claudish 14.13.0 → 14.14.0

package/dist/index.js

@@ -5491,7 +5491,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "14.13.0";
+var VERSION = "14.14.0";
 
 // src/redact.ts
 function isPlaceholder(value) {
@@ -21696,6 +21696,19 @@ class AccountRegistry {
       this.legacyStamp = undefined;
       return false;
     }
+    if (this.configStatus.state === "failed" && this.lastGoodSettings !== undefined) {
+      const path = this.legacyPath();
+      const detail = "not re-read while the account list config cannot be read";
+      this.legacyStamp = undefined;
+      this.legacyStatus = {
+        state: "failed",
+        error: detail,
+        failure: { source: "legacy", path, type: "io", detail },
+        path,
+        servingLastKnownGood: this.lastGoodLegacy !== undefined
+      };
+      return true;
+    }
     this.refreshLegacy();
     return true;
   }
@@ -21756,10 +21769,7 @@ class AccountRegistry {
     }
   }
   isSynthesizedLegacyOnly() {
-    const snapshot = this.snapshot("openai-codex");
-    const rows = snapshot.accounts["openai-codex"];
-    const entry = snapshot.settings["openai-codex"];
-    return !entry?.legacyCodexSuppressed && !entry?.accounts.length && rows.length === 1 && rows[0].legacy;
+    return isSynthesizedLegacyOnlySnapshot(this.snapshot("openai-codex"));
   }
   listAccounts(provider) {
     return this.snapshot(provider).accounts[provider];
@@ -21781,6 +21791,18 @@ class AccountRegistry {
     return { config: this.configStatus, legacy: this.legacyStatus };
   }
 }
+function isSynthesizedLegacyOnlySnapshot(snapshot) {
+  const rows = snapshot.accounts["openai-codex"];
+  const entry = snapshot.settings["openai-codex"];
+  return !entry?.legacyCodexSuppressed && !entry?.accounts.length && rows.length === 1 && rows[0].legacy;
+}
+function codexSourceFailed(snapshot) {
+  if (snapshot.config.state === "failed")
+    return snapshot.config;
+  if (snapshot.legacy.state === "failed")
+    return snapshot.legacy;
+  return;
+}
 function getAccountRegistry() {
   if (!registry2)
     registry2 = new AccountRegistry;
@@ -24428,6 +24450,10 @@ var init_keychain = __esm(() => {
 // src/auth/accounts/token-store.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync9, lstatSync as lstatSync2, readFileSync as readFileSync14, rmSync as rmSync4 } from "fs";
+import { isDeepStrictEqual } from "util";
+function sameDurableRecord(a, b) {
+  return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.accountId === b.accountId && a.generation === b.generation && a.fingerprint === b.fingerprint && isDeepStrictEqual(a.journal ?? null, b.journal ?? null);
+}
 function fingerprintOf(refreshToken) {
   return createHash2("sha256").update(refreshToken).digest("hex").slice(0, 16);
 }
@@ -24435,8 +24461,8 @@ function parseRecord(kind, text) {
   let raw;
   try {
     raw = JSON.parse(text);
-  } catch (err) {
-    throw new TokenStoreReadError(kind, `the stored record is not JSON (${err.message})`);
+  } catch {
+    throw new TokenStoreReadError(kind, "the stored record is not JSON (invalid JSON)");
   }
   if (typeof raw?.accessToken !== "string" || typeof raw?.refreshToken !== "string") {
     throw new TokenStoreReadError(kind, "the stored record has no token pair");
@@ -24598,8 +24624,8 @@ class LegacyCodexFileStore {
     let raw;
     try {
       raw = JSON.parse(text);
-    } catch (err) {
-      throw new TokenStoreReadError(this.kind, err instanceof Error ? err.message : String(err));
+    } catch {
+      throw new TokenStoreReadError(this.kind, "invalid JSON");
     }
     if (!raw?.access_token || !raw?.refresh_token) {
       throw new TokenStoreReadError(this.kind, "the credential file has no token pair");
@@ -24765,6 +24791,7 @@ class TokenManager {
   async resolve(ref, forced, rejectedFp) {
     const current = await this.readOrThrow(ref, { uncached: forced });
     if (!current) {
+      this.validateAccount?.(ref, "store-empty");
       throw new NeedsReauthError(`No stored credential for ${ref.label}. Run a login for this account.`);
     }
     await this.healIfMaterialMoved(ref, current);
@@ -24849,6 +24876,7 @@ class TokenManager {
     this.validateAccount?.(ref, "before-exchange");
     let record = await this.readOrThrow(ref, { uncached: true });
     if (!record) {
+      this.validateAccount?.(ref, "store-empty");
       throw new NeedsReauthError(`No stored credential for ${ref.label}. Run a login for this account.`);
     }
     await this.healIfMaterialMoved(ref, record);
@@ -24920,6 +24948,7 @@ class TokenManager {
     this.validateAccount?.(ref, "before-persist");
     const latest = await this.readOrThrow(ref, { uncached: true });
     if (!latest) {
+      this.validateAccount?.(ref, "store-empty");
       throw new NeedsReauthError(`The stored credential for ${ref.label} was removed during refresh.`);
     }
     if (latest.generation > record.generation || latest.fingerprint !== record.fingerprint) {
@@ -25266,6 +25295,64 @@ function tokenOptionsFor(opts, reason) {
     ...opts.rejectedAccessToken ? { rejectedAccessToken: opts.rejectedAccessToken } : {}
   };
 }
+
+class ReauthAttemptStamps {
+  committed = new Map;
+  inFlight = new Map;
+  get(id) {
+    let latest = this.committed.get(id);
+    for (const mark of this.inFlight.get(id) ?? []) {
+      if (latest === undefined || mark.at > latest)
+        latest = mark.at;
+    }
+    return latest;
+  }
+  snapshot() {
+    const out = new Map;
+    for (const id of new Set([...this.committed.keys(), ...this.inFlight.keys()])) {
+      const at = this.get(id);
+      if (at !== undefined)
+        out.set(id, at);
+    }
+    return out;
+  }
+  begin(id, at) {
+    const mark = { at };
+    let marks = this.inFlight.get(id);
+    if (!marks) {
+      marks = new Set;
+      this.inFlight.set(id, marks);
+    }
+    marks.add(mark);
+    const withdraw = () => {
+      const current = this.inFlight.get(id);
+      if (!current?.delete(mark))
+        return false;
+      if (current.size === 0)
+        this.inFlight.delete(id);
+      return true;
+    };
+    return {
+      commit: () => {
+        if (!withdraw())
+          return;
+        const previous = this.committed.get(id);
+        if (previous === undefined || at > previous)
+          this.committed.set(id, at);
+      },
+      restore: () => {
+        withdraw();
+      }
+    };
+  }
+  clear(id) {
+    this.committed.delete(id);
+    this.inFlight.delete(id);
+  }
+}
+function isStoreOnlyMove(leased, current) {
+  return current !== undefined && current.id === leased.id && current.enabled && current.store !== leased.store && current.identity.chatgptAccountId === leased.identity.chatgptAccountId;
+}
 function leaseFailureBlocker(ref, err) {
   if (err instanceof AccountChangedDuringLeaseError) {
     return {
@@ -25317,7 +25404,7 @@ class AccountPool {
   storeFactory;
   env;
   managers = new Map;
-  lastReauthAttempt = new Map;
+  lastReauthAttempt = new ReauthAttemptStamps;
   leaseFailures = new Map;
   constructor(provider, opts = {}) {
     this.provider = provider;
@@ -25341,7 +25428,7 @@ class AccountPool {
       provider: this.provider,
       failed: new Map,
       leaseFailures: new Map(this.leaseFailures),
-      reauthAttempts: new Map(this.lastReauthAttempt)
+      reauthAttempts: this.lastReauthAttempt.snapshot()
     };
     if (allowance && this.allowanceStrategyOn()) {
       try {
@@ -25421,9 +25508,12 @@ class AccountPool {
     await this.healReauthMarks(context, opts.pin);
     evaluation = this.evaluate(opts, context);
     const attempts = evaluation.records.length + 1;
+    let storeMovesLeft = evaluation.records.length + 1;
+    let fresh = true;
     for (let attempt = 0;attempt < attempts; attempt++) {
-      if (attempt > 0)
+      if (!fresh)
         evaluation = this.evaluate(opts, context);
+      fresh = false;
       const selection = evaluation.selection;
       if (selection.kind === "none")
         throw this.acquireNoEligibleError(evaluation, context, opts);
@@ -25439,23 +25529,15 @@ class AccountPool {
         continue;
       }
       const at = this.now();
-      this.lastReauthAttempt.set(record.id, at);
-      context.reauthAttempts.set(record.id, at);
-      const token = await this.tryLease(record, opts, reason, context);
-      if (!token)
-        continue;
-      const stillConfigured = this.accounts().some((a) => a.id === record.id && a.enabled && a.store === record.store);
-      if (!stillConfigured) {
-        context.failed.set(record.id, {
-          kind: "unavailable",
-          ref: candidate.ref,
-          reason: "account changed while leasing",
-          upstreamStatus: 503
-        });
-        if (opts.pin)
-          throw new NoUsableAccountError(`Pinned ${vendorName(this.provider)} account ${record.label} changed while leasing.`);
+      const step = await this.leaseStep(record, candidate.ref, reason, at, context, opts);
+      if (step === STORE_MOVED) {
+        if (storeMovesLeft-- > 0)
+          attempt--;
         continue;
       }
+      if (!step)
+        continue;
+      const token = step;
       this.leaseFailures.delete(record.id);
       context.leaseFailures.delete(record.id);
       const threadKey = evaluation.ranked ? context.allowance?.threadKey ?? null : null;
@@ -25490,6 +25572,95 @@ class AccountPool {
     }
     return error;
   }
+  noteLeaseChanged(record, ref, rows, context, opts) {
+    if (isStoreOnlyMove(record, rows.find((a) => a.id === record.id))) {
+      if (opts.pin)
+        throw new AccountStoreMovedDuringLeaseError(record.label);
+      log(`[accounts] ${this.provider}: ${record.label} moved store while leasing; leasing it again`);
+      return true;
+    }
+    context.failed.set(record.id, {
+      kind: "unavailable",
+      ref,
+      reason: "account changed while leasing",
+      upstreamStatus: 503
+    });
+    if (opts.pin)
+      throw new NoUsableAccountError(`Pinned ${vendorName(this.provider)} account ${record.label} changed while leasing.`);
+    return false;
+  }
+  async leaseStep(record, ref, reason, at, context, opts) {
+    const stamps = this.stampReauthAttempt(record.id, at, context);
+    let restored = false;
+    const restore = () => {
+      restored = true;
+      stamps.restore();
+    };
+    try {
+      const token = await this.tryLease(record, opts, reason, context);
+      if (token === STORE_MOVED) {
+        restore();
+        return STORE_MOVED;
+      }
+      if (token === NOT_ATTEMPTED) {
+        restore();
+        return null;
+      }
+      if (!token)
+        return null;
+      const rows = this.accounts();
+      const stillConfigured = rows.some((a) => a.id === record.id && a.enabled && a.store === record.store);
+      if (stillConfigured)
+        return token;
+      if (!this.noteLeaseChanged(record, ref, rows, context, opts))
+        return null;
+      restore();
+      return STORE_MOVED;
+    } catch (err) {
+      if (err instanceof AccountStoreMovedDuringLeaseError || err instanceof AccountListUnreadableDuringLeaseError) {
+        restore();
+      }
+      throw err;
+    } finally {
+      if (!restored)
+        stamps.commit();
+    }
+  }
+  stampReauthAttempt(id, at, context) {
+    const pool = this.lastReauthAttempt.begin(id, at);
+    const request = context.reauthAttempts.get(id);
+    context.reauthAttempts.set(id, at);
+    return {
+      restore: () => {
+        pool.restore();
+        if (request === undefined)
+          context.reauthAttempts.delete(id);
+        else
+          context.reauthAttempts.set(id, request);
+      },
+      commit: () => pool.commit()
+    };
+  }
+  unattemptedLease(record, ref, reason, context, err) {
+    if (err instanceof AccountStoreMovedDuringLeaseError) {
+      if (reason === "pinned")
+        throw err;
+      log(`[accounts] ${this.provider}: ${record.label} moved store while leasing; leasing it again`);
+      return STORE_MOVED;
+    }
+    if (!(err instanceof AccountListUnreadableDuringLeaseError))
+      return;
+    context.failed.set(record.id, {
+      kind: "unavailable",
+      ref,
+      reason: err.reason,
+      upstreamStatus: err.upstreamStatus
+    });
+    if (reason === "pinned")
+      throw err;
+    log(`[accounts] ${this.provider}: ${record.label}'s account list could not be read; trying the next account`);
+    return NOT_ATTEMPTED;
+  }
   async tryLease(record, opts, reason, context) {
     const ref = this.refOf(record);
     try {
@@ -25497,6 +25668,9 @@ class AccountPool {
     } catch (err) {
       if (classifyConnectionError(err))
         throw err;
+      const unattempted = this.unattemptedLease(record, ref, reason, context, err);
+      if (unattempted)
+        return unattempted;
       const blocker = leaseFailureBlocker(ref, err);
       if (!blocker)
         throw err;
@@ -25517,8 +25691,15 @@ class AccountPool {
         continue;
       if (!this.state.stateFor(ref).state.needsReauth)
         continue;
-      if (await this.managerFor(record).healNeedsReauth(ref)) {
-        this.lastReauthAttempt.delete(record.id);
+      let healed = await this.managerFor(record).healNeedsReauth(ref);
+      if (!healed) {
+        const current = this.accounts().find((a) => a.id === record.id);
+        if (current && isStoreOnlyMove(record, current)) {
+          healed = await this.managerFor(current).healNeedsReauth(this.refOf(current));
+        }
+      }
+      if (healed) {
+        this.lastReauthAttempt.clear(record.id);
         context.reauthAttempts.delete(record.id);
       }
     }
@@ -25571,6 +25752,36 @@ class AccountPool {
     }
     return new NoUsableAccountError(buildUnusableMessage(input), blockers);
   }
+  validateLeasedRow(record, phase) {
+    const legacyExchange = phase === "before-exchange" && record.store === "legacy-codex-file";
+    const reread = phase === "store-empty" || legacyExchange;
+    if (reread)
+      this.registry.invalidate();
+    let snapshot;
+    try {
+      snapshot = this.registry.snapshot(this.provider);
+    } catch (err) {
+      if (phase === "before-persist")
+        return;
+      throw err;
+    }
+    const failedSource = reread ? this.failedSourceOf(snapshot) : undefined;
+    if (failedSource) {
+      throw new AccountListUnreadableDuringLeaseError(record.label, failedSource.path, legacyExchange ? "its legacy file token is about to be exchanged" : "its store is empty");
+    }
+    const current = snapshot.accounts[this.provider].find((row) => row.id === record.id);
+    if (isStoreOnlyMove(record, current))
+      throw new AccountStoreMovedDuringLeaseError(record.label);
+    const rebound = !current || current.store !== record.store || current.identity.chatgptAccountId !== record.identity.chatgptAccountId;
+    if (rebound || phase !== "before-persist" && !current.enabled) {
+      throw new AccountChangedDuringLeaseError(`Account ${record.label} was removed, disabled or rebound during refresh.`);
+    }
+  }
+  failedSourceOf(snapshot) {
+    if (this.provider === "openai-codex")
+      return codexSourceFailed(snapshot);
+    return snapshot.config.state === "failed" ? snapshot.config : undefined;
+  }
   managerFor(record) {
     const key = `${record.id}:${record.store}:${record.identity.chatgptAccountId ?? ""}`;
     const existing = this.managers.get(key);
@@ -25580,21 +25791,7 @@ class AccountPool {
       store: this.storeFactory(record),
       exchange: exchangeFor(this.provider),
       lockPathFor: () => accountRefreshLockPath(record, this.env),
-      validateAccount: (_ref, phase) => {
-        let rows;
-        try {
-          rows = this.registry.snapshot(this.provider).accounts[this.provider];
-        } catch (err) {
-          if (phase === "before-persist")
-            return;
-          throw err;
-        }
-        const current = rows.find((row) => row.id === record.id);
-        const rebound = !current || current.store !== record.store || current.identity.chatgptAccountId !== record.identity.chatgptAccountId;
-        if (rebound || phase === "before-exchange" && !current.enabled) {
-          throw new AccountChangedDuringLeaseError(`Account ${record.label} was removed, disabled or rebound during refresh.`);
-        }
-      },
+      validateAccount: (_ref, phase) => this.validateLeasedRow(record, phase),
       state: this.state,
       now: this.now,
       env: this.env
@@ -25708,7 +25905,7 @@ function getAccountPool(provider) {
   pools.set(provider, pool);
   return pool;
 }
-var LEASE_FAILURE_DEPRIORITIZE_MS = 60000, AccountChangedDuringLeaseError, pools;
+var LEASE_FAILURE_DEPRIORITIZE_MS = 60000, AccountChangedDuringLeaseError, AccountStoreMovedDuringLeaseError, AccountListUnreadableDuringLeaseError, STORE_MOVED, NOT_ATTEMPTED, pools;
 var init_pool = __esm(() => {
   init_connection_error();
   init_logger();
@@ -25724,6 +25921,18 @@ var init_pool = __esm(() => {
   init_types();
   AccountChangedDuringLeaseError = class AccountChangedDuringLeaseError extends NoUsableAccountError {
   };
+  AccountStoreMovedDuringLeaseError = class AccountStoreMovedDuringLeaseError extends RefreshUnavailableError {
+    constructor(label) {
+      super("account store moved while leasing", `${label} now reads from its new store; retry`);
+    }
+  };
+  AccountListUnreadableDuringLeaseError = class AccountListUnreadableDuringLeaseError extends RefreshUnavailableError {
+    constructor(label, configPath, what = "its store is empty") {
+      super("account list could not be read", `${label}: ${what} and ${configPath} could not be read; retry`);
+    }
+  };
+  STORE_MOVED = Symbol("store-moved");
+  NOT_ATTEMPTED = Symbol("not-attempted");
   pools = new Map;
 });
 
@@ -25962,11 +26171,7 @@ var init_codex = __esm(() => {
       return { kind: "headers" };
     },
     isAvailable() {
-      try {
-        return existsSync10(credentialsPath());
-      } catch {
-        return false;
-      }
+      return getAccountRegistry().mayHaveConfiguredAccounts("openai-codex");
     },
     scrape(response) {
       return scrapeCodexHeaders(response.headers);
@@ -42073,188 +42278,6 @@ var init_billing_probe = __esm(() => {
   };
 });
 
-// src/auth/codex-pkce.ts
-import { exec as exec3 } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes7 } from "crypto";
-import { createServer } from "http";
-import { promisify as promisify3 } from "util";
-function loginClaims(idToken) {
-  try {
-    if (!idToken || idToken.split(".").length !== 3)
-      return { identity: {} };
-    const payload = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString("utf-8"));
-    const auth = payload["https://api.openai.com/auth"];
-    const stable = auth?.chatgpt_account_id || payload.chatgpt_account_id;
-    const text = (value) => typeof value === "string" && value.trim() ? value : undefined;
-    const wireId = stable || auth?.user_id;
-    return {
-      accountId: wireId ? wireId : undefined,
-      identity: {
-        chatgptAccountId: text(stable),
-        email: text(payload.email),
-        plan: text(auth?.chatgpt_plan_type)
-      }
-    };
-  } catch {
-    return { identity: {} };
-  }
-}
-function buildAuthUrl(challenge, state, redirectUri) {
-  const params = [
-    "response_type=code",
-    `client_id=${encodeURIComponent(CODEX_OAUTH_CONFIG.clientId)}`,
-    `redirect_uri=${encodeURIComponent(redirectUri)}`,
-    `scope=${CODEX_OAUTH_CONFIG.scopes.join("+")}`,
-    `code_challenge=${encodeURIComponent(challenge)}`,
-    "code_challenge_method=S256",
-    "id_token_add_organizations=true",
-    "codex_cli_simplified_flow=true",
-    `state=${encodeURIComponent(state)}`,
-    "originator=opencode"
-  ].join("&");
-  return `${CODEX_OAUTH_CONFIG.authUrl}?${params}`;
-}
-async function openBrowser(url) {
-  const execAsync = promisify3(exec3);
-  try {
-    if (process.platform === "darwin")
-      await execAsync(`open "${url}"`);
-    else if (process.platform === "win32")
-      await execAsync(`start "${url}"`);
-    else
-      await execAsync(`xdg-open "${url}"`);
-    console.log(`
-Opening browser for OpenAI authentication...`);
-    console.log(`If the browser doesn't open, visit this URL:
-${url}
-`);
-  } catch {
-    console.log(`
-Please open this URL in your browser to authenticate:`);
-    console.log(url);
-    console.log("");
-  }
-}
-function waitForCallback(options, deps) {
-  return new Promise((resolve, reject) => {
-    let redirectUri = "";
-    const schedule = deps.setTimeout ?? setTimeout;
-    const cancel = deps.clearTimeout ?? clearTimeout;
-    const finish = (error, result) => {
-      if (timer !== undefined)
-        cancel(timer);
-      server.close();
-      if (error)
-        reject(error);
-      else if (result)
-        resolve(result);
-    };
-    const server = createServer((req, res) => {
-      const url = new URL(req.url, redirectUri.replace("/auth/callback", ""));
-      if (url.pathname !== "/auth/callback") {
-        res.writeHead(404, { "Content-Type": "text/plain" });
-        res.end("Not found");
-        return;
-      }
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      if (error || !state || state !== options.state || !code) {
-        const detail = error ? "OAuth authorization was refused." : !state || state !== options.state ? "Invalid state parameter. Possible CSRF attack." : "No authorization code received.";
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end(`<html><body><h1>Authentication Failed</h1><p>${detail}</p><p>You can close this window.</p></body></html>`);
-        finish(new Error(error ? "OAuth authorization was refused" : !state || state !== options.state ? "Invalid OAuth state parameter (CSRF protection)" : "No authorization code received"));
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<html><body><h1>Authentication Successful!</h1><p>You can now close this window and return to your terminal.</p></body></html>");
-      finish(undefined, { authCode: code, state, redirectUri });
-    });
-    server.on("error", (err) => finish(new Error(`Failed to start callback server: ${err.message}`)));
-    server.listen(options.port, () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        finish(new Error("Failed to get server port"));
-        return;
-      }
-      redirectUri = `http://localhost:${address.port}/auth/callback`;
-      log(`[CodexOAuth] Callback server started on http://localhost:${address.port}`);
-      options.openBrowser(options.authorize(redirectUri)).catch(() => finish(new Error("Could not open OAuth browser")));
-    });
-    const timer = schedule(() => finish(new Error("OAuth login timed out after 5 minutes")), options.timeoutMs);
-  });
-}
-async function loginCodexPkce(deps = {}) {
-  log("[CodexOAuth] Starting OAuth login flow");
-  const verifier = randomBytes7(64).toString("base64url");
-  const challenge = createHash12("sha256").update(verifier).digest("base64url");
-  const state = randomBytes7(32).toString("base64url");
-  const options = {
-    port: 1455,
-    timeoutMs: 5 * 60 * 1000,
-    state,
-    authorize: (redirectUri) => buildAuthUrl(challenge, state, redirectUri),
-    openBrowser: deps.browser ?? openBrowser
-  };
-  const callback = await (deps.callback ? deps.callback(options) : waitForCallback(options, deps));
-  if (!callback.state || callback.state !== state)
-    throw new Error("Invalid OAuth state parameter (CSRF protection)");
-  if (!callback.authCode)
-    throw new Error("No authorization code received");
-  if (callback.redirectUri !== "http://localhost:1455/auth/callback")
-    throw new Error("Invalid OAuth redirect URI");
-  log("[CodexOAuth] Exchanging auth code for tokens");
-  let tokens;
-  try {
-    const response = await (deps.fetch ?? globalThis.fetch)(resolveUpstreamUrl(CODEX_OAUTH_CONFIG.tokenUrl), {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code: callback.authCode,
-        redirect_uri: callback.redirectUri,
-        client_id: CODEX_OAUTH_CONFIG.clientId,
-        code_verifier: verifier
-      })
-    });
-    if (!response.ok) {
-      throw new Error(`Token exchange failed: ${response.status}`);
-    }
-    try {
-      tokens = await response.json();
-    } catch {
-      throw new Error("Invalid OAuth token response");
-    }
-    if (!tokens.access_token || !tokens.refresh_token)
-      throw new Error("Token response missing access_token or refresh_token");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Token exchange failed";
-    const safe = message.split(callback.authCode).join("[redacted]").split(verifier).join("[redacted]");
-    throw new Error(`Failed to authenticate with OpenAI OAuth: ${safe}`);
-  }
-  const claims = loginClaims(tokens.id_token);
-  return {
-    credentials: {
-      access_token: tokens.access_token,
-      refresh_token: tokens.refresh_token,
-      expires_at: (deps.now ?? Date.now)() + tokens.expires_in * 1000,
-      account_id: claims.accountId
-    },
-    identity: claims.identity
-  };
-}
-var CODEX_OAUTH_CONFIG;
-var init_codex_pkce = __esm(() => {
-  init_logger();
-  init_test_upstream();
-  CODEX_OAUTH_CONFIG = {
-    clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-    authUrl: "https://auth.openai.com/oauth/authorize",
-    tokenUrl: "https://auth.openai.com/oauth/token",
-    scopes: ["openid", "profile", "email", "offline_access"]
-  };
-});
-
 // ../../node_modules/.bun/@inquirer+core@11.0.1+04f2146be16c61ef/node_modules/@inquirer/core/dist/lib/key.js
 var isUpKey = (key, keybindings = []) => key.name === "up" || keybindings.includes("vim") && key.name === "k" || keybindings.includes("emacs") && key.ctrl && key.name === "p", isDownKey = (key, keybindings = []) => key.name === "down" || keybindings.includes("vim") && key.name === "j" || keybindings.includes("emacs") && key.ctrl && key.name === "n", isBackspaceKey = (key) => key.name === "backspace", isTabKey = (key) => key.name === "tab", isNumberKey = (key) => "1234567890".includes(key.name), isEnterKey = (key) => key.name === "enter" || key.name === "return";
 
@@ -43192,7 +43215,7 @@ function wrapAnsi(string, columns, options) {
   return String(string).normalize().replaceAll(`\r
 `, `
 `).split(`
-`).map((line) => exec4(line, columns, options)).join(`
+`).map((line) => exec3(line, columns, options)).join(`
 `);
 }
 var ESCAPES, END_CODE = 39, ANSI_ESCAPE_BELL = "\x07", ANSI_CSI = "[", ANSI_OSC = "]", ANSI_SGR_TERMINATOR = "m", ANSI_ESCAPE_LINK, wrapAnsiCode = (code) => `${ESCAPES.values().next().value}${ANSI_CSI}${code}${ANSI_SGR_TERMINATOR}`, wrapAnsiHyperlink = (url) => `${ESCAPES.values().next().value}${ANSI_ESCAPE_LINK}${url}${ANSI_ESCAPE_BELL}`, wordLengths = (string) => string.split(" ").map((character) => stringWidth(character)), wrapWord = (rows, word, columns) => {
@@ -43246,7 +43269,7 @@ var ESCAPES, END_CODE = 39, ANSI_ESCAPE_BELL = "\x07", ANSI_CSI = "[", ANSI_OSC
     return string;
   }
   return words.slice(0, last).join(" ") + words.slice(last).join("");
-}, exec4 = (string, columns, options = {}) => {
+}, exec3 = (string, columns, options = {}) => {
   if (options.trim !== false && string.trim() === "") {
     return "";
   }
@@ -44525,9 +44548,727 @@ var init_dist12 = __esm(() => {
   init_dist11();
 });
 
+// src/auth/codex-pkce.ts
+import { exec as exec4 } from "child_process";
+import { createHash as createHash12, randomBytes as randomBytes7 } from "crypto";
+import { createServer } from "http";
+import { promisify as promisify3 } from "util";
+function loginClaims(idToken) {
+  try {
+    if (!idToken || idToken.split(".").length !== 3)
+      return { identity: {} };
+    const payload = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString("utf-8"));
+    const auth = payload["https://api.openai.com/auth"];
+    const stable = auth?.chatgpt_account_id || payload.chatgpt_account_id;
+    const text = (value) => typeof value === "string" && value.trim() ? value : undefined;
+    const wireId = stable || auth?.user_id;
+    return {
+      accountId: wireId ? wireId : undefined,
+      identity: {
+        chatgptAccountId: text(stable),
+        email: text(payload.email),
+        plan: text(auth?.chatgpt_plan_type)
+      }
+    };
+  } catch {
+    return { identity: {} };
+  }
+}
+function buildAuthUrl(challenge, state, redirectUri) {
+  const params = [
+    "response_type=code",
+    `client_id=${encodeURIComponent(CODEX_OAUTH_CONFIG.clientId)}`,
+    `redirect_uri=${encodeURIComponent(redirectUri)}`,
+    `scope=${CODEX_OAUTH_CONFIG.scopes.join("+")}`,
+    `code_challenge=${encodeURIComponent(challenge)}`,
+    "code_challenge_method=S256",
+    "id_token_add_organizations=true",
+    "codex_cli_simplified_flow=true",
+    `state=${encodeURIComponent(state)}`,
+    "originator=opencode"
+  ].join("&");
+  return `${CODEX_OAUTH_CONFIG.authUrl}?${params}`;
+}
+async function openBrowser(url) {
+  const execAsync = promisify3(exec4);
+  try {
+    if (process.platform === "darwin")
+      await execAsync(`open "${url}"`);
+    else if (process.platform === "win32")
+      await execAsync(`start "${url}"`);
+    else
+      await execAsync(`xdg-open "${url}"`);
+    console.log(`
+Opening browser for OpenAI authentication...`);
+    console.log(`If the browser doesn't open, visit this URL:
+${url}
+`);
+  } catch {
+    console.log(`
+Please open this URL in your browser to authenticate:`);
+    console.log(url);
+    console.log("");
+  }
+}
+function waitForCallback(options, deps) {
+  return new Promise((resolve, reject) => {
+    let redirectUri = "";
+    const schedule = deps.setTimeout ?? setTimeout;
+    const cancel = deps.clearTimeout ?? clearTimeout;
+    const finish = (error, result) => {
+      if (timer !== undefined)
+        cancel(timer);
+      server.close();
+      if (error)
+        reject(error);
+      else if (result)
+        resolve(result);
+    };
+    const server = createServer((req, res) => {
+      const url = new URL(req.url, redirectUri.replace("/auth/callback", ""));
+      if (url.pathname !== "/auth/callback") {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      if (error || !state || state !== options.state || !code) {
+        const detail = error ? "OAuth authorization was refused." : !state || state !== options.state ? "Invalid state parameter. Possible CSRF attack." : "No authorization code received.";
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(`<html><body><h1>Authentication Failed</h1><p>${detail}</p><p>You can close this window.</p></body></html>`);
+        finish(new Error(error ? "OAuth authorization was refused" : !state || state !== options.state ? "Invalid OAuth state parameter (CSRF protection)" : "No authorization code received"));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<html><body><h1>Authentication Successful!</h1><p>You can now close this window and return to your terminal.</p></body></html>");
+      finish(undefined, { authCode: code, state, redirectUri });
+    });
+    server.on("error", (err) => finish(new Error(`Failed to start callback server: ${err.message}`)));
+    server.listen(options.port, () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        finish(new Error("Failed to get server port"));
+        return;
+      }
+      redirectUri = `http://localhost:${address.port}/auth/callback`;
+      log(`[CodexOAuth] Callback server started on http://localhost:${address.port}`);
+      options.openBrowser(options.authorize(redirectUri)).catch(() => finish(new Error("Could not open OAuth browser")));
+    });
+    const timer = schedule(() => finish(new Error("OAuth login timed out after 5 minutes")), options.timeoutMs);
+  });
+}
+async function loginCodexPkce(deps = {}) {
+  log("[CodexOAuth] Starting OAuth login flow");
+  const verifier = randomBytes7(64).toString("base64url");
+  const challenge = createHash12("sha256").update(verifier).digest("base64url");
+  const state = randomBytes7(32).toString("base64url");
+  const options = {
+    port: 1455,
+    timeoutMs: 5 * 60 * 1000,
+    state,
+    authorize: (redirectUri) => buildAuthUrl(challenge, state, redirectUri),
+    openBrowser: deps.browser ?? openBrowser
+  };
+  const callback = await (deps.callback ? deps.callback(options) : waitForCallback(options, deps));
+  if (!callback.state || callback.state !== state)
+    throw new Error("Invalid OAuth state parameter (CSRF protection)");
+  if (!callback.authCode)
+    throw new Error("No authorization code received");
+  if (callback.redirectUri !== "http://localhost:1455/auth/callback")
+    throw new Error("Invalid OAuth redirect URI");
+  log("[CodexOAuth] Exchanging auth code for tokens");
+  let tokens;
+  try {
+    const response = await (deps.fetch ?? globalThis.fetch)(resolveUpstreamUrl(CODEX_OAUTH_CONFIG.tokenUrl), {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code: callback.authCode,
+        redirect_uri: callback.redirectUri,
+        client_id: CODEX_OAUTH_CONFIG.clientId,
+        code_verifier: verifier
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`Token exchange failed: ${response.status}`);
+    }
+    try {
+      tokens = await response.json();
+    } catch {
+      throw new Error("Invalid OAuth token response");
+    }
+    if (!tokens.access_token || !tokens.refresh_token)
+      throw new Error("Token response missing access_token or refresh_token");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Token exchange failed";
+    const safe = message.split(callback.authCode).join("[redacted]").split(verifier).join("[redacted]");
+    throw new Error(`Failed to authenticate with OpenAI OAuth: ${safe}`);
+  }
+  const claims = loginClaims(tokens.id_token);
+  return {
+    credentials: {
+      access_token: tokens.access_token,
+      refresh_token: tokens.refresh_token,
+      expires_at: (deps.now ?? Date.now)() + tokens.expires_in * 1000,
+      account_id: claims.accountId
+    },
+    identity: claims.identity
+  };
+}
+var CODEX_OAUTH_CONFIG;
+var init_codex_pkce = __esm(() => {
+  init_logger();
+  init_test_upstream();
+  CODEX_OAUTH_CONFIG = {
+    clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+    authUrl: "https://auth.openai.com/oauth/authorize",
+    tokenUrl: "https://auth.openai.com/oauth/token",
+    scopes: ["openid", "profile", "email", "offline_access"]
+  };
+});
+
+// src/auth/codex-oauth.ts
+var exports_codex_oauth = {};
+__export(exports_codex_oauth, {
+  CodexOAuth: () => CodexOAuth,
+  CodexOAuthLocalError: () => CodexOAuthLocalError,
+  getCodexOAuth: () => getCodexOAuth
+});
+import { existsSync as existsSync18, readFileSync as readFileSync21, unlinkSync as unlinkSync6 } from "fs";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAbsenceError(e) {
+  const code = e?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+function errorMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function credentialFileUnreadable(credPath, detail) {
+  return new CodexOAuthLocalError(`Could not read the OpenAI Codex credential file (${credPath}): ${detail}. ` + `Fix its permissions or contents, or run \`${LOGIN_COMMAND}\` to replace it; ` + "claudish does not fall back to OPENAI_CODEX_API_KEY while this file exists.");
+}
+function asCredentialFileError(e, credPath) {
+  return e instanceof CodexOAuthLocalError ? e : credentialFileUnreadable(credPath, errorMessage(e));
+}
+function describeTokenEndpointError(body, presentedRefreshToken) {
+  let text = "";
+  try {
+    const parsed = JSON.parse(body);
+    const err = parsed?.error;
+    const nested = typeof err === "object" && err !== null ? err : undefined;
+    const code = typeof err === "string" ? err : typeof nested?.code === "string" ? nested.code : undefined;
+    const message = typeof parsed?.error_description === "string" ? parsed.error_description : typeof nested?.message === "string" ? nested.message : undefined;
+    text = [code, message].filter(Boolean).join(": ");
+  } catch {
+    text = body;
+  }
+  if (presentedRefreshToken)
+    text = text.split(presentedRefreshToken).join("[redacted]");
+  text = text.replace(/\s+/g, " ").trim();
+  if (text.length > 200)
+    text = `${text.slice(0, 200)}\u2026`;
+  return text ? ` ${text}` : "";
+}
+function tokenHostUnreachable(e, tokenUrl) {
+  log(`[CodexOAuth] Could not reach ${tokenUrl}: ${errorMessage(e)}`);
+  return Object.assign(new Error(`Could not reach ${tokenUrl} to refresh the Codex token: ${errorMessage(e)}`, {
+    cause: markOwnTimeout(e)
+  }), { claudishEndpoint: tokenUrl });
+}
+
+class CodexOAuth {
+  static instance = null;
+  credentials = null;
+  credentialFileFailure = null;
+  readCredentialText = (path) => readFileSync21(path, "utf-8");
+  refreshPromise = null;
+  tokenRefreshMargin = 5 * 60 * 1000;
+  gateOverrides = {};
+  static _resetInstanceForTests() {
+    const instance = CodexOAuth.instance;
+    if (!instance)
+      return;
+    instance.credentials = null;
+    instance.credentialFileFailure = null;
+    instance.readCredentialText = (path) => readFileSync21(path, "utf-8");
+    instance.refreshPromise = null;
+    instance.tokenRefreshMargin = 5 * 60 * 1000;
+    instance.gateOverrides = {};
+    instance.loadCredentials();
+  }
+  _setRefreshGateOptionsForTests(opts) {
+    this.gateOverrides = { ...opts };
+  }
+  _setCredentialFileReaderForTests(read) {
+    this.readCredentialText = read ?? ((path) => readFileSync21(path, "utf-8"));
+  }
+  static getInstance() {
+    if (!CodexOAuth.instance) {
+      CodexOAuth.instance = new CodexOAuth;
+    }
+    return CodexOAuth.instance;
+  }
+  constructor() {
+    this.loadCredentials();
+  }
+  reloadCredentials() {
+    this.loadCredentials();
+    this.refreshPromise = null;
+  }
+  hasCredentials() {
+    return this.credentials !== null && !!this.credentials.refresh_token || this.credentialFileFailure !== null;
+  }
+  getCredentialsPath() {
+    return legacyCodexCredentialsPath();
+  }
+  getRefreshGatePath() {
+    return this.gateOverrides.path ?? accountLockPath("openai-codex", LEGACY_CODEX_ACCOUNT_ID);
+  }
+  async login(deps = {}) {
+    await Promise.resolve().then(() => init_management());
+    if (codexLoginUsesKeychain()) {
+      const lines = await loginCodexAccount({ pkce: () => loginCodexPkce(deps) });
+      for (const line of lines)
+        console.log(line);
+      this.reloadCredentials();
+      log("[CodexOAuth] Login saved to the Keychain account store");
+      return;
+    }
+    assertLegacyCodexLoginPermitted();
+    const { credentials } = await loginCodexPkce(deps);
+    const accountId = credentials.account_id;
+    await saveLegacyCodexLogin(() => {
+      this.saveCredentials(credentials);
+      this.setCredentials(credentials);
+    });
+    log("[CodexOAuth] Login successful");
+    if (accountId) {
+      log(`[CodexOAuth] Account ID: ${accountId}`);
+    }
+  }
+  async logout() {
+    await Promise.resolve().then(() => init_management());
+    assertLegacyCodexLogoutPermitted();
+    const credPath = this.getCredentialsPath();
+    if (existsSync18(credPath)) {
+      unlinkSync6(credPath);
+      log("[CodexOAuth] Credentials deleted");
+    }
+    this.setCredentials(null);
+  }
+  async getAccessToken() {
+    if (this.refreshPromise) {
+      log("[CodexOAuth] Waiting for in-progress refresh");
+      return this.refreshPromise;
+    }
+    if (!this.credentials && this.credentialFileFailure) {
+      this.loadCredentials();
+      if (this.credentialFileFailure)
+        throw this.credentialFileFailure;
+    }
+    if (!this.credentials)
+      throw await this.credentialFileGoneError();
+    if (this.isTokenValid()) {
+      return this.credentials.access_token;
+    }
+    return this.startRefresh({ kind: "expiry" });
+  }
+  getAccountId() {
+    return this.credentials?.account_id;
+  }
+  async forceRefresh() {
+    if (this.refreshPromise) {
+      log("[CodexOAuth] Forced refresh joined the in-progress refresh");
+      return this.refreshPromise;
+    }
+    return this.startRefresh({ kind: "forced", rejected: this.credentials?.access_token });
+  }
+  async refreshToken() {
+    await this.forceRefresh();
+  }
+  isTokenValid() {
+    if (!this.credentials)
+      return false;
+    return this.isFresh(this.credentials);
+  }
+  isFresh(credentials) {
+    return Date.now() < credentials.expires_at - this.tokenRefreshMargin;
+  }
+  isAdoptable(onDisk, trigger) {
+    if (!this.isFresh(onDisk))
+      return false;
+    return trigger.kind === "expiry" || onDisk.access_token !== trigger.rejected;
+  }
+  startRefresh(trigger) {
+    const flight = this.refreshUnderGate(trigger).finally(() => {
+      if (this.refreshPromise === flight)
+        this.refreshPromise = null;
+    });
+    this.refreshPromise = flight;
+    return flight;
+  }
+  async refreshUnderGate(trigger) {
+    const before = this.readCredentialFile();
+    try {
+      return await withRefreshGate("openai-codex", LEGACY_CODEX_ACCOUNT_ID, (handle) => this.refreshHoldingGate(trigger, handle), {
+        path: this.getRefreshGatePath(),
+        gen: before?.generation ?? 0,
+        ...this.gateOverrides.deps ? { deps: this.gateOverrides.deps } : {}
+      });
+    } catch (err) {
+      if (!isGateUnavailable(err))
+        throw err;
+      return this.refreshWithoutGate(trigger, err);
+    }
+  }
+  async refreshWithoutGate(trigger, err) {
+    const latest = this.readCredentialFile();
+    const ownership = latest ? await this.legacyFileOwnership() : undefined;
+    if (latest && ownership === "facade" && this.isAdoptable(latest.credentials, trigger)) {
+      log(`[CodexOAuth] Refresh gate unavailable (${err.reason}); the holder already rotated \u2014 using its token`);
+      this.setCredentials(latest.credentials);
+      return latest.credentials.access_token;
+    }
+    if (ownership === "elsewhere")
+      this.setCredentials(null);
+    else if (!latest)
+      await this.credentialFileGoneError({ dropCredentials: true });
+    log(`[CodexOAuth] Refresh gate unavailable: ${err.message}`);
+    if (err.reason !== "unwritable") {
+      throw credentialHttpError(`Another claudish process is refreshing the OpenAI Codex login (${err.reason}); retrying will usually work.`, 503);
+    }
+    throw new CodexOAuthLocalError(`Could not refresh the OpenAI Codex login: the refresh lock could not be created (${err.reason}). Retry the request; if this persists, run \`${LOGIN_COMMAND}\`.`);
+  }
+  async refreshHoldingGate(trigger, handle) {
+    const onDisk = this.readCredentialFile();
+    if (!onDisk)
+      throw await this.credentialFileGoneError({ dropCredentials: true });
+    const ownership = await this.legacyFileOwnership();
+    if (ownership !== "facade") {
+      if (ownership === "elsewhere")
+        this.setCredentials(null);
+      throw this.facadeYieldError(ownership);
+    }
+    if (this.isAdoptable(onDisk.credentials, trigger)) {
+      log("[CodexOAuth] Another process already rotated the token \u2014 using it, no exchange");
+      this.setCredentials(onDisk.credentials);
+      return onDisk.credentials.access_token;
+    }
+    const updated = await this.exchangeRefreshToken(onDisk.credentials);
+    if (!handle.holdsLock()) {
+      throw new CodexOAuthLocalError(`Could not refresh the OpenAI Codex login: the refresh lock was taken over before the new token could be saved. Retry the request; if this persists, run \`${LOGIN_COMMAND}\`.`);
+    }
+    const current = this.readCredentialFile();
+    if (!current) {
+      log("[CodexOAuth] The credential file was removed during the exchange \u2014 not recreating it");
+      this.setCredentials(null);
+      throw await this.credentialFileGoneError();
+    }
+    if (current.credentials.refresh_token !== onDisk.credentials.refresh_token) {
+      log("[CodexOAuth] The credential file changed during the exchange \u2014 keeping it");
+      this.setCredentials(current.credentials);
+      return current.credentials.access_token;
+    }
+    if (await this.legacyFileOwnership() === "elsewhere") {
+      log("[CodexOAuth] The account list no longer names the credential file \u2014 not saving to it");
+      this.setCredentials(null);
+      throw this.facadeYieldError("elsewhere");
+    }
+    try {
+      this.saveCredentials(updated);
+    } catch (e) {
+      log(`[CodexOAuth] Could not save the refreshed token: ${errorMessage(e)}`);
+      throw new CodexOAuthLocalError(`Could not save the refreshed OpenAI Codex login (${errorMessage(e)}). Run \`${LOGIN_COMMAND}\` to sign in again.`);
+    }
+    this.setCredentials(updated);
+    log(`[CodexOAuth] Token refreshed, valid until ${new Date(updated.expires_at).toISOString()}`);
+    return updated.access_token;
+  }
+  async legacyFileOwnership() {
+    await Promise.resolve().then(() => init_registry());
+    const registry = getAccountRegistry();
+    registry.invalidate();
+    let snapshot;
+    try {
+      snapshot = registry.snapshot("openai-codex");
+    } catch (err) {
+      log(`[CodexOAuth] Could not read the Codex account list: ${errorMessage(err)}`);
+      return "unknown";
+    }
+    const failed = codexSourceFailed(snapshot);
+    if (failed) {
+      log(`[CodexOAuth] Could not read the Codex account list (${failed.path}); not trusting the last-known-good copy`);
+      return "unknown";
+    }
+    if (isSynthesizedLegacyOnlySnapshot(snapshot))
+      return "facade";
+    const suppressed = snapshot.settings["openai-codex"]?.legacyCodexSuppressed === true;
+    const named = snapshot.accounts["openai-codex"].some((row) => row.store === "legacy-codex-file");
+    return !suppressed && named ? "file-row" : "elsewhere";
+  }
+  async missingLoginError() {
+    return this.credentialFileGoneError();
+  }
+  facadeYieldError(ownership) {
+    if (ownership === "unknown") {
+      return new CodexOAuthLocalError("The Codex account list could not be read, so the OpenAI Codex login was not refreshed. Retry the request.");
+    }
+    if (ownership === "file-row") {
+      return new CodexOAuthLocalError("The Codex login is now a configured account; retry the request.");
+    }
+    return new CodexOAuthLocalError("The Codex login moved to the macOS Keychain; retry the request.");
+  }
+  async credentialFileGoneError(opts = {}) {
+    await Promise.resolve().then(() => init_registry());
+    const registry = getAccountRegistry();
+    registry.invalidate();
+    const unreadable = (detail) => {
+      log(`[CodexOAuth] Credential file absent and the account list is unreadable: ${detail}`);
+      return new CodexOAuthLocalError("The OpenAI Codex credential file is gone and the Codex account list could not be read. Retry the request.");
+    };
+    let configured;
+    try {
+      const snapshot = registry.snapshot("openai-codex");
+      const failed = codexSourceFailed(snapshot);
+      if (failed)
+        return unreadable(`${failed.path}: ${failed.error ?? "read failed"}`);
+      configured = snapshot.accounts["openai-codex"].length > 0;
+    } catch (err) {
+      return unreadable(errorMessage(err));
+    }
+    if (opts.dropCredentials)
+      this.setCredentials(null);
+    if (configured) {
+      log("[CodexOAuth] Credential file absent; Codex accounts are configured \u2014 answering transient");
+      return new CodexOAuthLocalError("The Codex login moved to the macOS Keychain; retry the request.");
+    }
+    return new CodexOAuthRefreshError(`No OpenAI Codex OAuth credentials found. Please run \`${LOGIN_COMMAND}\` first.`);
+  }
+  async exchangeRefreshToken(from) {
+    log("[CodexOAuth] Refreshing access token");
+    const tokenUrl = resolveUpstreamUrl(CODEX_OAUTH_CONFIG.tokenUrl);
+    let response;
+    try {
+      response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          refresh_token: from.refresh_token,
+          client_id: CODEX_OAUTH_CONFIG.clientId
+        }),
+        signal: AbortSignal.timeout(CODEX_EXCHANGE_TIMEOUT_MS)
+      });
+    } catch (e) {
+      throw tokenHostUnreachable(e, tokenUrl);
+    }
+    if (!response.ok) {
+      const errorText = await response.text().catch(() => "");
+      const detail = describeTokenEndpointError(errorText, from.refresh_token);
+      log(`[CodexOAuth] Refresh failed: HTTP ${response.status}${detail}`);
+      if (response.status === 429 || response.status >= 500 && response.status <= 599) {
+        throw credentialHttpError(`The Codex token host is busy or unavailable (HTTP ${response.status}); retrying will usually work.${detail}`, response.status);
+      }
+      throw new CodexOAuthRefreshError(`OpenAI Codex login expired or was revoked \u2014 run \`${LOGIN_COMMAND}\` to sign in again. (token refresh: HTTP ${response.status}${detail})`);
+    }
+    let tokens;
+    try {
+      tokens = await response.json();
+    } catch (e) {
+      throw new CodexOAuthRefreshError(`Run \`${LOGIN_COMMAND}\` to sign in again: the Codex token endpoint returned an unreadable body (${errorMessage(e)}). A retry can succeed only if another claudish process already saved a newer token.`);
+    }
+    if (typeof tokens?.access_token !== "string" || tokens.access_token.length === 0) {
+      throw new CodexOAuthRefreshError(`Could not refresh the OpenAI Codex login: the token endpoint returned no access token. Retry; if this persists, run \`${LOGIN_COMMAND}\`.`);
+    }
+    const accountId = (tokens.id_token ? this.extractAccountId(tokens.id_token) : undefined) ?? from.account_id;
+    const expiresIn = typeof tokens.expires_in === "number" ? tokens.expires_in : 3600;
+    return {
+      access_token: tokens.access_token,
+      refresh_token: tokens.refresh_token || from.refresh_token,
+      expires_at: Date.now() + expiresIn * 1000,
+      account_id: accountId
+    };
+  }
+  setCredentials(credentials) {
+    this.credentials = credentials;
+    this.credentialFileFailure = null;
+  }
+  loadCredentials() {
+    const outcome = this.classifyCredentialFile();
+    switch (outcome.kind) {
+      case "present":
+        this.setCredentials(outcome.read.credentials);
+        log("[CodexOAuth] Loaded credentials from file");
+        return;
+      case "absent":
+        this.setCredentials(null);
+        return;
+      case "failed":
+        this.credentials = null;
+        this.credentialFileFailure = outcome.error;
+        log(`[CodexOAuth] Credential file present but unusable \u2014 Codex requests fail until it is fixed: ${outcome.error.message}`);
+        return;
+    }
+  }
+  classifyCredentialFile() {
+    let raw;
+    try {
+      raw = this.readRawCredentialFile();
+    } catch (e) {
+      return { kind: "failed", error: asCredentialFileError(e, this.getCredentialsPath()) };
+    }
+    if (raw === null)
+      return { kind: "absent" };
+    if (typeof raw.refresh_token !== "string" || !raw.refresh_token) {
+      log("[CodexOAuth] Credential file names no refresh token \u2014 treating it as no login");
+      return { kind: "absent" };
+    }
+    try {
+      return { kind: "present", read: this.projectCredentialFile(raw) };
+    } catch (e) {
+      return { kind: "failed", error: asCredentialFileError(e, this.getCredentialsPath()) };
+    }
+  }
+  readCredentialFile() {
+    const raw = this.readRawCredentialFile();
+    return raw === null ? null : this.projectCredentialFile(raw);
+  }
+  readRawCredentialFile() {
+    const credPath = this.getCredentialsPath();
+    let text;
+    try {
+      text = this.readCredentialText(credPath);
+    } catch (e) {
+      if (isAbsenceError(e))
+        return null;
+      throw credentialFileUnreadable(credPath, errorMessage(e));
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw credentialFileUnreadable(credPath, `it is not valid JSON (${text.length === 0 ? "empty" : "truncated or corrupted"})`);
+    }
+    if (!isRecord2(parsed)) {
+      throw credentialFileUnreadable(credPath, "it is not a JSON object");
+    }
+    return parsed;
+  }
+  projectCredentialFile(raw) {
+    const credPath = this.getCredentialsPath();
+    const accessToken = raw.access_token;
+    const refreshToken = raw.refresh_token;
+    const expiresAt = raw.expires_at;
+    if (typeof accessToken !== "string" || !accessToken || typeof refreshToken !== "string" || !refreshToken || typeof expiresAt !== "number" || !expiresAt) {
+      log("[CodexOAuth] Invalid credentials file structure");
+      throw new CodexOAuthLocalError(`The OpenAI Codex credential file (${credPath}) has no usable token pair. Run \`${LOGIN_COMMAND}\` to replace it.`);
+    }
+    const accountId = raw.account_id;
+    const generation = raw.claudish_generation;
+    return {
+      credentials: {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: expiresAt,
+        ...typeof accountId === "string" && accountId ? { account_id: accountId } : {}
+      },
+      generation: typeof generation === "number" ? generation : 0
+    };
+  }
+  saveCredentials(credentials) {
+    const credPath = this.getCredentialsPath();
+    let existing = {};
+    try {
+      if (existsSync18(credPath)) {
+        const parsed = JSON.parse(readFileSync21(credPath, "utf-8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          existing = parsed;
+      }
+    } catch {
+      existing = {};
+    }
+    const previousGeneration = typeof existing.claudish_generation === "number" ? existing.claudish_generation : 0;
+    const document = {
+      ...existing,
+      ...credentials,
+      claudish_generation: previousGeneration + 1
+    };
+    atomicWriteFileSync(credPath, JSON.stringify(document, null, 2), { mode: 384 });
+    log(`[CodexOAuth] Credentials saved to ${credPath}`);
+  }
+  extractAccountId(idToken) {
+    try {
+      const parts = idToken.split(".");
+      if (parts.length !== 3)
+        return;
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+      const authClaim = payload["https://api.openai.com/auth"];
+      const accountId = authClaim?.chatgpt_account_id || payload.chatgpt_account_id || authClaim?.user_id;
+      if (accountId) {
+        log(`[CodexOAuth] Extracted account ID from id_token: ${accountId}`);
+        return accountId;
+      }
+      return;
+    } catch (e) {
+      log(`[CodexOAuth] Failed to extract account ID from id_token: ${e.message}`);
+      return;
+    }
+  }
+}
+function getCodexOAuth() {
+  return CodexOAuth.getInstance();
+}
+var LOGIN_COMMAND = "claudish login codex", CodexOAuthRefreshError, CodexOAuthLocalError, CODEX_EXCHANGE_TIMEOUT_MS;
+var init_codex_oauth = __esm(() => {
+  init_connection_error();
+  init_transient_retry();
+  init_logger();
+  init_test_upstream();
+  init_atomic_write();
+  init_exchange();
+  init_paths();
+  init_refresh_lock();
+  init_types();
+  init_codex_pkce();
+  CodexOAuthRefreshError = class CodexOAuthRefreshError extends Error {
+    terminal = true;
+    upstreamStatus = 401;
+    constructor(message) {
+      super(message);
+      this.name = "CodexOAuthRefreshError";
+    }
+  };
+  CodexOAuthLocalError = class CodexOAuthLocalError extends Error {
+    transient = true;
+    constructor(message) {
+      super(message);
+      this.name = "CodexOAuthLocalError";
+    }
+  };
+  CODEX_EXCHANGE_TIMEOUT_MS = Math.min(TOKEN_REFRESH_TIMEOUT_MS, EXCHANGE_TIMEOUT_MS);
+});
+
 // src/auth/accounts/management.ts
 import { randomBytes as randomBytes8 } from "crypto";
-import { readFileSync as readFileSync21 } from "fs";
+import { accessSync, constants as fsConstants, lstatSync as lstatSync3, readFileSync as readFileSync22 } from "fs";
+function legacyMoveDeferredMessage(outcome, env = process.env) {
+  return `Could not move the existing Codex login into the macOS Keychain (${outcome.reason}: ` + `${redactSecrets(outcome.detail)}). The login was not moved; ${legacyCodexCredentialsPath(env)} was kept. ` + MOVE_HINTS[outcome.reason];
+}
+function moveLegacyCodexLogin(deps = {}, opts = {}) {
+  return new CodexAccountManagement(deps).moveLegacyLogin(opts);
+}
+function codexLoginUsesKeychain(env = process.env) {
+  return !legacyMoveKeychainBlocked(env) && defaultAccountStore(env).kind === "keychain";
+}
+function loginCodexAccount(deps = {}) {
+  return new CodexAccountManagement(deps).loginCodex();
+}
 function codexEntry(raw) {
   const block = raw.subscriptionAccounts;
   return block?.[PROVIDER];
@@ -44649,7 +45390,7 @@ class CodexAccountManagement {
       configPath: () => config,
       legacyCodexPath: () => legacyCodexCredentialsPath(this.env),
       env: this.env,
-      readFile: (path) => path === config ? "{}" : readFileSync21(path, "utf-8")
+      readFile: (path) => path === config ? "{}" : readFileSync22(path, "utf-8")
     });
     return registry.snapshot(PROVIDER).accounts[PROVIDER].find((row) => row.legacy);
   }
@@ -44793,7 +45534,8 @@ class CodexAccountManagement {
     if (command.verb === "add") {
       if (command.label !== undefined)
         validLabel(command.label);
-      return this.add(command.label);
+      await this.moveBeforeMutation();
+      return this.add({ label: command.label });
     }
     if (command.verb === "rename")
       validLabel(command.newLabel);
@@ -44805,6 +45547,8 @@ class CodexAccountManagement {
     }
     if (command.selector !== undefined)
       validSelector(command.selector);
+    if (command.verb !== "remove")
+      await this.moveBeforeMutation();
     const target = this.inspect((entry) => this.select(entry, command));
     if (command.verb === "login")
       return this.login(target);
@@ -44814,10 +45558,14 @@ class CodexAccountManagement {
       return this.remove(target, command);
     return this.setEnabled(target, command.verb === "enable");
   }
-  async add(requestedLabel) {
+  async add(opts = {}) {
+    const requestedLabel = opts.label;
+    const askNotice = opts.notice !== false;
+    const enrollLegacy = opts.enrollLegacy !== false;
+    const rowsFor = (entry) => enrollLegacy ? this.rowsOf(entry) : entry.accounts.map(asRecord);
     const initial = this.inspect((entry) => {
-      const legacy = this.synthesizedLegacy(entry);
-      if (requestedLabel !== undefined && labelTaken(this.rowsOf(entry).map((r) => r.label), requestedLabel)) {
+      const legacy = enrollLegacy ? this.synthesizedLegacy(entry) : undefined;
+      if (requestedLabel !== undefined && labelTaken(rowsFor(entry).map((r) => r.label), requestedLabel)) {
         throw new Error(`A Codex account labelled ${requestedLabel} already exists.`);
       }
       if (legacy && !legacy.identity.chatgptAccountId) {
@@ -44825,7 +45573,7 @@ class CodexAccountManagement {
       }
       return { notice: entry.noticeAcceptedAt, legacy, id: this.newId(entry) };
     });
-    if (!initial.notice && !await this.ask(OWNED_ACCOUNTS_NOTICE)) {
+    if (askNotice && !initial.notice && !await this.ask(OWNED_ACCOUNTS_NOTICE)) {
       return ["Cancelled; no account was added."];
     }
     const acceptedAt = new Date(this.now()).toISOString();
@@ -44850,7 +45598,7 @@ class CodexAccountManagement {
       this.inspect((entry) => {
         if (entry.accounts.some((a) => a.id === row.id))
           throw new Error("The generated account id is taken; retry the add.");
-        const rows = this.rowsOf(entry);
+        const rows = rowsFor(entry);
         this.refuseIdentity(rows, result.identity);
         this.chooseLabel(rows, result.identity, requestedLabel);
       });
@@ -44865,10 +45613,10 @@ class CodexAccountManagement {
           this.fence(holds);
           if (entry.accounts.some((a) => a.id === row.id))
             throw new Error("The generated account id is taken; retry the add.");
-          const rows = this.rowsOf(entry);
+          const rows = rowsFor(entry);
           this.refuseIdentity(rows, result.identity);
           const label = this.chooseLabel(rows, result.identity, requestedLabel);
-          const legacy = rows.find((r) => r.legacy);
+          const legacy = enrollLegacy ? rows.find((r) => r.legacy) : undefined;
           if (legacy) {
             if (legacy.identity.chatgptAccountId !== initial.legacy?.identity.chatgptAccountId) {
               throw new Error("The legacy Codex login changed during the add; retry to confirm its enrollment.");
@@ -44883,7 +45631,8 @@ class CodexAccountManagement {
             });
           }
           entry.accounts.push({ ...row, label });
-          entry.noticeAcceptedAt ??= acceptedAt;
+          if (askNotice)
+            entry.noticeAcceptedAt ??= acceptedAt;
           finalLabel = label;
         });
       } catch (error) {
@@ -44912,8 +45661,10 @@ class CodexAccountManagement {
     }
     throw new Error(`The add's outcome is unresolved: its token item (${store.kind}, id ${record.id}) was kept because the account list could not confirm the row is absent. Run \`claudish account list\`. Cause: ${errorText7(error)}`);
   }
-  async login(target) {
+  async login(target, opts = {}) {
     if (target.legacy) {
+      if (codexLoginUsesKeychain(this.env))
+        return this.loginCodex();
       if (this.deps.legacyLogin)
         await this.deps.legacyLogin();
       else
@@ -44925,7 +45676,7 @@ class CodexAccountManagement {
     const result = await (this.deps.pkce ?? loginCodexPkce)();
     const stable = stableIdentity(result.identity);
     if (target.identity.chatgptAccountId && stable !== target.identity.chatgptAccountId) {
-      throw new Error(`This login is a different Codex identity than ${target.label}; use \`claudish account add codex\` for a different account.`);
+      throw new Error(opts.differentIdentity ?? `This login is a different Codex identity than ${target.label}; use \`claudish account add codex\` for a different account.`);
     }
     await this.gate(target, async (holds) => {
       const validate = (entry) => {
@@ -44982,575 +45733,530 @@ class CodexAccountManagement {
     if (changed)
       await this.invalidate();
     const lines = [
-      `Codex account ${named(target)} ${changed ? "" : "is already "}${enabled ? "enabled" : "disabled"}.`
-    ];
-    if (!enabled) {
-      lines.push("Configured Codex accounts still reserve the subscription: with no enabled account, Codex requests fail visibly instead of using OPENAI_CODEX_API_KEY.");
-    }
-    if (enabled && poolDisabled) {
-      lines.push("The Codex pool itself is disabled in config.json (`enabled: false`); no account is selected.");
-    }
-    return lines;
-  }
-  async rename(target, newLabel) {
-    if (target.legacy) {
-      if (target.label === newLabel) {
-        return [`Codex account ${named(target)} is already labelled ${newLabel}.`];
-      }
-      if (!target.identity.chatgptAccountId) {
-        throw new Error("The legacy Codex login records no account id, so enrolling it cannot be checked for duplicates. Run `claudish login codex` once to refresh it, then retry.");
-      }
-    }
-    let changed = false;
-    await this.gate(target, async (holds) => {
-      changed = mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
-        this.fence(holds);
-        const current = this.resolve(entry, target.legacy ? { label: target.label } : { id: target.id });
-        sameTarget(current, target);
-        if (current.label === newLabel)
-          return;
-        const others = this.rowsOf(entry).filter((row) => row.id !== current.id).map((row) => row.label);
-        if (labelTaken(others, newLabel)) {
-          throw new Error(`A Codex account labelled ${newLabel} already exists.`);
-        }
-        if (current.legacy) {
-          entry.accounts.push({
-            id: this.newId(entry),
-            label: newLabel,
-            identity: current.identity,
-            store: "legacy-codex-file",
-            enabled: true,
-            addedAt: current.addedAt
-          });
-          return;
-        }
-        const row = entry.accounts.find((a) => a.id === target.id);
-        if (row)
-          row.label = newLabel;
-      });
-    });
-    if (changed)
-      await this.invalidate();
-    if (changed && target.legacy) {
-      this.print(`This enrolled your legacy login ${named(target)}${note(target.identity, target.label)} as a configured account, store legacy-codex-file; its credential file stays where it is.`);
-    }
-    return [
-      changed ? `Renamed Codex account ${named(target)} to ${newLabel}.` : `Codex account ${named(target)} is already labelled ${newLabel}.`
-    ];
-  }
-  async remove(target, command) {
-    const legacyFile = target.store === "legacy-codex-file";
-    if (legacyFile && !command.deleteFile) {
-      throw new Error(`${target.label} is the legacy Codex login; removing it deletes its credential file, which needs an explicit --delete-file. A label alone never authorizes that.`);
-    }
-    if (!legacyFile && command.deleteFile) {
-      throw new Error(`--delete-file applies only to the legacy Codex login, not ${target.label}.`);
-    }
-    if (!command.yes && !await this.ask(`Remove Codex account ${named(target)}${note(target.identity, target.label)}${legacyFile ? " and delete its legacy credential file" : ""}? Requests already in flight cannot be recalled.`)) {
-      return ["Cancelled; no account was removed."];
-    }
-    const warnings = [];
-    await this.gate(target, async (holds) => {
-      mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
-        this.fence(holds);
-        const current = this.resolve(entry, target.legacy ? { label: target.label } : { id: target.id });
-        sameTarget(current, target);
-        entry.accounts = entry.accounts.filter((row) => row.id !== target.id);
-        if (legacyFile)
-          entry.legacyCodexSuppressed = true;
-      });
-      await this.invalidate();
-      const state = this.deps.state ?? getStateStore();
-      try {
-        if (!await state.setActive(PROVIDER, target.id, target.id)) {
-          warnings.push("Clearing the active-account pointer is pending; state.json was not written.");
-        }
-      } catch {
-        warnings.push("Clearing the active-account pointer is pending; state.json was not written.");
-      }
-      try {
-        this.fence(holds);
-        await this.store(target.store).delete(target);
-      } catch {
-        warnings.push(`The removal is committed, but deleting ${target.label}'s token item (${target.store}) failed; the account was not restored${legacyFile ? " and the legacy login stays suppressed" : ""}.`);
-      }
-    });
-    const next = this.inspect((entry) => {
-      if (entry.accounts.length > 0) {
-        return entry.enabled === false || entry.accounts.every((row) => row.enabled === false) ? "pool-disabled" : "pool";
-      }
-      return this.synthesizedLegacy(entry) ? "legacy" : "key";
-    });
-    const nextText = {
-      pool: "the remaining Codex accounts",
-      "pool-disabled": "none: Codex accounts remain configured but all are disabled, so requests fail visibly",
-      legacy: "the legacy Codex login",
-      key: "OPENAI_CODEX_API_KEY if one is configured, otherwise none"
-    }[next];
-    return [
-      `Removed Codex account ${named(target)}${note(target.identity, target.label)}. Next Codex credential for new requests: ${nextText}.`,
-      ...next === "key" ? ["Warning: new Codex requests may now use OPENAI_CODEX_API_KEY, billed per token."] : [],
-      ...warnings
-    ];
-  }
-}
-function errorText7(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-var PROVIDER = "openai-codex", OWNED_ACCOUNTS_NOTICE, LEGACY_LOGIN_REFUSED, LEGACY_SAVE_WAIT_MS = 15000;
-var init_management = __esm(() => {
-  init_dist12();
-  init_profile_config();
-  init_codex_pkce();
-  init_account_label();
-  init_config_lock();
-  init_file_lock();
-  init_paths();
-  init_refresh_lock();
-  init_registry();
-  init_state_store();
-  init_token_store();
-  init_types();
-  OWNED_ACCOUNTS_NOTICE = "Add only Codex accounts you own and pay for. Switching between subscriptions may be " + "restricted by OpenAI's terms; this tool is not permission to bypass them. Accept and continue?";
-  LEGACY_LOGIN_REFUSED = "Codex accounts are managed by `claudish account`, or the legacy login was removed. " + "Run `claudish account add codex` for a new account, or " + "`claudish account login codex <label>` to log an existing one in again.";
-});
-
-// src/auth/codex-oauth.ts
-var exports_codex_oauth = {};
-__export(exports_codex_oauth, {
-  CodexOAuth: () => CodexOAuth,
-  getCodexOAuth: () => getCodexOAuth
-});
-import { existsSync as existsSync18, readFileSync as readFileSync22, unlinkSync as unlinkSync6 } from "fs";
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isAbsenceError(e) {
-  const code = e?.code;
-  return code === "ENOENT" || code === "ENOTDIR";
-}
-function errorMessage(e) {
-  return e instanceof Error ? e.message : String(e);
-}
-function credentialFileUnreadable(credPath, detail) {
-  return new CodexOAuthLocalError(`Could not read the OpenAI Codex credential file (${credPath}): ${detail}. ` + `Fix its permissions or contents, or run \`${LOGIN_COMMAND}\` to replace it; ` + "claudish does not fall back to OPENAI_CODEX_API_KEY while this file exists.");
-}
-function asCredentialFileError(e, credPath) {
-  return e instanceof CodexOAuthLocalError ? e : credentialFileUnreadable(credPath, errorMessage(e));
-}
-function describeTokenEndpointError(body, presentedRefreshToken) {
-  let text = "";
-  try {
-    const parsed = JSON.parse(body);
-    const err = parsed?.error;
-    const nested = typeof err === "object" && err !== null ? err : undefined;
-    const code = typeof err === "string" ? err : typeof nested?.code === "string" ? nested.code : undefined;
-    const message = typeof parsed?.error_description === "string" ? parsed.error_description : typeof nested?.message === "string" ? nested.message : undefined;
-    text = [code, message].filter(Boolean).join(": ");
-  } catch {
-    text = body;
-  }
-  if (presentedRefreshToken)
-    text = text.split(presentedRefreshToken).join("[redacted]");
-  text = text.replace(/\s+/g, " ").trim();
-  if (text.length > 200)
-    text = `${text.slice(0, 200)}\u2026`;
-  return text ? ` ${text}` : "";
-}
-function tokenHostUnreachable(e, tokenUrl) {
-  log(`[CodexOAuth] Could not reach ${tokenUrl}: ${errorMessage(e)}`);
-  return Object.assign(new Error(`Could not reach ${tokenUrl} to refresh the Codex token: ${errorMessage(e)}`, {
-    cause: markOwnTimeout(e)
-  }), { claudishEndpoint: tokenUrl });
-}
-
-class CodexOAuth {
-  static instance = null;
-  credentials = null;
-  credentialFileFailure = null;
-  readCredentialText = (path) => readFileSync22(path, "utf-8");
-  refreshPromise = null;
-  tokenRefreshMargin = 5 * 60 * 1000;
-  gateOverrides = {};
-  static _resetInstanceForTests() {
-    const instance = CodexOAuth.instance;
-    if (!instance)
-      return;
-    instance.credentials = null;
-    instance.credentialFileFailure = null;
-    instance.readCredentialText = (path) => readFileSync22(path, "utf-8");
-    instance.refreshPromise = null;
-    instance.tokenRefreshMargin = 5 * 60 * 1000;
-    instance.gateOverrides = {};
-    instance.loadCredentials();
-  }
-  _setRefreshGateOptionsForTests(opts) {
-    this.gateOverrides = { ...opts };
-  }
-  _setCredentialFileReaderForTests(read) {
-    this.readCredentialText = read ?? ((path) => readFileSync22(path, "utf-8"));
-  }
-  static getInstance() {
-    if (!CodexOAuth.instance) {
-      CodexOAuth.instance = new CodexOAuth;
-    }
-    return CodexOAuth.instance;
-  }
-  constructor() {
-    this.loadCredentials();
-  }
-  reloadCredentials() {
-    this.loadCredentials();
-    this.refreshPromise = null;
-  }
-  hasCredentials() {
-    return this.credentials !== null && !!this.credentials.refresh_token || this.credentialFileFailure !== null;
-  }
-  getCredentialsPath() {
-    return legacyCodexCredentialsPath();
-  }
-  getRefreshGatePath() {
-    return this.gateOverrides.path ?? accountLockPath("openai-codex", LEGACY_CODEX_ACCOUNT_ID);
-  }
-  async login(deps = {}) {
-    await Promise.resolve().then(() => init_management());
-    assertLegacyCodexLoginPermitted();
-    const { credentials } = await loginCodexPkce(deps);
-    const accountId = credentials.account_id;
-    await saveLegacyCodexLogin(() => {
-      this.saveCredentials(credentials);
-      this.setCredentials(credentials);
-    });
-    log("[CodexOAuth] Login successful");
-    if (accountId) {
-      log(`[CodexOAuth] Account ID: ${accountId}`);
+      `Codex account ${named(target)} ${changed ? "" : "is already "}${enabled ? "enabled" : "disabled"}.`
+    ];
+    if (!enabled) {
+      lines.push("Configured Codex accounts still reserve the subscription: with no enabled account, Codex requests fail visibly instead of using OPENAI_CODEX_API_KEY.");
     }
-  }
-  async logout() {
-    await Promise.resolve().then(() => init_management());
-    assertLegacyCodexLogoutPermitted();
-    const credPath = this.getCredentialsPath();
-    if (existsSync18(credPath)) {
-      unlinkSync6(credPath);
-      log("[CodexOAuth] Credentials deleted");
+    if (enabled && poolDisabled) {
+      lines.push("The Codex pool itself is disabled in config.json (`enabled: false`); no account is selected.");
     }
-    this.setCredentials(null);
+    return lines;
   }
-  async getAccessToken() {
-    if (this.refreshPromise) {
-      log("[CodexOAuth] Waiting for in-progress refresh");
-      return this.refreshPromise;
+  async rename(target, newLabel) {
+    if (target.legacy) {
+      if (target.label === newLabel) {
+        return [`Codex account ${named(target)} is already labelled ${newLabel}.`];
+      }
+      if (!target.identity.chatgptAccountId) {
+        throw new Error("The legacy Codex login records no account id, so enrolling it cannot be checked for duplicates. Run `claudish login codex` once to refresh it, then retry.");
+      }
     }
-    if (!this.credentials && this.credentialFileFailure) {
-      this.loadCredentials();
-      if (this.credentialFileFailure)
-        throw this.credentialFileFailure;
+    let changed = false;
+    await this.gate(target, async (holds) => {
+      changed = mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
+        this.fence(holds);
+        const current = this.resolve(entry, target.legacy ? { label: target.label } : { id: target.id });
+        sameTarget(current, target);
+        if (current.label === newLabel)
+          return;
+        const others = this.rowsOf(entry).filter((row) => row.id !== current.id).map((row) => row.label);
+        if (labelTaken(others, newLabel)) {
+          throw new Error(`A Codex account labelled ${newLabel} already exists.`);
+        }
+        if (current.legacy) {
+          entry.accounts.push({
+            id: this.newId(entry),
+            label: newLabel,
+            identity: current.identity,
+            store: "legacy-codex-file",
+            enabled: true,
+            addedAt: current.addedAt
+          });
+          return;
+        }
+        const row = entry.accounts.find((a) => a.id === target.id);
+        if (row)
+          row.label = newLabel;
+      });
+    });
+    if (changed)
+      await this.invalidate();
+    if (changed && target.legacy) {
+      this.print(`This enrolled your legacy login ${named(target)}${note(target.identity, target.label)} as a configured account, store legacy-codex-file; its credential file stays where it is.`);
     }
-    if (!this.credentials) {
-      throw new CodexOAuthRefreshError(`No OpenAI Codex OAuth credentials found. Please run \`${LOGIN_COMMAND}\` first.`);
+    return [
+      changed ? `Renamed Codex account ${named(target)} to ${newLabel}.` : `Codex account ${named(target)} is already labelled ${newLabel}.`
+    ];
+  }
+  async remove(target, command) {
+    const legacyFile = target.store === "legacy-codex-file";
+    if (legacyFile && !command.deleteFile) {
+      throw new Error(`${target.label} is the legacy Codex login; removing it deletes its credential file, which needs an explicit --delete-file. A label alone never authorizes that.`);
     }
-    if (this.isTokenValid()) {
-      return this.credentials.access_token;
+    if (!legacyFile && command.deleteFile) {
+      throw new Error(`--delete-file applies only to the legacy Codex login, not ${target.label}.`);
     }
-    return this.startRefresh({ kind: "expiry" });
-  }
-  getAccountId() {
-    return this.credentials?.account_id;
-  }
-  async forceRefresh() {
-    if (this.refreshPromise) {
-      log("[CodexOAuth] Forced refresh joined the in-progress refresh");
-      return this.refreshPromise;
+    if (!command.yes && !await this.ask(`Remove Codex account ${named(target)}${note(target.identity, target.label)}${legacyFile ? " and delete its legacy credential file" : ""}? Requests already in flight cannot be recalled.`)) {
+      return ["Cancelled; no account was removed."];
     }
-    return this.startRefresh({ kind: "forced", rejected: this.credentials?.access_token });
-  }
-  async refreshToken() {
-    await this.forceRefresh();
-  }
-  isTokenValid() {
-    if (!this.credentials)
-      return false;
-    return this.isFresh(this.credentials);
-  }
-  isFresh(credentials) {
-    return Date.now() < credentials.expires_at - this.tokenRefreshMargin;
-  }
-  isAdoptable(onDisk, trigger) {
-    if (!this.isFresh(onDisk))
-      return false;
-    return trigger.kind === "expiry" || onDisk.access_token !== trigger.rejected;
-  }
-  startRefresh(trigger) {
-    const flight = this.refreshUnderGate(trigger).finally(() => {
-      if (this.refreshPromise === flight)
-        this.refreshPromise = null;
-    });
-    this.refreshPromise = flight;
-    return flight;
-  }
-  async refreshUnderGate(trigger) {
-    const before = this.readCredentialFile();
-    try {
-      return await withRefreshGate("openai-codex", LEGACY_CODEX_ACCOUNT_ID, (handle) => this.refreshHoldingGate(trigger, handle), {
-        path: this.getRefreshGatePath(),
-        gen: before?.generation ?? 0,
-        ...this.gateOverrides.deps ? { deps: this.gateOverrides.deps } : {}
+    const warnings = [];
+    await this.gate(target, async (holds) => {
+      mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
+        this.fence(holds);
+        const current = this.resolve(entry, target.legacy ? { label: target.label } : { id: target.id });
+        sameTarget(current, target);
+        entry.accounts = entry.accounts.filter((row) => row.id !== target.id);
+        if (legacyFile)
+          entry.legacyCodexSuppressed = true;
       });
-    } catch (err) {
-      if (!isGateUnavailable(err))
-        throw err;
-      const latest = this.readCredentialFile();
-      if (latest && this.isAdoptable(latest.credentials, trigger)) {
-        log(`[CodexOAuth] Refresh gate unavailable (${err.reason}); the holder already rotated \u2014 using its token`);
-        this.setCredentials(latest.credentials);
-        return latest.credentials.access_token;
+      await this.invalidate();
+      const state = this.deps.state ?? getStateStore();
+      try {
+        if (!await state.setActive(PROVIDER, target.id, target.id)) {
+          warnings.push("Clearing the active-account pointer is pending; state.json was not written.");
+        }
+      } catch {
+        warnings.push("Clearing the active-account pointer is pending; state.json was not written.");
+      }
+      try {
+        this.fence(holds);
+        await this.store(target.store).delete(target);
+      } catch {
+        warnings.push(`The removal is committed, but deleting ${target.label}'s token item (${target.store}) failed; the account was not restored${legacyFile ? " and the legacy login stays suppressed" : ""}.`);
       }
-      log(`[CodexOAuth] Refresh gate unavailable: ${err.message}`);
-      if (err.reason !== "unwritable") {
-        throw credentialHttpError(`Another claudish process is refreshing the OpenAI Codex login (${err.reason}); retrying will usually work.`, 503);
+    });
+    const next = this.inspect((entry) => {
+      if (entry.accounts.length > 0) {
+        return entry.enabled === false || entry.accounts.every((row) => row.enabled === false) ? "pool-disabled" : "pool";
       }
-      throw new CodexOAuthLocalError(`Could not refresh the OpenAI Codex login: the refresh lock could not be created (${err.reason}). Retry the request; if this persists, run \`${LOGIN_COMMAND}\`.`);
-    }
+      return this.synthesizedLegacy(entry) ? "legacy" : "key";
+    });
+    const nextText = {
+      pool: "the remaining Codex accounts",
+      "pool-disabled": "none: Codex accounts remain configured but all are disabled, so requests fail visibly",
+      legacy: "the legacy Codex login",
+      key: "OPENAI_CODEX_API_KEY if one is configured, otherwise none"
+    }[next];
+    return [
+      `Removed Codex account ${named(target)}${note(target.identity, target.label)}. Next Codex credential for new requests: ${nextText}.`,
+      ...next === "key" ? ["Warning: new Codex requests may now use OPENAI_CODEX_API_KEY, billed per token."] : [],
+      ...warnings
+    ];
   }
-  async refreshHoldingGate(trigger, handle) {
-    const onDisk = this.readCredentialFile();
-    if (!onDisk) {
-      throw new CodexOAuthRefreshError(`No OpenAI Codex OAuth credentials found. Please run \`${LOGIN_COMMAND}\` first.`);
-    }
-    if (this.isAdoptable(onDisk.credentials, trigger)) {
-      log("[CodexOAuth] Another process already rotated the token \u2014 using it, no exchange");
-      this.setCredentials(onDisk.credentials);
-      return onDisk.credentials.access_token;
+  async moveBeforeMutation() {
+    const moved = await this.moveLegacyLogin();
+    if (moved.kind === "deferred")
+      throw new Error(legacyMoveDeferredMessage(moved, this.env));
+  }
+  async loginCodex() {
+    await this.moveBeforeMutation();
+    const rows = this.inspect((entry) => entry.accounts.map(asRecord));
+    if (rows.length === 0) {
+      return this.add({ label: LEGACY_CODEX_LABEL, notice: false, enrollLegacy: false });
+    }
+    if (rows.length === 1) {
+      const [row] = rows;
+      const remove = `claudish account remove codex ${shellWord(row.label)}` + (row.store === "legacy-codex-file" ? " --delete-file" : "");
+      return this.login(row, {
+        differentIdentity: `This login is a different Codex identity than ${row.label}. Run \`claudish account add codex\` to add it, or \`${remove}\` and then \`claudish login codex\` to replace it.`
+      });
     }
-    const updated = await this.exchangeRefreshToken(onDisk.credentials);
-    if (!handle.holdsLock()) {
-      throw new CodexOAuthLocalError(`Could not refresh the OpenAI Codex login: the refresh lock was taken over before the new token could be saved. Retry the request; if this persists, run \`${LOGIN_COMMAND}\`.`);
+    throw new Error(`Codex has ${rows.length} accounts; log one in with \`claudish account login codex <label>\`.`);
+  }
+  async moveLegacyLogin(opts = {}) {
+    if (legacyMoveKeychainBlocked(this.env))
+      return notApplicable("no-keychain");
+    const dest = this.deps.newStore?.() ?? defaultAccountStore(this.env);
+    if (dest.kind !== "keychain")
+      return notApplicable("no-keychain");
+    if (!isDefaultConfigPath(this.configPath(), this.env))
+      return notApplicable("alternate-config");
+    let target;
+    try {
+      target = this.inspect((entry) => this.moveTargetOf(entry));
+    } catch (err) {
+      if (this.legacyFileDenied())
+        return this.moveDeferred(err, "file-unreadable");
+      return this.moveDeferred(err, "config-unavailable");
+    }
+    if (target.kind === "none")
+      return notApplicable("no-legacy-account");
+    if (target.kind === "leftover")
+      return this.deleteLeftover();
+    const found = target;
+    let outcome;
+    try {
+      outcome = await this.gate(found.row, (holds) => this.moveHoldingGate(found, dest, holds, opts));
+    } catch (err) {
+      return this.moveDeferred(err, "gate-busy");
     }
-    const current = this.readCredentialFile();
-    if (!current) {
-      log("[CodexOAuth] The credential file was removed during the exchange \u2014 not recreating it");
-      this.setCredentials(null);
-      throw new CodexOAuthRefreshError(`No OpenAI Codex OAuth credentials found. Please run \`${LOGIN_COMMAND}\` first.`);
+    if (outcome.kind === "moved") {
+      log(`[accounts] moved the legacy Codex login into the Keychain as ${outcome.label} (id ${outcome.id})${outcome.fileDeleted ? "" : "; the credential file was kept"}`);
     }
-    if (current.credentials.refresh_token !== onDisk.credentials.refresh_token) {
-      log("[CodexOAuth] The credential file changed during the exchange \u2014 keeping it");
-      this.setCredentials(current.credentials);
-      return current.credentials.access_token;
+    return outcome;
+  }
+  moveTargetOf(entry) {
+    const legacyRow = entry.accounts.find((row) => row.store === "legacy-codex-file");
+    if (legacyRow)
+      return { kind: "row", row: asRecord(legacyRow) };
+    if (entry.accounts.length === 0 && !entry.legacyCodexSuppressed) {
+      const synthesized = this.synthesizedLegacy(entry);
+      return synthesized ? { kind: "synthesized", row: synthesized } : { kind: "none" };
     }
+    if (entry.legacyCodexSuppressed && this.legacyFilePresent())
+      return { kind: "leftover" };
+    return { kind: "none" };
+  }
+  legacyFilePresent() {
     try {
-      this.saveCredentials(updated);
-    } catch (e) {
-      log(`[CodexOAuth] Could not save the refreshed token: ${errorMessage(e)}`);
-      throw new CodexOAuthLocalError(`Could not save the refreshed OpenAI Codex login (${errorMessage(e)}). Run \`${LOGIN_COMMAND}\` to sign in again.`);
+      lstatSync3(legacyCodexCredentialsPath(this.env));
+      return true;
+    } catch (err) {
+      const code = err?.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        log(`[accounts] legacy Codex file check failed: ${redactSecrets(errorText7(err))}`);
+      }
+      return false;
     }
-    this.setCredentials(updated);
-    log(`[CodexOAuth] Token refreshed, valid until ${new Date(updated.expires_at).toISOString()}`);
-    return updated.access_token;
   }
-  async exchangeRefreshToken(from) {
-    log("[CodexOAuth] Refreshing access token");
-    const tokenUrl = resolveUpstreamUrl(CODEX_OAUTH_CONFIG.tokenUrl);
-    let response;
+  legacyFileDenied() {
     try {
-      response = await fetch(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          grant_type: "refresh_token",
-          refresh_token: from.refresh_token,
-          client_id: CODEX_OAUTH_CONFIG.clientId
-        }),
-        signal: AbortSignal.timeout(CODEX_EXCHANGE_TIMEOUT_MS)
-      });
-    } catch (e) {
-      throw tokenHostUnreachable(e, tokenUrl);
+      accessSync(legacyCodexCredentialsPath(this.env), fsConstants.R_OK);
+      return false;
+    } catch (err) {
+      const code = err?.code;
+      return code === "EACCES" || code === "EPERM";
     }
-    if (!response.ok) {
-      const errorText = await response.text().catch(() => "");
-      const detail = describeTokenEndpointError(errorText, from.refresh_token);
-      log(`[CodexOAuth] Refresh failed: HTTP ${response.status}${detail}`);
-      if (response.status === 429 || response.status >= 500 && response.status <= 599) {
-        throw credentialHttpError(`The Codex token host is busy or unavailable (HTTP ${response.status}); retrying will usually work.${detail}`, response.status);
+  }
+  async moveHoldingGate(target, dest, holds, opts) {
+    const hooks = this.deps.moveHooks;
+    const source = this.store("legacy-codex-file");
+    let phase = "config-unavailable";
+    let row = target.row;
+    let material;
+    try {
+      if (target.kind === "synthesized") {
+        const enrolled = this.enrolSynthesizedLegacy(target.row, holds);
+        if (enrolled === "already-moved")
+          return { kind: "already-moved" };
+        if (enrolled === "gone")
+          return notApplicable("no-legacy-account");
+        row = enrolled;
+        await hooks?.afterEnroll?.();
+      }
+      phase = "file-unreadable";
+      const read = await source.read(row, { uncached: true });
+      phase = "config-unavailable";
+      if (!read) {
+        const state = this.inspect((entry) => moveTargetState(entry, row));
+        return state === "moved" ? { kind: "already-moved" } : notApplicable("no-legacy-account");
+      }
+      material = read;
+      const state = this.inspect((entry) => moveTargetState(entry, row));
+      if (state === "moved")
+        return { kind: "already-moved" };
+      if (state === "removed")
+        return notApplicable("no-legacy-account");
+      if (state === "changed") {
+        throw new LegacyMoveDeferredError("target-changed", "the Codex account row changed while the move was pending");
+      }
+      phase = "keychain-unreadable";
+      const existing = await dest.read(row, { uncached: true });
+      const record = {
+        ...material,
+        writeId: randomBytes8(16).toString("hex"),
+        updatedAt: this.now()
+      };
+      const resumed = existing !== null && sameDurableRecord(existing, material);
+      if (!resumed) {
+        phase = "keychain-write-failed";
+        this.fence(holds);
+        await this.persistMovedRecord(dest, row, record);
       }
-      throw new CodexOAuthRefreshError(`OpenAI Codex login expired or was revoked \u2014 run \`${LOGIN_COMMAND}\` to sign in again. (token refresh: HTTP ${response.status}${detail})`);
+      phase = "config-unavailable";
+      await hooks?.beforePublish?.();
+      this.fence(holds);
+      const published = row;
+      mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
+        this.fence(holds);
+        if (moveTargetState(entry, published) !== "same") {
+          throw new LegacyMoveDeferredError("target-changed", "the Codex account row changed while the move was pending");
+        }
+        const current = entry.accounts.find((a) => a.id === published.id);
+        if (current)
+          current.store = dest.kind;
+        entry.legacyCodexSuppressed = true;
+      });
+    } catch (err) {
+      return this.moveDeferred(err, phase);
     }
-    let tokens;
     try {
-      tokens = await response.json();
-    } catch (e) {
-      throw new CodexOAuthRefreshError(`Run \`${LOGIN_COMMAND}\` to sign in again: the Codex token endpoint returned an unreadable body (${errorMessage(e)}). A retry can succeed only if another claudish process already saved a newer token.`);
+      if (opts.trigger === "request")
+        getAccountRegistry().invalidate();
+      else
+        await this.invalidate();
+    } catch (err) {
+      log(`[accounts] legacy Codex move: invalidation failed: ${redactSecrets(errorText7(err))}`);
     }
-    if (typeof tokens?.access_token !== "string" || tokens.access_token.length === 0) {
-      throw new CodexOAuthRefreshError(`Could not refresh the OpenAI Codex login: the token endpoint returned no access token. Retry; if this persists, run \`${LOGIN_COMMAND}\`.`);
+    try {
+      await hooks?.beforeDelete?.();
+    } catch (err) {
+      log(`[accounts] legacy Codex move: stopped before the file delete: ${errorText7(err)}`);
+      return { kind: "moved", id: row.id, label: row.label, fileDeleted: false };
     }
-    const accountId = (tokens.id_token ? this.extractAccountId(tokens.id_token) : undefined) ?? from.account_id;
-    const expiresIn = typeof tokens.expires_in === "number" ? tokens.expires_in : 3600;
-    return {
-      access_token: tokens.access_token,
-      refresh_token: tokens.refresh_token || from.refresh_token,
-      expires_at: Date.now() + expiresIn * 1000,
-      account_id: accountId
-    };
-  }
-  setCredentials(credentials) {
-    this.credentials = credentials;
-    this.credentialFileFailure = null;
+    const fileDeleted = await this.deleteMovedLegacyFile(source, row, material);
+    return { kind: "moved", id: row.id, label: row.label, fileDeleted };
   }
-  loadCredentials() {
-    const outcome = this.classifyCredentialFile();
-    switch (outcome.kind) {
-      case "present":
-        this.setCredentials(outcome.read.credentials);
-        log("[CodexOAuth] Loaded credentials from file");
+  enrolSynthesizedLegacy(expected, holds) {
+    const out = { value: "gone" };
+    mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
+      this.fence(holds);
+      const legacyRow = entry.accounts.find((a) => a.store === "legacy-codex-file");
+      if (legacyRow) {
+        out.value = asRecord(legacyRow);
         return;
-      case "absent":
-        this.setCredentials(null);
+      }
+      if (entry.accounts.length > 0 || entry.legacyCodexSuppressed) {
+        out.value = "already-moved";
         return;
-      case "failed":
-        this.credentials = null;
-        this.credentialFileFailure = outcome.error;
-        log(`[CodexOAuth] Credential file present but unusable \u2014 Codex requests fail until it is fixed: ${outcome.error.message}`);
+      }
+      const current = this.synthesizedLegacy(entry);
+      if (!current)
         return;
-    }
-  }
-  classifyCredentialFile() {
-    let raw;
-    try {
-      raw = this.readRawCredentialFile();
-    } catch (e) {
-      return { kind: "failed", error: asCredentialFileError(e, this.getCredentialsPath()) };
-    }
-    if (raw === null)
-      return { kind: "absent" };
-    if (typeof raw.refresh_token !== "string" || !raw.refresh_token) {
-      log("[CodexOAuth] Credential file names no refresh token \u2014 treating it as no login");
-      return { kind: "absent" };
-    }
-    try {
-      return { kind: "present", read: this.projectCredentialFile(raw) };
-    } catch (e) {
-      return { kind: "failed", error: asCredentialFileError(e, this.getCredentialsPath()) };
-    }
-  }
-  readCredentialFile() {
-    const raw = this.readRawCredentialFile();
-    return raw === null ? null : this.projectCredentialFile(raw);
+      if (current.identity.chatgptAccountId !== expected.identity.chatgptAccountId) {
+        throw new LegacyMoveDeferredError("target-changed", "the legacy Codex login changed while the move was pending");
+      }
+      const row = {
+        id: this.newId(entry),
+        label: current.label,
+        identity: current.identity,
+        store: "legacy-codex-file",
+        enabled: true,
+        addedAt: current.addedAt
+      };
+      entry.accounts.push(row);
+      out.value = asRecord(row);
+    });
+    return out.value;
   }
-  readRawCredentialFile() {
-    const credPath = this.getCredentialsPath();
-    let text;
+  async persistMovedRecord(dest, ref, record) {
+    let ambiguous = false;
     try {
-      text = this.readCredentialText(credPath);
-    } catch (e) {
-      if (isAbsenceError(e))
-        return null;
-      throw credentialFileUnreadable(credPath, errorMessage(e));
+      await dest.write(ref, record);
+    } catch (err) {
+      if (!(err instanceof TokenStoreAmbiguousWriteError)) {
+        throw new LegacyMoveDeferredError("keychain-write-failed", errorText7(err));
+      }
+      ambiguous = true;
+      log("[accounts] legacy Codex move: ambiguous Keychain write, reading it back");
     }
-    let parsed;
+    let proven;
     try {
-      parsed = JSON.parse(text);
-    } catch {
-      throw credentialFileUnreadable(credPath, `it is not valid JSON (${text.length === 0 ? "empty" : "truncated or corrupted"})`);
-    }
-    if (!isRecord2(parsed)) {
-      throw credentialFileUnreadable(credPath, "it is not a JSON object");
+      proven = await dest.read(ref, { uncached: true });
+    } catch (err) {
+      throw new LegacyMoveDeferredError("keychain-unverified", `the Keychain item could not be read back: ${errorText7(err)}`);
     }
-    return parsed;
-  }
-  projectCredentialFile(raw) {
-    const credPath = this.getCredentialsPath();
-    const accessToken = raw.access_token;
-    const refreshToken = raw.refresh_token;
-    const expiresAt = raw.expires_at;
-    if (typeof accessToken !== "string" || !accessToken || typeof refreshToken !== "string" || !refreshToken || typeof expiresAt !== "number" || !expiresAt) {
-      log("[CodexOAuth] Invalid credentials file structure");
-      throw new CodexOAuthLocalError(`The OpenAI Codex credential file (${credPath}) has no usable token pair. Run \`${LOGIN_COMMAND}\` to replace it.`);
+    if (!proven || proven.writeId !== record.writeId || proven.generation !== record.generation || proven.fingerprint !== record.fingerprint) {
+      throw new LegacyMoveDeferredError("keychain-unverified", ambiguous ? "the Keychain write timed out and its read-back does not show it" : "the Keychain read-back does not show this write");
     }
-    const accountId = raw.account_id;
-    const generation = raw.claudish_generation;
-    return {
-      credentials: {
-        access_token: accessToken,
-        refresh_token: refreshToken,
-        expires_at: expiresAt,
-        ...typeof accountId === "string" && accountId ? { account_id: accountId } : {}
-      },
-      generation: typeof generation === "number" ? generation : 0
-    };
   }
-  saveCredentials(credentials) {
-    const credPath = this.getCredentialsPath();
-    let existing = {};
+  async deleteMovedLegacyFile(source, ref, copied) {
     try {
-      if (existsSync18(credPath)) {
-        const parsed = JSON.parse(readFileSync22(credPath, "utf-8"));
-        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
-          existing = parsed;
+      const now = await source.read(ref, { uncached: true });
+      if (!now)
+        return true;
+      if (!sameDurableRecord(now, copied)) {
+        log("[accounts] legacy Codex move: the credential file changed after the copy; kept it (the account list no longer names it)");
+        return false;
       }
-    } catch {
-      existing = {};
+      await source.delete(ref);
+      return true;
+    } catch (err) {
+      log("[accounts] legacy Codex move: could not delete the credential file: " + redactSecrets(errorText7(err)));
+      return false;
     }
-    const previousGeneration = typeof existing.claudish_generation === "number" ? existing.claudish_generation : 0;
-    const document = {
-      ...existing,
-      ...credentials,
-      claudish_generation: previousGeneration + 1
-    };
-    atomicWriteFileSync(credPath, JSON.stringify(document, null, 2), { mode: 384 });
-    log(`[CodexOAuth] Credentials saved to ${credPath}`);
   }
-  extractAccountId(idToken) {
+  async deleteLeftover() {
+    const legacy = {
+      id: LEGACY_CODEX_ACCOUNT_ID,
+      label: LEGACY_CODEX_LABEL,
+      provider: PROVIDER,
+      identity: {},
+      store: "legacy-codex-file",
+      enabled: true,
+      addedAt: "",
+      legacy: true
+    };
     try {
-      const parts = idToken.split(".");
-      if (parts.length !== 3)
-        return;
-      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-      const authClaim = payload["https://api.openai.com/auth"];
-      const accountId = authClaim?.chatgpt_account_id || payload.chatgpt_account_id || authClaim?.user_id;
-      if (accountId) {
-        log(`[CodexOAuth] Extracted account ID from id_token: ${accountId}`);
-        return accountId;
-      }
-      return;
-    } catch (e) {
-      log(`[CodexOAuth] Failed to extract account ID from id_token: ${e.message}`);
-      return;
+      return await this.gate(legacy, async () => {
+        const still = this.inspect((entry) => entry.legacyCodexSuppressed === true && !entry.accounts.some((row) => row.store === "legacy-codex-file") && this.legacyFilePresent());
+        if (!still)
+          return notApplicable("no-legacy-account");
+        await this.store("legacy-codex-file").delete(legacy);
+        log("[accounts] removed the leftover legacy Codex credential file; nothing reads it");
+        return { kind: "leftover-deleted" };
+      });
+    } catch (err) {
+      log(`[accounts] leftover legacy Codex file not removed: ${redactSecrets(errorText7(err))}`);
+      return notApplicable("no-legacy-account");
     }
   }
+  moveDeferred(err, fallback) {
+    const reason = moveDeferralOf(err, fallback);
+    const detail = redactSecrets(errorText7(err));
+    log(`[accounts] legacy Codex move deferred (${reason}): ${detail}`);
+    return { kind: "deferred", reason, detail };
+  }
 }
-function getCodexOAuth() {
-  return CodexOAuth.getInstance();
+function notApplicable(reason) {
+  return { kind: "not-applicable", reason };
 }
-var LOGIN_COMMAND = "claudish login codex", CodexOAuthRefreshError, CodexOAuthLocalError, CODEX_EXCHANGE_TIMEOUT_MS;
-var init_codex_oauth = __esm(() => {
-  init_connection_error();
-  init_transient_retry();
+function moveTargetState(entry, row) {
+  const current = entry.accounts.find((a) => a.id === row.id);
+  if (!current)
+    return "removed";
+  if (current.identity?.chatgptAccountId !== row.identity.chatgptAccountId)
+    return "changed";
+  if (current.store !== "legacy-codex-file")
+    return "moved";
+  return "same";
+}
+function moveDeferralOf(err, fallback) {
+  if (err instanceof LegacyMoveDeferredError)
+    return err.reason;
+  if (err instanceof AccountListUnavailableError && err.failure?.source === "legacy") {
+    return "file-unreadable";
+  }
+  if (err instanceof RefreshUnavailableError)
+    return "gate-busy";
+  return fallback;
+}
+function errorText7(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var PROVIDER = "openai-codex", OWNED_ACCOUNTS_NOTICE, LEGACY_LOGIN_REFUSED, LEGACY_SAVE_WAIT_MS = 15000, LegacyMoveDeferredError, MOVE_HINTS;
+var init_management = __esm(() => {
+  init_dist12();
   init_logger();
-  init_test_upstream();
-  init_atomic_write();
-  init_exchange();
+  init_profile_config();
+  init_redact();
+  init_codex_pkce();
+  init_account_label();
+  init_config_lock();
+  init_file_lock();
+  init_legacy_move();
   init_paths();
   init_refresh_lock();
+  init_registry();
+  init_state_store();
+  init_token_store();
   init_types();
-  init_codex_pkce();
-  CodexOAuthRefreshError = class CodexOAuthRefreshError extends Error {
-    terminal = true;
-    upstreamStatus = 401;
-    constructor(message) {
-      super(message);
-      this.name = "CodexOAuthRefreshError";
+  OWNED_ACCOUNTS_NOTICE = "Add only Codex accounts you own and pay for. Switching between subscriptions may be " + "restricted by OpenAI's terms; this tool is not permission to bypass them. Accept and continue?";
+  LEGACY_LOGIN_REFUSED = "Codex accounts are managed by `claudish account`, or the legacy login was removed. " + "Run `claudish account add codex` for a new account, or " + "`claudish account login codex <label>` to log an existing one in again.";
+  LegacyMoveDeferredError = class LegacyMoveDeferredError extends Error {
+    reason;
+    constructor(reason, detail) {
+      super(detail);
+      this.reason = reason;
+      this.name = "LegacyMoveDeferredError";
     }
   };
-  CodexOAuthLocalError = class CodexOAuthLocalError extends Error {
-    transient = true;
-    constructor(message) {
-      super(message);
-      this.name = "CodexOAuthLocalError";
-    }
+  MOVE_HINTS = {
+    "gate-busy": "Retry in a moment.",
+    "config-unavailable": "Retry in a moment; if this persists, repair config.json.",
+    "target-changed": "Retry in a moment.",
+    "file-unreadable": "Repair or remove the file, then retry.",
+    "keychain-unreadable": "Unlock the login keychain and retry.",
+    "keychain-write-failed": "Unlock the login keychain and retry.",
+    "keychain-unverified": "Unlock the login keychain and retry."
   };
-  CODEX_EXCHANGE_TIMEOUT_MS = Math.min(TOKEN_REFRESH_TIMEOUT_MS, EXCHANGE_TIMEOUT_MS);
+});
+
+// src/auth/accounts/legacy-move.ts
+import { lstatSync as lstatSync4, realpathSync as realpathSync3 } from "fs";
+import { join as join22, resolve as resolve2 } from "path";
+function legacyMoveKeychainBlocked(env = process.env) {
+  return env.CLAUDISH_DISABLE_KEYCHAIN === "1" || !isKeychainSupported();
+}
+function canonical(path) {
+  try {
+    return realpathSync3(path);
+  } catch {
+    return resolve2(path);
+  }
+}
+function isDefaultConfigPath(configPath, env = process.env) {
+  return canonical(configPath) === canonical(join22(claudishHome(env), "config.json"));
+}
+function legacyMoveApplies(env, configPath, registry) {
+  if (legacyMoveKeychainBlocked(env))
+    return false;
+  let due;
+  try {
+    const snapshot = registry.snapshot("openai-codex");
+    const rows = snapshot.accounts["openai-codex"];
+    const legacyRow = rows.some((row) => row.legacy || row.store === "legacy-codex-file");
+    due = legacyRow || snapshot.settings["openai-codex"]?.legacyCodexSuppressed === true && legacyFileExists(env);
+  } catch {
+    return false;
+  }
+  if (!due || !isDefaultConfigPath(configPath, env))
+    return false;
+  return defaultAccountStore(env).kind === "keychain";
+}
+function legacyFileExists(env) {
+  try {
+    lstatSync4(legacyCodexCredentialsPath(env));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function startLegacyCodexMove(opts = {}) {
+  try {
+    if (inFlight2)
+      return;
+    const now = opts.now ?? Date.now;
+    if (now() < cooldownUntil)
+      return;
+    const env = opts.env ?? process.env;
+    const configPath = (opts.configPath ?? activeConfigFile)();
+    if (!legacyMoveApplies(env, configPath, opts.registry ?? getAccountRegistry()))
+      return;
+    const move = (async () => {
+      await Promise.resolve().then(() => init_management());
+      return moveLegacyCodexLogin({ env, configPath: () => configPath, ...opts.management }, { trigger: "request" });
+    })().catch((err) => ({
+      kind: "deferred",
+      reason: "config-unavailable",
+      detail: redactSecrets(err instanceof Error ? err.message : String(err))
+    })).then((outcome) => {
+      log(`[accounts] legacy Codex move (request path): ${outcome.kind}`);
+      if (outcome.kind === "deferred" || outcome.kind === "not-applicable") {
+        cooldownUntil = now() + LEGACY_MOVE_RETRY_MS;
+      }
+      return outcome;
+    }).finally(() => {
+      if (inFlight2 === move)
+        inFlight2 = null;
+    });
+    inFlight2 = move;
+    lastMove = move;
+  } catch (err) {
+    log(`[accounts] legacy Codex move not started: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+var LEGACY_MOVE_RETRY_MS, inFlight2 = null, lastMove = null, cooldownUntil = 0;
+var init_legacy_move = __esm(() => {
+  init_logger();
+  init_profile_config();
+  init_keychain();
+  init_redact();
+  init_paths();
+  init_registry();
+  init_token_store();
+  LEGACY_MOVE_RETRY_MS = 10 * 60 * 1000;
 });
 
 // src/auth/credentials/composite-credential.ts
@@ -45654,6 +46360,9 @@ class CodexOAuthHalf {
   }
   async getRequestAuth(ctx) {
     if (ctx.requireOAuth && !this.oauth.hasCredentials()) {
+      const why = await this.oauth.missingLoginError();
+      if (why instanceof CodexOAuthLocalError)
+        throw why;
       throw new MeteredEscapeError("Codex OAuth login disappeared during this request");
     }
     const token = ctx.forceRefresh ? await this.oauth.forceRefresh() : await this.oauth.getAccessToken();
@@ -45693,6 +46402,7 @@ class CodexPoolHalf {
     return this.registry.hasConfiguredAccounts("openai-codex");
   }
   async getRequestAuth(ctx) {
+    startLegacyCodexMove();
     if (!ctx.pin && this.registry.isSynthesizedLegacyOnly()) {
       return this.legacy.getRequestAuth(ctx);
     }
@@ -45733,6 +46443,7 @@ var CODEX_RESPONSES_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses"
 var init_codex_credential = __esm(() => {
   init_test_upstream();
   init_errors3();
+  init_legacy_move();
   init_pool();
   init_registry();
   init_codex_oauth();
@@ -45743,9 +46454,9 @@ var init_codex_credential = __esm(() => {
 // src/providers/devin/devin-credentials.ts
 import { readFileSync as readFileSync23 } from "fs";
 import { homedir as homedir22 } from "os";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function devinCredentialsPath() {
-  return credentialsPathOverride ?? join22(homedir22(), ".local", "share", "devin", "credentials.toml");
+  return credentialsPathOverride ?? join23(homedir22(), ".local", "share", "devin", "credentials.toml");
 }
 function readTomlString(source, key) {
   const match = source.match(new RegExp(`^\\s*${key}\\s*=\\s*"([^"]*)"`, "m"));
@@ -45885,13 +46596,13 @@ import {
   writeSync as writeSync6
 } from "fs";
 import { homedir as homedir23, hostname as hostname3, platform, release as release2 } from "os";
-import { dirname as dirname12, join as join23 } from "path";
+import { dirname as dirname12, join as join24 } from "path";
 import { promisify as promisify4 } from "util";
 function kimiOAuthPath() {
-  return kimiOAuthPathOverride ?? join23(homedir23(), ".claudish", "kimi-oauth.json");
+  return kimiOAuthPathOverride ?? join24(homedir23(), ".claudish", "kimi-oauth.json");
 }
 function kimiDeviceIdPath() {
-  return kimiDeviceIdPathOverride ?? join23(homedir23(), ".claudish", "kimi-device-id");
+  return kimiDeviceIdPathOverride ?? join24(homedir23(), ".claudish", "kimi-device-id");
 }
 function isKimiCredentials(data) {
   if (!data || typeof data !== "object")
@@ -46236,7 +46947,7 @@ var init_kimi_oauth = __esm(() => {
 // src/auth/oauth-registry.ts
 import { existsSync as existsSync20, readFileSync as readFileSync25 } from "fs";
 import { homedir as homedir24 } from "os";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function credentialSatisfies(descriptor, data) {
   if (!data?.access_token)
     return false;
@@ -46249,7 +46960,7 @@ function credentialSatisfies(descriptor, data) {
   return true;
 }
 function hasValidOAuthCredentials(descriptor) {
-  const credPath = join24(homedir24(), ".claudish", descriptor.credentialFile);
+  const credPath = join25(homedir24(), ".claudish", descriptor.credentialFile);
   if (!existsSync20(credPath))
     return false;
   if (descriptor.validationMode === "file-exists") {
@@ -46265,10 +46976,18 @@ function hasOAuthCredentials(providerName) {
   const descriptor = OAUTH_PROVIDERS[providerName];
   if (!descriptor)
     return false;
+  if (providerName === "openai-codex") {
+    try {
+      return getAccountRegistry().hasConfiguredAccounts("openai-codex");
+    } catch {
+      return false;
+    }
+  }
   return hasValidOAuthCredentials(descriptor);
 }
 var OAUTH_PROVIDERS;
 var init_oauth_registry = __esm(() => {
+  init_registry();
   OAUTH_PROVIDERS = {
     "kimi-coding": {
       credentialFile: "kimi-oauth.json",
@@ -46442,12 +47161,12 @@ import {
   writeFileSync as writeFileSync9
 } from "fs";
 import { homedir as homedir25 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function defaultMuseStoreDir() {
-  return join25(homedir25(), ".claudish");
+  return join26(homedir25(), ".claudish");
 }
 function museStorePath(kind, dir = defaultMuseStoreDir()) {
-  return join25(dir, FILE_NAMES[kind]);
+  return join26(dir, FILE_NAMES[kind]);
 }
 function isValidMuseStore(value) {
   if (!value || typeof value !== "object")
@@ -46502,7 +47221,7 @@ var init_muse_store = __esm(() => {
 
 // src/providers/meta-muse/muse-keychain.ts
 import { mkdirSync as mkdirSync14, readFileSync as readFileSync27, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync10 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function processExists(pid) {
   try {
     process.kill(pid, 0);
@@ -46515,7 +47234,7 @@ function resetMuseKeychainState() {
   keychainEpoch++;
   retainedToken = null;
   lateResult = null;
-  inFlight2 = null;
+  inFlight3 = null;
 }
 function disabled() {
   return deps2.env().CLAUDISH_DISABLE_KEYCHAIN === "1";
@@ -46552,7 +47271,7 @@ function parseMuseKeychainValue(value) {
   }
 }
 function lockPath2() {
-  return join26(deps2.dir(), LOCK_FILE);
+  return join27(deps2.dir(), LOCK_FILE);
 }
 function readLock() {
   let mtime;
@@ -46639,8 +47358,8 @@ async function withMuseKeychainLogin(use, deadlineMs = MUSE_KEYCHAIN_READ_DEADLI
       lateResult = null;
       return settle(result, use);
     }
-    if (inFlight2)
-      return raceJoin(inFlight2, deadline, use);
+    if (inFlight3)
+      return raceJoin(inFlight3, deadline, use);
     if (deps2.now() >= deadline)
       return { kind: "timeout" };
     const lock = readLock();
@@ -46679,7 +47398,7 @@ async function withMuseKeychainLogin(use, deadlineMs = MUSE_KEYCHAIN_READ_DEADLI
     const done = spawn.done.finally(() => {
       rewriteLock(deps2.pid(), "claudish");
     });
-    inFlight2 = done;
+    inFlight3 = done;
     inFlightEpoch = keychainEpoch;
     return raceJoin(done, deadline, use);
   }
@@ -46696,16 +47415,16 @@ async function raceJoin(done, deadline, use) {
   if (winner === "timeout") {
     const startedIn = inFlightEpoch;
     done.then((result) => {
-      if (inFlight2 === done)
-        inFlight2 = null;
+      if (inFlight3 === done)
+        inFlight3 = null;
       if (startedIn === keychainEpoch)
         lateResult = result;
       releaseLock();
     });
     return { kind: "timeout" };
   }
-  if (inFlight2 === done)
-    inFlight2 = null;
+  if (inFlight3 === done)
+    inFlight3 = null;
   try {
     return await settle(winner, use);
   } finally {
@@ -46750,7 +47469,7 @@ async function waitForLockThenCopy(deadline, sinceMtime) {
     await deps2.sleep(Math.min(LOCK_POLL_MS, Math.max(0, deadline - deps2.now())));
   }
 }
-var MUSE_KEYCHAIN_SERVICE = "ai.meta.dev.credentials", MUSE_KEYCHAIN_ACCOUNT = "meta", LOCK_FILE = "muse-keychain-read.lock", PRESENCE_TTL_MS = 3000, LOCK_POLL_MS = 500, LOCK_MAX_AGE_MS, UNREADABLE_LOCK_GRACE_MS = 5000, MUSE_KEYCHAIN_READ_DEADLINE_MS = 120000, defaultDeps4, deps2, presenceMemo = null, inFlight2 = null, lateResult = null, keychainEpoch = 0, inFlightEpoch = 0, holdsLock = false, retainedToken = null;
+var MUSE_KEYCHAIN_SERVICE = "ai.meta.dev.credentials", MUSE_KEYCHAIN_ACCOUNT = "meta", LOCK_FILE = "muse-keychain-read.lock", PRESENCE_TTL_MS = 3000, LOCK_POLL_MS = 500, LOCK_MAX_AGE_MS, UNREADABLE_LOCK_GRACE_MS = 5000, MUSE_KEYCHAIN_READ_DEADLINE_MS = 120000, defaultDeps4, deps2, presenceMemo = null, inFlight3 = null, lateResult = null, keychainEpoch = 0, inFlightEpoch = 0, holdsLock = false, retainedToken = null;
 var init_muse_keychain = __esm(() => {
   init_prompt_role();
   init_keychain();
@@ -50314,7 +51033,7 @@ var init_vision_proxy = __esm(() => {
 
 // src/mcp-session/home-dir.ts
 import { homedir as homedir27 } from "os";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 function userHomeFrom(env, homedirFn = homedir27) {
   const home = env.HOME;
   return home && home.length > 0 ? home : homedirFn();
@@ -50323,7 +51042,7 @@ function sessionsDirFrom(env, homedirFn = homedir27) {
   const explicit = env.CLAUDISH_SESSIONS_DIR;
   if (explicit && explicit.length > 0)
     return explicit;
-  return join27(userHomeFrom(env, homedirFn), ".claudish", "sessions");
+  return join28(userHomeFrom(env, homedirFn), ".claudish", "sessions");
 }
 function claudeCodeStringHash(s) {
   let h = 0;
@@ -50498,7 +51217,7 @@ var init_transcript_tailer = () => {};
 // src/session-events/index.ts
 import { existsSync as existsSync22, readFileSync as readFileSync28, readdirSync as readdirSync3 } from "fs";
 import { homedir as homedir28 } from "os";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function extractSessionId2(metadata) {
   const userId = metadata?.user_id;
   if (typeof userId !== "string")
@@ -50523,7 +51242,7 @@ class SessionEventRegistry {
   claudeHome;
   pollIntervalMs;
   constructor(opts = {}) {
-    this.claudeHome = opts.claudeHome ?? join28(homedir28(), ".claude");
+    this.claudeHome = opts.claudeHome ?? join29(homedir28(), ".claude");
     this.pollIntervalMs = opts.pollIntervalMs;
   }
   ensureSession(sessionId) {
@@ -50609,13 +51328,13 @@ class SessionEventRegistry {
     }
   }
   locateTranscript(sessionId) {
-    const projectsDir = join28(this.claudeHome, "projects");
-    const primary = join28(projectsDir, slugFromCwd(process.cwd()), `${sessionId}.jsonl`);
+    const projectsDir = join29(this.claudeHome, "projects");
+    const primary = join29(projectsDir, slugFromCwd(process.cwd()), `${sessionId}.jsonl`);
     if (existsSync22(primary))
       return primary;
     try {
       for (const dir of readdirSync3(projectsDir)) {
-        const candidate = join28(projectsDir, dir, `${sessionId}.jsonl`);
+        const candidate = join29(projectsDir, dir, `${sessionId}.jsonl`);
         if (existsSync22(candidate))
           return candidate;
       }
@@ -50624,7 +51343,7 @@ class SessionEventRegistry {
   }
   readSettingsEffortLevel() {
     try {
-      const settings = JSON.parse(readFileSync28(join28(this.claudeHome, "settings.json"), "utf-8"));
+      const settings = JSON.parse(readFileSync28(join29(this.claudeHome, "settings.json"), "utf-8"));
       return typeof settings.effortLevel === "string" ? settings.effortLevel : undefined;
     } catch {
       return;
@@ -50735,7 +51454,7 @@ import {
   writeFileSync as writeFileSync11
 } from "fs";
 import { homedir as homedir29 } from "os";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function ensureDir() {
   if (!existsSync23(CLAUDISH_DIR)) {
     mkdirSync15(CLAUDISH_DIR, { recursive: true });
@@ -50770,7 +51489,7 @@ function writeToDisk(events) {
     ensureDir();
     const trimmed = enforceSizeCap([...events]);
     const payload = { version: 1, events: trimmed };
-    const tmpFile = join29(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
+    const tmpFile = join30(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
     writeFileSync11(tmpFile, JSON.stringify(payload, null, 2), "utf-8");
     renameSync8(tmpFile, BUFFER_FILE);
     memoryCache = trimmed;
@@ -50843,8 +51562,8 @@ function syncFlushOnExit() {
 var BUFFER_MAX_BYTES, CLAUDISH_DIR, BUFFER_FILE, memoryCache = null, eventsSinceLastFlush = 0, flushScheduled = false, SIGNAL_EXIT_CODE;
 var init_stats_buffer = __esm(() => {
   BUFFER_MAX_BYTES = 64 * 1024;
-  CLAUDISH_DIR = join29(homedir29(), ".claudish");
-  BUFFER_FILE = join29(CLAUDISH_DIR, "stats-buffer.json");
+  CLAUDISH_DIR = join30(homedir29(), ".claudish");
+  BUFFER_FILE = join30(CLAUDISH_DIR, "stats-buffer.json");
   process.on("exit", syncFlushOnExit);
   SIGNAL_EXIT_CODE = { SIGTERM: 143, SIGINT: 130 };
   for (const signal of ["SIGTERM", "SIGINT"]) {
@@ -54891,7 +55610,7 @@ var init_openai_responses_sse = __esm(() => {
 });
 
 // src/session/token-file.ts
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function assignedTokenFile(env) {
   const f = env.CLAUDISH_TOKEN_FILE;
   if (!f || f === env.CLAUDISH_PUBLISHED_TOKEN_FILE)
@@ -54899,7 +55618,7 @@ function assignedTokenFile(env) {
   return f;
 }
 function resolveTokenFilePath(port, env = process.env) {
-  return assignedTokenFile(env) ?? join30(userHomeFrom(env), ".claudish", `tokens-${port}.json`);
+  return assignedTokenFile(env) ?? join31(userHomeFrom(env), ".claudish", `tokens-${port}.json`);
 }
 var init_token_file = __esm(() => {
   init_home_dir();
@@ -57340,9 +58059,9 @@ var init_composed_handler = __esm(() => {
 // src/providers/api-key-provenance.ts
 import { existsSync as existsSync24, readFileSync as readFileSync30 } from "fs";
 import { homedir as homedir30 } from "os";
-import { join as join31, resolve as resolve2 } from "path";
+import { join as join32, resolve as resolve3 } from "path";
 function activeConfigPath() {
-  return activeGlobalConfigFile(join31(homedir30(), ".claudish", "config.json"));
+  return activeGlobalConfigFile(join32(homedir30(), ".claudish", "config.json"));
 }
 function configLayerLabel() {
   return getConfigFileOverride() ? activeConfigPath() : "~/.claudish/config.json";
@@ -57360,7 +58079,7 @@ function resolveApiKeyProvenance(envVar, aliases) {
   const allVars = [envVar, ...aliases || []];
   const dotenvValue = readDotenvKey(allVars);
   layers.push({
-    source: `.env (${resolve2(".env")})`,
+    source: `.env (${resolve3(".env")})`,
     maskedValue: maskKey(dotenvValue),
     isActive: false
   });
@@ -57466,7 +58185,7 @@ function formatProvenanceLog(p) {
 }
 function readDotenvKey(envVars) {
   try {
-    const dotenvPath = resolve2(".env");
+    const dotenvPath = resolve3(".env");
     if (!existsSync24(dotenvPath))
       return null;
     const parsed = readAllowedDotenv(readFileSync30(dotenvPath, "utf-8"));
@@ -71181,7 +71900,7 @@ function compareByConnectionPrice(a, b) {
 // src/providers/probe-catalog.ts
 import { existsSync as existsSync25, mkdirSync as mkdirSync17, readFileSync as readFileSync31, writeFileSync as writeFileSync13 } from "fs";
 import { homedir as homedir31 } from "os";
-import { dirname as dirname14, join as join32 } from "path";
+import { dirname as dirname14, join as join33 } from "path";
 function describeProbeCatalogFailure(outcome) {
   switch (outcome.kind) {
     case "incompatible":
@@ -71352,7 +72071,7 @@ var PROBE_MODELS_URL = "https://us-central1-claudish-6da10.cloudfunctions.net/pr
 var init_probe_catalog = __esm(() => {
   init_catalog_route_bindings();
   CACHE_TTL_MS4 = 60 * 60 * 1000;
-  PROBE_MODELS_CACHE_PATH = join32(homedir31(), ".claudish", "probe-models.json");
+  PROBE_MODELS_CACHE_PATH = join33(homedir31(), ".claudish", "probe-models.json");
 });
 
 // src/providers/route-candidates.ts
@@ -73369,7 +74088,7 @@ var init_slot_row = __esm(() => {
 
 // src/pane/prompt-delivery.ts
 import { writeFileSync as writeFileSync14 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 function stripControl(s) {
   let out = "";
   for (const ch of s) {
@@ -73436,7 +74155,7 @@ function renderTurnFile(text, limit = READ_LINE_LIMIT) {
 `), lines: out.length, marker };
 }
 function turnFilePath(turnDir, turnIndex) {
-  return join33(turnDir, `turn-${turnIndex}.md`);
+  return join34(turnDir, `turn-${turnIndex}.md`);
 }
 function fileTemplate(file, marker) {
   const base = `Your task is in the file \`${file}\`. Read all of it with the Read tool (in parts if it is long), then do exactly what it says, treating its content as the user's message.`;
@@ -73517,12 +74236,12 @@ var init_prompt_delivery = __esm(() => {
 
 // src/team-stats.ts
 import { existsSync as existsSync26, readFileSync as readFileSync32, writeFileSync as writeFileSync15 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function statsDir(sessionPath) {
-  return join34(sessionPath, "stats");
+  return join35(sessionPath, "stats");
 }
 function tokenFileFor(sessionPath, anonId) {
-  return join34(statsDir(sessionPath), `${anonId}.json`);
+  return join35(statsDir(sessionPath), `${anonId}.json`);
 }
 function readTokenStatsAt(path) {
   if (!existsSync26(path))
@@ -73685,7 +74404,7 @@ ${segs.join(" \xB7 ")}`;
 }
 function writeStatusFile(sessionPath, manifest, status, opts) {
   try {
-    writeFileSync15(join34(sessionPath, "status.txt"), `${renderTeamStats(sessionPath, manifest, status, opts)}
+    writeFileSync15(join35(sessionPath, "status.txt"), `${renderTeamStats(sessionPath, manifest, status, opts)}
 `, "utf-8");
   } catch {}
 }
@@ -73928,7 +74647,7 @@ var init_effort_recommendations = __esm(() => {
 // src/model-loader.ts
 import { existsSync as existsSync27, readFileSync as readFileSync34 } from "fs";
 import { homedir as homedir32 } from "os";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 function isRecommendationTier(value) {
   return typeof value === "string" && RECOMMENDATION_TIER_INDEX.has(value);
 }
@@ -74509,7 +75228,7 @@ var init_model_loader = __esm(() => {
   ];
   RECOMMENDATION_TIER_INDEX = new Map(RECOMMENDATION_SECTIONS.map((section, index) => [section.recommendationTier, index]));
   FIREBASE_RECOMMENDED_URL = `${FIREBASE_BASE_URL}?catalog=recommended`;
-  RECOMMENDED_MODELS_CACHE_PATH = join35(homedir32(), ".claudish", "recommended-models-cache-v2.json");
+  RECOMMENDED_MODELS_CACHE_PATH = join36(homedir32(), ".claudish", "recommended-models-cache-v2.json");
   RECOMMENDED_ROUTE_TIER_ORDER = {
     native: 0,
     general: 1,
@@ -75807,7 +76526,7 @@ var init_DiscoveryNotice = __esm(() => {
 // src/providers/model-descriptions.ts
 import { existsSync as existsSync28, mkdirSync as mkdirSync18, readFileSync as readFileSync35, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir33 } from "os";
-import { dirname as dirname15, join as join36 } from "path";
+import { dirname as dirname15, join as join37 } from "path";
 function emptyDescriptionIndex() {
   return EMPTY_INDEX;
 }
@@ -75900,7 +76619,7 @@ var init_model_descriptions = __esm(() => {
   init_logger();
   init_model_loader();
   init_cache_ttl();
-  MODEL_DESCRIPTIONS_CACHE_PATH = join36(homedir33(), ".claudish", "model-descriptions.json");
+  MODEL_DESCRIPTIONS_CACHE_PATH = join37(homedir33(), ".claudish", "model-descriptions.json");
   EMPTY_INDEX = { get: () => {
     return;
   }, size: 0 };
@@ -82233,22 +82952,22 @@ var init_branding = __esm(() => {
 // src/update-checker.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync19, readFileSync as readFileSync36, unlinkSync as unlinkSync9, writeFileSync as writeFileSync17 } from "fs";
 import { homedir as homedir34, platform as platform2, tmpdir } from "os";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 function getCacheFilePath() {
   let cacheDir;
   if (isWindows) {
-    const localAppData = process.env.LOCALAPPDATA || join37(homedir34(), "AppData", "Local");
-    cacheDir = join37(localAppData, "claudish");
+    const localAppData = process.env.LOCALAPPDATA || join38(homedir34(), "AppData", "Local");
+    cacheDir = join38(localAppData, "claudish");
   } else {
-    cacheDir = join37(homedir34(), ".cache", "claudish");
+    cacheDir = join38(homedir34(), ".cache", "claudish");
   }
   try {
     if (!existsSync29(cacheDir)) {
       mkdirSync19(cacheDir, { recursive: true });
     }
-    return join37(cacheDir, "update-check.json");
+    return join38(cacheDir, "update-check.json");
   } catch {
-    return join37(tmpdir(), "claudish-update-check.json");
+    return join38(tmpdir(), "claudish-update-check.json");
   }
 }
 function readCache2() {
@@ -88575,7 +89294,7 @@ var init_response_seam = __esm(() => {
 // src/services/pricing-cache.ts
 import { existsSync as existsSync30, readFileSync as readFileSync37, statSync as statSync13 } from "fs";
 import { homedir as homedir35 } from "os";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 function prefixMatch(modelName) {
   for (const [key, pricing] of pricingMap) {
     if (modelName.startsWith(key))
@@ -88635,14 +89354,14 @@ var init_pricing_cache = __esm(() => {
   init_logger();
   init_catalog_query();
   pricingMap = new Map;
-  CACHE_DIR = join38(homedir35(), ".claudish");
-  CACHE_FILE = join38(CACHE_DIR, "pricing-cache.json");
+  CACHE_DIR = join39(homedir35(), ".claudish");
+  CACHE_FILE = join39(CACHE_DIR, "pricing-cache.json");
   CACHE_TTL_MS5 = 24 * 60 * 60 * 1000;
 });
 
 // src/proxy-server.ts
 import { appendFileSync as appendFileSync6, mkdirSync as mkdirSync20 } from "fs";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 function isTerminalRoutingFailure(e) {
   return e instanceof RoutingError;
 }
@@ -88650,7 +89369,7 @@ function maybeCaptureClassifierRequest(c, body) {
   if (!process.env.CLAUDISH_CLASSIFIER_DEBUG)
     return;
   try {
-    const dir = join39(process.cwd(), "logs");
+    const dir = join40(process.cwd(), "logs");
     if (!classifierCaptureDirReady) {
       mkdirSync20(dir, { recursive: true });
       classifierCaptureDirReady = true;
@@ -88675,7 +89394,7 @@ function maybeCaptureClassifierRequest(c, body) {
         "x-api-key": c.req.header("x-api-key") ? "<present>" : null
       }
     };
-    appendFileSync6(join39(dir, "classifier-capture.jsonl"), `${JSON.stringify(record)}
+    appendFileSync6(join40(dir, "classifier-capture.jsonl"), `${JSON.stringify(record)}
 `);
   } catch {}
 }
@@ -89210,13 +89929,13 @@ import {
   unlinkSync as unlinkSync10
 } from "fs";
 import { homedir as homedir36 } from "os";
-import { dirname as dirname16, join as join40 } from "path";
+import { dirname as dirname16, join as join41 } from "path";
 import { fileURLToPath } from "url";
 function getVersion3() {
   return VERSION;
 }
 function clearAllModelCaches() {
-  const cacheDir = join40(homedir36(), ".claudish");
+  const cacheDir = join41(homedir36(), ".claudish");
   if (!existsSync31(cacheDir))
     return;
   const cachePatterns = ["pricing-cache.json", "recommended-models-cache-v2.json"];
@@ -89225,7 +89944,7 @@ function clearAllModelCaches() {
     const files = readdirSync4(cacheDir);
     for (const file of files) {
       if (cachePatterns.includes(file)) {
-        unlinkSync10(join40(cacheDir, file));
+        unlinkSync10(join41(cacheDir, file));
         cleared++;
       }
     }
@@ -90745,7 +91464,7 @@ ${h("MORE INFO")}
 }
 function printAIAgentGuide() {
   try {
-    const guidePath = join40(__dirname2, "../AI_AGENT_GUIDE.md");
+    const guidePath = join41(__dirname2, "../AI_AGENT_GUIDE.md");
     const guideContent = readFileSync38(guidePath, "utf-8");
     console.log(guideContent);
   } catch (error) {
@@ -90762,10 +91481,10 @@ async function initializeClaudishSkill() {
   console.log(`\uD83D\uDD27 Initializing Claudish skill in current project...
 `);
   const cwd = process.cwd();
-  const claudeDir = join40(cwd, ".claude");
-  const skillsDir = join40(claudeDir, "skills");
-  const claudishSkillDir = join40(skillsDir, "claudish-usage");
-  const skillFile = join40(claudishSkillDir, "SKILL.md");
+  const claudeDir = join41(cwd, ".claude");
+  const skillsDir = join41(claudeDir, "skills");
+  const claudishSkillDir = join41(skillsDir, "claudish-usage");
+  const skillFile = join41(claudishSkillDir, "SKILL.md");
   if (existsSync31(skillFile)) {
     console.log("\u2705 Claudish skill already installed at:");
     console.log(`   ${skillFile}
@@ -90773,7 +91492,7 @@ async function initializeClaudishSkill() {
     console.log("\uD83D\uDCA1 To reinstall, delete the file and run 'claudish --init' again.");
     return;
   }
-  const sourceSkillPath = join40(__dirname2, "../skills/claudish-usage/SKILL.md");
+  const sourceSkillPath = join41(__dirname2, "../skills/claudish-usage/SKILL.md");
   if (!existsSync31(sourceSkillPath)) {
     console.error("\u274C Error: Claudish skill file not found in installation.");
     console.error(`   Expected at: ${sourceSkillPath}`);
@@ -90969,16 +91688,16 @@ var init_cli = __esm(() => {
 // src/launcher/magmux-binary.ts
 import { execSync } from "child_process";
 import { existsSync as existsSync32 } from "fs";
-import { dirname as dirname17, join as join41 } from "path";
+import { dirname as dirname17, join as join42 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function findMagmuxBinaryOrNull() {
   const thisFile = fileURLToPath2(import.meta.url);
   const thisDir = dirname17(thisFile);
-  const pkgRoots = [join41(thisDir, ".."), join41(thisDir, "..", "..")];
+  const pkgRoots = [join42(thisDir, ".."), join42(thisDir, "..", "..")];
   const platform = process.platform;
   const arch = process.arch;
   for (const pkgRoot of pkgRoots) {
-    const bundled = join41(pkgRoot, "native", `magmux-${platform}-${arch}`);
+    const bundled = join42(pkgRoot, "native", `magmux-${platform}-${arch}`);
     if (existsSync32(bundled))
       return bundled;
   }
@@ -90986,7 +91705,7 @@ function findMagmuxBinaryOrNull() {
     const pkgName = `@claudish/magmux-${platform}-${arch}`;
     let searchDir = pkgRoots[0];
     for (let i = 0;i < 5; i++) {
-      const candidate = join41(searchDir, "node_modules", pkgName, "bin", "magmux");
+      const candidate = join42(searchDir, "node_modules", pkgName, "bin", "magmux");
       if (existsSync32(candidate))
         return candidate;
       const parent = dirname17(searchDir);
@@ -91023,7 +91742,7 @@ import {
   writeFileSync as writeFileSync18
 } from "fs";
 import { connect as netConnect } from "net";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 function envDeltas(parentEnv, childEnv) {
   const set = [];
   const unset = [];
@@ -91089,9 +91808,9 @@ function planMagmuxWrap(input) {
   const controlSocket = `/tmp/magmux-${id}.sock`;
   const tmpRoot = input.tmpRoot ?? "/tmp";
   mkdirSync22(tmpRoot, { recursive: true });
-  const scriptDir = mkdtempSync(join42(tmpRoot, "claudish-launch-"));
+  const scriptDir = mkdtempSync(join43(tmpRoot, "claudish-launch-"));
   chmodSync3(scriptDir, 448);
-  const scriptPath = join42(scriptDir, "claude-launch.sh");
+  const scriptPath = join43(scriptDir, "claude-launch.sh");
   const parentEnv = input.parentEnv ?? process.env;
   const deltas = envDeltas(parentEnv, input.childEnv);
   const fd = openSync10(scriptPath, "wx", 384);
@@ -91236,8 +91955,8 @@ var DEFAULT_PANE_COLS = 160, DEFAULT_PANE_ROWS = 50, MIN_PANE_COLS = 40, MAX_PAN
 
 // src/pane/process-identity.ts
 import { execFile as execFile2, execFileSync as execFileSync2 } from "child_process";
-import { lstatSync as lstatSync3 } from "fs";
-import { basename as basename2, dirname as dirname18, join as join43 } from "path";
+import { lstatSync as lstatSync5 } from "fs";
+import { basename as basename2, dirname as dirname18, join as join44 } from "path";
 function collapse(s) {
   return s.trim().replace(/\s+/g, " ");
 }
@@ -91447,7 +92166,7 @@ function isLaunchDirPath(root, p) {
   if (dirname18(p) !== root || !LAUNCH_DIR_RE.test(basename2(p)))
     return false;
   try {
-    const st = lstatSync3(p);
+    const st = lstatSync5(p);
     return st.isDirectory() && !st.isSymbolicLink();
   } catch {
     return false;
@@ -91457,16 +92176,16 @@ function isValidPaneId(id) {
   return PANE_ID_RE.test(id) && !/^\d+$/.test(id);
 }
 function sockPathOf(root, paneId) {
-  return join43(root, `magmux-${paneId}.sock`);
+  return join44(root, `magmux-${paneId}.sock`);
 }
 function recordPathOf(root, paneId) {
-  return join43(root, "panes", `${paneId}.json`);
+  return join44(root, "panes", `${paneId}.json`);
 }
 function isPaneSockPath(root, p, paneId) {
   return isValidPaneId(paneId) && dirname18(p) === root && basename2(p) === `magmux-${paneId}.sock`;
 }
 function isPaneRecordPath(root, p, paneId) {
-  return isValidPaneId(paneId) && dirname18(p) === join43(root, "panes") && basename2(p) === `${paneId}.json`;
+  return isValidPaneId(paneId) && dirname18(p) === join44(root, "panes") && basename2(p) === `${paneId}.json`;
 }
 function watcherArgv(a) {
   return [
@@ -91572,17 +92291,17 @@ var init_process_identity = __esm(() => {
 // src/pane/pane-launch.ts
 import { execFile as execFile3, spawn } from "child_process";
 import { randomBytes as randomBytes12 } from "crypto";
-import { chmodSync as chmodSync4, lstatSync as lstatSync4, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync19 } from "fs";
-import { join as join44, resolve as resolve3 } from "path";
+import { chmodSync as chmodSync4, lstatSync as lstatSync6, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync19 } from "fs";
+import { join as join45, resolve as resolve4 } from "path";
 function uid() {
   return typeof process.getuid === "function" ? process.getuid() : 0;
 }
 function sockRootFor(env = process.env) {
   const override = env[ENV.CLAUDISH_PANE_ROOT]?.trim();
-  return override ? resolve3(override) : `/tmp/claudish-mux-${uid()}`;
+  return override ? resolve4(override) : `/tmp/claudish-mux-${uid()}`;
 }
 function assertPrivateDir(p) {
-  const st = lstatSync4(p);
+  const st = lstatSync6(p);
   if (st.isSymbolicLink() || !st.isDirectory())
     throw new PaneRootError(`pane socket root ${p} is not a real directory`);
   if (st.uid !== uid())
@@ -91591,7 +92310,7 @@ function assertPrivateDir(p) {
     throw new PaneRootError(`pane socket root ${p} has mode ${(st.mode & 511).toString(8)}; it must be 0700`);
 }
 function ensureSockRoot(given = sockRootFor()) {
-  const root = resolve3(given);
+  const root = resolve4(given);
   try {
     mkdirSync23(root, { mode: 448 });
   } catch (e) {
@@ -91601,7 +92320,7 @@ function ensureSockRoot(given = sockRootFor()) {
       throw e;
   }
   assertPrivateDir(root);
-  const panes = join44(root, "panes");
+  const panes = join45(root, "panes");
   try {
     mkdirSync23(panes, { mode: 448 });
   } catch (e) {
@@ -91655,7 +92374,7 @@ function buildPaneEnv(input) {
   if ((input.platform ?? process.platform) === "linux" && entryBytes > LINUX_ENV_STRING_LIMIT)
     throw new PaneEnvTooLargeError(`pane environment snapshot is ${entryBytes} bytes, over Linux's 131072-byte limit per variable`);
   env[ENV.CLAUDISH_PANE_ENV] = json;
-  env.SHELL = join44(input.ctlDir, "sh-shim");
+  env.SHELL = join45(input.ctlDir, "sh-shim");
   return { magmuxEnv: env };
 }
 function buildClaudishPaneArgv(spawnModel, sessionUuid, turnDir, callerFlags) {
@@ -91865,21 +92584,21 @@ exec ${words}
 `;
 }
 function paneCommand(ctlDir) {
-  const cmd = `. ${shq2(join44(ctlDir, "pane-launch.sh"))}`;
+  const cmd = `. ${shq2(join45(ctlDir, "pane-launch.sh"))}`;
   if (/claude /.test(cmd) || /claude$/.test(cmd) || /(^|\/)claude['"]?$/.test(cmd))
     throw new Error(`pane command would attach magmux's Claude Code controller: ${cmd}`);
   return cmd;
 }
 function createLaunchDirs(root) {
-  const ctlDir = mkdtempSync2(join44(root, "launch-"));
+  const ctlDir = mkdtempSync2(join45(root, "launch-"));
   chmodSync4(ctlDir, 448);
-  const turnDir = mkdtempSync2(join44(root, "launch-"));
+  const turnDir = mkdtempSync2(join45(root, "launch-"));
   chmodSync4(turnDir, 448);
   return { ctlDir, turnDir };
 }
 function writeLauncherFiles(ctlDir, script) {
-  writeFileSync19(join44(ctlDir, "pane-launch.sh"), script, { mode: 384, flag: "wx" });
-  writeFileSync19(join44(ctlDir, "sh-shim"), SHELL_SHIM, { mode: 448, flag: "wx" });
+  writeFileSync19(join45(ctlDir, "pane-launch.sh"), script, { mode: 384, flag: "wx" });
+  writeFileSync19(join45(ctlDir, "sh-shim"), SHELL_SHIM, { mode: 448, flag: "wx" });
 }
 function spawnPaneWatcher(args) {
   const proc = spawn("/bin/sh", watcherArgv(args), {
@@ -91902,7 +92621,7 @@ function paneMagmuxArgv(input) {
     "--session-id",
     input.sessionUuid,
     "--transcript",
-    resolve3(input.transcriptPath),
+    resolve4(input.transcriptPath),
     "--id",
     input.paneId,
     "--sock-dir",
@@ -92281,9 +93000,9 @@ var init_magmux_client = __esm(() => {
 // src/pane/pane-registry.ts
 import {
   constants as constants3,
-  accessSync,
+  accessSync as accessSync2,
   existsSync as existsSync34,
-  lstatSync as lstatSync5,
+  lstatSync as lstatSync7,
   readFileSync as readFileSync39,
   readdirSync as readdirSync5,
   renameSync as renameSync9,
@@ -92291,7 +93010,7 @@ import {
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync20
 } from "fs";
-import { join as join45 } from "path";
+import { join as join46 } from "path";
 function ownerStartOfSelf() {
   if (ownStart)
     return ownStart;
@@ -92312,7 +93031,7 @@ function ownerAlive(owner, table) {
   return !minted || startedAt(row, minted.startMs);
 }
 function recordsDir(root) {
-  return join45(root, "panes");
+  return join46(root, "panes");
 }
 function writeRecord(root, rec) {
   const p = recordPathOf(root, rec.paneId);
@@ -92382,13 +93101,13 @@ function readRecords(root) {
 }
 function readGroupFile(ctlDir) {
   try {
-    return parseGroupFile(readFileSync39(join45(ctlDir, "group"), "utf8"));
+    return parseGroupFile(readFileSync39(join46(ctlDir, "group"), "utf8"));
   } catch {
     return null;
   }
 }
 function writeGroupFile(ctlDir, snap) {
-  const p = join45(ctlDir, "group");
+  const p = join46(ctlDir, "group");
   const tmp = `${p}.tmp`;
   try {
     writeFileSync20(tmp, formatGroupFile(snap), { mode: 384 });
@@ -92620,14 +93339,14 @@ function dialErrno(reported, sockPath) {
     return reported;
   let isSocket;
   try {
-    isSocket = lstatSync5(sockPath).isSocket();
+    isSocket = lstatSync7(sockPath).isSocket();
   } catch (e) {
     return e.code ?? "unknown";
   }
   if (!isSocket)
     return "ENOTSOCK";
   try {
-    accessSync(sockPath, constants3.W_OK);
+    accessSync2(sockPath, constants3.W_OK);
   } catch {
     return "EACCES";
   }
@@ -92665,7 +93384,7 @@ async function sweepRecordlessSocket(root, name, out) {
   const owner = ownerOfSocketId(id);
   if (!owner || ownerAlive(owner, table))
     return;
-  const sockPath = join45(root, name);
+  const sockPath = join46(root, name);
   const magmuxMayLive = !table || table.some((r) => isPaneMagmuxCommand(r.command, id));
   const probe = await probeSocket(sockPath, magmuxMayLive);
   if (probe.state === "stale") {
@@ -92835,7 +93554,7 @@ var init_queue = __esm(() => {
 
 // src/mcp-session/parent-session.ts
 import { readFile as readFile7 } from "fs/promises";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 function positiveInt(value) {
   if (value === undefined || !/^[1-9][0-9]*$/.test(value))
     return;
@@ -92859,11 +93578,11 @@ function parentSessionIdFrom(env) {
 }
 function claudeConfigDir(env) {
   const fromEnv = env.CLAUDE_CONFIG_DIR;
-  return fromEnv && fromEnv.length > 0 ? fromEnv : join46(userHomeFrom(env), ".claude");
+  return fromEnv && fromEnv.length > 0 ? fromEnv : join47(userHomeFrom(env), ".claude");
 }
 async function readHostSessionRecord(opts) {
   try {
-    const raw = await readFile7(join46(opts.configDir, "sessions", `${opts.hostPid}.json`), "utf-8");
+    const raw = await readFile7(join47(opts.configDir, "sessions", `${opts.hostPid}.json`), "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object")
       return;
@@ -93213,15 +93932,15 @@ var init_input_gate = __esm(() => {
 });
 
 // src/pane/gate-binding.ts
-import { realpathSync as realpathSync3 } from "fs";
-import { basename as basename3, dirname as dirname19, join as join47, resolve as resolve4 } from "path";
+import { realpathSync as realpathSync4 } from "fs";
+import { basename as basename3, dirname as dirname19, join as join48, resolve as resolve5 } from "path";
 function normaliseTranscriptPath(p) {
-  const abs = resolve4(p);
+  const abs = resolve5(p);
   const tail = [];
   let cur = abs;
   for (;; ) {
     try {
-      return tail.length ? join47(realpathSync3(cur), ...tail.reverse()) : realpathSync3(cur);
+      return tail.length ? join48(realpathSync4(cur), ...tail.reverse()) : realpathSync4(cur);
     } catch {
       const parent = dirname19(cur);
       if (parent === cur)
@@ -93635,7 +94354,7 @@ var init_scroll_input = __esm(() => {
 
 // src/pane/session-registry.ts
 import { readFileSync as readFileSync40, readdirSync as readdirSync6 } from "fs";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 function parseRegistryRecord(raw) {
   let parsed;
   try {
@@ -93680,7 +94399,7 @@ class SessionRegistry {
   isAlive;
   constructor(o) {
     this.o = o;
-    this.dir = join48(o.configDir, "sessions");
+    this.dir = join49(o.configDir, "sessions");
     this.now = o.now ?? Date.now;
     this.isAlive = o.isAlive ?? pidAlive;
   }
@@ -93716,7 +94435,7 @@ class SessionRegistry {
   readPid(pid) {
     let raw;
     try {
-      raw = readFileSync40(join48(this.dir, `${pid}.json`), "utf8");
+      raw = readFileSync40(join49(this.dir, `${pid}.json`), "utf8");
     } catch {
       return null;
     }
@@ -94018,10 +94737,10 @@ import {
   openSync as openSync11,
   readSync as readSync4,
   readdirSync as readdirSync7,
-  realpathSync as realpathSync4,
+  realpathSync as realpathSync5,
   statSync as statSync14
 } from "fs";
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 function initialFollowerState(resolvePath = safeRealpath) {
   return {
     turns: [],
@@ -94037,7 +94756,7 @@ function initialFollowerState(resolvePath = safeRealpath) {
 }
 function safeRealpath(p) {
   try {
-    return realpathSync4(p);
+    return realpathSync5(p);
   } catch {
     return p;
   }
@@ -94595,7 +95314,7 @@ class TranscriptFollower {
     for (const f of this.subagentFiles()) {
       let tail = this.subs.get(f);
       if (!tail) {
-        tail = new Tail(join49(this.subagentsDir, f));
+        tail = new Tail(join50(this.subagentsDir, f));
         this.subs.set(f, tail);
       }
       for (const { line } of tail.read()) {
@@ -94694,8 +95413,8 @@ var init_transcript_follower = __esm(() => {
 });
 
 // src/pane/pane-session.ts
-import { readFileSync as readFileSync41, realpathSync as realpathSync5, rmSync as rmSync11, statSync as statSync15, writeFileSync as writeFileSync21 } from "fs";
-import { join as join50 } from "path";
+import { readFileSync as readFileSync41, realpathSync as realpathSync6, rmSync as rmSync11, statSync as statSync15, writeFileSync as writeFileSync21 } from "fs";
+import { join as join51 } from "path";
 function iso3(ms) {
   return new Date(ms).toISOString();
 }
@@ -94847,7 +95566,7 @@ class PaneSessionImpl {
     });
     this.secondaryQuietMs = o.timings?.secondaryQuietMs ?? SECONDARY_QUIET_MS;
     this.corroborationMs = o.timings?.corroborationMs ?? CORROBORATION_MS;
-    this.follower = new TranscriptFollower(o.transcriptPath, join50(o.transcriptPath.replace(/\.jsonl$/, ""), "subagents"));
+    this.follower = new TranscriptFollower(o.transcriptPath, join51(o.transcriptPath.replace(/\.jsonl$/, ""), "subagents"));
     this.registry = new SessionRegistry({
       configDir: claudeConfigDir(o.parentEnv ?? process.env),
       sessionUuid: o.sessionUuid
@@ -94894,7 +95613,7 @@ class PaneSessionImpl {
       return this.spawnFailed(new Error("magmux did not start"));
     this.magmux = proc;
     try {
-      writeFileSync21(join50(this.ctlDir, "magmux.pid"), `${proc.pid}
+      writeFileSync21(join51(this.ctlDir, "magmux.pid"), `${proc.pid}
 `, { mode: 384 });
     } catch {}
     updateRecord(this.root, this.paneId, { magmuxPid: proc.pid });
@@ -97345,7 +98064,7 @@ function preparePane(o, root, parentEnv) {
   try {
     const paneId = mintPaneId(o.kind, o.label);
     const sockPath = sockPathOf(root, paneId);
-    const cwd = realpathSync5(o.cwd);
+    const cwd = realpathSync6(o.cwd);
     const launch = o.claudishSpawn ?? resolveClaudishLaunch(parentEnv);
     dirs = createLaunchDirs(root);
     const argv = buildClaudishPaneArgv(o.spawnModel, o.sessionUuid, dirs.turnDir, o.callerFlags);
@@ -97893,15 +98612,15 @@ import {
   constants as constants4,
   closeSync as closeSync12,
   fstatSync as fstatSync5,
-  lstatSync as lstatSync6,
+  lstatSync as lstatSync8,
   openSync as openSync12,
   readSync as readSync5,
   readdirSync as readdirSync8,
   readlinkSync,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   statSync as statSync16
 } from "fs";
-import { basename as basename4, dirname as dirname20, join as join51, sep } from "path";
+import { basename as basename4, dirname as dirname20, join as join52, sep } from "path";
 function isUuid(v) {
   return typeof v === "string" && UUID_RE.test(v);
 }
@@ -98051,7 +98770,7 @@ function locateTranscriptByUuid(projectsRoot, uuid) {
   }
   let hit = null;
   for (const d of dirs) {
-    const p = join51(projectsRoot, d, `${uuid}.jsonl`);
+    const p = join52(projectsRoot, d, `${uuid}.jsonl`);
     try {
       if (!statSync16(p).isFile())
         continue;
@@ -98113,8 +98832,8 @@ function openContainedTranscript(path, uuid, projectsRoot) {
   let real;
   let root;
   try {
-    real = realpathSync6(path);
-    root = realpathSync6(projectsRoot);
+    real = realpathSync7(path);
+    root = realpathSync7(projectsRoot);
   } catch (e) {
     if (!isEnoent(e))
       logRejection(path, errText(e));
@@ -98142,8 +98861,8 @@ function openContainedTranscript(path, uuid, projectsRoot) {
       return null;
     }
     const parent = dirname20(real);
-    const named = lstatSync6(real);
-    if (realpathSync6(parent) !== parent || !named.isFile() || named.dev !== st.dev || named.ino !== st.ino || !kernelPathMatches(fd, real)) {
+    const named = lstatSync8(real);
+    if (realpathSync7(parent) !== parent || !named.isFile() || named.dev !== st.dev || named.ino !== st.ino || !kernelPathMatches(fd, real)) {
       logRejection(path, "the opened file is not the one under the projects directory");
       closeQuietly(fd);
       return null;
@@ -98275,10 +98994,10 @@ __export(exports_session_discovery, {
   transcriptPathFor: () => transcriptPathFor
 });
 import { execFile as execFile4, execFileSync as execFileSync3 } from "child_process";
-import { closeSync as closeSync13, openSync as openSync13, readSync as readSync6, readdirSync as readdirSync9, realpathSync as realpathSync7, statSync as statSync17 } from "fs";
-import { basename as basename5, join as join52 } from "path";
+import { closeSync as closeSync13, openSync as openSync13, readSync as readSync6, readdirSync as readdirSync9, realpathSync as realpathSync8, statSync as statSync17 } from "fs";
+import { basename as basename5, join as join53 } from "path";
 function projectsDir(env = process.env) {
-  return join52(claudeConfigDir(env), "projects");
+  return join53(claudeConfigDir(env), "projects");
 }
 function slugForPath(absPath) {
   return projectDirNameFor(absPath);
@@ -98286,9 +99005,9 @@ function slugForPath(absPath) {
 function transcriptPathFor(cwd, sessionUuid, projectsRoot = projectsDir()) {
   let real = cwd;
   try {
-    real = realpathSync7(cwd);
+    real = realpathSync8(cwd);
   } catch {}
-  return join52(projectsRoot, slugForPath(real), `${sessionUuid}.jsonl`);
+  return join53(projectsRoot, slugForPath(real), `${sessionUuid}.jsonl`);
 }
 function isAgentSession(row) {
   return row.entrypoint !== undefined && row.entrypoint !== "cli";
@@ -98335,7 +99054,7 @@ function projectDirs() {
   }
 }
 function sessionsIn2(dirName) {
-  const dir = join52(projectsDir(), dirName);
+  const dir = join53(projectsDir(), dirName);
   let names;
   try {
     names = readdirSync9(dir).filter((n) => n.endsWith(".jsonl"));
@@ -98344,7 +99063,7 @@ function sessionsIn2(dirName) {
   }
   const rows = [];
   for (const n of names) {
-    const file = join52(dir, n);
+    const file = join53(dir, n);
     try {
       const st = statSync17(file);
       if (st.size === 0)
@@ -98723,16 +99442,16 @@ var init_session_discovery = __esm(() => {
 import { randomBytes as randomBytes13, randomUUID as randomUUID8 } from "crypto";
 import {
   existsSync as existsSync36,
-  lstatSync as lstatSync7,
+  lstatSync as lstatSync9,
   mkdirSync as mkdirSync24,
   readFileSync as readFileSync42,
   readdirSync as readdirSync10,
-  realpathSync as realpathSync8,
+  realpathSync as realpathSync9,
   rmSync as rmSync12,
   statSync as statSync18,
   writeFileSync as writeFileSync22
 } from "fs";
-import { basename as basename6, dirname as dirname21, join as join53, resolve as resolve5, sep as sep2 } from "path";
+import { basename as basename6, dirname as dirname21, join as join54, resolve as resolve6, sep as sep2 } from "path";
 function slotTerminal(e) {
   if (!e.session)
     return true;
@@ -98769,13 +99488,13 @@ function addressRun(path, runId) {
   pruneRuns();
   if (runId) {
     const run = teamRuns.get(runId) ?? null;
-    if (run && path !== undefined && resolve5(path) !== run.path)
+    if (run && path !== undefined && resolve6(path) !== run.path)
       return null;
     return run;
   }
   if (path === undefined)
     return null;
-  const id = newestRunByPath.get(resolve5(path));
+  const id = newestRunByPath.get(resolve6(path));
   return id ? teamRuns.get(id) ?? null : null;
 }
 function activeRunAt(path) {
@@ -98801,7 +99520,7 @@ function notableAnomalies(snap) {
   return snap.anomalies.filter((a) => a.startsWith("background_shell_open") || a.startsWith("turn_end_record_missing") || a.startsWith("agent_count_mismatch") || a.startsWith("prompt_not_read"));
 }
 function upstreamLogPath(path, id) {
-  return join53(path, "errors", `${id}-upstream.jsonl`);
+  return join54(path, "errors", `${id}-upstream.jsonl`);
 }
 function neverSpawnedRow(e, m) {
   return {
@@ -98910,14 +99629,14 @@ function teamRunRowFromDisk(path, status) {
 }
 function statusMtimeMs(path) {
   try {
-    return statSync18(join53(path, "status.json")).mtimeMs;
+    return statSync18(join54(path, "status.json")).mtimeMs;
   } catch {
     return null;
   }
 }
 function readManifestOrNull(path) {
   try {
-    return JSON.parse(readFileSync42(join53(path, "manifest.json"), "utf-8"));
+    return JSON.parse(readFileSync42(join54(path, "manifest.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -99016,7 +99735,7 @@ function transcriptTeamSlot(path, slot, since, runId, opts = {}) {
   }
   if (path === undefined)
     throw unknownRun(path, runId);
-  const resolved = resolve5(path);
+  const resolved = resolve6(path);
   let status;
   try {
     status = getStatus(resolved);
@@ -99177,13 +99896,13 @@ function answerFailureDetail(v, answer, requirePattern, outcomes) {
 function readWrittenFile(path, root) {
   let realRoot;
   try {
-    realRoot = realpathSync8(root);
+    realRoot = realpathSync9(root);
   } catch {
-    realRoot = resolve5(root);
+    realRoot = resolve6(root);
   }
   let real;
   try {
-    real = realpathSync8(resolve5(root, path));
+    real = realpathSync9(resolve6(root, path));
   } catch {
     return { skip: "missing" };
   }
@@ -99237,13 +99956,13 @@ function persistErrorLog(errorLogPath, header, sections) {
   } catch {}
 }
 function validateSessionPath(sessionPath) {
-  const resolved = resolve5(sessionPath);
+  const resolved = resolve6(sessionPath);
   const outside = () => new Error(`Session path must be within current directory: ${sessionPath}`);
   let existing = resolved;
   const tail = [];
   for (;; ) {
     try {
-      lstatSync7(existing);
+      lstatSync9(existing);
       break;
     } catch {
       const parent = dirname21(existing);
@@ -99255,18 +99974,18 @@ function validateSessionPath(sessionPath) {
   }
   let real;
   try {
-    real = join53(realpathSync8(existing), ...tail);
+    real = join54(realpathSync9(existing), ...tail);
   } catch {
     throw outside();
   }
-  const cwd = realpathSync8(process.cwd());
+  const cwd = realpathSync9(process.cwd());
   if (real !== cwd && !real.startsWith(cwd + sep2)) {
     throw outside();
   }
   return resolved;
 }
 function readTeamInputFile(inputPath) {
-  const resolved = resolve5(inputPath);
+  const resolved = resolve6(inputPath);
   const cwd = process.cwd();
   if (!resolved.startsWith(`${cwd}/`) && resolved !== cwd) {
     throw new Error(`Input file must be within current directory: ${inputPath}`);
@@ -99284,14 +100003,14 @@ function setupSession(sessionPath, models, input) {
   if (models.length === 0) {
     throw new Error("At least one model is required");
   }
-  if (existsSync36(join53(sessionPath, "manifest.json"))) {
+  if (existsSync36(join54(sessionPath, "manifest.json"))) {
     throw new Error(`Session already exists at ${sessionPath}. Use a new directory path or delete the existing session first.`);
   }
-  mkdirSync24(join53(sessionPath, "work"), { recursive: true });
-  mkdirSync24(join53(sessionPath, "errors"), { recursive: true });
+  mkdirSync24(join54(sessionPath, "work"), { recursive: true });
+  mkdirSync24(join54(sessionPath, "errors"), { recursive: true });
   if (input !== undefined) {
-    writeFileSync22(join53(sessionPath, "input.md"), input, "utf-8");
-  } else if (!existsSync36(join53(sessionPath, "input.md"))) {
+    writeFileSync22(join54(sessionPath, "input.md"), input, "utf-8");
+  } else if (!existsSync36(join54(sessionPath, "input.md"))) {
     throw new Error(`No input.md found at ${sessionPath} and no input provided`);
   }
   const ids = models.map((_, i) => String(i + 1).padStart(2, "0"));
@@ -99308,9 +100027,9 @@ function setupSession(sessionPath, models, input) {
       model: models[i],
       assignedAt: now
     };
-    mkdirSync24(join53(sessionPath, "work", anonId), { recursive: true });
+    mkdirSync24(join54(sessionPath, "work", anonId), { recursive: true });
   }
-  writeFileSync22(join53(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+  writeFileSync22(join54(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
   const status = {
     startedAt: now,
     models: Object.fromEntries(Object.keys(manifest.models).map((id) => [
@@ -99325,7 +100044,7 @@ function setupSession(sessionPath, models, input) {
       }
     ]))
   };
-  writeFileAtomic(join53(sessionPath, "status.json"), JSON.stringify(status, null, 2));
+  writeFileAtomic(join54(sessionPath, "status.json"), JSON.stringify(status, null, 2));
   return manifest;
 }
 function assertValidRequirePattern(pattern) {
@@ -99353,7 +100072,7 @@ async function preflightTeamRun(opts) {
       throw new Error(`invalid_args: ${refusal}`);
   }
   await assertMagmuxAvailable();
-  assertNoActiveRun(resolve5(opts.path));
+  assertNoActiveRun(resolve6(opts.path));
   const root = sockRootFor(opts.parentEnv ?? process.env);
   const live = livePaneCount(root);
   if (live + opts.slots > MAX_LIVE_PANES)
@@ -99385,10 +100104,10 @@ async function startModelsIn(flight, sessionPath, opts) {
   if (!flagCheck.ok)
     throw new Error(`invalid_args: ${flagCheck.message}`);
   const agentRequested = requestedAgentOf(claudeFlags);
-  const path = resolve5(sessionPath);
-  const manifest = JSON.parse(readFileSync42(join53(path, "manifest.json"), "utf-8"));
-  const statusPath = join53(path, "status.json");
-  const inputContent = readFileSync42(join53(path, "input.md"), "utf-8");
+  const path = resolve6(sessionPath);
+  const manifest = JSON.parse(readFileSync42(join54(path, "manifest.json"), "utf-8"));
+  const statusPath = join54(path, "status.json");
+  const inputContent = readFileSync42(join54(path, "input.md"), "utf-8");
   const readAvailable = !flagsRemoveRead(claudeFlags);
   const refusal = deliveryRefusal(inputContent, readAvailable);
   if (refusal)
@@ -99428,7 +100147,7 @@ async function startModelsIn(flight, sessionPath, opts) {
   mkdirSync24(statsDir(path), { recursive: true });
   const entries = new Map;
   let run = null;
-  const errorLogPathOf = (id) => join53(path, "errors", `${id}.log`);
+  const errorLogPathOf = (id) => join54(path, "errors", `${id}.log`);
   const upstreamLogOf = (id) => upstreamLogPath(path, id);
   const flagsOf = (e) => {
     const effort = opts.efforts?.[e.model];
@@ -99438,7 +100157,7 @@ async function startModelsIn(flight, sessionPath, opts) {
   function writeResponse(e, text) {
     e.answer = text;
     try {
-      writeFileSync22(join53(path, `response-${e.id}.md`), text, "utf-8");
+      writeFileSync22(join54(path, `response-${e.id}.md`), text, "utf-8");
     } catch (err) {
       persistErrorLog(errorLogPathOf(e.id), `response file not written: ${String(err)}`, []);
     }
@@ -99448,7 +100167,7 @@ async function startModelsIn(flight, sessionPath, opts) {
     if (e.answer !== null || !e.session)
       return;
     try {
-      writeFileSync22(join53(path, `response-${e.id}.md`), e.session.chainText(), "utf-8");
+      writeFileSync22(join54(path, `response-${e.id}.md`), e.session.chainText(), "utf-8");
     } catch (err) {
       persistErrorLog(errorLogPathOf(e.id), `response file not written: ${String(err)}`, []);
     }
@@ -99465,7 +100184,7 @@ async function startModelsIn(flight, sessionPath, opts) {
       return { file: null, outcomes: turn.writtenFiles ?? [] };
     const outcomes = [];
     for (const written of turn.writtenFiles ?? []) {
-      const path = resolve5(cwd, written);
+      const path = resolve6(cwd, written);
       const r = readWrittenFile(path, cwd);
       if ("skip" in r) {
         outcomes.push(`${path} (skipped: ${r.skip})`);
@@ -99645,7 +100364,7 @@ async function startModelsIn(flight, sessionPath, opts) {
   }
   async function startSlot(e, uuid, transcriptPath) {
     let session;
-    e.inboxPath = createHookInbox(join53(path, "work"), `${e.id}.hook-inbox.jsonl`);
+    e.inboxPath = createHookInbox(join54(path, "work"), `${e.id}.hook-inbox.jsonl`);
     const binding = bindingFor(e, uuid);
     e.binding = binding;
     try {
@@ -99875,9 +100594,9 @@ async function runModels(sessionPath, opts = {}) {
   return handle.done;
 }
 async function judgeResponses(sessionPath, opts = {}) {
-  const active = activeRunAt(resolve5(sessionPath));
+  const active = activeRunAt(resolve6(sessionPath));
   if (active)
-    throw new Error(`invalid_args: the team run at ${resolve5(sessionPath)} is still ACTIVE (run_id ${active.runId}); judge it once it has settled`);
+    throw new Error(`invalid_args: the team run at ${resolve6(sessionPath)} is still ACTIVE (run_id ${active.runId}); judge it once it has settled`);
   const responseFiles = readdirSync10(sessionPath).filter((f) => f.startsWith("response-") && f.endsWith(".md")).sort();
   if (responseFiles.length < 2) {
     throw new Error(`Need at least 2 responses to judge, found ${responseFiles.length}`);
@@ -99885,13 +100604,13 @@ async function judgeResponses(sessionPath, opts = {}) {
   const responses = {};
   for (const file of responseFiles) {
     const id = file.replace(/^response-/, "").replace(/\.md$/, "");
-    responses[id] = readFileSync42(join53(sessionPath, file), "utf-8");
+    responses[id] = readFileSync42(join54(sessionPath, file), "utf-8");
   }
-  const input = readFileSync42(join53(sessionPath, "input.md"), "utf-8");
+  const input = readFileSync42(join54(sessionPath, "input.md"), "utf-8");
   const judgePrompt = buildJudgePrompt(input, responses);
-  writeFileSync22(join53(sessionPath, "judge-prompt.md"), judgePrompt, "utf-8");
+  writeFileSync22(join54(sessionPath, "judge-prompt.md"), judgePrompt, "utf-8");
   const judgeModels = opts.judges ?? getDefaultJudgeModels(sessionPath);
-  const judgePath = join53(sessionPath, "judging");
+  const judgePath = join54(sessionPath, "judging");
   mkdirSync24(judgePath, { recursive: true });
   setupSession(judgePath, judgeModels, judgePrompt);
   await runModels(judgePath, {
@@ -99903,11 +100622,11 @@ async function judgeResponses(sessionPath, opts = {}) {
   });
   const votes = parseJudgeVotes(judgePath, Object.keys(responses));
   const verdict = aggregateVerdict(votes, Object.keys(responses));
-  writeFileSync22(join53(sessionPath, "verdict.md"), formatVerdict(verdict, sessionPath), "utf-8");
+  writeFileSync22(join54(sessionPath, "verdict.md"), formatVerdict(verdict, sessionPath), "utf-8");
   return verdict;
 }
 function getStatus(sessionPath) {
-  return JSON.parse(readFileSync42(join53(sessionPath, "status.json"), "utf-8"));
+  return JSON.parse(readFileSync42(join54(sessionPath, "status.json"), "utf-8"));
 }
 function readTeamStatus(sessionPath) {
   try {
@@ -99947,7 +100666,7 @@ function fisherYatesShuffle(arr) {
   return arr;
 }
 function getDefaultJudgeModels(sessionPath) {
-  const manifest = JSON.parse(readFileSync42(join53(sessionPath, "manifest.json"), "utf-8"));
+  const manifest = JSON.parse(readFileSync42(join54(sessionPath, "manifest.json"), "utf-8"));
   return Object.values(manifest.models).map((e) => e.model);
 }
 function buildJudgePrompt(input, responses) {
@@ -100010,7 +100729,7 @@ function parseJudgeVotes(judgePath, responseIds) {
     const judgeId = file.replace(/^response-/, "").replace(/\.md$/, "");
     let content;
     try {
-      content = readFileSync42(join53(judgePath, file), "utf-8");
+      content = readFileSync42(join54(judgePath, file), "utf-8");
     } catch (err) {
       log(`[team] judge answer ${file} unreadable: ${err instanceof Error ? err.message : String(err)}`);
       continue;
@@ -100063,7 +100782,7 @@ function aggregateVerdict(votes, responseIds) {
 function formatVerdict(verdict, sessionPath) {
   let manifest = null;
   try {
-    manifest = JSON.parse(readFileSync42(join53(sessionPath, "manifest.json"), "utf-8"));
+    manifest = JSON.parse(readFileSync42(join54(sessionPath, "manifest.json"), "utf-8"));
   } catch {}
   let output = `# Team Verdict
 
@@ -100120,7 +100839,7 @@ var init_team_orchestrator = __esm(() => {
 
 // src/mcp-session/inherited-settings.ts
 import { existsSync as existsSync37, readFileSync as readFileSync43, statSync as statSync19 } from "fs";
-import { join as join54, resolve as resolve6 } from "path";
+import { join as join55, resolve as resolve7 } from "path";
 function isPlainObject7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -100174,7 +100893,7 @@ function readSettingsValue(value) {
 function buildInheritedSettingsLayer(setupFrom, callerFlags) {
   const layers = [];
   for (const name of ["settings.json", "settings.local.json"]) {
-    const file = join54(setupFrom, ".claude", name);
+    const file = join55(setupFrom, ".claude", name);
     if (!existsSync37(file))
       continue;
     layers.push(parseLayer(readFileSync43(file, "utf-8"), file));
@@ -100206,14 +100925,14 @@ function resolveSetupFrom(arg, workDir, serverCwd) {
     return;
   let setupFrom = serverCwd;
   if (typeof arg === "string") {
-    setupFrom = resolve6(arg);
+    setupFrom = resolve7(arg);
     if (!statSync19(setupFrom, { throwIfNoEntry: false })?.isDirectory()) {
       throw new Error(`invalid_args: setup_from ${setupFrom} is not an existing directory`);
     }
   } else if (arg !== undefined) {
     throw new Error("invalid_args: setup_from must be a directory path or null");
   }
-  return setupFrom === resolve6(workDir ?? serverCwd) ? undefined : setupFrom;
+  return setupFrom === resolve7(workDir ?? serverCwd) ? undefined : setupFrom;
 }
 var init_inherited_settings = () => {};
 
@@ -100233,7 +100952,7 @@ import {
   statSync as statSync20,
   writeFileSync as writeFileSync23
 } from "fs";
-import { join as join55, resolve as resolve7, sep as sep3 } from "path";
+import { join as join56, resolve as resolve8, sep as sep3 } from "path";
 function normaliseTimeoutSeconds(raw) {
   const n = typeof raw === "string" && raw.trim() !== "" ? Number(raw) : raw;
   if (typeof n !== "number" || !Number.isFinite(n))
@@ -100403,7 +101122,7 @@ function dropLeadingFragment(tail) {
   return firstBreak === -1 ? tail.text : tail.text.slice(firstBreak + 1);
 }
 function diskAccounting(sessionDir) {
-  const stats = readTokenStatsAt(join55(sessionDir, "tokens.json"));
+  const stats = readTokenStatsAt(join56(sessionDir, "tokens.json"));
   return {
     tokensIn: stats?.billed_input_tokens ?? null,
     tokensOut: stats?.output_tokens ?? null,
@@ -100488,7 +101207,7 @@ class SessionManager {
     let dir = "";
     for (let attempt = 0;; attempt++) {
       id = `team-${randomUUID9().replace(/-/g, "").slice(0, 8)}`;
-      dir = join55(this.sessionsDir, id);
+      dir = join56(this.sessionsDir, id);
       try {
         mkdirSync25(dir);
         break;
@@ -100503,7 +101222,7 @@ class SessionManager {
       sessionId: id,
       parentClaudeSessionId: opts.parentClaudeSessionId,
       startedAt,
-      teamPath: resolve7(opts.teamPath),
+      teamPath: resolve8(opts.teamPath),
       slots: opts.slots
     });
     this.teamRunStarts.set(id, startedAt);
@@ -100520,9 +101239,9 @@ class SessionManager {
       if (dir === null)
         throw new Error("not a record id");
       const completedAt = new Date().toISOString();
-      const startedAt = this.teamRunStarts.get(record) ?? metaString(readJsonObject(join55(dir, "spawn.json"), META_READ_LIMIT)?.startedAt) ?? completedAt;
+      const startedAt = this.teamRunStarts.get(record) ?? metaString(readJsonObject(join56(dir, "spawn.json"), META_READ_LIMIT)?.startedAt) ?? completedAt;
       const elapsedMs = Date.parse(completedAt) - Date.parse(startedAt);
-      writeJsonAtomic(join55(dir, "meta.json"), {
+      writeJsonAtomic(join56(dir, "meta.json"), {
         kind: "team",
         status: outcome.status,
         startedAt,
@@ -100554,7 +101273,7 @@ class SessionManager {
       startedAt,
       ...rest
     };
-    writeJsonAtomic(join55(dir, "spawn.json"), body);
+    writeJsonAtomic(join56(dir, "spawn.json"), body);
   }
   async createSession(opts) {
     if (this.activeSessions + this.starting >= this.maxSessions) {
@@ -100594,7 +101313,7 @@ class SessionManager {
         throw err;
       }
       if (inherited.layer) {
-        flags = [...inherited.restFlags, "--settings", join55(entry.sessionDir, INHERITED_SETTINGS)];
+        flags = [...inherited.restFlags, "--settings", join56(entry.sessionDir, INHERITED_SETTINGS)];
       }
       this.sessions.set(entry.info.sessionId, entry);
       uncount();
@@ -100619,10 +101338,10 @@ class SessionManager {
     const timeout = normaliseTimeoutSeconds(opts.timeoutSeconds);
     const agentRequested = requestedAgentOf(opts.claudishFlags ?? []);
     const startedAt = new Date().toISOString();
-    const sessionDir = opts.sessionDir ?? join55(this.sessionsDir, sessionId);
+    const sessionDir = opts.sessionDir ?? join56(this.sessionsDir, sessionId);
     mkdirSync25(sessionDir, { recursive: true });
     if (opts.prompt)
-      writeFileSync23(join55(sessionDir, "prompt.md"), opts.prompt, "utf-8");
+      writeFileSync23(join56(sessionDir, "prompt.md"), opts.prompt, "utf-8");
     this.writeSpawnRecord(sessionDir, {
       kind: "session",
       sessionId,
@@ -100635,13 +101354,13 @@ class SessionManager {
       ...agentRequested ? { agentRequested } : {}
     });
     if (inheritedLayer) {
-      writeFileSync23(join55(sessionDir, INHERITED_SETTINGS), `${JSON.stringify(inheritedLayer, null, 2)}
+      writeFileSync23(join56(sessionDir, INHERITED_SETTINGS), `${JSON.stringify(inheritedLayer, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
     }
     const cwd = opts.cwd ?? process.cwd();
     const parentEnv = opts.parentEnv ?? this.parentEnv;
     const spawnModel = opts.spawnModel ?? null;
-    const tokenFile = opts.tokenFile ?? join55(sessionDir, "tokens.json");
+    const tokenFile = opts.tokenFile ?? join56(sessionDir, "tokens.json");
     return {
       info: {
         sessionId,
@@ -100679,18 +101398,18 @@ class SessionManager {
       },
       session: null,
       scrollback: new ScrollbackBuffer(this.scrollbackCapacity),
-      outputLogStream: createWriteStream(join55(sessionDir, "output.log")),
+      outputLogStream: createWriteStream(join56(sessionDir, "output.log")),
       sessionDir,
       cwd,
       tokenFile,
-      eventLogPath: join55(sessionDir, "events.jsonl"),
+      eventLogPath: join56(sessionDir, "events.jsonl"),
       eventLogBytes: 0,
-      upstreamErrorLogPath: join55(sessionDir, "upstream-errors.jsonl"),
+      upstreamErrorLogPath: join56(sessionDir, "upstream-errors.jsonl"),
       eventRing: [],
       proseBytes: 0,
       answeredTurns: new Map,
       inboxPath: null,
-      waitLogPath: join55(sessionDir, "waits.jsonl"),
+      waitLogPath: join56(sessionDir, "waits.jsonl"),
       waitLogBytes: 0,
       waitSince: null,
       ended: false,
@@ -100885,7 +101604,7 @@ class SessionManager {
       try {
         const text = screenLines.join(`
 `).replace(/\s+$/, "");
-        writeFileSync23(join55(entry.sessionDir, "screen.txt"), `${redactSecrets(text)}
+        writeFileSync23(join56(entry.sessionDir, "screen.txt"), `${redactSecrets(text)}
 `, "utf-8");
       } catch {}
     }
@@ -100899,7 +101618,7 @@ class SessionManager {
       entry.waitSince = null;
     }
     try {
-      writeJsonAtomic(join55(entry.sessionDir, "meta.json"), toMetaRecord(entry.info, entry.cwd));
+      writeJsonAtomic(join56(entry.sessionDir, "meta.json"), toMetaRecord(entry.info, entry.cwd));
     } catch (err) {
       process.stderr.write(`[claudish] session ${entry.info.sessionId}: could not write meta.json: ` + `${err instanceof Error ? err.message : String(err)}
 `);
@@ -101140,8 +101859,8 @@ class SessionManager {
     } catch {
       return null;
     }
-    const spawnPath = join55(sessionDir, "spawn.json");
-    const metaPath = join55(sessionDir, "meta.json");
+    const spawnPath = join56(sessionDir, "spawn.json");
+    const metaPath = join56(sessionDir, "meta.json");
     const spawnRecord = readJsonObject(spawnPath, META_READ_LIMIT);
     if (spawnRecord?.kind === "team")
       return null;
@@ -101233,9 +101952,9 @@ class SessionManager {
   diskSessionDir(sessionId) {
     if (!SESSION_ID_RE.test(sessionId))
       return null;
-    const root = resolve7(this.sessionsDir);
-    const dir = resolve7(root, sessionId);
-    if (dir !== join55(root, sessionId))
+    const root = resolve8(this.sessionsDir);
+    const dir = resolve8(root, sessionId);
+    if (dir !== join56(root, sessionId))
       return null;
     if (!dir.startsWith(root + sep3))
       return null;
@@ -101254,10 +101973,10 @@ class SessionManager {
     } catch {
       return null;
     }
-    const spawnRecord = readJsonObject(join55(sessionDir, "spawn.json"), META_READ_LIMIT);
+    const spawnRecord = readJsonObject(join56(sessionDir, "spawn.json"), META_READ_LIMIT);
     if (spawnRecord?.kind === "team")
       return null;
-    const meta = readJsonObject(join55(sessionDir, "meta.json"), META_READ_LIMIT);
+    const meta = readJsonObject(join56(sessionDir, "meta.json"), META_READ_LIMIT);
     if (meta?.kind === "team")
       return null;
     const partial = meta === null;
@@ -101279,7 +101998,7 @@ class SessionManager {
     return stored;
   }
   diskOutput(record, tailLines) {
-    const tail = readTailText(join55(record.sessionDir, "output.log"), OUTPUT_TAIL_BYTES);
+    const tail = readTailText(join56(record.sessionDir, "output.log"), OUTPUT_TAIL_BYTES);
     const buffer = new ScrollbackBuffer(this.scrollbackCapacity);
     if (tail?.text)
       buffer.append(dropLeadingFragment(tail));
@@ -101299,12 +102018,12 @@ class SessionManager {
   }
   diskDiagnostics(record, limit) {
     const { sessionDir, info } = record;
-    const eventLogPath = join55(sessionDir, "events.jsonl");
-    const upstreamErrorLogPath = join55(sessionDir, "upstream-errors.jsonl");
-    const outputLogPath = join55(sessionDir, "output.log");
+    const eventLogPath = join56(sessionDir, "events.jsonl");
+    const upstreamErrorLogPath = join56(sessionDir, "upstream-errors.jsonl");
+    const outputLogPath = join56(sessionDir, "output.log");
     const events = readTailLines2(eventLogPath, EVENT_TAIL_BYTES);
     const outputTail = readTailText(outputLogPath, OUTPUT_TAIL_BYTES);
-    const screen = readTailText(join55(sessionDir, "screen.txt"), SCREEN_READ_BYTES);
+    const screen = readTailText(join56(sessionDir, "screen.txt"), SCREEN_READ_BYTES);
     return {
       sessionId: info.sessionId,
       state: info.state,
@@ -101710,7 +102429,7 @@ var init_progress_heartbeat = __esm(() => {
 import { spawn as spawn2 } from "child_process";
 import { mkdirSync as mkdirSync26, mkdtempSync as mkdtempSync3, rmSync as rmSync14, writeFileSync as writeFileSync24 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join56 } from "path";
+import { join as join57 } from "path";
 function claudeCodePrintArgv(model, systemPromptFile) {
   const head = [PRINT_FLAGS[0], "--model", model, ...PRINT_FLAGS.slice(1)];
   return systemPromptFile !== undefined ? [...head, "--system-prompt-file", systemPromptFile] : [...head, "--system-prompt", ""];
@@ -101811,7 +102530,7 @@ function killGroup(proc) {
   timer.unref?.();
 }
 function stopAllClaudeCodePrintChildren() {
-  for (const proc of inFlight3)
+  for (const proc of inFlight4)
     killGroup(proc);
 }
 function stderrTail(stderr) {
@@ -101828,13 +102547,13 @@ async function runPromptViaClaudeCode(model, prompt, systemPrompt, opts = {}) {
   } catch (e) {
     throw new Error(`cannot start claudish (${parentEnv.CLAUDISH_BIN?.trim() || "claudish"}): ${e instanceof Error ? e.message : String(e)}`);
   }
-  const root = mkdtempSync3(join56(tmpdir2(), "claudish-run-prompt-"));
+  const root = mkdtempSync3(join57(tmpdir2(), "claudish-run-prompt-"));
   try {
-    const cwd = join56(root, "cwd");
+    const cwd = join57(root, "cwd");
     mkdirSync26(cwd, { mode: 448 });
     let systemPromptFile;
     if (typeof systemPrompt === "string" && systemPrompt.length > 0) {
-      systemPromptFile = join56(root, "system-prompt.txt");
+      systemPromptFile = join57(root, "system-prompt.txt");
       writeFileSync24(systemPromptFile, systemPrompt, { mode: 384 });
     }
     const argv = claudeCodePrintArgv(model, systemPromptFile);
@@ -101887,7 +102606,7 @@ function runChild(launch, argv, cwd, env, prompt, signal) {
       if (settled)
         return;
       settled = true;
-      inFlight3.delete(proc);
+      inFlight4.delete(proc);
       signal?.removeEventListener("abort", onAbort);
       fn();
     };
@@ -101902,7 +102621,7 @@ function runChild(launch, argv, cwd, env, prompt, signal) {
     proc.stdin?.on("error", () => {});
     proc.on("error", (e) => finish(() => reject(startError(launch.command, e))));
     proc.on("close", (code, sig) => finish(() => resolvePromise({ code, signal: sig, stdout, stderr })));
-    inFlight3.add(proc);
+    inFlight4.add(proc);
     signal?.addEventListener("abort", onAbort, { once: true });
     if (signal?.aborted)
       onAbort();
@@ -101914,7 +102633,7 @@ function startError(command, e) {
   const detail = typeof code === "string" ? code : e instanceof Error ? e.message : String(e ?? "unknown");
   return new Error(`cannot start claudish (${command}): ${detail}`);
 }
-var PRINT_FLAGS, PRINT_CHILD_DROPPED_MARKERS, inFlight3, KILL_GRACE_MS = 5000, STDERR_TAIL_CHARS = 2000;
+var PRINT_FLAGS, PRINT_CHILD_DROPPED_MARKERS, inFlight4, KILL_GRACE_MS = 5000, STDERR_TAIL_CHARS = 2000;
 var init_run_prompt_claude_code = __esm(() => {
   init_config();
   init_child_env();
@@ -101936,7 +102655,7 @@ var init_run_prompt_claude_code = __esm(() => {
     ...PANE_LAUNCH_VARS,
     ENV.CLAUDISH_PANE_CHILD
   ];
-  inFlight3 = new Set;
+  inFlight4 = new Set;
 });
 
 // src/providers/preflight-chain.ts
@@ -102136,7 +102855,7 @@ var init_preflight_chain = __esm(() => {
 // src/mcp-server.ts
 import { existsSync as existsSync39, readFileSync as readFileSync45, readdirSync as readdirSync11 } from "fs";
 import { homedir as homedir37 } from "os";
-import { dirname as dirname22, join as join57, resolve as resolve8 } from "path";
+import { dirname as dirname22, join as join58, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 async function loadAllModels(forceRefresh = false) {
   if (!forceRefresh && existsSync39(OPENROUTER_MODELS_CACHE_PATH)) {
@@ -103328,7 +104047,7 @@ This searched OpenRouter's listing only. Subscription wire ids and catalog alias
         const promptText = () => {
           if (input !== undefined)
             return input;
-          const existing = join57(resolved, "input.md");
+          const existing = join58(resolved, "input.md");
           return existsSync39(existing) ? readFileSync45(existing, "utf-8") : undefined;
         };
         const choice = modelChoiceStop([
@@ -103511,16 +104230,16 @@ This searched OpenRouter's listing only. Subscription wire ids and catalog alias
         const sp = session_path;
         for (const file of ["status.json", "manifest.json", "input.md"]) {
           try {
-            sessionData[file] = readFileSync45(join57(sp, file), "utf-8");
+            sessionData[file] = readFileSync45(join58(sp, file), "utf-8");
           } catch {}
         }
         try {
-          const errorDir = join57(sp, "errors");
+          const errorDir = join58(sp, "errors");
           if (existsSync39(errorDir)) {
             for (const f of readdirSync11(errorDir)) {
               if (f.endsWith(".log")) {
                 try {
-                  sessionData[`errors/${f}`] = readFileSync45(join57(errorDir, f), "utf-8");
+                  sessionData[`errors/${f}`] = readFileSync45(join58(errorDir, f), "utf-8");
                 } catch {}
               }
             }
@@ -103530,7 +104249,7 @@ This searched OpenRouter's listing only. Subscription wire ids and catalog alias
           for (const f of readdirSync11(sp)) {
             if (f.startsWith("response-") && f.endsWith(".md")) {
               try {
-                const content = readFileSync45(join57(sp, f), "utf-8");
+                const content = readFileSync45(join58(sp, f), "utf-8");
                 sessionData[f] = content.slice(0, 200) + (content.length > 200 ? "... (truncated)" : "");
               } catch {}
             }
@@ -103539,7 +104258,7 @@ This searched OpenRouter's listing only. Subscription wire ids and catalog alias
       }
       let version = "unknown";
       try {
-        const pkgPath = join57(__dirname3, "../package.json");
+        const pkgPath = join58(__dirname3, "../package.json");
         if (existsSync39(pkgPath)) {
           version = JSON.parse(readFileSync45(pkgPath, "utf-8")).version;
         }
@@ -103722,7 +104441,7 @@ Report manually at https://github.com/anthropics/claudish/issues${autoSendHint}`
         const { specs, stripped } = strippedProviders([args.model], new Set(args.user_required_provider === true ? [args.model] : []));
         const requestedModel = specs[0];
         const choice = modelChoiceStop([{ given: args.model, spec: requestedModel }], new Set(args.user_required_model === true ? [args.model] : []), "with user_required_model: true", {
-          projectRulesReadable: typeof args.work_dir !== "string" || resolve8(args.work_dir) === process.cwd()
+          projectRulesReadable: typeof args.work_dir !== "string" || resolve9(args.work_dir) === process.cwd()
         });
         if (choice)
           return choice;
@@ -103732,7 +104451,7 @@ Report manually at https://github.com/anthropics/claudish/issues${autoSendHint}`
         }
         const workDir = args.work_dir;
         const plan = await prehydrateCredentialsForSpawn([requestedModel], {
-          pin: workDir === undefined || resolve8(workDir) === process.cwd()
+          pin: workDir === undefined || resolve9(workDir) === process.cwd()
         });
         const parentClaudeSessionId = await parentSessionForCall({
           hostPid: sessionManager.hostPid
@@ -104221,8 +104940,8 @@ var init_mcp_server = __esm(() => {
   init_preflight_chain();
   __filename3 = fileURLToPath3(import.meta.url);
   __dirname3 = dirname22(__filename3);
-  CLAUDISH_CACHE_DIR = join57(homedir37(), ".claudish");
-  OPENROUTER_MODELS_CACHE_PATH = join57(CLAUDISH_CACHE_DIR, "openrouter-models.json");
+  CLAUDISH_CACHE_DIR = join58(homedir37(), ".claudish");
+  OPENROUTER_MODELS_CACHE_PATH = join58(CLAUDISH_CACHE_DIR, "openrouter-models.json");
   NEXT_STEP = {
     cancelled: "you stopped this slot; nothing is wrong with it. Re-run it if you still want its vote",
     timeout: "grid mode only \u2014 magmux ended the pane. The orchestrator has no deadline",
@@ -104353,7 +105072,7 @@ var HOOKS_AMBIENT_DTS = '// claudish hook types \u2014 written by `claudish hook
 // src/hooks/observer/corpus.ts
 import { appendFileSync as appendFileSync8, readFileSync as readFileSync47, readdirSync as readdirSync12, statSync as statSync21 } from "fs";
 import { homedir as homedir38 } from "os";
-import { join as join58 } from "path";
+import { join as join59 } from "path";
 function directoryOf2(filePath) {
   const slash = filePath.lastIndexOf("/");
   return slash > 0 ? filePath.slice(0, slash) : undefined;
@@ -104432,26 +105151,26 @@ function listTranscripts(root) {
     return files;
   }
   for (const project of projects) {
-    const dir = join58(root, project);
+    const dir = join59(root, project);
     try {
       if (!statSync21(dir).isDirectory())
         continue;
       for (const f of readdirSync12(dir)) {
         if (f.endsWith(".jsonl"))
-          files.push(join58(dir, f));
+          files.push(join59(dir, f));
       }
     } catch {}
   }
   return files;
 }
 function buildCorpus(options = {}) {
-  const root = options.projectsRoot ?? join58(homedir38(), ".claude", "projects");
+  const root = options.projectsRoot ?? join59(homedir38(), ".claude", "projects");
   const files = listTranscripts(root);
   const records = [];
   for (const f of files)
     records.push(...replayTranscript(f));
   if (options.write && records.length > 0) {
-    const outputPath = options.outputPath ?? join58(homedir38(), ".claudish", "behavior-divergences.jsonl");
+    const outputPath = options.outputPath ?? join59(homedir38(), ".claudish", "behavior-divergences.jsonl");
     try {
       appendFileSync8(outputPath, `${records.map((r) => JSON.stringify(r)).join(`
 `)}
@@ -104469,7 +105188,7 @@ var init_corpus = __esm(() => {
 // src/hooks-command.ts
 import { existsSync as existsSync41, mkdirSync as mkdirSync27, readFileSync as readFileSync48, writeFileSync as writeFileSync25 } from "fs";
 import { homedir as homedir39 } from "os";
-import { join as join59, resolve as resolve9 } from "path";
+import { join as join60, resolve as resolve10 } from "path";
 function severityColor(sev) {
   if (sev === "fix")
     return green(sev);
@@ -104559,7 +105278,7 @@ async function check(file, json) {
     console.error("Usage: claudish hooks check <file> [--json]");
     return 1;
   }
-  const path = resolve9(process.cwd(), file);
+  const path = resolve10(process.cwd(), file);
   const notes = [];
   const loaded = await loadUserHooks({
     modules: [path],
@@ -104592,10 +105311,10 @@ async function check(file, json) {
   return valid ? 0 : 1;
 }
 function init(dirArg) {
-  const dir = dirArg ? resolve9(process.cwd(), dirArg) : join59(homedir39(), ".claudish", "hooks");
+  const dir = dirArg ? resolve10(process.cwd(), dirArg) : join60(homedir39(), ".claudish", "hooks");
   const files = [
-    [join59(dir, "example-hook.ts"), EXAMPLE_HOOK],
-    [join59(dir, "claudish-hooks.d.ts"), HOOKS_AMBIENT_DTS]
+    [join60(dir, "example-hook.ts"), EXAMPLE_HOOK],
+    [join60(dir, "claudish-hooks.d.ts"), HOOKS_AMBIENT_DTS]
   ];
   const existing = files.filter(([path]) => existsSync41(path)).map(([path]) => path);
   if (existing.length > 0) {
@@ -104798,7 +105517,7 @@ var init_hooks_command = __esm(() => {
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync42, readFileSync as readFileSync49, writeFileSync as writeFileSync26 } from "fs";
 import { connect as netConnect2 } from "net";
-import { join as join60 } from "path";
+import { join as join61 } from "path";
 import { setTimeout as wait } from "timers/promises";
 function paneRouteLine(explanation) {
   const origin = describeRouteExplanation(explanation);
@@ -104948,9 +105667,9 @@ async function runWithGrid(sessionPath, models, input, opts) {
   const keep = opts?.keep ?? false;
   const manifest = setupSession(sessionPath, models, input);
   const startedAt = new Date().toISOString();
-  const gridfilePath = join60(sessionPath, "gridfile.txt");
-  const prompt = readFileSync49(join60(sessionPath, "input.md"), "utf-8").replace(/'/g, "'\\''").replace(/\n/g, " ");
-  const rawPrompt = readFileSync49(join60(sessionPath, "input.md"), "utf-8");
+  const gridfilePath = join61(sessionPath, "gridfile.txt");
+  const prompt = readFileSync49(join61(sessionPath, "input.md"), "utf-8").replace(/'/g, "'\\''").replace(/\n/g, " ");
+  const rawPrompt = readFileSync49(join61(sessionPath, "input.md"), "utf-8");
   const usedBannerColors = new Set;
   const routeLines = mode === "interactive" ? new Map : await resolvePaneRouteLines(Object.values(manifest.models).map((entry) => entry.model));
   const gridLines = Object.entries(manifest.models).map(([anonId]) => {
@@ -104982,7 +105701,7 @@ async function runWithGrid(sessionPath, models, input, opts) {
   });
   const [{ results }] = await Promise.all([subscription, procExit]);
   const status = buildTeamStatus(manifest, startedAt, results?.panes ?? null);
-  const statusPath = join60(sessionPath, "status.json");
+  const statusPath = join61(sessionPath, "status.json");
   writeFileSync26(statusPath, JSON.stringify(status, null, 2), "utf-8");
   return status;
 }
@@ -105003,7 +105722,7 @@ var init_team_grid = __esm(() => {
 
 // src/team-cli.ts
 import { readFileSync as readFileSync50 } from "fs";
-import { join as join61 } from "path";
+import { join as join62 } from "path";
 async function runPaneTeam(sessionPath, models, input, opts) {
   installPaneShutdownHooks({ exitAfter: true });
   try {
@@ -105148,7 +105867,7 @@ async function teamCommand(args) {
     }
     case "judge": {
       await judgeResponses(sessionPath, { judges });
-      console.log(readFileSync50(join61(sessionPath, "verdict.md"), "utf-8"));
+      console.log(readFileSync50(join62(sessionPath, "verdict.md"), "utf-8"));
       break;
     }
     case "run-and-judge": {
@@ -105164,7 +105883,7 @@ async function teamCommand(args) {
       });
       printStatus(status);
       await judgeResponses(sessionPath, { judges });
-      console.log(readFileSync50(join61(sessionPath, "verdict.md"), "utf-8"));
+      console.log(readFileSync50(join62(sessionPath, "verdict.md"), "utf-8"));
       break;
     }
     case "status": {
@@ -107068,8 +107787,10 @@ A command that takes <label> also takes the account's email.
 --id <generated-id> may replace or confirm the label; labels are unique per claudish provider.
 Removing the legacy login (default, legacy-codex-file) requires --delete-file.
 New accounts use the macOS Keychain, or protected plaintext files where there is none.
+On macOS the legacy login (~/.claudish/codex-oauth.json) moves into the Keychain on first use.
 Add only accounts you own; vendor terms may restrict switching between subscriptions.
-With Codex accounts configured, use account add/login instead of \`claudish login codex\`.
+On macOS, \`claudish login codex\` adds or logs in your one Codex account; with several, use account login.
+Elsewhere, with Codex accounts configured, use account add/login instead of \`claudish login codex\`.
 Claude account mutations, import and use are not available. No token input or export.`, MUTATION_VERBS, HOUR_MS19 = 3600000, FORECAST_HELP = `Usage:
   claudish account forecast [--json] [--horizon <h|d>] [--provider codex]
 
@@ -107092,7 +107813,7 @@ var init_account_command = __esm(() => {
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync43, unlinkSync as unlinkSync12 } from "fs";
 import { homedir as homedir40 } from "os";
-import { join as join62 } from "path";
+import { join as join63 } from "path";
 async function defaultSuggestModel() {
   try {
     const token = await getValidAntigravityAccessToken();
@@ -107211,7 +107932,7 @@ No session detected yet. Starting the Antigravity CLI interactively \u2014
   async logout(deps) {
     deleteSharedAntigravityToken(deps);
     try {
-      const tokenFile = join62(homedir40(), ".gemini", "antigravity-cli", "antigravity-oauth-token");
+      const tokenFile = join63(homedir40(), ".gemini", "antigravity-cli", "antigravity-oauth-token");
       if (existsSync43(tokenFile))
         unlinkSync12(tokenFile);
     } catch {}
@@ -115403,9 +116124,9 @@ var init_tui = __esm(() => {
 // src/auth/claude-code-facts.ts
 import { createHash as createHash14 } from "crypto";
 import { homedir as homedir41 } from "os";
-import { isAbsolute as isAbsolute2, resolve as resolve10 } from "path";
+import { isAbsolute as isAbsolute2, resolve as resolve11 } from "path";
 function defaultConfigDir(env) {
-  return resolve10(env.HOME || homedir41(), ".claude");
+  return resolve11(env.HOME || homedir41(), ".claude");
 }
 function configDirHash(configDir) {
   return createHash14("sha256").update(configDir).digest("hex").slice(0, 8);
@@ -115414,7 +116135,7 @@ function claudeCodeKeychainService(env = process.env) {
   const raw = env.CLAUDE_CONFIG_DIR?.trim();
   if (!raw)
     return `${BASE_KEYCHAIN_SERVICE}${KEYCHAIN_SERVICE_SUFFIX}`;
-  const resolved = isAbsolute2(raw) ? resolve10(raw) : resolve10(process.cwd(), raw);
+  const resolved = isAbsolute2(raw) ? resolve11(raw) : resolve11(process.cwd(), raw);
   if (resolved === defaultConfigDir(env)) {
     return `${BASE_KEYCHAIN_SERVICE}${KEYCHAIN_SERVICE_SUFFIX}`;
   }
@@ -115490,7 +116211,7 @@ var init_own_pane = __esm(() => {
 
 // src/hooks/session/interactive-driver.ts
 import { existsSync as existsSync44, statSync as statSync22 } from "fs";
-import { join as join63 } from "path";
+import { join as join64 } from "path";
 function nextDriverPhase(phase, ev) {
   const row = EDGES[phase];
   return row[ev] ?? null;
@@ -115708,7 +116429,7 @@ class InteractiveDriver {
   }
   follow(sid, offset) {
     const path = transcriptPathFor(this.o.cwd, sid, this.o.projectsRoot);
-    this.follower = new TranscriptFollower(path, join63(path.replace(/\.jsonl$/, ""), "subagents"));
+    this.follower = new TranscriptFollower(path, join64(path.replace(/\.jsonl$/, ""), "subagents"));
     this.sessionId = sid;
     this.settledTurn = null;
     this.lastPollAt = Date.now();
@@ -116823,7 +117544,7 @@ import {
   writeFileSync as writeFileSync27
 } from "fs";
 import { homedir as homedir42, tmpdir as tmpdir3 } from "os";
-import { dirname as dirname23, join as join64 } from "path";
+import { dirname as dirname23, join as join65 } from "path";
 import { isatty } from "tty";
 function releaseTerminalIsolation() {
   if (!restoreTerminal)
@@ -116895,7 +117616,7 @@ function hasResolvableAnthropicAuth(deps = {}) {
   if (isRealAnthropicEnvCredential(env, "ANTHROPIC_API_KEY") || isRealAnthropicEnvCredential(env, "ANTHROPIC_AUTH_TOKEN")) {
     return true;
   }
-  if (fileExists(join64(homedir42(), ".claude", ".credentials.json")))
+  if (fileExists(join65(homedir42(), ".claude", ".credentials.json")))
     return true;
   return keychainProbe();
 }
@@ -116995,10 +117716,10 @@ function readableClaudeSettingsLayers(config, env, deps) {
   const cwd = deps.cwd ?? process.cwd();
   const files = [
     managedSettingsPath(),
-    join64(home, ".claude", "settings.json"),
-    ...env.CLAUDE_CONFIG_DIR ? [join64(env.CLAUDE_CONFIG_DIR, "settings.json")] : [],
-    join64(cwd, ".claude", "settings.json"),
-    join64(cwd, ".claude", "settings.local.json")
+    join65(home, ".claude", "settings.json"),
+    ...env.CLAUDE_CONFIG_DIR ? [join65(env.CLAUDE_CONFIG_DIR, "settings.json")] : [],
+    join65(cwd, ".claude", "settings.json"),
+    join65(cwd, ".claude", "settings.local.json")
   ];
   const layers = [];
   for (const file of files) {
@@ -117030,7 +117751,7 @@ function readSettingsSource(source, readFile) {
 }
 function managedSettingsPath() {
   if (isWindows2()) {
-    return join64(process.env.PROGRAMDATA || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
+    return join65(process.env.PROGRAMDATA || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
   }
   if (process.platform === "darwin") {
     return "/Library/Application Support/ClaudeCode/managed-settings.json";
@@ -117051,8 +117772,8 @@ function isWindows2() {
 }
 function createStatusLineScript(tokenFilePath) {
   const homeDir = process.env.HOME || process.env.USERPROFILE || tmpdir3();
-  const claudishDir = join64(homeDir, ".claudish");
-  const scriptPath = join64(claudishDir, `status-${process.pid}-${Date.now()}.js`);
+  const claudishDir = join65(homeDir, ".claudish");
+  const scriptPath = join65(claudishDir, `status-${process.pid}-${Date.now()}.js`);
   const escapedTokenPath = tokenFilePath.replace(/\\/g, "\\\\");
   const light = getThemeMode() === "light";
   const cyanCode = light ? "38;2;14;116;144" : "96";
@@ -117244,7 +117965,7 @@ function cleanupStaleTokenFiles(dir, now = Date.now(), maxAgeMs = STALE_TOKEN_FI
     if (!name.startsWith("tokens-") || !name.endsWith(".json"))
       continue;
     scanned++;
-    const full = join64(dir, name);
+    const full = join65(dir, name);
     try {
       if (statSync23(full).mtimeMs >= cutoff)
         continue;
@@ -117273,9 +117994,9 @@ function parseSettingsArgSafe(value) {
 }
 function userSettingsFileCandidates(cwd) {
   return [
-    join64(homedir42(), ".claude", "settings.json"),
-    join64(cwd, ".claude", "settings.json"),
-    join64(cwd, ".claude", "settings.local.json")
+    join65(homedir42(), ".claude", "settings.json"),
+    join65(cwd, ".claude", "settings.json"),
+    join65(cwd, ".claude", "settings.local.json")
   ];
 }
 function discoverUserStatusLineCommand(claudeArgs = [], cwd = process.cwd()) {
@@ -117316,11 +118037,11 @@ function buildChainedStatusCommand(userCommand, claudishBody, claudishSegment) {
 }
 function createTempSettingsFile(_modelDisplay, port, proxyAuthMode, userStatusLineCommand) {
   const homeDir = process.env.HOME || process.env.USERPROFILE || tmpdir3();
-  const claudishDir = join64(homeDir, ".claudish");
+  const claudishDir = join65(homeDir, ".claudish");
   try {
     mkdirSync28(claudishDir, { recursive: true });
   } catch {}
-  const tempPath = join64(claudishDir, `settings-${process.pid}-${Date.now()}.json`);
+  const tempPath = join65(claudishDir, `settings-${process.pid}-${Date.now()}.json`);
   const assignedFile = assignedTokenFile(process.env) !== null;
   const tokenFilePath = resolveTokenFilePath(port);
   cleanupStaleTokenFiles(claudishDir);
@@ -117711,7 +118432,7 @@ async function runClaudeWithProxy(config, proxyUrl, onCleanup) {
     console.error(`
 Or set CLAUDE_PATH to your custom installation:`);
     const home = homedir42();
-    const localPath = isWindows2() ? join64(home, ".claude", "local", "claude.exe") : join64(home, ".claude", "local", "claude");
+    const localPath = isWindows2() ? join65(home, ".claude", "local", "claude.exe") : join65(home, ".claude", "local", "claude");
     console.error(`  export CLAUDE_PATH=${localPath}`);
     process.exit(1);
   }
@@ -117746,7 +118467,7 @@ Or set CLAUDE_PATH to your custom installation:`);
   let driverLaunch = null;
   if (surfaces.driver) {
     const minted = sessionFlags.sessionId || sessionFlags.resumes ? null : randomUUID11();
-    const turnDir = mkdtempSync4(join64(tmpdir3(), "claudish-turns-"));
+    const turnDir = mkdtempSync4(join65(tmpdir3(), "claudish-turns-"));
     chmodSync5(turnDir, 448);
     claudeArgs.unshift(...driverLeadingArgs({ mintedSessionId: minted, turnDir }));
     const sink = new InProcessSink;
@@ -117895,15 +118616,15 @@ async function findClaudeBinary() {
     }
   }
   const home = homedir42();
-  const localPath = isWindows ? join64(home, ".claude", "local", "claude.exe") : join64(home, ".claude", "local", "claude");
+  const localPath = isWindows ? join65(home, ".claude", "local", "claude.exe") : join65(home, ".claude", "local", "claude");
   if (existsSync46(localPath)) {
     return localPath;
   }
   if (isWindows) {
     const windowsPaths = [
-      join64(home, "AppData", "Roaming", "npm", "claude.cmd"),
-      join64(home, ".npm-global", "claude.cmd"),
-      join64(home, "node_modules", ".bin", "claude.cmd")
+      join65(home, "AppData", "Roaming", "npm", "claude.cmd"),
+      join65(home, ".npm-global", "claude.cmd"),
+      join65(home, "node_modules", ".bin", "claude.cmd")
     ];
     for (const path of windowsPaths) {
       if (existsSync46(path)) {
@@ -117914,11 +118635,11 @@ async function findClaudeBinary() {
     const commonPaths = [
       "/usr/local/bin/claude",
       "/opt/homebrew/bin/claude",
-      join64(home, ".npm-global/bin/claude"),
-      join64(home, ".local/bin/claude"),
-      join64(home, "node_modules/.bin/claude"),
+      join65(home, ".npm-global/bin/claude"),
+      join65(home, ".local/bin/claude"),
+      join65(home, "node_modules/.bin/claude"),
       "/data/data/com.termux/files/usr/bin/claude",
-      join64(home, "../usr/bin/claude")
+      join65(home, "../usr/bin/claude")
     ];
     for (const path of commonPaths) {
       if (existsSync46(path)) {
@@ -118027,16 +118748,16 @@ var init_claude_runner = __esm(() => {
 // src/diag-output.ts
 import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync29, unlinkSync as unlinkSync14, writeFileSync as writeFileSync28 } from "fs";
 import { homedir as homedir43 } from "os";
-import { join as join65 } from "path";
+import { join as join66 } from "path";
 function getClaudishDir() {
-  const dir = join65(homedir43(), ".claudish");
+  const dir = join66(homedir43(), ".claudish");
   try {
     mkdirSync29(dir, { recursive: true });
   } catch {}
   return dir;
 }
 function getDiagLogPath() {
-  return join65(getClaudishDir(), `diag-${process.pid}.log`);
+  return join66(getClaudishDir(), `diag-${process.pid}.log`);
 }
 
 class LogFileDiagOutput {
@@ -120698,7 +121419,7 @@ init_op_source();
 init_startup_trace();
 init_picker_cancelled();
 import { existsSync as existsSync47, readFileSync as readFileSync53 } from "fs";
-import { join as join66, resolve as resolve11 } from "path";
+import { join as join67, resolve as resolve12 } from "path";
 
 // src/tui/runtime/should-open-picker.ts
 function noModelConfigured(gate) {
@@ -120715,7 +121436,7 @@ function requiresExplicitModel(gate, tty) {
 var autoloadDropped = [...droppedAtLaunch, ...takeLauncherDropped(process.env)];
 var dotenvText;
 try {
-  dotenvText = readFileSync53(join66(process.cwd(), ".env"));
+  dotenvText = readFileSync53(join67(process.cwd(), ".env"));
 } catch {}
 if (dotenvText !== undefined) {
   await Promise.resolve().then(() => init_dotenv_allowlist());
@@ -120830,7 +121551,7 @@ async function applyOpImport() {
 async function applyConfigOverride() {
   await Promise.resolve();
   const plan = planConfigOverride(process.argv.slice(2), process.env, {
-    resolve: resolve11,
+    resolve: resolve12,
     exists: existsSync47
   });
   if (plan.kind === "none")
@@ -121063,7 +121784,7 @@ async function runCli() {
         process.exit(1);
       }
       const mode = cliConfig.teamMode ?? "default";
-      const sessionPath = join66(process.cwd(), `.claudish-team-${Date.now()}`);
+      const sessionPath = join67(process.cwd(), `.claudish-team-${Date.now()}`);
       if (mode === "json") {
         await Promise.resolve().then(() => init_pane());
         await Promise.resolve().then(() => init_team_orchestrator());
@@ -121083,7 +121804,7 @@ async function runCli() {
         const status = await runModels(sessionPath);
         const result = { ...status, responses: {} };
         for (const anonId of Object.keys(status.models)) {
-          const responsePath = join66(sessionPath, `response-${anonId}.md`);
+          const responsePath = join67(sessionPath, `response-${anonId}.md`);
           try {
             const raw = readFileSync53(responsePath, "utf-8").trim();
             try {