@kaitranntt/ccs 7.79.1-dev.5 → 7.79.1-dev.6

package/README.md

@@ -20,21 +20,25 @@ Anthropic-compatible APIs without config thrash.
 
 </div>
 
-## Why CCS
+> **[Docker]** `ghcr.io/kaitranntt/ccs-dashboard:latest` is deprecated. Use `ghcr.io/kaitranntt/ccs:latest` instead. See [#1251](https://github.com/kaitranntt/ccs/issues/1251) and [docker/README.md](docker/README.md#choosing-an-image) for migration details. To wire a sibling container to CLIProxy, see [Connect your app to CLIProxy](docker/README.md#connect-your-app-to-cliproxy).
 
-CCS gives you one stable command surface while letting you switch between:
+<!-- quickstart-snippet-start -->
+## Quick Start (Docker)
 
-- multiple runtimes such as Claude Code, Factory Droid, and Codex CLI
-- multiple Claude subscriptions and isolated account contexts
-- OAuth providers like Codex, Kiro, Claude, Qwen, Kimi, and more, with legacy
-  Copilot compatibility for existing setups
-- API and local-model profiles like GLM, Kimi, OpenRouter, Ollama, llama.cpp,
-  Novita, and Alibaba Coding Plan
+With Docker installed:
 
-The goal is simple: stop rewriting config files, stop breaking active sessions,
-and move between providers in seconds.
+```bash
+curl -fsSL https://ccs.kaitran.ca/docker-compose.yaml -o docker-compose.yaml
+docker compose up -d
+```
+
+Dashboard at http://localhost:3000 · CLIProxy at http://localhost:8317.
+
+Need a corporate-proxy alternative? Download directly:
+`https://raw.githubusercontent.com/kaitranntt/ccs/main/docker/compose.yaml`
+<!-- quickstart-snippet-end -->
 
-## Quick Start
+## Install on Host (npm)
 
 ```bash
 npm install -g @kaitranntt/ccs
@@ -51,6 +55,20 @@ ccs glm
 ccs ollama
 ```
 
+## Why CCS
+
+CCS gives you one stable command surface while letting you switch between:
+
+- multiple runtimes such as Claude Code, Factory Droid, and Codex CLI
+- multiple Claude subscriptions and isolated account contexts
+- OAuth providers like Codex, Kiro, Claude, Qwen, Kimi, and more, with legacy
+  Copilot compatibility for existing setups
+- API and local-model profiles like GLM, Kimi, OpenRouter, Ollama, llama.cpp,
+  Novita, and Alibaba Coding Plan
+
+The goal is simple: stop rewriting config files, stop breaking active sessions,
+and move between providers in seconds.
+
 ## OpenAI-Compatible Routing
 
 CCS can now bridge Claude Code into OpenAI-compatible providers through a local

package/dist/bin/ccsxp-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ccsxp-runtime.d.ts","sourceRoot":"","sources":["../../src/bin/ccsxp-runtime.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,EAAE,KAAgB,CAAC;AACzB,QAAA,MAAM,IAAI,KAAkB,CAAC;AAC7B,QAAA,MAAQ,2BAA2B,KAAyD,CAAC;AAC7F,QAAA,MAAQ,eAAe,KAA0C,CAAC;AAClE,QAAA,MAAQ,UAAU,KAAgC,CAAC;AACnD,QAAA,MAAQ,IAAI,KAA2B,CAAC;AAIxC,QAAA,MAAM,uBAAuB,gCAA8B,CAAC;AAC5D,QAAA,MAAM,iCAAiC,QAC6B,CAAC;AAErE,iBAAS,+BAA+B,CAAC,KAAK,EAAE,OAAO,WAEtD;AAED,iBAAS,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aA0C/C;AAED,iBAAS,qBAAqB,QAO7B;AAOD,QAAA,MAAM,aAAa,KAcf,CAAC"}
+{"version":3,"file":"ccsxp-runtime.d.ts","sourceRoot":"","sources":["../../src/bin/ccsxp-runtime.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,EAAE,KAAgB,CAAC;AACzB,QAAA,MAAM,IAAI,KAAkB,CAAC;AAC7B,QAAA,MAAQ,2BAA2B,KAAyD,CAAC;AAC7F,QAAA,MAAQ,eAAe,KAA0C,CAAC;AAClE,QAAA,MAAQ,UAAU,KAAgC,CAAC;AACnD,QAAA,MAAQ,IAAI,KAA2B,CAAC;AAIxC,QAAA,MAAM,uBAAuB,gCAA8B,CAAC;AAC5D,QAAA,MAAM,iCAAiC,QAC6B,CAAC;AAErE,iBAAS,+BAA+B,CAAC,KAAK,EAAE,OAAO,WAEtD;AAED,iBAAS,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aA0C/C;AAED,iBAAS,qBAAqB,QAO7B;AAiBD,QAAA,MAAM,aAAa,KAcf,CAAC"}

package/dist/bin/ccsxp-runtime.js

@@ -56,6 +56,14 @@ function resolveCcsxpCodexHome() {
     }
     return path.join(os.homedir(), '.codex');
 }
+// H5: CCS_CODEX_PROFILE is ignored by ccsxp. The ccsx auth profile system
+// (src/codex-auth/) is intentionally NOT consulted here — ccsxp serves the
+// cliproxy round-robin pool, not per-user-account profiles. Emit a one-line
+// notice so users who set CCS_CODEX_PROFILE in their shell don't get confused
+// when ccsxp silently ignores it and overwrites CODEX_HOME below.
+if (process.env.CCS_CODEX_PROFILE) {
+    process.stderr.write("[i] CCS_CODEX_PROFILE is ignored by ccsxp; profile applies to native 'codex' only.\n");
+}
 process.env.CODEX_HOME = resolveCcsxpCodexHome();
 // ccsxp is the Codex + cliproxy shortcut. Keep the native Codex history root,
 // strip conflicting target overrides, and prepend the native cliproxy provider

package/dist/bin/ccsxp-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"ccsxp-runtime.js","sourceRoot":"","sources":["../../src/bin/ccsxp-runtime.ts"],"names":[],"mappings":";AAAA,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,EAAE,2BAA2B,EAAE,GAAG,OAAO,CAAC,2CAA2C,CAAC,CAAC;AAC7F,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAClE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AACnD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAExC,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,OAAO,CAAC;AAChD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,GAAG,GAAG,CAAC;AAC/C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,iCAAiC,GACrC,kEAAkE,CAAC;AAErE,SAAS,+BAA+B,CAAC,KAAc;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAc;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM;QACR,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtE,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAClD,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;AAEjD,8EAA8E;AAC9E,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,wBAAwB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,wHAAwH,CAC3K,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,CAAC,EACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACvB,UAAU,EACV,uBAAuB,EACvB,GAAG,aAAa,CACjB,CAAC;AAEF,OAAO,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"ccsxp-runtime.js","sourceRoot":"","sources":["../../src/bin/ccsxp-runtime.ts"],"names":[],"mappings":";AAAA,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,EAAE,2BAA2B,EAAE,GAAG,OAAO,CAAC,2CAA2C,CAAC,CAAC;AAC7F,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAClE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AACnD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAExC,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,OAAO,CAAC;AAChD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,GAAG,GAAG,CAAC;AAC/C,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,iCAAiC,GACrC,kEAAkE,CAAC;AAErE,SAAS,+BAA+B,CAAC,KAAc;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAc;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM;QACR,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtE,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAClD,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,kEAAkE;AAClE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sFAAsF,CACvF,CAAC;AACJ,CAAC;AACD,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;AAEjD,8EAA8E;AAC9E,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,wBAAwB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,wHAAwH,CAC3K,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,CAAC,EACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACvB,UAAU,EACV,uBAAuB,EACvB,GAAG,aAAa,CACjB,CAAC;AAEF,OAAO,CAAC,QAAQ,CAAC,CAAC"}

package/dist/bin/codex-runtime-router.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Codex runtime router — testable logic for src/bin/codex-runtime.ts.
+ *
+ * All inter-module deps are resolved via require() at call-time so tests can
+ * inject stubs via require.cache before calling main().
+ *
+ * Routing:
+ *   argv[2] === 'auth'  → delegate to runCodexAuth(argv.slice(3)), exit with code
+ *   else               → resolve active profile, set CODEX_HOME, load ccs
+ *                        CCS manages the process lifecycle; entry MUST NOT
+ *                        call process.exit() when main returns -1.
+ *
+ * Return value contract:
+ *   ≥ 0  → auth branch: caller should process.exit(code)
+ *   -1   → CCS branch: CCS has taken over the process; caller must NOT exit
+ */
+/**
+ * Main entry-point for the ccsx / codex-runtime binary.
+ *
+ * @param argv - process.argv (or test-supplied equivalent)
+ * @returns ≥0 exit code for auth branch; -1 for CCS branch (no exit needed)
+ */
+export declare function main(argv: string[]): Promise<number>;
+//# sourceMappingURL=codex-runtime-router.d.ts.map

package/dist/bin/codex-runtime-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-runtime-router.d.ts","sourceRoot":"","sources":["../../src/bin/codex-runtime-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAsBH;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D1D"}

package/dist/bin/codex-runtime-router.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Codex runtime router — testable logic for src/bin/codex-runtime.ts.
+ *
+ * All inter-module deps are resolved via require() at call-time so tests can
+ * inject stubs via require.cache before calling main().
+ *
+ * Routing:
+ *   argv[2] === 'auth'  → delegate to runCodexAuth(argv.slice(3)), exit with code
+ *   else               → resolve active profile, set CODEX_HOME, load ccs
+ *                        CCS manages the process lifecycle; entry MUST NOT
+ *                        call process.exit() when main returns -1.
+ *
+ * Return value contract:
+ *   ≥ 0  → auth branch: caller should process.exit(code)
+ *   -1   → CCS branch: CCS has taken over the process; caller must NOT exit
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = void 0;
+process.env.CCS_INTERNAL_ENTRY_TARGET = 'codex';
+function isCodexAuthProfileResolutionError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        'name' in err &&
+        err.name === 'CodexAuthProfileResolutionError');
+}
+function errorMessage(err) {
+    if (err instanceof Error)
+        return err.message;
+    if (typeof err === 'object' && err !== null && 'message' in err) {
+        const message = err.message;
+        if (typeof message === 'string')
+            return message;
+    }
+    return String(err);
+}
+/**
+ * Main entry-point for the ccsx / codex-runtime binary.
+ *
+ * @param argv - process.argv (or test-supplied equivalent)
+ * @returns ≥0 exit code for auth branch; -1 for CCS branch (no exit needed)
+ */
+async function main(argv) {
+    const subcommand = argv[2];
+    // ── auth branch ─────────────────────────────────────────────────────────
+    if (subcommand === 'auth') {
+        const { runCodexAuth } = require('../codex-auth/codex-auth-router');
+        return runCodexAuth(argv.slice(3));
+    }
+    // ── non-auth branch: profile resolution ─────────────────────────────────
+    // F1: respect explicit CODEX_HOME unless CCS_CODEX_PROFILE asks for a managed profile.
+    const explicit = (process.env.CODEX_HOME ?? '').trim();
+    const profileOverride = (process.env.CCS_CODEX_PROFILE ?? '').trim();
+    if (!explicit || profileOverride) {
+        try {
+            const { resolveActiveProfile } = require('../codex-auth/resolve-active-profile');
+            const resolved = resolveActiveProfile(process.env);
+            if (resolved) {
+                if (explicit && explicit !== resolved.dir) {
+                    process.stderr.write(`[!] codex-auth: CCS_CODEX_PROFILE=${profileOverride} overrides existing CODEX_HOME.\n`);
+                }
+                process.env.CODEX_HOME = resolved.dir;
+                try {
+                    const { ensureSharedConfigSymlink } = require('../codex-auth/codex-config-symlink');
+                    ensureSharedConfigSymlink(resolved.dir);
+                }
+                catch (symlinkErr) {
+                    const msg = symlinkErr instanceof Error ? symlinkErr.message : String(symlinkErr);
+                    process.stderr.write(`[!] codex-auth: shared config symlink failed (${msg}), continuing\n`);
+                }
+            }
+        }
+        catch (resolverErr) {
+            const msg = errorMessage(resolverErr);
+            if (isCodexAuthProfileResolutionError(resolverErr)) {
+                process.stderr.write(`[X] codex-auth: ${msg}\n`);
+                return 1;
+            }
+            process.stderr.write(`[X] codex-auth: profile resolution failed (${msg})\n`);
+            return 1;
+        }
+    }
+    // ── delegate to CCS ─────────────────────────────────────────────────────
+    // require() is evaluated AFTER env mutations above. CCS manages its own
+    // process lifecycle (spawns codex, pipes stdio, calls process.exit).
+    // Return -1 so the entry script knows NOT to call process.exit().
+    require('../ccs');
+    return -1; // CCS is in control — entry must not call process.exit()
+}
+exports.main = main;
+//# sourceMappingURL=codex-runtime-router.js.map

package/dist/bin/codex-runtime-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-runtime-router.js","sourceRoot":"","sources":["../../src/bin/codex-runtime-router.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,OAAO,CAAC;AAEhD,SAAS,iCAAiC,CAAC,GAAY;IACrD,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAA0B,CAAC,IAAI,KAAK,iCAAiC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;QACvD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,2EAA2E;IAC3E,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,iCAAiC,CAEjE,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IAE3E,uFAAuF;IACvF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,sCAAsC,CAI9E,CAAC;YACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,eAAe,mCAAmC,CACxF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC;gBAEtC,IAAI,CAAC;oBACH,MAAM,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC,oCAAoC,CAEjF,CAAC;oBACF,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,GAAG,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,GAAG,iBAAiB,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,iCAAiC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;gBACjD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,GAAG,KAAK,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,kEAAkE;IAClE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElB,OAAO,CAAC,CAAC,CAAC,CAAC,yDAAyD;AACtE,CAAC;AA9DD,oBA8DC"}

package/dist/bin/codex-runtime.d.ts

@@ -1 +1,2 @@
+export {};
 //# sourceMappingURL=codex-runtime.d.ts.map

package/dist/bin/codex-runtime.js

@@ -1,5 +1,10 @@
 #!/usr/bin/env node
 "use strict";
-process.env.CCS_INTERNAL_ENTRY_TARGET = 'codex';
-require('../ccs');
+Object.defineProperty(exports, "__esModule", { value: true });
+const codex_runtime_router_1 = require("./codex-runtime-router");
+// -1 means CCS has taken over the process lifecycle; do not exit.
+(0, codex_runtime_router_1.main)(process.argv).then((code) => {
+    if (code >= 0)
+        process.exit(code);
+});
 //# sourceMappingURL=codex-runtime.js.map

package/dist/bin/codex-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-runtime.js","sourceRoot":"","sources":["../../src/bin/codex-runtime.ts"],"names":[],"mappings":";AAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,OAAO,CAAC;AAChD,OAAO,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"codex-runtime.js","sourceRoot":"","sources":["../../src/bin/codex-runtime.ts"],"names":[],"mappings":";;AAAA,iEAA8C;AAC9C,kEAAkE;AAClE,IAAA,2BAAI,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IAC/B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC"}

package/dist/codex-auth/codex-account-identity.d.ts

@@ -0,0 +1,8 @@
+import type { CodexAccountIdentity } from './types';
+/**
+ * Read auth.json from disk and extract display-safe identity fields.
+ * Returns {} on any error (missing file, bad JSON, missing token, decode failure).
+ * Never throws.
+ */
+export declare function decodeAccountIdentity(authJsonPath: string): CodexAccountIdentity;
+//# sourceMappingURL=codex-account-identity.d.ts.map

package/dist/codex-auth/codex-account-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-account-identity.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-account-identity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAUpD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAiBhF"}

package/dist/codex-auth/codex-account-identity.js

@@ -0,0 +1,53 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeAccountIdentity = void 0;
+const fs = __importStar(require("fs"));
+const logging_1 = require("../services/logging");
+const decode_id_token_1 = require("./decode-id-token");
+const logger = (0, logging_1.createLogger)('codex-auth:identity');
+/**
+ * Read auth.json from disk and extract display-safe identity fields.
+ * Returns {} on any error (missing file, bad JSON, missing token, decode failure).
+ * Never throws.
+ */
+function decodeAccountIdentity(authJsonPath) {
+    try {
+        const raw = fs.readFileSync(authJsonPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        const idToken = parsed?.tokens?.id_token;
+        if (typeof idToken !== 'string' || idToken.length === 0) {
+            return {};
+        }
+        return (0, decode_id_token_1.decodeIdToken)(idToken);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn('codex-auth.identity.decode-failed', `Failed to decode account identity from ${authJsonPath}: ${msg}`);
+        return {};
+    }
+}
+exports.decodeAccountIdentity = decodeAccountIdentity;
+//# sourceMappingURL=codex-account-identity.js.map

package/dist/codex-auth/codex-account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-account-identity.js","sourceRoot":"","sources":["../../src/codex-auth/codex-account-identity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,iDAAmD;AACnD,uDAAkD;AAGlD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,qBAAqB,CAAC,CAAC;AAQnD;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,IAAA,+BAAa,EAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CACT,mCAAmC,EACnC,0CAA0C,YAAY,KAAK,GAAG,EAAE,CACjE,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAjBD,sDAiBC"}

package/dist/codex-auth/codex-auth-dashboard-service.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Dashboard service for codex-auth profile summary.
+ *
+ * Reads the profile registry, decodes each profile's auth.json JWT,
+ * resolves the active profile via env precedence, and returns the
+ * API response shape for GET /api/codex/profiles.
+ *
+ * Security: tokens NEVER appear in the returned object. Only display-safe
+ * fields (email, plan, accountId) are extracted from JWT. auth.json is
+ * read/decoded and then discarded.
+ *
+ * Cache: 5-second in-memory cache reduces full registry/auth reads during
+ * dashboard polling, but each call still stats the registry so corruption or
+ * edits are surfaced immediately instead of serving stale success.
+ */
+export interface CodexAuthProfileEntry {
+    name: string;
+    codexHome: string;
+    email: string | null;
+    plan: string | null;
+    accountId: string | null;
+    lastUsed: string | null;
+    authValid: boolean;
+}
+export interface CodexAuthActiveProfile {
+    name: string | null;
+    source: 'default' | 'env' | 'explicit-codex-home';
+    codexHome: string;
+}
+export interface CodexAuthProfilesSummary {
+    active: CodexAuthActiveProfile | null;
+    default: string | null;
+    profiles: CodexAuthProfileEntry[];
+}
+/**
+ * Invalidate the in-process cache so the next call re-reads from disk.
+ * Useful for Phase 2 CLI commands running in the same process as the dashboard.
+ * Out-of-process invocations rely on the 5s TTL.
+ */
+export declare function invalidateCodexAuthProfilesCache(): void;
+/**
+ * Returns the codex-auth profiles summary, using a 5s in-memory cache.
+ * Tokens are never included in the returned object.
+ */
+export declare function getCodexAuthProfilesSummary(): Promise<CodexAuthProfilesSummary>;
+//# sourceMappingURL=codex-auth-dashboard-service.d.ts.map

package/dist/codex-auth/codex-auth-dashboard-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-dashboard-service.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-auth-dashboard-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,KAAK,GAAG,qBAAqB,CAAC;IAClD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CACnC;AAWD;;;;GAIG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAmLD;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,wBAAwB,CAAC,CASrF"}

package/dist/codex-auth/codex-auth-dashboard-service.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Dashboard service for codex-auth profile summary.
+ *
+ * Reads the profile registry, decodes each profile's auth.json JWT,
+ * resolves the active profile via env precedence, and returns the
+ * API response shape for GET /api/codex/profiles.
+ *
+ * Security: tokens NEVER appear in the returned object. Only display-safe
+ * fields (email, plan, accountId) are extracted from JWT. auth.json is
+ * read/decoded and then discarded.
+ *
+ * Cache: 5-second in-memory cache reduces full registry/auth reads during
+ * dashboard polling, but each call still stats the registry so corruption or
+ * edits are surfaced immediately instead of serving stale success.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCodexAuthProfilesSummary = exports.invalidateCodexAuthProfilesCache = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logging_1 = require("../services/logging");
+const codex_account_identity_1 = require("./codex-account-identity");
+const decode_id_token_1 = require("./decode-id-token");
+const codex_profile_paths_1 = require("./codex-profile-paths");
+const types_1 = require("./types");
+const codex_profile_registry_1 = require("./codex-profile-registry");
+const logger = (0, logging_1.createLogger)('codex-auth:dashboard');
+// ── Cache ───────────────────────────────────────────────────────────────────
+let cache = null;
+const TTL_MS = 5000;
+/**
+ * Invalidate the in-process cache so the next call re-reads from disk.
+ * Useful for Phase 2 CLI commands running in the same process as the dashboard.
+ * Out-of-process invocations rely on the 5s TTL.
+ */
+function invalidateCodexAuthProfilesCache() {
+    cache = null;
+}
+exports.invalidateCodexAuthProfilesCache = invalidateCodexAuthProfilesCache;
+// ── Registry helpers ────────────────────────────────────────────────────────
+function getRegistryCacheSignature() {
+    const registryPath = (0, codex_profile_paths_1.getCodexAuthRegistryPath)();
+    try {
+        const stat = fs.statSync(registryPath);
+        return ['present', stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs].join(':');
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT') {
+            return 'missing';
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn('codex-auth.dashboard.registry-stat-failed', `Registry stat failed: ${msg}`);
+        throw new Error('Codex auth profile registry could not be checked safely');
+    }
+}
+function readRegistry() {
+    const registryPath = (0, codex_profile_paths_1.getCodexAuthRegistryPath)();
+    if (!fs.existsSync(registryPath)) {
+        return { version: types_1.CODEX_PROFILE_SCHEMA_VERSION, default: null, profiles: {} };
+    }
+    try {
+        const registry = new codex_profile_registry_1.CodexProfileRegistry(registryPath);
+        const profiles = {};
+        for (const name of registry.listProfiles()) {
+            profiles[name] = registry.getProfile(name);
+        }
+        return {
+            version: types_1.CODEX_PROFILE_SCHEMA_VERSION,
+            default: registry.getDefault(),
+            profiles,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn('codex-auth.dashboard.registry-read-failed', `Registry read failed: ${msg}`);
+        throw new Error(`Codex auth profile registry could not be read safely: ${msg}`);
+    }
+}
+// ── Profile entry builder ───────────────────────────────────────────────────
+function buildProfileEntry(name) {
+    const codexHome = path.join((0, codex_profile_paths_1.getCodexInstancesDir)(), name);
+    const authJsonPath = path.join(codexHome, 'auth.json');
+    let authValid = false;
+    let email = null;
+    let plan = null;
+    let accountId = null;
+    try {
+        if (fs.existsSync(authJsonPath)) {
+            // decodeAccountIdentity never throws; returns {} on any error
+            const identity = (0, codex_account_identity_1.decodeAccountIdentity)(authJsonPath);
+            authValid = Object.keys(identity).length > 0 || _hasStructurallyValidIdToken(authJsonPath);
+            email = identity.email ?? null;
+            plan = identity.plan_type ?? null;
+            accountId = identity.account_id ?? null;
+            logger.debug('codex-auth.dashboard.decoded', 'Decoded auth profile summary', {
+                profileName: name,
+                hasEmail: email !== null,
+                hasPlan: plan !== null,
+                hasAccountId: accountId !== null,
+            });
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn('codex-auth.dashboard.decode-error', `Failed to decode auth for profile=${name}: ${msg}`);
+    }
+    return {
+        name,
+        codexHome,
+        email,
+        plan,
+        accountId,
+        // lastUsed is set below by caller from registry metadata
+        lastUsed: null,
+        authValid,
+    };
+}
+/**
+ * Check whether auth.json has a parseable JWT payload, even if it has no
+ * display fields. A non-empty but malformed token is not valid auth.
+ * This sets authValid=true for valid-but-sparse tokens.
+ */
+function _hasStructurallyValidIdToken(authJsonPath) {
+    try {
+        const raw = fs.readFileSync(authJsonPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        const idToken = parsed?.tokens?.id_token;
+        return typeof idToken === 'string' && (0, decode_id_token_1.hasStructurallyValidIdToken)(idToken);
+    }
+    catch {
+        return false;
+    }
+}
+// ── Active resolution ───────────────────────────────────────────────────────
+function resolveActive(registry) {
+    const instancesDir = (0, codex_profile_paths_1.getCodexInstancesDir)();
+    // Precedence 1: explicit $CODEX_HOME set by env (ccsxp, manual)
+    const codexHome = (process.env.CODEX_HOME ?? '').trim();
+    if (codexHome) {
+        // Attempt reverse-map: does any registered profile's codexHome match?
+        const matchedName = Object.keys(registry.profiles).find((name) => path.join(instancesDir, name) === codexHome) ??
+            null;
+        return {
+            name: matchedName,
+            source: 'explicit-codex-home',
+            codexHome,
+        };
+    }
+    // Precedence 2: $CCS_CODEX_PROFILE env var
+    const profileEnv = (process.env.CCS_CODEX_PROFILE ?? '').trim();
+    if (profileEnv) {
+        if (!Object.prototype.hasOwnProperty.call(registry.profiles, profileEnv)) {
+            logger.warn('codex-auth.dashboard.stale-env-profile', 'Ignoring CCS_CODEX_PROFILE because it is not registered', { profileName: profileEnv });
+            return null;
+        }
+        return {
+            name: profileEnv,
+            source: 'env',
+            codexHome: path.join(instancesDir, profileEnv),
+        };
+    }
+    // Precedence 3: registry default
+    const defaultProfile = registry.default;
+    if (defaultProfile) {
+        return {
+            name: defaultProfile,
+            source: 'default',
+            codexHome: path.join(instancesDir, defaultProfile),
+        };
+    }
+    // Precedence 4: no active profile (legacy ~/.codex mode)
+    return null;
+}
+// ── Core builder ────────────────────────────────────────────────────────────
+async function buildSummary() {
+    const registry = readRegistry();
+    const active = resolveActive(registry);
+    const profiles = Object.entries(registry.profiles).map(([name, meta]) => {
+        const entry = buildProfileEntry(name);
+        entry.lastUsed = meta.last_used ?? null;
+        return entry;
+    });
+    return {
+        active,
+        default: registry.default,
+        profiles,
+    };
+}
+// ── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Returns the codex-auth profiles summary, using a 5s in-memory cache.
+ * Tokens are never included in the returned object.
+ */
+async function getCodexAuthProfilesSummary() {
+    const now = Date.now();
+    const registrySignature = getRegistryCacheSignature();
+    if (cache && cache.expiresAt > now && cache.registrySignature === registrySignature) {
+        return cache.value;
+    }
+    const value = await buildSummary();
+    cache = { value, expiresAt: now + TTL_MS, registrySignature };
+    return value;
+}
+exports.getCodexAuthProfilesSummary = getCodexAuthProfilesSummary;
+//# sourceMappingURL=codex-auth-dashboard-service.js.map

package/dist/codex-auth/codex-auth-dashboard-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-dashboard-service.js","sourceRoot":"","sources":["../../src/codex-auth/codex-auth-dashboard-service.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,iDAAmD;AACnD,qEAAiE;AACjE,uDAAgE;AAChE,+DAAuF;AACvF,mCAAuD;AACvD,qEAAgE;AAGhE,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,sBAAsB,CAAC,CAAC;AA0BpD,+EAA+E;AAE/E,IAAI,KAAK,GAIE,IAAI,CAAC;AAChB,MAAM,MAAM,GAAG,IAAI,CAAC;AAEpB;;;;GAIG;AACH,SAAgB,gCAAgC;IAC9C,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAFD,4EAEC;AAED,+EAA+E;AAE/E,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,IAAA,8CAAwB,GAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyC,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,YAAY,GAAG,IAAA,8CAAwB,GAAE,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,oCAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,6CAAoB,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAyC,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO;YACL,OAAO,EAAE,oCAA4B;YACrC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC9B,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,0CAAoB,GAAE,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEvD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,IAAA,8CAAqB,EAAC,YAAY,CAAC,CAAC;YACrD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC3F,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC;YAC/B,IAAI,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC;YAClC,SAAS,GAAG,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,8BAA8B,EAAE;gBAC3E,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,KAAK,KAAK,IAAI;gBACxB,OAAO,EAAE,IAAI,KAAK,IAAI;gBACtB,YAAY,EAAE,SAAS,KAAK,IAAI;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CACT,mCAAmC,EACnC,qCAAqC,IAAI,KAAK,GAAG,EAAE,CACpD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,SAAS;QACT,KAAK;QACL,IAAI;QACJ,SAAS;QACT,yDAAyD;QACzD,QAAQ,EAAE,IAAI;QACd,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACzC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAA,6CAA2B,EAAC,OAAO,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,SAAS,aAAa,CAAC,QAA0B;IAC/C,MAAM,YAAY,GAAG,IAAA,0CAAoB,GAAE,CAAC;IAE5C,gEAAgE;IAChE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,SAAS,EAAE,CAAC;QACd,sEAAsE;QACtE,MAAM,WAAW,GACf,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC;YAC1F,IAAI,CAAC;QACP,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,qBAAqB;YAC7B,SAAS;SACV,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,IAAI,CACT,wCAAwC,EACxC,yDAAyD,EACzD,EAAE,WAAW,EAAE,UAAU,EAAE,CAC5B,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC;IACxC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,YAAY;IACzB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAA4B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAC7E,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC,CACF,CAAC;IAEF,OAAO;QACL,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACI,KAAK,UAAU,2BAA2B;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,iBAAiB,GAAG,yBAAyB,EAAE,CAAC;IACtD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,IAAI,KAAK,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AATD,kEASC"}

package/dist/codex-auth/codex-auth-help.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Help text for `ccsx auth` command tree.
+ * ASCII-only. Includes ccsxp scope clarifier (H5).
+ */
+export declare function printCodexAuthHelp(): void;
+export declare function printCodexAuthUseHelp(): void;
+//# sourceMappingURL=codex-auth-help.d.ts.map

package/dist/codex-auth/codex-auth-help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-help.d.ts","sourceRoot":"","sources":["../../src/codex-auth/codex-auth-help.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,kBAAkB,IAAI,IAAI,CAkDzC;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAyB5C"}