@makaio/client-codex 1.0.0-dev-1781368205459 → 1.0.0-dev-1783940945655

package/dist/{codex-client-session-service-C2F6rQDS.mjs → codex-client-session-service-ddd3K0rw.mjs}

@@ -7,9 +7,12 @@ import * as fs$1 from "node:fs/promises";
 import fs from "node:fs/promises";
 import * as path$1 from "node:path";
 import path from "node:path";
+import * as os$1 from "node:os";
 import os from "node:os";
-import { randomUUID } from "node:crypto";
-import { ClientConfigPrimeSchema, SessionConfigSetupRequestSchema, SessionConfigSetupResponseSchema } from "@makaio/framework/contracts/client";
+import { createHash, randomUUID } from "node:crypto";
+import { ClientConfigPrimeSchema, SessionConfigSetupRequestSchema, SessionConfigSetupResponseSchema, SessionConfigTeardownRequestSchema, SessionConfigTeardownResponseSchema } from "@makaio/framework/contracts/client";
+import { parse } from "smol-toml";
+import { lock } from "proper-lockfile";
 
 //#region src/definition.ts
 /**
@@ -67,7 +70,29 @@ const clientDefinition = createClientDefinition({
 		capabilities: (codexCapabilityMap.patch ?? []).map((tag) => ({ tag }))
 	}],
 	defaultApprovalPolicy: "full-access",
-	defaultProviderId: "openai-codex",
+	authMethods: [{
+		id: "native",
+		mode: "inferred",
+		label: "Native account"
+	}, {
+		id: "access-token",
+		mode: "explicit",
+		label: "Access token",
+		fields: [{
+			id: "accessToken",
+			label: "Access token",
+			required: true,
+			secret: true,
+			sourceHints: [{
+				kind: "environment",
+				variable: "CODEX_ACCESS_TOKEN"
+			}]
+		}]
+	}],
+	defaultAuth: {
+		providerDefinitionId: "openai-codex",
+		methodId: "native"
+	},
 	runtimeCapabilities: {
 		supportsHooks: true,
 		supportsStatusline: false,
@@ -994,10 +1019,14 @@ function extractPrompt(payload) {
 * Returns `null` for unknown or not-yet-modeled event names so the caller
 * skips global emission and keeps the event raw-only in `client:codex.*`.
 * @param raw - Raw hook payload delivered on `client:codex.hook.received`
+* @param machineId - Stable runtime identity of the observing machine,
+*   caller-supplied by the owning client runtime. Stamped onto
+*   `client.session.started` so downstream storage receives the owning
+*   machine's identity without deriving it from the writer process.
 * @returns Normalized event with subject and typed payload, or `null` when
 *   the event name is unknown
 */
-function normalizeCodexHook(raw) {
+function normalizeCodexHook(raw, machineId) {
 	const subject = CODEX_EVENT_MAP.get(raw.eventName);
 	if (subject === void 0) return null;
 	const base = {
@@ -1010,7 +1039,10 @@ function normalizeCodexHook(raw) {
 	switch (subject) {
 		case ClientSubjects.session.started: return {
 			subject,
-			payload: { ...base }
+			payload: {
+				...base,
+				...machineId !== void 0 && { machineId }
+			}
 		};
 		case ClientSubjects.session.userPrompt.submitted: return {
 			subject,
@@ -1063,6 +1095,7 @@ function normalizeCodexHook(raw) {
 * - `wiring.apply` — install wiring entries into the target scope
 * - `wiring.remove` — uninstall wiring entries from the target scope
 * - `sessionConfig.setup` — seed an isolated session config directory
+* - `sessionConfig.destroy` — reconcile and clear isolated native auth
 *
 * **Subject conventions:**
 * - Raw Codex-native events flow in the `client:codex.*` namespace only.
@@ -1077,6 +1110,10 @@ const { subjects, namespaceDomain } = createClientNamespace("codex", {
 	"sessionConfig.setup": {
 		request: SessionConfigSetupRequestSchema,
 		response: SessionConfigSetupResponseSchema
+	},
+	"sessionConfig.destroy": {
+		request: SessionConfigTeardownRequestSchema,
+		response: SessionConfigTeardownResponseSchema
 	}
 });
 /**
@@ -1094,6 +1131,7 @@ const { subjects, namespaceDomain } = createClientNamespace("codex", {
 * - `CodexClientSubjects.wiring.apply` → `client:codex.wiring.apply`
 * - `CodexClientSubjects.wiring.remove` → `client:codex.wiring.remove`
 * - `CodexClientSubjects.sessionConfig.setup` → `client:codex.sessionConfig.setup`
+* - `CodexClientSubjects.sessionConfig.destroy` → `client:codex.sessionConfig.destroy`
 */
 const CodexClientSubjects = subjects;
 /**
@@ -1104,70 +1142,1017 @@ const CodexClientSubjects = subjects;
 const CODEX_CLIENT_NAMESPACE = namespaceDomain;
 
 //#endregion
-//#region src/runtime/session-config-handler.ts
+//#region src/runtime/native-auth-errors.ts
 /**
-* Codex session config setup handler.
-*
-* Implements the `client:codex.sessionConfig.setup` delegation request by
-* materializing the Codex config files needed for an isolated session
-* directory.
+* Secret-safe error helpers for Codex native authentication storage.
+* @packageDocumentation
+*/
+/**
+* Build an error that preserves a safe discriminator but never the secret-bearing message.
+* @param operation - Safe operation label.
+* @param error - Original failure, whose message is deliberately discarded.
+* @returns Sanitized error safe for bus propagation and logs.
+*/
+function sanitizedNativeAuthError(operation, error) {
+	const errorName = error instanceof Error && error.name ? error.name : "UnknownError";
+	const code = error?.code;
+	const safeCode = typeof code === "string" || typeof code === "number" ? `/${String(code)}` : "";
+	return /* @__PURE__ */ new Error(`Codex native-auth ${operation} failed (${errorName}${safeCode})`);
+}
+/**
+* Preserve both sanitized failures when cleanup follows an earlier error.
+* @param existing - Earlier failure, when present.
+* @param next - Newly observed sanitized failure.
+* @param message - Safe aggregate description.
+* @returns The new failure or an aggregate retaining both failures.
+*/
+function mergeNativeAuthErrors(existing, next, message) {
+	return existing === void 0 ? next : new AggregateError([existing, next], message);
+}
+
+//#endregion
+//#region src/runtime/native-keyring-credential-store.ts
+/** Load the optional native keyring addon only when a keyring operation runs. */
+let nativeKeyringModule;
+/**
+* Create one native keyring entry without evaluating the addon on file-only paths.
+* @param service - Keyring service name.
+* @param account - Keyring account name.
+* @returns Native asynchronous keyring entry.
+*/
+async function createNativeKeyringEntry(service, account) {
+	nativeKeyringModule ??= import("@napi-rs/keyring");
+	const { AsyncEntry } = await nativeKeyringModule;
+	return new AsyncEntry(service, account);
+}
+/**
+* Check the portable keyring binding's missing-entry discriminator.
+* @param error - Keyring operation failure.
+* @returns Whether the keyring reports an absent entry.
+*/
+function isMissingKeyringEntry(error) {
+	return error instanceof Error && error.name === "NoEntry";
+}
+/** Native cross-platform keyring implementation matching Codex's keyring-rs store. */
+const nativeKeyringCredentialStore = {
+	async read(service, account) {
+		try {
+			return await (await createNativeKeyringEntry(service, account)).getPassword() ?? null;
+		} catch (error) {
+			if (isMissingKeyringEntry(error)) return null;
+			throw error;
+		}
+	},
+	async write(service, account, value) {
+		await (await createNativeKeyringEntry(service, account)).setPassword(value);
+	},
+	async delete(service, account) {
+		try {
+			await (await createNativeKeyringEntry(service, account)).deleteCredential();
+		} catch (error) {
+			if (!isMissingKeyringEntry(error)) throw error;
+		}
+	}
+};
+
+//#endregion
+//#region src/runtime/native-auth-source-lock.ts
+/**
+* Canonical Codex native-auth identity and source-lock primitives.
+* @packageDocumentation
+*/
+/** Secret-free cross-process lock-directory suffix beside canonical CODEX_HOME. */
+const CODEX_AUTH_CAS_LOCK_FILE = ".makaio-codex-auth-cas.lock";
+/** Lock finalization failed after the guarded native-auth operation committed. */
+var CodexNativeAuthSourceLockFinalizationError = class extends Error {
+	constructor() {
+		super("Codex native-auth source lock is uncertain after committed operation");
+		this.name = "CodexNativeAuthSourceLockFinalizationError";
+	}
+};
+/** Lock freshness and retry policy shared by every Codex native-auth CAS. */
+const CODEX_AUTH_CAS_LOCK_OPTIONS = {
+	stale: 3e4,
+	update: 1e4,
+	retries: {
+		retries: 50,
+		factor: 1,
+		minTimeout: 20,
+		maxTimeout: 100
+	}
+};
+/**
+* Resolve the canonical identity shared by Codex file and keyring auth stores.
+* @param codexHome - CODEX_HOME path.
+* @returns Canonical path plus Codex's derived keyring account.
+*/
+async function identifyCodexAuthHome(codexHome) {
+	return createCodexAuthHomeIdentity(await canonicalizeCodexHome(codexHome));
+}
+/**
+* Derive a cleanup-only identity from the normalized input path.
 *
-* The handler copies `config.toml` and `auth.json` from the base config
-* directory (when present) into the session-scoped directory, then primes the
-* session directory to ensure `check_for_update_on_startup = false` is set.
+* This deliberately performs no `realpath` lookup. A lease directory may have
+* disappeared or been replaced by a symlink before restart cleanup; following
+* that new target could delete an unrelated canonical keyring credential.
+* @param codexHome - Original lease CODEX_HOME path.
+* @returns Lexically normalized identity safe for conservative keyring cleanup.
+*/
+function identifyCodexAuthHomeLexically(codexHome) {
+	return createCodexAuthHomeIdentity(path$1.resolve(codexHome));
+}
+/**
+* Inspect a lease target while rejecting a symlink or non-directory final path.
+* @param codexHome - Isolated lease CODEX_HOME path.
+* @returns Stable canonical identity, or a cleanup-only lexical fallback.
+*/
+async function inspectCodexLeaseTarget(codexHome) {
+	const fallbackIdentity = identifyCodexAuthHomeLexically(codexHome);
+	let before;
+	try {
+		before = await fs$1.lstat(codexHome);
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			status: "missing",
+			fallbackIdentity
+		};
+		throw sanitizedNativeAuthError("lease target inspection", error);
+	}
+	if (before.isSymbolicLink() || !before.isDirectory()) return {
+		status: "unsafe",
+		fallbackIdentity
+	};
+	const identity = await identifyCodexAuthHome(codexHome);
+	let after;
+	try {
+		after = await fs$1.lstat(codexHome);
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			status: "unsafe",
+			fallbackIdentity
+		};
+		throw sanitizedNativeAuthError("lease target verification", error);
+	}
+	if (after.isSymbolicLink() || !after.isDirectory() || before.dev !== after.dev || before.ino !== after.ino) return {
+		status: "unsafe",
+		fallbackIdentity
+	};
+	return {
+		status: "safe",
+		identity
+	};
+}
+/**
+* Serialize one canonical Codex native-auth mutation by CODEX_HOME.
 *
-* When `sessionDir` and `baseConfigDir` resolve to the same path (the
-* framework passes `sessionDir` as `baseConfigDir` when no profile is
-* configured) the copy step is skipped and only the prime step runs.
+* Account integrations and session-lease compare-and-swap operations must use
+* this same lock so a lease cannot overwrite a concurrently selected account.
+* @param codexHome - Canonical Codex config home whose auth source is mutated.
+* @param operation - Source operation that must retain exclusive ownership.
+* @returns Operation result after the source lock is released.
+*/
+async function withCodexNativeAuthSourceLock(codexHome, operation) {
+	const result = await executeCodexNativeAuthSourceLock(codexHome, operation);
+	if (result.coordination === "uncertain") throw new CodexNativeAuthSourceLockFinalizationError();
+	return result.value;
+}
+/**
+* Execute against one CODEX_HOME while preserving committed operation results
+* when lock finalization becomes uncertain.
+* @param codexHome - Canonical Codex config home.
+* @param operation - Native-auth operation guarded by the source lock.
+* @returns Operation value plus released/uncertain coordination state.
+*/
+async function executeCodexNativeAuthSourceLock(codexHome, operation) {
+	return executeIdentifiedCodexNativeAuthSourceLock(await identifyCodexAuthHome(codexHome), operation);
+}
+/**
+* Serialize one operation against an already-pinned Codex auth identity.
+* @param identity - Canonical source CODEX_HOME identity.
+* @param operation - Source operation that must retain exclusive ownership.
+* @returns Operation result after the source lock is released.
+*/
+async function withIdentifiedCodexNativeAuthSourceLock(identity, operation) {
+	const result = await executeIdentifiedCodexNativeAuthSourceLock(identity, operation);
+	if (result.coordination === "uncertain") throw new CodexNativeAuthSourceLockFinalizationError();
+	return result.value;
+}
+/**
+* Execute against an already-pinned identity and retain post-commit lock state.
+* @param identity - Canonical source CODEX_HOME identity.
+* @param operation - Native-auth operation guarded by the source lock.
+* @returns Operation value plus released/uncertain coordination state.
+*/
+async function executeIdentifiedCodexNativeAuthSourceLock(identity, operation) {
+	if (!inspectionMatchesIdentity(await inspectCodexLeaseTarget(identity.canonicalPath), identity)) throw new Error("Codex native-auth source identity is no longer a stable directory");
+	let compromisedError;
+	let release;
+	try {
+		release = await lock(identity.canonicalPath, {
+			realpath: false,
+			lockfilePath: buildCodexNativeAuthSourceLockPath(identity.canonicalPath),
+			...CODEX_AUTH_CAS_LOCK_OPTIONS,
+			onCompromised: (error) => {
+				compromisedError = sanitizedNativeAuthError("source lock compromised", error);
+			}
+		});
+	} catch (error) {
+		throw sanitizedNativeAuthError("source lock acquisition", error);
+	}
+	let outcome;
+	if (compromisedError !== void 0) outcome = {
+		status: "rejected",
+		reason: compromisedError
+	};
+	else try {
+		if (!inspectionMatchesIdentity(await inspectCodexLeaseTarget(identity.canonicalPath), identity)) throw new Error("Codex native-auth source identity changed before operation");
+		outcome = {
+			status: "fulfilled",
+			value: await operation()
+		};
+	} catch (reason) {
+		outcome = {
+			status: "rejected",
+			reason
+		};
+	}
+	let releaseError;
+	try {
+		await release();
+	} catch (error) {
+		releaseError = sanitizedNativeAuthError("source lock release", error);
+	}
+	if (outcome.status === "rejected") {
+		let operationError = outcome.reason;
+		if (compromisedError !== void 0 && operationError !== compromisedError) operationError = mergeNativeAuthErrors(operationError, compromisedError, "Codex native-auth operation and source lock compromise both failed");
+		if (releaseError !== void 0) operationError = mergeNativeAuthErrors(operationError, releaseError, "Codex native-auth operation and source lock release both failed");
+		throw operationError;
+	}
+	return {
+		value: outcome.value,
+		coordination: compromisedError !== void 0 || releaseError !== void 0 ? "uncertain" : "released"
+	};
+}
+/**
+* Build a sibling lock anchor that survives CODEX_HOME rename/replacement.
+* @param canonicalPath - Canonical CODEX_HOME path.
+* @returns Secret-free sibling lock directory path.
+*/
+function buildCodexNativeAuthSourceLockPath(canonicalPath) {
+	return `${canonicalPath}${CODEX_AUTH_CAS_LOCK_FILE}`;
+}
+/**
+* Verify a present or absent source still represents the pinned lexical identity.
+* @param inspection - Current safety inspection for the source path.
+* @param identity - Identity pinned before lock acquisition.
+* @returns Whether the inspected path still represents the pinned identity.
+*/
+function inspectionMatchesIdentity(inspection, identity) {
+	if (inspection.status === "unsafe") return false;
+	const inspectedIdentity = inspection.status === "safe" ? inspection.identity : inspection.fallbackIdentity;
+	return inspectedIdentity.canonicalPath === identity.canonicalPath && inspectedIdentity.keyringAccount === identity.keyringAccount;
+}
+/**
+* Build the exact Codex keyring identity for one already-normalized path.
+* @param canonicalPath - Canonical or deliberately lexical absolute path.
+* @returns Path plus `cli|sha256(path).slice(0, 16)` account.
+*/
+function createCodexAuthHomeIdentity(canonicalPath) {
+	return {
+		canonicalPath,
+		keyringAccount: `cli|${createHash("sha256").update(canonicalPath).digest("hex").slice(0, 16)}`
+	};
+}
+/**
+* Canonicalize CODEX_HOME exactly as Codex does, falling back when absent.
+* @param codexHome - Candidate CODEX_HOME path.
+* @returns Canonical path, or the absolute input path when absent.
+*/
+async function canonicalizeCodexHome(codexHome) {
+	try {
+		return await fs$1.realpath(codexHome);
+	} catch (error) {
+		if (error.code === "ENOENT") return path$1.resolve(codexHome);
+		throw sanitizedNativeAuthError("CODEX_HOME canonicalization", error);
+	}
+}
+
+//#endregion
+//#region src/runtime/native-auth-store.ts
+/**
+* Codex native authentication storage primitives.
 *
-* Returns `{ env: { CODEX_HOME: sessionDir } }` so the spawned Codex process
-* inherits the isolated session directory as its configuration root.
+* Mirrors Codex App Server 0.130's `file`, `keyring`, and `auto` credential
+* store semantics without interpreting credential payloads. Credential values
+* remain inside this client-owned runtime boundary; the only persisted lease
+* state contains store identities and SHA-256 digests.
 * @packageDocumentation
 */
+/** Codex's fixed keyring service name for CLI authentication. */
+const CODEX_AUTH_KEYRING_SERVICE = "Codex Auth";
+/** Non-secret lease metadata file stored inside the isolated CODEX_HOME. */
+const CODEX_AUTH_LEASE_METADATA_FILE = ".makaio-codex-auth-lease.json";
+const CodexAuthHomeIdentitySchema = z.object({
+	canonicalPath: z.string().refine((value) => path$1.isAbsolute(value), "Expected an absolute path"),
+	keyringAccount: z.string().regex(/^cli\|[0-9a-f]{16}$/)
+}).strict().superRefine((identity, ctx) => {
+	const expected = `cli|${createHash("sha256").update(identity.canonicalPath).digest("hex").slice(0, 16)}`;
+	if (identity.keyringAccount !== expected) ctx.addIssue({
+		code: "custom",
+		message: "Keyring account does not match canonical CODEX_HOME"
+	});
+});
+const DigestSchema = z.string().regex(/^[0-9a-f]{64}$/);
+/** Strict schema for the secret-free native auth lease generation. */
+const CodexAuthLeaseMetadataSchema = z.object({
+	version: z.literal(1),
+	backend: z.object({
+		configured: z.enum([
+			"none",
+			"file",
+			"keyring",
+			"auto"
+		]),
+		effective: z.enum([
+			"none",
+			"file",
+			"keyring"
+		])
+	}).strict(),
+	canonicalIdentity: CodexAuthHomeIdentitySchema.nullable(),
+	targetIdentity: CodexAuthHomeIdentitySchema,
+	sourceGenerationDigest: DigestSchema.nullable(),
+	initialTargetDigest: DigestSchema.nullable()
+}).strict().superRefine((metadata, ctx) => {
+	if (metadata.backend.effective !== "none" !== (metadata.canonicalIdentity !== null && metadata.sourceGenerationDigest !== null && metadata.initialTargetDigest !== null)) ctx.addIssue({
+		code: "custom",
+		message: "Materialized metadata must carry one complete generation"
+	});
+	if (metadata.sourceGenerationDigest !== null && metadata.initialTargetDigest !== null && metadata.sourceGenerationDigest !== metadata.initialTargetDigest) ctx.addIssue({
+		code: "custom",
+		message: "The initial target generation must equal the source generation"
+	});
+	if (metadata.backend.configured === "none" && metadata.backend.effective !== "none") ctx.addIssue({
+		code: "custom",
+		message: "An empty lease cannot materialize native authentication"
+	});
+	if (metadata.backend.configured === "file" && metadata.backend.effective === "keyring") ctx.addIssue({
+		code: "custom",
+		message: "File mode cannot select keyring authentication"
+	});
+	if (metadata.backend.configured === "keyring" && metadata.backend.effective === "file") ctx.addIssue({
+		code: "custom",
+		message: "Keyring mode cannot select file authentication"
+	});
+});
+/**
+* Compute a stable SHA-256 digest without interpreting the credential value.
+* @param value - Opaque credential payload.
+* @returns Lowercase hexadecimal SHA-256 digest.
+*/
+function digestCodexCredential(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
 /**
-* Copy a file if it exists at the source path; silently skip when absent.
-* @param src - Source file path.
-* @param dst - Destination file path.
+* Local native auth store used by the session config handler.
 */
-async function copyIfPresent(src, dst) {
+var CodexNativeAuthStore = class {
+	keyring;
+	/**
+	* @param keyring - Cross-platform keyring implementation.
+	*/
+	constructor(keyring = nativeKeyringCredentialStore) {
+		this.keyring = keyring;
+	}
+	/**
+	* Resolve `cli_auth_credentials_store` from the canonical config.
+	* Codex 0.130 defaults this setting to `file`.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @returns Configured credential store mode.
+	*/
+	async resolveMode(identity) {
+		const content = await readTextIfPresent(path$1.join(identity.canonicalPath, "config.toml"), "configuration read");
+		if (content === null) return "file";
+		let parsed;
+		try {
+			parsed = parse(content);
+		} catch {
+			throw new Error("Codex native-auth configuration is invalid");
+		}
+		const configured = parsed["cli_auth_credentials_store"];
+		if (configured === void 0) return "file";
+		if (configured === "file" || configured === "keyring" || configured === "auto") return configured;
+		throw new Error("Codex native-auth configuration selects an unsupported credential store");
+	}
+	/**
+	* Load a credential using Codex 0.130's configured store order.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @param mode - Configured store mode.
+	* @returns Effective credential plus keyring-fallback status.
+	*/
+	async readEffective(identity, mode) {
+		if (mode === "file") return {
+			credential: await this.readFileCredential(identity),
+			keyringUnavailable: false
+		};
+		if (mode === "keyring") return {
+			credential: await this.readKeyringCredential(identity),
+			keyringUnavailable: false
+		};
+		try {
+			const keyringCredential = await this.readKeyringCredential(identity);
+			if (keyringCredential !== null) return {
+				credential: keyringCredential,
+				keyringUnavailable: false
+			};
+		} catch {
+			return {
+				credential: await this.readFileCredential(identity),
+				keyringUnavailable: true
+			};
+		}
+		return {
+			credential: await this.readFileCredential(identity),
+			keyringUnavailable: false
+		};
+	}
+	/**
+	* Read the credential generation that should be considered for lease refresh.
+	*
+	* `auto` normally prefers keyring. During a running process, however, a
+	* transient keyring save failure can put a fresher generation in `auth.json`
+	* while the unchanged keyring entry remains. Detect that exact fallback by
+	* comparing both stores to the lease's initial generation.
+	* @param identity - Isolated target CODEX_HOME identity.
+	* @param mode - Configured store mode.
+	* @param initialDigest - Digest materialized when the lease was created.
+	* @returns Refresh candidate plus keyring availability status.
+	*/
+	async readRefreshCandidate(identity, mode, initialDigest) {
+		if (mode !== "auto") return this.readEffective(identity, mode);
+		let keyringCredential;
+		try {
+			keyringCredential = await this.readKeyringCredential(identity);
+		} catch {
+			return {
+				credential: await this.readFileCredential(identity),
+				keyringUnavailable: true
+			};
+		}
+		const fileCredential = await this.readFileCredential(identity);
+		if (keyringCredential !== null && digestCodexCredential(keyringCredential.value) !== initialDigest) return {
+			credential: keyringCredential,
+			keyringUnavailable: false
+		};
+		if (fileCredential !== null && digestCodexCredential(fileCredential.value) !== initialDigest) return {
+			credential: fileCredential,
+			keyringUnavailable: false
+		};
+		return {
+			credential: keyringCredential ?? fileCredential,
+			keyringUnavailable: false
+		};
+	}
+	/**
+	* Read one concrete backend without fallback.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @param backend - Concrete store to read.
+	* @returns Credential value, or `null` when absent.
+	*/
+	async readBackend(identity, backend) {
+		return (backend === "file" ? await this.readFileCredential(identity) : await this.readKeyringCredential(identity))?.value ?? null;
+	}
+	/**
+	* Clone an opaque value into one concrete target backend.
+	* @param identity - Target CODEX_HOME identity.
+	* @param backend - Concrete target store.
+	* @param value - Opaque credential payload.
+	*/
+	async writeBackend(identity, backend, value) {
+		if (backend === "file") {
+			await writePrivateFileAtomically(path$1.join(identity.canonicalPath, "auth.json"), value);
+			return;
+		}
+		await this.writeKeyring(identity, value);
+		await removeFileIfPresent(path$1.join(identity.canonicalPath, "auth.json"), "credential fallback removal").catch(() => void 0);
+	}
+	/**
+	* Persist a refreshed credential using Codex 0.130's save semantics.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @param mode - Configured store mode.
+	* @param value - Refreshed opaque credential payload.
+	*/
+	async saveConfigured(identity, mode, value) {
+		if (mode === "file") {
+			await this.writeBackend(identity, "file", value);
+			return;
+		}
+		if (mode === "keyring") {
+			await this.writeBackend(identity, "keyring", value);
+			return;
+		}
+		try {
+			await this.writeBackend(identity, "keyring", value);
+		} catch {
+			await this.writeBackend(identity, "file", value);
+		}
+	}
+	/**
+	* Run a generation check and conditional write under one cross-process lock.
+	* @param identity - Canonical source CODEX_HOME identity.
+	* @param operation - CAS operation to execute while the lock is held.
+	* @returns Operation result.
+	*/
+	async withSourceLock(identity, operation) {
+		return withIdentifiedCodexNativeAuthSourceLock(identity, operation);
+	}
+	/**
+	* Remove a target keyring credential.
+	* @param identity - Target CODEX_HOME identity.
+	*/
+	async deleteKeyring(identity) {
+		try {
+			await this.keyring.delete(CODEX_AUTH_KEYRING_SERVICE, identity.keyringAccount);
+		} catch (error) {
+			throw sanitizedNativeAuthError("keyring cleanup", error);
+		}
+	}
+	/**
+	* Remove the file credential from a target CODEX_HOME.
+	* @param identity - Target CODEX_HOME identity.
+	*/
+	async deleteFile(identity) {
+		await removeFileIfPresent(path$1.join(identity.canonicalPath, "auth.json"), "credential cleanup");
+	}
+	/**
+	* Atomically persist strict secret-free lease metadata with mode `0600`.
+	* @param sessionDir - Isolated CODEX_HOME.
+	* @param metadata - Validated metadata generation.
+	*/
+	async writeLeaseMetadata(sessionDir, metadata) {
+		const parsed = CodexAuthLeaseMetadataSchema.parse(metadata);
+		await writePrivateFileAtomically(path$1.join(sessionDir, CODEX_AUTH_LEASE_METADATA_FILE), `${JSON.stringify(parsed)}\n`);
+	}
+	/**
+	* Read and strictly parse secret-free lease metadata.
+	* @param sessionDir - Isolated CODEX_HOME.
+	* @returns Found, missing, or invalid outcome without echoing file contents.
+	*/
+	async readLeaseMetadata(sessionDir) {
+		let content;
+		try {
+			content = await fs$1.readFile(path$1.join(sessionDir, CODEX_AUTH_LEASE_METADATA_FILE), "utf-8");
+		} catch (error) {
+			if (error.code === "ENOENT") return { status: "missing" };
+			throw sanitizedNativeAuthError("lease metadata read", error);
+		}
+		try {
+			return {
+				status: "found",
+				metadata: CodexAuthLeaseMetadataSchema.parse(JSON.parse(content))
+			};
+		} catch {
+			return { status: "invalid" };
+		}
+	}
+	/**
+	* Read a file-backed credential.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @returns Opaque file credential, or `null` when absent.
+	*/
+	async readFileCredential(identity) {
+		const value = await readTextIfPresent(path$1.join(identity.canonicalPath, "auth.json"), "credential file read");
+		return value === null ? null : {
+			backend: "file",
+			value
+		};
+	}
+	/**
+	* Read a keyring-backed credential.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @returns Opaque keyring credential, or `null` when absent.
+	*/
+	async readKeyringCredential(identity) {
+		try {
+			const value = await this.keyring.read(CODEX_AUTH_KEYRING_SERVICE, identity.keyringAccount);
+			return value === null ? null : {
+				backend: "keyring",
+				value
+			};
+		} catch (error) {
+			throw sanitizedNativeAuthError("keyring read", error);
+		}
+	}
+	/**
+	* Write a keyring-backed credential.
+	* @param identity - Canonical CODEX_HOME identity.
+	* @param value - Opaque credential payload.
+	*/
+	async writeKeyring(identity, value) {
+		try {
+			await this.keyring.write(CODEX_AUTH_KEYRING_SERVICE, identity.keyringAccount, value);
+		} catch (error) {
+			throw sanitizedNativeAuthError("keyring write", error);
+		}
+	}
+};
+/**
+* Read a text file with ENOENT represented as `null`.
+* @param filePath - File path to read.
+* @param operation - Sanitized operation label for failures.
+* @returns File contents, or `null` when absent.
+*/
+async function readTextIfPresent(filePath, operation) {
 	try {
-		await fs$1.copyFile(src, dst);
+		return await fs$1.readFile(filePath, "utf-8");
 	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
+		if (error.code === "ENOENT") return null;
+		throw sanitizedNativeAuthError(operation, error);
+	}
+}
+/**
+* Write one private file via create/write/sync/rename.
+* @param filePath - Destination path.
+* @param value - File contents.
+*/
+async function writePrivateFileAtomically(filePath, value) {
+	await fs$1.mkdir(path$1.dirname(filePath), { recursive: true });
+	const temporaryPath = path$1.join(path$1.dirname(filePath), `.${path$1.basename(filePath)}.${randomUUID()}.tmp`);
+	let handle;
+	let operationError;
+	try {
+		handle = await fs$1.open(temporaryPath, "wx", 384);
+		await handle.writeFile(value, "utf-8");
+		await handle.sync();
+		await handle.close();
+		handle = void 0;
+		await fs$1.rename(temporaryPath, filePath);
+		await fs$1.chmod(filePath, 384);
+	} catch (error) {
+		operationError = sanitizedNativeAuthError("private file write", error);
 	}
+	if (handle !== void 0) try {
+		await handle.close();
+	} catch (error) {
+		operationError = mergeNativeAuthErrors(operationError, sanitizedNativeAuthError("private file close", error), "Codex native-auth private file write and close both failed");
+	}
+	try {
+		await fs$1.rm(temporaryPath, { force: true });
+	} catch (error) {
+		operationError = mergeNativeAuthErrors(operationError, sanitizedNativeAuthError("private temporary file cleanup", error), "Codex native-auth private file operation and cleanup both failed");
+	}
+	if (operationError !== void 0) throw operationError;
 }
 /**
-* Handle `client:codex.sessionConfig.setup` by seeding the session-scoped
-* directory with the appropriate Codex config files.
+* Remove a file without exposing filesystem details or contents.
+* @param filePath - File path to remove.
+* @param operation - Sanitized operation label for failures.
+*/
+async function removeFileIfPresent(filePath, operation) {
+	try {
+		await fs$1.rm(filePath, { force: true });
+	} catch (error) {
+		throw sanitizedNativeAuthError(operation, error);
+	}
+}
+
+//#endregion
+//#region src/runtime/session-config-handler.ts
+/**
+* Codex session config lease handler.
 *
-* Steps:
-* 1. Create `sessionDir` (recursive, no-op when it already exists).
-* 2. When `sessionDir` and `baseConfigDir` are distinct paths, copy
-* `config.toml` and `auth.json` from `baseConfigDir` into `sessionDir`
-* (each copy is skipped when the source file does not exist).
-* 3. Prime `sessionDir` via {@link handleCodexConfigPrime} to ensure
-* `check_for_update_on_startup = false` is set.
-* @param payload - Session config setup delegation payload. Only `sessionDir`,
-*   `baseConfigDir`, and `projectDir` are used; `platform` and
-*   `configInheritance` are accepted for interface compatibility but are not
-*   required for Codex's simpler config model.
-* @returns Environment variables for the spawned Codex process: `CODEX_HOME`
-*   pointing to `sessionDir`.
-*/
-async function handleCodexSessionConfigSetup(payload) {
-	const { sessionDir, baseConfigDir, projectDir } = payload;
-	await fs$1.mkdir(sessionDir, { recursive: true });
-	if (path$1.resolve(sessionDir) !== path$1.resolve(baseConfigDir)) {
-		await copyIfPresent(path$1.join(baseConfigDir, "config.toml"), path$1.join(sessionDir, "config.toml"));
-		await copyIfPresent(path$1.join(baseConfigDir, "auth.json"), path$1.join(sessionDir, "auth.json"));
-	}
-	await handleCodexConfigPrime({
-		clientId: "codex",
-		configDir: sessionDir,
-		phase: "session-create",
-		...projectDir !== void 0 ? { projectDir } : {}
-	});
-	return { env: { CODEX_HOME: sessionDir } };
+* Materializes file/keyring native auth into an isolated CODEX_HOME and
+* reconciles refreshes on teardown with a generation-checked write-back.
+* `empty` inheritance never reads or clones canonical native credentials.
+* @packageDocumentation
+*/
+/**
+* Codex-owned setup and teardown component for isolated config leases.
+*/
+var CodexSessionConfigHandler = class {
+	authStore;
+	nativeConfigDir;
+	/** Runtime copy of metadata used when a lease directory disappeared early. */
+	activeMetadata = /* @__PURE__ */ new Map();
+	/**
+	* @param authStore - Native file/keyring storage implementation.
+	* @param nativeConfigDir - Native CODEX_HOME used when no profile source exists.
+	*/
+	constructor(authStore = new CodexNativeAuthStore(), nativeConfigDir = path$1.join(os$1.homedir(), ".codex")) {
+		this.authStore = authStore;
+		this.nativeConfigDir = nativeConfigDir;
+	}
+	/**
+	* Seed an isolated CODEX_HOME according to the requested inheritance policy.
+	* @param payload - Validated setup delegation payload.
+	* @returns Process environment and truthful native-auth materialization status.
+	*/
+	async setup(payload) {
+		const { sessionDir, configInheritance, projectDir } = payload;
+		await fs$1.mkdir(sessionDir, { recursive: true });
+		const targetInspection = await inspectCodexLeaseTarget(sessionDir);
+		if (targetInspection.status !== "safe") throw new Error("Codex native-auth lease target must be a stable directory");
+		const targetIdentity = targetInspection.identity;
+		const sourceConfigDir = this.resolveSourceConfigDir(payload);
+		const sourceIdentity = configInheritance === "empty" ? void 0 : await identifyCodexAuthHome(sourceConfigDir);
+		if (sourceIdentity !== void 0 && identitiesEqual(sourceIdentity, targetIdentity)) throw new Error("Codex native-auth source and lease target must be different directories");
+		const emptyMetadata = createEmptyMetadata(targetIdentity);
+		await this.recordMetadata(sessionDir, emptyMetadata);
+		try {
+			let authMaterialized = false;
+			let mode;
+			if (sourceIdentity !== void 0) {
+				const result = await this.authStore.withSourceLock(sourceIdentity, async () => {
+					await this.materializeGeneralConfig(sourceIdentity.canonicalPath, sessionDir, configInheritance);
+					return this.materializeNativeAuthLocked(sourceIdentity, targetIdentity, sessionDir);
+				});
+				authMaterialized = result.materialized;
+				mode = result.mode;
+			} else {
+				await this.materializeGeneralConfig(sourceConfigDir, sessionDir, configInheritance);
+				await this.authStore.deleteFile(targetIdentity);
+			}
+			if (configInheritance === "auth-only" && mode !== void 0) await fs$1.writeFile(path$1.join(sessionDir, "config.toml"), `cli_auth_credentials_store = "${mode}"\n`, { mode: 384 });
+			await handleCodexConfigPrime({
+				clientId: "codex",
+				configDir: sessionDir,
+				phase: "session-create",
+				...projectDir !== void 0 ? { projectDir } : {}
+			});
+			return {
+				env: { CODEX_HOME: sessionDir },
+				authMaterialized
+			};
+		} catch (error) {
+			await this.rollbackFailedSetup(sessionDir).catch((cleanupError) => {
+				throw new AggregateError([error, cleanupError], "Codex session config setup and cleanup both failed");
+			});
+			throw error;
+		}
+	}
+	/**
+	* Compare-and-swap refreshed native auth back to its canonical store, then
+	* remove the session-specific keyring entry.
+	* @param payload - Validated teardown delegation payload.
+	* @returns Successful client-owned teardown result.
+	*/
+	async teardown(payload) {
+		const leaseKey = path$1.resolve(payload.sessionDir);
+		const activeMetadata = this.activeMetadata.get(leaseKey);
+		const inspection = await this.inspectLeaseForTeardown(payload.sessionDir);
+		const inspectedIdentity = inspection.targetInspection.status === "safe" ? inspection.targetInspection.identity : inspection.targetInspection.fallbackIdentity;
+		const cleanupIdentity = activeMetadata?.targetIdentity ?? inspectedIdentity;
+		let operationError = inspection.operationError;
+		if (operationError === void 0) try {
+			await this.reconcileInspectedLease(payload.sessionDir, inspection, activeMetadata);
+		} catch (error) {
+			operationError = error;
+		}
+		try {
+			for (const cleanupError of await this.collectTargetCleanupErrors(payload.sessionDir, cleanupIdentity)) operationError = mergeOperationErrors(operationError, cleanupError, "Codex native-auth write-back and target cleanup both failed");
+		} finally {
+			this.activeMetadata.delete(leaseKey);
+		}
+		if (operationError !== void 0) throw operationError;
+		return { success: true };
+	}
+	/**
+	* Inspect the lease target and its metadata without starting write-back.
+	* @param sessionDir - Original isolated CODEX_HOME path.
+	* @returns Target state, metadata state, and any sanitized inspection failure.
+	*/
+	async inspectLeaseForTeardown(sessionDir) {
+		let operationError;
+		let targetInspection;
+		try {
+			targetInspection = await inspectCodexLeaseTarget(sessionDir);
+		} catch (error) {
+			operationError = error;
+			targetInspection = {
+				status: "missing",
+				fallbackIdentity: identifyCodexAuthHomeLexically(sessionDir)
+			};
+		}
+		let metadataRead = { status: "missing" };
+		if (targetInspection.status === "safe") try {
+			metadataRead = await this.authStore.readLeaseMetadata(sessionDir);
+		} catch (error) {
+			operationError = mergeOperationErrors(operationError, error, "Codex native-auth lease inspection encountered multiple failures");
+		}
+		else if (targetInspection.status === "unsafe") operationError = mergeOperationErrors(operationError, /* @__PURE__ */ new Error("Codex native-auth lease target is unsafe; write-back was skipped"), "Codex native-auth lease inspection encountered multiple failures");
+		return {
+			metadataRead,
+			operationError,
+			targetInspection
+		};
+	}
+	/**
+	* Validate one inspected lease generation and reconcile a refreshed target.
+	* @param sessionDir - Original isolated CODEX_HOME path.
+	* @param inspection - Verified target and metadata inspection result.
+	* @param activeMetadata - In-memory setup generation, when this process created the lease.
+	*/
+	async reconcileInspectedLease(sessionDir, inspection, activeMetadata) {
+		if (inspection.metadataRead.status === "invalid") throw new Error("Codex native-auth lease metadata is invalid; write-back was skipped");
+		if (inspection.metadataRead.status === "found") {
+			const inspectedIdentity = inspection.targetInspection.status === "safe" ? inspection.targetInspection.identity : inspection.targetInspection.fallbackIdentity;
+			const expectedTargetIdentity = activeMetadata?.targetIdentity ?? inspectedIdentity;
+			const diskMetadata = inspection.metadataRead.metadata;
+			if (!identitiesEqual(diskMetadata.targetIdentity, expectedTargetIdentity)) throw new Error("Codex native-auth lease target identity is invalid; write-back was skipped");
+			if (activeMetadata !== void 0 && !metadataEqual(diskMetadata, activeMetadata)) throw new Error("Codex native-auth lease generation metadata changed; write-back was skipped");
+			const currentTarget = await inspectCodexLeaseTarget(sessionDir);
+			if (currentTarget.status !== "safe" || !identitiesEqual(currentTarget.identity, expectedTargetIdentity)) throw new Error("Codex native-auth lease target changed during teardown; write-back was skipped");
+			await this.reconcileRefresh(diskMetadata);
+		} else if (activeMetadata?.backend.effective !== void 0 && activeMetadata.backend.effective !== "none") throw new Error("Codex native-auth lease metadata is missing; write-back was skipped");
+	}
+	/**
+	* Resolve profile source or the native CODEX_HOME fallback.
+	* @param payload - Setup payload carrying source and target paths.
+	* @returns Canonical source candidate selected for this lease.
+	*/
+	resolveSourceConfigDir(payload) {
+		return path$1.resolve(payload.sessionDir) === path$1.resolve(payload.baseConfigDir) ? this.nativeConfigDir : payload.baseConfigDir;
+	}
+	/**
+	* Materialize general config independently from native authentication.
+	* @param sourceConfigDir - Resolved source CODEX_HOME.
+	* @param sessionDir - Isolated target CODEX_HOME.
+	* @param inheritance - Requested config inheritance policy.
+	*/
+	async materializeGeneralConfig(sourceConfigDir, sessionDir, inheritance) {
+		const target = path$1.join(sessionDir, "config.toml");
+		await fs$1.rm(target, { force: true });
+		if (inheritance !== "full") return;
+		try {
+			await fs$1.copyFile(path$1.join(sourceConfigDir, "config.toml"), target);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	/**
+	* Resolve and clone native auth while the caller owns the canonical source lock.
+	* @param canonicalIdentity - Canonical auth source pinned during setup.
+	* @param targetIdentity - Isolated target store identity.
+	* @param sessionDir - Isolated target CODEX_HOME.
+	* @returns Materialization status and configured storage mode.
+	*/
+	async materializeNativeAuthLocked(canonicalIdentity, targetIdentity, sessionDir) {
+		const mode = await this.authStore.resolveMode(canonicalIdentity);
+		const sourceRead = await this.authStore.readEffective(canonicalIdentity, mode);
+		const sourceCredential = sourceRead.credential;
+		if (sourceCredential === null) {
+			await this.authStore.deleteFile(targetIdentity);
+			if (mode === "keyring" || mode === "auto" && !sourceRead.keyringUnavailable) await this.authStore.deleteKeyring(targetIdentity);
+			await this.recordMetadata(sessionDir, {
+				version: 1,
+				backend: {
+					configured: mode,
+					effective: "none"
+				},
+				canonicalIdentity,
+				targetIdentity,
+				sourceGenerationDigest: null,
+				initialTargetDigest: null
+			});
+			return {
+				materialized: false,
+				mode
+			};
+		}
+		const digest = digestCodexCredential(sourceCredential.value);
+		const metadata = {
+			version: 1,
+			backend: {
+				configured: mode,
+				effective: sourceCredential.backend
+			},
+			canonicalIdentity,
+			targetIdentity,
+			sourceGenerationDigest: digest,
+			initialTargetDigest: digest
+		};
+		await this.recordMetadata(sessionDir, metadata);
+		if (sourceCredential.backend === "file" && mode === "auto" && !sourceRead.keyringUnavailable) await this.authStore.deleteKeyring(targetIdentity);
+		await this.authStore.writeBackend(targetIdentity, sourceCredential.backend, sourceCredential.value);
+		const targetValue = await this.authStore.readBackend(targetIdentity, sourceCredential.backend);
+		if (targetValue === null || digestCodexCredential(targetValue) !== digest) throw new Error("Codex native-auth target generation verification failed");
+		return {
+			materialized: true,
+			mode
+		};
+	}
+	/**
+	* Atomically record metadata on disk and retain it for missing-directory teardown.
+	* @param sessionDir - Isolated target CODEX_HOME.
+	* @param metadata - Secret-free lease generation metadata.
+	*/
+	async recordMetadata(sessionDir, metadata) {
+		await this.authStore.writeLeaseMetadata(sessionDir, metadata);
+		this.activeMetadata.set(path$1.resolve(sessionDir), metadata);
+	}
+	/**
+	* Remove only resources materialized before a setup failure.
+	* @param sessionDir - Isolated target CODEX_HOME.
+	*/
+	async rollbackFailedSetup(sessionDir) {
+		const leaseKey = path$1.resolve(sessionDir);
+		const metadata = this.activeMetadata.get(leaseKey);
+		if (metadata === void 0) return;
+		try {
+			const cleanupErrors = await this.collectTargetCleanupErrors(sessionDir, metadata.targetIdentity);
+			if (cleanupErrors.length > 0) throw new AggregateError(cleanupErrors, "Codex native-auth setup rollback failed");
+		} finally {
+			this.activeMetadata.delete(leaseKey);
+		}
+	}
+	/**
+	* Attempt keyring cleanup unconditionally and file cleanup only for the
+	* still-verified lease directory.
+	* @param sessionDir - Original isolated CODEX_HOME path.
+	* @param trustedIdentity - Target identity captured before materialization.
+	* @returns Every sanitized inspection or cleanup failure.
+	*/
+	async collectTargetCleanupErrors(sessionDir, trustedIdentity) {
+		const errors = [];
+		let inspection;
+		try {
+			inspection = await inspectCodexLeaseTarget(sessionDir);
+		} catch (error) {
+			errors.push(error);
+		}
+		const cleanupOperations = [() => this.authStore.deleteKeyring(trustedIdentity)];
+		if (inspection?.status === "safe" && identitiesEqual(inspection.identity, trustedIdentity)) cleanupOperations.push(() => this.authStore.deleteFile(trustedIdentity));
+		else if (inspection?.status === "unsafe" || inspection?.status === "safe" && !identitiesEqual(inspection.identity, trustedIdentity)) errors.push(/* @__PURE__ */ new Error("Codex native-auth lease target became unsafe; file cleanup was skipped"));
+		const cleanupResults = await Promise.allSettled(cleanupOperations.map(async (operation) => operation()));
+		errors.push(...cleanupResults.flatMap((result) => result.status === "rejected" ? [result.reason] : []));
+		return errors;
+	}
+	/**
+	* Reconcile one changed target under the canonical source's cross-process lock.
+	* @param metadata - Validated on-disk lease generation.
+	*/
+	async reconcileRefresh(metadata) {
+		const canonicalIdentity = metadata.canonicalIdentity;
+		const mode = metadata.backend.configured;
+		const sourceGenerationDigest = metadata.sourceGenerationDigest;
+		const initialTargetDigest = metadata.initialTargetDigest;
+		if (mode === "none" || metadata.backend.effective === "none" || canonicalIdentity === null || sourceGenerationDigest === null || initialTargetDigest === null) return;
+		const targetCredential = (await this.authStore.readRefreshCandidate(metadata.targetIdentity, mode, initialTargetDigest)).credential;
+		if (targetCredential === null) return;
+		if (digestCodexCredential(targetCredential.value) === initialTargetDigest) return;
+		await this.authStore.withSourceLock(canonicalIdentity, async () => {
+			const currentMode = await this.authStore.resolveMode(canonicalIdentity);
+			if (currentMode !== mode) return;
+			const canonicalCredential = (await this.authStore.readEffective(canonicalIdentity, currentMode)).credential;
+			if (canonicalCredential !== null && canonicalCredential.backend === metadata.backend.effective && digestCodexCredential(canonicalCredential.value) === sourceGenerationDigest) await this.authStore.saveConfigured(canonicalIdentity, mode, targetCredential.value);
+		});
+	}
+};
+/**
+* Compare canonical identities without trusting metadata aliases.
+* @param left - First canonical identity.
+* @param right - Second canonical identity.
+* @returns Whether path and derived keyring account both match.
+*/
+function identitiesEqual(left, right) {
+	return left.canonicalPath === right.canonicalPath && left.keyringAccount === right.keyringAccount;
+}
+/**
+* Compare the complete trusted lease generation with its on-disk marker.
+* @param left - First strict metadata generation.
+* @param right - Second strict metadata generation.
+* @returns Whether every source, target, backend, and digest field matches.
+*/
+function metadataEqual(left, right) {
+	return left.version === right.version && left.backend.configured === right.backend.configured && left.backend.effective === right.backend.effective && (left.canonicalIdentity === null && right.canonicalIdentity === null || left.canonicalIdentity !== null && right.canonicalIdentity !== null && identitiesEqual(left.canonicalIdentity, right.canonicalIdentity)) && identitiesEqual(left.targetIdentity, right.targetIdentity) && left.sourceGenerationDigest === right.sourceGenerationDigest && left.initialTargetDigest === right.initialTargetDigest;
+}
+/**
+* Create the explicit no-auth marker written before setup begins.
+* @param targetIdentity - Isolated target CODEX_HOME identity.
+* @returns Initial secret-free lease metadata.
+*/
+function createEmptyMetadata(targetIdentity) {
+	return {
+		version: 1,
+		backend: {
+			configured: "none",
+			effective: "none"
+		},
+		canonicalIdentity: null,
+		targetIdentity,
+		sourceGenerationDigest: null,
+		initialTargetDigest: null
+	};
+}
+/**
+* Preserve every failure observed across write-back and mandatory cleanup.
+* @param existing - Earlier failure, when present.
+* @param next - Newly observed failure.
+* @param message - Safe aggregate description.
+* @returns The single failure or an aggregate retaining both.
+*/
+function mergeOperationErrors(existing, next, message) {
+	return existing === void 0 ? next : new AggregateError([existing, next], message);
 }
 
 //#endregion
@@ -1312,7 +2297,7 @@ const MANAGED_SESSION_CAP = 1e4;
 *    `client.runtime.started` for the adapter-managed session gate, and
 *    registers request handlers for `config.hooks.list`, `config.hooks.add`,
 *    `config.hooks.remove`, `config.prime`, `wiring.list`, `wiring.apply`,
-*    `wiring.remove`, and `sessionConfig.setup`.
+*    `wiring.remove`, `sessionConfig.setup`, and `sessionConfig.destroy`.
 * 2. On each incoming raw event, calls {@link normalizeCodexHook}.
 * 3. Emits the normalized subject when the event is recognized; silently
 *    ignores unknown events.  Normalized `client.session.*` events are
@@ -1326,6 +2311,15 @@ var CodexClientSessionService = class extends BaseService {
 	/** Cached active config-dir resolution; reset when the active Codex version changes. */
 	cachedConfigDir;
 	/**
+	* Stable runtime identity of the machine that owns the client sessions
+	* observed by this service.  Stamped onto `client.session.started` payloads
+	* so downstream storage receives the owning machine's identity without
+	* deriving it from the writer process.
+	*/
+	machineId;
+	/** Client-owned native auth materialization and refresh reconciliation. */
+	sessionConfigHandler;
+	/**
 	* Set of `adapterSessionId` values known to be owned by an adapter-managed
 	* Codex runtime.  Populated by {@link handleRuntimeStarted} when a
 	* `client.runtime.started` event arrives with `clientId === CLIENT_ID` and
@@ -1344,15 +2338,21 @@ var CodexClientSessionService = class extends BaseService {
 	* @param settings - Optional {@link CodexClientSettings} instance for tests
 	*   that need exact filesystem paths. Production callers should omit it so
 	*   the service can resolve the active managed config dir via the bus.
+	* @param machineId - Stable runtime identity of the observing machine,
+	*   caller-supplied from the extension context. Omit in tests or when the
+	*   identity is unavailable.
+	* @param sessionConfigHandler - Optional native auth lease handler override.
 	*/
-	constructor(bus = MakaioBus, settings) {
+	constructor(bus = MakaioBus, settings, machineId, sessionConfigHandler = new CodexSessionConfigHandler()) {
 		super(bus);
 		this.settingsOverride = settings;
+		this.machineId = machineId;
+		this.sessionConfigHandler = sessionConfigHandler;
 	}
 	/**
 	* Register the raw hook ingress handler, config management request handlers,
 	* wiring management request handlers, the config-prime lifecycle handler,
-	* and the session config setup handler on the bus.
+	* and the session config setup/teardown handlers on the bus.
 	*
 	* Also subscribes to `client.runtime.started` to track adapter-managed
 	* sessions for the {@link handleHookReceived} suppression gate.
@@ -1394,7 +2394,10 @@ var CodexClientSessionService = class extends BaseService {
 			ctx.setResult(await handleCodexConfigPrime(ctx.payload));
 		});
 		this.registerHandler(CodexClientSubjects.sessionConfig.setup, async (ctx) => {
-			ctx.setResult(await handleCodexSessionConfigSetup(ctx.payload));
+			ctx.setResult(await this.sessionConfigHandler.setup(ctx.payload));
+		});
+		this.registerHandler(CodexClientSubjects.sessionConfig.destroy, async (ctx) => {
+			ctx.setResult(await this.sessionConfigHandler.teardown(ctx.payload));
 		});
 	}
 	/**
@@ -1485,7 +2488,7 @@ var CodexClientSessionService = class extends BaseService {
 	* @param raw - Raw hook payload delivered on `client:codex.hook.received`
 	*/
 	async handleHookReceived(raw) {
-		const normalized = normalizeCodexHook(raw);
+		const normalized = normalizeCodexHook(raw, this.machineId);
 		if (normalized === null) return;
 		if (this.isAdapterManagedSession(normalized.payload.adapterSessionId)) return;
 		switch (normalized.subject) {
@@ -1547,4 +2550,4 @@ function isResolveBinaryMissingGlobalBinary(error) {
 }
 
 //#endregion
-export { CodexNativeHooksFileSchema as _, CodexWiringSchemas as a, clientDefinition as b, CodexConfigHooksAddResponseSchema as c, CodexConfigHooksRemoveRequestSchema as d, CodexConfigHooksRemoveResponseSchema as f, CodexNativeHookMatcherGroupSchema as g, CodexNativeCommandHookSchema as h, normalizeCodexHook as i, CodexConfigHooksListRequestSchema as l, CodexHookEntrySchema as m, CODEX_CLIENT_NAMESPACE as n, AbsolutePathSchema as o, CodexConfigSchemas as p, CodexClientSubjects as r, CodexConfigHooksAddRequestSchema as s, CodexClientSessionService as t, CodexConfigHooksListResponseSchema as u, CodexScopeHookRecordSchema as v, CodexScopeSchema as y };
+export { clientDefinition as C, CodexScopeSchema as S, CodexHookEntrySchema as _, CODEX_CLIENT_NAMESPACE as a, CodexNativeHooksFileSchema as b, CodexWiringSchemas as c, CodexConfigHooksAddResponseSchema as d, CodexConfigHooksListRequestSchema as f, CodexConfigSchemas as g, CodexConfigHooksRemoveResponseSchema as h, withCodexNativeAuthSourceLock as i, AbsolutePathSchema as l, CodexConfigHooksRemoveRequestSchema as m, buildCodexNativeAuthSourceLockPath as n, CodexClientSubjects as o, CodexConfigHooksListResponseSchema as p, executeCodexNativeAuthSourceLock as r, normalizeCodexHook as s, CodexClientSessionService as t, CodexConfigHooksAddRequestSchema as u, CodexNativeCommandHookSchema as v, CodexScopeHookRecordSchema as x, CodexNativeHookMatcherGroupSchema as y };