codexunlimit 0.1.0-web.13 → 0.1.0-web.16

package/account-pool.mjs

@@ -1,161 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import {CodexAccountClient} from './codex-account-client.mjs';
-import {LocalQuota,accountIdentity,rateLimitWindows} from './quota.mjs';
-
-const validId=id=>typeof id==='string'&&/^[a-f0-9-]{36}$/.test(id);
-const failure=code=>Object.assign(Error(code),{status:409});
-function readAuth(file){
-  if(!fs.existsSync(file)||fs.lstatSync(file).isSymbolicLink()||fs.statSync(file).size>131072)throw failure('pool_account_expired');
-  const auth=JSON.parse(fs.readFileSync(file,'utf8').replace(/^\uFEFF/,''));
-  if(typeof auth.tokens?.access_token!=='string'||!/^\S{16,32768}$/.test(auth.tokens.access_token)||auth.OPENAI_API_KEY)throw failure('pool_account_expired');
-  return auth;
-}
-function credentialsOf(auth){
-  const token=auth.tokens.access_token;let claims={};try{claims=JSON.parse(Buffer.from(token.split('.')[1],'base64url'));}catch{}
-  const accountId=auth.tokens.account_id??claims['https://api.openai.com/auth']?.chatgpt_account_id;
-  return {token,accountId:typeof accountId==='string'?accountId:undefined,expiresAt:typeof claims.exp==='number'?claims.exp*1000:null};
-}
-
-export class AccountPool{
-  constructor(state,{privateKey,defaultAccount,clientFactory=(home,options)=>new CodexAccountClient(home,options),now=Date.now}={}){
-    this.state=state;this.db=state.db;this.defaultAccount=defaultAccount;this.clientFactory=clientFactory;this.now=now;this.pending=null;this.closed=false;this.operations=new Map();this.clients=new Set();this.refreshing=new Set();this.quotaErrors=new Map();
-    this.removing=new Set();this.refreshes=new Map();this.key=crypto.createHash('sha256').update(privateKey.export({type:'pkcs8',format:'der'})).update('codexunlimit.account-pool.v1').digest();
-    this.directory=path.join(state.home,'accounts');fs.mkdirSync(this.directory,{recursive:true,mode:0o700});if(fs.lstatSync(this.directory).isSymbolicLink())throw failure('pool_storage_invalid');
-    this.db.exec('CREATE TABLE IF NOT EXISTS pool_accounts(id TEXT PRIMARY KEY,label TEXT NOT NULL,account_ref TEXT,email TEXT,plan TEXT,secret TEXT,state TEXT NOT NULL,created_at INTEGER NOT NULL,last_error TEXT)');
-    this.quota=new LocalQuota(state,{now});
-    for(const row of this.rows()){
-      const file=path.join(this.profile(row.id),'auth.json');
-      if(fs.existsSync(file)){try{this.saveAuth(row.id,readAuth(file));fs.unlinkSync(file);}catch{}}
-      if(!row.secret)this.db.prepare("UPDATE pool_accounts SET state='needs_login',last_error='pool_login_interrupted' WHERE id=? AND secret IS NULL").run(row.id);
-    }
-  }
-  rows(){return this.db.prepare('SELECT * FROM pool_accounts ORDER BY created_at,id').all();}
-  row(id){if(!validId(id))throw failure('pool_account_missing');const row=this.db.prepare('SELECT * FROM pool_accounts WHERE id=?').get(id);if(!row)throw failure('pool_account_missing');return row;}
-  active(){return this.state.get('pool.active')??'codex';}
-  profile(id){
-    if(id!=='codex'&&!validId(id))throw failure('pool_account_missing');
-    const folder=path.join(this.directory,id);if(path.dirname(folder)!==this.directory||fs.existsSync(folder)&&fs.lstatSync(folder).isSymbolicLink())throw failure('pool_storage_invalid');
-    fs.mkdirSync(folder,{recursive:true,mode:0o700});return folder;
-  }
-  encrypt(id,auth){const iv=crypto.randomBytes(12),cipher=crypto.createCipheriv('aes-256-gcm',this.key,iv);cipher.setAAD(Buffer.from(id));const data=Buffer.concat([cipher.update(JSON.stringify(auth),'utf8'),cipher.final()]);return JSON.stringify({iv:iv.toString('base64'),tag:cipher.getAuthTag().toString('base64'),data:data.toString('base64')});}
-  decrypt(row){try{const secret=JSON.parse(row.secret),decipher=crypto.createDecipheriv('aes-256-gcm',this.key,Buffer.from(secret.iv,'base64'));decipher.setAAD(Buffer.from(row.id));decipher.setAuthTag(Buffer.from(secret.tag,'base64'));return JSON.parse(Buffer.concat([decipher.update(Buffer.from(secret.data,'base64')),decipher.final()]));}catch{throw failure('pool_account_expired');}}
-  saveAuth(id,auth,info={}){
-    const identity=accountIdentity(credentialsOf(auth));
-    if(this.db.prepare('SELECT id FROM pool_accounts WHERE account_ref=? AND id<>?').get(identity.ref,id))throw failure('pool_account_exists');
-    const email=typeof info.email==='string'?info.email.slice(0,254):identity.email,plan=typeof info.planType==='string'?info.planType.slice(0,40):identity.plan;
-    this.db.prepare("UPDATE pool_accounts SET secret=?,account_ref=?,email=?,plan=?,state='ready',last_error=NULL WHERE id=?").run(this.encrypt(id,auth),identity.ref,email,plan,id);return identity.ref;
-  }
-  async defaultCredentials(){return this.defaultAccount();}
-  list(){
-    let defaultRow={id:'codex',label:'Tài khoản trong Codex',state:'needs_login',windows:[]};
-    try{const credentials=this.defaultAccount(),identity=accountIdentity(credentials);defaultRow={...defaultRow,...identity,state:'ready',windows:this.quota.read(identity.ref)};delete defaultRow.ref;delete defaultRow.accountId;}catch{}
-    const rows=[defaultRow,...this.rows().map(row=>({id:row.id,label:row.label,email:row.email,plan:row.plan,state:row.state,error:row.last_error,windows:row.account_ref?this.quota.read(row.account_ref):[]}))].map(row=>({...row,active:row.id===this.active(),refreshing:this.refreshing.has(row.id),quotaError:this.quotaErrors.get(row.id)??null}));
-    const pending=this.pending?{accountId:this.pending.accountId,status:this.pending.status,type:this.pending.type,url:this.pending.status==='pending'?this.pending.url:undefined,userCode:this.pending.status==='pending'?this.pending.userCode:undefined,error:this.pending.error,expiresAt:this.pending.expiresAt}:null;
-    return {rows,activeId:this.active(),pending,maxAccounts:10,now:this.now()};
-  }
-  async credentials(id=this.active()){
-    if(this.removing.has(id))throw failure('pool_account_missing');
-    if(id==='codex')return {...await this.defaultCredentials(),poolId:'codex'};
-    const row=this.row(id);if(!row.secret||row.state!=='ready')throw failure('pool_account_expired');
-    let credentials=credentialsOf(this.decrypt(row));
-    if(credentials.expiresAt!==null&&credentials.expiresAt<=this.now()+120000){
-      let refresh=this.refreshes.get(id);if(!refresh){refresh=this.withProfile(id,client=>client.request('account/read',{refreshToken:true}));this.refreshes.set(id,refresh);refresh.finally(()=>{if(this.refreshes.get(id)===refresh)this.refreshes.delete(id);}).catch(()=>{});}
-      await refresh;credentials=credentialsOf(this.decrypt(this.row(id)));
-    }
-    if(credentials.expiresAt!==null&&credentials.expiresAt<=this.now())throw failure('pool_account_expired');
-    return {...credentials,poolId:id};
-  }
-  client(home,options={}){const client=this.clientFactory(home,options);this.clients.add(client);return client;}
-  async closeClient(client){try{await client.close();}finally{this.clients.delete(client);}}
-  withProfile(id,action){
-    if(this.closed)return Promise.reject(failure('pool_runtime_unavailable'));if(this.removing.has(id))return Promise.reject(failure('pool_account_missing'));
-    const previous=this.operations.get(id)??Promise.resolve();
-    const operation=previous.catch(()=>{}).then(async()=>{
-      if(this.closed)throw failure('pool_runtime_unavailable');if(this.removing.has(id))throw failure('pool_account_missing');
-      const row=this.row(id),folder=this.profile(id),file=path.join(folder,'auth.json');
-      if(this.pending?.accountId===id&&this.pending.status==='pending')throw failure('pool_login_pending');
-      if(fs.existsSync(file)&&fs.lstatSync(file).isSymbolicLink())throw failure('pool_storage_invalid');
-      fs.writeFileSync(file,JSON.stringify(this.decrypt(row)),{mode:0o600});
-      let client;
-      try{client=this.client(folder);await client.ready;return await action(client);}
-      finally{
-        if(client)await this.closeClient(client);
-        if(fs.existsSync(file)){try{this.saveAuth(id,readAuth(file));}finally{fs.unlinkSync(file);}}
-      }
-    });
-    this.operations.set(id,operation);operation.finally(()=>{if(this.operations.get(id)===operation)this.operations.delete(id);}).catch(()=>{});return operation;
-  }
-  async select(id){await this.credentials(id);if(this.removing.has(id))throw failure('pool_account_missing');if(id!=='codex')this.row(id);this.state.set('pool.active',id);this.state.set('web.connected',true);return this.list();}
-  rename(id,label){if(typeof label!=='string'||!label.trim()||label.length>60)throw failure('invalid_input');this.row(id);this.db.prepare('UPDATE pool_accounts SET label=? WHERE id=?').run(label.trim(),id);return this.list();}
-  async remove(id){
-    this.row(id);if(this.removing.has(id))throw failure('pool_account_missing');this.removing.add(id);
-    try{
-      if(this.pending?.accountId===id&&this.pending.status==='pending')await this.cancelLogin();await this.operations.get(id)?.catch(()=>{});
-      const folder=this.profile(id);if(path.dirname(fs.realpathSync(folder))!==fs.realpathSync(this.directory))throw failure('pool_storage_invalid');fs.rmSync(folder,{recursive:true,force:true,maxRetries:10,retryDelay:100});
-      this.db.prepare('DELETE FROM pool_accounts WHERE id=?').run(id);if(this.active()===id)this.state.set('pool.active','codex');return this.list();
-    }finally{this.removing.delete(id);}
-  }
-  async startLogin({id,type='chatgpt',label='Tài khoản mới'}={}){
-    if(this.closed)throw failure('pool_runtime_unavailable');if(this.pending?.status==='pending')throw failure('pool_login_pending');
-    if(!['chatgpt','chatgptDeviceCode'].includes(type)||typeof label!=='string'||!label.trim()||label.length>60)throw failure('invalid_input');
-    let prior=null;if(id){if(this.removing.has(id))throw failure('pool_account_missing');prior=this.row(id);}else if(this.rows().length>=10)throw failure('pool_full');
-    const accountId=id??crypto.randomUUID(),folder=this.profile(accountId),file=path.join(folder,'auth.json');
-    await this.operations.get(accountId)?.catch(()=>{});
-    if(!prior)this.db.prepare("INSERT INTO pool_accounts(id,label,state,created_at) VALUES(?,?,'pending',?)").run(accountId,label.trim(),this.now());
-    const pending={accountId,type,status:'pending',expiresAt:this.now()+10*60000,prior};this.pending=pending;
-    let client;
-    try{
-      client=this.client(folder,{onNotification:(method,params)=>{
-        if(method==='account/login/completed'){pending.completion=params;if(pending.loginId&&!pending.task)pending.task=this.finishLogin(pending).catch(()=>{});}
-      }});pending.client=client;
-      const login=await client.request('account/login/start',{type});
-      const url=new URL(login.authUrl??login.verificationUrl);if(url.protocol!=='https:'||!['auth.openai.com','auth0.openai.com'].includes(url.hostname)||url.username||url.password)throw failure('pool_login_unavailable');
-      pending.loginId=login.loginId;pending.url=url.href;pending.userCode=typeof login.userCode==='string'?login.userCode.slice(0,64):undefined;
-      pending.timer=setTimeout(()=>this.cancelLogin('pool_login_expired').catch(()=>{}),10*60000);pending.timer.unref();
-      if(pending.completion&&!pending.task)pending.task=this.finishLogin(pending).catch(()=>{});return this.list();
-    }catch(error){if(client)await this.closeClient(client);if(fs.existsSync(file)&&!fs.lstatSync(file).isSymbolicLink())fs.unlinkSync(file);if(!prior)this.db.prepare('DELETE FROM pool_accounts WHERE id=?').run(accountId);pending.status='failed';pending.error='pool_login_unavailable';throw failure('pool_login_unavailable');}
-  }
-  async finishLogin(pending){
-    if(this.closed||pending!==this.pending||pending.status!=='pending'||pending.finishing||pending.completion?.loginId!==pending.loginId)return;
-    pending.finishing=true;clearTimeout(pending.timer);const file=path.join(this.profile(pending.accountId),'auth.json');
-    try{
-      if(!pending.completion.success)throw failure('pool_login_failed');
-      const result=await pending.client.request('account/read',{refreshToken:false});if(result.account?.type!=='chatgpt')throw failure('pool_login_failed');
-      let limits;try{limits=await pending.client.request('account/rateLimits/read');}catch{}
-      await this.closeClient(pending.client);const auth=readAuth(file),ref=this.saveAuth(pending.accountId,auth,result.account);
-      if(limits)this.quota.save(ref,rateLimitWindows(limits),'account_api');pending.status='complete';
-    }catch(error){pending.status='failed';pending.error=error.message==='pool_account_exists'?'pool_account_exists':'pool_login_failed';await this.closeClient(pending.client);if(!pending.prior)this.db.prepare('DELETE FROM pool_accounts WHERE id=?').run(pending.accountId);}
-    finally{if(fs.existsSync(file)&&!fs.lstatSync(file).isSymbolicLink())fs.unlinkSync(file);}
-  }
-  async cancelLogin(reason=null){
-    const pending=this.pending;if(!pending||pending.status!=='pending')return this.list();
-    if(pending.finishing)throw failure('pool_login_pending');pending.status='cancelled';pending.error=reason;clearTimeout(pending.timer);
-    try{if(pending.loginId)await pending.client.request('account/login/cancel',{loginId:pending.loginId});}catch{}
-    await this.closeClient(pending.client);const file=path.join(this.profile(pending.accountId),'auth.json');if(fs.existsSync(file)&&!fs.lstatSync(file).isSymbolicLink())fs.unlinkSync(file);
-    if(!pending.prior)this.db.prepare('DELETE FROM pool_accounts WHERE id=?').run(pending.accountId);return this.list();
-  }
-  async refreshQuota(id=this.active()){
-    if(this.refreshing.has(id))return this.list();if(id!=='codex')this.row(id);
-    this.refreshing.add(id);this.quotaErrors.delete(id);
-    try{
-      let credentials,limits;
-      if(id==='codex'){
-        credentials=await this.defaultCredentials();if(!credentials.accountId)throw failure('pool_quota_unavailable');
-        const client=this.client(this.profile('codex'),{externalCredentials:()=>this.defaultCredentials()});
-        try{await client.request('account/login/start',{type:'chatgptAuthTokens',accessToken:credentials.token,chatgptAccountId:credentials.accountId});limits=await client.request('account/rateLimits/read');}finally{await this.closeClient(client);}
-      }else{
-        credentials=await this.credentials(id);limits=await this.withProfile(id,client=>client.request('account/rateLimits/read'));
-      }
-      const windows=rateLimitWindows(limits);if(!windows.length)throw failure('pool_quota_unavailable');this.quota.save(accountIdentity(credentials).ref,windows,'account_api');
-    }catch(error){this.quotaErrors.set(id,error.message==='pool_account_expired'?'pool_account_expired':'pool_quota_unavailable');throw failure(this.quotaErrors.get(id));}
-    finally{this.refreshing.delete(id);}
-    return this.list();
-  }
-  observe(credentials,response){try{this.quota.observe(credentials,response);}catch{}}
-  async close(){
-    if(this.pending?.status==='pending'&&!this.pending.finishing)await this.cancelLogin().catch(()=>{});
-    this.closed=true;await Promise.allSettled([...this.clients].map(client=>this.closeClient(client)));await Promise.allSettled([...this.operations.values(),this.pending?.task]);this.key.fill(0);
-  }
-}

package/app.mjs

@@ -1,161 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import {Readable} from 'node:stream';
-import {pipeline} from 'node:stream/promises';
-import {syncCodex,unsyncCodex,codexConnection} from './config.mjs';
-import {errors} from './web/messages.js';
-import {VERSION} from './product.mjs';
-import {createUpdateChecker} from './updates.mjs';
-import {boundedJson} from './io.mjs';
-import {fileURLToPath} from 'node:url';
-
-const random=()=>crypto.randomBytes(32).toString('base64url');
-const digest=value=>crypto.createHash('sha256').update(value).digest('hex');
-const fail=(code,status=400)=>Object.assign(Error(code),{status});
-export function createBrowserTicket(state){
-  const ticket=random();state.set('web.ticket',{hash:digest(ticket),expires:Date.now()+120000});return ticket;
-}
-export function readCodexAccount(state){
-  try{
-    const file=path.join(state.get('codex_home'),'auth.json');
-    if(fs.statSync(file).size>131072)throw Error();
-    const auth=JSON.parse(fs.readFileSync(file,'utf8')),token=auth.tokens?.access_token;
-    if(typeof token!=='string'||!/^\S{16,32768}$/.test(token))throw Error();
-    let claims={};try{claims=JSON.parse(Buffer.from(token.split('.')[1],'base64url'));}catch{}
-    if(claims.exp&&claims.exp*1000<=Date.now())throw fail('account_expired');
-    const accountId=auth.tokens.account_id??claims['https://api.openai.com/auth']?.chatgpt_account_id;
-    return {token,accountId:typeof accountId==='string'?accountId:undefined};
-  }catch(e){throw fail(e.message==='account_expired'?'account_expired':'account_required',409);}
-}
-async function body(req){
-  if(!/^application\/json(?:;|$)/i.test(req.headers['content-type']??''))throw fail('json_required',415);
-  if(Number(req.headers['content-length']??0)>1048576){req.resume();throw fail('request_too_large',413);}
-  let size=0;const chunks=[];
-  for await(const chunk of req){size+=chunk.length;if(size>1048576)throw fail('request_too_large',413);chunks.push(chunk);}
-  try{const data=JSON.parse(Buffer.concat(chunks));if(!data||typeof data!=='object'||Array.isArray(data))throw Error();return data;}catch{throw fail('invalid_input');}
-}
-export function createLocalApp(state,{license,request=fetch,account=()=>readCodexAccount(state),desktop,pool,checkUpdates=createUpdateChecker(),onStop=()=>{}}={}){
-  const sessions=new Map(),assets={'/app/':'index.html','/app/app.js':'app.js','/app/style.css':'style.css','/app/stream.js':'stream.js','/app/messages.js':'messages.js'};
-  assets['/app/updates.js']='updates.js';
-  assets['/app/markdown.js']='markdown.js';assets['/app/pool-ui.js']='pool-ui.js';
-  assets['/app/vendor/markdown-it.js']=fileURLToPath(import.meta.resolve('markdown-it/browser'));
-  for(const name of fs.readdirSync(path.join(import.meta.dirname,'web/assets')))if(/^[a-z0-9.-]+\.(woff2|css|txt|svg|png|ico)$/.test(name))assets['/app/assets/'+name]='assets/'+name;
-  return async(req,res,server)=>{
-    const url=new URL(req.url,'http://127.0.0.1');
-    if(!url.pathname.startsWith('/app'))return false;
-    const headers={'cache-control':'no-store','x-content-type-options':'nosniff','referrer-policy':'no-referrer','x-frame-options':'DENY',
-      'content-security-policy':"default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"};
-    const json=(status,data,extra={})=>{res.writeHead(status,{...headers,'content-type':'application/json; charset=utf-8',...extra});res.end(JSON.stringify(data));};
-    try{
-      const origin='http://'+req.headers.host;
-      // External links may navigate to the public shell; APIs still require same-origin access.
-      const entryNavigation=req.method==='GET'&&(url.pathname==='/app'||url.pathname==='/app/')&&
-        req.headers['sec-fetch-mode']==='navigate'&&req.headers['sec-fetch-dest']==='document';
-      if((req.headers.origin&&req.headers.origin!==origin)||(req.headers['sec-fetch-site']==='cross-site'&&!entryNavigation))throw fail('local_request_denied',403);
-      if(req.method==='GET'&&url.pathname==='/app'){res.writeHead(302,{...headers,location:'/app/'});res.end();return true;}
-      if(req.method==='GET'&&assets[url.pathname]){
-        const file=assets[url.pathname],type=file.endsWith('.html')?'text/html':file.endsWith('.css')?'text/css':file.endsWith('.svg')?'image/svg+xml':file.endsWith('.png')?'image/png':file.endsWith('.ico')?'image/x-icon':file.endsWith('.woff2')?'font/woff2':file.endsWith('.txt')?'text/plain':'text/javascript';
-        res.writeHead(200,{...headers,'content-type':type+'; charset=utf-8'});res.end(fs.readFileSync(path.isAbsolute(file)?file:path.join(import.meta.dirname,'web',file)));return true;
-      }
-      const write=req.method==='POST';
-      if(!['GET','POST'].includes(req.method))throw fail('method_not_allowed',405);
-      if(write&&req.headers.origin!==origin)throw fail('local_request_denied',403);
-      for(const [key,s]of sessions)if(s.expires<Date.now())sessions.delete(key);
-      if(url.pathname==='/app/api/session'&&write){
-        const input=await body(req),ticket=state.get('web.ticket');
-        if(typeof input.ticket!=='string'||input.ticket.length!==43||!ticket||ticket.expires<Date.now()||digest(input.ticket)!==ticket.hash)throw fail('open_from_command',401);
-        state.set('web.ticket',null);
-        const token=random(),s={csrf:random(),expires:Date.now()+8*3600000};
-        if(sessions.size>=8)sessions.delete(sessions.keys().next().value);
-        sessions.set(digest(token),s);json(200,{csrf:s.csrf},{'set-cookie':'cu-local='+token+'; Path=/app; HttpOnly; SameSite=Strict; Max-Age=28800'});return true;
-      }
-      const token=String(req.headers.cookie??'').split(';').map(x=>x.trim()).find(x=>x.startsWith('cu-local='))?.slice(9);
-      const session=token&&sessions.get(digest(token));if(!session)throw fail('open_from_command',401);
-      if(write&&req.headers['x-csrf-token']!==session.csrf)throw fail('session_expired',403);
-      const route=url.pathname.slice('/app/api/'.length);
-      if(!write&&route==='updates'){json(200,await checkUpdates());return true;}
-      if(!write&&route==='status'){
-        // A short-lived lease expiring does not mean the purchased service expired.
-        let licenseError=null;
-        if(state.get('license.activation'))try{await license.ensure();}catch(e){licenseError=e.message;}
-        const accounts=pool?.list()??null;
-        let connected=false;if(state.get('web.connected'))try{if(accounts)connected=accounts.rows.some(row=>row.active&&row.state==='ready');else{account();connected=true;}}catch{}
-        const usage=state.db.prepare('SELECT COUNT(*) total,COALESCE(SUM(status>=400),0) errors FROM desktop_usage').get();
-        const codex=codexConnection(state);if(codex.error&&!errors[codex.error])codex.error='operation_failed';
-        json(200,{version:VERSION,csrf:session.csrf,license:{...license.status(),...(licenseError?{error:errors[licenseError]?licenseError:'service_unavailable'}:{})},connected,codexConfigured:codex.configured,codex,desktop:desktop?.status()??{supported:false},accounts,usage,
-          recent:state.db.prepare('SELECT ts,status,duration_ms FROM desktop_usage ORDER BY id DESC LIMIT 12').all()});return true;
-      }
-      const input=write?await body(req):{};
-      if(route==='accounts'&&!write){if(!pool)throw fail('pool_runtime_unavailable',503);json(200,pool.list());return true;}
-      if(write&&(route.startsWith('accounts/')||route==='quota/refresh')){
-        if(!pool)throw fail('pool_runtime_unavailable',503);
-        let result;
-        if(route==='accounts/login'){
-          if(input.accepted!==true)throw fail('privacy_required');state.set('web.privacyAcceptedAt',Date.now());
-          result=await pool.startLogin({id:input.accountId,type:input.type,label:input.label});
-        }else if(route==='accounts/cancel')result=await pool.cancelLogin();
-        else if(route==='accounts/select'){if(!state.get('web.privacyAcceptedAt'))throw fail('privacy_required');result=await pool.select(input.accountId);}
-        else if(route==='accounts/remove')result=await pool.remove(input.accountId);
-        else if(route==='accounts/rename')result=pool.rename(input.accountId,input.label);
-        else if(route==='quota/refresh')result=await pool.refreshQuota(input.accountId);
-        else throw fail('route_not_found',404);
-        json(200,result);return true;
-      }
-      if(write&&route==='activate'){await license.activate(input.key);json(200,{ok:true});}
-      else if(write&&route==='renew'){await license.ensure('desktop',{online:true});json(200,{ok:true});}
-      else if(write&&route==='connect'){
-        if(input.accepted!==true)throw Object.assign(Error('privacy_required'),{status:400});
-        if(pool)await pool.credentials();else account();state.set('web.connected',true);state.set('web.privacyAcceptedAt',Date.now());json(200,{ok:true});
-      }
-      else if(write&&route==='disconnect'){state.set('web.connected',false);json(200,{ok:true});}
-      else if(write&&route==='sync'){if(!state.get('web.privacyAcceptedAt'))throw Object.assign(Error('privacy_required'),{status:400});await license.ensure();json(200,syncCodex(state));}
-      else if(write&&route==='unsync'){json(200,unsyncCodex(state));}
-      else if(write&&route==='desktop/startup'){
-        if(typeof input.enabled!=='boolean')throw fail('invalid_input');
-        if(!desktop)throw fail('startup_unavailable',409);
-        await desktop.setStartup(input.enabled);json(200,desktop.status());
-      }
-      else if(write&&route==='desktop/tray'){
-        if(!desktop)throw fail('tray_unavailable',409);
-        await desktop.showTray();json(200,desktop.status());
-      }
-      else if(write&&route==='stop'){
-        if(input.mode!=='exit'&&input.mode!=='update')throw fail('invalid_input');
-        if(input.mode==='exit')unsyncCodex(state);
-        json(200,{stopped:true});setImmediate(onStop);
-      }
-      else if((!write&&route==='models')||(write&&route==='chat')){
-        if(!state.get('web.connected'))throw fail('account_required',409);
-        const credentials=pool?await pool.credentials((write?input.accountId:url.searchParams.get('accountId'))??pool.active()):account();let payload;
-        if(write){
-          if(typeof input.model!=='string'||!input.model.length||input.model.length>160||!Array.isArray(input.messages)||!input.messages.length||input.messages.length>100||
-            input.messages.some(m=>!m||!['user','assistant'].includes(m.role)||typeof m.content!=='string'||!m.content.trim()||m.content.length>(m.role==='user'?32000:256000))||input.messages.at(-1).role!=='user')throw fail('invalid_message');
-          payload={model:input.model,stream:true,store:false,instructions:'Respond helpfully to the user.',input:input.messages.map(m=>({role:m.role,content:[{type:m.role==='assistant'?'output_text':'input_text',text:m.content}]}))};
-        }
-        const controller=new AbortController();res.on('close',()=>controller.abort());
-        const upstream=await request('http://127.0.0.1:'+server.address().port+(write?'/v1/responses':'/v1/models'),{
-          method:write?'POST':'GET',headers:{authorization:'Bearer '+credentials.token,'content-type':'application/json',...(pool?{'x-cu-control':state.get('control_token')}:{}) ,...(credentials.accountId?{'chatgpt-account-id':credentials.accountId}:{})},
-          body:write?JSON.stringify(payload):undefined,redirect:'error',signal:AbortSignal.any([controller.signal,AbortSignal.timeout(600000)])});
-        if(!upstream.ok){
-          let code;try{code=(await boundedJson(upstream,16384)).error?.code;}catch{}
-          const reason=['local_queue_full','local_queue_timeout','license_concurrency_limit'].includes(code)?'connection_busy':code==='request_proof_expired'?'request_clock_error':upstream.status===426?'connector_update_required':['request_body_rejected','request_proof_rejected','request_body_unverified'].includes(code)?'request_integrity_failed':upstream.status===401?'account_expired':upstream.status===429?'usage_limit':upstream.status===403?'activation_required':'service_unavailable';
-          throw fail(reason,upstream.status);
-        }
-        if(write){res.writeHead(200,{...headers,'content-type':'text/event-stream; charset=utf-8'});await pipeline(Readable.fromWeb(upstream.body),res,{signal:controller.signal});}
-        else{
-          const data=await boundedJson(upstream,2*1024*1024),list=data?.models??data?.data??[];
-          if(!Array.isArray(list))throw fail('models_unavailable',503);
-          json(200,{models:list.filter(m=>m&&typeof m==='object'&&m.visibility!=='hide').map(m=>({id:m.slug??m.id,name:m.display_name??m.slug??m.id})).filter(m=>typeof m.id==='string'&&m.id.length<=160&&typeof m.name==='string'&&m.name.length<=160).slice(0,256)});
-        }
-      }else throw fail('route_not_found',404);
-    }catch(error){
-      const configuration=/^\/app\/api\/(?:sync|unsync|stop)$/.test(url.pathname);
-      const code=configuration&&['EACCES','EPERM','EBUSY'].includes(error.code)?'config_permission_denied':configuration&&error.code==='ENOENT'?'config_missing':error.message;
-      const publicCode=errors[code]?code:['json_required','request_too_large','invalid_input','local_request_denied','method_not_allowed','route_not_found'].includes(code)?code:'operation_failed';
-      const badInput=['invalid_activation_key','license_invalid_or_expired','license_revoked','device_limit_reached','activation_required'].includes(publicCode);
-      if(res.headersSent)res.destroy();else json(error.status??(configuration?409:badInput?400:503),{error:publicCode},error.retryAfter?{'retry-after':String(error.retryAfter)}:{});
-    }
-    return true;
-  };
-}

package/codex-account-client.mjs

@@ -1,53 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import {createRequire} from 'node:module';
-import {spawn} from 'node:child_process';
-import {VERSION} from './product.mjs';
-
-export function codexExecutable(){
-  const require=createRequire(import.meta.url),name='@openai/codex-'+process.platform+'-'+process.arch;
-  const targets={linux:{x64:'x86_64-unknown-linux-musl',arm64:'aarch64-unknown-linux-musl'},darwin:{x64:'x86_64-apple-darwin',arm64:'aarch64-apple-darwin'},win32:{x64:'x86_64-pc-windows-msvc',arm64:'aarch64-pc-windows-msvc'}};
-  const target=targets[process.platform]?.[process.arch];if(!target)throw Error('pool_platform_unavailable');
-  try{
-    const resolve=createRequire(require.resolve('@openai/codex/package.json'));
-    const entry=path.join(path.dirname(resolve.resolve(name+'/package.json')),'vendor',target,'bin',process.platform==='win32'?'codex.exe':'codex');
-    if(!fs.existsSync(entry))throw Error();return entry;
-  }catch{throw Error('pool_runtime_missing');}
-}
-
-export class CodexAccountClient{
-  constructor(home,{onNotification=()=>{},externalCredentials,spawnProcess=spawn,executable=codexExecutable(),timeout=30000}={}){
-    this.pending=new Map();this.nextId=0;this.closed=false;this.buffer='';this.timeout=timeout;this.onNotification=onNotification;
-    const env={...process.env,CODEX_HOME:home};for(const name of ['OPENAI_API_KEY','CODEX_API_KEY','OPENAI_BASE_URL','OPENAI_ORG_ID','OPENAI_ORGANIZATION','CODEX_API_BASE_URL','CHATGPT_BASE_URL'])delete env[name];
-    this.process=spawnProcess(executable,['-c','cli_auth_credentials_store="'+(externalCredentials?'ephemeral':'file')+'"','-c','forced_login_method="chatgpt"','app-server','--listen','stdio://'],{cwd:home,env,windowsHide:true,stdio:['pipe','pipe','pipe']});
-    this.exited=new Promise(resolve=>{this.process.once('close',()=>{this.fail();resolve();});this.process.once('error',()=>{this.fail();resolve();});});
-    this.process.stderr.resume();this.process.stdin.on('error',()=>this.fail());
-    this.process.stdout.setEncoding('utf8');this.process.stdout.on('data',chunk=>{
-      this.buffer+=chunk;if(this.buffer.length>2*1024*1024){this.fail();this.process.kill();return;}
-      let boundary;
-      while((boundary=this.buffer.indexOf('\n'))!==-1){
-        const line=this.buffer.slice(0,boundary);this.buffer=this.buffer.slice(boundary+1);if(!line.trim())continue;
-        let message;try{message=JSON.parse(line);}catch{this.fail();this.process.kill();return;}
-        if(message.id!==undefined&&!message.method){const waiting=this.pending.get(message.id);if(!waiting)continue;clearTimeout(waiting.timer);this.pending.delete(message.id);message.error?waiting.reject(Error('pool_provider_rejected')):waiting.resolve(message.result);}
-        else if(message.method&&message.id!==undefined){
-          if(message.method==='account/chatgptAuthTokens/refresh'&&externalCredentials){Promise.resolve().then(externalCredentials).then(credentials=>this.write({id:message.id,result:{accessToken:credentials.token,chatgptAccountId:credentials.accountId}})).catch(()=>this.write({id:message.id,error:{code:-32000,message:'account_refresh_required'}}));}
-          else this.write({id:message.id,error:{code:-32601,message:'unsupported_request'}});
-        }else if(message.method)Promise.resolve().then(()=>this.onNotification(message.method,message.params)).catch(()=>{});
-      }
-    });
-    this.ready=this.call('initialize',{clientInfo:{name:'codex_unlimit_accounts',title:'Codex Unlimit',version:VERSION},capabilities:{experimentalApi:!!externalCredentials}}).then(()=>this.write({method:'initialized',params:{}}));
-    this.ready.catch(()=>{});
-  }
-  write(message){if(!this.closed&&!this.process.stdin.destroyed)this.process.stdin.write(JSON.stringify(message)+'\n');}
-  call(method,params={}){
-    if(this.closed)return Promise.reject(Error('pool_runtime_unavailable'));
-    return new Promise((resolve,reject)=>{const id=++this.nextId,timer=setTimeout(()=>{this.pending.delete(id);reject(Error('pool_request_timeout'));},this.timeout);timer.unref();this.pending.set(id,{resolve,reject,timer});this.write({id,method,params});});
-  }
-  async request(method,params={}){await this.ready;return this.call(method,params);}
-  fail(){this.closed=true;for(const waiting of this.pending.values()){clearTimeout(waiting.timer);waiting.reject(Error('pool_runtime_unavailable'));}this.pending.clear();}
-  async close(){
-    if(!this.closed)this.process.stdin.end();
-    const timeout=setTimeout(()=>this.process.kill(),1500);timeout.unref();
-    await this.exited;clearTimeout(timeout);this.fail();
-  }
-}

package/config.mjs

@@ -1,224 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-
-const BEGIN='# BEGIN Codexunlimit Web managed configuration';
-const END='# END Codexunlimit Web managed configuration';
-const PREVIOUS='# Codexunlimit Web saved root line: ';
-const PROVIDER='codexunlimit';
-const PROVIDER_BEGIN='# BEGIN Codexunlimit Web HTTP provider';
-const PROVIDER_END='# END Codexunlimit Web HTTP provider';
-const ROOT_KEYS=new Set(['openai_base_url','model_provider','model_catalog_json']);
-const digest=value=>crypto.createHash('sha256').update(value).digest('hex');
-
-function rootKey(line){
-  const m=/^\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))\s*=/.exec(line);
-  return m?.[1]??m?.[2]??m?.[3];
-}
-function splitRoot(text){
-  const lines=text.split('\n');let end=lines.length;
-  for(let i=0;i<lines.length;i++){
-    const line=lines[i].trim();
-    if(line.startsWith('#'))continue;
-    if(line.startsWith('[')){end=i;break;}
-    // Cấu hình root nhiều dòng cần được người dùng kiểm tra; không sửa bằng suy đoán.
-    if(line.includes('"""')||line.includes("'''"))throw Error('multiline_root_config_requires_manual_setup');
-  }
-  return {lines,end};
-}
-function layout(text){
-  const bom=text.startsWith('\uFEFF')?'\uFEFF':'',crlf=text.includes('\r\n');
-  const {lines,end}=splitRoot(text.slice(bom.length).replace(/\r\n/g,'\n'));
-  const fields=new Map();
-  for(let i=0;i<end;i++){
-    const key=rootKey(lines[i]);
-    if(!ROOT_KEYS.has(key)&&key!=='profile')continue;
-    if(fields.has(key))throw Error('duplicate_provider_settings_review_required');
-    const value=lines[i].slice(lines[i].indexOf('=')+1).trim();
-    const match=/^(?:"([^"\\]*)"|'([^']*)')\s*(?:#.*)?$/.exec(value);
-    fields.set(key,{line:i,value:match?.[1]??match?.[2]});
-  }
-  return {bom,crlf,lines,end,fields,join:lines=>bom+(crlf?lines.join('\n').replace(/\n/g,'\r\n'):lines.join('\n'))};
-}
-function providerHeader(line){
-  return /^\[\s*(?:model_providers|"model_providers"|'model_providers')\s*\.\s*(?:codexunlimit|"codexunlimit"|'codexunlimit')\s*\]\s*(?:#.*)?$/.test(line.trim());
-}
-function httpProvider(baseUrl){
-  return [PROVIDER_BEGIN,'[model_providers.'+PROVIDER+']','name = "Codex Unlimit"','base_url = '+JSON.stringify(baseUrl),
-    'wire_api = "responses"','requires_openai_auth = true','supports_websockets = false',PROVIDER_END];
-}
-function stripHttpProvider(text,baseUrl){
-  const {lines,join}=layout(text),headers=lines.flatMap((line,i)=>providerHeader(line)?[i]:[]);
-  const starts=lines.flatMap((line,i)=>line.trim()===PROVIDER_BEGIN?[i]:[]),ends=lines.flatMap((line,i)=>line.trim()===PROVIDER_END?[i]:[]);
-  if(!headers.length){if(starts.length||ends.length)throw Error('managed_configuration_changed_review_required');return {text,found:false};}
-  if(headers.length!==1||starts.length!==ends.length||starts.length>1)throw Error('managed_configuration_changed_review_required');
-  const first=headers[0];let end=first+1;while(end<lines.length&&!lines[end].trimStart().startsWith('['))end++;
-  const marked=starts.length===1;
-  if(marked&&(starts[0]!==first-1||ends[0]<=first||ends[0]>=end))throw Error('managed_configuration_changed_review_required');
-  const expected=new Map([['name','Codex Unlimit'],['base_url',baseUrl],['wire_api','responses'],['requires_openai_auth',true],['supports_websockets',false]]),found=new Map();
-  for(const line of lines.slice(first+1,marked?ends[0]:end)){
-    if(!line.trim()||line.trimStart().startsWith('#'))continue;
-    const key=rootKey(line),value=line.slice(line.indexOf('=')+1).trim(),literal=/^(?:"([^"\\]*)"|'([^']*)'|(true|false))\s*(?:#.*)?$/.exec(value);
-    const parsed=literal?.[3]?literal[3]==='true':literal?.[1]??literal?.[2];
-    if(!literal||!expected.has(key)||found.has(key)||parsed!==expected.get(key))throw Error('managed_configuration_changed_review_required');
-    found.set(key,parsed);
-  }
-  if(found.size!==expected.size)throw Error('managed_configuration_changed_review_required');
-  return {text:join(lines.filter((_,i)=>i<(marked?starts[0]:first)||i>=(marked?ends[0]+1:end))),found:true};
-}
-function hasProviderConflict(text){
-  return layout(text).lines.some(line=>providerHeader(line)||rootKey(line)==='model_providers'||/^\s*(?:model_providers|"model_providers"|'model_providers')\s*\.\s*(?:codexunlimit|"codexunlimit"|'codexunlimit')\s*[.=]/.test(line));
-}
-function directRouting(text){
-  const {fields}=layout(text);
-  return !fields.has('profile')&&!fields.has('openai_base_url')&&!fields.has('model_catalog_json')&&
-    (!fields.has('model_provider')||fields.get('model_provider').value==='openai');
-}
-function directConfiguration(text,previous){
-  if(!directRouting(text))return null;
-  text=stripHttpProvider(text,previous.baseUrl).text;
-  if(![BEGIN,END,PREVIOUS].some(marker=>text.includes(marker)))return text;
-  const {lines,end,join}=layout(text),source=layout(verifiedOriginal(previous));
-  const saved=source.lines.slice(0,source.end).filter(line=>ROOT_KEYS.has(rootKey(line)));
-  const begin=lines.filter(line=>line.trim()===BEGIN).length,finish=lines.filter(line=>line.trim()===END).length;
-  if(begin!==finish||begin>1)throw Error('managed_configuration_changed_review_required');
-  const filtered=lines.filter((line,i)=>{
-    const stripped=line.trimStart();
-    if(![BEGIN,END].includes(line.trim())&&!stripped.startsWith(PREVIOUS))return true;
-    if(i>=end)throw Error('managed_configuration_changed_review_required');
-    if(stripped.startsWith(PREVIOUS)&&!saved.some(value=>PREVIOUS+Buffer.from(value).toString('base64')===stripped))
-      throw Error('saved_root_line_corrupt');
-    return false;
-  });
-  // Reset có thể để lại comment của relay; chỉ bỏ metadata, không phục hồi provider cũ.
-  return join(filtered);
-}
-function verifiedOriginal(previous){
-  try{
-    if(fs.lstatSync(previous.backup).isSymbolicLink())throw Error();
-    const original=fs.readFileSync(previous.backup,'utf8');
-    if(digest(original)!==previous.original_hash)throw Error();
-    return original;
-  }catch{throw Error('config_backup_missing_or_changed_review_required');}
-}
-export function managedConfig(original,baseUrl){
-  if(original.includes('# BEGIN TDH Relay')||original.includes('# BEGIN Codexunlimit managed'))throw Error('existing_connector_review_required');
-  if(original.includes(BEGIN)||original.includes(END)||original.includes(PREVIOUS))throw Error('managed_configuration_already_present');
-  if(hasProviderConflict(original))throw Error('managed_provider_conflict');
-  const bom=original.startsWith('\uFEFF')?'\uFEFF':'',crlf=original.includes('\r\n');
-  const {lines,end}=splitRoot(original.slice(bom.length).replace(/\r\n/g,'\n'));
-  const root=lines.slice(0,end).map(line=>ROOT_KEYS.has(rootKey(line))?PREVIOUS+Buffer.from(line).toString('base64'):line);
-  const block=[BEGIN,'openai_base_url = '+JSON.stringify(baseUrl),'model_provider = "'+PROVIDER+'"',END].join('\n');
-  let result=[block,...root,...httpProvider(baseUrl),...lines.slice(end)].join('\n');
-  if(crlf)result=result.replace(/\n/g,'\r\n');
-  return bom+result;
-}
-export function restoreConfig(current,baseUrl,{original}={}){
-  const stripped=stripHttpProvider(current,baseUrl);
-  const {lines,end,fields,join}=layout(stripped.text);
-  const begins=[],ends=[];
-  lines.forEach((line,i)=>{if(line.trim()===BEGIN)begins.push(i);if(line.trim()===END)ends.push(i);});
-  const marked=begins.length===1&&ends.length===1&&begins[0]<ends[0]&&ends[0]<end;
-  const unmarked=begins.length===0&&ends.length===0&&original!==undefined;
-  if(!marked&&!unmarked||fields.get('openai_base_url')?.value!==baseUrl||!['openai',PROVIDER].includes(fields.get('model_provider')?.value)||fields.get('model_provider')?.value===PROVIDER&&!stripped.found)
-    throw Error('managed_configuration_changed_review_required');
-  if(fields.has('model_catalog_json'))throw Error('new_provider_settings_review_required');
-  const source=original===undefined?null:layout(original);
-  const expected=source?.lines.slice(0,source.end).filter(line=>ROOT_KEYS.has(rootKey(line)))??null;
-  const restored=new Set(),result=[];
-  for(let i=0;i<lines.length;i++){
-    const line=lines[i];
-    if(begins.includes(i)||ends.includes(i)||i<end&&ROOT_KEYS.has(rootKey(line)))continue;
-    if(!line.trimStart().startsWith(PREVIOUS)){result.push(line);continue;}
-    if(i>=end)throw Error('saved_root_line_moved');
-    const encoded=line.trimStart().slice(PREVIOUS.length);
-    if(!/^[A-Za-z0-9+/]*={0,2}$/.test(encoded))throw Error('saved_root_line_corrupt');
-    const decoded=Buffer.from(encoded,'base64').toString('utf8');
-    const key=rootKey(decoded);
-    if(!ROOT_KEYS.has(key)||/[\r\n]/.test(decoded)||restored.has(key)||expected&&!expected.includes(decoded))throw Error('saved_root_line_corrupt');
-    restored.add(key);result.push(decoded);
-  }
-  // Nếu trình ghi TOML đã bỏ comment, lấy đúng root cũ từ backup đã kiểm tra hash.
-  if(expected)result.unshift(...expected.filter(line=>!restored.has(rootKey(line))));
-  return join(result);
-}
-function atomicWrite(file,content){
-  const temporary=file+'.cu-'+crypto.randomBytes(6).toString('hex');
-  fs.writeFileSync(temporary,content,{mode:0o600,flag:'wx'});
-  try{fs.renameSync(temporary,file);}catch(error){fs.unlinkSync(temporary);throw error;}
-}
-function backupConfig(state,original,label='codex-config'){
-  const backupDir=path.join(state.home,'backups');fs.mkdirSync(backupDir,{recursive:true,mode:0o700});
-  const backup=path.join(backupDir,label+'-'+Date.now()+'-'+crypto.randomBytes(4).toString('hex')+'.toml');
-  fs.writeFileSync(backup,original,{mode:0o600,flag:'wx'});return backup;
-}
-export function syncCodex(state){
-  const codexHome=state.get('codex_home');
-  if(!codexHome)throw Error('codex_home_missing');
-  fs.mkdirSync(codexHome,{recursive:true,mode:0o700});
-  const file=path.join(codexHome,'config.toml');
-  if(fs.existsSync(file)&&fs.lstatSync(file).isSymbolicLink())throw Error('config_symlink_requires_manual_setup');
-  const original=fs.existsSync(file)?fs.readFileSync(file,'utf8'):'';
-  const baseUrl='http://127.0.0.1:'+state.settings.get('relay.port')+'/v1';
-  const previous=state.get('codex_sync');
-  if(previous&&(path.resolve(previous.file)!==path.resolve(file)||previous.baseUrl!==baseUrl))throw Error('config_target_changed_review_required');
-  if(layout(original).fields.has('profile'))throw Error('active_codex_profile_requires_manual_setup');
-  const direct=previous?directConfiguration(original,previous):null;
-  if(previous&&direct===null){
-    const restored=restoreConfig(original,baseUrl,{original:verifiedOriginal(previous)});
-    const next=managedConfig(restored,baseUrl);
-    if(next===original)return {changed:false,file};
-    const backup=backupConfig(state,original,'codex-config-before-repair');
-    atomicWrite(file,next);
-    state.set('codex_sync',{...previous,managed_hash:digest(next),repair_backup:backup});
-    return {changed:true,file,backup,recovery:'equivalent_configuration'};
-  }
-  const baseline=direct??original;
-  const repairBackup=baseline!==original?backupConfig(state,original,'codex-config-before-repair'):null;
-  const next=managedConfig(baseline,baseUrl);
-  const backup=backupConfig(state,baseline);
-  state.set('codex_sync',{file,baseUrl,backup,original_hash:digest(baseline),managed_hash:digest(next),...(repairBackup?{repair_backup:repairBackup}:{})});
-  try{atomicWrite(file,next);}catch(error){state.set('codex_sync',previous);throw error;}
-  return {changed:true,file,backup,...(previous?{recovery:'direct_configuration'}:{})};
-}
-export function unsyncCodex(state){
-  const previous=state.get('codex_sync');
-  if(!previous)return {changed:false};
-  if(fs.lstatSync(previous.file).isSymbolicLink())throw Error('config_symlink_requires_manual_setup');
-  const current=fs.readFileSync(previous.file,'utf8');
-  const direct=directConfiguration(current,previous);
-  if(direct!==null){
-    if(direct!==current){backupConfig(state,current,'codex-config-before-repair');atomicWrite(previous.file,direct);}
-    state.set('codex_sync',null);return {changed:direct!==current,file:previous.file,recovery:'already_direct_configuration'};
-  }
-  atomicWrite(previous.file,restoreConfig(current,previous.baseUrl,{original:verifiedOriginal(previous)}));
-  state.set('codex_sync',null);
-  return {changed:true,file:previous.file};
-}
-export function codexConnection(state){
-  const previous=state.get('codex_sync');
-  try{
-    const codexHome=state.get('codex_home');if(!codexHome)throw Error('codex_home_missing');
-    const file=path.join(codexHome,'config.toml');
-    if(fs.existsSync(file)&&fs.lstatSync(file).isSymbolicLink())throw Error('config_symlink_requires_manual_setup');
-    const current=fs.existsSync(file)?fs.readFileSync(file,'utf8'):'';
-    const baseUrl='http://127.0.0.1:'+state.settings.get('relay.port')+'/v1';
-    if(layout(current).fields.has('profile'))throw Error('active_codex_profile_requires_manual_setup');
-    if(previous){
-      if(path.resolve(previous.file)!==path.resolve(file)||previous.baseUrl!==baseUrl)throw Error('config_target_changed_review_required');
-      if(directConfiguration(current,previous)!==null)return {configured:false,managed:true,repairable:true};
-      restoreConfig(current,baseUrl,{original:verifiedOriginal(previous)});
-      return {configured:true,managed:true,repairable:true};
-    }
-    managedConfig(current,baseUrl);
-    return {configured:false,managed:false,repairable:true};
-  }catch(error){
-    const code=['EACCES','EPERM','EBUSY'].includes(error.code)?'config_permission_denied':error.code==='ENOENT'?'config_missing':error.message;
-    return {configured:false,managed:!!previous,repairable:false,error:code};
-  }
-}
-
-export function migrateCodexTransport(state){
-  if(!state.get('codex_sync')||!codexConnection(state).configured)return {changed:false};
-  return syncCodex(state);
-}