@jeffreycao/copilot-api 2.7.0 → 2.7.2

package/dist/{token-0pmwyQAu.js → token-BjzzuPSb.js}

@@ -1,6 +1,6 @@
-import { C as writeFileAtomically, _ as readEditableConfigFromDisk, c as getConfig, h as isResponsesApiWebSocketEnabled, u as getUpstreamTransportConfig, x as PATHS } from "./config-store-CARrUljo.js";
-import { c as setProviderConfig, n as getRawProviderConfig } from "./config-B2OaAnpL.js";
-import { a as UpstreamHeadersTimeoutError, i as HTTPError, n as assertGitHubCopilotEnabled, o as UpstreamStreamInactivityTimeoutError } from "./github-copilot-provider-DlQZgaCT.js";
+import { C as writeFileAtomically, _ as readEditableConfigFromDisk, c as getConfig, h as isResponsesApiWebSocketEnabled, u as getUpstreamTransportConfig, x as PATHS } from "./config-store-CMgB1mCV.js";
+import { c as setProviderConfig, n as getRawProviderConfig } from "./config-DIDLVXMU.js";
+import { a as UpstreamHeadersTimeoutError, i as HTTPError, n as assertGitHubCopilotEnabled, o as UpstreamStreamInactivityTimeoutError } from "./github-copilot-provider-CLEAHyT-.js";
 import consola from "consola";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import path from "node:path";
@@ -11,6 +11,7 @@ import { WebSocket } from "undici";
 import { events } from "fetch-event-stream";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { z } from "zod";
 import { exec } from "node:child_process";
 //#region src/lib/internal-headers.ts
 const FULL_MODEL_CATALOG_HEADER = "x-full-model-catalog";
@@ -980,15 +981,23 @@ function shouldIncludeHeader(headerName) {
 const CALLBACK_HOST = "127.0.0.1";
 const CALLBACK_PORT = 1455;
 const CALLBACK_PATH = "/auth/callback";
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const CLIENT_ID$1 = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 const TOKEN_URL = "https://auth.openai.com/oauth/token";
 const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
-const SCOPE = "openid profile email offline_access";
+const SCOPE$1 = "openid profile email offline_access";
 const JWT_CLAIM_PATH = "https://api.openai.com/auth";
-const REFRESH_BUFFER_MS = 6e4;
-const CALLBACK_TIMEOUT_MS = 45e3;
+const REFRESH_BUFFER_MS$1 = 6e4;
+const CALLBACK_TIMEOUT_MS = 12e4;
 const REFRESH_TIMEOUT_MS = 3e4;
+var CodexOAuthError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(reason === "callback_timeout" ? "Codex authorization timed out after 2 minutes" : "Could not listen for Codex authorization on port 1455");
+		this.reason = reason;
+		this.name = "CodexOAuthError";
+	}
+};
 function base64UrlEncode(bytes) {
 	return Buffer.from(bytes).toString("base64url");
 }
@@ -1040,7 +1049,7 @@ function decodeJwt(accessToken) {
 		return null;
 	}
 }
-function getAccountId(accessToken) {
+function getAccountId$1(accessToken) {
 	const payload = decodeJwt(accessToken);
 	if (!payload) return null;
 	const authPayload = payload[JWT_CLAIM_PATH];
@@ -1108,17 +1117,18 @@ function renderOAuthErrorPage(message) {
 		message
 	});
 }
-async function exchangeAuthorizationCode(code, verifier) {
+async function exchangeAuthorizationCode(code, verifier, signal) {
 	const response = await fetch(TOKEN_URL, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: new URLSearchParams({
 			grant_type: "authorization_code",
-			client_id: CLIENT_ID,
+			client_id: CLIENT_ID$1,
 			code,
 			code_verifier: verifier,
 			redirect_uri: REDIRECT_URI
-		})
+		}),
+		signal
 	});
 	if (!response.ok) {
 		const details = await response.text().catch(() => "");
@@ -1143,7 +1153,7 @@ async function refreshAccessToken(refreshToken, options = {}) {
 			body: new URLSearchParams({
 				grant_type: "refresh_token",
 				refresh_token: refreshToken,
-				client_id: CLIENT_ID
+				client_id: CLIENT_ID$1
 			}),
 			signal
 		});
@@ -1168,9 +1178,9 @@ async function createAuthorizationFlow() {
 	const state = createState();
 	const url = new URL(AUTHORIZE_URL);
 	url.searchParams.set("response_type", "code");
-	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("client_id", CLIENT_ID$1);
 	url.searchParams.set("redirect_uri", REDIRECT_URI);
-	url.searchParams.set("scope", SCOPE);
+	url.searchParams.set("scope", SCOPE$1);
 	url.searchParams.set("code_challenge", challenge);
 	url.searchParams.set("code_challenge_method", "S256");
 	url.searchParams.set("state", state);
@@ -1183,7 +1193,8 @@ async function createAuthorizationFlow() {
 		url: url.toString()
 	};
 }
-async function waitForAuthorizationCode(state) {
+async function waitForAuthorizationCode(state, signal) {
+	signal?.throwIfAborted();
 	let resolveCode;
 	const waitForCode = new Promise((resolve) => {
 		resolveCode = resolve;
@@ -1229,14 +1240,21 @@ async function waitForAuthorizationCode(state) {
 			});
 		});
 	} catch {
-		return null;
+		throw new CodexOAuthError("callback_unavailable");
 	}
+	let timeout;
+	const onAbort = () => resolveCode?.(null);
+	signal?.addEventListener("abort", onAbort, { once: true });
 	try {
-		const timeout = new Promise((resolve) => {
-			setTimeout(() => resolve(null), CALLBACK_TIMEOUT_MS);
-		});
-		return await Promise.race([waitForCode, timeout]);
+		signal?.throwIfAborted();
+		timeout = setTimeout(() => resolveCode?.(null), CALLBACK_TIMEOUT_MS);
+		const code = await waitForCode;
+		signal?.throwIfAborted();
+		if (!code) throw new CodexOAuthError("callback_timeout");
+		return code;
 	} finally {
+		clearTimeout(timeout);
+		signal?.removeEventListener("abort", onAbort);
 		await new Promise((resolve, reject) => {
 			server.close((error) => {
 				if (error) {
@@ -1245,25 +1263,40 @@ async function waitForAuthorizationCode(state) {
 				}
 				resolve();
 			});
+			server.closeAllConnections();
 		}).catch(() => void 0);
 	}
 }
 async function loginCodex(options) {
+	options.signal?.throwIfAborted();
 	const { verifier, state, url } = await createAuthorizationFlow();
+	options.signal?.throwIfAborted();
 	options.onAuth({
 		url,
 		instructions: "Please complete the login in the browser. If the browser does not automatically redirect, please paste the callback URL or code back to the terminal."
 	});
 	options.onProgress?.("Waiting for Codex OAuth callback");
-	let code = await waitForAuthorizationCode(state);
+	let code = null;
+	let callbackError;
+	try {
+		code = await waitForAuthorizationCode(state, options.signal);
+	} catch (error) {
+		options.signal?.throwIfAborted();
+		if (!(error instanceof CodexOAuthError)) throw error;
+		callbackError = error;
+	}
+	options.signal?.throwIfAborted();
 	if (!code) {
-		const parsed = parseAuthorizationInput(await options.onPrompt("Paste the authorization code or full redirect URL:"));
+		const input = await options.onPrompt("Paste the authorization code or full redirect URL:");
+		options.signal?.throwIfAborted();
+		const parsed = parseAuthorizationInput(input);
 		if (parsed.state && parsed.state !== state) throw new Error("Codex OAuth state mismatch");
 		code = parsed.code ?? null;
 	}
-	if (!code) throw new Error("Missing Codex authorization code");
-	const tokenResult = await exchangeAuthorizationCode(code, verifier);
-	const accountId = getAccountId(tokenResult.accessToken);
+	if (!code) throw callbackError ?? /* @__PURE__ */ new Error("Missing Codex authorization code");
+	const tokenResult = await exchangeAuthorizationCode(code, verifier, options.signal);
+	options.signal?.throwIfAborted();
+	const accountId = getAccountId$1(tokenResult.accessToken);
 	if (!accountId) throw new Error("Failed to extract Codex account id from access token");
 	return {
 		accessToken: tokenResult.accessToken,
@@ -1274,17 +1307,590 @@ async function loginCodex(options) {
 }
 async function refreshCodexCredentials(credentials, options = {}) {
 	const tokenResult = await refreshAccessToken(credentials.refreshToken, options);
-	const accountId = getAccountId(tokenResult.accessToken);
+	const accountId = getAccountId$1(tokenResult.accessToken);
 	if (!accountId) throw new Error("Failed to extract Codex account id from access token");
 	return {
-		accessToken: tokenResult.accessToken,
-		refreshToken: tokenResult.refreshToken,
-		expiresAt: tokenResult.expiresAt,
-		accountId
+		accessToken: tokenResult.accessToken,
+		refreshToken: tokenResult.refreshToken,
+		expiresAt: tokenResult.expiresAt,
+		accountId
+	};
+}
+function isCodexCredentialsExpired(credentials, now = Date.now()) {
+	return credentials.expiresAt <= now + REFRESH_BUFFER_MS$1;
+}
+//#endregion
+//#region src/lib/oauth/xai.ts
+const XAI_API_BASE_URL = "https://api.x.ai";
+const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const ISSUER = "https://auth.x.ai/oauth2";
+const SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const REQUEST_TIMEOUT_MS = 3e4;
+const POLLING_SAFETY_MARGIN_MS = 3e3;
+const REFRESH_BUFFER_MS = 6e4;
+const tokenSchema = z.object({
+	access_token: z.string().trim().min(1),
+	refresh_token: z.string().trim().min(1).optional(),
+	id_token: z.string().optional(),
+	expires_in: z.number().finite().optional()
+});
+const deviceSchema = z.object({
+	device_code: z.string().min(1),
+	user_code: z.string().min(1),
+	verification_uri: z.url({ protocol: /^https$/u }),
+	verification_uri_complete: z.url({ protocol: /^https$/u }).optional(),
+	expires_in: z.number().finite().optional(),
+	interval: z.number().finite().optional()
+});
+const errorSchema = z.object({ error: z.string().optional() });
+var XaiOAuthError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(reason === "authorization_expired" ? "xAI device code expired. Please sign in again." : "xAI device authorization was denied.");
+		this.name = "XaiOAuthError";
+		this.reason = reason;
+	}
+};
+function positiveSeconds(value, fallback) {
+	return value !== void 0 && value > 0 ? value : fallback;
+}
+function tokenCredentials(tokens, currentRefreshToken) {
+	const refreshToken = tokens.refresh_token ?? currentRefreshToken;
+	if (!refreshToken) throw new Error("xAI token response is missing refresh_token");
+	let expiresAt = Date.now() + positiveSeconds(tokens.expires_in, 3600) * 1e3;
+	if (!tokens.expires_in || tokens.expires_in <= 0) try {
+		const payload = JSON.parse(Buffer.from(tokens.access_token.split(".")[1], "base64url").toString("utf8"));
+		const claims = z.object({ exp: z.number().finite().positive() }).safeParse(payload);
+		if (claims.success) expiresAt = claims.data.exp * 1e3;
+	} catch {}
+	return {
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt
+	};
+}
+function tokenAccountId(token) {
+	if (!token) return void 0;
+	try {
+		const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+		const claims = z.object({ sub: z.string().trim().min(1) }).safeParse(payload);
+		return claims.success ? claims.data.sub : void 0;
+	} catch {
+		return;
+	}
+}
+async function getAccountId(tokens, signal, dependencies) {
+	const accountId = tokenAccountId(tokens.id_token) ?? tokenAccountId(tokens.access_token);
+	if (accountId) return accountId;
+	const response = await (dependencies.fetcher ?? fetch)(`${ISSUER}/userinfo`, {
+		headers: {
+			Authorization: `Bearer ${tokens.access_token}`,
+			Accept: "application/json"
+		},
+		signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+	});
+	if (!response.ok) throw requestError(response, await readOAuthError(response));
+	const user = z.object({ sub: z.string().trim().min(1) }).parse(await response.json());
+	signal.throwIfAborted();
+	return user.sub;
+}
+async function send(endpoint, body, options = {}, dependencies = {}) {
+	const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
+	const timeout = AbortSignal.timeout(timeoutMs);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+	try {
+		return await (dependencies.fetcher ?? fetch)(`${ISSUER}/${endpoint}`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json",
+				"User-Agent": "copilot-api"
+			},
+			body: new URLSearchParams(body),
+			signal
+		});
+	} catch (error) {
+		options.signal?.throwIfAborted();
+		if (timeout.aborted) throw new Error(`xAI authorization request timed out after ${timeoutMs}ms`, { cause: error });
+		throw error;
+	}
+}
+async function readOAuthError(response) {
+	const payload = await response.json().catch(() => null);
+	const parsed = errorSchema.safeParse(payload);
+	return parsed.success ? parsed.data.error : void 0;
+}
+function requestError(response, error) {
+	const detail = error && /^[a-z_]+$/u.test(error) ? `: ${error}` : "";
+	return /* @__PURE__ */ new Error(`xAI authorization request failed (${response.status})${detail}`);
+}
+async function loginXai(options, dependencies = {}) {
+	options.signal?.throwIfAborted();
+	const response = await send("device/code", {
+		client_id: CLIENT_ID,
+		scope: SCOPE,
+		referrer: "opencode"
+	}, options, dependencies);
+	if (!response.ok) throw requestError(response, await readOAuthError(response));
+	const device = deviceSchema.parse(await response.json());
+	options.signal?.throwIfAborted();
+	const lifetimeMs = positiveSeconds(device.expires_in, 300) * 1e3;
+	const expiresAt = Date.now() + lifetimeMs;
+	const timeout = AbortSignal.timeout(lifetimeMs);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+	options.onAuth({
+		url: device.verification_uri_complete ?? device.verification_uri,
+		verificationUri: device.verification_uri,
+		userCode: device.user_code,
+		expiresAt
+	});
+	let intervalMs = Math.max(positiveSeconds(device.interval, 5) * 1e3, 1e3);
+	const sleep = dependencies.sleep ?? ((ms, abortSignal) => setTimeout$1(ms, void 0, { signal: abortSignal }));
+	try {
+		for (;;) {
+			signal.throwIfAborted();
+			const tokenResponse = await send("token", {
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				client_id: CLIENT_ID,
+				device_code: device.device_code
+			}, { signal }, dependencies);
+			signal.throwIfAborted();
+			if (tokenResponse.ok) {
+				const tokens = tokenSchema.parse(await tokenResponse.json());
+				signal.throwIfAborted();
+				const credentials = tokenCredentials(tokens);
+				const accountId = await getAccountId(tokens, signal, dependencies);
+				signal.throwIfAborted();
+				return {
+					...credentials,
+					accountId
+				};
+			}
+			const error = await readOAuthError(tokenResponse);
+			if (error === "authorization_pending" || error === "slow_down") {
+				if (error === "slow_down") intervalMs += 5e3;
+				await sleep(intervalMs + POLLING_SAFETY_MARGIN_MS, signal);
+				continue;
+			}
+			if (error === "access_denied" || error === "authorization_denied") throw new XaiOAuthError("authorization_denied");
+			if (error === "expired_token") throw new XaiOAuthError("authorization_expired");
+			throw requestError(tokenResponse, error);
+		}
+	} catch (error) {
+		options.signal?.throwIfAborted();
+		if (timeout.aborted) throw new XaiOAuthError("authorization_expired");
+		throw error;
+	}
+}
+async function refreshXaiCredentials(credentials, options = {}, dependencies = {}) {
+	const response = await send("token", {
+		grant_type: "refresh_token",
+		refresh_token: credentials.refreshToken,
+		client_id: CLIENT_ID
+	}, options, dependencies);
+	if (!response.ok) throw requestError(response, await readOAuthError(response));
+	const tokens = tokenSchema.parse(await response.json());
+	const refreshedAccountId = tokenAccountId(tokens.id_token) ?? tokenAccountId(tokens.access_token);
+	if (refreshedAccountId && refreshedAccountId !== credentials.accountId) throw new Error("xAI token refresh returned a different account");
+	return {
+		...tokenCredentials(tokens, credentials.refreshToken),
+		accountId: credentials.accountId
+	};
+}
+function isXaiCredentialsExpired(credentials, now = Date.now()) {
+	return credentials.expiresAt <= now + REFRESH_BUFFER_MS;
+}
+const CODEX_CREDENTIAL_LOCK_RETRY_MS = 10;
+const CODEX_CREDENTIAL_LOCK_TIMEOUT_MS = 1e4;
+const CODEX_CREDENTIAL_LOCK_STALE_MS = 6e4;
+function isNodeError(error) {
+	return error instanceof Error && "code" in error;
+}
+function normalizeCodexAccountSelector(value) {
+	return value.trim().toLowerCase();
+}
+function parseCodexCredentialLockMetadata(value) {
+	try {
+		const candidate = JSON.parse(value);
+		if (typeof candidate.createdAt !== "number" || !Number.isFinite(candidate.createdAt) || typeof candidate.owner !== "string" || typeof candidate.pid !== "number" || !Number.isSafeInteger(candidate.pid) || candidate.pid <= 0) return null;
+		return {
+			createdAt: candidate.createdAt,
+			owner: candidate.owner,
+			pid: candidate.pid
+		};
+	} catch {
+		return null;
+	}
+}
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return !(isNodeError(error) && error.code === "ESRCH");
+	}
+}
+async function isCodexCredentialLockContention(error, lockPath) {
+	if (isNodeError(error) && error.code === "EEXIST") return true;
+	if (process.platform !== "win32" || !isNodeError(error) || error.code !== "EACCES" && error.code !== "EPERM") return false;
+	try {
+		await fs.stat(lockPath);
+		return true;
+	} catch (statError) {
+		if (isNodeError(statError) && statError.code === "ENOENT") return true;
+		return false;
+	}
+}
+async function removeStaleCodexCredentialLock(lockPath) {
+	let content;
+	let modifiedAt;
+	try {
+		const [lockContent, stats] = await Promise.all([fs.readFile(lockPath, "utf8"), fs.stat(lockPath)]);
+		content = lockContent;
+		modifiedAt = stats.mtimeMs;
+	} catch (error) {
+		if (isNodeError(error) && error.code === "ENOENT" || await isCodexCredentialLockContention(error, lockPath)) return;
+		throw error;
+	}
+	const metadata = parseCodexCredentialLockMetadata(content);
+	if (Date.now() - (metadata?.createdAt ?? modifiedAt) < CODEX_CREDENTIAL_LOCK_STALE_MS && (!metadata || isProcessAlive(metadata.pid))) return;
+	try {
+		if (await fs.readFile(lockPath, "utf8") !== content) return;
+		await fs.unlink(lockPath);
+	} catch (error) {
+		if (isNodeError(error) && error.code === "ENOENT" || await isCodexCredentialLockContention(error, lockPath)) return;
+		throw error;
+	}
+}
+async function acquireCodexCredentialLock(lockPath = `${PATHS.CODEX_CREDENTIAL_PATH}.lock`) {
+	await fs.mkdir(path.dirname(lockPath), { recursive: true });
+	const startedAt = Date.now();
+	while (true) {
+		const metadata = {
+			createdAt: Date.now(),
+			owner: `${process.pid}-${randomBytes(8).toString("hex")}`,
+			pid: process.pid
+		};
+		const content = `${JSON.stringify(metadata)}\n`;
+		try {
+			const fileHandle = await fs.open(lockPath, "wx", 384);
+			try {
+				await fileHandle.writeFile(content, "utf8");
+				await fileHandle.sync();
+			} catch (error) {
+				await fileHandle.close().catch(() => {});
+				await fs.unlink(lockPath).catch(() => {});
+				throw error;
+			}
+			return {
+				content,
+				fileHandle,
+				lockPath
+			};
+		} catch (error) {
+			if (!await isCodexCredentialLockContention(error, lockPath)) throw error;
+		}
+		await removeStaleCodexCredentialLock(lockPath);
+		if (Date.now() - startedAt >= CODEX_CREDENTIAL_LOCK_TIMEOUT_MS) throw new Error(`Timed out waiting for Codex credential store lock: ${lockPath}`);
+		await setTimeout$1(CODEX_CREDENTIAL_LOCK_RETRY_MS);
+	}
+}
+async function releaseCodexCredentialLock(lock) {
+	await lock.fileHandle.close();
+	try {
+		if (await fs.readFile(lock.lockPath, "utf8") !== lock.content) return;
+		await fs.unlink(lock.lockPath);
+	} catch (error) {
+		if (!(isNodeError(error) && error.code === "ENOENT")) throw error;
+	}
+}
+async function withCodexCredentialLock(operation, lockPath) {
+	const lock = await acquireCodexCredentialLock(lockPath);
+	let result;
+	try {
+		result = await operation();
+	} catch (error) {
+		await releaseCodexCredentialLock(lock).catch(() => {});
+		throw error;
+	}
+	await releaseCodexCredentialLock(lock);
+	return result;
+}
+/**
+* Serializes operations that must keep Codex account selection in config.json
+* consistent with the credential store. Credential writes retain their own
+* narrower lock so refreshes can run without changing the selected account.
+*/
+function withCodexAccountMutationLock(operation) {
+	return withCodexCredentialLock(operation, `${PATHS.CODEX_CREDENTIAL_PATH}.accounts.lock`);
+}
+function withCredentialFileLock(credentialPath, operation) {
+	return withCodexCredentialLock(operation, `${credentialPath}.lock`);
+}
+async function readOptionalFile(filePath) {
+	try {
+		return await fs.readFile(filePath, "utf8");
+	} catch (error) {
+		if (isNodeError(error) && error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+function writeProtectedFile(filePath, content) {
+	return Promise.resolve().then(() => writeFileAtomically(filePath, content));
+}
+function normalizeCodexCredentials(credentials) {
+	if (!credentials || typeof credentials !== "object") return null;
+	const candidate = credentials;
+	if (typeof candidate.accessToken !== "string" || !candidate.accessToken.trim() || typeof candidate.refreshToken !== "string" || !candidate.refreshToken.trim() || typeof candidate.expiresAt !== "number" || !Number.isFinite(candidate.expiresAt) || typeof candidate.accountId !== "string" || !candidate.accountId.trim()) return null;
+	return {
+		accessToken: candidate.accessToken,
+		refreshToken: candidate.refreshToken,
+		expiresAt: candidate.expiresAt,
+		accountId: candidate.accountId
+	};
+}
+function normalizeCodexStoredAccount(account) {
+	const credentials = normalizeCodexCredentials(account);
+	if (!credentials) return null;
+	const aliasValue = account.alias;
+	if (aliasValue !== void 0 && typeof aliasValue !== "string") return null;
+	const alias = aliasValue?.trim();
+	return {
+		...credentials,
+		...alias ? { alias } : {}
+	};
+}
+function normalizeCodexCredentialStore(value) {
+	const legacyCredentials = normalizeCodexCredentials(value);
+	if (legacyCredentials) return {
+		version: 1,
+		accounts: [legacyCredentials]
+	};
+	if (!value || typeof value !== "object") return null;
+	const candidate = value;
+	if (candidate.version !== 1 || !Array.isArray(candidate.accounts)) return null;
+	if (candidate.accounts.length > 3) return null;
+	const accounts = [];
+	const accountIds = /* @__PURE__ */ new Set();
+	const aliases = /* @__PURE__ */ new Set();
+	for (const value of candidate.accounts) {
+		const account = normalizeCodexStoredAccount(value);
+		if (!account || accountIds.has(account.accountId)) return null;
+		const normalizedAlias = account.alias ? normalizeCodexAccountSelector(account.alias) : void 0;
+		if (normalizedAlias && aliases.has(normalizedAlias)) return null;
+		accounts.push(account);
+		accountIds.add(account.accountId);
+		if (normalizedAlias) aliases.add(normalizedAlias);
+	}
+	return {
+		version: 1,
+		accounts: accounts.map((account, index) => {
+			const alias = account.alias;
+			if (!alias || !accounts.some((candidate, candidateIndex) => candidateIndex !== index && normalizeCodexAccountSelector(candidate.accountId) === normalizeCodexAccountSelector(alias))) return account;
+			const { alias: _alias, ...credentials } = account;
+			return credentials;
+		})
+	};
+}
+async function writeCodexCredentialStoreUnlocked(store, credentialPath = PATHS.CODEX_CREDENTIAL_PATH) {
+	await writeProtectedFile(credentialPath, `${JSON.stringify(store, null, 2)}\n`);
+}
+async function readGitHubToken() {
+	return (await readOptionalFile(PATHS.GITHUB_TOKEN_PATH))?.trim() || null;
+}
+const GITHUB_TOKEN_ENV = "COPILOT_API_GITHUB_TOKEN";
+function readGitHubTokenFromEnv() {
+	return process.env["COPILOT_API_GITHUB_TOKEN"]?.trim() || void 0;
+}
+async function writeGitHubToken(token) {
+	await writeProtectedFile(PATHS.GITHUB_TOKEN_PATH, token.trim());
+}
+function createOAuthCredentialStore(providerLabel, credentialPath) {
+	async function readStore() {
+		const raw = await readOptionalFile(credentialPath());
+		if (!raw?.trim()) return null;
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch (error) {
+			throw new Error(`${providerLabel} credentials file is not valid JSON: ${credentialPath()}`, { cause: error });
+		}
+		const store = normalizeCodexCredentialStore(parsed);
+		if (!store) throw new Error(`${providerLabel} credentials file is missing required fields: ${credentialPath()}`);
+		return store;
+	}
+	async function readCredentials(accountId) {
+		const store = await readStore();
+		if (!store || store.accounts.length === 0) return null;
+		const normalizedAccountId = accountId?.trim();
+		if (normalizedAccountId) return store.accounts.find((account) => account.accountId === normalizedAccountId) ?? null;
+		if (store.accounts.length > 1) throw new Error(`Multiple ${providerLabel} accounts found but no account is selected`);
+		return store.accounts[0];
+	}
+	async function writeCredentials(credentials, options = {}) {
+		const normalizedCredentials = normalizeCodexCredentials(credentials);
+		if (!normalizedCredentials) throw new Error(`${providerLabel} credentials are missing required fields`);
+		await withCredentialFileLock(credentialPath(), async () => {
+			const store = await readStore() ?? {
+				version: 1,
+				accounts: []
+			};
+			const accountIdSelector = normalizeCodexAccountSelector(normalizedCredentials.accountId);
+			const existingIndex = store.accounts.findIndex((account) => account.accountId === normalizedCredentials.accountId);
+			if (existingIndex < 0 && options.insertIfMissing === false) return;
+			const existingRefreshToken = store.accounts[existingIndex]?.refreshToken;
+			if (options.expectedRefreshToken !== void 0 && existingRefreshToken !== options.expectedRefreshToken && existingRefreshToken !== normalizedCredentials.refreshToken) return;
+			if (existingIndex < 0 && store.accounts.some((account) => normalizeCodexAccountSelector(account.accountId) === accountIdSelector)) throw new Error(`${providerLabel} account id '${normalizedCredentials.accountId}' is already in use`);
+			if (existingIndex < 0 && store.accounts.length >= 3) throw new Error(`${providerLabel} supports at most 3 accounts`);
+			if (store.accounts.some((account, index) => index !== existingIndex && account.alias && normalizeCodexAccountSelector(account.alias) === accountIdSelector)) throw new Error(`${providerLabel} account id '${normalizedCredentials.accountId}' conflicts with another account alias`);
+			const alias = options.alias?.trim();
+			if (alias) {
+				const aliasSelector = normalizeCodexAccountSelector(alias);
+				if (store.accounts.some((account, index) => index !== existingIndex && account.alias && normalizeCodexAccountSelector(account.alias) === aliasSelector)) throw new Error(`${providerLabel} account alias '${alias}' is already in use`);
+				if (store.accounts.some((account, index) => index !== existingIndex && normalizeCodexAccountSelector(account.accountId) === aliasSelector)) throw new Error(`${providerLabel} account alias '${alias}' conflicts with another account id`);
+			}
+			const existingAccount = existingIndex >= 0 ? store.accounts[existingIndex] : void 0;
+			const nextAccount = {
+				...normalizedCredentials,
+				...alias ? { alias } : existingAccount?.alias ? { alias: existingAccount.alias } : {}
+			};
+			const accounts = [...store.accounts];
+			if (existingIndex >= 0) accounts[existingIndex] = nextAccount;
+			else accounts.push(nextAccount);
+			await writeCodexCredentialStoreUnlocked({
+				version: 1,
+				accounts
+			}, credentialPath());
+		});
+	}
+	async function removeCredentials(accountId) {
+		const normalizedAccountId = accountId.trim();
+		if (!normalizedAccountId) throw new Error(`${providerLabel} account id must be a non-empty string`);
+		return await withCredentialFileLock(credentialPath(), async () => {
+			const store = await readStore();
+			const index = store?.accounts.findIndex((account) => account.accountId === normalizedAccountId) ?? -1;
+			if (!store || index < 0) throw new Error(`${providerLabel} account '${normalizedAccountId}' was not found`);
+			const removedAccount = store.accounts[index];
+			await writeCodexCredentialStoreUnlocked({
+				version: 1,
+				accounts: store.accounts.filter((_account, accountIndex) => accountIndex !== index)
+			}, credentialPath());
+			return removedAccount;
+		});
+	}
+	return {
+		readStore,
+		readCredentials,
+		writeCredentials,
+		removeCredentials
+	};
+}
+const codexCredentialStore = createOAuthCredentialStore("Codex", () => PATHS.CODEX_CREDENTIAL_PATH);
+const readCodexCredentialStore = codexCredentialStore.readStore;
+codexCredentialStore.readCredentials;
+const writeCodexCredentials = codexCredentialStore.writeCredentials;
+codexCredentialStore.removeCredentials;
+//#endregion
+//#region src/lib/oauth-accounts.ts
+function createOAuthAccountManager(options) {
+	const store = createOAuthCredentialStore(options.label, options.credentialPath);
+	const withMutationLock = (operation) => withCredentialFileLock(`${options.credentialPath()}.accounts`, operation);
+	const activeId = (accounts) => readEditableConfigFromDisk().providers?.[options.provider]?.accountId?.trim() || (accounts.length === 1 ? accounts[0].accountId : void 0);
+	const summarize = (account, active) => ({
+		accountId: account.accountId,
+		...account.alias ? { alias: account.alias } : {},
+		active
+	});
+	async function findAccount(selector) {
+		const normalized = selector.trim();
+		if (!normalized) throw new Error(`${options.label} account selector must be a non-empty string`);
+		const accounts = (await store.readStore())?.accounts ?? [];
+		const account = accounts.find((candidate) => candidate.accountId === normalized) ?? accounts.find((candidate) => candidate.alias?.toLowerCase() === normalized.toLowerCase());
+		if (!account) throw new Error(`${options.label} account '${normalized}' was not found`);
+		return {
+			account,
+			accounts
+		};
+	}
+	return {
+		store,
+		withMutationLock,
+		list: () => withMutationLock(async () => {
+			const accounts = (await store.readStore())?.accounts ?? [];
+			const active = activeId(accounts);
+			return accounts.map((account) => summarize(account, account.accountId === active));
+		}),
+		select: (selector) => withMutationLock(async () => {
+			const { account } = await findAccount(selector);
+			options.selectAccount(account.accountId);
+			return summarize(account, true);
+		}),
+		remove: (selector) => withMutationLock(async () => {
+			const { account, accounts } = await findAccount(selector);
+			if (account.accountId === activeId(accounts)) throw new Error(`${options.label} account '${account.accountId}' is currently in use; switch to another account before removing it`);
+			const removed = await store.removeCredentials(account.accountId);
+			return summarize(removed, false);
+		})
 	};
 }
-function isCodexCredentialsExpired(credentials, now = Date.now()) {
-	return credentials.expiresAt <= now + REFRESH_BUFFER_MS;
+//#endregion
+//#region src/lib/xai-token.ts
+function syncXaiProviderConfig(accountId, enable = false) {
+	const { apiKey: _apiKey, modelsDevProviderId: _catalog, ...existing } = readEditableConfigFromDisk().providers?.xai ?? {};
+	setProviderConfig("xai", {
+		...existing,
+		type: "openai-responses",
+		enabled: enable ? true : existing.enabled,
+		baseUrl: XAI_API_BASE_URL,
+		authType: "oauth2",
+		accountId,
+		pricingCurrency: "USD"
+	});
+}
+const xaiAccounts = createOAuthAccountManager({
+	provider: "xai",
+	label: "xAI",
+	credentialPath: () => PATHS.XAI_CREDENTIAL_PATH,
+	selectAccount: (accountId) => syncXaiProviderConfig(accountId)
+});
+const getXaiAccounts = xaiAccounts.list;
+const selectXaiAccount = xaiAccounts.select;
+const removeXaiAccount = xaiAccounts.remove;
+async function readXaiCredentials(accountId = getRawProviderConfig("xai")?.accountId) {
+	return await xaiAccounts.store.readCredentials(accountId);
+}
+function persistXaiCredentials(credentials, options = {}) {
+	return xaiAccounts.withMutationLock(async () => {
+		await xaiAccounts.store.writeCredentials(credentials, { alias: options.alias });
+		syncXaiProviderConfig(credentials.accountId, true);
+	});
+}
+const refreshInFlight = /* @__PURE__ */ new Map();
+const pendingPersistence = /* @__PURE__ */ new Map();
+async function getXaiAccessToken() {
+	const credentials = await readXaiCredentials();
+	if (!credentials || !isXaiCredentialsExpired(credentials)) return credentials?.accessToken ?? null;
+	const key = `${credentials.accountId}:${credentials.refreshToken}`;
+	const inFlight = refreshInFlight.get(key);
+	if (inFlight) return await inFlight;
+	const refresh = withCredentialFileLock(`${PATHS.XAI_CREDENTIAL_PATH}.refresh`, async () => {
+		const current = await readXaiCredentials(credentials.accountId);
+		if (!current) return null;
+		if (!isXaiCredentialsExpired(current)) return current.accessToken;
+		const currentKey = `${current.accountId}:${current.refreshToken}`;
+		const refreshed = pendingPersistence.get(currentKey) ?? await refreshXaiCredentials(current);
+		pendingPersistence.set(currentKey, refreshed);
+		await xaiAccounts.store.writeCredentials(refreshed, {
+			insertIfMissing: false,
+			expectedRefreshToken: current.refreshToken
+		});
+		pendingPersistence.delete(currentKey);
+		return (await readXaiCredentials(credentials.accountId))?.accessToken ?? null;
+	}).finally(() => {
+		refreshInFlight.delete(key);
+	});
+	refreshInFlight.set(key, refresh);
+	return await refresh;
 }
 //#endregion
 //#region src/lib/request-auth.ts
@@ -1611,272 +2217,6 @@ const GITHUB_BASE_URL = "https://github.com";
 const GITHUB_CLIENT_ID = "Iv1.b507a08c87ecfe98";
 const GITHUB_APP_SCOPES = ["read:user"].join(" ");
 const OPENCODE_GITHUB_CLIENT_ID = "Ov23li8tweQw6odWQebz";
-const CODEX_CREDENTIAL_LOCK_RETRY_MS = 10;
-const CODEX_CREDENTIAL_LOCK_TIMEOUT_MS = 1e4;
-const CODEX_CREDENTIAL_LOCK_STALE_MS = 6e4;
-function isNodeError(error) {
-	return error instanceof Error && "code" in error;
-}
-function normalizeCodexAccountSelector(value) {
-	return value.trim().toLowerCase();
-}
-function parseCodexCredentialLockMetadata(value) {
-	try {
-		const candidate = JSON.parse(value);
-		if (typeof candidate.createdAt !== "number" || !Number.isFinite(candidate.createdAt) || typeof candidate.owner !== "string" || typeof candidate.pid !== "number" || !Number.isSafeInteger(candidate.pid) || candidate.pid <= 0) return null;
-		return {
-			createdAt: candidate.createdAt,
-			owner: candidate.owner,
-			pid: candidate.pid
-		};
-	} catch {
-		return null;
-	}
-}
-function isProcessAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return !(isNodeError(error) && error.code === "ESRCH");
-	}
-}
-async function isCodexCredentialLockContention(error, lockPath) {
-	if (isNodeError(error) && error.code === "EEXIST") return true;
-	if (process.platform !== "win32" || !isNodeError(error) || error.code !== "EACCES" && error.code !== "EPERM") return false;
-	try {
-		await fs.stat(lockPath);
-		return true;
-	} catch (statError) {
-		if (isNodeError(statError) && statError.code === "ENOENT") return true;
-		return false;
-	}
-}
-async function removeStaleCodexCredentialLock(lockPath) {
-	let content;
-	let modifiedAt;
-	try {
-		const [lockContent, stats] = await Promise.all([fs.readFile(lockPath, "utf8"), fs.stat(lockPath)]);
-		content = lockContent;
-		modifiedAt = stats.mtimeMs;
-	} catch (error) {
-		if (isNodeError(error) && error.code === "ENOENT") return;
-		throw error;
-	}
-	const metadata = parseCodexCredentialLockMetadata(content);
-	if (Date.now() - (metadata?.createdAt ?? modifiedAt) < CODEX_CREDENTIAL_LOCK_STALE_MS && (!metadata || isProcessAlive(metadata.pid))) return;
-	try {
-		if (await fs.readFile(lockPath, "utf8") !== content) return;
-		await fs.unlink(lockPath);
-	} catch (error) {
-		if (isNodeError(error) && error.code === "ENOENT") return;
-		throw error;
-	}
-}
-async function acquireCodexCredentialLock(lockPath = `${PATHS.CODEX_CREDENTIAL_PATH}.lock`) {
-	await fs.mkdir(path.dirname(lockPath), { recursive: true });
-	const startedAt = Date.now();
-	while (true) {
-		const metadata = {
-			createdAt: Date.now(),
-			owner: `${process.pid}-${randomBytes(8).toString("hex")}`,
-			pid: process.pid
-		};
-		const content = `${JSON.stringify(metadata)}\n`;
-		try {
-			const fileHandle = await fs.open(lockPath, "wx", 384);
-			try {
-				await fileHandle.writeFile(content, "utf8");
-				await fileHandle.sync();
-			} catch (error) {
-				await fileHandle.close().catch(() => {});
-				await fs.unlink(lockPath).catch(() => {});
-				throw error;
-			}
-			return {
-				content,
-				fileHandle,
-				lockPath
-			};
-		} catch (error) {
-			if (!await isCodexCredentialLockContention(error, lockPath)) throw error;
-		}
-		await removeStaleCodexCredentialLock(lockPath);
-		if (Date.now() - startedAt >= CODEX_CREDENTIAL_LOCK_TIMEOUT_MS) throw new Error(`Timed out waiting for Codex credential store lock: ${lockPath}`);
-		await setTimeout$1(CODEX_CREDENTIAL_LOCK_RETRY_MS);
-	}
-}
-async function releaseCodexCredentialLock(lock) {
-	await lock.fileHandle.close();
-	try {
-		if (await fs.readFile(lock.lockPath, "utf8") !== lock.content) return;
-		await fs.unlink(lock.lockPath);
-	} catch (error) {
-		if (!(isNodeError(error) && error.code === "ENOENT")) throw error;
-	}
-}
-async function withCodexCredentialLock(operation, lockPath) {
-	const lock = await acquireCodexCredentialLock(lockPath);
-	let result;
-	try {
-		result = await operation();
-	} catch (error) {
-		await releaseCodexCredentialLock(lock).catch(() => {});
-		throw error;
-	}
-	await releaseCodexCredentialLock(lock);
-	return result;
-}
-/**
-* Serializes operations that must keep Codex account selection in config.json
-* consistent with the credential store. Credential writes retain their own
-* narrower lock so refreshes can run without changing the selected account.
-*/
-function withCodexAccountMutationLock(operation) {
-	return withCodexCredentialLock(operation, `${PATHS.CODEX_CREDENTIAL_PATH}.accounts.lock`);
-}
-async function readOptionalFile(filePath) {
-	try {
-		return await fs.readFile(filePath, "utf8");
-	} catch (error) {
-		if (isNodeError(error) && error.code === "ENOENT") return null;
-		throw error;
-	}
-}
-function writeProtectedFile(filePath, content) {
-	return Promise.resolve().then(() => writeFileAtomically(filePath, content));
-}
-function normalizeCodexCredentials(credentials) {
-	if (!credentials || typeof credentials !== "object") return null;
-	const candidate = credentials;
-	if (typeof candidate.accessToken !== "string" || typeof candidate.refreshToken !== "string" || typeof candidate.expiresAt !== "number" || typeof candidate.accountId !== "string") return null;
-	return {
-		accessToken: candidate.accessToken,
-		refreshToken: candidate.refreshToken,
-		expiresAt: candidate.expiresAt,
-		accountId: candidate.accountId
-	};
-}
-function normalizeCodexStoredAccount(account) {
-	const credentials = normalizeCodexCredentials(account);
-	if (!credentials) return null;
-	const aliasValue = account.alias;
-	if (aliasValue !== void 0 && typeof aliasValue !== "string") return null;
-	const alias = aliasValue?.trim();
-	return {
-		...credentials,
-		...alias ? { alias } : {}
-	};
-}
-function normalizeCodexCredentialStore(value) {
-	const legacyCredentials = normalizeCodexCredentials(value);
-	if (legacyCredentials) return {
-		version: 1,
-		accounts: [legacyCredentials]
-	};
-	if (!value || typeof value !== "object") return null;
-	const candidate = value;
-	if (candidate.version !== 1 || !Array.isArray(candidate.accounts)) return null;
-	if (candidate.accounts.length > 3) return null;
-	const accounts = [];
-	const accountIds = /* @__PURE__ */ new Set();
-	const aliases = /* @__PURE__ */ new Set();
-	for (const value of candidate.accounts) {
-		const account = normalizeCodexStoredAccount(value);
-		if (!account || accountIds.has(account.accountId)) return null;
-		const normalizedAlias = account.alias ? normalizeCodexAccountSelector(account.alias) : void 0;
-		if (normalizedAlias && aliases.has(normalizedAlias)) return null;
-		accounts.push(account);
-		accountIds.add(account.accountId);
-		if (normalizedAlias) aliases.add(normalizedAlias);
-	}
-	return {
-		version: 1,
-		accounts: accounts.map((account, index) => {
-			const alias = account.alias;
-			if (!alias || !accounts.some((candidate, candidateIndex) => candidateIndex !== index && normalizeCodexAccountSelector(candidate.accountId) === normalizeCodexAccountSelector(alias))) return account;
-			const { alias: _alias, ...credentials } = account;
-			return credentials;
-		})
-	};
-}
-async function writeCodexCredentialStoreUnlocked(store) {
-	await writeProtectedFile(PATHS.CODEX_CREDENTIAL_PATH, `${JSON.stringify(store, null, 2)}\n`);
-}
-async function readGitHubToken() {
-	return (await readOptionalFile(PATHS.GITHUB_TOKEN_PATH))?.trim() || null;
-}
-const GITHUB_TOKEN_ENV = "COPILOT_API_GITHUB_TOKEN";
-function readGitHubTokenFromEnv() {
-	return process.env["COPILOT_API_GITHUB_TOKEN"]?.trim() || void 0;
-}
-async function writeGitHubToken(token) {
-	await writeProtectedFile(PATHS.GITHUB_TOKEN_PATH, token.trim());
-}
-async function readCodexCredentialStore() {
-	const raw = await readOptionalFile(PATHS.CODEX_CREDENTIAL_PATH);
-	if (!raw?.trim()) return null;
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch (error) {
-		throw new Error(`Codex credentials file is not valid JSON: ${PATHS.CODEX_CREDENTIAL_PATH}`, { cause: error });
-	}
-	const store = normalizeCodexCredentialStore(parsed);
-	if (!store) throw new Error(`Codex credentials file is missing required fields: ${PATHS.CODEX_CREDENTIAL_PATH}`);
-	return store;
-}
-async function writeCodexCredentials(credentials, options = {}) {
-	const normalizedCredentials = normalizeCodexCredentials(credentials);
-	if (!normalizedCredentials) throw new Error("Codex credentials are missing required fields");
-	await withCodexCredentialLock(async () => {
-		const store = await readCodexCredentialStore() ?? {
-			version: 1,
-			accounts: []
-		};
-		const accountIdSelector = normalizeCodexAccountSelector(normalizedCredentials.accountId);
-		const existingIndex = store.accounts.findIndex((account) => account.accountId === normalizedCredentials.accountId);
-		if (existingIndex < 0 && options.insertIfMissing === false) return;
-		const existingRefreshToken = store.accounts[existingIndex]?.refreshToken;
-		if (options.expectedRefreshToken !== void 0 && existingRefreshToken !== options.expectedRefreshToken && existingRefreshToken !== normalizedCredentials.refreshToken) return;
-		if (existingIndex < 0 && store.accounts.some((account) => normalizeCodexAccountSelector(account.accountId) === accountIdSelector)) throw new Error(`Codex account id '${normalizedCredentials.accountId}' is already in use`);
-		if (existingIndex < 0 && store.accounts.length >= 3) throw new Error(`Codex supports at most 3 accounts`);
-		if (store.accounts.some((account, index) => index !== existingIndex && account.alias && normalizeCodexAccountSelector(account.alias) === accountIdSelector)) throw new Error(`Codex account id '${normalizedCredentials.accountId}' conflicts with another account alias`);
-		const alias = options.alias?.trim();
-		if (alias) {
-			const aliasSelector = normalizeCodexAccountSelector(alias);
-			if (store.accounts.some((account, index) => index !== existingIndex && account.alias && normalizeCodexAccountSelector(account.alias) === aliasSelector)) throw new Error(`Codex account alias '${alias}' is already in use`);
-			if (store.accounts.some((account, index) => index !== existingIndex && normalizeCodexAccountSelector(account.accountId) === aliasSelector)) throw new Error(`Codex account alias '${alias}' conflicts with another account id`);
-		}
-		const existingAccount = existingIndex >= 0 ? store.accounts[existingIndex] : void 0;
-		const nextAccount = {
-			...normalizedCredentials,
-			...alias ? { alias } : existingAccount?.alias ? { alias: existingAccount.alias } : {}
-		};
-		const accounts = [...store.accounts];
-		if (existingIndex >= 0) accounts[existingIndex] = nextAccount;
-		else accounts.push(nextAccount);
-		await writeCodexCredentialStoreUnlocked({
-			version: 1,
-			accounts
-		});
-	});
-}
-async function removeCodexCredentials(accountId) {
-	const normalizedAccountId = accountId.trim();
-	if (!normalizedAccountId) throw new Error("Codex account id must be a non-empty string");
-	return await withCodexCredentialLock(async () => {
-		const store = await readCodexCredentialStore();
-		const index = store?.accounts.findIndex((account) => account.accountId === normalizedAccountId) ?? -1;
-		if (!store || index < 0) throw new Error(`Codex account '${normalizedAccountId}' was not found`);
-		const removedAccount = store.accounts[index];
-		await writeCodexCredentialStoreUnlocked({
-			version: 1,
-			accounts: store.accounts.filter((_account, accountIndex) => accountIndex !== index)
-		});
-		return removedAccount;
-	});
-}
 //#endregion
 //#region src/services/github/get-copilot-token.ts
 const getCopilotToken = async () => {
@@ -2136,53 +2476,15 @@ function syncCodexProviderConfig(options) {
 function getConfiguredCodexAccountId() {
 	return getRawProviderConfig("codex")?.accountId?.trim() || void 0;
 }
-function getPersistedCodexAccountId() {
-	return readEditableConfigFromDisk().providers?.codex?.accountId?.trim() || void 0;
-}
-function resolveActiveCodexAccountId(accounts, configuredAccountId = getConfiguredCodexAccountId()) {
-	return configuredAccountId ?? (accounts.length === 1 ? accounts[0].accountId : void 0);
-}
-function normalizeCodexSelector(selector) {
-	const normalizedSelector = selector.trim();
-	if (!normalizedSelector) throw new Error("Codex account selector must be a non-empty string");
-	return normalizedSelector;
-}
-function findCodexAccount(accounts, selector) {
-	return accounts.find((candidate) => candidate.accountId === selector) ?? accounts.find((candidate) => candidate.alias?.toLowerCase() === selector.toLowerCase());
-}
-function toCodexAccountSummary(account, active) {
-	return {
-		accountId: account.accountId,
-		...account.alias ? { alias: account.alias } : {},
-		active
-	};
-}
-async function getCodexAccounts() {
-	return await withCodexAccountMutationLock(async () => {
-		const accounts = (await readCodexCredentialStore())?.accounts ?? [];
-		const activeAccountId = resolveActiveCodexAccountId(accounts, getPersistedCodexAccountId());
-		return accounts.map((account) => toCodexAccountSummary(account, account.accountId === activeAccountId));
-	});
-}
-async function selectCodexAccount(selector) {
-	return await withCodexAccountMutationLock(async () => {
-		const normalizedSelector = normalizeCodexSelector(selector);
-		const account = findCodexAccount((await readCodexCredentialStore())?.accounts ?? [], normalizedSelector);
-		if (!account) throw new Error(`Codex account '${normalizedSelector}' was not found`);
-		syncCodexProviderConfig({ accountId: account.accountId });
-		return toCodexAccountSummary(account, true);
-	});
-}
-async function removeCodexAccount(selector) {
-	return await withCodexAccountMutationLock(async () => {
-		const normalizedSelector = normalizeCodexSelector(selector);
-		const accounts = (await readCodexCredentialStore())?.accounts ?? [];
-		const account = findCodexAccount(accounts, normalizedSelector);
-		if (!account) throw new Error(`Codex account '${normalizedSelector}' was not found`);
-		if (account.accountId === resolveActiveCodexAccountId(accounts, getPersistedCodexAccountId())) throw new Error(`Codex account '${account.accountId}' is currently in use; switch to another account before removing it`);
-		return toCodexAccountSummary(await removeCodexCredentials(account.accountId), false);
-	});
-}
+const codexAccounts = createOAuthAccountManager({
+	provider: "codex",
+	label: "Codex",
+	credentialPath: () => PATHS.CODEX_CREDENTIAL_PATH,
+	selectAccount: (accountId) => syncCodexProviderConfig({ accountId })
+});
+const getCodexAccounts = codexAccounts.list;
+const selectCodexAccount = codexAccounts.select;
+const removeCodexAccount = codexAccounts.remove;
 async function persistCodexCredentials(credentials, options = {}) {
 	const generation = options.runtimeGeneration ?? codexRuntimeGeneration;
 	const persist = async () => {
@@ -2438,6 +2740,6 @@ async function logUser(dependencies = defaultCopilotTokenDependencies) {
 	state.tokenBasedBilling = copilotUser.token_based_billing;
 }
 //#endregion
-export { state as $, compactAutoContinuePromptStarts as A, CODEX_API_BASE_URL as B, copilotHeaders as C, prepareInteractionHeaders as D, prepareForCompact as E, createAuthMiddleware as F, resolveTraceId as G, forwardCodexResponses as H, getConfiguredAdminApiKeys as I, createResponsesSafeStream as J, fetchUpstreamWithLifecycle as K, getConfiguredApiKeys as L, compactSummaryPromptStart as M, compactSystemPromptStarts as N, prepareMessageProxyHeaders as O, compactTextOnlyGuard as P, createWebSocketUrl as Q, getMissingApiKeysMessage as R, copilotBaseUrl as S, copilotWebSocketHeaders as T, generateTraceId as U, buildCodexRequestHeaders as V, requestContext as W, getResponsesStreamTerminalDisposition as X, encodePoolKeyPart as Y, createPooledWebSocketStream as Z, parseUserIdMetadata as _, removeCodexAccount as a, readGitHubToken as b, setupCopilotToken as c, generateRequestIdFromPayload as d, FULL_MODEL_CATALOG_HEADER as et, getRootSessionId as f, isResponsesStream as g, isNullish as h, persistCodexCredentials as i, compactMessageSections as j, initOpencodeVersion as k, setupGitHubToken as l, isAsyncIterable as m, invalidateCodexRuntime as n, selectCodexAccount as o, getUUID as p, createResponsesHttpEventStream as q, logUser as r, setupCodexToken as s, getCodexAccounts as t, stripInternalRequestHeaders as tt, stopCopilotRefreshLoop as u, getCopilotUsage as v, copilotModelsHeaders as w, readGitHubTokenFromEnv as x, GITHUB_TOKEN_ENV as y, loginCodex as z };
+export { createResponsesHttpEventStream as $, compactSystemPromptStarts as A, selectXaiAccount as B, prepareForCompact as C, compactAutoContinuePromptStarts as D, initOpencodeVersion as E, getMissingApiKeysMessage as F, loginCodex as G, readGitHubToken as H, getXaiAccessToken as I, forwardCodexResponses as J, CODEX_API_BASE_URL as K, getXaiAccounts as L, createAuthMiddleware as M, getConfiguredAdminApiKeys as N, compactMessageSections as O, getConfiguredApiKeys as P, fetchUpstreamWithLifecycle as Q, persistXaiCredentials as R, copilotWebSocketHeaders as S, prepareMessageProxyHeaders as T, readGitHubTokenFromEnv as U, GITHUB_TOKEN_ENV as V, loginXai as W, requestContext as X, generateTraceId as Y, resolveTraceId as Z, parseUserIdMetadata as _, removeCodexAccount as a, state as at, copilotHeaders as b, setupCopilotToken as c, generateRequestIdFromPayload as d, createResponsesSafeStream as et, getRootSessionId as f, isResponsesStream as g, isNullish as h, persistCodexCredentials as i, createWebSocketUrl as it, compactTextOnlyGuard as j, compactSummaryPromptStart as k, setupGitHubToken as l, isAsyncIterable as m, invalidateCodexRuntime as n, getResponsesStreamTerminalDisposition as nt, selectCodexAccount as o, FULL_MODEL_CATALOG_HEADER as ot, getUUID as p, buildCodexRequestHeaders as q, logUser as r, createPooledWebSocketStream as rt, setupCodexToken as s, stripInternalRequestHeaders as st, getCodexAccounts as t, encodePoolKeyPart as tt, stopCopilotRefreshLoop as u, getCopilotUsage as v, prepareInteractionHeaders as w, copilotModelsHeaders as x, copilotBaseUrl as y, removeXaiAccount as z };
 
-//# sourceMappingURL=token-0pmwyQAu.js.map
+//# sourceMappingURL=token-BjzzuPSb.js.map