agent-shim 8.15.0 → 8.16.0

package/dist/cli.cjs

@@ -14464,7 +14464,7 @@ var require_client = __commonJS({
     "use strict";
     var assert2 = require("node:assert");
     var net3 = require("node:net");
-    var http6 = require("node:http");
+    var http7 = require("node:http");
     var util = require_util2();
     var { ClientStats } = require_stats();
     var { channels } = require_diagnostics();
@@ -14522,7 +14522,7 @@ var require_client = __commonJS({
     var connectH1 = require_client_h1();
     var connectH2 = require_client_h2();
     var kClosedResolve = /* @__PURE__ */ Symbol("kClosedResolve");
-    var getDefaultNodeMaxHeaderSize = http6 && http6.maxHeaderSize && Number.isInteger(http6.maxHeaderSize) && http6.maxHeaderSize > 0 ? () => http6.maxHeaderSize : () => {
+    var getDefaultNodeMaxHeaderSize = http7 && http7.maxHeaderSize && Number.isInteger(http7.maxHeaderSize) && http7.maxHeaderSize > 0 ? () => http7.maxHeaderSize : () => {
       throw new InvalidArgumentError2("http module not available or http.maxHeaderSize invalid");
     };
     var noop = () => {
@@ -55242,6 +55242,8 @@ var ProviderEnvSchema = external_exports.record(external_exports.string().min(1)
 var PROVIDER_KINDS = ["http", "codex"];
 var CODEX_TIERS = ["fable", "opus", "sonnet", "haiku"];
 var CODEX_EFFORTS = ["none", "low", "medium", "high"];
+var CODEX_LOGINS = ["codex-cli", "chatgpt-sign-in"];
+var CODEX_DEFAULT_LOGIN = "codex-cli";
 var CODEX_DEFAULT_MODEL = "gpt-5.6-sol";
 var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
   fable: "gpt-5.6-sol",
@@ -55261,7 +55263,9 @@ var CodexProviderConfigSchema = external_exports.strictObject({
     haiku: external_exports.string().min(1).optional()
   }).optional(),
   /** The reasoning effort used when the request's own `output_config.effort` is not one the backend accepts. */
-  effort: external_exports.enum(CODEX_EFFORTS).optional()
+  effort: external_exports.enum(CODEX_EFFORTS).optional(),
+  /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
+  login: external_exports.enum(CODEX_LOGINS).optional()
 });
 var HttpProviderSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
@@ -60278,6 +60282,7 @@ function buildLayoutPaths(root) {
     frontdoorCaCertFile: import_node_path19.default.join(root, "frontdoor", "ca", "ca.pem"),
     frontdoorCaKeyFile: import_node_path19.default.join(root, "frontdoor", "ca", "ca.key"),
     frontdoorCaBundlesDir: import_node_path19.default.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: import_node_path19.default.join(root, "codex", "chatgpt-sign-in.json"),
     frontdoorStateFile: import_node_path19.default.join(root, "frontdoor", "state.json"),
     frontdoorLockFile: import_node_path19.default.join(root, "frontdoor", "start.lock"),
     frontdoorControlTokenFile: import_node_path19.default.join(root, "frontdoor", "control-token"),
@@ -61744,7 +61749,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.15.0",
+  version: "8.16.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -63484,7 +63489,7 @@ var ProviderKindMismatchError = class extends UsageError {
   }
 };
 function isEmptyCodexConfig(config2) {
-  return config2 === void 0 || config2.defaultModel === void 0 && config2.effort === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
+  return config2 === void 0 || config2.defaultModel === void 0 && config2.effort === void 0 && config2.login === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
 }
 function addProvider(paths, name, input2) {
   if (providerExists(paths, name)) {
@@ -64121,7 +64126,7 @@ function registerCheckCommand(program2, deps) {
 }
 
 // src/codex/commands.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_os6 = __toESM(require("node:os"), 1);
 var import_node_path31 = __toESM(require("node:path"), 1);
@@ -64272,8 +64277,273 @@ function createCodexAuthStore(authPath, ports) {
   };
 }
 
-// src/codex/upstream.ts
+// src/codex/siwc.ts
 var import_node_crypto6 = require("node:crypto");
+var SIWC_AUTHORIZE_URL = "https://auth.openai.com/api/accounts/authorize";
+var SIWC_TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+var SIWC_REVOKE_URL = "https://auth.openai.com/api/accounts/oauth/revoke";
+var SIWC_ISSUER = "https://auth.openai.com";
+var SIWC_JWKS_URL = "https://auth.openai.com/.well-known/jwks.json";
+var SIWC_DYNAMIC_CLIENT_ID = "dynamic_agent_client";
+var SIWC_RESOURCE = "https://api.openai.com/v1";
+var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
+var SIWC_SCOPES = ["openid", "profile", "email", "offline_access", "resource.invoke", "chatgpt.tokens.use.direct"];
+var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SIWC_CALLBACK_PORT = 1455;
+var SIWC_CALLBACK_PATH = "/auth/callback";
+var SIWC_RANDOM_BYTES = 32;
+var MS_PER_SECOND4 = 1e3;
+var ID_TOKEN_ALGORITHM = "RS256";
+var SiwcError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SiwcError";
+  }
+};
+var SiwcInvalidGrantError = class extends SiwcError {
+  constructor(message) {
+    super(message);
+    this.name = "SiwcInvalidGrantError";
+  }
+};
+function base64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function newPkce(randomBytes4) {
+  const verifier = base64Url(randomBytes4(SIWC_RANDOM_BYTES));
+  return { verifier, challenge: (0, import_node_crypto6.createHash)("sha256").update(verifier).digest("base64url") };
+}
+function newOpaqueValue(randomBytes4) {
+  return base64Url(randomBytes4(SIWC_RANDOM_BYTES));
+}
+function buildAuthorizeUrl(request7) {
+  const url2 = new URL(SIWC_AUTHORIZE_URL);
+  const params = url2.searchParams;
+  params.set("client_id", request7.clientId ?? SIWC_DYNAMIC_CLIENT_ID);
+  if (request7.clientId === void 0) {
+    params.set("agent_name_hint", request7.agentName);
+  }
+  if (request7.returning !== void 0) {
+    params.set("id_token_hint", request7.returning.idToken);
+    if (request7.returning.loginHint !== void 0) {
+      params.set("login_hint", request7.returning.loginHint);
+    }
+  }
+  params.set("response_type", "code");
+  params.set("redirect_uri", request7.redirectUri);
+  params.set("scope", SIWC_SCOPES.join(" "));
+  params.set("resource", SIWC_RESOURCE);
+  params.set("state", request7.state);
+  params.set("nonce", request7.nonce);
+  params.set("code_challenge_method", "S256");
+  params.set("code_challenge", request7.challenge);
+  return url2.toString();
+}
+function parseCallback(url2, expectedState) {
+  const params = url2.searchParams;
+  const error62 = params.get("error");
+  if (error62 !== null) {
+    throw new SiwcError(`the sign-in was refused: ${error62}${params.has("error_description") ? ` (${params.get("error_description") ?? ""})` : ""}`);
+  }
+  if (params.get("state") !== expectedState) {
+    throw new SiwcError("the sign-in callback's state did not match the request, so it was discarded");
+  }
+  const code = params.get("code");
+  if (code === null || code === "") {
+    throw new SiwcError("the sign-in callback carried no authorization code");
+  }
+  const scope = params.get("scope");
+  return { code, clientId: params.get("client_id") ?? void 0, scopes: scope === null ? [] : scope.split(" ").filter((part) => part !== "") };
+}
+var TokenResponseSchema = external_exports.looseObject({
+  access_token: external_exports.string().min(1),
+  refresh_token: external_exports.string().min(1).optional(),
+  id_token: external_exports.string().min(1).optional(),
+  expires_in: external_exports.number().positive(),
+  scope: external_exports.string().optional()
+});
+var ERROR_BODY_CHARS = 300;
+var TOKEN_CALL_TIMEOUT_MS = 3e4;
+async function postToken(ports, form, what) {
+  const response = await ports.fetch(SIWC_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ ...form, resource: SIWC_RESOURCE }).toString(),
+    signal: AbortSignal.timeout(TOKEN_CALL_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    const detail = (await response.text()).slice(0, ERROR_BODY_CHARS);
+    const message = `the ${what} failed with HTTP ${String(response.status)}: ${detail}`;
+    throw /"error"\s*:\s*"invalid_grant"/.test(detail) ? new SiwcInvalidGrantError(message) : new SiwcError(message);
+  }
+  const parsed = TokenResponseSchema.safeParse(await response.json());
+  if (!parsed.success) {
+    throw new SiwcError(`the ${what} answered without an access token and a lifetime`);
+  }
+  return parsed.data;
+}
+function grantTokens(ports, answer) {
+  return {
+    accessToken: answer.access_token,
+    refreshToken: answer.refresh_token,
+    idToken: answer.id_token,
+    scopes: answer.scope === void 0 ? void 0 : answer.scope.split(" ").filter((part) => part !== ""),
+    expiresAt: ports.now().getTime() + answer.expires_in * MS_PER_SECOND4
+  };
+}
+async function exchangeCode(ports, request7) {
+  return grantTokens(
+    ports,
+    await postToken(ports, { grant_type: "authorization_code", client_id: request7.clientId, code: request7.code, code_verifier: request7.verifier, redirect_uri: request7.redirectUri }, "authorisation code exchange")
+  );
+}
+async function refreshTokens(ports, request7) {
+  return grantTokens(ports, await postToken(ports, { grant_type: "refresh_token", client_id: request7.clientId, refresh_token: request7.refreshToken }, "token refresh"));
+}
+var JwtHeaderSchema = external_exports.looseObject({ alg: external_exports.string(), kid: external_exports.string().optional() });
+var IdTokenClaimsSchema = external_exports.looseObject({
+  iss: external_exports.string(),
+  sub: external_exports.string().min(1),
+  aud: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())]),
+  exp: external_exports.number(),
+  nonce: external_exports.string().optional(),
+  email: external_exports.string().optional()
+});
+var JwksSchema = external_exports.object({ keys: external_exports.array(external_exports.looseObject({ kid: external_exports.string().optional(), kty: external_exports.string() })) });
+function decodeSegment(segment) {
+  if (segment === void 0) {
+    throw new SiwcError("the ID token is not a three-part JWT");
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return parsed;
+  } catch {
+    throw new SiwcError("the ID token has an unreadable segment");
+  }
+}
+async function verifyIdToken(ports, idToken, expected) {
+  const [headerSegment, payloadSegment, signatureSegment, ...rest] = idToken.split(".");
+  if (rest.length > 0 || headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
+    throw new SiwcError("the ID token is not a three-part JWT");
+  }
+  const header = JwtHeaderSchema.parse(decodeSegment(headerSegment));
+  if (header.alg !== ID_TOKEN_ALGORITHM) {
+    throw new SiwcError(`the ID token is signed with ${header.alg}, and only ${ID_TOKEN_ALGORITHM} is accepted`);
+  }
+  const response = await ports.fetch(SIWC_JWKS_URL, { method: "GET", headers: {}, signal: AbortSignal.timeout(TOKEN_CALL_TIMEOUT_MS) });
+  if (!response.ok) {
+    throw new SiwcError(`the issuer's key set could not be fetched (HTTP ${String(response.status)})`);
+  }
+  const jwk = JwksSchema.parse(await response.json()).keys.find((key) => key.kty === "RSA" && (header.kid === void 0 || key.kid === header.kid));
+  if (jwk === void 0) {
+    throw new SiwcError("the issuer's key set has no key for the ID token's signature");
+  }
+  const signed = Buffer.from(`${headerSegment}.${payloadSegment}`);
+  if (!(0, import_node_crypto6.verify)("sha256", signed, (0, import_node_crypto6.createPublicKey)({ key: jwk, format: "jwk" }), Buffer.from(signatureSegment, "base64url"))) {
+    throw new SiwcError("the ID token's signature did not verify");
+  }
+  const claims = IdTokenClaimsSchema.parse(decodeSegment(payloadSegment));
+  if (claims.iss !== SIWC_ISSUER) {
+    throw new SiwcError(`the ID token was issued by ${claims.iss}, not ${SIWC_ISSUER}`);
+  }
+  if (!(Array.isArray(claims.aud) ? claims.aud : [claims.aud]).includes(expected.clientId)) {
+    throw new SiwcError("the ID token was issued for a different client");
+  }
+  if (claims.exp * MS_PER_SECOND4 <= ports.now().getTime()) {
+    throw new SiwcError("the ID token has already expired");
+  }
+  if (expected.nonce !== void 0 && claims.nonce !== expected.nonce) {
+    throw new SiwcError("the ID token's nonce did not match the request");
+  }
+  return { sub: claims.sub, email: claims.email };
+}
+
+// src/codex/siwcLogin.ts
+var SIWC_AGENT_NAME = "agent-shim";
+var SIWC_LOGIN_TIMEOUT_MS = 3e5;
+async function runSiwcLogin(ports, options) {
+  const existing = ports.store.read();
+  const returning = existing?.grant;
+  for (let attempt = 0; ; attempt += 1) {
+    const clientId = ports.store.read()?.registeredClientId ?? returning?.clientId;
+    try {
+      return await authorizeOnce(ports, options, clientId, attempt === 0 ? returning : void 0);
+    } catch (error62) {
+      if (!(error62 instanceof SiwcInvalidGrantError) || attempt > 0) {
+        throw error62;
+      }
+      ports.print("OpenAI did not accept the first code, which is expected once after registering: authorising again with the registration it issued.");
+    }
+  }
+}
+async function authorizeOnce(ports, options, savedClientId, returning) {
+  const pkce = newPkce(ports.siwc.randomBytes);
+  const state = newOpaqueValue(ports.siwc.randomBytes);
+  const nonce = newOpaqueValue(ports.siwc.randomBytes);
+  const redirectUri = `http://127.0.0.1:${String(SIWC_CALLBACK_PORT)}${SIWC_CALLBACK_PATH}`;
+  const url2 = buildAuthorizeUrl({
+    clientId: savedClientId,
+    agentName: SIWC_AGENT_NAME,
+    redirectUri,
+    state,
+    nonce,
+    challenge: pkce.challenge,
+    ...returning === void 0 ? {} : { returning: { idToken: returning.idToken, loginHint: returning.email } }
+  });
+  const listener = await ports.listen(SIWC_CALLBACK_PORT, state);
+  try {
+    ports.print(`Sign in at: ${url2}`);
+    if (options.open) {
+      ports.openBrowser(url2);
+    }
+    const callback = parseCallback(await listener.waitForCallback(AbortSignal.timeout(SIWC_LOGIN_TIMEOUT_MS)), state);
+    const clientId = callback.clientId ?? savedClientId;
+    if (clientId === void 0) {
+      throw new SiwcError("the sign-in callback carried no client id and none was stored from an earlier sign-in");
+    }
+    const grantBefore = ports.store.read()?.grant;
+    ports.store.write({ registeredClientId: clientId, ...grantBefore === void 0 ? {} : { grant: grantBefore } });
+    const tokens = await exchangeCode(ports.siwc, { clientId, code: callback.code, verifier: pkce.verifier, redirectUri });
+    if (tokens.refreshToken === void 0 || tokens.idToken === void 0) {
+      throw new SiwcError("the token endpoint did not return a refresh token and an ID token, so the sign-in cannot be kept");
+    }
+    const scopes = tokens.scopes ?? callback.scopes;
+    if (!scopes.includes(SIWC_PLAN_SCOPE)) {
+      throw new SiwcError("the sign-in was not granted permission to use your ChatGPT plan: run the login again and allow it");
+    }
+    const identity = await verifyIdToken(ports.siwc, tokens.idToken, { clientId, nonce });
+    ports.store.write({
+      registeredClientId: clientId,
+      grant: { clientId, sub: identity.sub, ...identity.email === void 0 ? {} : { email: identity.email }, idToken: tokens.idToken, accessToken: tokens.accessToken, refreshToken: tokens.refreshToken, scopes, expiresAt: tokens.expiresAt }
+    });
+    return { email: identity.email, sub: identity.sub };
+  } finally {
+    listener.close();
+  }
+}
+var REVOKE_TIMEOUT_MS = 3e4;
+async function runSiwcLogout(ports) {
+  const file2 = ports.store.read();
+  if (file2?.grant === void 0) {
+    return { hadGrant: false, revoked: false };
+  }
+  const revoked = await ports.siwc.fetch(SIWC_REVOKE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ token: file2.grant.refreshToken, token_type_hint: "refresh_token", client_id: file2.grant.clientId }).toString(),
+    signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+  }).then(
+    (response) => response.ok,
+    () => false
+  );
+  ports.store.write({ registeredClientId: file2.grant.clientId });
+  return { hadGrant: true, revoked };
+}
+
+// src/codex/siwcPorts.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_crypto7 = require("node:crypto");
+var import_node_http = __toESM(require("node:http"), 1);
 
 // src/codex/http.ts
 var HTTP_STATUS = {
@@ -64291,7 +64561,157 @@ var HTTP_STATUS = {
   badGateway: 502
 };
 
+// src/codex/siwcPorts.ts
+function realSiwcPorts(fetch3) {
+  return { fetch: fetch3, randomBytes: (size) => (0, import_node_crypto7.randomBytes)(size), now: () => /* @__PURE__ */ new Date() };
+}
+var CALLBACK_PAGE = "<!doctype html><meta charset=utf-8><title>Signed in</title><p>You can close this tab and return to the terminal.</p>";
+async function listenForCallback(port, state) {
+  let deliver;
+  const arrived = new Promise((resolve) => {
+    deliver = resolve;
+  });
+  const server = import_node_http.default.createServer((request7, response) => {
+    const url2 = new URL(request7.url ?? "/", `http://127.0.0.1:${String(port)}`);
+    if (request7.method !== "GET" || url2.pathname !== SIWC_CALLBACK_PATH || url2.searchParams.getAll("state").length !== 1 || url2.searchParams.get("state") !== state) {
+      response.writeHead(HTTP_STATUS.notFound).end("Not found");
+      return;
+    }
+    response.writeHead(HTTP_STATUS.ok, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(CALLBACK_PAGE);
+    deliver?.(url2);
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", (error62) => {
+      reject(error62.code === "EADDRINUSE" ? new Error(`port ${String(port)} is in use (another sign-in, such as \`codex login\`, may be running): finish or stop it and try again`) : error62);
+    });
+    server.listen(port, "127.0.0.1", () => {
+      resolve();
+    });
+  });
+  return {
+    waitForCallback: async (signal) => await Promise.race([
+      arrived,
+      new Promise((_resolve, reject) => {
+        signal.addEventListener("abort", () => {
+          reject(new Error("timed out waiting for the browser sign-in to finish"));
+        });
+      })
+    ]),
+    close: () => {
+      server.close();
+      server.closeAllConnections();
+    }
+  };
+}
+function openInBrowser(url2) {
+  const command = process.platform === "darwin" ? { file: "open", args: [url2] } : process.platform === "win32" ? { file: "cmd", args: ["/c", "start", "", url2] } : { file: "xdg-open", args: [url2] };
+  (0, import_node_child_process4.spawn)(command.file, command.args, { detached: true, stdio: "ignore" }).unref();
+}
+
+// src/codex/siwcStore.ts
+var SiwcGrantSchema = external_exports.strictObject({
+  clientId: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  email: external_exports.string().optional(),
+  idToken: external_exports.string().min(1),
+  accessToken: external_exports.string().min(1),
+  refreshToken: external_exports.string().min(1),
+  scopes: external_exports.array(external_exports.string()).readonly(),
+  /** When the access token stops working, in milliseconds since the epoch. */
+  expiresAt: external_exports.number()
+});
+var SiwcFileSchema = external_exports.strictObject({ registeredClientId: external_exports.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+var SIWC_REFRESH_MARGIN_MS = 6e4;
+function parseSiwcFile(raw, filePath) {
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new CodexAuthError(`${filePath} is not valid JSON: run \`agent-shim codex login\` again`);
+  }
+  const parsed = SiwcFileSchema.safeParse(json2);
+  if (!parsed.success) {
+    throw new CodexAuthError(`${filePath} is not a Sign in with ChatGPT file: run \`agent-shim codex login\` again`);
+  }
+  return parsed.data;
+}
+function grantFrom(previous, tokens) {
+  return {
+    ...previous,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken ?? previous.refreshToken,
+    idToken: tokens.idToken ?? previous.idToken,
+    scopes: tokens.scopes ?? previous.scopes,
+    expiresAt: tokens.expiresAt
+  };
+}
+function createSiwcStore(filePath, ports) {
+  let cached2;
+  let inFlight;
+  const read = () => {
+    const raw = ports.fs.read(filePath);
+    return raw === void 0 ? void 0 : parseSiwcFile(raw, filePath);
+  };
+  const write = (file2) => {
+    const temp = `${filePath}.${ports.tempSuffix}.tmp`;
+    ports.fs.writePrivate(temp, `${JSON.stringify(file2, null, 2)}
+`);
+    ports.fs.rename(temp, filePath);
+    cached2 = file2.grant;
+  };
+  const loadSignedIn = () => {
+    const file2 = read();
+    if (file2?.grant === void 0) {
+      throw new CodexAuthError(`no Sign in with ChatGPT login at ${filePath}: run \`agent-shim codex login\` first`);
+    }
+    if (!file2.grant.scopes.includes(SIWC_PLAN_SCOPE)) {
+      throw new CodexAuthError(`the Sign in with ChatGPT login at ${filePath} was not granted permission to use your ChatGPT plan: run \`agent-shim codex login\` again and allow it`);
+    }
+    return { file: file2, grant: file2.grant };
+  };
+  const credentialsOf2 = (grant) => ({ accessToken: grant.accessToken, accountId: void 0 });
+  const doRefresh = async (rejected) => {
+    const { file: file2, grant } = loadSignedIn();
+    if (rejected !== void 0 && grant.accessToken !== rejected) {
+      cached2 = grant;
+      return credentialsOf2(grant);
+    }
+    let tokens;
+    try {
+      tokens = await refreshTokens(ports.siwc, { clientId: grant.clientId, refreshToken: grant.refreshToken });
+    } catch (error62) {
+      if (error62 instanceof SiwcError) {
+        throw new CodexAuthError(`${error62.message}: run \`agent-shim codex login\` again if the login was revoked`);
+      }
+      throw error62;
+    }
+    const next = grantFrom(grant, tokens);
+    write({ ...file2, grant: next });
+    return credentialsOf2(next);
+  };
+  const refreshOnce = async (rejected) => await (inFlight ??= doRefresh(rejected).finally(() => {
+    inFlight = void 0;
+  }));
+  return {
+    read,
+    write,
+    auth: {
+      current: async () => {
+        const grant = cached2 ?? loadSignedIn().grant;
+        cached2 = grant;
+        if (grant.expiresAt - SIWC_REFRESH_MARGIN_MS <= ports.siwc.now().getTime()) {
+          return await refreshOnce(void 0);
+        }
+        return credentialsOf2(grant);
+      },
+      refresh: async (rejected) => await refreshOnce(rejected)
+    }
+  };
+}
+
 // src/codex/upstream.ts
+var import_node_crypto8 = require("node:crypto");
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var CODEX_UPSTREAM_TIMEOUT_MS = 3e5;
 var CODEX_HEADERS_TIMEOUT_MS = 15e3;
@@ -64327,12 +64747,17 @@ function sessionIdFor(userId, randomId) {
   if (userId === void 0 || userId === "") {
     return randomId();
   }
-  const hex3 = (0, import_node_crypto6.createHash)("sha256").update(`agent-shim codex session
+  const hex3 = (0, import_node_crypto8.createHash)("sha256").update(`agent-shim codex session
 ${userId}`).digest("hex");
   let next = 0;
   return UUID_TEMPLATE.replace(/x/g, () => hex3.charAt(next++));
 }
-function headersFor(credentials, sessionId) {
+var CODEX_BACKEND_TARGET = { url: CODEX_RESPONSES_URL, headers: codexBackendHeaders };
+var RESPONSES_API_TARGET = {
+  url: SIWC_RESPONSES_URL,
+  headers: (credentials) => ({ "Content-Type": "application/json", Accept: "text/event-stream", Authorization: `Bearer ${credentials.accessToken}` })
+};
+function codexBackendHeaders(credentials, sessionId) {
   return {
     "Content-Type": "application/json",
     Accept: "text/event-stream",
@@ -64344,11 +64769,11 @@ function headersFor(credentials, sessionId) {
   };
 }
 async function callCodex(ports, request7, sessionId, signal) {
-  const url2 = ports.url ?? CODEX_RESPONSES_URL;
+  const target = ports.target ?? CODEX_BACKEND_TARGET;
   const body = JSON.stringify(request7);
-  const send = async (credentials2) => await fetchUntilHeaders(ports.fetch, ports.timers, url2, {
+  const send = async (credentials2) => await fetchUntilHeaders(ports.fetch, ports.timers, target.url, {
     method: "POST",
-    headers: headersFor(credentials2, sessionId),
+    headers: target.headers(credentials2, sessionId),
     body,
     signal: AbortSignal.any([signal, AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS)])
   });
@@ -64384,6 +64809,7 @@ var realCodexAuthFs = {
     }
   },
   writePrivate: (filePath, contents) => {
+    import_node_fs11.default.mkdirSync(import_node_path31.default.dirname(filePath), { recursive: true });
     import_node_fs11.default.writeFileSync(filePath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
     import_node_fs11.default.chmodSync(filePath, PRIVATE_FILE_MODE);
   },
@@ -64403,17 +64829,22 @@ function writeUsageSnapshot(log, snapshot) {
     log(`usage snapshot write failed: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
 }
-function createCodexRoutePorts(log) {
+function createCodexRoutePorts(log, signInFile) {
   const agent = createUpstreamAgent();
   const upstreamFetch = createUpstreamFetch(agent);
+  const tempSuffix = `${String(process.pid)}.${(0, import_node_crypto9.randomUUID)()}`;
   const auth = createCodexAuthStore(import_node_path31.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
     fs: realCodexAuthFs,
     fetch: upstreamFetch,
     now: () => /* @__PURE__ */ new Date(),
-    tempSuffix: `${String(process.pid)}.${(0, import_node_crypto7.randomUUID)()}`
+    tempSuffix
   });
+  const signIn = createSiwcStore(signInFile, { fs: realCodexAuthFs, siwc: realSiwcPorts(upstreamFetch), tempSuffix });
   return {
-    upstream: { fetch: upstreamFetch, auth, timers: realTimers, randomId: import_node_crypto7.randomUUID },
+    upstreams: {
+      "codex-cli": { fetch: upstreamFetch, auth, timers: realTimers, randomId: import_node_crypto9.randomUUID },
+      "chatgpt-sign-in": { fetch: upstreamFetch, auth: signIn.auth, timers: realTimers, randomId: import_node_crypto9.randomUUID, target: RESPONSES_API_TARGET }
+    },
     writeUsageSnapshot: (snapshot) => {
       writeUsageSnapshot(log, snapshot);
     },
@@ -64421,6 +64852,18 @@ function createCodexRoutePorts(log) {
     log
   };
 }
+function readSignInStatus(fsPort, filePath) {
+  const raw = fsPort.readFileUtf8(filePath);
+  if (raw === void 0) {
+    return { state: "none" };
+  }
+  try {
+    const file2 = parseSiwcFile(raw, filePath);
+    return file2.grant === void 0 ? { state: "none" } : { state: "signed-in", email: file2.grant.email, planScope: file2.grant.scopes.includes(SIWC_PLAN_SCOPE), accessTokenExpiresAt: file2.grant.expiresAt };
+  } catch (error62) {
+    return { state: "unreadable", message: error62 instanceof Error ? error62.message : String(error62) };
+  }
+}
 function codexProviderNames(fsPort, providersDir) {
   return readAllProviders(fsPort, providersDir).filter((entry) => isCodexProvider(entry.provider)).map((entry) => entry.name).sort();
 }
@@ -64431,12 +64874,22 @@ function collectCodexStatus(fsPort, paths, isRunning) {
     supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
     sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
     codexProviders: codexProviderNames(fsPort, paths.providersDir),
+    signIn: readSignInStatus(fsPort, paths.chatgptSignInFile),
     usageSnapshotPath: codexUsageSnapshotPath(),
     usageSnapshotExists: fsPort.readFileUtf8(codexUsageSnapshotPath()) !== void 0,
     logPath: paths.frontdoorLogPath,
     logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
   };
 }
+function formatSignIn(signIn) {
+  if (signIn.state === "none") {
+    return "chatgpt sign-in: not signed in (run `agent-shim codex login`)";
+  }
+  if (signIn.state === "unreadable") {
+    return `chatgpt sign-in: ${signIn.message}`;
+  }
+  return `chatgpt sign-in: signed in${signIn.email === void 0 ? "" : ` as ${signIn.email}`}${signIn.planScope ? "" : ", WITHOUT permission to use your ChatGPT plan (run `agent-shim codex login` again and allow it)"}`;
+}
 function formatCodexStatus(status) {
   const lines = [];
   lines.push(
@@ -64457,10 +64910,24 @@ function formatCodexStatus(status) {
   if (status.frontDoor.lastError !== void 0) {
     lines.push(`last error: ${status.frontDoor.lastError}`);
   }
+  lines.push(formatSignIn(status.signIn));
   lines.push(`usage snapshot: ${status.usageSnapshotPath}${status.usageSnapshotExists ? "" : " (not created yet)"}`);
   lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
   return lines;
 }
+function realSiwcLoginPorts(paths) {
+  const siwc = realSiwcPorts(createUpstreamFetch(createUpstreamAgent()));
+  const store = createSiwcStore(paths.chatgptSignInFile, { fs: realCodexAuthFs, siwc, tempSuffix: `${String(process.pid)}.${(0, import_node_crypto9.randomUUID)()}` });
+  return {
+    store,
+    siwc,
+    listen: listenForCallback,
+    openBrowser: openInBrowser,
+    print: (line) => {
+      console.log(line);
+    }
+  };
+}
 function registerCodexCommand(program2, deps) {
   const { paths } = deps;
   const codex = withExamples(program2.command("codex").description("Inspect the codex translation the front-door daemon serves for codex providers."), ["agent-shim codex status"]);
@@ -64477,10 +64944,38 @@ function registerCodexCommand(program2, deps) {
     }),
     ["agent-shim codex status", "agent-shim codex status --json"]
   );
+  withExamples(
+    codex.command("login").description("Sign in with ChatGPT so a codex provider with `codex.login` set to `chatgpt-sign-in` can spend your ChatGPT plan on OpenAI's public Responses API. Opens your browser.").option("--no-open", "Print the sign-in address instead of opening the browser.").option("--json", "Print the result as JSON.").action(async (options) => {
+      const ports = realSiwcLoginPorts(paths);
+      const result = await runSiwcLogin(options.json === true ? { ...ports, print: () => void 0 } : ports, { open: options.open });
+      if (options.json === true) {
+        printJson({ action: "login", email: result.email ?? null, sub: result.sub });
+        return;
+      }
+      console.log(`Signed in${result.email === void 0 ? "" : ` as ${result.email}`}. Set "codex": { "login": "chatgpt-sign-in" } on a codex provider to use it.`);
+    }),
+    ["agent-shim codex login", "agent-shim codex login --no-open"]
+  );
+  withExamples(
+    codex.command("logout").description("Revoke the Sign in with ChatGPT login and remove it from this machine.").option("--json", "Print the result as JSON.").action(async (options) => {
+      const ports = realSiwcLoginPorts(paths);
+      const result = await runSiwcLogout(ports);
+      if (options.json === true) {
+        printJson({ action: "logout", ...result });
+        return;
+      }
+      if (!result.hadGrant) {
+        console.log("Not signed in.");
+        return;
+      }
+      console.log(result.revoked ? "Signed out and revoked the login at OpenAI." : "Signed out here, but OpenAI could not be told to revoke the login: revoke it in ChatGPT settings.");
+    }),
+    ["agent-shim codex logout"]
+  );
 }
 
 // src/frontdoor/commands.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var import_node_path36 = __toESM(require("node:path"), 1);
 var import_node_fs13 = __toESM(require("node:fs"), 1);
 
@@ -64585,7 +65080,7 @@ function createDoorPipelines(deps) {
 }
 
 // src/frontdoor/capability.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var CONNECT_PROXY_USER = "agent-shim";
 var CONNECT_PROXY_REALM = "agent-shim front door";
 var BASIC_SCHEME = "basic";
@@ -64607,13 +65102,13 @@ function capabilityFromProxyAuthorization(value2) {
   return password === "" ? void 0 : password;
 }
 function digest(token) {
-  return (0, import_node_crypto8.createHash)("sha256").update(token, "utf8").digest();
+  return (0, import_node_crypto10.createHash)("sha256").update(token, "utf8").digest();
 }
 function isLiveCapability(presented, live) {
   const presentedDigest = digest(presented);
   let matched = false;
   for (const token of live) {
-    const equal = (0, import_node_crypto8.timingSafeEqual)(presentedDigest, digest(token));
+    const equal = (0, import_node_crypto10.timingSafeEqual)(presentedDigest, digest(token));
     matched = equal || matched;
   }
   return matched;
@@ -64757,11 +65252,11 @@ function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
 }
 
 // src/frontdoor/connect.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var fs13 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/x509.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var import_node_net = __toESM(require("node:net"), 1);
 var TAG_BOOLEAN = 1;
 var TAG_INTEGER = 2;
@@ -64797,7 +65292,7 @@ var HIGH_BIT = 128;
 var BASE_128_PAYLOAD_MASK = 127;
 var FIRST_ARC_WEIGHT = 40;
 var SHORT_FORM_MAX_LENGTH = 127;
-var MS_PER_SECOND4 = 1e3;
+var MS_PER_SECOND5 = 1e3;
 var UTC_TIME_LAST_YEAR = 2049;
 var YEAR_DIGITS = 4;
 var TWO_DIGIT_YEAR_DIGITS = 2;
@@ -64856,7 +65351,7 @@ function wholeBitString(content) {
   return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
 }
 function time3(instant) {
-  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND4) * MS_PER_SECOND4).toISOString();
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND5) * MS_PER_SECOND5).toISOString();
   const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
   if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
     return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
@@ -64913,7 +65408,7 @@ function ipBytes(address) {
   return bytes;
 }
 function keyIdentifier(publicKey) {
-  return (0, import_node_crypto9.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
+  return (0, import_node_crypto11.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
 }
 function readElement(buffer, offset) {
   const tag = buffer[offset];
@@ -64959,7 +65454,7 @@ ${body.join("\n")}
 `;
 }
 function randomSerial() {
-  const bytes = (0, import_node_crypto9.randomBytes)(SERIAL_NUMBER_BYTES);
+  const bytes = (0, import_node_crypto11.randomBytes)(SERIAL_NUMBER_BYTES);
   bytes[0] = (bytes[0] ?? 0) & BASE_128_PAYLOAD_MASK | HIGH_BIT >> 1;
   return bytes;
 }
@@ -64974,7 +65469,7 @@ function assemble(spec) {
     spec.subjectPublicKey.export({ type: "spki", format: "der" }),
     tlv(TAG_EXTENSIONS, sequence(...spec.extensions))
   );
-  const signature = (0, import_node_crypto9.sign)("sha256", tbs, spec.signingKey);
+  const signature = (0, import_node_crypto11.sign)("sha256", tbs, spec.signingKey);
   return sequence(tbs, SIGNATURE_ALGORITHM, wholeBitString(signature));
 }
 function subjectKeyIdentifierExtension(publicKey) {
@@ -64984,7 +65479,7 @@ function basicConstraintsExtension(isCa) {
   return extension(OID_BASIC_CONSTRAINTS, true, sequence(...isCa ? [boolean4(true)] : []));
 }
 function rsaKeyPair() {
-  return (0, import_node_crypto9.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
+  return (0, import_node_crypto11.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
 }
 function keyPem(privateKey) {
   return privateKey.export({ type: "pkcs8", format: "pem" });
@@ -65008,8 +65503,8 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   if (commonName === void 0) {
     throw new Error("a leaf certificate needs at least one name");
   }
-  const caCertificate = new import_node_crypto9.X509Certificate(ca.certPem);
-  const caPrivateKey = (0, import_node_crypto9.createPrivateKey)(ca.keyPem);
+  const caCertificate = new import_node_crypto11.X509Certificate(ca.certPem);
+  const caPrivateKey = (0, import_node_crypto11.createPrivateKey)(ca.keyPem);
   const { publicKey, privateKey } = rsaKeyPair();
   const generalNames = names.map((name) => import_node_net.default.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
   const der = assemble({
@@ -65106,22 +65601,22 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   };
   writeFrontDoorState(fs19, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
-  let http6;
+  let http7;
   try {
-    http6 = await ports.startProviderListener(lastPort);
+    http7 = await ports.startProviderListener(lastPort);
   } catch (error62) {
     return fail(`could not start the provider listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
-  if (previousSticky !== void 0 && http6.port !== previousSticky) {
-    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http6.port)} (sessions launched against the old port are stale until they relaunch)`);
+  if (previousSticky !== void 0 && http7.port !== previousSticky) {
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http7.port)} (sessions launched against the old port are stale until they relaunch)`);
   }
-  lastPort = http6.port;
+  lastPort = http7.port;
   const previousStickyConnect = lastConnectPort;
   let connect3;
   try {
     connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error62) {
-    await http6.close();
+    await http7.close();
     return fail(`could not start the CONNECT surface: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
@@ -65134,16 +65629,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error62) {
     await connect3.close();
-    await http6.close();
+    await http7.close();
     return fail(`could not start the direct listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http6.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http7.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs19.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http6.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http7.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -65151,14 +65646,17 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs19, paths.frontdoorSessionsDir).length === 0) {
+    const listed = listFrontDoorSessions(fs19, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
+    ports.observeLaunchRegistry(listed, pruned);
+    const prunedPids = new Set(pruned);
+    if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE2) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect3.close();
-        await http6.close();
+        await http7.close();
         ports.closeRcStreamHub();
         writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
         return 0;
@@ -65274,8 +65772,8 @@ function ensureCa(store, generate) {
 }
 function caParses(ca) {
   try {
-    new import_node_crypto10.X509Certificate(ca.certPem);
-    (0, import_node_crypto10.createPrivateKey)(ca.keyPem);
+    new import_node_crypto12.X509Certificate(ca.certPem);
+    (0, import_node_crypto12.createPrivateKey)(ca.keyPem);
     return true;
   } catch {
     return false;
@@ -65563,13 +66061,13 @@ function realConnectCertStore(paths) {
 
 // src/frontdoor/connectEffects.ts
 var import_node_dns = __toESM(require("node:dns"), 1);
-var http2 = __toESM(require("node:http"), 1);
+var http3 = __toESM(require("node:http"), 1);
 var https3 = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 
 // src/frontdoor/server.ts
-var import_node_http = __toESM(require("node:http"), 1);
+var import_node_http2 = __toESM(require("node:http"), 1);
 var import_node_https = __toESM(require("node:https"), 1);
 
 // src/frontdoor/rcControl.ts
@@ -66646,7 +67144,7 @@ function createFrontDoorServer(pipeline, log, tls2, control, api) {
     });
   };
   if (tls2 === void 0) {
-    return import_node_http.default.createServer(handler);
+    return import_node_http2.default.createServer(handler);
   }
   const server = import_node_https.default.createServer({ key: tls2.keyPem, cert: tls2.certPem }, handler);
   server.on("tlsClientError", (_error, socket) => {
@@ -66661,7 +67159,7 @@ async function frontDoorHealthy(port, ca) {
       resolve(response.statusCode === HTTP_STATUS.ok);
     };
     const options = { host: "127.0.0.1", port, path: "/healthz", agent: false, timeout: HEALTH_TIMEOUT_MS };
-    const request7 = ca === void 0 ? import_node_http.default.get(options, onResponse) : import_node_https.default.get({ ...options, ca: [ca] }, onResponse);
+    const request7 = ca === void 0 ? import_node_http2.default.get(options, onResponse) : import_node_https.default.get({ ...options, ca: [ca] }, onResponse);
     request7.on("timeout", () => {
       request7.destroy();
     });
@@ -66816,7 +67314,7 @@ async function reservedDial(target, ports) {
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
-var ExemptHttpAgent = class extends http2.Agent {
+var ExemptHttpAgent = class extends http3.Agent {
   constructor(ports = DOOR_SOURCE_PORTS) {
     super();
     this.ports = ports;
@@ -67087,7 +67585,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
       };
     },
     createHttpSession: (handler, onUpgrade) => {
-      const server = http2.createServer(handler);
+      const server = http3.createServer(handler);
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
@@ -67157,7 +67655,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
         }
         upstreamResponse.pipe(response);
       };
-      const upstream = target.tls ? https3.request(options, onUpstreamResponse) : http2.request(options, onUpstreamResponse);
+      const upstream = target.tls ? https3.request(options, onUpstreamResponse) : http3.request(options, onUpstreamResponse);
       upstream.on("error", (error62) => {
         if (response.headersSent) {
           response.destroy(error62);
@@ -67282,7 +67780,21 @@ function cacheClause(cacheEnv, owner, block2) {
   const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
   return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
 }
-function pushProvider(push, entry, cacheEnv) {
+function signInProblem(signIn) {
+  if (signIn.raw === void 0) {
+    return "nobody is signed in: run `agent-shim codex login`.";
+  }
+  try {
+    const grant = parseSiwcFile(signIn.raw, signIn.path).grant;
+    if (grant === void 0) {
+      return "nobody is signed in: run `agent-shim codex login`.";
+    }
+    return grant.scopes.includes(SIWC_PLAN_SCOPE) ? void 0 : "the login was not given permission to use your ChatGPT plan: run `agent-shim codex login` again and allow it.";
+  } catch (error62) {
+    return error62 instanceof Error ? error62.message : String(error62);
+  }
+}
+function pushProvider(push, entry, cacheEnv, signIn) {
   if (entry.raw === void 0) {
     push("provider", "fail", `${entry.path} is missing.`, entry.name);
     return;
@@ -67309,6 +67821,12 @@ function pushProvider(push, entry, cacheEnv) {
   if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
     push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
   }
+  if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
+    const problem = signInProblem(signIn);
+    if (problem !== void 0) {
+      push("provider", "warn", `${entry.name} uses the Sign in with ChatGPT login, but ${problem}`, entry.name);
+    }
+  }
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
@@ -67433,7 +67951,7 @@ function runDoctor(params) {
     return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
-    pushProvider(push, entry, params.credentialCache);
+    pushProvider(push, entry, params.credentialCache, params.chatgptSignIn);
   }
   if (params.platform !== "darwin" || params.run === void 0) {
     push("keychain", "pass", "Skipped (not macOS).");
@@ -67675,6 +68193,7 @@ function collectDoctorReport(params) {
   const report = runDoctor({
     env: params.env,
     credentialCache: realCredentialCacheEnv(paths),
+    chatgptSignIn: { path: paths.chatgptSignInFile, raw: realFsPort.readFileUtf8(paths.chatgptSignInFile) },
     installedClaudeVersions: realInstalledClaudeVersions(),
     identities,
     configProfiles,
@@ -68870,6 +69389,56 @@ var DoctorRunOutputSchema = external_exports.strictObject({
   findings: external_exports.readonly(external_exports.array(DoctorFindingSchema))
 });
 
+// node_modules/.pnpm/@orpc+contract@1.15.4/node_modules/@orpc/contract/dist/shared/contract.D_dZrO__.mjs
+var ValidationError = class extends Error {
+  issues;
+  data;
+  constructor(options) {
+    super(options.message, options);
+    this.issues = options.issues;
+    this.data = options.data;
+  }
+};
+function mergeErrorMap(errorMap1, errorMap2) {
+  return { ...errorMap1, ...errorMap2 };
+}
+async function validateORPCError(map3, error62) {
+  const { code, status, message, data, cause, defined } = error62;
+  const config2 = map3?.[error62.code];
+  if (!config2 || fallbackORPCErrorStatus(error62.code, config2.status) !== error62.status) {
+    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
+  }
+  if (!config2.data) {
+    return defined ? error62 : new ORPCError(code, { defined: true, status, message, data, cause });
+  }
+  const validated2 = await config2.data["~standard"].validate(error62.data);
+  if (validated2.issues) {
+    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
+  }
+  return new ORPCError(code, { defined: true, status, message, data: validated2.value, cause });
+}
+var ContractProcedure = class {
+  /**
+   * This property holds the defined options for the contract procedure.
+   */
+  "~orpc";
+  constructor(def) {
+    if (def.route?.successStatus && isORPCErrorStatus(def.route.successStatus)) {
+      throw new Error("[ContractProcedure] Invalid successStatus.");
+    }
+    if (Object.values(def.errorMap).some((val) => val && val.status && !isORPCErrorStatus(val.status))) {
+      throw new Error("[ContractProcedure] Invalid error status code.");
+    }
+    this["~orpc"] = def;
+  }
+};
+function isContractProcedure(item) {
+  if (item instanceof ContractProcedure) {
+    return true;
+  }
+  return (typeof item === "object" || typeof item === "function") && item !== null && "~orpc" in item && typeof item["~orpc"] === "object" && item["~orpc"] !== null && "errorMap" in item["~orpc"] && "route" in item["~orpc"] && "meta" in item["~orpc"];
+}
+
 // node_modules/.pnpm/@orpc+standard-server-fetch@1.15.4/node_modules/@orpc/standard-server-fetch/dist/index.mjs
 function toEventIterator(stream, options = {}) {
   const eventStream = stream?.pipeThrough(new TextDecoderStream()).pipeThrough(new EventDecoderStream());
@@ -69581,93 +70150,6 @@ var StandardRPCLink = class extends StandardLink {
   }
 };
 
-// node_modules/.pnpm/@orpc+client@1.15.4/node_modules/@orpc/client/dist/adapters/fetch/index.mjs
-var CompositeLinkFetchPlugin = class extends CompositeStandardLinkPlugin {
-  initRuntimeAdapter(options) {
-    for (const plugin of this.plugins) {
-      plugin.initRuntimeAdapter?.(options);
-    }
-  }
-};
-var LinkFetchClient = class {
-  fetch;
-  toFetchRequestOptions;
-  adapterInterceptors;
-  constructor(options) {
-    const plugin = new CompositeLinkFetchPlugin(options.plugins);
-    plugin.initRuntimeAdapter(options);
-    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
-    this.toFetchRequestOptions = options;
-    this.adapterInterceptors = toArray(options.adapterInterceptors);
-  }
-  async call(standardRequest, options, path44, input2) {
-    const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
-    const fetchResponse = await intercept(
-      this.adapterInterceptors,
-      { ...options, request: request7, path: path44, input: input2, init: { redirect: "manual" } },
-      ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
-    );
-    const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
-    return lazyResponse;
-  }
-};
-var RPCLink = class extends StandardRPCLink {
-  constructor(options) {
-    const linkClient = new LinkFetchClient(options);
-    super(linkClient, options);
-  }
-};
-
-// node_modules/.pnpm/@orpc+contract@1.15.4/node_modules/@orpc/contract/dist/shared/contract.D_dZrO__.mjs
-var ValidationError = class extends Error {
-  issues;
-  data;
-  constructor(options) {
-    super(options.message, options);
-    this.issues = options.issues;
-    this.data = options.data;
-  }
-};
-function mergeErrorMap(errorMap1, errorMap2) {
-  return { ...errorMap1, ...errorMap2 };
-}
-async function validateORPCError(map3, error62) {
-  const { code, status, message, data, cause, defined } = error62;
-  const config2 = map3?.[error62.code];
-  if (!config2 || fallbackORPCErrorStatus(error62.code, config2.status) !== error62.status) {
-    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
-  }
-  if (!config2.data) {
-    return defined ? error62 : new ORPCError(code, { defined: true, status, message, data, cause });
-  }
-  const validated2 = await config2.data["~standard"].validate(error62.data);
-  if (validated2.issues) {
-    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
-  }
-  return new ORPCError(code, { defined: true, status, message, data: validated2.value, cause });
-}
-var ContractProcedure = class {
-  /**
-   * This property holds the defined options for the contract procedure.
-   */
-  "~orpc";
-  constructor(def) {
-    if (def.route?.successStatus && isORPCErrorStatus(def.route.successStatus)) {
-      throw new Error("[ContractProcedure] Invalid successStatus.");
-    }
-    if (Object.values(def.errorMap).some((val) => val && val.status && !isORPCErrorStatus(val.status))) {
-      throw new Error("[ContractProcedure] Invalid error status code.");
-    }
-    this["~orpc"] = def;
-  }
-};
-function isContractProcedure(item) {
-  if (item instanceof ContractProcedure) {
-    return true;
-  }
-  return (typeof item === "object" || typeof item === "function") && item !== null && "~orpc" in item && typeof item["~orpc"] === "object" && item["~orpc"] !== null && "errorMap" in item["~orpc"] && "route" in item["~orpc"] && "meta" in item["~orpc"];
-}
-
 // node_modules/.pnpm/@orpc+contract@1.15.4/node_modules/@orpc/contract/dist/index.mjs
 function mergeMeta(meta1, meta22) {
   return { ...meta1, ...meta22 };
@@ -70612,6 +71094,43 @@ var os7 = new Builder({
   dedupeLeadingMiddlewares: true
 });
 
+// node_modules/.pnpm/@orpc+client@1.15.4/node_modules/@orpc/client/dist/adapters/fetch/index.mjs
+var CompositeLinkFetchPlugin = class extends CompositeStandardLinkPlugin {
+  initRuntimeAdapter(options) {
+    for (const plugin of this.plugins) {
+      plugin.initRuntimeAdapter?.(options);
+    }
+  }
+};
+var LinkFetchClient = class {
+  fetch;
+  toFetchRequestOptions;
+  adapterInterceptors;
+  constructor(options) {
+    const plugin = new CompositeLinkFetchPlugin(options.plugins);
+    plugin.initRuntimeAdapter(options);
+    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.toFetchRequestOptions = options;
+    this.adapterInterceptors = toArray(options.adapterInterceptors);
+  }
+  async call(standardRequest, options, path44, input2) {
+    const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
+    const fetchResponse = await intercept(
+      this.adapterInterceptors,
+      { ...options, request: request7, path: path44, input: input2, init: { redirect: "manual" } },
+      ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
+    );
+    const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
+    return lazyResponse;
+  }
+};
+var RPCLink = class extends StandardRPCLink {
+  constructor(options) {
+    const linkClient = new LinkFetchClient(options);
+    super(linkClient, options);
+  }
+};
+
 // node_modules/.pnpm/@orpc+standard-server-node@1.15.4/node_modules/@orpc/standard-server-node/dist/index.mjs
 var import_node_buffer = require("node:buffer");
 var import_node_stream = require("node:stream");
@@ -71335,6 +71854,62 @@ function frontDoorRcApiClient(port, ca, token) {
   return createORPCClient(frontDoorApiLink(port, ca, token));
 }
 
+// src/frontdoor/eventSchemas.ts
+var DOOR_EVENT_SOURCE_RC = "rc";
+var LAUNCH_EVENT_SOURCE = "launch";
+var DoorEventSchema = external_exports.strictObject({
+  source: external_exports.string().min(1),
+  /** A positive integer because the backbone's counters start at one and only ever increase. */
+  sequence: external_exports.number().int().positive(),
+  payload: external_exports.unknown()
+});
+var DoorEventSourceQuerySchema = external_exports.strictObject({
+  sources: external_exports.array(external_exports.string().min(1)).min(1).optional()
+});
+var LaunchLifecycleEventSchema = external_exports.strictObject({
+  kind: external_exports.enum(["registered", "pruned", "ended"]),
+  pid: external_exports.number().int().positive(),
+  startedAt: external_exports.number(),
+  observedAt: external_exports.number()
+});
+
+// src/frontdoor/eventsApi.ts
+function createEventsApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    events: {
+      subscribe: authed.input(DoorEventSourceQuerySchema).output(eventIterator(DoorEventSchema)).handler(async function* ({ input: input2, signal }) {
+        if (input2.sources !== void 0) {
+          const live = deps.events.sources();
+          const unknown2 = input2.sources.filter((source) => !live.includes(source));
+          if (unknown2.length > 0) {
+            throw new ORPCError("NOT_FOUND", { message: `the door publishes no event source named ${unknown2.map((source) => `"${source}"`).join(", ")}; the live sources are ${live.map((source) => `"${source}"`).join(", ")}` });
+          }
+        }
+        const stream = deps.events.stream(input2.sources);
+        const ended = new Promise((resolve) => {
+          signal?.addEventListener("abort", () => {
+            resolve();
+          }, { once: true });
+        });
+        try {
+          for (; ; ) {
+            signal?.throwIfAborted();
+            const next = await Promise.race([stream.next(), ended.then(() => ({ value: void 0, done: true }))]);
+            if (next.done === true) {
+              signal?.throwIfAborted();
+              return;
+            }
+            yield withEventMeta(next.value, { id: String(next.value.sequence) });
+          }
+        } finally {
+          stream.close();
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
@@ -71373,14 +71948,156 @@ function createControlApiRouter(deps) {
   };
 }
 function createDoorApiRouter(deps) {
-  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps) };
+  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps));
 }
 
+// src/frontdoor/eventHub.ts
+var DOOR_EVENT_BUFFER_EVENTS = 100;
+function createDoorEventHub() {
+  const sequences = /* @__PURE__ */ new Map();
+  const registered = /* @__PURE__ */ new Set();
+  const every = /* @__PURE__ */ new Set();
+  const bySource = /* @__PURE__ */ new Map();
+  const deliver = (event) => {
+    for (const listener of every) {
+      listener(event);
+    }
+    for (const listener of bySource.get(event.source) ?? []) {
+      listener(event);
+    }
+  };
+  const publish = (source, payload) => {
+    const sequence2 = (sequences.get(source) ?? 0) + 1;
+    sequences.set(source, sequence2);
+    deliver({ source, sequence: sequence2, payload });
+  };
+  const addListener = (sources, listener) => {
+    if (sources === void 0) {
+      every.add(listener);
+      return () => {
+        every.delete(listener);
+      };
+    }
+    const listenersFor = (source) => {
+      const listeners = bySource.get(source) ?? /* @__PURE__ */ new Set();
+      bySource.set(source, listeners);
+      return listeners;
+    };
+    const detachers = sources.map((source) => {
+      const listeners = listenersFor(source);
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+        if (listeners.size === 0) {
+          bySource.delete(source);
+        }
+      };
+    });
+    return () => {
+      for (const detach of detachers) {
+        detach();
+      }
+    };
+  };
+  return {
+    publisher: (source) => {
+      registered.add(source);
+      return {
+        source,
+        publish: (payload) => {
+          publish(source, payload);
+        }
+      };
+    },
+    subscribe: addListener,
+    stream: (sources) => {
+      const queue = [];
+      let wake;
+      let closed = false;
+      const detach = addListener(sources, (event) => {
+        if (queue.length >= DOOR_EVENT_BUFFER_EVENTS) {
+          queue.shift();
+        }
+        queue.push(event);
+        wake?.();
+      });
+      return {
+        next: async () => {
+          for (; ; ) {
+            const event = queue.shift();
+            if (event !== void 0) {
+              return { value: event, done: false };
+            }
+            if (closed) {
+              return { value: void 0, done: true };
+            }
+            await new Promise((resolve) => {
+              wake = resolve;
+            });
+          }
+        },
+        close: () => {
+          closed = true;
+          detach();
+          wake?.();
+        }
+      };
+    },
+    sources: () => [...registered].sort()
+  };
+}
+function rcFanoutOnDoorHub(fanout, hub) {
+  const publisher = hub.publisher(DOOR_EVENT_SOURCE_RC);
+  return {
+    publish: (event) => {
+      fanout.publish(event);
+      publisher.publish(event);
+    },
+    subscribe: (session, listener) => fanout.subscribe(session, listener)
+  };
+}
+
+// src/frontdoor/launchEvents.ts
+function createLaunchEventPublisher(hub, now) {
+  const publisher = hub.publisher(LAUNCH_EVENT_SOURCE);
+  let known;
+  return {
+    observe: (sessions, pruned) => {
+      const previous = known;
+      const listed = new Map(sessions.map((session) => [session.pid, session]));
+      const prunedSet = new Set(pruned);
+      known = new Map([...listed].filter(([pid]) => !prunedSet.has(pid)));
+      if (previous === void 0) {
+        return;
+      }
+      const emit = (kind, pid, startedAt) => {
+        publisher.publish({ kind, pid, startedAt, observedAt: now() });
+      };
+      for (const pid of pruned) {
+        const session = listed.get(pid);
+        if (session !== void 0) {
+          emit("pruned", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of previous) {
+        if (!listed.has(pid) && !prunedSet.has(pid)) {
+          emit("ended", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of listed) {
+        if (!previous.has(pid) && !prunedSet.has(pid)) {
+          emit("registered", pid, session.startedAt);
+        }
+      }
+    }
+  };
+}
+
 // src/frontdoor/headroomHop.ts
-var http3 = __toESM(require("node:http"), 1);
+var http4 = __toESM(require("node:http"), 1);
 var HTTP_BAD_GATEWAY2 = HTTP_STATUS.badGateway;
 function responseHeaders(headers) {
   const result = {};
@@ -71434,7 +72151,7 @@ async function answerBadGateway(response, message) {
   await response.write(JSON.stringify({ type: "error", error: { type: "api_error", message } }));
   response.end();
 }
-var HOP_AGENT = new http3.Agent({ keepAlive: false });
+var HOP_AGENT = new http4.Agent({ keepAlive: false });
 async function forwardThroughHeadroom(request7, response, target) {
   const { socketPath, headers } = target;
   await new Promise((resolve) => {
@@ -71462,7 +72179,7 @@ async function forwardThroughHeadroom(request7, response, target) {
       };
       void stream();
     };
-    const hop = http3.request({ socketPath, method: request7.method, path: request7.url, headers, agent: HOP_AGENT }, onUpstreamResponse);
+    const hop = http4.request({ socketPath, method: request7.method, path: request7.url, headers, agent: HOP_AGENT }, onUpstreamResponse);
     hop.on("error", (error62) => {
       const phase = response.headersSent ? "mid-stream" : "before the response started";
       const code = "code" in error62 && typeof error62.code === "string" ? ` ${error62.code}` : "";
@@ -71651,7 +72368,7 @@ async function serveRouted(request7, deps) {
 }
 
 // src/codex/translate.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 
 // src/codex/anthropic.ts
 var TextBlockSchema = external_exports.looseObject({ type: external_exports.literal("text"), text: external_exports.string() });
@@ -71730,7 +72447,8 @@ function resolveCodexConfig(config2) {
       sonnet: overrides?.sonnet ?? CODEX_DEFAULT_TIER_MODELS.sonnet,
       haiku: overrides?.haiku ?? CODEX_DEFAULT_TIER_MODELS.haiku
     },
-    effort: config2?.effort ?? CODEX_DEFAULT_EFFORT
+    effort: config2?.effort ?? CODEX_DEFAULT_EFFORT,
+    login: config2?.login ?? CODEX_DEFAULT_LOGIN
   };
 }
 function mapModel(requested, config2) {
@@ -71763,7 +72481,7 @@ function shortToolName(name, names) {
   if (name.length <= CODEX_TOOL_NAME_LIMIT) {
     return name;
   }
-  const hash2 = (0, import_node_crypto11.createHash)("sha256").update(name).digest("hex").slice(0, TOOL_NAME_HASH_CHARS);
+  const hash2 = (0, import_node_crypto13.createHash)("sha256").update(name).digest("hex").slice(0, TOOL_NAME_HASH_CHARS);
   const shortened = `${name.slice(0, CODEX_TOOL_NAME_LIMIT - TOOL_NAME_HASH_CHARS - 1)}_${hash2}`;
   names.set(shortened, name);
   return shortened;
@@ -72039,17 +72757,17 @@ function unifiedQuotaHeaders(upstream, rejected, quotaError) {
   }
   return headers;
 }
-var MS_PER_SECOND5 = 1e3;
+var MS_PER_SECOND6 = 1e3;
 function buildUsageSnapshot(upstream, quotaError, nowMs) {
   const used7 = upstream.get("x-codex-primary-used-percent") ?? (quotaError === void 0 ? null : EXHAUSTED_PERCENT);
   const reset7 = upstream.get("x-codex-primary-reset-at") ?? (quotaError?.resets_at === void 0 ? null : String(quotaError.resets_at));
-  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND5).toISOString() } : void 0;
+  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND6).toISOString() } : void 0;
   let fiveHour;
   if (Number(upstream.get("x-codex-secondary-window-minutes")) > 0) {
     const used5 = upstream.get("x-codex-secondary-used-percent");
     const reset5 = upstream.get("x-codex-secondary-reset-at");
     if (used5 !== null && reset5 !== null) {
-      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND5).toISOString() };
+      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND6).toISOString() };
     }
   }
   if (sevenDay === void 0 && fiveHour === void 0) {
@@ -72266,12 +72984,13 @@ function createCodexRoute(ports) {
     }
     const body = parsed.data;
     const requestedModel = body.model ?? "";
+    const upstreamPorts = ports.upstreams[config2.login];
     const { request: upstreamRequest, toolNames } = translateRequest(body, config2);
     const started = ports.now();
     const elapsed = () => `${String(ports.now() - started)}ms`;
     let upstream;
     try {
-      upstream = await callCodex(ports.upstream, upstreamRequest, sessionIdFor(body.metadata?.user_id, ports.upstream.randomId), request7.signal);
+      upstream = await callCodex(upstreamPorts, upstreamRequest, sessionIdFor(body.metadata?.user_id, upstreamPorts.randomId), request7.signal);
     } catch (error62) {
       if (request7.signal.aborted) {
         return errorResponse(HTTP_STATUS.clientClosedRequest, "client disconnected");
@@ -72304,7 +73023,7 @@ function createCodexRoute(ports) {
       });
     }
     snapshot(void 0);
-    const relay = createRelay({ requestedModel, toolNames, fallbackId: () => `msg_${ports.upstream.randomId()}` });
+    const relay = createRelay({ requestedModel, toolNames, fallbackId: () => `msg_${upstreamPorts.randomId()}` });
     const upstreamBody = upstream.body;
     const quota = { ...quotaHeaders(upstream.headers), ...unifiedQuotaHeaders(upstream.headers, false, void 0) };
     const logCompleted = (message, usage) => {
@@ -72469,7 +73188,7 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
 }
 
 // src/frontdoor/passthrough.ts
-var http4 = __toESM(require("node:http"), 1);
+var http5 = __toESM(require("node:http"), 1);
 var https4 = __toESM(require("node:https"), 1);
 function responseHeaders2(headers) {
   const result = {};
@@ -72523,7 +73242,7 @@ function createPassthroughRoute(name, target) {
           };
           void stream();
         };
-        const forward = tls2 ? https4.request(options, onUpstreamResponse) : http4.request(options, onUpstreamResponse);
+        const forward = tls2 ? https4.request(options, onUpstreamResponse) : http5.request(options, onUpstreamResponse);
         forward.on("error", (error62) => {
           if (!response.headersSent) {
             response.start(HTTP_STATUS.badGateway, { "Content-Type": "application/json" });
@@ -72701,7 +73420,7 @@ var RC_SESSION_ID_PREFIX2 = "cse_";
 var RC_SELF_HOST_API_BASE_URL = "https://api.anthropic.com";
 var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
 var HTTP_CONFLICT = 409;
-var MS_PER_SECOND6 = 1e3;
+var MS_PER_SECOND7 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE = 503;
 var RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
 var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
@@ -72776,7 +73495,7 @@ function parseJsonObject2(body) {
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
   const header = encode3({ alg: "HS256", typ: "JWT" });
-  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND6) / MS_PER_SECOND6), iat: Math.floor(issuedAt / MS_PER_SECOND6) });
+  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND7) / MS_PER_SECOND7), iat: Math.floor(issuedAt / MS_PER_SECOND7) });
   return `${header}.${payload}.${Buffer.from(randomToken(), "utf8").toString("base64url")}`;
 }
 function growthBookFeatures() {
@@ -73227,7 +73946,7 @@ data: ${JSON.stringify(envelope)}
       }
       if (method === "POST" && pathname.startsWith("/api/eval/")) {
         await readBody3(request7, CONTROL_BODY_CAP_BYTES);
-        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND6) });
+        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND7) });
         return true;
       }
       if (method === "GET" && pathname === "/api/oauth/profile") {
@@ -73715,7 +74434,7 @@ var ProviderQuotaError = class extends Error {
     this.name = "ProviderQuotaError";
   }
 };
-var MS_PER_SECOND7 = 1e3;
+var MS_PER_SECOND8 = 1e3;
 var SECONDS_PER_HOUR = 3600;
 var HOURS_PER_DAY3 = 24;
 var DAYS_PER_MONTH = 30;
@@ -73727,8 +74446,8 @@ var ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
 var ZAI_UNIT_HOURS = 3;
 var ZAI_UNIT_MONTHS = 5;
 var ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
-  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
+  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND8],
+  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8]
 ]);
 var ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
 var ZaiLimitSchema = external_exports.object({
@@ -73761,8 +74480,8 @@ function zaiWindow(limit) {
 var zaiQuotaAdapter = {
   source: ZAI_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === ZAI_HOST,
-  fetch: async (apiKey, http6, signal, nowMs) => {
-    const response = await http6(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
+  fetch: async (apiKey, http7, signal, nowMs) => {
+    const response = await http7(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
     if (response.status !== HTTP_OK) {
       throw new ProviderQuotaError(ZAI_SOURCE, `answered HTTP ${String(response.status)}`);
     }
@@ -73792,7 +74511,7 @@ var OPENROUTER_HOST = "openrouter.ai";
 var OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
 var OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
 var HTTP_FORBIDDEN = 403;
-var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
+var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8;
 var OpenRouterKeySchema = external_exports.object({
   data: external_exports.object({
     limit: external_exports.number().nonnegative().nullable(),
@@ -73803,8 +74522,8 @@ var OpenRouterKeySchema = external_exports.object({
   })
 });
 var OpenRouterCreditsSchema = external_exports.object({ data: external_exports.object({ total_credits: external_exports.number().nonnegative(), total_usage: external_exports.number().nonnegative() }) });
-async function openRouterGet(url2, schema, apiKey, http6, signal) {
-  const response = await http6(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
+async function openRouterGet(url2, schema, apiKey, http7, signal) {
+  const response = await http7(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
   if (response.status === HTTP_FORBIDDEN) {
     return "forbidden";
   }
@@ -73829,12 +74548,12 @@ function nextUtcMidnight(nowMs) {
 var openRouterQuotaAdapter = {
   source: OPENROUTER_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === OPENROUTER_HOST,
-  fetch: async (apiKey, http6, signal, nowMs) => {
-    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http6, signal);
+  fetch: async (apiKey, http7, signal, nowMs) => {
+    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http7, signal);
     if (key === "forbidden") {
       throw new ProviderQuotaError(OPENROUTER_SOURCE, "/api/v1/key refused the key (HTTP 403)");
     }
-    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http6, signal);
+    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http7, signal);
     const { limit, limit_remaining: limitRemaining, limit_reset: limitReset, free_model_daily_requests: free, is_free_tier: isFreeTier } = key.data;
     const windows = [];
     if (limit !== null && limit > 0) {
@@ -74010,7 +74729,7 @@ function realFrontDoorSupervisorPorts(paths) {
   };
   let directPort = 0;
   const rcSelfHost = rcSelfHostFromEnv(process.env);
-  const codexPorts = createCodexRoutePorts(log);
+  const codexPorts = createCodexRoutePorts(log, paths.chatgptSignInFile);
   let ca;
   const loadCa = () => {
     ca ??= ensureCa(realConnectCertStore(paths), () => generateCa(/* @__PURE__ */ new Date()));
@@ -74027,14 +74746,15 @@ function realFrontDoorSupervisorPorts(paths) {
   };
   const rcSelfHostSurface = rcSelfHost ? createRcSelfHostSurface({
     now: () => Date.now(),
-    newUuid: import_node_crypto12.randomUUID,
-    randomToken: () => (0, import_node_crypto12.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
+    newUuid: import_node_crypto14.randomUUID,
+    randomToken: () => (0, import_node_crypto14.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
     credentialRecord: () => readRcSelfHostRecord(realFarmFs, paths.frontdoorDir),
     log
   }) : void 0;
   const rcCredentialStore = createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir);
   const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS, credentialStore: rcCredentialStore });
-  const rcFanout = createRcEventFanout();
+  const doorEvents = createDoorEventHub();
+  const rcFanout = rcFanoutOnDoorHub(createRcEventFanout(), doorEvents);
   const rcHub = createRcStreamHub({
     now: () => Date.now(),
     credentialOf: rcTracker.credentialOf,
@@ -74045,7 +74765,7 @@ function realFrontDoorSupervisorPorts(paths) {
     saveSequenceNum: rcCredentialStore.writeCursor,
     dial: rcSelfHost ? lateRcStreamDial(rcSelfHostDialTarget) : realRcStreamDial(),
     fanout: rcFanout,
-    newClientId: import_node_crypto12.randomUUID,
+    newClientId: import_node_crypto14.randomUUID,
     backoffMs: RC_STREAM_BACKOFF_MS,
     sleep: async (ms) => {
       await new Promise((resolve) => {
@@ -74056,7 +74776,7 @@ function realFrontDoorSupervisorPorts(paths) {
       appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
     }
   });
-  const rcControlToken = (0, import_node_crypto12.randomUUID)();
+  const rcControlToken = (0, import_node_crypto14.randomUUID)();
   const resolveRoute = rcObservingResolver(
     createProviderRouteResolver({ fs: realFsPort, providersDir: paths.providersDir, codexPorts, directPort: () => directPort, ...rcSelfHostSurface === void 0 ? {} : { rcSelfHostRoute: rcSelfHostSurface.route } }),
     rcTracker,
@@ -74087,8 +74807,8 @@ function realFrontDoorSupervisorPorts(paths) {
     now: () => Date.now(),
     headroomSocket: () => headroomSocketTarget(realFarmFs, realHeadroomSocketTrust, paths),
     // The per-generation capability the direct listener demands: held only in this process's memory, so a loopback process that discovers the direct port still cannot use it.
-    hopSecret: (0, import_node_crypto12.randomUUID)(),
-    custody: createCredentialCustody(() => (0, import_node_crypto12.randomUUID)()),
+    hopSecret: (0, import_node_crypto14.randomUUID)(),
+    custody: createCredentialCustody(() => (0, import_node_crypto14.randomUUID)()),
     log
   });
   const onListenerError = (name) => (error62) => {
@@ -74109,9 +74829,9 @@ function realFrontDoorSupervisorPorts(paths) {
     startProviderListener: async (preferredPort) => {
       const authority = loadCa();
       const rcDial = rcSelfHost ? lateRcEventDial(rcSelfHostDialTarget) : realRcEventDial();
-      const rcInject = async (sessionId, text2) => await injectRcUserMessage({ credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto12.randomUUID }, sessionId, text2);
+      const rcInject = async (sessionId, text2) => await injectRcUserMessage({ credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto14.randomUUID }, sessionId, text2);
       const rcAnswer = async (sessionId, requestId, decision) => await answerRcControlRequest({ credentialOf: rcTracker.credentialOf, pendingOf: (id) => rcTracker.pendingOf(id), completePending: rcTracker.completePending, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial }, sessionId, requestId, decision);
-      const rcControlRequestDeps = { credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto12.randomUUID };
+      const rcControlRequestDeps = { credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto14.randomUUID };
       const rcInterrupt = async (sessionId) => await interruptRcSession(rcControlRequestDeps, sessionId);
       const rcSetModel = async (sessionId, model) => await setRcSessionModel(rcControlRequestDeps, sessionId, model);
       const rcSetPermissionMode = async (sessionId, mode) => await setRcSessionPermissionMode(rcControlRequestDeps, sessionId, mode);
@@ -74144,7 +74864,8 @@ function realFrontDoorSupervisorPorts(paths) {
           setModel: rcSetModel,
           setPermissionMode: rcSetPermissionMode,
           fanout: rcFanout,
-          ...controlDeps
+          ...controlDeps,
+          events: doorEvents
         })
       );
       const handle = await listenFrontDoor(server, { ...preferredPort === void 0 ? {} : { preferredPort }, ca: authority.certPem, onError: onListenerError("provider") });
@@ -74158,7 +74879,7 @@ function realFrontDoorSupervisorPorts(paths) {
     },
     startConnectListener: async (preferredPort) => {
       const wantedTransparentPort = process.env.AGENT_SHIM_TRANSPARENT_SURFACE === void 0 ? void 0 : Number(process.env.AGENT_SHIM_TRANSPARENT_SURFACE);
-      const transparentCapability = wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort) ? void 0 : (0, import_node_crypto12.randomUUID)();
+      const transparentCapability = wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort) ? void 0 : (0, import_node_crypto14.randomUUID)();
       if (transparentCapability !== void 0) {
         writeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, { pid: process.pid, startedAt: Date.now(), token: transparentCapability });
       }
@@ -74231,6 +74952,8 @@ function realFrontDoorSupervisorPorts(paths) {
       return { port: handle.port, close: handle.close };
     },
     closeRcStreamHub: rcHub.close,
+    // The launch lifecycle publisher over the same backbone the typed API serves: the tick's registry facts go in here, and the door's own register, prune and end moments come out as source-tagged events.
+    observeLaunchRegistry: createLaunchEventPublisher(doorEvents, () => Date.now()).observe,
     log: (line) => {
       appendLog(paths, line);
     }
@@ -74501,8 +75224,8 @@ function registerFrontDoorCommand(program2, deps) {
         identitiesDir: paths.identitiesDir,
         frontdoorDir: paths.frontdoorDir,
         identity,
-        newUuid: import_node_crypto12.randomUUID,
-        randomToken: () => (0, import_node_crypto12.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
+        newUuid: import_node_crypto14.randomUUID,
+        randomToken: () => (0, import_node_crypto14.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
         force: options.force === true,
         now: () => Date.now()
       });
@@ -74816,7 +75539,7 @@ function registerCompletionCommand(program2) {
 }
 
 // src/credentialCommand.ts
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 
 // src/identityToken.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
@@ -74868,7 +75591,7 @@ function realCommandPorts(deps) {
     cache: createRealCredentialCache(deps.paths.root),
     platform: process.platform,
     now: () => Date.now(),
-    ssh: (host, remoteCommand, input2) => (0, import_node_child_process4.spawnSync)("ssh", ["--", host, remoteCommand], { input: input2, stdio: ["pipe", "inherit", "inherit"] }).status
+    ssh: (host, remoteCommand, input2) => (0, import_node_child_process5.spawnSync)("ssh", ["--", host, remoteCommand], { input: input2, stdio: ["pipe", "inherit", "inherit"] }).status
   };
 }
 var REMOTE_ROOT_SCRIPT = 'root="${AGENT_SHIM_HOME:-${CLAUDE_USE_HOME:-}}"; if [ -z "$root" ]; then if [ ! -d "$HOME/.agent-shim" ] && [ -d "$HOME/.claude-use" ]; then root="$HOME/.claude-use"; else root="$HOME/.agent-shim"; fi; fi';
@@ -74999,15 +75722,15 @@ function registerDoctorCommand(program2, deps) {
 
 // src/headroom/commands.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_http2 = __toESM(require("node:http"), 1);
+var import_node_http3 = __toESM(require("node:http"), 1);
 var import_node_path39 = __toESM(require("node:path"), 1);
-var import_node_child_process5 = require("node:child_process");
+var import_node_child_process6 = require("node:child_process");
 
 // src/frontdoor/realFrontDoorPort.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/ensure.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var FRONTDOOR_START_TIMEOUT_MS = 3e4;
 var FRONTDOOR_LAUNCHER_POLL_MS = 100;
 var FrontDoorStartError = class extends CliError {
@@ -75041,7 +75764,7 @@ function ensureFrontDoor(params) {
           continue;
         }
         if (verdict.ok) {
-          const token = (0, import_node_crypto13.randomUUID)();
+          const token = (0, import_node_crypto15.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
           return { port: state.port, connectPort: state.connectPort, token };
         }
@@ -75145,7 +75868,7 @@ function probeFrontDoorSync(port, caPem) {
 }
 
 // src/frontdoor/trust.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_path38 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
@@ -75168,7 +75891,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto16.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs19.exists(bundle)) {
     fs19.mkdirp(bundlesDir);
     fs19.writeFileAtomic(bundle, combined);
@@ -75308,7 +76031,7 @@ function headroomProxyArgs(socketPath, settings2) {
 }
 async function readyOverSocket(socketPath) {
   return await new Promise((resolve) => {
-    const probe = import_node_http2.default.get({ socketPath, path: "/readyz", timeout: READY_FETCH_TIMEOUT_MS }, (response) => {
+    const probe = import_node_http3.default.get({ socketPath, path: "/readyz", timeout: READY_FETCH_TIMEOUT_MS }, (response) => {
       response.resume();
       resolve(response.statusCode === HTTP_STATUS.ok);
     });
@@ -75322,7 +76045,7 @@ async function readyOverSocket(socketPath) {
 }
 var HEADROOM_TOOL_NAME = "headroom-ai";
 function readInstalledHeadroomCommit() {
-  const toolDir = (0, import_node_child_process5.spawnSync)("uv", ["tool", "dir"], { encoding: "utf8" });
+  const toolDir = (0, import_node_child_process6.spawnSync)("uv", ["tool", "dir"], { encoding: "utf8" });
   if (toolDir.status !== 0) {
     return void 0;
   }
@@ -75362,7 +76085,7 @@ function realSupervisorPorts(paths) {
       }
       const logFd = import_node_fs16.default.openSync(paths.headroomLogPath, "a");
       try {
-        const child = (0, import_node_child_process5.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
+        const child = (0, import_node_child_process6.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
           detached: true,
           stdio: ["ignore", logFd, logFd],
           env: headroomSpawnEnv(process.env, allowlist, settings2, trust?.path)
@@ -75402,7 +76125,7 @@ function realSupervisorPorts(paths) {
     },
     ready: readyOverSocket,
     install: (spec) => {
-      const result = (0, import_node_child_process5.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
+      const result = (0, import_node_child_process6.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
       if (result.error !== void 0) {
         return { ok: false, error: `uv is not installed or not on PATH (${result.error.message})` };
       }
@@ -75415,7 +76138,7 @@ function realSupervisorPorts(paths) {
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
     headroomVersion: () => {
-      const result = (0, import_node_child_process5.spawnSync)("headroom", ["--version"], { encoding: "utf8" });
+      const result = (0, import_node_child_process6.spawnSync)("headroom", ["--version"], { encoding: "utf8" });
       return result.status === 0 ? result.stdout.trim() : void 0;
     },
     installedCommit: readInstalledHeadroomCommit,
@@ -75598,13 +76321,14 @@ function toProviderView(name, provider) {
   };
 }
 function codexConfigFromOptions(options) {
-  if (options.codexDefaultModel === void 0 && options.codexModel === void 0 && options.codexEffort === void 0) {
+  if (options.codexDefaultModel === void 0 && options.codexModel === void 0 && options.codexEffort === void 0 && options.codexLogin === void 0) {
     return void 0;
   }
   const candidate = {
     ...options.codexDefaultModel === void 0 ? {} : { defaultModel: options.codexDefaultModel },
     ...options.codexModel === void 0 ? {} : { models: options.codexModel },
-    ...options.codexEffort === void 0 ? {} : { effort: options.codexEffort }
+    ...options.codexEffort === void 0 ? {} : { effort: options.codexEffort },
+    ...options.codexLogin === void 0 ? {} : { login: options.codexLogin }
   };
   const parsed = CodexProviderConfigSchema.safeParse(candidate);
   if (!parsed.success) {
@@ -75627,7 +76351,7 @@ function registerProviderCommand(program2, deps) {
       new Option("--credential-target <target>", "Where the token goes: bearer sets ANTHROPIC_AUTH_TOKEN (default), apiKey sets ANTHROPIC_API_KEY.").choices(
         PROVIDER_CREDENTIAL_TARGETS
       )
-    ).option("--env <KEY=VALUE>", "Extra environment entry for the child (repeatable).", collectStringPair).option("--codex-default-model <model>", "Codex providers: the codex model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: the codex model one tier (fable, opus, sonnet or haiku) maps to (repeatable).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: the reasoning effort when a request asks for none the backend accepts.").choices(CODEX_EFFORTS)).option("--json", "Print the result as JSON.").action((name, options) => {
+    ).option("--env <KEY=VALUE>", "Extra environment entry for the child (repeatable).", collectStringPair).option("--codex-default-model <model>", "Codex providers: the codex model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: the codex model one tier (fable, opus, sonnet or haiku) maps to (repeatable).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: the reasoning effort when a request asks for none the backend accepts.").choices(CODEX_EFFORTS)).addOption(new Option("--codex-login <login>", "Codex providers: which login the upstream call uses, the Codex CLI's own login or a Sign in with ChatGPT grant from `agent-shim codex login`.").choices(CODEX_LOGINS)).option("--json", "Print the result as JSON.").action((name, options) => {
       const codex = codexConfigFromOptions(options);
       const created = addProvider(paths, name, {
         ...options.kind === void 0 ? {} : { kind: options.kind },
@@ -75659,14 +76383,14 @@ function registerProviderCommand(program2, deps) {
     new Option("--credential-target <target>", "Where the token goes: bearer sets ANTHROPIC_AUTH_TOKEN, apiKey sets ANTHROPIC_API_KEY.").choices(
       PROVIDER_CREDENTIAL_TARGETS
     )
-  ).option("--env <KEY=VALUE>", "Add or replace an environment entry for the child (repeatable).", collectStringPair).option("--unset-env <KEY>", "Remove an environment entry (repeatable).", collectRepeated).option("--codex-default-model <model>", "Codex providers: replace the model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: set the codex model one tier maps to (repeatable; other tiers are kept).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: replace the default reasoning effort.").choices(CODEX_EFFORTS));
+  ).option("--env <KEY=VALUE>", "Add or replace an environment entry for the child (repeatable).", collectStringPair).option("--unset-env <KEY>", "Remove an environment entry (repeatable).", collectRepeated).option("--codex-default-model <model>", "Codex providers: replace the model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: set the codex model one tier maps to (repeatable; other tiers are kept).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: replace the default reasoning effort.").choices(CODEX_EFFORTS)).addOption(new Option("--codex-login <login>", "Codex providers: replace which login the upstream call uses.").choices(CODEX_LOGINS));
   addCredentialCacheOptions(providerSet);
   withExamples(
     providerSet.option("--json", "Print the result as JSON.").action((name, allOptions) => {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --display-name, --base-url, --credential, --credential-target, a --credential-cache option, --env, --unset-env, --codex-default-model, --codex-model or --codex-effort."
+          "Nothing to change: pass --display-name, --base-url, --credential, --credential-target, a --credential-cache option, --env, --unset-env, --codex-default-model, --codex-model, --codex-effort or --codex-login."
         );
       }
       const codex = codexConfigFromOptions(options);
@@ -75727,6 +76451,7 @@ function registerProviderCommand(program2, deps) {
         const config2 = resolveCodexConfig(found.codex);
         console.log(`Codex models: ${CODEX_TIERS.map((tier) => `${tier}=${config2.models[tier]}`).join(", ")}, otherwise ${config2.defaultModel}`);
         console.log(`Codex effort: ${config2.effort}`);
+        console.log(`Codex login: ${config2.login}`);
       } else {
         console.log(`Base URL: ${found.baseUrl}`);
       }
@@ -76134,10 +76859,10 @@ function buildProgram(deps) {
 
 // src/launchWiring.ts
 var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 
 // src/launcher.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var import_node_path41 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
@@ -76638,7 +77363,7 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId: (0, import_node_crypto15.randomUUID)()
+    sessionId: (0, import_node_crypto17.randomUUID)()
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -76683,7 +77408,7 @@ function buildFarmRuntime(paths, cwd) {
         ...cliOverride === void 0 ? {} : { cliOverride }
       }).input,
       now: () => Date.now(),
-      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto16.randomUUID)()}`,
+      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto18.randomUUID)()}`,
       // Zombie-aware on purpose: a previous launcher that crashed out of a resync without releasing the lock may sit unreaped, still answering signal 0 as alive, and must read as a dead holder so this launch takes the lock over instead of timing out.
       lock: { pid: process.pid, isRunning: realIsProcessRunning, sleep: realSleepSync }
     },