claudish 14.5.2 → 14.6.0

package/dist/index.js

@@ -4266,6 +4266,67 @@ var init_zod = __esm(() => {
   init_external();
 });
 
+// src/auth/accounts/account-label.ts
+function cleanPlan(plan) {
+  const cleaned = (plan ?? "").toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, PLAN_MAX);
+  return cleaned || undefined;
+}
+function labelTaken(taken, label) {
+  const wanted = label.toLowerCase();
+  for (const existing of taken)
+    if (existing.toLowerCase() === wanted)
+      return true;
+  return false;
+}
+function emailMatches(rowEmail, selector) {
+  return rowEmail !== undefined && rowEmail.toLowerCase() === selector.toLowerCase();
+}
+function shellWord(label) {
+  if (/^[\w@+.-]+$/.test(label))
+    return label;
+  return `'${label.replace(/'/g, `'\\''`)}'`;
+}
+function baseOf(input) {
+  const fromEmail = (input.email ?? "").trim().toLowerCase().replace(/[^a-z0-9_@+.-]/g, "_").replace(/^\W+/, "");
+  if (fromEmail)
+    return fromEmail.slice(0, ACCOUNT_LABEL_MAX);
+  return (input.chatgptAccountId ?? "").toLowerCase().replace(/[^a-z0-9_-]/g, "").replace(/^\W+/, "").slice(0, 8);
+}
+function fit(base, suffix) {
+  return base.slice(0, ACCOUNT_LABEL_MAX - suffix.length).replace(/[.\-+@]+$/, "") + suffix;
+}
+function deriveAccountLabel(input) {
+  const base = baseOf(input);
+  if (!base)
+    throw new Error("The login carries no email or account id; pass --label.");
+  const taken = new Set;
+  for (const label of input.taken)
+    taken.add(label.toLowerCase());
+  const plan = cleanPlan(input.plan);
+  const planSuffix = plan ? `-${plan}` : "";
+  function* candidates() {
+    yield fit(base, "");
+    if (plan)
+      yield fit(base, planSuffix);
+    for (let n = 2;n <= NUMBER_MAX; n++)
+      yield fit(base, `${planSuffix}-${n}`);
+  }
+  for (const candidate of candidates()) {
+    if (taken.has(candidate.toLowerCase()))
+      continue;
+    if (!ACCOUNT_LABEL_PATTERN.test(candidate)) {
+      throw new Error(`The derived label "${candidate}" is not valid; pass --label.`);
+    }
+    return candidate;
+  }
+  throw new Error("Could not derive an unused label; pass --label.");
+}
+var ACCOUNT_LABEL_MAX = 64, ACCOUNT_LABEL_PATTERN, ACCOUNT_LABEL_RULE, PLAN_MAX = 16, NUMBER_MAX = 999;
+var init_account_label = __esm(() => {
+  ACCOUNT_LABEL_PATTERN = /^\w[\w@+. -]{0,63}$/;
+  ACCOUNT_LABEL_RULE = "An account label starts with a letter, digit or underscore and has at most 64 letters, " + "digits, spaces, and the characters _ @ + . -";
+});
+
 // src/auth/quota/codex-window-slots.ts
 var CODEX_WINDOW_SLOTS;
 var init_codex_window_slots = __esm(() => {
@@ -4326,6 +4387,7 @@ function requireWireApiForTransport(transport, wire, ctx) {
 var CustomEndpointAuthSchemeSchema, WireValueSchema, WirePointerSchema, WireAssignmentSchema, CustomEndpointWireSchema, CustomEndpointSimpleSchema, CustomEndpointComplexSchema, CustomEndpointSchema, PredefinedEndpointsConfigSchema, AccountIdentitySchema, AccountStoreKindSchema, SubscriptionAccountSchema, CodexWindowSlotSchema, SubscriptionAccountsEntrySchema, SubscriptionAccountsSchema;
 var init_config_schema = __esm(() => {
   init_zod();
+  init_account_label();
   init_codex_window_slots();
   CustomEndpointAuthSchemeSchema = _enum(["bearer", "x-api-key", "none"]);
   WireValueSchema = union([string2(), number2(), boolean2()]);
@@ -4392,7 +4454,7 @@ var init_config_schema = __esm(() => {
   AccountStoreKindSchema = _enum(["keychain", "file", "legacy-codex-file"]);
   SubscriptionAccountSchema = object({
     id: string2().regex(/^[a-z0-9]{12}$/, "account ids are generated, 12 lowercase alphanumerics"),
-    label: string2().regex(/^[\w][\w .-]{0,31}$/, "labels are 1-32 word characters, . - or space"),
+    label: string2().regex(ACCOUNT_LABEL_PATTERN, ACCOUNT_LABEL_RULE),
     identity: AccountIdentitySchema.optional(),
     store: AccountStoreKindSchema,
     enabled: boolean2().optional(),
@@ -4586,12 +4648,12 @@ function isAccountProvider(value) {
 function sameAccount(a, b) {
   return a.provider === b.provider && a.id === b.id;
 }
-var ACCOUNT_PROVIDERS, DEFAULT_SWITCH_AT = 0.9, ACCOUNT_ID_PATTERN, LEGACY_CODEX_ACCOUNT_ID = "legacy-codex", ACCOUNT_LABEL_PATTERN;
+var ACCOUNT_PROVIDERS, DEFAULT_SWITCH_AT = 0.9, ACCOUNT_ID_PATTERN, LEGACY_CODEX_ACCOUNT_ID = "legacy-codex";
 var init_types = __esm(() => {
   init_errors3();
+  init_account_label();
   ACCOUNT_PROVIDERS = ["native-anthropic", "openai-codex"];
   ACCOUNT_ID_PATTERN = /^[a-z0-9]{12}$/;
-  ACCOUNT_LABEL_PATTERN = /^[\w][\w .-]{0,31}$/;
 });
 
 // src/auth/accounts/config-validation.ts
@@ -5332,7 +5394,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "14.5.2";
+var VERSION = "14.6.0";
 
 // src/redact.ts
 function isPlaceholder(value) {
@@ -24516,7 +24578,7 @@ function vendorName(provider) {
 }
 function loginCommandFor(ref) {
   const vendor = ref.provider === "openai-codex" ? "codex" : "claude";
-  return `claudish account login ${vendor} ${ref.label}`;
+  return `claudish account login ${vendor} ${shellWord(ref.label)}`;
 }
 function rethrowSelectionFailure(err) {
   if (classifyConnectionError(err) || isAccountsError(err))
@@ -24927,6 +24989,7 @@ var LEASE_FAILURE_DEPRIORITIZE_MS = 60000, AccountChangedDuringLeaseError, pools
 var init_pool = __esm(() => {
   init_connection_error();
   init_logger();
+  init_account_label();
   init_allowance_service();
   init_exchange();
   init_paths();
@@ -43758,7 +43821,7 @@ function assertLegacyCodexLogoutPermitted(configPath = activeConfigFile()) {
     const rows = codexEntry(raw)?.accounts ?? [];
     if (rows.length > 0) {
       const legacy = rows.find((row) => row.store === "legacy-codex-file");
-      throw new Error(legacy ? `The legacy Codex login is account ${legacy.label}. Remove it with ` + `\`claudish account remove codex ${legacy.label} --delete-file\`.` : "Codex accounts are managed by `claudish account`; remove one with " + "`claudish account remove codex <label>`.");
+      throw new Error(legacy ? `The legacy Codex login is account ${legacy.label}. Remove it with ` + `\`claudish account remove codex ${shellWord(legacy.label)} --delete-file\`.` : "Codex accounts are managed by `claudish account`; remove one with " + "`claudish account remove codex <label>`.");
     }
     return { config: raw, result: undefined };
   });
@@ -43783,10 +43846,23 @@ async function saveLegacyCodexLogin(write, opts = {}) {
     }
   }
 }
-function display(identity) {
+function display(identity, label) {
   const raw = identity.email || identity.chatgptAccountId || "identity unavailable";
-  const shown = [...raw].filter((ch) => ch.charCodeAt(0) > 31 && ch !== "\x7F").join("");
-  return identity.plan ? `${shown}, ${identity.plan}` : shown;
+  const shown = [...raw].filter((ch) => {
+    const code = ch.charCodeAt(0);
+    return code > 31 && !(code >= 127 && code <= 159);
+  }).join("");
+  const text = identity.email && label.toLowerCase() === identity.email.toLowerCase() ? "" : shown;
+  if (!identity.plan)
+    return text;
+  return text ? `${text}, ${identity.plan}` : identity.plan;
+}
+function note(identity, label) {
+  const text = display(identity, label);
+  return text ? ` (${text})` : "";
+}
+function named(row) {
+  return row.legacy ? `${row.label} (legacy login)` : `${row.label} (id ${row.id})`;
 }
 function stableIdentity(identity) {
   const stable = identity.chatgptAccountId?.trim();
@@ -43796,8 +43872,16 @@ function stableIdentity(identity) {
   return stable;
 }
 function validLabel(label) {
-  if (!ACCOUNT_LABEL_PATTERN.test(label)) {
-    throw new Error("An account label starts with a letter, digit or underscore and has at most 32 letters, " + "digits, spaces, dots, underscores or hyphens.");
+  if (!ACCOUNT_LABEL_PATTERN.test(label))
+    throw new Error(ACCOUNT_LABEL_RULE);
+}
+function validSelector(selector) {
+  const control = [...selector].some((ch) => {
+    const code = ch.charCodeAt(0);
+    return code <= 31 || code >= 127 && code <= 159;
+  });
+  if (selector.length < 1 || selector.length > 254 || control) {
+    throw new Error("An account selector is a label or an email: 1 to 254 characters, no control characters.");
   }
 }
 function asRecord(row) {
@@ -43848,16 +43932,41 @@ class CodexAccountManagement {
       result: read(codexEntry(raw) ?? { generation: 0, accounts: [] })
     }));
   }
-  resolve(entry, target) {
+  rowsOf(entry) {
     const rows = entry.accounts.map(asRecord);
     const legacy = this.synthesizedLegacy(entry);
     if (legacy)
       rows.push(legacy);
+    return rows;
+  }
+  resolve(entry, target) {
+    const rows = this.rowsOf(entry);
     const matches = rows.filter((row) => (target.id === undefined || row.id === target.id) && (target.label === undefined || row.label === target.label));
     if (matches.length === 1)
       return matches[0];
     throw new Error(matches.length > 1 ? "Ambiguous Codex account; name it with --id <generated-id>." : "No such Codex account; run `claudish account list`.");
   }
+  select(entry, target) {
+    const rows = this.rowsOf(entry).filter((row) => target.id === undefined || row.id === target.id);
+    const { selector } = target;
+    if (selector === undefined) {
+      if (rows.length === 1)
+        return rows[0];
+      throw new Error("No such Codex account; run `claudish account list`.");
+    }
+    const exact = rows.filter((row) => row.label === selector);
+    if (exact.length === 1)
+      return exact[0];
+    if (exact.length > 1) {
+      throw new Error("Ambiguous Codex account; name it with --id <generated-id>.");
+    }
+    const byEmail = rows.filter((row) => emailMatches(row.identity.email, selector));
+    if (byEmail.length === 1)
+      return byEmail[0];
+    if (byEmail.length === 0)
+      throw new Error("No such Codex account; run `claudish account list`.");
+    throw new Error(`More than one Codex account has the email ${selector}: ${byEmail.map(named).join(", ")}. ` + "Name one by label, or pass --id <generated-id>." + (byEmail.some((row) => row.legacy) ? " The legacy login has no --id; name it by its label." : ""));
+  }
   newId(entry, reserved) {
     for (let attempt = 0;attempt < 16; attempt++) {
       const id = this.deps.newId?.() ?? randomBytes8(6).toString("hex");
@@ -43869,21 +43978,39 @@ class CodexAccountManagement {
     throw new Error("Could not generate an unused account id.");
   }
   refuseDuplicate(entry, identity, label, except) {
+    const rows = this.rowsOf(entry);
+    for (const row of rows) {
+      if (row.id !== except && row.label === label) {
+        throw new Error(`A Codex account labelled ${label} already exists.`);
+      }
+    }
+    this.refuseIdentity(rows, identity, except);
+  }
+  refuseIdentity(rows, identity, except) {
     const stable = stableIdentity(identity);
-    const rows = entry.accounts.map(asRecord);
-    const legacy = this.synthesizedLegacy(entry);
-    if (legacy)
-      rows.push(legacy);
     for (const row of rows) {
       if (row.id === except)
         continue;
-      if (row.label === label)
-        throw new Error(`A Codex account labelled ${label} already exists.`);
       if (row.identity.chatgptAccountId === stable) {
         throw new Error(`This Codex identity is already registered as ${row.label}.`);
       }
     }
   }
+  chooseLabel(rows, identity, explicit) {
+    const taken = rows.map((row) => row.label);
+    if (explicit !== undefined) {
+      if (labelTaken(taken, explicit)) {
+        throw new Error(`A Codex account labelled ${explicit} already exists.`);
+      }
+      return explicit;
+    }
+    return deriveAccountLabel({
+      email: identity.email,
+      plan: identity.plan,
+      chatgptAccountId: identity.chatgptAccountId,
+      taken
+    });
+  }
   store(kind) {
     return this.deps.store?.(kind) ?? storeFor(kind, this.env);
   }
@@ -43936,30 +44063,35 @@ class CodexAccountManagement {
     };
   }
   async run(command) {
-    if (command.label !== undefined)
-      validLabel(command.label);
-    if (command.verb === "add")
+    if (command.verb === "add") {
+      if (command.label !== undefined)
+        validLabel(command.label);
       return this.add(command.label);
+    }
+    if (command.verb === "rename")
+      validLabel(command.newLabel);
     if (command.id !== undefined && !ACCOUNT_ID_PATTERN.test(command.id)) {
       throw new Error("--id takes a generated account id, as `claudish account list --json` shows.");
     }
-    if (command.label === undefined && command.id === undefined) {
-      throw new Error("Name the Codex account by label, or with --id <generated-id>.");
+    if (command.selector === undefined && command.id === undefined) {
+      throw new Error("Name the Codex account by label or email, or with --id <generated-id>.");
     }
-    const target = this.inspect((entry) => this.resolve(entry, command));
+    if (command.selector !== undefined)
+      validSelector(command.selector);
+    const target = this.inspect((entry) => this.select(entry, command));
     if (command.verb === "login")
       return this.login(target);
+    if (command.verb === "rename")
+      return this.rename(target, command.newLabel);
     if (command.verb === "remove")
       return this.remove(target, command);
     return this.setEnabled(target, command.verb === "enable");
   }
   async add(requestedLabel) {
-    const label = requestedLabel ?? await (this.deps.label ?? (() => dist_default3({ message: "Codex account label:" })))();
-    validLabel(label);
     const initial = this.inspect((entry) => {
       const legacy = this.synthesizedLegacy(entry);
-      if (entry.accounts.some((row) => row.label === label) || legacy?.label === label) {
-        throw new Error(`A Codex account labelled ${label} already exists.`);
+      if (requestedLabel !== undefined && labelTaken(this.rowsOf(entry).map((r) => r.label), requestedLabel)) {
+        throw new Error(`A Codex account labelled ${requestedLabel} already exists.`);
       }
       if (legacy && !legacy.identity.chatgptAccountId) {
         throw new Error("The legacy Codex login records no account id, so enrolling it cannot be checked for duplicates. Run `claudish login codex` once to refresh it, then retry.");
@@ -43971,26 +44103,29 @@ class CodexAccountManagement {
     }
     const acceptedAt = new Date(this.now()).toISOString();
     if (initial.legacy) {
-      this.print(`This add also enrolls your working legacy login as ${initial.legacy.label} (${display(initial.legacy.identity)}), store legacy-codex-file. Its credential file stays where it is and is not copied.`);
+      this.print(`This add also enrolls your working legacy login as ${initial.legacy.label}${note(initial.legacy.identity, initial.legacy.label)}, store legacy-codex-file. Its credential file stays where it is and is not copied.`);
     }
     const store = this.deps.newStore?.() ?? defaultAccountStore(this.env);
-    this.print(`New Codex account ${label}; store: ${store.kind}.` + (store.kind === "file" ? " Warning: its tokens are kept in plaintext files readable only by you (0600)." : ""));
+    this.print(`New Codex account${requestedLabel === undefined ? "" : ` ${requestedLabel}`}; store: ${store.kind}.` + (store.kind === "file" ? " Warning: its tokens are kept in plaintext files readable only by you (0600)." : ""));
     const result = await (this.deps.pkce ?? loginCodexPkce)();
     stableIdentity(result.identity);
     const row = {
       id: initial.id,
-      label,
+      label: "",
       identity: result.identity,
       store: store.kind,
       enabled: true,
       addedAt: new Date(this.now()).toISOString()
     };
     const record = asRecord(row);
+    let finalLabel = "";
     await this.gate(record, async (holds) => {
       this.inspect((entry) => {
         if (entry.accounts.some((a) => a.id === row.id))
           throw new Error("The generated account id is taken; retry the add.");
-        this.refuseDuplicate(entry, result.identity, label);
+        const rows = this.rowsOf(entry);
+        this.refuseIdentity(rows, result.identity);
+        this.chooseLabel(rows, result.identity, requestedLabel);
       });
       if (await store.read(record, { uncached: true })) {
         throw new Error("A token item already exists for the generated account id; retry the add.");
@@ -44003,8 +44138,10 @@ class CodexAccountManagement {
           this.fence(holds);
           if (entry.accounts.some((a) => a.id === row.id))
             throw new Error("The generated account id is taken; retry the add.");
-          this.refuseDuplicate(entry, result.identity, label);
-          const legacy = this.synthesizedLegacy(entry);
+          const rows = this.rowsOf(entry);
+          this.refuseIdentity(rows, result.identity);
+          const label = this.chooseLabel(rows, result.identity, requestedLabel);
+          const legacy = rows.find((r) => r.legacy);
           if (legacy) {
             if (legacy.identity.chatgptAccountId !== initial.legacy?.identity.chatgptAccountId) {
               throw new Error("The legacy Codex login changed during the add; retry to confirm its enrollment.");
@@ -44018,15 +44155,18 @@ class CodexAccountManagement {
               addedAt: legacy.addedAt
             });
           }
-          entry.accounts.push(row);
+          entry.accounts.push({ ...row, label });
           entry.noticeAcceptedAt ??= acceptedAt;
+          finalLabel = label;
         });
       } catch (error) {
         await this.cleanupUnpublished(store, record, error);
       }
     });
     await this.invalidate();
-    return [`Added Codex account ${label} (${display(result.identity)}); store: ${store.kind}.`];
+    return [
+      `Added Codex account ${finalLabel}${note(result.identity, finalLabel)}; store: ${store.kind}.`
+    ];
   }
   async cleanupUnpublished(store, record, error) {
     let published;
@@ -44052,9 +44192,9 @@ class CodexAccountManagement {
       else
         await (await Promise.resolve().then(() => (init_codex_oauth(), exports_codex_oauth))).CodexOAuth.getInstance().login();
       await this.invalidate();
-      return [`Codex account ${target.label}: login saved.`];
+      return [`Codex account ${named(target)}: login saved.`];
     }
-    this.print(`Logging in Codex account ${target.label}; store: ${target.store}.`);
+    this.print(`Logging in Codex account ${named(target)}; store: ${target.store}.`);
     const result = await (this.deps.pkce ?? loginCodexPkce)();
     const stable = stableIdentity(result.identity);
     if (target.identity.chatgptAccountId && stable !== target.identity.chatgptAccountId) {
@@ -44081,12 +44221,12 @@ class CodexAccountManagement {
     });
     await this.invalidate();
     return [
-      `Codex account ${target.label} (${display(result.identity)}): login saved; store: ${target.store}. A recorded needs-login mark clears on the account's next use.`
+      `Codex account ${named(target)}${note(result.identity, target.label)}: login saved; store: ${target.store}. A recorded needs-login mark clears on the account's next use.`
     ];
   }
   async setEnabled(target, enabled) {
     if (target.legacy) {
-      this.print(`This enrolls your legacy login ${target.label} (${display(target.identity)}) as a configured account, store legacy-codex-file; its credential file stays where it is.`);
+      this.print(`This enrolls your legacy login ${named(target)}${note(target.identity, target.label)} as a configured account, store legacy-codex-file; its credential file stays where it is.`);
     }
     let changed = false;
     let poolDisabled = false;
@@ -44115,7 +44255,7 @@ class CodexAccountManagement {
     if (changed)
       await this.invalidate();
     const lines = [
-      `Codex account ${target.label} ${changed ? "" : "is already "}${enabled ? "enabled" : "disabled"}.`
+      `Codex account ${named(target)} ${changed ? "" : "is already "}${enabled ? "enabled" : "disabled"}.`
     ];
     if (!enabled) {
       lines.push("Configured Codex accounts still reserve the subscription: with no enabled account, Codex requests fail visibly instead of using OPENAI_CODEX_API_KEY.");
@@ -44125,6 +44265,52 @@ class CodexAccountManagement {
     }
     return lines;
   }
+  async rename(target, newLabel) {
+    if (target.legacy) {
+      if (target.label === newLabel) {
+        return [`Codex account ${named(target)} is already labelled ${newLabel}.`];
+      }
+      if (!target.identity.chatgptAccountId) {
+        throw new Error("The legacy Codex login records no account id, so enrolling it cannot be checked for duplicates. Run `claudish login codex` once to refresh it, then retry.");
+      }
+    }
+    let changed = false;
+    await this.gate(target, async (holds) => {
+      changed = mutateAccountsConfig(this.configPath(), PROVIDER, (entry) => {
+        this.fence(holds);
+        const current = this.resolve(entry, target.legacy ? { label: target.label } : { id: target.id });
+        sameTarget(current, target);
+        if (current.label === newLabel)
+          return;
+        const others = this.rowsOf(entry).filter((row) => row.id !== current.id).map((row) => row.label);
+        if (labelTaken(others, newLabel)) {
+          throw new Error(`A Codex account labelled ${newLabel} already exists.`);
+        }
+        if (current.legacy) {
+          entry.accounts.push({
+            id: this.newId(entry),
+            label: newLabel,
+            identity: current.identity,
+            store: "legacy-codex-file",
+            enabled: true,
+            addedAt: current.addedAt
+          });
+          return;
+        }
+        const row = entry.accounts.find((a) => a.id === target.id);
+        if (row)
+          row.label = newLabel;
+      });
+    });
+    if (changed)
+      await this.invalidate();
+    if (changed && target.legacy) {
+      this.print(`This enrolled your legacy login ${named(target)}${note(target.identity, target.label)} as a configured account, store legacy-codex-file; its credential file stays where it is.`);
+    }
+    return [
+      changed ? `Renamed Codex account ${named(target)} to ${newLabel}.` : `Codex account ${named(target)} is already labelled ${newLabel}.`
+    ];
+  }
   async remove(target, command) {
     const legacyFile = target.store === "legacy-codex-file";
     if (legacyFile && !command.deleteFile) {
@@ -44133,7 +44319,7 @@ class CodexAccountManagement {
     if (!legacyFile && command.deleteFile) {
       throw new Error(`--delete-file applies only to the legacy Codex login, not ${target.label}.`);
     }
-    if (!command.yes && !await this.ask(`Remove Codex account ${target.label} (${display(target.identity)})${legacyFile ? " and delete its legacy credential file" : ""}? Requests already in flight cannot be recalled.`)) {
+    if (!command.yes && !await this.ask(`Remove Codex account ${named(target)}${note(target.identity, target.label)}${legacyFile ? " and delete its legacy credential file" : ""}? Requests already in flight cannot be recalled.`)) {
       return ["Cancelled; no account was removed."];
     }
     const warnings = [];
@@ -44175,7 +44361,7 @@ class CodexAccountManagement {
       key: "OPENAI_CODEX_API_KEY if one is configured, otherwise none"
     }[next];
     return [
-      `Removed Codex account ${target.label} (${display(target.identity)}). Next Codex credential for new requests: ${nextText}.`,
+      `Removed Codex account ${named(target)}${note(target.identity, target.label)}. Next Codex credential for new requests: ${nextText}.`,
       ...next === "key" ? ["Warning: new Codex requests may now use OPENAI_CODEX_API_KEY, billed per token."] : [],
       ...warnings
     ];
@@ -44189,6 +44375,7 @@ var init_management = __esm(() => {
   init_dist12();
   init_profile_config();
   init_codex_pkce();
+  init_account_label();
   init_config_lock();
   init_file_lock();
   init_paths();
@@ -89664,10 +89851,12 @@ ${h("SUBCOMMANDS")}
   ${bold("Subscription accounts:")}
     ${green("claudish account list")}                 Configured subscription accounts, per claudish provider
     ${green("claudish account status")} ${yellow("[--json]")}       Usage per window, thresholds and blockers
-    ${green("claudish account add codex")} ${yellow("[--label <label>]")}     Log in a Codex account you own and add it
+    ${green("claudish account add codex")} ${yellow("[--label <label>]")}     Log in a Codex account you own and add it ${dim("(label defaults to the login's email)")}
     ${green("claudish account login codex")} ${yellow("<label>")}         Log the same Codex identity in again
     ${green("claudish account enable|disable codex")} ${yellow("<label>")} Include or skip it in selection
+    ${green("claudish account rename codex")} ${yellow("<label> <new-label>")}  Give an account a new label
     ${green("claudish account remove codex")} ${yellow("<label> [--yes] [--delete-file]")}
+    ${dim("A <label> may also be the account's email.")}
     ${dim("--id <generated-id> may replace or confirm a label. Removing the legacy login (default)")}
     ${dim("requires --delete-file. New accounts use the macOS Keychain, or protected plaintext files")}
     ${dim("where there is none. No token input or export; Claude account mutations are not available.")}
@@ -104220,7 +104409,7 @@ function renderRow2(row, pool, now) {
     lines.push(`      ${warn2(formatReset(row.blocker.resetAt, now, row.blocker.estimated === true))}`);
   }
   if (row.blocker?.kind === "needs-reauth") {
-    lines.push(`      ${bad2("needs login")}: run \`claudish account login ${vendorOf(row.ref.provider)} ${row.record.label}\``);
+    lines.push(`      ${bad2("needs login")}: run \`claudish account login ${vendorOf(row.ref.provider)} ${shellWord(row.record.label)}\``);
     if (row.state.needsReauth?.lastReason) {
       lines.push(`      ${dim4(row.state.needsReauth.lastReason)}`);
     }
@@ -104295,7 +104484,7 @@ ${strong2(vendorOf(report.provider))}`);
   if (!any) {
     console.log(`
 No subscription accounts are configured.`);
-    console.log(dim4("A Codex login (`claudish login codex`) is shown here as `default (legacy file)` " + "once it exists; add an account with `claudish account add codex --label <label>`."));
+    console.log(dim4("A Codex login (`claudish login codex`) is shown here as `default (legacy file)` " + "once it exists; add an account with `claudish account add codex`."));
   }
   console.log("");
 }
@@ -104378,12 +104567,24 @@ function parseAccountMutation(args) {
       throw usage2("account add codex takes no positional argument; use --label.");
     return { verb: v, label: values.get("--label") };
   }
+  if (v === "rename") {
+    const hasId = values.has("--id");
+    if (positional.length === 2 || positional.length === 1 && hasId) {
+      return {
+        verb: v,
+        selector: positional.length === 2 ? positional[0] : undefined,
+        id: values.get("--id"),
+        newLabel: positional[positional.length - 1]
+      };
+    }
+    throw usage2("account rename codex needs <label> <new-label>, or --id <generated-id> <new-label>.");
+  }
   if (positional.length > 1)
     throw usage2(`account ${v} codex names one account.`);
   if (positional.length === 0 && !values.has("--id")) {
     throw usage2(`account ${v} codex needs a label or --id <generated-id>.`);
   }
-  const target = { label: positional[0], id: values.get("--id") };
+  const target = { selector: positional[0], id: values.get("--id") };
   if (v === "remove") {
     return { verb: v, ...target, yes: flags.has("--yes"), deleteFile: flags.has("--delete-file") };
   }
@@ -104488,8 +104689,11 @@ var ACCOUNT_HELP = `Usage:
   claudish account forecast [--json] [--horizon <h|d>] [--provider codex]
   claudish account add codex [--label <label>]
   claudish account login|enable|disable codex <label> [--id <generated-id>]
+  claudish account rename codex <label> <new-label> [--id <generated-id>]
   claudish account remove codex <label> [--id <generated-id>] [--yes] [--delete-file]
 
+--label on add is optional and overrides the default, the login's email.
+A command that takes <label> also takes the account's email.
 --id <generated-id> may replace or confirm the label; labels are unique per claudish provider.
 Removing the legacy login (default, legacy-codex-file) requires --delete-file.
 New accounts use the macOS Keychain, or protected plaintext files where there is none.
@@ -104503,13 +104707,14 @@ The allowance trajectory, alerts and sessions of a claudish provider's account p
   --horizon <h|d>     how far ahead to project, 1h to 7d (default 7d)
   --provider codex    the claudish provider (openai-codex); the only one with a model today`;
 var init_account_command = __esm(() => {
+  init_account_label();
   init_policy2();
   init_pool();
   init_registry();
   init_state_store();
   init_types();
   init_ansi();
-  MUTATION_VERBS = ["add", "login", "enable", "disable", "remove"];
+  MUTATION_VERBS = ["add", "login", "enable", "disable", "remove", "rename"];
 });
 
 // src/auth/antigravity-oauth.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudish",
-  "version": "14.5.2",
+  "version": "14.6.0",
   "description": "Run Claude Code with any model - OpenRouter, Ollama, LM Studio & local models",
   "type": "module",
   "main": "./dist/index.js",
@@ -71,10 +71,10 @@
     "ai"
   ],
   "optionalDependencies": {
-    "@claudish/magmux-darwin-arm64": "14.5.2",
-    "@claudish/magmux-darwin-x64": "14.5.2",
-    "@claudish/magmux-linux-arm64": "14.5.2",
-    "@claudish/magmux-linux-x64": "14.5.2"
+    "@claudish/magmux-darwin-arm64": "14.6.0",
+    "@claudish/magmux-darwin-x64": "14.6.0",
+    "@claudish/magmux-linux-arm64": "14.6.0",
+    "@claudish/magmux-linux-x64": "14.6.0"
   },
   "author": "Jack Rudenko <i@madappgang.com>",
   "license": "MIT",