@modelprofile.com/authswitch 2.1.2

package/dist_ts/classes.codexauth.d.ts

@@ -0,0 +1,35 @@
+import type { IActiveAuth, ICodexIdentity } from './interfaces.js';
+import { CodexHome } from './classes.codexhome.js';
+/**
+ * Reads, writes and clears the Codex file credential store, and derives the
+ * account identity used to key a stash.
+ *
+ * Nothing in this class logs or returns a token value; only the raw string that
+ * callers copy verbatim between the active slot and the stash.
+ */
+export declare class CodexAuth {
+    readonly codexHome: CodexHome;
+    constructor(codexHomeArg: CodexHome);
+    /**
+     * Extracts the account identity from the content of an auth.json.
+     * Returns null when the file holds no recognisable credential.
+     */
+    identityFromRaw(rawArg: string): ICodexIdentity | null;
+    /**
+     * A short, non-reversible label for an API key so two different keys get two
+     * different stashes without the key itself ever being written down.
+     */
+    private fingerprint;
+    /** Reads the active credential, if any. */
+    readActive(): IActiveAuth;
+    /**
+     * When no auth.json exists the credential is either absent or held by an OS
+     * keyring. The age-encrypted secrets directory is the observable marker of the
+     * keyring-backed store, so use it to tell the two apart.
+     */
+    private detectNonFileSource;
+    /** Writes a credential into the active slot atomically and owner-only. */
+    writeActive(rawArg: string): void;
+    /** Removes the active credential. Safe to call when none exists. */
+    clearActive(): void;
+}

package/dist_ts/classes.codexauth.js

@@ -0,0 +1,184 @@
+import * as plugins from './plugins.js';
+import { CodexHome } from './classes.codexhome.js';
+import { writeSecretFileAtomically } from './helpers.js';
+/**
+ * Decodes the payload of a JWT without verifying it.
+ *
+ * authswitch never uses these claims for authorization -- only to label a stash
+ * with the account it belongs to -- so signature verification would buy nothing.
+ */
+const decodeJwtPayload = (tokenArg) => {
+    const segments = tokenArg.split('.');
+    if (segments.length < 2) {
+        return null;
+    }
+    try {
+        const decoded = Buffer.from(segments[1], 'base64url').toString('utf8');
+        const parsed = JSON.parse(decoded);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+};
+const asString = (valueArg) => typeof valueArg === 'string' && valueArg.length > 0 ? valueArg : null;
+/**
+ * Walks an arbitrary JSON value and returns the first string that looks like a JWT.
+ * Used as a fallback so a Codex schema change cannot silently break stash labelling.
+ */
+const findFirstJwt = (valueArg, depthArg = 0) => {
+    if (depthArg > 6) {
+        return null;
+    }
+    if (typeof valueArg === 'string') {
+        return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+$/.test(valueArg) ? valueArg : null;
+    }
+    if (Array.isArray(valueArg)) {
+        for (const itemArg of valueArg) {
+            const found = findFirstJwt(itemArg, depthArg + 1);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    if (valueArg && typeof valueArg === 'object') {
+        for (const itemArg of Object.values(valueArg)) {
+            const found = findFirstJwt(itemArg, depthArg + 1);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+};
+/**
+ * Reads, writes and clears the Codex file credential store, and derives the
+ * account identity used to key a stash.
+ *
+ * Nothing in this class logs or returns a token value; only the raw string that
+ * callers copy verbatim between the active slot and the stash.
+ */
+export class CodexAuth {
+    codexHome;
+    constructor(codexHomeArg) {
+        this.codexHome = codexHomeArg;
+    }
+    /**
+     * Extracts the account identity from the content of an auth.json.
+     * Returns null when the file holds no recognisable credential.
+     */
+    identityFromRaw(rawArg) {
+        let parsed;
+        try {
+            parsed = JSON.parse(rawArg);
+        }
+        catch {
+            return null;
+        }
+        if (!parsed || typeof parsed !== 'object') {
+            return null;
+        }
+        const record = parsed;
+        const tokens = (record.tokens ?? null);
+        const idToken = (tokens ? asString(tokens.id_token) : null) ?? findFirstJwt(record);
+        if (idToken) {
+            const claims = decodeJwtPayload(idToken) ?? {};
+            const authClaim = (claims['https://api.openai.com/auth'] ?? {});
+            const profileClaim = (claims['https://api.openai.com/profile'] ?? {});
+            const email = asString(claims.email) ??
+                asString(profileClaim.email) ??
+                asString(authClaim.user_email);
+            const accountId = asString(authClaim.chatgpt_account_id) ??
+                (tokens ? asString(tokens.account_id) : null) ??
+                asString(record.account_id);
+            if (email) {
+                return {
+                    kind: 'chatgpt',
+                    email: email.toLowerCase(),
+                    accountId,
+                    planType: asString(authClaim.chatgpt_plan_type),
+                    userId: asString(authClaim.user_id) ?? asString(claims.sub),
+                };
+            }
+            if (accountId) {
+                // An OAuth credential we cannot label by email is still worth stashing;
+                // key it by account id so it round-trips instead of being silently dropped.
+                return {
+                    kind: 'chatgpt',
+                    email: `account:${accountId}`,
+                    accountId,
+                    planType: asString(authClaim.chatgpt_plan_type),
+                    userId: asString(authClaim.user_id) ?? asString(claims.sub),
+                };
+            }
+        }
+        const apiKey = asString(record.OPENAI_API_KEY) ?? asString(record.openai_api_key);
+        if (apiKey) {
+            const fingerprint = this.fingerprint(apiKey);
+            return {
+                kind: 'apikey',
+                email: `apikey:${fingerprint}`,
+                accountId: null,
+                planType: null,
+                userId: null,
+            };
+        }
+        return null;
+    }
+    /**
+     * A short, non-reversible label for an API key so two different keys get two
+     * different stashes without the key itself ever being written down.
+     */
+    fingerprint(secretArg) {
+        let hash = 0x811c9dc5;
+        for (let index = 0; index < secretArg.length; index++) {
+            hash ^= secretArg.charCodeAt(index);
+            hash = Math.imul(hash, 0x01000193) >>> 0;
+        }
+        return hash.toString(16).padStart(8, '0');
+    }
+    /** Reads the active credential, if any. */
+    readActive() {
+        const authFilePath = this.codexHome.authFilePath;
+        if (!plugins.fs.existsSync(authFilePath)) {
+            return {
+                source: this.detectNonFileSource(),
+                authFilePath,
+                identity: null,
+                raw: null,
+            };
+        }
+        const raw = plugins.fs.readFileSync(authFilePath, 'utf8');
+        return {
+            source: 'file',
+            authFilePath,
+            identity: this.identityFromRaw(raw),
+            raw,
+        };
+    }
+    /**
+     * When no auth.json exists the credential is either absent or held by an OS
+     * keyring. The age-encrypted secrets directory is the observable marker of the
+     * keyring-backed store, so use it to tell the two apart.
+     */
+    detectNonFileSource() {
+        if (plugins.fs.existsSync(this.codexHome.secretsDir)) {
+            return 'keyring';
+        }
+        return 'none';
+    }
+    /** Writes a credential into the active slot atomically and owner-only. */
+    writeActive(rawArg) {
+        plugins.fs.mkdirSync(this.codexHome.dir, { recursive: true });
+        writeSecretFileAtomically(this.codexHome.authFilePath, rawArg);
+    }
+    /** Removes the active credential. Safe to call when none exists. */
+    clearActive() {
+        if (plugins.fs.existsSync(this.codexHome.authFilePath)) {
+            plugins.fs.rmSync(this.codexHome.authFilePath);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jb2RleGF1dGguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmNvZGV4YXV0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDbkQsT0FBTyxFQUFFLHlCQUF5QixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBRXpEOzs7OztHQUtHO0FBQ0gsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWdCLEVBQWtDLEVBQUU7SUFDNUUsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNyQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEIsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sTUFBTSxHQUFZLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDNUMsSUFBSSxNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ25FLE9BQU8sTUFBaUMsQ0FBQztRQUMzQyxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFpQixFQUFFLENBQ3BELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFFeEU7OztHQUdHO0FBQ0gsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFFBQVEsR0FBRyxDQUFDLEVBQWlCLEVBQUU7SUFDdEUsSUFBSSxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDakIsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNqQyxPQUFPLHNEQUFzRCxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzVCLEtBQUssTUFBTSxPQUFPLElBQUksUUFBUSxFQUFFLENBQUM7WUFDL0IsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDbEQsSUFBSSxLQUFLO2dCQUFFLE9BQU8sS0FBSyxDQUFDO1FBQzFCLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFDRCxJQUFJLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUM3QyxLQUFLLE1BQU0sT0FBTyxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBbUMsQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDbEQsSUFBSSxLQUFLO2dCQUFFLE9BQU8sS0FBSyxDQUFDO1FBQzFCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDLENBQUM7QUFFRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLE9BQU8sU0FBUztJQUNKLFNBQVMsQ0FBWTtJQUVyQyxZQUFZLFlBQXVCO1FBQ2pDLElBQUksQ0FBQyxTQUFTLEdBQUcsWUFBWSxDQUFDO0lBQ2hDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxlQUFlLENBQUMsTUFBYztRQUNuQyxJQUFJLE1BQWUsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMxQyxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFpQyxDQUFDO1FBRWpELE1BQU0sTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQW1DLENBQUM7UUFDekUsTUFBTSxPQUFPLEdBQ1gsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUV0RSxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ1osTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQy9DLE1BQU0sU0FBUyxHQUFHLENBQUMsTUFBTSxDQUFDLDZCQUE2QixDQUFDLElBQUksRUFBRSxDQUE0QixDQUFDO1lBQzNGLE1BQU0sWUFBWSxHQUFHLENBQUMsTUFBTSxDQUFDLGdDQUFnQyxDQUFDLElBQUksRUFBRSxDQUE0QixDQUFDO1lBQ2pHLE1BQU0sS0FBSyxHQUNULFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUN0QixRQUFRLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQztnQkFDNUIsUUFBUSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNqQyxNQUFNLFNBQVMsR0FDYixRQUFRLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDO2dCQUN0QyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO2dCQUM3QyxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzlCLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ1YsT0FBTztvQkFDTCxJQUFJLEVBQUUsU0FBUztvQkFDZixLQUFLLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRTtvQkFDMUIsU0FBUztvQkFDVCxRQUFRLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQztvQkFDL0MsTUFBTSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUM7aUJBQzVELENBQUM7WUFDSixDQUFDO1lBQ0QsSUFBSSxTQUFTLEVBQUUsQ0FBQztnQkFDZCx3RUFBd0U7Z0JBQ3hFLDRFQUE0RTtnQkFDNUUsT0FBTztvQkFDTCxJQUFJLEVBQUUsU0FBUztvQkFDZixLQUFLLEVBQUUsV0FBVyxTQUFTLEVBQUU7b0JBQzdCLFNBQVM7b0JBQ1QsUUFBUSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUM7b0JBQy9DLE1BQU0sRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDO2lCQUM1RCxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDbEYsSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUNYLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDN0MsT0FBTztnQkFDTCxJQUFJLEVBQUUsUUFBUTtnQkFDZCxLQUFLLEVBQUUsVUFBVSxXQUFXLEVBQUU7Z0JBQzlCLFNBQVMsRUFBRSxJQUFJO2dCQUNmLFFBQVEsRUFBRSxJQUFJO2dCQUNkLE1BQU0sRUFBRSxJQUFJO2FBQ2IsQ0FBQztRQUNKLENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7O09BR0c7SUFDSyxXQUFXLENBQUMsU0FBaUI7UUFDbkMsSUFBSSxJQUFJLEdBQUcsVUFBVSxDQUFDO1FBQ3RCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxTQUFTLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDdEQsSUFBSSxJQUFJLFNBQVMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDcEMsSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzQyxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVELDJDQUEyQztJQUNwQyxVQUFVO1FBQ2YsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDakQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDekMsT0FBTztnQkFDTCxNQUFNLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixFQUFFO2dCQUNsQyxZQUFZO2dCQUNaLFFBQVEsRUFBRSxJQUFJO2dCQUNkLEdBQUcsRUFBRSxJQUFJO2FBQ1YsQ0FBQztRQUNKLENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDMUQsT0FBTztZQUNMLE1BQU0sRUFBRSxNQUFNO1lBQ2QsWUFBWTtZQUNaLFFBQVEsRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQztZQUNuQyxHQUFHO1NBQ0osQ0FBQztJQUNKLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ssbUJBQW1CO1FBQ3pCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3JELE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsMEVBQTBFO0lBQ25FLFdBQVcsQ0FBQyxNQUFjO1FBQy9CLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDOUQseUJBQXlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUVELG9FQUFvRTtJQUM3RCxXQUFXO1FBQ2hCLElBQUksT0FBTyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDakQsQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist_ts/classes.codexdaemon.d.ts

@@ -0,0 +1,38 @@
+import type { ICommandResult, IDaemonStatus } from './interfaces.js';
+import { CodexHome } from './classes.codexhome.js';
+/**
+ * Drives the Codex CLI itself for everything Codex already exposes.
+ *
+ * The local app-server holds the remote-control websocket, keeps the state
+ * database open, and refreshes tokens on its own schedule, so a credential swap
+ * has to happen while it is stopped. Codex ships
+ * `codex app-server daemon {start,stop,version}` for exactly this, so authswitch
+ * goes through those rather than signalling pids behind Codex' back.
+ */
+export declare class CodexDaemon {
+    readonly codexHome: CodexHome;
+    private readonly binary;
+    constructor(codexHomeArg: CodexHome, binaryArg?: string);
+    /** Whether the Codex CLI can be executed at all. */
+    isAvailable(): boolean;
+    /**
+     * Authoritative daemon status, straight from Codex.
+     * Returns null when the Codex CLI cannot be reached or answers unexpectedly,
+     * which callers treat as "unknown" rather than "stopped".
+     */
+    status(): IDaemonStatus | null;
+    /** True when remote control is enabled for future daemon starts. */
+    isRemoteControlEnabled(): boolean;
+    /** The pid of the managed daemon, when its pid file is readable. */
+    daemonPid(): number | null;
+    /**
+     * Whether a daemon is up. Prefers Codex' own answer and falls back to the pid
+     * file so the check still works when the Codex CLI is not on PATH.
+     */
+    isDaemonRunning(): boolean;
+    stop(): ICommandResult;
+    start(): ICommandResult;
+    /** A one-line diagnosis of a failed invocation, suitable for an error message. */
+    describeFailure(resultArg: ICommandResult): string;
+    private run;
+}

package/dist_ts/classes.codexdaemon.js

@@ -0,0 +1,122 @@
+import * as plugins from './plugins.js';
+import { CodexHome } from './classes.codexhome.js';
+import { describeCodexFailure } from './helpers.js';
+/**
+ * Drives the Codex CLI itself for everything Codex already exposes.
+ *
+ * The local app-server holds the remote-control websocket, keeps the state
+ * database open, and refreshes tokens on its own schedule, so a credential swap
+ * has to happen while it is stopped. Codex ships
+ * `codex app-server daemon {start,stop,version}` for exactly this, so authswitch
+ * goes through those rather than signalling pids behind Codex' back.
+ */
+export class CodexDaemon {
+    codexHome;
+    binary;
+    constructor(codexHomeArg, binaryArg) {
+        this.codexHome = codexHomeArg;
+        this.binary = binaryArg ?? process.env.AUTHSWITCH_CODEX_BIN ?? 'codex';
+    }
+    /** Whether the Codex CLI can be executed at all. */
+    isAvailable() {
+        return this.run(['--version']).ok;
+    }
+    /**
+     * Authoritative daemon status, straight from Codex.
+     * Returns null when the Codex CLI cannot be reached or answers unexpectedly,
+     * which callers treat as "unknown" rather than "stopped".
+     */
+    status() {
+        const result = this.run(['app-server', 'daemon', 'version']);
+        if (!result.ok) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(result.stdout.trim());
+            return {
+                running: parsed.status === 'running',
+                backend: typeof parsed.backend === 'string' ? parsed.backend : null,
+                appServerVersion: typeof parsed.appServerVersion === 'string' ? parsed.appServerVersion : null,
+                cliVersion: typeof parsed.cliVersion === 'string' ? parsed.cliVersion : null,
+                socketPath: typeof parsed.socketPath === 'string' ? parsed.socketPath : null,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** True when remote control is enabled for future daemon starts. */
+    isRemoteControlEnabled() {
+        const settingsPath = this.codexHome.appServerSettingsPath;
+        if (!plugins.fs.existsSync(settingsPath)) {
+            return false;
+        }
+        try {
+            const parsed = JSON.parse(plugins.fs.readFileSync(settingsPath, 'utf8'));
+            return parsed.remoteControlEnabled === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** The pid of the managed daemon, when its pid file is readable. */
+    daemonPid() {
+        const pidPath = this.codexHome.appServerPidPath;
+        if (!plugins.fs.existsSync(pidPath)) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(plugins.fs.readFileSync(pidPath, 'utf8'));
+            return typeof parsed.pid === 'number' ? parsed.pid : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Whether a daemon is up. Prefers Codex' own answer and falls back to the pid
+     * file so the check still works when the Codex CLI is not on PATH.
+     */
+    isDaemonRunning() {
+        const status = this.status();
+        if (status !== null) {
+            return status.running;
+        }
+        const pid = this.daemonPid();
+        if (pid === null) {
+            return false;
+        }
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    stop() {
+        return this.run(['app-server', 'daemon', 'stop']);
+    }
+    start() {
+        return this.run(['app-server', 'daemon', 'start']);
+    }
+    /** A one-line diagnosis of a failed invocation, suitable for an error message. */
+    describeFailure(resultArg) {
+        return describeCodexFailure(this.binary, resultArg.stdout, resultArg.stderr, resultArg.spawnError);
+    }
+    run(argsArg) {
+        const result = plugins.childProcess.spawnSync(this.binary, argsArg, {
+            encoding: 'utf8',
+            timeout: 60_000,
+            env: { ...process.env, CODEX_HOME: this.codexHome.dir },
+        });
+        return {
+            ok: result.status === 0,
+            stdout: result.stdout ?? '',
+            stderr: result.stderr ?? '',
+            code: result.status,
+            spawnError: result.error ? result.error.message : null,
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jb2RleGRhZW1vbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuY29kZXhkYWVtb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUVwRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sT0FBTyxXQUFXO0lBQ04sU0FBUyxDQUFZO0lBQ3BCLE1BQU0sQ0FBUztJQUVoQyxZQUFZLFlBQXVCLEVBQUUsU0FBa0I7UUFDckQsSUFBSSxDQUFDLFNBQVMsR0FBRyxZQUFZLENBQUM7UUFDOUIsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsSUFBSSxPQUFPLENBQUM7SUFDekUsQ0FBQztJQUVELG9EQUFvRDtJQUM3QyxXQUFXO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTTtRQUNYLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxZQUFZLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNmLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBNEIsQ0FBQztZQUMzRSxPQUFPO2dCQUNMLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxLQUFLLFNBQVM7Z0JBQ3BDLE9BQU8sRUFBRSxPQUFPLE1BQU0sQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJO2dCQUNuRSxnQkFBZ0IsRUFDZCxPQUFPLE1BQU0sQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsSUFBSTtnQkFDOUUsVUFBVSxFQUFFLE9BQU8sTUFBTSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLElBQUk7Z0JBQzVFLFVBQVUsRUFBRSxPQUFPLE1BQU0sQ0FBQyxVQUFVLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFJO2FBQzdFLENBQUM7UUFDSixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVELG9FQUFvRTtJQUM3RCxzQkFBc0I7UUFDM0IsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQztRQUMxRCxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUN6QyxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FFdEUsQ0FBQztZQUNGLE9BQU8sTUFBTSxDQUFDLG9CQUFvQixLQUFLLElBQUksQ0FBQztRQUM5QyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO0lBQ0gsQ0FBQztJQUVELG9FQUFvRTtJQUM3RCxTQUFTO1FBQ2QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQztRQUNoRCxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBcUIsQ0FBQztZQUN4RixPQUFPLE9BQU8sTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUM1RCxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7T0FHRztJQUNJLGVBQWU7UUFDcEIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzdCLElBQUksTUFBTSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3BCLE9BQU8sTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUN4QixDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQzdCLElBQUksR0FBRyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2pCLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3JCLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztJQUNILENBQUM7SUFFTSxJQUFJO1FBQ1QsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFTSxLQUFLO1FBQ1YsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFFRCxrRkFBa0Y7SUFDM0UsZUFBZSxDQUFDLFNBQXlCO1FBQzlDLE9BQU8sb0JBQW9CLENBQ3pCLElBQUksQ0FBQyxNQUFNLEVBQ1gsU0FBUyxDQUFDLE1BQU0sRUFDaEIsU0FBUyxDQUFDLE1BQU0sRUFDaEIsU0FBUyxDQUFDLFVBQVUsQ0FDckIsQ0FBQztJQUNKLENBQUM7SUFFTyxHQUFHLENBQUMsT0FBaUI7UUFDM0IsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUU7WUFDbEUsUUFBUSxFQUFFLE1BQU07WUFDaEIsT0FBTyxFQUFFLE1BQU07WUFDZixHQUFHLEVBQUUsRUFBRSxHQUFHLE9BQU8sQ0FBQyxHQUFHLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFO1NBQ3hELENBQUMsQ0FBQztRQUNILE9BQU87WUFDTCxFQUFFLEVBQUUsTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQ3ZCLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUU7WUFDM0IsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRTtZQUMzQixJQUFJLEVBQUUsTUFBTSxDQUFDLE1BQU07WUFDbkIsVUFBVSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJO1NBQ3ZELENBQUM7SUFDSixDQUFDO0NBQ0YifQ==

package/dist_ts/classes.codexharness.d.ts

@@ -0,0 +1,35 @@
+import { CodexSwitcher } from './classes.codexswitcher.js';
+import { CodexAccountStatus } from './classes.codexstatus.js';
+import { CodexPreuse } from './classes.codexpreuse.js';
+import type { IAuthHarness, IHarnessAccountStatus, IHarnessOutcome, IHarnessState, IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
+import type { IHarnessLoginOptions, IHarnessLoginProvider } from './interfaces.harness.js';
+/** Codex-specific credentials, remote-control handling and service status. */
+export declare class CodexHarness implements IAuthHarness {
+    private readonly switcher;
+    private readonly accountStatus;
+    private readonly preuse;
+    readonly id = "codex";
+    readonly label = "Codex";
+    readonly loginHint = "Use authswitch codex login to sign in and save another account.";
+    readonly loginProviders: IHarnessLoginProvider[];
+    readonly diagnosticsLabel = "Check credential storage and remote control";
+    constructor(switcher?: CodexSwitcher, accountStatus?: Pick<CodexAccountStatus, 'read'>, preuse?: Pick<CodexPreuse, 'run'>);
+    beginLogin(options?: IHarnessLoginOptions): Promise<import("./interfaces.harness.js").IHarnessLoginHandle>;
+    readState(): IHarnessState;
+    readAccountStatus(accountIdArg: string): Promise<IHarnessAccountStatus>;
+    preuseAccount(accountIdArg: string, optionsArg: IHarnessPreuseOptions): Promise<IHarnessPreuseResult>;
+    private readAccountCredential;
+    private activeAccountId;
+    resolveAccount(referenceArg: string): {
+        id: string;
+    } | {
+        candidates: string[];
+    };
+    switchAccount(accountIdArg: string): IHarnessOutcome;
+    removeAccount(accountIdArg: string): IHarnessOutcome;
+    saveCurrent(optionsArg: {
+        keepActive: boolean;
+    }): IHarnessOutcome;
+    private formatRemoteControl;
+    diagnose(): IHarnessOutcome;
+}