codex-copilot-dx 0.5.6 → 0.6.0

package/README.md

@@ -4,7 +4,8 @@ Use [Codex Desktop](https://openai.com/codex), [Claude Code](https://claude.com/
 
 ## How it works
 
-A single in-process adapter (port `2026`) exposes both APIs over your Copilot subscription:
+A single in-process adapter (port `2026`) exposes both APIs over one Copilot
+account by default, or over isolated Codex and Claude accounts when configured:
 
 - **Codex** -> OpenAI Responses API (`/v1/responses`, `/v1/responses/compact`); Responses-only models and compaction proxy directly, chat models convert to Chat Completions.
 - **Claude Code** -> Anthropic Messages API (`/v1/messages`, `/v1/messages/count_tokens`), translated to/from Chat Completions.
@@ -33,8 +34,8 @@ global install, use `npx codex-copilot-dx@latest`.
 Both installed commands expose the same options and subcommands; help, version,
 doctor, status, and argument-error output use the command name that was invoked.
 
-To query the models currently advertised as selectable for the saved Copilot
-account, run:
+To query the models currently advertised as selectable for the saved Codex
+Copilot account, run:
 
 ```bash
 ccdx models
@@ -48,6 +49,54 @@ being advertised does not guarantee that a later inference request will avoid
 quota, rate-limit, or policy enforcement. `codex-copilot-dx models` is fully
 equivalent.
 
+### Separate GitHub account for Claude
+
+The default remains fully backward compatible: Codex and Claude requests share
+the existing GitHub authentication. To keep an enterprise account for Codex
+while using a different personal account that has Claude models enabled, run:
+
+```bash
+ccdx auth login claude --github-login <personal-github-login>
+```
+
+This is the only command that starts the additional Device Flow. It verifies
+the selected GitHub identity, Copilot entitlement, and an enabled Claude model
+before saving anything. It refuses the current Codex account and never changes,
+migrates, or deletes the existing Codex credential. The optional login pin is
+recommended so authorizing the wrong browser account fails before activation.
+
+The existing Codex token remains at
+`~/.local/share/copilot-api/github_token`. The isolated Claude credential is
+stored with mode `0600` under
+`~/.local/share/copilot-api/profiles/claude/github_token`, with matching account
+metadata committed last. Restart a running adapter after authentication.
+
+Once enabled, routing is fixed by API surface rather than by model name:
+
+- `/v1/responses`, `/v1/responses/compact`, their Chat fallback, and normal
+  `/v1/models` use the Codex account.
+- `/v1/messages` and Claude App model discovery use the isolated Claude account.
+- `/v1/messages/count_tokens` remains local and uses neither account.
+
+The two profiles keep separate service tokens, API bases, refresh/backoff state,
+model endpoint metadata, and model caches. If the isolated Claude profile later
+becomes invalid, Claude requests fail with a reauthentication instruction while
+Codex remains available; CCDX never silently falls back to the enterprise
+account. Reauthorize it explicitly with:
+
+```bash
+ccdx auth login claude --reauth --github-login <personal-github-login>
+```
+
+These commands are read-only and never start Device Flow:
+
+```bash
+ccdx auth status
+ccdx auth status --online
+ccdx models --profile claude
+ccdx doctor --online --profile all
+```
+
 To change the model used by Codex Auto-review, run:
 
 ```bash
@@ -123,6 +172,9 @@ ccdx doctor --online
 ```
 
 The online doctor never starts device flow, scans for replacement tokens, or changes the saved token.
+Use `--profile codex`, `--profile claude`, or `--profile all` to choose which
+account entitlement is checked. Without `--profile`, the legacy Codex check is
+preserved.
 
 To actively verify the protocol path through an already-running adapter, run:
 

package/bin/cli.mjs

@@ -5,8 +5,8 @@ import { ensureCodexConfig } from "../src/config.mjs";
 import { ensureClaudeConfig } from "../src/claude-config.mjs";
 import { applyClaudeDesktopConfig, formatClaudeDesktopApplyResult, generatedClaudeDesktopApiKey, loadManagedClaudeDesktopApiKey, syncManagedClaudeDesktopModels } from "../src/claude-desktop-config.mjs";
 import { startAdapter } from "../src/adapter.mjs";
-import { cacheModelEndpoints, listModels, refreshVSCodeVersion } from "../src/copilot.mjs";
-import { claudeDesktopModelDefsFromCopilotModels, claudeDesktopModelIds, codexAutoReviewModelStatus, gptModelIdsFromCopilotModels, parseModelAliasEnv } from "../src/models.mjs";
+import { defaultCopilotClient, refreshVSCodeVersion } from "../src/copilot.mjs";
+import { claudeDesktopModelIds } from "../src/models.mjs";
 import { status } from "../src/status.mjs";
 import { configureLogging } from "../src/log.mjs";
 import { flushUsageWrites, printUsageSummary } from "../src/usage.mjs";
@@ -14,14 +14,16 @@ import { checkForUpdate, localPackageVersion } from "../src/version.mjs";
 import { runDoctor } from "../src/doctor.mjs";
 import { adapterBaseUrl, checkRunningAdapter } from "../src/running-adapter.mjs";
 import { assertSafeAdapterHost, isLoopbackHost } from "../src/security.mjs";
-import { isValidModelList, loadModelCache, saveModelCache } from "../src/model-cache.mjs";
-import { initializeModelRegistry, runInBackground } from "../src/startup.mjs";
+import { runInBackground } from "../src/startup.mjs";
 import { cliCommandName, cliHelp, parseAdapterProbeOptions, parseCliArgs, parseRuntimeOptions } from "../src/cli-options.mjs";
 import { formatAdapterStatus, readAdapterStatus } from "../src/cli-status.mjs";
 import { closeHttpServer } from "../src/shutdown.mjs";
 import { runAutoReviewModelCommand } from "../src/auto-review-model.mjs";
 import { autoReviewModelPreference } from "../src/user-settings.mjs";
 import { fetchLiveCopilotModels, formatLiveCopilotModels } from "../src/cli-models.mjs";
+import { runAuthCommand } from "../src/cli-auth.mjs";
+import { createProfileRuntime } from "../src/profile-runtime.mjs";
+import { createProfileModelRuntime } from "../src/profile-model-runtime.mjs";
 
 const LOCAL_VERSION = localPackageVersion();
 const CLI_NAME = cliCommandName();
@@ -48,6 +50,29 @@ if (CLI.command === "usage") {
   await printUsageSummary();
   process.exit(0);
 }
+if (CLI.command === "auth") {
+  try {
+    const result = await runAuthCommand({
+      action: CLI.action,
+      profile: CLI.profile,
+      online: CLI.online,
+      reauth: CLI.reauth,
+      expectedLogin: CLI.expectedLogin,
+      commandName: CLI_NAME,
+    });
+    if (result.output) console.log(result.output);
+    if (result.action === "login") {
+      if (!result.changed) {
+        console.log(status("ok", `Claude profile is already configured for ${result.identity?.login || result.identity?.id || "the saved account"}`));
+      }
+      console.log(status("warn", `Restart the running ${CLI_NAME} adapter to activate the Claude profile`));
+    }
+    process.exit(0);
+  } catch (e) {
+    console.error(status("err", e.message));
+    process.exit(1);
+  }
+}
 if (CLI.command === "status") {
   let probe;
   try {
@@ -71,7 +96,7 @@ if (CLI.command === "status") {
 }
 if (CLI.command === "models") {
   try {
-    const catalog = await fetchLiveCopilotModels();
+    const catalog = await fetchLiveCopilotModels({ profile: CLI.profile });
     console.log(formatLiveCopilotModels(catalog, { commandName: CLI_NAME }));
     process.exit(0);
   } catch (e) {
@@ -113,7 +138,6 @@ const MODEL_REFRESH_TIMEOUT_MS = RUNTIME.modelRefreshTimeoutMs;
 const EXISTING_ADAPTER_TIMEOUT_MS = RUNTIME.existingAdapterTimeoutMs;
 const CONFIGURE_CLAUDE_DESKTOP = CLI.configureClaudeDesktop || process.env.CCDX_CONFIGURE_CLAUDE_DESKTOP === "1";
 const LOGGING = configureLogging();
-const MODEL_REGISTRY = { modelDefs: undefined, models: undefined, source: "built-in" };
 let activeServer = null;
 let modelRefreshTimer = null;
 let shuttingDown = false;
@@ -123,88 +147,11 @@ if (LOGGING.filePath) {
   if (LOGGING.level === "debug") console.log(status("debug", "Debug logging enabled"));
 }
 
-function applyModelsToRegistry(models, source, { updateClaudeModels = true } = {}) {
-  if (!isValidModelList(models)) throw new Error("Copilot models response contained no valid models");
-  const modelDefs = updateClaudeModels
-    ? claudeDesktopModelDefsFromCopilotModels(models)
-    : MODEL_REGISTRY.modelDefs;
-  cacheModelEndpoints(models);
-  MODEL_REGISTRY.models = models;
-  if (updateClaudeModels && modelDefs.length) {
-    MODEL_REGISTRY.modelDefs = modelDefs;
-    MODEL_REGISTRY.source = source;
-  }
-  return modelDefs;
-}
-
-function loadCachedModelRegistry() {
-  const cached = loadModelCache();
-  if (!cached) return false;
-  try {
-    const customAliases = parseModelAliasEnv(process.env.CCDX_CLAUDE_MODEL_ALIASES).length > 0;
-    applyModelsToRegistry(cached, "cache", { updateClaudeModels: !customAliases });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function refreshClaudeDesktopModelDefs() {
-  const customAliases = parseModelAliasEnv(process.env.CCDX_CLAUDE_MODEL_ALIASES).length > 0;
-
-  const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), MODEL_REFRESH_TIMEOUT_MS);
-  try {
-    const { status: httpStatus, body } = await listModels({ signal: ctrl.signal });
-    if (httpStatus < 200 || httpStatus >= 300) {
-      throw new Error(`Copilot models returned HTTP ${httpStatus}`);
-    }
-    const models = JSON.parse(body);
-    const autoReview = codexAutoReviewModelStatus(models, process.env, {
-      autoReviewModel: autoReviewModelPreference().model,
-    });
-    if (!autoReview.available) {
-      console.log(status("warn", `Auto-review target ${autoReview.upstreamModel} is unavailable: ${autoReview.reason}. Run ${CLI_NAME} doctor --compat to verify the live path.`));
-    }
-    const gptModelIds = gptModelIdsFromCopilotModels(models);
-    if (gptModelIds.length) {
-      console.log(status("ok", `Refreshed GPT models from GitHub Copilot: ${gptModelIds.join(", ")}`));
-    } else {
-      console.log(status("warn", "Copilot models response contained no GPT models"));
-    }
-
-    const modelDefs = applyModelsToRegistry(models, "live", { updateClaudeModels: !customAliases });
-    try {
-      saveModelCache(models);
-    } catch (e) {
-      console.log(status("warn", `Could not persist the Copilot model cache (${e.message})`));
-    }
-    if (customAliases) {
-      console.log(status("info", "Using CCDX_CLAUDE_MODEL_ALIASES for Claude models"));
-    } else if (modelDefs?.length) {
-      console.log(status("ok", `Refreshed Claude models from GitHub Copilot: ${modelDefs.map((model) => model.id).join(", ")}`));
-    } else {
-      console.log(status("warn", "Copilot models response contained no Claude models; using built-in Claude models"));
-    }
-    syncClaudeDesktopProfileModels(MODEL_REGISTRY.modelDefs);
-    return modelDefs;
-  } catch (e) {
-    const fallback = MODEL_REGISTRY.modelDefs?.length ? `${MODEL_REGISTRY.source} model list` : "built-in model list";
-    const message = ctrl.signal.aborted
-      ? `Model refresh timed out after ${MODEL_REFRESH_TIMEOUT_MS}ms; using ${fallback}`
-      : `Could not refresh model list; using ${fallback} (${e.message})`;
-    console.log(status("warn", message));
-    return MODEL_REGISTRY.modelDefs;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 function currentClaudeDesktopApiKey() {
   return String(process.env.CCDX_CLAUDE_DESKTOP_API_KEY || process.env.CCDX_PROXY_API_KEY || "").trim();
 }
 
-function syncClaudeDesktopProfileModels(modelDefs = MODEL_REGISTRY.modelDefs) {
+function syncClaudeDesktopProfileModels(modelDefs) {
   const result = syncManagedClaudeDesktopModels({
     port: ADAPTER_PORT,
     host: ADAPTER_HOST,
@@ -268,6 +215,7 @@ if (CLI.command === "doctor") {
     host: ADAPTER_HOST,
     online: CLI.online,
     compat: CLI.compat,
+    profile: CLI.profile,
   });
   process.exit(checks.some((check) => check.kind === "err") ? 1 : 0);
 }
@@ -296,14 +244,33 @@ try {
   // Ensure GitHub login, using device flow if no token exists.
   await ensureAuth();
 
+  const profileRuntime = createProfileRuntime({ codexClient: defaultCopilotClient });
+  if (profileRuntime.claudeMode === "isolated") {
+    if (profileRuntime.claudeProfile.valid) {
+      const account = profileRuntime.claudeProfile.identity?.login
+        || profileRuntime.claudeProfile.identity?.id
+        || "the saved account";
+      console.log(status("ok", `Claude requests will use the isolated GitHub account ${account}`));
+    } else {
+      console.log(status("warn", `Claude profile is configured but invalid (${profileRuntime.claudeProfile.reason}); Codex remains available, but Claude requests will fail until you run ${CLI_NAME} auth login claude --reauth and restart`));
+    }
+  }
+
+  const profileModels = createProfileModelRuntime({
+    codexClient: profileRuntime.codexClient,
+    claudeClient: profileRuntime.claudeClient,
+    claudeMode: profileRuntime.claudeMode,
+    claudeCredentialFingerprint: profileRuntime.claudeCredentialFingerprint,
+    timeoutMs: MODEL_REFRESH_TIMEOUT_MS,
+    commandName: CLI_NAME,
+    autoReviewModelResolver: () => autoReviewModelPreference().model,
+    onClaudeModelsChanged: syncClaudeDesktopProfileModels,
+  });
+
   // Refresh the VS Code version in the background; fallback is non-blocking.
   void refreshVSCodeVersion();
-  const modelInitialization = await initializeModelRegistry({
-    loadCached: loadCachedModelRegistry,
-    currentModelDefs: () => MODEL_REGISTRY.modelDefs,
-    refresh: refreshClaudeDesktopModelDefs,
-  });
-  const claudeDesktopModelDefs = modelInitialization.modelDefs;
+  const modelInitialization = await profileModels.initialize();
+  const claudeDesktopModelDefs = modelInitialization.claude.modelDefs;
   syncClaudeDesktopProfileModels(claudeDesktopModelDefs);
 
   if (!isLoopbackHost(ADAPTER_HOST)) {
@@ -327,7 +294,11 @@ try {
     claudeDesktopApiKey,
     claudeDesktopModelDefs,
     autoReviewModelResolver: () => autoReviewModelPreference().model,
-    modelRegistry: MODEL_REGISTRY,
+    codexClient: profileRuntime.codexClient,
+    claudeClient: profileRuntime.claudeClient,
+    codexModelRegistry: profileModels.codexRegistry,
+    claudeModelRegistry: profileModels.claudeRegistry,
+    claudeMode: profileRuntime.claudeMode,
     showRequestId: CLI.showRequestId,
     upstreamTimeoutMs: RUNTIME.upstreamTimeoutMs,
     streamHandshakeTimeoutMs: RUNTIME.streamHandshakeTimeoutMs,
@@ -358,7 +329,7 @@ try {
   const refreshIntervalMs = RUNTIME.modelRefreshIntervalMs;
   if (Number.isFinite(refreshIntervalMs) && refreshIntervalMs > 0) {
     modelRefreshTimer = setInterval(() => {
-      refreshClaudeDesktopModelDefs().catch(() => {});
+      profileModels.refreshAll().catch(() => {});
     }, refreshIntervalMs);
     modelRefreshTimer.unref?.();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "Use Codex Desktop, Claude Code, and Claude App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/adapter.mjs

@@ -1,6 +1,6 @@
 import http from "node:http";
 import { createAnthropicCountTokensHandler, createAnthropicMessagesHandler } from "./anthropic-handler.mjs";
-import { chatCompletions, listModels, responses as copilotResponses, responsesCompact as copilotResponsesCompact } from "./copilot.mjs";
+import { defaultCopilotClient } from "./copilot.mjs";
 import { isValidModelList } from "./model-cache.mjs";
 import { claudeDesktopModelsResponse } from "./models.mjs";
 import {
@@ -90,10 +90,46 @@ export function createAdapterHandler(options = {}) {
     || process.env.CCDX_CLAUDE_DESKTOP_API_KEY
     || process.env.CCDX_PROXY_API_KEY
     || "";
-  const chatCompletionsFn = options.chatCompletionsFn || chatCompletions;
-  const responsesFn = options.responsesFn || copilotResponses;
-  const responsesCompactFn = options.responsesCompactFn || copilotResponsesCompact;
-  const listModelsFn = options.listModelsFn || listModels;
+  const codexClient = options.codexClient || defaultCopilotClient;
+  const hasExplicitClaudeMode = Object.hasOwn(options, "claudeMode");
+  if (hasExplicitClaudeMode && !["inherited", "isolated"].includes(options.claudeMode)) {
+    throw new Error(`Unsupported Claude mode: ${options.claudeMode}`);
+  }
+  if (options.claudeMode === "isolated"
+    && (!options.claudeClient || options.claudeClient === codexClient)) {
+    throw new Error("Isolated Claude mode requires a distinct Claude client");
+  }
+  if (options.claudeMode === "inherited"
+    && options.claudeClient && options.claudeClient !== codexClient) {
+    throw new Error("Inherited Claude mode requires the Codex client");
+  }
+  const claudeClient = options.claudeClient || codexClient;
+  // chatCompletionsFn is retained as a compatibility injection and continues to
+  // override both surfaces in existing tests and embedders. New dual-profile
+  // callers should pass codexClient/claudeClient instead.
+  const codexChatCompletionsFn = options.codexChatCompletionsFn
+    || options.chatCompletionsFn
+    || codexClient.chatCompletions;
+  const claudeChatCompletionsFn = options.claudeChatCompletionsFn
+    || options.chatCompletionsFn
+    || claudeClient.chatCompletions;
+  const responsesFn = options.responsesFn || codexClient.responses;
+  const responsesCompactFn = options.responsesCompactFn || codexClient.responsesCompact;
+  const listModelsFn = options.listModelsFn || codexClient.listModels;
+  const getCachedModelEndpointsFn = options.getCachedModelEndpointsFn
+    || codexClient.getCachedModelEndpoints;
+  const claudeMode = hasExplicitClaudeMode
+    ? options.claudeMode
+    : claudeClient === codexClient ? "inherited" : "isolated";
+  if (claudeMode === "isolated" && options.chatCompletionsFn) {
+    throw new Error("Isolated Claude mode cannot use the shared chatCompletionsFn override; pass codexChatCompletionsFn or claudeChatCompletionsFn explicitly");
+  }
+  const codexModelRegistry = options.codexModelRegistry || options.modelRegistry;
+  const claudeModelRegistry = options.claudeModelRegistry || options.modelRegistry || codexModelRegistry;
+  if (claudeMode === "isolated"
+    && (!options.claudeModelRegistry || claudeModelRegistry === codexModelRegistry)) {
+    throw new Error("Isolated Claude mode requires a distinct Claude model registry");
+  }
   const openAIModelEnv = options.openAIModelEnv || process.env;
   const upstreamTimeoutMs = parsePositiveInteger(options.upstreamTimeoutMs, ADAPTER_RUNTIME_CONFIG.upstreamTimeoutMs);
   const streamHandshakeTimeoutMs = parsePositiveInteger(options.streamHandshakeTimeoutMs, ADAPTER_RUNTIME_CONFIG.streamHandshakeTimeoutMs);
@@ -102,13 +138,14 @@ export function createAdapterHandler(options = {}) {
   const requestMetrics = options.requestMetrics || createRequestMetrics();
   const streamPerformanceMetrics = options.streamPerformanceMetrics || createStreamPerformanceMetrics();
   const claudeDesktopModelOptions = () => {
-    const modelDefs = options.modelRegistry?.modelDefs || options.claudeDesktopModelDefs;
+    const modelDefs = claudeModelRegistry?.modelDefs || options.claudeDesktopModelDefs;
     return Array.isArray(modelDefs) ? { modelDefs } : {};
   };
   const responsesHandler = createResponsesHandler({
     acquireRequest,
     autoReviewModelResolver: options.autoReviewModelResolver,
-    chatCompletionsFn,
+    chatCompletionsFn: codexChatCompletionsFn,
+    getCachedModelEndpointsFn,
     openAIModelEnv,
     responsesPayloadOptions: options.responsesPayloadOptions,
     responsesFn,
@@ -128,7 +165,7 @@ export function createAdapterHandler(options = {}) {
   const anthropicCountTokensHandler = createAnthropicCountTokensHandler({ acquireRequest });
   const anthropicMessagesHandler = createAnthropicMessagesHandler({
     acquireRequest,
-    chatCompletionsFn,
+    chatCompletionsFn: claudeChatCompletionsFn,
     environment: process.env,
     modelOptions: claudeDesktopModelOptions,
     streamHandshakeTimeoutMs,
@@ -148,7 +185,12 @@ export function createAdapterHandler(options = {}) {
         metrics: requestMetrics,
         streamPerformance: streamPerformanceMetrics,
         admission: acquireRequest,
-        modelRegistry: options.modelRegistry,
+        modelRegistry: codexModelRegistry,
+        codexClient,
+        claudeClient,
+        codexModelRegistry,
+        claudeModelRegistry,
+        claudeMode,
       })));
       return;
     }
@@ -181,24 +223,24 @@ export function createAdapterHandler(options = {}) {
             let models;
             try { models = JSON.parse(body); } catch {}
             if (isValidModelList(models)) {
-              if (options.modelRegistry) {
-                options.modelRegistry.models = models;
+              if (codexModelRegistry) {
+                codexModelRegistry.models = models;
               }
               res.writeHead(status, { "Content-Type": "application/json" });
               res.end(body);
               return;
             }
-            if (sendLastKnownGoodModels(res, options.modelRegistry)) return;
+            if (sendLastKnownGoodModels(res, codexModelRegistry)) return;
             sendJsonError(res, httpError("Copilot models response contained no valid models", 502), 502);
             return;
           }
-          if (modelListCanUseLastKnownGood(status) && sendLastKnownGoodModels(res, options.modelRegistry)) return;
+          if (modelListCanUseLastKnownGood(status) && sendLastKnownGoodModels(res, codexModelRegistry)) return;
           res.writeHead(status, { "Content-Type": "application/json" });
           res.end(body);
         })
         .catch((e) => {
           logRequestFailure("Models", e, abort);
-          if (sendLastKnownGoodModels(res, options.modelRegistry)) return;
+          if (sendLastKnownGoodModels(res, codexModelRegistry)) return;
           if (!res.destroyed && !res.writableEnded) {
             if (!res.headersSent) res.writeHead(e?.statusCode || 502);
             res.end(JSON.stringify({ error: e.message }));

package/src/auth-profile.mjs

@@ -0,0 +1,205 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { atomicWriteFileSync } from "./atomic-file.mjs";
+import {
+  githubTokenLockPath,
+  githubTokenMetadataPath,
+  githubTokenPath,
+} from "./auth.mjs";
+import {
+  githubTokenFingerprint,
+  normalizeGithubIdentity,
+} from "./github-identity.mjs";
+import { withFileLock } from "./lock.mjs";
+import { parsePositiveInteger, RUNTIME_DEFAULTS } from "./runtime-config.mjs";
+
+export const AUTH_PROFILE_CODEX = "codex";
+export const AUTH_PROFILE_CLAUDE = "claude";
+
+const AUTH_PROFILES = new Set([AUTH_PROFILE_CODEX, AUTH_PROFILE_CLAUDE]);
+
+function checkedProfile(profile) {
+  const value = String(profile || "").trim().toLowerCase();
+  if (!AUTH_PROFILES.has(value)) throw new Error(`Unsupported authentication profile: ${profile}`);
+  return value;
+}
+
+export function authProfilePaths(profile, { home = os.homedir() } = {}) {
+  const name = checkedProfile(profile);
+  if (name === AUTH_PROFILE_CODEX) {
+    return {
+      profile: name,
+      tokenPath: githubTokenPath(home),
+      metadataPath: githubTokenMetadataPath(home),
+      lockPath: githubTokenLockPath(home),
+    };
+  }
+
+  const directory = path.join(home, ".local", "share", "copilot-api", "profiles", AUTH_PROFILE_CLAUDE);
+  const tokenPath = path.join(directory, "github_token");
+  return {
+    profile: name,
+    tokenPath,
+    metadataPath: `${tokenPath}.account.json`,
+    lockPath: `${tokenPath}.lock`,
+  };
+}
+
+function readOptionalFile(filePath) {
+  try {
+    return { exists: true, data: fs.readFileSync(filePath), mode: fs.statSync(filePath).mode & 0o777 };
+  } catch (error) {
+    if (error?.code === "ENOENT") return { exists: false, data: null, mode: 0o600 };
+    throw error;
+  }
+}
+
+function parsedMetadata(snapshot) {
+  if (!snapshot.exists) return { value: null, malformed: false };
+  try {
+    return { value: JSON.parse(snapshot.data.toString("utf8")), malformed: false };
+  } catch {
+    return { value: null, malformed: true };
+  }
+}
+
+export function readAuthProfileCredentials(profile, { home = os.homedir() } = {}) {
+  const paths = authProfilePaths(profile, { home });
+  const tokenSnapshot = readOptionalFile(paths.tokenPath);
+  const metadataSnapshot = readOptionalFile(paths.metadataPath);
+  const token = tokenSnapshot.exists ? tokenSnapshot.data.toString("utf8").trim() : "";
+  const metadataResult = parsedMetadata(metadataSnapshot);
+  const metadataFingerprint = metadataResult.value?.token_fingerprint;
+  const metadataMatchesToken = Boolean(token)
+    && Boolean(metadataFingerprint)
+    && metadataFingerprint === githubTokenFingerprint(token);
+  const metadataIdentity = normalizeGithubIdentity(metadataResult.value);
+  const identity = metadataMatchesToken ? metadataIdentity : null;
+
+  if (paths.profile === AUTH_PROFILE_CODEX) {
+    const configured = tokenSnapshot.exists;
+    return {
+      profile: paths.profile,
+      configured,
+      valid: configured && Boolean(token),
+      reason: !configured ? "unconfigured" : token ? "" : "empty_token",
+      token,
+      identity,
+      metadata: metadataResult.value,
+      paths,
+    };
+  }
+
+  // Metadata is written last, but any credential artifact reserves the Claude
+  // profile. A partial write must fail closed instead of borrowing Codex.
+  const configured = metadataSnapshot.exists || tokenSnapshot.exists;
+  let reason = "";
+  if (!configured) reason = "unconfigured";
+  else if (!metadataSnapshot.exists) reason = "missing_metadata";
+  else if (metadataResult.malformed) reason = "metadata_malformed";
+  else if (!tokenSnapshot.exists) reason = "missing_token";
+  else if (!token) reason = "empty_token";
+  else if (!metadataIdentity) reason = "metadata_identity_missing";
+  else if (!metadataFingerprint || metadataFingerprint !== githubTokenFingerprint(token)) reason = "token_metadata_mismatch";
+
+  return {
+    profile: paths.profile,
+    configured,
+    valid: configured && !reason,
+    reason,
+    token,
+    identity,
+    metadata: metadataResult.value,
+    paths,
+  };
+}
+
+function lockOptions(env = process.env) {
+  return {
+    timeoutMs: parsePositiveInteger(env.CCDX_TOKEN_LOCK_TIMEOUT_MS, RUNTIME_DEFAULTS.tokenLockTimeoutMs),
+    staleMs: parsePositiveInteger(env.CCDX_TOKEN_LOCK_STALE_MS, RUNTIME_DEFAULTS.tokenLockStaleMs),
+  };
+}
+
+export function withAuthProfileLock(profile, fn, {
+  home = os.homedir(),
+  env = process.env,
+  ...options
+} = {}) {
+  const { lockPath } = authProfilePaths(profile, { home });
+  return withFileLock(lockPath, fn, { ...lockOptions(env), ...options });
+}
+
+function writeSecret(filePath, data, writeFile) {
+  writeFile(filePath, data, { mode: 0o600 });
+  fs.chmodSync(filePath, 0o600);
+}
+
+function restoreSnapshot(filePath, snapshot, writeFile) {
+  if (snapshot.exists) {
+    writeSecret(filePath, snapshot.data, writeFile);
+    return;
+  }
+  try {
+    fs.unlinkSync(filePath);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+export function writeClaudeAuthProfile(token, identity, {
+  home = os.homedir(),
+  now = () => new Date(),
+  writeFile = atomicWriteFileSync,
+} = {}) {
+  const cleanToken = String(token || "").trim();
+  const normalizedIdentity = normalizeGithubIdentity(identity);
+  if (!cleanToken) throw new Error("Claude GitHub token is empty");
+  if (!normalizedIdentity) throw new Error("Claude GitHub account identity is missing");
+
+  const paths = authProfilePaths(AUTH_PROFILE_CLAUDE, { home });
+  const directory = path.dirname(paths.tokenPath);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+
+  const previousToken = readOptionalFile(paths.tokenPath);
+  const previousMetadata = readOptionalFile(paths.metadataPath);
+  const timestamp = now();
+  const updatedAt = timestamp instanceof Date ? timestamp.toISOString() : new Date(timestamp).toISOString();
+  const metadata = `${JSON.stringify({
+    profile: AUTH_PROFILE_CLAUDE,
+    ...normalizedIdentity,
+    token_fingerprint: githubTokenFingerprint(cleanToken),
+    updated_at: updatedAt,
+  }, null, 2)}\n`;
+
+  try {
+    writeSecret(paths.tokenPath, cleanToken, writeFile);
+    // Commit the activation marker last. Readers never observe a configured
+    // Claude profile unless the token and its fingerprint agree.
+    writeSecret(paths.metadataPath, metadata, writeFile);
+  } catch (error) {
+    try {
+      restoreSnapshot(paths.tokenPath, previousToken, writeFile);
+      restoreSnapshot(paths.metadataPath, previousMetadata, writeFile);
+    } catch (rollbackError) {
+      error.rollbackError = rollbackError;
+    }
+    throw error;
+  }
+
+  return {
+    profile: AUTH_PROFILE_CLAUDE,
+    identity: normalizedIdentity,
+    paths,
+  };
+}
+
+export function profileReauthMessage(profile, { home = os.homedir() } = {}) {
+  const name = checkedProfile(profile);
+  if (name === AUTH_PROFILE_CLAUDE) {
+    return "Claude authentication is unavailable. Run `ccdx auth login claude --reauth`, then restart ccdx.";
+  }
+  return `Codex authentication is unavailable at ${authProfilePaths(name, { home }).tokenPath}. Run ccdx again to log in.`;
+}