clankerbend 0.1.1 → 0.1.3

package/host/src/index.js

@@ -100,6 +100,7 @@ export class ClankerBendHost {
     this.token = this.localDevInsecure ? "" : (isNonEmptyString(options.token) ? options.token : createSessionToken());
     this.runDir = options.runDir || null;
     this.transcriptAdapter = options.transcriptAdapter || createMockTranscriptAdapter();
+    this.accountRegistry = options.accountRegistry || null;
     this.apps = new Map();
     this.sseClients = new Set();
     this.actionResults = new Map();
@@ -157,6 +158,15 @@ export class ClankerBendHost {
         version: null,
         error: "not started"
       },
+      codexAccounts: this.accountRegistry
+        ? {
+            available: true,
+            activeAccountId: null,
+            maxRunningDesktopInstances: 1,
+            switching: false,
+            ...this.accountRegistry.list()
+          }
+        : null,
       lastAction: null
     };
   }
@@ -266,6 +276,11 @@ export class ClankerBendHost {
         correlateItems: false,
         approvals: false,
         rollback: false
+      },
+      codexAccounts: {
+        available: Boolean(this.accountRegistry),
+        switch: Boolean(this.transcriptAdapter.switchTo),
+        adoptPrimary: Boolean(this.transcriptAdapter.adoptAsPrimary)
       }
     };
   }
@@ -323,6 +338,7 @@ export class ClankerBendHost {
   }
 
   publicState() {
+    if (this.accountRegistry) this.state.codexAccounts = this.accountState();
     return {
       protocolName: "clankerbend",
       protocolVersion: this.protocolVersion,
@@ -361,6 +377,7 @@ export class ClankerBendHost {
         ...this.appState(app.appId)
       })),
       appServer: this.state.appServer,
+      codexAccounts: this.state.codexAccounts || undefined,
       lastAction: this.state.lastAction || undefined
     };
   }
@@ -501,6 +518,19 @@ export class ClankerBendHost {
     if (url.pathname === "/clankerbend/composer/context/remove" && req.method === "POST") return this.composerContextRemoveEndpoint(req, res);
     if (url.pathname === "/clankerbend/composer/draft" && req.method === "POST") return this.composerDraftEndpoint(req, res);
     if (url.pathname === "/clankerbend/composer/submit" && req.method === "POST") return this.composerSubmitEndpoint(req, res);
+    if (url.pathname === "/clankerbend/codex/accounts" && req.method === "GET") return this.codexAccountsListEndpoint(res);
+    if (url.pathname === "/clankerbend/codex/accounts" && req.method === "POST") return this.codexAccountsCreateEndpoint(req, res);
+    if (url.pathname === "/clankerbend/codex/accounts/default" && req.method === "POST") return this.codexAccountsDefaultEndpoint(req, res);
+    if (url.pathname === "/clankerbend/codex/accounts/switch" && req.method === "POST") return this.codexAccountsSwitchEndpoint(req, res);
+    if (url.pathname === "/clankerbend/codex/primary/rollback" && req.method === "POST") return this.codexPrimaryRollbackEndpoint(req, res);
+    const accountRoute = this.parseCodexAccountRoute(url.pathname);
+    if (accountRoute && req.method === "POST" && accountRoute.tail === "/switch") return this.codexAccountSwitchEndpoint(accountRoute.accountId, res);
+    if (accountRoute && req.method === "POST" && accountRoute.tail === "/start") return this.codexAccountSwitchEndpoint(accountRoute.accountId, res);
+    if (accountRoute && req.method === "POST" && accountRoute.tail === "/focus") return this.codexAccountSwitchEndpoint(accountRoute.accountId, res);
+    if (accountRoute && req.method === "POST" && accountRoute.tail === "/set-default") return this.codexAccountSetDefaultEndpoint(accountRoute.accountId, res);
+    if (accountRoute && req.method === "POST" && accountRoute.tail === "/adopt-as-primary") return this.codexAccountAdoptEndpoint(accountRoute.accountId, res);
+    if (accountRoute && req.method === "DELETE") return this.codexAccountDeleteEndpoint(accountRoute.accountId, res);
+    if (accountRoute && req.method === "POST" && accountRoute.tail === "/delete") return this.codexAccountDeleteEndpoint(accountRoute.accountId, res);
 
     const appRoute = this.parseAppRoute(url.pathname);
     if (appRoute && req.method === "GET" && appRoute.tail === "/manifest") return this.ok(res, this.appManifest(appRoute.appId));
@@ -532,6 +562,107 @@ export class ClankerBendHost {
     return { appId, tail: `/${parts.slice(4).join("/")}` };
   }
 
+  parseCodexAccountRoute(pathname) {
+    if (!pathname.startsWith("/clankerbend/codex/accounts/")) return null;
+    const parts = pathname.split("/");
+    const accountId = decodeURIComponent(parts[4] || "");
+    if (!accountId) return null;
+    return { accountId, tail: `/${parts.slice(5).join("/")}` };
+  }
+
+  requireAccountRegistry() {
+    if (!this.accountRegistry) throw httpError(404, "not_found", "Codex account registry is unavailable");
+    return this.accountRegistry;
+  }
+
+  accountState() {
+    if (typeof this.transcriptAdapter.accountState === "function") return this.transcriptAdapter.accountState();
+    return this.accountRegistry ? {
+      available: true,
+      activeAccountId: null,
+      maxRunningDesktopInstances: 1,
+      switching: false,
+      ...this.accountRegistry.list()
+    } : null;
+  }
+
+  codexAccountsListEndpoint(res) {
+    this.requireAccountRegistry();
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, this.state.codexAccounts);
+  }
+
+  async codexAccountsCreateEndpoint(req, res) {
+    this.requireAccountRegistry();
+    const body = await readJsonObject(req, "account create request body");
+    const result = typeof this.transcriptAdapter.createAccount === "function"
+      ? await this.transcriptAdapter.createAccount(body)
+      : this.accountRegistry.createManaged(body);
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, result, 201);
+  }
+
+  async codexAccountsDefaultEndpoint(req, res) {
+    const body = await readJsonObject(req, "account default request body");
+    if (!isNonEmptyString(body.accountId)) throw httpError(400, "bad_request", "accountId is required");
+    return this.codexAccountSetDefaultEndpoint(body.accountId, res);
+  }
+
+  async codexAccountsSwitchEndpoint(req, res) {
+    const body = await readJsonObject(req, "account switch request body");
+    if (!isNonEmptyString(body.accountId)) throw httpError(400, "bad_request", "accountId is required");
+    return this.codexAccountSwitchEndpoint(body.accountId, res);
+  }
+
+  async codexAccountSwitchEndpoint(accountId, res) {
+    this.requireAccountRegistry();
+    if (typeof this.transcriptAdapter.switchTo !== "function") {
+      throw httpError(409, "unsupported", "active adapter does not support Codex account switching");
+    }
+    const result = await this.transcriptAdapter.switchTo(accountId);
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, result);
+  }
+
+  async codexAccountSetDefaultEndpoint(accountId, res) {
+    this.requireAccountRegistry();
+    const result = typeof this.transcriptAdapter.setDefault === "function"
+      ? await this.transcriptAdapter.setDefault(accountId)
+      : this.accountRegistry.setDefault(accountId);
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, result);
+  }
+
+  async codexAccountAdoptEndpoint(accountId, res) {
+    this.requireAccountRegistry();
+    if (typeof this.transcriptAdapter.adoptAsPrimary !== "function") {
+      throw httpError(409, "unsupported", "active adapter does not support primary adoption");
+    }
+    const result = await this.transcriptAdapter.adoptAsPrimary(accountId);
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, result);
+  }
+
+  async codexPrimaryRollbackEndpoint(req, res) {
+    this.requireAccountRegistry();
+    const body = await readJsonObject(req, "primary rollback request body");
+    if (typeof this.transcriptAdapter.rollbackPrimary !== "function") {
+      throw httpError(409, "unsupported", "active adapter does not support primary rollback");
+    }
+    const result = await this.transcriptAdapter.rollbackPrimary(body);
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, result);
+  }
+
+  async codexAccountDeleteEndpoint(accountId, res) {
+    this.requireAccountRegistry();
+    const result = typeof this.transcriptAdapter.deleteAccount === "function"
+      ? await this.transcriptAdapter.deleteAccount(accountId)
+      : this.accountRegistry.deleteManaged(accountId);
+    this.state.codexAccounts = this.accountState();
+    return this.ok(res, result);
+  }
+
   async actionEndpoint(appId, req, res) {
     const app = this.requireApp(appId);
     const body = await readJsonObject(req, "action request body");
@@ -973,10 +1104,17 @@ export class ClankerBendHost {
       res.writeHead(404).end("not found");
       return;
     }
-    res.writeHead(200, {
-      "content-type": mimeType(filePath),
+    const contentType = mimeType(filePath);
+    const headers = {
+      "content-type": contentType,
       "cache-control": "no-store"
-    });
+    };
+    if (this.token && contentType.startsWith("text/html")) {
+      res.writeHead(200, headers);
+      res.end(injectAppToken(readFileSync(filePath, "utf8"), this.token));
+      return;
+    }
+    res.writeHead(200, headers);
     createReadStream(filePath).pipe(res);
   }
 
@@ -1023,7 +1161,7 @@ export class ClankerBendHost {
 
   applyCors(res) {
     res.setHeader("access-control-allow-origin", "*");
-    res.setHeader("access-control-allow-methods", "GET,POST,OPTIONS");
+    res.setHeader("access-control-allow-methods", "GET,POST,DELETE,OPTIONS");
     res.setHeader("access-control-allow-headers", "authorization,content-type");
   }
 }
@@ -1134,6 +1272,20 @@ export function createSessionToken() {
   return randomBytes(32).toString("base64url");
 }
 
+function injectAppToken(html, token) {
+  const script = `<meta name="clankerbend-token" content="${escapeHtmlAttribute(token)}">\n    <script>window.__CLANKERBEND_TOKEN=${JSON.stringify(token)};</script>`;
+  return /<head[^>]*>/i.test(html)
+    ? html.replace(/<head[^>]*>/i, (match) => `${match}\n    ${script}`)
+    : `${script}\n${html}`;
+}
+
+function escapeHtmlAttribute(value) {
+  return String(value)
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;");
+}
+
 function requirePermission(app, permission) {
   if (app.permissions?.[permission] === false) {
     throw httpError(403, "forbidden", `${app.appId} lacks ${permission}`);

package/launch/accounts.mjs

@@ -0,0 +1,360 @@
+import { cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+export const ACCOUNT_REGISTRY_VERSION = 1;
+export const PRIMARY_ACCOUNT_ID = "primary";
+export const MAX_ACCOUNT_PROFILES = 20;
+
+export function primaryCodexHome() {
+  return process.env.CODEX_HOME ? resolve(process.env.CODEX_HOME) : join(homedir(), ".codex");
+}
+
+export class CodexAccountRegistry {
+  constructor(options = {}) {
+    if (!options.root) throw new Error("account registry root is required");
+    if (!options.primaryElectronProfile) throw new Error("primary electron profile is required");
+    this.root = resolve(options.root);
+    this.registryPath = options.registryPath || join(this.root, "accounts.json");
+    this.accountsDir = options.accountsDir || join(this.root, "accounts");
+    this.deletedDir = options.deletedDir || join(this.root, "deleted-accounts");
+    this.primaryCodexHome = resolve(options.primaryCodexHome || primaryCodexHome());
+    this.primaryElectronProfile = resolve(options.primaryElectronProfile);
+    this.maxAccounts = options.maxAccounts || MAX_ACCOUNT_PROFILES;
+    this.registry = this.load();
+  }
+
+  list() {
+    this.ensurePrimary();
+    return {
+      version: ACCOUNT_REGISTRY_VERSION,
+      clankerbendDefaultAccountId: this.registry.clankerbendDefaultAccountId || PRIMARY_ACCOUNT_ID,
+      maxAccounts: this.maxAccounts,
+      accounts: this.registry.accounts.map((account) => this.publicAccount(account)),
+      backups: this.registry.backups || [],
+      deletedAccounts: this.registry.deletedAccounts || []
+    };
+  }
+
+  get(id) {
+    this.ensurePrimary();
+    const account = this.registry.accounts.find((candidate) => candidate.id === id);
+    if (!account) throw new Error(`unknown Codex account profile: ${id}`);
+    return account;
+  }
+
+  getDefault() {
+    const id = this.registry.clankerbendDefaultAccountId || PRIMARY_ACCOUNT_ID;
+    return this.registry.accounts.find((account) => account.id === id) || this.get(PRIMARY_ACCOUNT_ID);
+  }
+
+  createManaged(input = {}) {
+    this.ensurePrimary();
+    if (this.registry.accounts.length >= this.maxAccounts) {
+      throw new Error(`Codex account profile limit reached (${this.maxAccounts})`);
+    }
+    const id = input.id
+      ? safeAccountId(input.id)
+      : uniqueAccountId(this.registry.accounts, accountIdFromLabel(input.label || "account"));
+    if (input.id && this.registry.accounts.some((account) => account.id === id)) {
+      throw new Error(`Codex account profile already exists: ${id}`);
+    }
+    const accountRoot = join(this.accountsDir, id);
+    const codexHome = join(accountRoot, "codex-home");
+    const electronProfile = join(accountRoot, "electron-profile");
+    mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+    mkdirSync(electronProfile, { recursive: true, mode: 0o700 });
+    writeManagedConfig(codexHome, this.primaryCodexHome);
+    const account = {
+      id,
+      kind: "managed",
+      label: String(input.label || id),
+      codexHome,
+      electronProfile,
+      createdAt: new Date().toISOString(),
+      createdFrom: PRIMARY_ACCOUNT_ID
+    };
+    this.registry.accounts.push(account);
+    this.save();
+    return this.publicAccount(account);
+  }
+
+  setDefault(id) {
+    this.get(id);
+    this.registry.clankerbendDefaultAccountId = id;
+    this.save();
+    return this.list();
+  }
+
+  adoptAsPrimary(id) {
+    const target = this.get(id);
+    if (target.kind === "primary") throw new Error("primary account is already the primary Codex home");
+    const timestamp = timestampSegment();
+    const primary = this.get(PRIMARY_ACCOUNT_ID);
+    const oldPrimaryId = uniqueAccountId(this.registry.accounts, `previous-primary-${timestamp}`);
+    const backupCodexHome = `${this.primaryCodexHome}.backup_${timestamp}`;
+    const oldPrimaryElectronProfile = join(this.accountsDir, oldPrimaryId, "electron-profile");
+    const rollbackBackup = {
+      id: oldPrimaryId,
+      label: `Previous Primary ${timestamp}`,
+      codexHome: backupCodexHome,
+      createdAt: new Date().toISOString(),
+      reason: "adopt-as-primary"
+    };
+
+    if (!existsSync(target.codexHome)) throw new Error(`target CODEX_HOME does not exist: ${target.codexHome}`);
+    if (existsSync(backupCodexHome)) throw new Error(`backup path already exists: ${backupCodexHome}`);
+
+    if (existsSync(this.primaryCodexHome)) movePath(this.primaryCodexHome, backupCodexHome);
+    if (existsSync(primary.electronProfile)) movePath(primary.electronProfile, oldPrimaryElectronProfile);
+    movePath(target.codexHome, this.primaryCodexHome);
+    if (existsSync(target.electronProfile)) movePath(target.electronProfile, primary.electronProfile);
+    else mkdirSync(primary.electronProfile, { recursive: true, mode: 0o700 });
+
+    const oldPrimary = {
+      id: oldPrimaryId,
+      kind: "managed",
+      label: rollbackBackup.label,
+      codexHome: backupCodexHome,
+      electronProfile: oldPrimaryElectronProfile,
+      createdAt: rollbackBackup.createdAt,
+      createdFrom: PRIMARY_ACCOUNT_ID,
+      backup: true
+    };
+    primary.lastAdoptedFrom = target.id;
+    primary.lastAdoptedAt = new Date().toISOString();
+    primary.codexHome = this.primaryCodexHome;
+    primary.electronProfile = this.primaryElectronProfile;
+    this.registry.accounts = this.registry.accounts
+      .filter((account) => account.id !== target.id)
+      .map((account) => account.id === PRIMARY_ACCOUNT_ID ? primary : account);
+    this.registry.accounts.push(oldPrimary);
+    this.registry.backups = [...(this.registry.backups || []), rollbackBackup];
+    this.registry.clankerbendDefaultAccountId = PRIMARY_ACCOUNT_ID;
+    this.save();
+    return {
+      adoptedAccountId: id,
+      primary: this.publicAccount(primary),
+      previousPrimary: this.publicAccount(oldPrimary),
+      backup: rollbackBackup
+    };
+  }
+
+  rollbackPrimary(input = {}) {
+    const backupId = input.backupId || input.accountId;
+    if (!backupId) throw new Error("backupId is required");
+    const backupAccount = this.get(backupId);
+    if (backupAccount.kind === "primary") throw new Error("cannot rollback from primary account");
+    if (!existsSync(backupAccount.codexHome)) throw new Error(`backup CODEX_HOME does not exist: ${backupAccount.codexHome}`);
+
+    const timestamp = timestampSegment();
+    const primary = this.get(PRIMARY_ACCOUNT_ID);
+    const replacedId = uniqueAccountId(this.registry.accounts, `rollback-replaced-${timestamp}`);
+    const replacedCodexHome = `${this.primaryCodexHome}.rollback_replaced_${timestamp}`;
+    const replacedElectronProfile = join(this.accountsDir, replacedId, "electron-profile");
+
+    if (existsSync(this.primaryCodexHome)) movePath(this.primaryCodexHome, replacedCodexHome);
+    if (existsSync(primary.electronProfile)) movePath(primary.electronProfile, replacedElectronProfile);
+    movePath(backupAccount.codexHome, this.primaryCodexHome);
+    if (existsSync(backupAccount.electronProfile)) movePath(backupAccount.electronProfile, primary.electronProfile);
+    else mkdirSync(primary.electronProfile, { recursive: true, mode: 0o700 });
+
+    const replacedAccount = {
+      id: replacedId,
+      kind: "managed",
+      label: `Rollback Replaced ${timestamp}`,
+      codexHome: replacedCodexHome,
+      electronProfile: replacedElectronProfile,
+      createdAt: new Date().toISOString(),
+      createdFrom: PRIMARY_ACCOUNT_ID,
+      backup: true
+    };
+    primary.lastRollbackFrom = backupAccount.id;
+    primary.lastRollbackAt = new Date().toISOString();
+    primary.codexHome = this.primaryCodexHome;
+    primary.electronProfile = this.primaryElectronProfile;
+    this.registry.accounts = this.registry.accounts
+      .filter((account) => account.id !== backupAccount.id)
+      .map((account) => account.id === PRIMARY_ACCOUNT_ID ? primary : account);
+    this.registry.accounts.push(replacedAccount);
+    this.registry.backups = [...(this.registry.backups || []), {
+      id: replacedId,
+      label: replacedAccount.label,
+      codexHome: replacedCodexHome,
+      createdAt: replacedAccount.createdAt,
+      reason: "rollback-replaced-primary"
+    }];
+    this.registry.clankerbendDefaultAccountId = PRIMARY_ACCOUNT_ID;
+    this.save();
+    return {
+      restoredAccountId: backupAccount.id,
+      primary: this.publicAccount(primary),
+      replacedPrimary: this.publicAccount(replacedAccount)
+    };
+  }
+
+  deleteManaged(id) {
+    const account = this.get(id);
+    if (account.kind === "primary") throw new Error("primary account cannot be deleted");
+    const timestamp = timestampSegment();
+    const deleteRoot = join(this.deletedDir, `${id}_${timestamp}`);
+    mkdirSync(deleteRoot, { recursive: true, mode: 0o700 });
+    const deleted = {
+      id,
+      label: account.label,
+      deletedAt: new Date().toISOString(),
+      originalCodexHome: account.codexHome,
+      originalElectronProfile: account.electronProfile,
+      deletedRoot: deleteRoot,
+      codexHome: null,
+      electronProfile: null
+    };
+    if (existsSync(account.codexHome)) {
+      const destination = join(deleteRoot, "codex-home");
+      movePath(account.codexHome, destination);
+      deleted.codexHome = destination;
+    }
+    if (existsSync(account.electronProfile)) {
+      const destination = join(deleteRoot, "electron-profile");
+      movePath(account.electronProfile, destination);
+      deleted.electronProfile = destination;
+    }
+    this.registry.accounts = this.registry.accounts.filter((candidate) => candidate.id !== id);
+    if (this.registry.clankerbendDefaultAccountId === id) this.registry.clankerbendDefaultAccountId = PRIMARY_ACCOUNT_ID;
+    this.registry.deletedAccounts = [...(this.registry.deletedAccounts || []), deleted];
+    this.save();
+    return deleted;
+  }
+
+  load() {
+    mkdirSync(this.root, { recursive: true, mode: 0o700 });
+    mkdirSync(this.accountsDir, { recursive: true, mode: 0o700 });
+    let registry = null;
+    if (existsSync(this.registryPath)) {
+      registry = JSON.parse(readFileSync(this.registryPath, "utf8"));
+    }
+    registry ||= {
+      version: ACCOUNT_REGISTRY_VERSION,
+      clankerbendDefaultAccountId: PRIMARY_ACCOUNT_ID,
+      accounts: [],
+      backups: [],
+      deletedAccounts: []
+    };
+    registry.version = ACCOUNT_REGISTRY_VERSION;
+    registry.accounts = Array.isArray(registry.accounts) ? registry.accounts : [];
+    registry.backups = Array.isArray(registry.backups) ? registry.backups : [];
+    registry.deletedAccounts = Array.isArray(registry.deletedAccounts) ? registry.deletedAccounts : [];
+    this.registry = registry;
+    this.ensurePrimary();
+    return this.registry;
+  }
+
+  ensurePrimary() {
+    const primary = this.registry.accounts.find((account) => account.id === PRIMARY_ACCOUNT_ID);
+    if (primary) {
+      primary.kind = "primary";
+      primary.label ||= "Primary";
+      primary.codexHome = this.primaryCodexHome;
+      primary.electronProfile = this.primaryElectronProfile;
+      return primary;
+    }
+    const account = {
+      id: PRIMARY_ACCOUNT_ID,
+      kind: "primary",
+      label: "Primary",
+      codexHome: this.primaryCodexHome,
+      electronProfile: this.primaryElectronProfile,
+      createdAt: new Date().toISOString()
+    };
+    this.registry.accounts.unshift(account);
+    this.registry.clankerbendDefaultAccountId ||= PRIMARY_ACCOUNT_ID;
+    this.save();
+    return account;
+  }
+
+  save() {
+    mkdirSync(dirname(this.registryPath), { recursive: true, mode: 0o700 });
+    writeFileSync(this.registryPath, `${JSON.stringify(this.registry, null, 2)}\n`, { mode: 0o600 });
+  }
+
+  publicAccount(account) {
+    return {
+      id: account.id,
+      kind: account.kind,
+      label: account.label,
+      codexHome: account.codexHome,
+      electronProfile: account.electronProfile,
+      auth: {
+        authJson: existsSync(join(account.codexHome, "auth.json")),
+        configToml: existsSync(join(account.codexHome, "config.toml"))
+      },
+      createdAt: account.createdAt,
+      createdFrom: account.createdFrom,
+      backup: account.backup || undefined,
+      lastSeenAccount: account.lastSeenAccount || undefined,
+      lastAdoptedFrom: account.lastAdoptedFrom || undefined,
+      lastAdoptedAt: account.lastAdoptedAt || undefined,
+      lastRollbackFrom: account.lastRollbackFrom || undefined,
+      lastRollbackAt: account.lastRollbackAt || undefined
+    };
+  }
+}
+
+function writeManagedConfig(codexHome, primaryHome) {
+  const primaryConfig = join(primaryHome, "config.toml");
+  let content = "";
+  if (existsSync(primaryConfig)) {
+    const match = readFileSync(primaryConfig, "utf8").match(/^\s*cli_auth_credentials_store\s*=.*$/m);
+    if (match) content = `${match[0].trim()}\n`;
+  }
+  if (!content && existsSync(join(primaryHome, "auth.json"))) {
+    content = "cli_auth_credentials_store = \"file\"\n";
+  }
+  if (content) writeFileSync(join(codexHome, "config.toml"), content, { mode: 0o600 });
+}
+
+function accountIdFromLabel(label) {
+  const id = String(label || "account")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40);
+  if (!id) return "account";
+  return /^[a-z]/.test(id) ? id : `account-${id}`.slice(0, 40);
+}
+
+function safeAccountId(id) {
+  const value = String(id || "").trim();
+  if (!/^[a-z][a-z0-9_-]{0,39}$/.test(value)) {
+    throw new Error("account id must start with a lowercase letter and contain only lowercase letters, numbers, _ or -");
+  }
+  return value;
+}
+
+function uniqueAccountId(accounts, base) {
+  let candidate = safeAccountId(base);
+  let suffix = 2;
+  while (accounts.some((account) => account.id === candidate)) {
+    candidate = safeAccountId(`${base}-${suffix}`);
+    suffix += 1;
+  }
+  return candidate;
+}
+
+function timestampSegment(date = new Date()) {
+  return date.toISOString().replace(/\..*$/, "").replace("T", "_").replace(/:/g, "");
+}
+
+function movePath(from, to) {
+  mkdirSync(dirname(to), { recursive: true, mode: 0o700 });
+  try {
+    renameSync(from, to);
+  } catch (err) {
+    if (err?.code !== "EXDEV") throw err;
+    const stat = statSync(from);
+    if (stat.isDirectory()) cpSync(from, to, { recursive: true, force: false });
+    else cpSync(from, to, { force: false });
+    rmSync(from, { recursive: true, force: true });
+  }
+}