLI backend. Touch ID may not be offered for keychain prompts.";
+	if (selection === "auto" && backendId === "macos") return "⚠ macOS keychain is using the cross-keychain CLI fallback (`security`). Touch ID may not be offered for keychain prompts.";
+	return null;
+};
+const maybeWarnAboutMacOSKeychainPromptMode = async (selection) => {
+	let backendId = null;
+	if (selection === "auto" && process.platform === "darwin") try {
+		backendId = await resolveMacOSCrossKeychainBackendId();
+	} catch {
+		backendId = null;
+	}
+	const warning = getMacOSKeychainPromptWarning(selection, process.platform, backendId);
+	if (warning) process.stderr.write(`${warning}\n`);
+};
+const createProgram = (deps = {}) => {
+	const program = new Command();
+	program.name("cdx").description("OpenAI account switcher - manage multiple OpenAI Pro subscriptions").version(version, "-v, --version").option("--secret-store <mode>", "Select secret-store backend (auto|legacy-keychain)", parseSecretStoreSelection);
+	program.hook("preAction", async (_thisCommand, actionCommand) => {
+		const options = actionCommand.optsWithGlobals();
+		const configuredSelection = options.secretStore ? void 0 : await loadConfiguredSecretStoreSelection();
+		const selection = options.secretStore ?? configuredSelection ?? "auto";
+		setSecretStoreAdapter(createSecretStoreAdapterFromSelection(selection));
+		await maybeWarnAboutMacOSKeychainPromptMode(selection);
+	});
+	program.hook("postAction", () => {
+		resetSecretStoreAdapter();
+	});
+	registerLoginCommand(program, deps);
+	registerReloginCommand(program);
+	registerSwitchCommand(program);
+	registerLabelCommand(program);
+	registerMigrateSecretsCommand(program);
+	registerKeyringCommand(program);
+	registerStatusCommand(program);
+	registerDoctorCommand(program);
+	registerUsageCommand(program);
+	registerUpdateSelfCommand(program);
+	registerHelpCommand(program);
+	registerVersionCommand(program, version);
+	registerDefaultInteractiveAction(program);
+	return program;
+};
+const main = async () => {
+	const program = createProgram();
+	const completion = tab(program);
+	configureTabCompletion(completion);
+	const completionArgs = getCompletionParseArgs(process.argv);
+	if (completionArgs) {
+		completion.parse(completionArgs);
+		return;
+	}
+	await program.parseAsync(process.argv);
+};
+if (import.meta.main) main().catch((error) => {
+	exitWithCommandError(error);
+});
+//#endregion
+export { createProgram, createRuntimeSecretStoreAdapter, createSecretStoreAdapterFromSelection, createTestPaths, getMacOSKeychainPromptWarning, getPaths, getSecretStoreAdapter, interactiveMode, loadConfig, resetPaths, resetSecretStoreAdapter, resolveMacOSCrossKeychainBackendId, runInteractiveMode, saveConfig, setPaths, setSecretStoreAdapter, switchNext, switchToAccount, writeAllAuthFiles, writeAuthFile, writeCodexAuthFile, writePiAuthFile };