@minniexcode/codex-switch 0.0.9 → 0.0.11

package/dist/app/add-provider.js

@@ -41,13 +41,13 @@ const errors_1 = require("../domain/errors");
 const config_repo_1 = require("../storage/config-repo");
 const fs_utils_1 = require("../storage/fs-utils");
 const providers_repo_1 = require("../storage/providers-repo");
-const auth_repo_1 = require("../storage/auth-repo");
+const copilot_adapter_1 = require("../runtime/copilot-adapter");
 const copilot_installer_1 = require("../runtime/copilot-installer");
 const run_mutation_1 = require("./run-mutation");
 /**
  * Adds a new provider record to the managed providers registry.
  */
-function addProvider(args) {
+async function addProvider(args) {
     (0, fs_utils_1.ensureDir)(args.codexDir);
     const providers = (0, providers_repo_1.readProvidersFileIfExists)(args.providersPath);
     if (providers.providers[args.providerName]) {
@@ -68,17 +68,26 @@ function addProvider(args) {
         }
         : undefined;
     if (args.copilot) {
-        const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
+        const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)(args.runtimesDir);
         if (!installStatus.installed) {
-            if (!args.installCopilotSdk) {
-                throw (0, errors_1.cliError)(args.interactive ? "COPILOT_SDK_MISSING" : "COPILOT_SDK_INSTALL_REQUIRES_TTY", args.interactive
-                    ? "The optional Copilot SDK runtime is not installed. Re-run with --install-copilot-sdk or confirm installation interactively."
-                    : "The optional Copilot SDK runtime is not installed. Pass --install-copilot-sdk when running non-interactively.", {
-                    installDir: installStatus.installDir,
-                    packageName: installStatus.packageName,
+            throw (0, errors_1.cliError)("COPILOT_SDK_MISSING", "The optional Copilot SDK runtime is not installed. Run `codexs login copilot` first.", {
+                installDir: installStatus.installDir,
+                packageName: installStatus.packageName,
+                suggestion: "Run `codexs login copilot` to install the Copilot SDK and complete login.",
+            });
+        }
+        try {
+            await (0, copilot_adapter_1.readCopilotAuthState)(args.runtimesDir);
+        }
+        catch (error) {
+            const normalized = (0, errors_1.normalizeError)(error);
+            if (normalized.code === "COPILOT_AUTH_REQUIRED") {
+                throw (0, errors_1.cliError)("COPILOT_AUTH_REQUIRED", "Copilot authentication is required before a Copilot provider can be added.", {
+                    ...(normalized.details ?? {}),
+                    suggestion: "Run `codexs login copilot` to complete GitHub Copilot login.",
                 });
             }
-            (0, copilot_installer_1.installCopilotSdk)();
+            throw error;
         }
     }
     const document = (0, config_repo_1.readStructuredConfig)(args.configPath);
@@ -98,18 +107,20 @@ function addProvider(args) {
             }),
         }
         : undefined;
-    const upsertModelProviders = !existingModelProvider && args.createProfile
+    const upsertModelProviders = args.copilot
         ? {
-            [args.profile]: {
-                baseUrl: args.copilot ? (0, providers_1.buildCopilotBridgeBaseUrl)(runtime) : args.baseUrl ?? undefined,
-                envKey: (0, config_1.buildManagedProfileEnvKey)(args.profile),
-            },
+            [args.profile]: (0, providers_1.buildCopilotModelProviderProjection)(runtime),
         }
-        : undefined;
+        : !existingModelProvider && args.createProfile
+            ? {
+                [args.profile]: {
+                    baseUrl: args.baseUrl ?? undefined,
+                },
+            }
+            : undefined;
     if (existingProfile) {
         (0, config_repo_1.requireManagedProfileRuntime)(document, providers, args.profile);
     }
-    const envKey = existingModelProvider?.envKey ?? (0, config_1.buildManagedProfileEnvKey)(args.profile);
     const apiKey = args.copilot ? args.bridgeApiKey ?? crypto.randomBytes(24).toString("hex") : args.apiKey;
     const baseUrl = args.copilot ? (0, providers_1.buildCopilotBridgeBaseUrl)(runtime) : args.baseUrl ?? undefined;
     const next = {
@@ -118,7 +129,6 @@ function addProvider(args) {
             [args.providerName]: (0, providers_1.cleanProviderRecord)({
                 profile: args.profile,
                 apiKey,
-                envKey,
                 baseUrl,
                 note: args.note ?? undefined,
                 tags: args.tags,
@@ -127,14 +137,13 @@ function addProvider(args) {
         },
     };
     return (0, run_mutation_1.runMutation)({
-        codexDir: args.codexDir,
+        lockPath: args.lockPath,
         backupsDir: args.backupsDir,
         latestBackupPath: args.latestBackupPath,
         operation: "add",
         files: [
             { absolutePath: args.providersPath, relativePath: "providers.json" },
             { absolutePath: args.configPath, relativePath: "config.toml" },
-            { absolutePath: args.authPath, relativePath: "auth.json" },
         ],
         mutate: () => {
             const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
@@ -144,15 +153,9 @@ function addProvider(args) {
             // Persist only the normalized provider payload so later reads are deterministic.
             (0, providers_repo_1.writeProvidersFile)(args.providersPath, next);
             (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-            if (document.activeProfile === args.profile) {
-                const activeProviderName = (0, config_repo_1.resolveActiveProviderName)(document, next);
-                const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-                (0, auth_repo_1.writeAuthFile)(args.authPath, next.providers[activeProviderName], existingAuth ?? undefined);
-            }
             return {
                 provider: args.providerName,
                 profile: args.profile,
-                envKey,
                 runtimeKind: runtime?.kind ?? null,
                 createdProfileSections: configPlan.createdProfileSections,
                 createdModelProviderSections: configPlan.createdModelProviderSections,

package/dist/app/bridge.js

@@ -22,13 +22,14 @@ async function startBridge(args) {
         requestedProviderName: args.providerName ?? null,
         providers,
         configPath: args.configPath,
+        runtimeDir: args.runtimeDir,
         runtime: args.runtime,
         json: args.json,
         commandName: "start",
         preferRuntimeState: false,
     });
-    await requireBridgeRuntimeReadiness();
-    const bridge = await (0, copilot_bridge_1.ensureCopilotBridge)(target.providerName, target.provider);
+    await requireBridgeRuntimeReadiness(args.runtimesDir);
+    const bridge = await (0, copilot_bridge_1.ensureCopilotBridge)(target.providerName, target.provider, args.runtimeDir);
     const nextProvider = bridge.portChanged ? rewriteBridgeProviderPort(target.provider, bridge.port) : target.provider;
     if (bridge.portChanged) {
         try {
@@ -43,7 +44,7 @@ async function startBridge(args) {
         }
         catch (error) {
             if (!bridge.reused) {
-                (0, copilot_bridge_1.stopCopilotBridge)();
+                (0, copilot_bridge_1.stopCopilotBridge)(args.runtimeDir);
             }
             throw error;
         }
@@ -66,7 +67,7 @@ async function startBridge(args) {
  */
 async function stopBridge(args) {
     const providers = (0, providers_repo_1.readProvidersFile)(args.providersPath);
-    const state = (0, runtime_state_repo_1.readCopilotBridgeState)();
+    const state = (0, runtime_state_repo_1.readCopilotBridgeState)(args.runtimeDir);
     if (!state && !args.providerName) {
         return {
             data: {
@@ -90,6 +91,7 @@ async function stopBridge(args) {
         requestedProviderName: args.providerName ?? null,
         providers,
         configPath: args.configPath,
+        runtimeDir: args.runtimeDir,
         runtime: args.runtime,
         json: args.json,
         commandName: "stop",
@@ -101,7 +103,7 @@ async function stopBridge(args) {
             requestedProvider: args.providerName,
         });
     }
-    (0, copilot_bridge_1.stopCopilotBridge)();
+    (0, copilot_bridge_1.stopCopilotBridge)(args.runtimeDir);
     return {
         data: {
             provider: target.providerName,
@@ -115,18 +117,19 @@ async function stopBridge(args) {
  */
 async function statusBridge(args) {
     const providers = (0, providers_repo_1.readProvidersFile)(args.providersPath);
-    const state = (0, runtime_state_repo_1.readCopilotBridgeState)();
+    const state = (0, runtime_state_repo_1.readCopilotBridgeState)(args.runtimeDir);
     const target = await resolveBridgeTarget({
         requestedProviderName: args.providerName ?? null,
         providers,
         configPath: args.configPath,
+        runtimeDir: args.runtimeDir,
         runtime: args.runtime,
         json: args.json,
         commandName: "status",
         preferRuntimeState: true,
     });
     const provider = target.provider;
-    const runtimeStatus = await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(provider);
+    const runtimeStatus = await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(provider, state, args.runtimeDir);
     const expectedBaseUrl = (0, providers_1.buildCopilotBridgeBaseUrl)(provider.runtime);
     if (args.providerName && state?.provider && state.provider !== args.providerName) {
         throw (0, errors_1.cliError)("BRIDGE_PROVIDER_MISMATCH", `Bridge runtime state belongs to "${state.provider}" not "${args.providerName}".`, {
@@ -154,7 +157,7 @@ async function resolveBridgeTarget(args) {
         return resolveNamedBridgeProvider(args.providers, args.requestedProviderName);
     }
     if (args.preferRuntimeState) {
-        const runtimeState = (0, runtime_state_repo_1.readCopilotBridgeState)();
+        const runtimeState = (0, runtime_state_repo_1.readCopilotBridgeState)(args.runtimeDir);
         if (runtimeState?.provider && args.providers.providers[runtimeState.provider]) {
             return resolveNamedBridgeProvider(args.providers, runtimeState.provider);
         }
@@ -238,15 +241,15 @@ async function promptForCopilotBridgeSelection(runtime, targets, commandName) {
 /**
  * Verifies that the local Copilot bridge prerequisites are available before startup.
  */
-async function requireBridgeRuntimeReadiness() {
-    const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
+async function requireBridgeRuntimeReadiness(runtimesDir) {
+    const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)(runtimesDir);
     if (!installStatus.installed) {
         throw (0, errors_1.cliError)("COPILOT_SDK_MISSING", "The optional Copilot SDK runtime is not installed.", {
             installDir: installStatus.installDir,
             packageName: installStatus.packageName,
         });
     }
-    await (0, copilot_adapter_1.readCopilotAuthState)();
+    await (0, copilot_adapter_1.readCopilotAuthState)(runtimesDir);
 }
 /**
  * Rewrites one Copilot bridge provider record with a recovered runtime port.
@@ -281,10 +284,7 @@ function persistRecoveredBridgePort(args) {
         const document = (0, config_repo_1.readStructuredConfig)(args.configPath);
         const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
             upsertModelProviders: {
-                [args.provider.profile]: {
-                    baseUrl: (0, providers_1.buildCopilotBridgeBaseUrl)(args.provider.runtime),
-                    envKey: (0, config_repo_1.requireRuntimeEnvKey)(document, args.provider.profile),
-                },
+                [args.provider.profile]: (0, providers_1.buildCopilotModelProviderProjection)(args.provider.runtime),
             },
         });
         (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);

package/dist/app/edit-provider.js

@@ -7,7 +7,6 @@ const providers_1 = require("../domain/providers");
 const config_repo_1 = require("../storage/config-repo");
 const fs_utils_1 = require("../storage/fs-utils");
 const providers_repo_1 = require("../storage/providers-repo");
-const auth_repo_1 = require("../storage/auth-repo");
 const run_mutation_1 = require("./run-mutation");
 /**
  * Updates selected fields on a single managed provider.
@@ -63,23 +62,15 @@ function editProvider(args) {
         upsertModelProviders = {
             [newProfile]: {
                 baseUrl: args.baseUrl ?? undefined,
-                envKey: (0, config_1.buildManagedProfileEnvKey)(newProfile),
             },
         };
     }
     else {
         (0, config_repo_1.requireManagedProfileRuntime)(document, providers, newProfile);
     }
-    const nextEnvKey = args.profile !== undefined && args.profile !== current.profile
-        ? targetModelProviderSection?.envKey ?? (0, config_1.buildManagedProfileEnvKey)(newProfile)
-        : current.envKey;
-    if (nextEnvKey !== current.envKey) {
-        updatedFields.push("envKey");
-    }
     const nextRecord = (0, providers_1.cleanProviderRecord)({
         profile: newProfile,
         apiKey: args.apiKey ?? current.apiKey,
-        envKey: nextEnvKey,
         baseUrl: args.baseUrl === null ? undefined : args.baseUrl ?? current.baseUrl,
         note: args.note === null ? undefined : args.note ?? current.note,
         tags: args.tags ?? current.tags,
@@ -90,7 +81,7 @@ function editProvider(args) {
                 ...(args.model !== undefined && args.model !== null ? { model: args.model } : {}),
             },
         };
-        if (args.model !== undefined && (targetSection?.model !== args.model) && !updatedFields.includes("model")) {
+        if (args.model !== undefined && targetSection?.model !== args.model && !updatedFields.includes("model")) {
             updatedFields.push("model");
         }
     }
@@ -118,14 +109,13 @@ function editProvider(args) {
         switchToProfile: args.switchToProfile ?? null,
     });
     return (0, run_mutation_1.runMutation)({
-        codexDir: args.codexDir,
+        lockPath: args.lockPath,
         backupsDir: args.backupsDir,
         latestBackupPath: args.latestBackupPath,
         operation: "edit",
         files: [
             { absolutePath: args.providersPath, relativePath: "providers.json" },
             { absolutePath: args.configPath, relativePath: "config.toml" },
-            { absolutePath: args.authPath, relativePath: "auth.json" },
         ],
         mutate: () => {
             const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
@@ -143,12 +133,6 @@ function editProvider(args) {
             // Write providers first so the registry and config move together inside the managed backup boundary.
             (0, providers_repo_1.writeProvidersFile)(args.providersPath, nextProviders);
             (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-            const updatedDocument = (0, config_repo_1.readStructuredConfig)(args.configPath);
-            if (updatedDocument.activeProfile) {
-                const activeProviderName = (0, config_repo_1.resolveActiveProviderName)(updatedDocument, nextProviders);
-                const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-                (0, auth_repo_1.writeAuthFile)(args.authPath, nextProviders.providers[activeProviderName], existingAuth ?? undefined);
-            }
             return {
                 provider: args.providerName,
                 updatedFields,

package/dist/app/get-status.js

@@ -48,7 +48,7 @@ const runtime_state_repo_1 = require("../storage/runtime-state-repo");
 /**
  * Reports the current on-disk runtime state and how it maps back to managed providers.
  */
-async function getStatus(codexDir, configPath, providersPath, authPath) {
+async function getStatus(codexDir, configPath, providersPath, authPath, options) {
     const configExists = fs.existsSync(configPath);
     const providersExists = fs.existsSync(providersPath);
     let currentProfile = null;
@@ -56,7 +56,7 @@ async function getStatus(codexDir, configPath, providersPath, authPath) {
     const providers = providersExists ? (0, providers_repo_1.readProvidersFile)(providersPath) : null;
     let configViews = [];
     let consistencyIssues = [];
-    const authState = (0, auth_repo_1.readManagedAuthState)(authPath);
+    const authState = (0, auth_repo_1.readAuthFileState)(authPath);
     if (configExists) {
         const document = (0, config_repo_1.readStructuredConfig)(configPath);
         currentProfile = document.activeProfile;
@@ -69,23 +69,35 @@ async function getStatus(codexDir, configPath, providersPath, authPath) {
     const liveState = (0, runtime_state_1.inspectLiveStateDrift)(currentProfile, providers);
     const activeProviderCandidates = currentProfile && providers ? (0, providers_1.findProvidersByProfile)(providers, currentProfile) : [];
     const activeProvider = activeProviderCandidates.length === 1 && providers ? providers.providers[activeProviderCandidates[0]] : null;
-    const copilotInstall = (0, copilot_installer_1.probeCopilotSdkInstall)();
-    const runtimeState = (0, runtime_state_repo_1.readCopilotBridgeState)();
+    const copilotInstall = (0, copilot_installer_1.probeCopilotSdkInstall)(options?.runtimesDir);
+    const runtimeStateInspection = (0, runtime_state_repo_1.inspectCopilotBridgeState)(options?.runtimeDir);
+    const runtimeState = runtimeStateInspection.state;
     const runtimeStateProvider = runtimeState && providers ? providers.providers[runtimeState.provider] ?? null : null;
     const bridgeProbeTarget = activeProvider && (0, providers_1.isCopilotBridgeProvider)(activeProvider)
         ? activeProvider
         : runtimeStateProvider && (0, providers_1.isCopilotBridgeProvider)(runtimeStateProvider)
             ? runtimeStateProvider
             : null;
-    const copilotBridge = bridgeProbeTarget ? await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(bridgeProbeTarget) : runtimeState ? {
-        ok: false,
-        runtime: "copilot-bridge",
-        reason: "failed",
-        cause: "Copilot bridge runtime state exists but no matching managed Copilot provider is active.",
-        details: runtimeState,
-    } : null;
+    const copilotBridge = !runtimeStateInspection.valid && runtimeStateInspection.exists
+        ? {
+            ok: false,
+            runtime: "copilot-bridge",
+            reason: "failed",
+            cause: runtimeStateInspection.parseError ?? "Failed to parse Copilot bridge runtime state.",
+        }
+        : bridgeProbeTarget
+            ? await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(bridgeProbeTarget, runtimeState, options?.runtimeDir)
+            : runtimeState
+                ? {
+                    ok: false,
+                    runtime: "copilot-bridge",
+                    reason: "failed",
+                    cause: "Copilot bridge runtime state exists but no matching managed Copilot provider is active.",
+                    details: runtimeState,
+                }
+                : null;
     const copilotAuth = activeProvider && (0, providers_1.isCopilotBridgeProvider)(activeProvider)
-        ? await (0, copilot_adapter_1.readCopilotAuthState)().catch((error) => ({
+        ? await (0, copilot_adapter_1.readCopilotAuthState)(options?.runtimesDir).catch((error) => ({
             ready: false,
             source: "official-sdk",
             mode: "session",
@@ -96,11 +108,21 @@ async function getStatus(codexDir, configPath, providersPath, authPath) {
         // Surface unmanaged live state without mutating anything during a read-only status call.
         warnings.push("Current config profile is not mapped in providers.json. Backfill would be required before treating live state as managed.");
     }
+    if (runtimeStateInspection.exists && !runtimeStateInspection.valid) {
+        warnings.push(`Copilot bridge runtime state is unreadable: ${runtimeStateInspection.parseError ?? "unknown parse failure"}`);
+    }
     return {
         warnings,
         data: {
             codexDir,
-            storage: (0, runtime_state_1.getStorageRoles)(),
+            storage: (0, runtime_state_1.getStorageRoles)({
+                codexDir,
+                providersPath,
+                configPath,
+                authPath,
+                runtimeDir: options?.runtimeDir,
+                runtimesDir: options?.runtimesDir,
+            }),
             configExists,
             providersExists,
             currentProfile,

package/dist/app/import-providers.js

@@ -62,7 +62,7 @@ function importProviders(args) {
     (0, fs_utils_1.ensureDir)(args.codexDir);
     const document = (0, config_repo_1.readStructuredConfig)(args.configPath);
     return (0, run_mutation_1.runMutation)({
-        codexDir: args.codexDir,
+        lockPath: args.lockPath,
         backupsDir: args.backupsDir,
         latestBackupPath: args.latestBackupPath,
         operation: "import",

package/dist/app/init-codex.js

@@ -35,34 +35,33 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.initCodex = initCodex;
 const fs = __importStar(require("node:fs"));
-const errors_1 = require("../domain/errors");
 const fs_utils_1 = require("../storage/fs-utils");
 const providers_repo_1 = require("../storage/providers-repo");
+const tool_config_repo_1 = require("../storage/tool-config-repo");
 /**
- * Initializes a Codex directory for managed providers.json usage without requiring live Codex state.
+ * Initializes the codex-switch tool home without requiring target Codex runtime files.
  */
 function initCodex(args) {
-    const codexDirExists = fs.existsSync(args.codexDir);
-    if (!codexDirExists && !args.createCodexDir) {
-        throw (0, errors_1.cliError)("CODEX_DIR_NOT_FOUND", "The requested Codex directory does not exist.", {
-            codexDir: args.codexDir,
-        });
-    }
-    if (!codexDirExists) {
-        (0, fs_utils_1.ensureDir)(args.codexDir);
+    const toolHomeExists = fs.existsSync(args.toolHomeDir);
+    if (!toolHomeExists) {
+        (0, fs_utils_1.ensureDir)(args.toolHomeDir);
     }
+    const toolConfigExists = fs.existsSync(args.toolConfigPath);
+    const ensuredConfig = (0, tool_config_repo_1.ensureToolConfig)(args.toolConfigPath, args.version, args.defaultCodexDir ?? "");
     const providersExists = fs.existsSync(args.providersPath);
     if (!providersExists) {
         (0, providers_repo_1.writeProvidersFile)(args.providersPath, { providers: {} });
     }
     return {
         data: {
-            codexDir: args.codexDir,
-            createdCodexDir: !codexDirExists,
+            toolHomeDir: args.toolHomeDir,
+            toolConfigPath: args.toolConfigPath,
+            providersPath: args.providersPath,
+            createdToolHomeDir: !toolHomeExists,
+            createdToolConfigFile: ensuredConfig.created && !toolConfigExists,
             createdProvidersFile: !providersExists,
+            toolConfigAlreadyExisted: toolConfigExists,
             providersAlreadyExisted: providersExists,
-            configExists: fs.existsSync(args.configPath),
-            authExists: fs.existsSync(args.authPath),
         },
     };
 }

package/dist/app/list-providers.js

@@ -11,7 +11,6 @@ function listProviders(providersPath) {
     const items = names.map((name) => ({
         name,
         profile: providers.providers[name].profile,
-        envKey: providers.providers[name].envKey,
         note: providers.providers[name].note ?? null,
         tags: providers.providers[name].tags ?? [],
     }));

package/dist/app/remove-provider.js

@@ -34,7 +34,7 @@ function removeProvider(args) {
         switchToProfile: args.switchToProfile ?? null,
     });
     return (0, run_mutation_1.runMutation)({
-        codexDir: args.codexDir,
+        lockPath: args.lockPath,
         backupsDir: args.backupsDir,
         latestBackupPath: args.latestBackupPath,
         operation: "remove",

package/dist/app/run-doctor.js

@@ -102,8 +102,9 @@ async function runDoctor(args) {
             });
         }
     }
-    const authState = (0, auth_repo_1.readManagedAuthState)(args.authPath);
-    const runtimeState = (0, runtime_state_repo_1.readCopilotBridgeState)();
+    const authState = (0, auth_repo_1.readAuthFileState)(args.authPath);
+    const runtimeStateInspection = (0, runtime_state_repo_1.inspectCopilotBridgeState)(args.runtimeDir);
+    const runtimeState = runtimeStateInspection.state;
     if (authState.exists && !authState.valid) {
         issues.push({
             code: "AUTH_JSON_INVALID",
@@ -111,36 +112,18 @@ async function runDoctor(args) {
             file: args.authPath,
         });
     }
+    if (runtimeStateInspection.exists && !runtimeStateInspection.valid) {
+        issues.push({
+            code: "BRIDGE_STATE_STALE",
+            message: `Copilot bridge runtime state is unreadable: ${runtimeStateInspection.parseError ?? "unknown parse failure"}`,
+        });
+    }
     if (document?.activeProfile && providers) {
         const matches = (0, providers_1.findProvidersByProfile)(providers, document.activeProfile);
         if (matches.length === 1) {
             const activeProvider = providers.providers[matches[0]];
-            const payload = authState.payload ?? {};
-            const actualKeys = authState.managedSecretKeys;
-            if (authState.authMode !== null && authState.authMode !== "apikey") {
-                issues.push({
-                    code: "AUTH_JSON_INVALID",
-                    message: `auth.json auth_mode must be "apikey", found "${authState.authMode}".`,
-                });
-            }
-            if (!actualKeys.includes(activeProvider.envKey) || actualKeys.length !== 1) {
-                issues.push({
-                    code: "AUTH_JSON_ENV_KEY_MISMATCH",
-                    message: `auth.json managed env key does not match active provider "${matches[0]}".`,
-                    provider: matches[0],
-                    expectedEnvKey: activeProvider.envKey,
-                    actualEnvKeys: actualKeys,
-                });
-            }
-            if (payload[activeProvider.envKey] !== activeProvider.apiKey) {
-                issues.push({
-                    code: "AUTH_JSON_APIKEY_MISMATCH",
-                    message: `auth.json secret value does not match active provider "${matches[0]}".`,
-                    provider: matches[0],
-                });
-            }
             if ((0, providers_1.isCopilotBridgeProvider)(activeProvider)) {
-                const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
+                const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)(args.runtimesDir);
                 if (!installStatus.installed) {
                     issues.push({
                         code: "COPILOT_SDK_MISSING",
@@ -150,7 +133,7 @@ async function runDoctor(args) {
                     });
                 }
                 try {
-                    await (0, copilot_adapter_1.readCopilotAuthState)();
+                    await (0, copilot_adapter_1.readCopilotAuthState)(args.runtimesDir);
                 }
                 catch (error) {
                     const normalized = (0, errors_1.normalizeError)(error);
@@ -160,7 +143,7 @@ async function runDoctor(args) {
                         ...(normalized.details ?? {}),
                     });
                 }
-                const bridge = await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(activeProvider);
+                const bridge = await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(activeProvider, runtimeState, args.runtimeDir);
                 if (!bridge.ok) {
                     issues.push({
                         code: mapBridgeDiagnosticCode(bridge.cause),
@@ -215,7 +198,14 @@ async function runDoctor(args) {
             healthy: issues.length === 0,
             issues,
             codexDir: args.codexDir,
-            storage: (0, runtime_state_1.getStorageRoles)(),
+            storage: (0, runtime_state_1.getStorageRoles)({
+                codexDir: args.codexDir,
+                providersPath: args.providersPath,
+                configPath: args.configPath,
+                authPath: args.authPath,
+                runtimeDir: args.runtimeDir,
+                runtimesDir: args.runtimesDir,
+            }),
             liveState: drift,
             auth: authState,
         },
@@ -255,18 +245,10 @@ function renderConfigIssueMessage(issue) {
             return `Model provider section "${issue.modelProvider}" for profile "${issue.profile}" is missing from config.toml.`;
         case "MODEL_PROVIDER_BASE_URL_MISSING":
             return `Model provider section "${issue.modelProvider}" for profile "${issue.profile}" is missing base_url.`;
-        case "MODEL_PROVIDER_ENV_KEY_MISSING":
-            return `Model provider section "${issue.modelProvider}" for profile "${issue.profile}" is missing env_key.`;
-        case "PROVIDER_ENV_KEY_MISMATCH":
-            return `Provider "${issue.provider}" envKey does not match runtime env_key for profile "${issue.profile}".`;
         case "ACTIVE_PROVIDER_UNRESOLVED":
-            return `Active profile "${issue.profile}" maps to multiple providers and cannot determine the current auth mirror owner.`;
+            return `Active profile "${issue.profile}" maps to multiple providers, so the active managed provider cannot be resolved uniquely.`;
         case "AUTH_JSON_INVALID":
             return String(issue.message ?? issue.reason ?? "auth.json is invalid.");
-        case "AUTH_JSON_ENV_KEY_MISMATCH":
-            return `auth.json managed env key does not match provider "${String(issue.provider ?? "")}".`;
-        case "AUTH_JSON_APIKEY_MISMATCH":
-            return `auth.json secret does not match provider "${String(issue.provider ?? "")}".`;
         case "DESTRUCTIVE_REMOVE_BLOCKED":
             return `Provider "${issue.provider}" cannot be removed while "${issue.activeProfile}" remains active.`;
         default:

package/dist/app/run-mutation.js

@@ -8,8 +8,9 @@ const lock_repo_1 = require("../storage/lock-repo");
  * Runs a write operation under a lock with automatic backup and rollback handling.
  */
 function runMutation(args) {
-    return (0, lock_repo_1.withCodexLock)(args.codexDir, args.operation, () => {
-        const backup = (0, backup_repo_1.createBackup)(args.codexDir, args.backupsDir, args.operation, args.files);
+    const lockPath = args.lockPath ?? require("node:path").join(args.codexDir ?? process.cwd(), ".codex-switch.lock");
+    return (0, lock_repo_1.withCodexLock)(lockPath, args.operation, () => {
+        const backup = (0, backup_repo_1.createBackup)(args.backupsDir, args.operation, args.files);
         try {
             const data = args.mutate({ backup });
             // Record the successful backup only after the mutation completes.