@kaitranntt/ccs 7.79.1-dev.2 → 7.79.1-dev.21

package/dist/codex-auth/codex-auth-help.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Help text for `ccsx auth` command tree.
+ * ASCII-only. Includes ccsxp scope clarifier (H5).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printCodexAuthUseHelp = exports.printCodexAuthHelp = void 0;
+function printCodexAuthHelp() {
+    process.stdout.write(`CCS Concurrent Codex Account Management
+
+Usage
+  ccsx auth <command> [options]
+
+Commands
+  create <name>          Create a new Codex profile (idempotent)
+  login <name>           Run \`codex login\` against the profile (auto-creates if missing)
+  switch <name>          Set the persistent default Codex profile
+  use <name>             Emit shell-eval exports to activate a profile in this shell only
+  show [name]            List profiles or show details for one
+  remove <name>          Delete a profile (auth.json + profile dir + registry entry)
+  import-default <name>  Migrate legacy ~/.codex/auth.json into a new profile
+
+Shell activation (per terminal)
+  bash/zsh: eval "$(ccsx auth use work)"
+  fish:     ccsx auth use work | source
+  pwsh:     ccsx auth use work | Invoke-Expression
+
+Examples
+  ccsx auth create work
+  ccsx auth login work          # OAuth in browser
+  ccsx auth create personal
+  ccsx auth login personal
+  eval "$(ccsx auth use work)"  # terminal A
+  eval "$(ccsx auth use personal)"  # terminal B
+  codex                              # each terminal uses its own account
+  ccsx auth show
+  ccsx auth switch personal     # change persistent default
+  ccsx auth remove old --yes
+
+Options
+  --yes, -y              Skip confirmation (remove)
+  --force                Re-link config.toml (create) | override default check (remove) |
+                         overwrite existing profile (import-default)
+  --json                 JSON output (show)
+  --shell <s>            Override shell detection (use): bash|zsh|fish|pwsh|cmd
+  --with-history         Copy history.jsonl + sessions/ too (import-default, default: off)
+  --force-while-running  Allow import-default even if Codex is running (risky)
+
+Notes
+  Auth state (auth.json) and history.jsonl are isolated per profile.
+  config.toml is shared via symlink to ~/.codex/config.toml.
+  Default profile (switch) is persistent across shells.
+  Active profile (use) is per-terminal via CODEX_HOME / CCS_CODEX_PROFILE.
+
+  Note: This feature applies only to native \`codex\`. \`ccsxp\` ignores
+  CCS_CODEX_PROFILE and uses its own cliproxy pool.
+`);
+}
+exports.printCodexAuthHelp = printCodexAuthHelp;
+function printCodexAuthUseHelp() {
+    process.stdout.write(`ccsx auth use — Activate a Codex profile in the current shell
+
+Usage
+  ccsx auth use <name> [--shell <bash|zsh|fish|pwsh|cmd>]
+
+Description
+  Emits shell-evalable export statements to stdout. Use within eval "$(...)"
+  only. Output to stdout is shell-evaluatable; do not pipe to other commands.
+
+  All errors and informational messages go to stderr so the eval is never
+  contaminated.
+
+Shell evaluation
+  bash/zsh: eval "$(ccsx auth use work)"
+  fish:     ccsx auth use work | source
+  pwsh:     ccsx auth use work | Invoke-Expression
+  cmd:      (not supported natively; use PowerShell)
+
+Options
+  --shell <s>   Override auto-detected shell: bash|zsh|fish|pwsh|cmd
+
+Note: This profile applies only to native \`codex\`. \`ccsxp\` ignores
+CCS_CODEX_PROFILE and uses its own cliproxy pool.
+`);
+}
+exports.printCodexAuthUseHelp = printCodexAuthUseHelp;
+//# sourceMappingURL=codex-auth-help.js.map

package/dist/codex-auth/codex-auth-help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-help.js","sourceRoot":"","sources":["../../src/codex-auth/codex-auth-help.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,SAAgB,kBAAkB;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDtB,CAAC,CAAC;AACH,CAAC;AAlDD,gDAkDC;AAED,SAAgB,qBAAqB;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;CAuBtB,CAAC,CAAC;AACH,CAAC;AAzBD,sDAyBC"}

package/dist/codex-auth/codex-auth-router.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Codex auth command router.
+ *
+ * Exports runCodexAuth(argv) which routes argv[0] (the subcommand) to
+ * the appropriate handler. Returns an exit code (0 = success, non-zero = error).
+ *
+ * Phase 3 wires this into src/bin/codex-runtime.ts for argv[2]==='auth'.
+ */
+/**
+ * Route a `ccsx auth <subcommand> [...args]` invocation.
+ *
+ * @param argv - Arguments after `auth`, e.g. ['create', 'work'] or ['--help']
+ * @returns Exit code (0 success, 1 user error, 2+ system error)
+ */
+export declare function runCodexAuth(argv: string[]): Promise<number>;
+//# sourceMappingURL=codex-auth-router.d.ts.map

package/dist/codex-auth/codex-auth-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-router.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-auth-router.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwDlE"}

package/dist/codex-auth/codex-auth-router.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Codex auth command router.
+ *
+ * Exports runCodexAuth(argv) which routes argv[0] (the subcommand) to
+ * the appropriate handler. Returns an exit code (0 = success, non-zero = error).
+ *
+ * Phase 3 wires this into src/bin/codex-runtime.ts for argv[2]==='auth'.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCodexAuth = void 0;
+const codex_profile_registry_1 = require("./codex-profile-registry");
+const codex_auth_help_1 = require("./codex-auth-help");
+const index_1 = require("./commands/index");
+const packageJson = require('../../package.json');
+/**
+ * Route a `ccsx auth <subcommand> [...args]` invocation.
+ *
+ * @param argv - Arguments after `auth`, e.g. ['create', 'work'] or ['--help']
+ * @returns Exit code (0 success, 1 user error, 2+ system error)
+ */
+async function runCodexAuth(argv) {
+    const [subcommand, ...rest] = argv;
+    // Help / no-arg
+    if (!subcommand || subcommand === '--help' || subcommand === '-h' || subcommand === 'help') {
+        (0, codex_auth_help_1.printCodexAuthHelp)();
+        return 0;
+    }
+    // Version passthrough
+    if (subcommand === '--version' || subcommand === '-v') {
+        process.stdout.write(`ccsx auth ${packageJson.version}\n`);
+        return 0;
+    }
+    const registry = new codex_profile_registry_1.CodexProfileRegistry();
+    const ctx = {
+        registry,
+        version: packageJson.version,
+    };
+    try {
+        switch (subcommand) {
+            case 'create':
+                await (0, index_1.handleCreateCodex)(ctx, rest);
+                return 0;
+            case 'login':
+                await (0, index_1.handleLoginCodex)(ctx, rest);
+                return 0;
+            case 'switch':
+                await (0, index_1.handleSwitchCodex)(ctx, rest);
+                return 0;
+            case 'use':
+                await (0, index_1.handleUseCodex)(ctx, rest);
+                return 0;
+            case 'show':
+                await (0, index_1.handleShowCodex)(ctx, rest);
+                return 0;
+            case 'remove':
+                await (0, index_1.handleRemoveCodex)(ctx, rest);
+                return 0;
+            case 'import-default':
+                await (0, index_1.handleImportDefaultCodex)(ctx, rest);
+                return 0;
+            default:
+                process.stderr.write(`[X] Unknown command: ${subcommand}\n`);
+                process.stderr.write(`    ccsx auth --help\n`);
+                return 1;
+        }
+    }
+    catch (err) {
+        // Unhandled errors from handlers (e.g. process.exit called inside)
+        // These should be rare — handlers use exitWithError() which calls process.exit
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[X] Unexpected error in ccsx auth ${subcommand}: ${msg}\n`);
+        return 1;
+    }
+}
+exports.runCodexAuth = runCodexAuth;
+//# sourceMappingURL=codex-auth-router.js.map

package/dist/codex-auth/codex-auth-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-router.js","sourceRoot":"","sources":["../../src/codex-auth/codex-auth-router.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,qEAAgE;AAChE,uDAAuD;AACvD,4CAQ0B;AAG1B,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AAEzE;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEnC,gBAAgB;IAChB,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC3F,IAAA,oCAAkB,GAAE,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sBAAsB;IACtB,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,6CAAoB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAwB;QAC/B,QAAQ;QACR,OAAO,EAAE,WAAW,CAAC,OAAO;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,QAAQ;gBACX,MAAM,IAAA,yBAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC;YACX,KAAK,OAAO;gBACV,MAAM,IAAA,wBAAgB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAClC,OAAO,CAAC,CAAC;YACX,KAAK,QAAQ;gBACX,MAAM,IAAA,yBAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC;YACX,KAAK,KAAK;gBACR,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,CAAC;YACX,KAAK,MAAM;gBACT,MAAM,IAAA,uBAAe,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjC,OAAO,CAAC,CAAC;YACX,KAAK,QAAQ;gBACX,MAAM,IAAA,yBAAiB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC;YACX,KAAK,gBAAgB;gBACnB,MAAM,IAAA,gCAAwB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC;YACX;gBACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,IAAI,CAAC,CAAC;gBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,+EAA+E;QAC/E,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAxDD,oCAwDC"}

package/dist/codex-auth/codex-config-symlink.d.ts

@@ -0,0 +1,14 @@
+export interface EnsureSharedConfigSymlinkOptions {
+    overwriteRegularFile?: boolean;
+}
+/**
+ * Ensure <profileDir>/config.toml points at the shared ~/.codex/config.toml.
+ * Self-healing: recreates stale or missing symlinks. If symlink creation is
+ * unavailable, copies the shared config so the profile still has settings.
+ *
+ * @param profileDir  - The per-profile directory (will be created if missing).
+ * @param sharedConfigPath - Override for the shared target path (used in tests
+ *   to avoid touching real ~/.codex/config.toml). Defaults to getSharedCodexConfigPath().
+ */
+export declare function ensureSharedConfigSymlink(profileDir: string, sharedConfigPath?: string, options?: EnsureSharedConfigSymlinkOptions): void;
+//# sourceMappingURL=codex-config-symlink.d.ts.map

package/dist/codex-auth/codex-config-symlink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-config-symlink.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-config-symlink.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,GAAE,gCAAqC,GAC7C,IAAI,CA0EN"}

package/dist/codex-auth/codex-config-symlink.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureSharedConfigSymlink = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logging_1 = require("../services/logging");
+const codex_profile_paths_1 = require("./codex-profile-paths");
+const logger = (0, logging_1.createLogger)('codex-auth:symlink');
+/**
+ * Ensure <profileDir>/config.toml points at the shared ~/.codex/config.toml.
+ * Self-healing: recreates stale or missing symlinks. If symlink creation is
+ * unavailable, copies the shared config so the profile still has settings.
+ *
+ * @param profileDir  - The per-profile directory (will be created if missing).
+ * @param sharedConfigPath - Override for the shared target path (used in tests
+ *   to avoid touching real ~/.codex/config.toml). Defaults to getSharedCodexConfigPath().
+ */
+function ensureSharedConfigSymlink(profileDir, sharedConfigPath, options = {}) {
+    const targetPath = sharedConfigPath ?? (0, codex_profile_paths_1.getSharedCodexConfigPath)();
+    const linkPath = path.join(profileDir, 'config.toml');
+    // Ensure profile directory exists
+    fs.mkdirSync(profileDir, { recursive: true, mode: 0o700 });
+    // Ensure shared config target parent directory exists
+    fs.mkdirSync(path.dirname(targetPath), { recursive: true, mode: 0o700 });
+    // Create empty shared config if it doesn't exist — Codex will populate on first run
+    if (!fs.existsSync(targetPath)) {
+        fs.writeFileSync(targetPath, '', { mode: 0o600 });
+        logger.stage('dispatch', 'codex.shared-config.created', 'Created empty shared config.toml', {
+            path: targetPath,
+        });
+    }
+    // Inspect whatever currently exists at the link path
+    let existingStat = null;
+    try {
+        existingStat = fs.lstatSync(linkPath);
+    }
+    catch {
+        // ENOENT — nothing there yet, proceed to create
+    }
+    if (existingStat !== null) {
+        if (existingStat.isSymbolicLink()) {
+            const currentTarget = fs.readlinkSync(linkPath);
+            if (currentTarget === targetPath) {
+                // Already correct — idempotent return
+                logger.stage('dispatch', 'codex.symlink.ok', 'Shared config symlink already correct', {
+                    link: linkPath,
+                });
+                return;
+            }
+            // Stale symlink — remove and re-create
+            fs.unlinkSync(linkPath);
+            logger.stage('dispatch', 'codex.symlink.repaired', 'Replaced stale symlink', {
+                link: linkPath,
+                was: currentTarget,
+                now: targetPath,
+            });
+        }
+        else if (options.overwriteRegularFile ||
+            isRegularConfigCopyUnmodified(linkPath, targetPath)) {
+            // Explicit repair or unchanged fallback copy — replace with a shared symlink when possible.
+            process.stderr.write(`[!] codex-auth: overwriting regular file at ${linkPath} with symlink to shared config.toml\n`);
+            fs.unlinkSync(linkPath);
+        }
+        else {
+            process.stderr.write(`[!] codex-auth: preserving existing regular config.toml at ${linkPath}; ` +
+                `use ccsx auth create <name> --force to refresh it.\n`);
+            logger.warn('codex-auth.symlink-regular-file-preserved', 'Preserved regular config.toml', {
+                link: linkPath,
+                target: targetPath,
+            });
+            return;
+        }
+    }
+    try {
+        fs.symlinkSync(targetPath, linkPath);
+        logger.stage('dispatch', 'codex.symlink.created', 'Created shared config symlink', {
+            link: linkPath,
+            target: targetPath,
+        });
+    }
+    catch (err) {
+        copySharedConfigFallback(targetPath, linkPath, err);
+    }
+}
+exports.ensureSharedConfigSymlink = ensureSharedConfigSymlink;
+function isRegularConfigCopyUnmodified(linkPath, targetPath) {
+    try {
+        return fs.readFileSync(linkPath, 'utf8') === fs.readFileSync(targetPath, 'utf8');
+    }
+    catch {
+        return false;
+    }
+}
+function copySharedConfigFallback(targetPath, linkPath, err) {
+    fs.copyFileSync(targetPath, linkPath);
+    fs.chmodSync(linkPath, 0o600);
+    process.stderr.write(`[!] codex-auth: symlink unavailable; copied shared config.toml to ${linkPath}. ` +
+        `Config edits won't propagate automatically.\n`);
+    logger.warn('codex-auth.symlink-copy-fallback', 'Copied shared config after symlink failure', {
+        link: linkPath,
+        target: targetPath,
+        error: err instanceof Error ? err.message : String(err),
+    });
+}
+//# sourceMappingURL=codex-config-symlink.js.map

package/dist/codex-auth/codex-config-symlink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-config-symlink.js","sourceRoot":"","sources":["../../src/codex-auth/codex-config-symlink.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,iDAAmD;AACnD,+DAAiE;AAEjE,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,oBAAoB,CAAC,CAAC;AAMlD;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CACvC,UAAkB,EAClB,gBAAyB,EACzB,UAA4C,EAAE;IAE9C,MAAM,UAAU,GAAG,gBAAgB,IAAI,IAAA,8CAAwB,GAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEtD,kCAAkC;IAClC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,sDAAsD;IACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEzE,oFAAoF;IACpF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,6BAA6B,EAAE,kCAAkC,EAAE;YAC1F,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjC,sCAAsC;gBACtC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,kBAAkB,EAAE,uCAAuC,EAAE;oBACpF,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,uCAAuC;YACvC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EAAE;gBAC3E,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,aAAa;gBAClB,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;QACL,CAAC;aAAM,IACL,OAAO,CAAC,oBAAoB;YAC5B,6BAA6B,CAAC,QAAQ,EAAE,UAAU,CAAC,EACnD,CAAC;YACD,4FAA4F;YAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,QAAQ,uCAAuC,CAC/F,CAAC;YACF,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8DAA8D,QAAQ,IAAI;gBACxE,sDAAsD,CACzD,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,+BAA+B,EAAE;gBACxF,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,uBAAuB,EAAE,+BAA+B,EAAE;YACjF,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AA9ED,8DA8EC;AAED,SAAS,6BAA6B,CAAC,QAAgB,EAAE,UAAkB;IACzE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB,EAAE,QAAgB,EAAE,GAAY;IAClF,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qEAAqE,QAAQ,IAAI;QAC/E,+CAA+C,CAClD,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,4CAA4C,EAAE;QAC5F,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/codex-auth/codex-profile-paths.d.ts

@@ -0,0 +1,5 @@
+export declare function getCodexAuthRegistryPath(): string;
+export declare function getCodexInstancesDir(): string;
+export declare function resolveCodexProfileDir(name: string): string;
+export declare function getSharedCodexConfigPath(): string;
+//# sourceMappingURL=codex-profile-paths.d.ts.map

package/dist/codex-auth/codex-profile-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-profile-paths.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-profile-paths.ts"],"names":[],"mappings":"AAKA,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAa3D;AAID,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD"}

package/dist/codex-auth/codex-profile-paths.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSharedCodexConfigPath = exports.resolveCodexProfileDir = exports.getCodexInstancesDir = exports.getCodexAuthRegistryPath = void 0;
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const config_manager_1 = require("../utils/config-manager");
+const types_1 = require("./types");
+function getCodexAuthRegistryPath() {
+    return path.join((0, config_manager_1.getCcsDir)(), 'codex-profiles.yaml');
+}
+exports.getCodexAuthRegistryPath = getCodexAuthRegistryPath;
+function getCodexInstancesDir() {
+    return path.join((0, config_manager_1.getCcsDir)(), 'codex-instances');
+}
+exports.getCodexInstancesDir = getCodexInstancesDir;
+function resolveCodexProfileDir(name) {
+    const nameError = (0, types_1.getCodexProfileNameError)(name);
+    if (nameError) {
+        throw new Error(nameError);
+    }
+    const instancesDir = path.resolve(getCodexInstancesDir());
+    const profileDir = path.resolve(path.join(instancesDir, name));
+    if (profileDir !== instancesDir && profileDir.startsWith(`${instancesDir}${path.sep}`)) {
+        return profileDir;
+    }
+    throw new Error('Profile directory resolved outside codex-instances.');
+}
+exports.resolveCodexProfileDir = resolveCodexProfileDir;
+// Uses os.homedir() intentionally — this is the upstream Codex location,
+// not a CCS-owned path. Tests must override the shared config path explicitly.
+function getSharedCodexConfigPath() {
+    return path.join(os.homedir(), '.codex', 'config.toml');
+}
+exports.getSharedCodexConfigPath = getSharedCodexConfigPath;
+//# sourceMappingURL=codex-profile-paths.js.map

package/dist/codex-auth/codex-profile-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-profile-paths.js","sourceRoot":"","sources":["../../src/codex-auth/codex-profile-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,uCAAyB;AACzB,4DAAoD;AACpD,mCAAmD;AAEnD,SAAgB,wBAAwB;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,0BAAS,GAAE,EAAE,qBAAqB,CAAC,CAAC;AACvD,CAAC;AAFD,4DAEC;AAED,SAAgB,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,0BAAS,GAAE,EAAE,iBAAiB,CAAC,CAAC;AACnD,CAAC;AAFD,oDAEC;AAED,SAAgB,sBAAsB,CAAC,IAAY;IACjD,MAAM,SAAS,GAAG,IAAA,gCAAwB,EAAC,IAAI,CAAC,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACvF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AACzE,CAAC;AAbD,wDAaC;AAED,yEAAyE;AACzE,+EAA+E;AAC/E,SAAgB,wBAAwB;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAFD,4DAEC"}

package/dist/codex-auth/codex-profile-registry.d.ts

@@ -0,0 +1,34 @@
+import type { CodexProfileData, CodexProfileMetadata } from './types';
+export declare class CodexProfileRegistryReadError extends Error {
+    constructor(message: string);
+}
+export declare function validateCodexProfileRegistryData(parsed: unknown): CodexProfileData;
+/**
+ * Registry for codex auth profiles stored at ~/.ccs/codex-profiles.yaml.
+ *
+ * Writes are guarded by a registry-directory lock around the read-modify-write
+ * cycle, then persisted atomically with tmp file + POSIX rename.
+ *
+ * Constructor accepts an optional registryPath for test isolation.
+ */
+export declare class CodexProfileRegistry {
+    private readonly registryPath;
+    constructor(registryPath?: string);
+    private _read;
+    private _write;
+    private _withRegistryWriteLock;
+    private _cleanOrphanTmpFiles;
+    createProfile(name: string, meta?: Partial<CodexProfileMetadata>): void;
+    getProfile(name: string): CodexProfileMetadata;
+    updateProfile(name: string, partial: Partial<CodexProfileMetadata>): void;
+    removeProfile(name: string, options?: {
+        forceDefault?: boolean;
+    }): void;
+    listProfiles(): string[];
+    hasProfile(name: string): boolean;
+    getDefault(): string | null;
+    setDefault(name: string): void;
+    clearDefault(): void;
+    touchProfile(name: string): void;
+}
+//# sourceMappingURL=codex-profile-registry.d.ts.map

package/dist/codex-auth/codex-profile-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-profile-registry.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-profile-registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAWtE,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAiClF;AAmFD;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,YAAY,CAAC,EAAE,MAAM;IAOjC,OAAO,CAAC,KAAK;IAoBb,OAAO,CAAC,MAAM;IA2Bd,OAAO,CAAC,sBAAsB;IAuC9B,OAAO,CAAC,oBAAoB;IAyB5B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAAG,IAAI;IAkB3E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB;IAU9C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI;IAYzE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,IAAI;IAmB3E,YAAY,IAAI,MAAM,EAAE;IAIxB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAOjC,UAAU,IAAI,MAAM,GAAG,IAAI;IAI3B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAY9B,YAAY,IAAI,IAAI;IAQpB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAGjC"}