codexuse-cli 5.1.1 → 5.1.6

package/dist/index.js

@@ -4327,9 +4327,19 @@ async function requestGumroadVerify(licenseKey, mode) {
     clearTimeout(timeout);
   }
 }
-function normalizeVerificationResult(response) {
+function isExplicitRevocationMessage(message) {
+  if (!message) {
+    return false;
+  }
+  const normalized = message.toLowerCase();
+  return normalized.includes("revoked") || normalized.includes("refunded") || normalized.includes("chargeback") || normalized.includes("disabled") || normalized.includes("subscription") || normalized.includes("no longer active");
+}
+function normalizeVerificationResult(response, mode) {
   if (!response.success) {
     const message = response.message ?? "License key is invalid.";
+    if (mode === "refresh" && !isExplicitRevocationMessage(message)) {
+      throw new LicenseError(message, "network");
+    }
     throw new LicenseError(message, "invalid");
   }
   if (!response.purchase) {
@@ -4502,7 +4512,7 @@ var LicenseService = class {
       try {
         const result = await requestGumroadVerify(workingStored.licenseKey, "refresh");
         ensureWithinUseLimit(result);
-        const normalized = normalizeVerificationResult(result);
+        const normalized = normalizeVerificationResult(result, "refresh");
         const updated = {
           licenseKey: workingStored.licenseKey,
           purchaseEmail: normalized.email,
@@ -4561,7 +4571,7 @@ var LicenseService = class {
     const digest = import_node_crypto5.default.createHash("sha256").update(trimmed).digest("hex");
     const result = await requestGumroadVerify(trimmed, "activation");
     ensureWithinUseLimit(result);
-    const normalized = normalizeVerificationResult(result);
+    const normalized = normalizeVerificationResult(result, "activation");
     const stored = {
       licenseKey: trimmed,
       purchaseEmail: normalized.email,
@@ -4625,7 +4635,7 @@ var import_node_crypto6 = require("crypto");
 var import_fs = require("fs");
 var import_path = __toESM(require("path"), 1);
 var import_path2 = require("path");
-var import_toml2 = __toESM(require_toml(), 1);
+var import_toml = __toESM(require_toml(), 1);
 
 // ../../packages/contracts/src/profiles/identity.ts
 function normalizeValue(value) {
@@ -4670,6 +4680,10 @@ function resolveProfileIdentityKey(profile) {
   return profileName ? `profile:${profileName}` : null;
 }
 function resolveProfileIdentityKeyFromProfile(profile) {
+  const rateLimitKey = normalizeValue(profile.rateLimitKey);
+  if (rateLimitKey) {
+    return rateLimitKey;
+  }
   return resolveProfileIdentityKey(profile) ?? `profile:${profile.name}`;
 }
 
@@ -4679,7 +4693,6 @@ var import_node_readline = __toESM(require("readline"), 1);
 var import_node_fs3 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
 var import_node_path5 = __toESM(require("path"), 1);
-var import_toml = __toESM(require_toml(), 1);
 
 // ../../packages/runtime-codex/src/codex/cli.ts
 var import_node_fs2 = require("fs");
@@ -4873,6 +4886,17 @@ function buildCodexCommand(binaryPath, args, env) {
   };
 }
 
+// ../../packages/runtime-codex/src/cli/env.ts
+function buildCodexChildEnv(overrides = {}) {
+  const env = { ...process.env };
+  for (const key of Object.keys(env)) {
+    if (key.startsWith("OPENAI_")) {
+      delete env[key];
+    }
+  }
+  return { ...env, ...overrides };
+}
+
 // ../../packages/shared/src/core/logger.ts
 var isTestEnv = process.env.NODE_ENV === "test" || process.env.VITEST === "true" || process.env.VITEST === "1";
 function isMocked(fn) {
@@ -4905,12 +4929,6 @@ var ACTIVATION_MODEL = "gpt-5.1-codex-mini";
 var MAX_STDERR_CAPTURE_CHARS = 32768;
 var REFRESH_TOKEN_REDEEMED_SNIPPET = "refresh token was already used";
 var authFileCache = /* @__PURE__ */ new Map();
-var CODEX_OAUTH_REFRESH_URL = "https://auth.openai.com/oauth/token";
-var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-var CODEX_OAUTH_REFRESH_MAX_AGE_MS = 8 * 24 * 60 * 60 * 1e3;
-var CODEX_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_MS = 2 * 60 * 1e3;
-var CODEX_USAGE_DEFAULT_BASE_URL = "https://chatgpt.com/backend-api";
-var CODEX_USAGE_TIMEOUT_MS = 3e4;
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -5134,17 +5152,6 @@ function extractJwtIssuedAtMs(token) {
   }
   return issuedAt * 1e3;
 }
-function extractJwtExpiresAtMs(token) {
-  const payload = decodeJwtPayload(token);
-  if (!payload) {
-    return null;
-  }
-  const expiresAt = payload["exp"];
-  if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
-    return null;
-  }
-  return expiresAt * 1e3;
-}
 function parseAuthRecord(content) {
   try {
     const parsed = JSON.parse(content);
@@ -5233,353 +5240,6 @@ async function writeAuthFileCached(filePath, content) {
     authFileCache.delete(filePath);
   }
 }
-function nonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-function resolveCodexAuthPathForEnv(envOverride) {
-  return envOverride?.CODEX_HOME ? import_node_path5.default.join(envOverride.CODEX_HOME, "auth.json") : import_node_path5.default.join(
-    envOverride?.HOME ?? process.env.HOME ?? import_node_os2.default.homedir(),
-    ".codex",
-    "auth.json"
-  );
-}
-function parseCodexOAuthCredentials(content) {
-  const parsed = parseAuthRecord(content);
-  if (!parsed) {
-    return null;
-  }
-  const tokens = isRecord4(parsed.tokens) ? parsed.tokens : {};
-  const accessToken = nonEmptyString(tokens.access_token) ?? nonEmptyString(parsed.access_token);
-  const refreshToken = nonEmptyString(tokens.refresh_token) ?? nonEmptyString(parsed.refresh_token);
-  if (!accessToken && !refreshToken) {
-    return null;
-  }
-  return {
-    accessToken: accessToken ?? "",
-    refreshToken: refreshToken ?? "",
-    idToken: nonEmptyString(tokens.id_token) ?? nonEmptyString(parsed.id_token),
-    accountId: nonEmptyString(tokens.account_id) ?? nonEmptyString(parsed.account_id),
-    lastRefreshMs: parseTimestamp2(tokens.last_refresh) ?? parseTimestamp2(parsed.last_refresh)
-  };
-}
-function shouldRefreshCodexOAuthToken(credentials) {
-  if (!credentials.refreshToken) {
-    return false;
-  }
-  const accessExpiresAt = extractJwtExpiresAtMs(credentials.accessToken);
-  if (accessExpiresAt !== null && accessExpiresAt - Date.now() <= CODEX_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_MS) {
-    return true;
-  }
-  if (credentials.lastRefreshMs === null) {
-    return true;
-  }
-  return Date.now() - credentials.lastRefreshMs > CODEX_OAUTH_REFRESH_MAX_AGE_MS;
-}
-async function writeCodexOAuthCredentials(authPath, content, credentials) {
-  let json = {};
-  try {
-    const parsed = JSON.parse(content);
-    if (isRecord4(parsed)) {
-      json = { ...parsed };
-    }
-  } catch {
-    json = {};
-  }
-  const existingTokens = isRecord4(json.tokens) ? json.tokens : {};
-  json.tokens = {
-    ...existingTokens,
-    access_token: credentials.accessToken,
-    refresh_token: credentials.refreshToken,
-    ...credentials.idToken ? { id_token: credentials.idToken } : {},
-    ...credentials.accountId ? { account_id: credentials.accountId } : {},
-    last_refresh: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  json.last_refresh = (/* @__PURE__ */ new Date()).toISOString();
-  await writeAuthFileCached(authPath, `${JSON.stringify(json, null, 2)}
-`);
-}
-async function refreshCodexOAuthCredentials(credentials) {
-  if (!credentials.refreshToken) {
-    return credentials;
-  }
-  const response = await fetch(CODEX_OAUTH_REFRESH_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    signal: AbortSignal.timeout(CODEX_USAGE_TIMEOUT_MS),
-    body: JSON.stringify({
-      client_id: CODEX_OAUTH_CLIENT_ID,
-      grant_type: "refresh_token",
-      refresh_token: credentials.refreshToken,
-      scope: "openid profile email"
-    })
-  });
-  const body = await response.text();
-  if (!response.ok) {
-    let code = "";
-    try {
-      const parsed2 = JSON.parse(body);
-      if (isRecord4(parsed2)) {
-        const error = isRecord4(parsed2.error) ? parsed2.error : {};
-        code = nonEmptyString(error.code) ?? nonEmptyString(parsed2.error) ?? nonEmptyString(parsed2.code) ?? "";
-      }
-    } catch {
-      code = "";
-    }
-    if (code === "refresh_token_reused") {
-      throw new Error("refresh token was already used");
-    }
-    if (code === "refresh_token_expired") {
-      throw new Error("refresh token expired");
-    }
-    if (code === "invalid_grant" || code === "refresh_token_invalidated") {
-      throw new Error("refresh token was revoked");
-    }
-    throw new Error(`Codex OAuth refresh failed HTTP ${response.status}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    throw new Error("Codex OAuth refresh returned invalid JSON");
-  }
-  if (!isRecord4(parsed)) {
-    throw new Error("Codex OAuth refresh returned invalid data");
-  }
-  return {
-    accessToken: nonEmptyString(parsed.access_token) ?? credentials.accessToken,
-    refreshToken: nonEmptyString(parsed.refresh_token) ?? credentials.refreshToken,
-    idToken: nonEmptyString(parsed.id_token) ?? credentials.idToken,
-    accountId: credentials.accountId,
-    lastRefreshMs: Date.now()
-  };
-}
-async function loadCodexConfigContents(envOverride) {
-  const codexHome = envOverride?.CODEX_HOME?.trim();
-  const root = codexHome || import_node_path5.default.join(envOverride?.HOME ?? process.env.HOME ?? import_node_os2.default.homedir(), ".codex");
-  try {
-    return await import_node_fs3.promises.readFile(import_node_path5.default.join(root, "config.toml"), "utf8");
-  } catch {
-    return null;
-  }
-}
-function parseChatGPTBaseUrl(contents) {
-  if (!contents) {
-    return CODEX_USAGE_DEFAULT_BASE_URL;
-  }
-  try {
-    const parsed = (0, import_toml.parse)(contents);
-    if (isRecord4(parsed)) {
-      return nonEmptyString(parsed.chatgpt_base_url) ?? CODEX_USAGE_DEFAULT_BASE_URL;
-    }
-  } catch {
-    return CODEX_USAGE_DEFAULT_BASE_URL;
-  }
-  return CODEX_USAGE_DEFAULT_BASE_URL;
-}
-async function resolveCodexUsageUrl(envOverride) {
-  let base = parseChatGPTBaseUrl(await loadCodexConfigContents(envOverride));
-  while (base.endsWith("/")) {
-    base = base.slice(0, -1);
-  }
-  if ((base.startsWith("https://chatgpt.com") || base.startsWith("https://chat.openai.com")) && !base.includes("/backend-api")) {
-    base += "/backend-api";
-  }
-  return `${base}${base.includes("/backend-api") ? "/wham/usage" : "/api/codex/usage"}`;
-}
-function numberFromUnknown(value) {
-  if (typeof value === "number" && Number.isFinite(value)) {
-    return value;
-  }
-  if (typeof value === "string" && value.trim()) {
-    const parsed = Number(value.trim());
-    return Number.isFinite(parsed) ? parsed : null;
-  }
-  return null;
-}
-function toOAuthWindow(window) {
-  if (!window) {
-    return void 0;
-  }
-  const usedPercent = numberFromUnknown(window.used_percent);
-  const resetAt = numberFromUnknown(window.reset_at);
-  const limitWindowSeconds = numberFromUnknown(window.limit_window_seconds);
-  if (usedPercent === null && resetAt === null && limitWindowSeconds === null) {
-    return void 0;
-  }
-  const result = {};
-  if (usedPercent !== null) {
-    result.usedPercent = Math.max(0, Math.min(100, usedPercent));
-  }
-  if (limitWindowSeconds !== null) {
-    result.windowMinutes = Math.round(limitWindowSeconds / 60);
-  }
-  if (resetAt !== null) {
-    const resetMs = resetAt > 1e10 ? resetAt : resetAt * 1e3;
-    result.resetsAt = new Date(resetMs).toISOString();
-    result.resetsInSeconds = Math.max(0, Math.round((resetMs - Date.now()) / 1e3));
-  }
-  return result;
-}
-function firstNonEmptyString(...values) {
-  for (const value of values) {
-    const text = nonEmptyString(value);
-    if (text) {
-      return text;
-    }
-  }
-  return null;
-}
-function slugForRateLimitId(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function isSparkRateLimit(limitName, meteredFeature) {
-  return [limitName, meteredFeature].filter((value) => Boolean(value)).some((value) => value.toLowerCase().includes("spark"));
-}
-function sparkWindowIdentity(window, fallback) {
-  const limitWindowSeconds = numberFromUnknown(window.limit_window_seconds);
-  const windowMinutes = limitWindowSeconds !== null ? Math.round(limitWindowSeconds / 60) : null;
-  const kind = windowMinutes !== null && windowMinutes > 0 && windowMinutes <= 6 * 60 ? "five-hour" : windowMinutes !== null && windowMinutes >= 6 * 24 * 60 ? "weekly" : fallback;
-  return kind === "weekly" ? { id: "codex-spark-weekly", label: "Codex Spark Weekly" } : { id: "codex-spark", label: "Codex Spark 5-hour" };
-}
-function toExtraRateLimitWindow(args) {
-  const window = toOAuthWindow(args.window);
-  if (!window) {
-    return null;
-  }
-  return {
-    id: args.id,
-    label: args.label,
-    ...args.meteredFeature ? { meteredFeature: args.meteredFeature } : {},
-    ...window
-  };
-}
-function parseExtraRateLimitWindows(additionalRateLimits) {
-  if (!Array.isArray(additionalRateLimits)) {
-    return [];
-  }
-  const usedIds = /* @__PURE__ */ new Set();
-  const extraWindows = [];
-  for (const entry of additionalRateLimits) {
-    if (!isRecord4(entry)) {
-      continue;
-    }
-    const limitName = firstNonEmptyString(entry.limit_name);
-    const meteredFeature = firstNonEmptyString(entry.metered_feature);
-    const rateLimit = isRecord4(entry.rate_limit) ? entry.rate_limit : null;
-    if (!rateLimit) {
-      continue;
-    }
-    const primary = isRecord4(rateLimit.primary_window) ? rateLimit.primary_window : null;
-    const secondary = isRecord4(rateLimit.secondary_window) ? rateLimit.secondary_window : null;
-    if (isSparkRateLimit(limitName, meteredFeature)) {
-      const candidates = [
-        { window: primary, fallback: "five-hour" },
-        { window: secondary, fallback: "weekly" }
-      ];
-      for (const candidate of candidates) {
-        if (!candidate.window) {
-          continue;
-        }
-        const identity = sparkWindowIdentity(candidate.window, candidate.fallback);
-        if (usedIds.has(identity.id)) {
-          continue;
-        }
-        const extraWindow2 = toExtraRateLimitWindow({
-          ...identity,
-          meteredFeature,
-          window: candidate.window
-        });
-        if (extraWindow2) {
-          usedIds.add(identity.id);
-          extraWindows.push(extraWindow2);
-        }
-      }
-      continue;
-    }
-    const idSource = firstNonEmptyString(meteredFeature, limitName);
-    const slug = idSource ? slugForRateLimitId(idSource) : "";
-    if (!slug) {
-      continue;
-    }
-    const id = `codex-${slug}`;
-    if (usedIds.has(id)) {
-      continue;
-    }
-    const extraWindow = toExtraRateLimitWindow({
-      id,
-      label: firstNonEmptyString(limitName, meteredFeature) ?? "Codex extra limit",
-      meteredFeature,
-      window: primary ?? secondary
-    });
-    if (extraWindow) {
-      usedIds.add(id);
-      extraWindows.push(extraWindow);
-    }
-  }
-  return extraWindows;
-}
-function parseRateLimitSnapshotFromOAuthUsage(value) {
-  if (!isRecord4(value)) {
-    throw new Error("Codex usage API returned invalid data");
-  }
-  const usage = value;
-  const primary = toOAuthWindow(usage.rate_limit?.primary_window ?? null);
-  const secondary = toOAuthWindow(usage.rate_limit?.secondary_window ?? null);
-  const extraWindows = parseExtraRateLimitWindows(usage.additional_rate_limits);
-  if (!primary && !secondary && extraWindows.length === 0) {
-    return null;
-  }
-  return {
-    lastUpdated: (/* @__PURE__ */ new Date()).toISOString(),
-    source: "codex-oauth-estimate",
-    ...primary ? { primary } : {},
-    ...secondary ? { secondary } : {},
-    ...extraWindows.length > 0 ? { extraWindows } : {}
-  };
-}
-async function fetchRateLimitsViaOAuth(envOverride) {
-  const authPath = resolveCodexAuthPathForEnv(envOverride);
-  const authContent = await readAuthFileCached(authPath);
-  if (!authContent) {
-    return null;
-  }
-  let credentials = parseCodexOAuthCredentials(authContent);
-  if (!credentials) {
-    return null;
-  }
-  if (shouldRefreshCodexOAuthToken(credentials)) {
-    credentials = await refreshCodexOAuthCredentials(credentials);
-    await writeCodexOAuthCredentials(authPath, authContent, credentials);
-  }
-  if (!credentials.accessToken) {
-    return null;
-  }
-  const usageUrl = await resolveCodexUsageUrl(envOverride);
-  const response = await fetch(usageUrl, {
-    method: "GET",
-    headers: {
-      Authorization: `Bearer ${credentials.accessToken}`,
-      Accept: "application/json",
-      "User-Agent": "CodexUse",
-      ...credentials.accountId ? { "ChatGPT-Account-Id": credentials.accountId } : {}
-    },
-    signal: AbortSignal.timeout(CODEX_USAGE_TIMEOUT_MS)
-  });
-  const body = await response.text();
-  if (response.status === 401 || response.status === 403) {
-    throw new Error(`Codex OAuth usage failed HTTP ${response.status} (${usageUrl})`);
-  }
-  if (!response.ok) {
-    throw new Error(`Codex usage API failed HTTP ${response.status} (${usageUrl}): ${body.slice(0, 500)}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    throw new Error("Codex usage API returned invalid JSON");
-  }
-  return parseRateLimitSnapshotFromOAuthUsage(parsed);
-}
 function inferRefreshFailureHint(stderrOutput) {
   if (!stderrOutput) {
     return null;
@@ -5715,14 +5375,13 @@ async function fetchRateLimitsViaRpc(envOverride, options = {}) {
     });
     return null;
   }
-  const childEnv = {
-    ...process.env,
+  const childEnv = buildCodexChildEnv({
     ...envOverride ?? {},
     HOME: tempHome,
     CODEX_HOME: tempHome,
     CODEX_TELEMETRY_LABEL: "codex-rpc",
     ELECTRON_RUN_AS_NODE: "1"
-  };
+  });
   const command = buildCodexCommand(
     binaryPath,
     ["-s", "read-only", "-a", "untrusted", "app-server"],
@@ -5825,14 +5484,13 @@ async function activateResetWindowViaRpc(envOverride, options = {}) {
     });
     return { status: "skipped", reason: "auth-missing" };
   }
-  const childEnv = {
-    ...process.env,
+  const childEnv = buildCodexChildEnv({
     ...envOverride ?? {},
     HOME: tempHome,
     CODEX_HOME: tempHome,
     CODEX_TELEMETRY_LABEL: "codex-reset-activation",
     ELECTRON_RUN_AS_NODE: "1"
-  };
+  });
   const command = buildCodexCommand(
     binaryPath,
     ["-s", "read-only", "-a", "untrusted", "app-server"],
@@ -6155,6 +5813,7 @@ var ProfileManager = class {
       displayName: record.displayName ?? null,
       data: record.data,
       metadata: record.metadata,
+      rateLimitKey: record.rateLimitKey ?? null,
       accountId: record.accountId ?? null,
       workspaceId: record.workspaceId ?? null,
       workspaceName: record.workspaceName ?? null,
@@ -6172,11 +5831,14 @@ var ProfileManager = class {
     if (!dataRaw || typeof dataRaw !== "object") {
       return null;
     }
-    return {
+    const data = cloneJson(dataRaw);
+    const metadata = raw.metadata ? cloneJson(raw.metadata) : void 0;
+    const fallbackRecord = {
       name: profileName,
       displayName: typeof raw.displayName === "string" ? raw.displayName : null,
-      data: cloneJson(dataRaw),
-      metadata: raw.metadata ? cloneJson(raw.metadata) : void 0,
+      data,
+      metadata,
+      rateLimitKey: typeof raw.rateLimitKey === "string" ? raw.rateLimitKey : null,
       accountId: typeof raw.accountId === "string" ? raw.accountId : null,
       workspaceId: typeof raw.workspaceId === "string" ? raw.workspaceId : null,
       workspaceName: typeof raw.workspaceName === "string" ? raw.workspaceName : null,
@@ -6185,6 +5847,10 @@ var ProfileManager = class {
       createdAt: typeof raw.createdAt === "string" ? raw.createdAt : null,
       updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : null
     };
+    return {
+      ...fallbackRecord,
+      rateLimitKey: fallbackRecord.rateLimitKey ?? this.resolveProfileIdentityFromRecord(fallbackRecord)
+    };
   }
   async readProfilesStateSource() {
     const state = await getAppState();
@@ -6234,10 +5900,11 @@ var ProfileManager = class {
   }
   rateLimitSnapshotKeysForRecord(record) {
     return Array.from(
-      /* @__PURE__ */ new Set([
+      new Set([
         this.resolveProfileIdentityFromRecord(record),
+        record.rateLimitKey,
         resolveFallbackAccountKey(record.name)
-      ])
+      ].filter((key) => Boolean(key)))
     );
   }
   rateLimitSnapshotKeysForStateMap(map) {
@@ -6950,6 +6617,7 @@ var ProfileManager = class {
       displayName,
       data,
       metadata: resolvedMetadata,
+      rateLimitKey: existingRecord?.rateLimitKey ?? this.resolveProfileIdentityFromData(resolvedName, data, resolvedMetadata),
       accountId,
       workspaceId: data.workspace_id ?? workspaceId,
       workspaceName: data.workspace_name ?? workspaceName,
@@ -6968,6 +6636,7 @@ var ProfileManager = class {
       createdAt: row.createdAt ?? void 0,
       authMethod: row.authMethod ?? void 0,
       accountId: row.accountId ?? void 0,
+      rateLimitKey: row.rateLimitKey ?? void 0,
       workspaceId: row.workspaceId ?? void 0,
       workspaceName: row.workspaceName ?? void 0,
       metadata: row.metadata
@@ -7004,6 +6673,7 @@ var ProfileManager = class {
       name,
       displayName: fallback?.displayName ?? name,
       isValid: Boolean(data && Object.keys(data).length > 0),
+      rateLimitKey: fallback?.rateLimitKey,
       accountId,
       workspaceId,
       workspaceName,
@@ -7322,7 +6992,7 @@ var ProfileManager = class {
     }
     let parsed;
     try {
-      parsed = (0, import_toml2.parse)(raw);
+      parsed = (0, import_toml.parse)(raw);
     } catch (error) {
       logWarn(`Failed to parse config.toml for profile home '${profileHome}':`, error);
       return;
@@ -7332,7 +7002,7 @@ var ProfileManager = class {
     }
     delete parsed["model_reasoning_effort"];
     const sanitized = this.ensureTrailingNewline(
-      (0, import_toml2.stringify)(parsed)
+      (0, import_toml.stringify)(parsed)
     );
     try {
       await import_fs.promises.writeFile(configPath, sanitized, "utf8");
@@ -7395,11 +7065,10 @@ var ProfileManager = class {
     const codexFormat = this.convertToCodexFormat(profileData);
     const profileHome = await this.prepareProfileHome(profileName, codexFormat);
     const authPath = import_path.default.join(profileHome, "auth.json");
-    const envOverrides = {
-      ...process.env,
+    const envOverrides = buildCodexChildEnv({
       HOME: profileHome,
       CODEX_HOME: profileHome
-    };
+    });
     try {
       return await action(envOverrides);
     } finally {
@@ -7449,11 +7118,10 @@ var ProfileManager = class {
         const profileHome = await this.prepareProfileHome(profileName, codexFormat);
         return {
           profileHome,
-          env: {
-            ...process.env,
+          env: buildCodexChildEnv({
             HOME: profileHome,
             CODEX_HOME: profileHome
-          }
+          })
         };
       })
     );
@@ -7696,16 +7364,7 @@ var ProfileManager = class {
         profileName,
         () => this.runWithPreparedProfileHome(
           profileName,
-          async (env) => {
-            try {
-              const oauthSnapshot = await fetchRateLimitsViaOAuth(env);
-              if (oauthSnapshot) {
-                return oauthSnapshot;
-              }
-            } catch {
-            }
-            return fetchRateLimitsViaRpc(env, { codexPath: options.codexPath });
-          },
+          (env) => fetchRateLimitsViaRpc(env, { codexPath: options.codexPath }),
           { syncFromActiveAuthBeforeAction: false }
         )
       );
@@ -8049,6 +7708,7 @@ var ProfileManager = class {
           displayName: typeof candidate.displayName === "string" ? candidate.displayName : null,
           data,
           metadata,
+          rateLimitKey: this.resolveProfileIdentityFromData(name, data, metadata),
           accountId: typeof candidate.accountId === "string" ? candidate.accountId : null,
           workspaceId: typeof candidate.workspaceId === "string" ? candidate.workspaceId : null,
           workspaceName: typeof candidate.workspaceName === "string" ? candidate.workspaceName : null,
@@ -9335,10 +8995,6 @@ function snapshotResetSeconds(snapshot) {
   ].filter((value) => typeof value === "number" && Number.isFinite(value));
   return values.length > 0 ? Math.min(...values) : null;
 }
-function fallbackUsedPercent(profile) {
-  const cached = maxUsedPercent(profile.rateLimit ?? null);
-  return typeof cached === "number" && Number.isFinite(cached) ? cached : null;
-}
 function compareCandidates(left, right) {
   const leftUsage = left.usedPercent ?? Number.POSITIVE_INFINITY;
   const rightUsage = right.usedPercent ?? Number.POSITIVE_INFINITY;
@@ -9396,16 +9052,17 @@ async function selectBestProfile(manager, profiles, codexPath) {
     }
     try {
       const snapshot = await manager.readLiveRateLimits(profile.name, { codexPath });
+      const usedPercent = maxUsedPercent(snapshot);
       candidates.push({
         profile,
-        usedPercent: typeof maxUsedPercent(snapshot) === "number" ? maxUsedPercent(snapshot) : fallbackUsedPercent(profile),
+        usedPercent: typeof usedPercent === "number" ? usedPercent : null,
         resetSeconds: snapshotResetSeconds(snapshot)
       });
     } catch {
       candidates.push({
         profile,
-        usedPercent: fallbackUsedPercent(profile),
-        resetSeconds: snapshotResetSeconds(profile.rateLimit ?? null)
+        usedPercent: null,
+        resetSeconds: null
       });
     }
   }
@@ -9540,6 +9197,9 @@ Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro or an
   if (!best) {
     throw new Error("No valid saved profiles found. Add one with `codexuse profile add <name>`.");
   }
+  if (best.usedPercent === null) {
+    throw new Error("No live rate-limit usage found. Skipping best profile run.");
+  }
   const dryRun = hasFlag(flags, "--dry-run");
   const summary = `${best.profile.name} (${formatUsagePercent(best.usedPercent)} used)`;
   if (dryRun) {
@@ -9611,6 +9271,7 @@ var import_node_path10 = __toESM(require("path"), 1);
 var import_node_fs6 = require("fs");
 var import_node_path9 = __toESM(require("path"), 1);
 var ROLLOUT_DIRS = ["sessions", "archived_sessions"];
+var SQLITE_EXTENSIONS = /* @__PURE__ */ new Set([".db", ".sqlite", ".sqlite3"]);
 function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -9729,8 +9390,91 @@ function resolveRolloutPath(profileHome, rolloutPath) {
   }
   return import_node_path9.default.isAbsolute(rolloutPath) ? rolloutPath : import_node_path9.default.join(profileHome, rolloutPath);
 }
-async function readThreadRecordFromStateDb(profileHome, threadId) {
-  const dbPath = import_node_path9.default.join(profileHome, "state_5.sqlite");
+async function collectSessionDatabasePaths(profileHome) {
+  const paths = [];
+  const sqliteDir = import_node_path9.default.join(profileHome, "sqlite");
+  try {
+    const entries = await import_node_fs6.promises.readdir(sqliteDir, {
+      withFileTypes: true,
+      encoding: "utf8"
+    });
+    for (const entry of entries) {
+      if (!entry.isFile()) {
+        continue;
+      }
+      const entryName = String(entry.name);
+      if (SQLITE_EXTENSIONS.has(import_node_path9.default.extname(entryName))) {
+        paths.push(import_node_path9.default.join(sqliteDir, entryName));
+      }
+    }
+  } catch {
+  }
+  paths.sort((left, right) => {
+    const leftName = import_node_path9.default.basename(left);
+    const rightName = import_node_path9.default.basename(right);
+    if (leftName === "codex-dev.db" && rightName !== "codex-dev.db") return -1;
+    if (rightName === "codex-dev.db" && leftName !== "codex-dev.db") return 1;
+    return leftName.localeCompare(rightName);
+  });
+  const legacy = import_node_path9.default.join(profileHome, "state_5.sqlite");
+  if (!paths.includes(legacy)) {
+    paths.push(legacy);
+  }
+  return paths;
+}
+function tableColumns(db, table) {
+  try {
+    return new Set(
+      db.prepare(`PRAGMA table_info(${table})`).all().map((row) => isRecord5(row) ? recordString(row.name) : null).filter((name) => Boolean(name))
+    );
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function firstColumn(columns, names) {
+  return names.find((name) => columns.has(name)) ?? null;
+}
+function sqlColumnOrNull(column, alias) {
+  return column ? `${column} AS ${alias}` : `NULL AS ${alias}`;
+}
+function queryThreadRecordFromTable(db, profileHome, threadId, config) {
+  const columns = tableColumns(db, config.table);
+  const idColumn = firstColumn(columns, config.id);
+  if (!idColumn) {
+    return null;
+  }
+  const variants = threadIdVariants(threadId);
+  const placeholders = variants.map(() => "?").join(", ");
+  const orderByColumn = firstColumn(columns, [
+    "updated_at_ms",
+    "updated_at",
+    "created_at_ms",
+    "created_at"
+  ]);
+  const select = [
+    sqlColumnOrNull(firstColumn(columns, config.rolloutPath), "rollout_path"),
+    sqlColumnOrNull(firstColumn(columns, config.title), "title"),
+    sqlColumnOrNull(firstColumn(columns, config.cwd), "cwd"),
+    sqlColumnOrNull(firstColumn(columns, ["updated_at"]), "updated_at"),
+    sqlColumnOrNull(firstColumn(columns, ["updated_at_ms"]), "updated_at_ms"),
+    sqlColumnOrNull(firstColumn(columns, ["created_at_ms", "created_at"]), "created_at_ms")
+  ].join(", ");
+  const orderBy = orderByColumn ? ` ORDER BY ${orderByColumn} DESC, ${idColumn} DESC` : ` ORDER BY ${idColumn} DESC`;
+  const row = db.prepare(
+    `SELECT ${select} FROM ${config.table} WHERE ${idColumn} IN (${placeholders})${orderBy} LIMIT 1`
+  ).all(...variants).find(isRecord5);
+  if (!row) {
+    return null;
+  }
+  return {
+    rolloutPath: resolveRolloutPath(profileHome, recordString(row.rollout_path)),
+    title: recordString(row.title),
+    cwd: recordString(row.cwd),
+    updatedAt: recordString(row.updated_at),
+    updatedAtMs: normalizeTimestampMs(row.updated_at_ms) ?? normalizeTimestampMs(row.updated_at) ?? normalizeTimestampMs(row.created_at_ms)
+  };
+}
+async function readThreadRecordFromDb(profileHome, dbPath, threadId) {
   try {
     await import_node_fs6.promises.access(dbPath);
   } catch {
@@ -9739,42 +9483,28 @@ async function readThreadRecordFromStateDb(profileHome, threadId) {
   let db = null;
   try {
     db = await openReadonlyDatabase(dbPath);
-    const columns = new Set(
-      db.prepare("PRAGMA table_info(threads)").all().map((row2) => isRecord5(row2) ? recordString(row2.name) : null).filter((name) => Boolean(name))
-    );
-    const idColumn = columns.has("id") ? "id" : columns.has("thread_id") ? "thread_id" : null;
-    if (!idColumn) {
-      return null;
-    }
-    const variants = threadIdVariants(threadId);
-    const placeholders = variants.map(() => "?").join(", ");
-    const select = [
-      columns.has("rollout_path") ? "rollout_path AS rollout_path" : "NULL AS rollout_path",
-      columns.has("title") ? "title AS title" : "NULL AS title",
-      columns.has("cwd") ? "cwd AS cwd" : "NULL AS cwd",
-      columns.has("updated_at") ? "updated_at AS updated_at" : "NULL AS updated_at",
-      columns.has("updated_at_ms") ? "updated_at_ms AS updated_at_ms" : "NULL AS updated_at_ms",
-      columns.has("created_at_ms") ? "created_at_ms AS created_at_ms" : "NULL AS created_at_ms"
-    ].join(", ");
-    const orderByColumn = columns.has("updated_at_ms") ? "updated_at_ms" : columns.has("updated_at") ? "updated_at" : columns.has("created_at_ms") ? "created_at_ms" : null;
-    const orderBy = orderByColumn ? ` ORDER BY ${orderByColumn} DESC, ${idColumn} DESC` : ` ORDER BY ${idColumn} DESC`;
-    const rows = db.prepare(
-      `SELECT ${select} FROM threads WHERE ${idColumn} IN (${placeholders})${orderBy} LIMIT 1`
-    ).all(...variants);
-    const row = rows.find(isRecord5);
-    if (!row) {
-      return null;
+    for (const config of [
+      {
+        table: "threads",
+        id: ["id", "thread_id"],
+        title: ["title", "thread_title"],
+        cwd: ["cwd", "source_cwd"],
+        rolloutPath: ["rollout_path"]
+      },
+      {
+        table: "automation_runs",
+        id: ["thread_id", "id"],
+        title: ["thread_title", "title", "inbox_title"],
+        cwd: ["source_cwd", "cwd"],
+        rolloutPath: []
+      }
+    ]) {
+      const record = queryThreadRecordFromTable(db, profileHome, threadId, config);
+      if (record) {
+        return record;
+      }
     }
-    return {
-      rolloutPath: resolveRolloutPath(
-        profileHome,
-        recordString(row.rollout_path)
-      ),
-      title: recordString(row.title),
-      cwd: recordString(row.cwd),
-      updatedAt: recordString(row.updated_at),
-      updatedAtMs: normalizeTimestampMs(row.updated_at_ms) ?? normalizeTimestampMs(row.updated_at) ?? normalizeTimestampMs(row.created_at_ms)
-    };
+    return null;
   } catch {
     return null;
   } finally {
@@ -9782,9 +9512,16 @@ async function readThreadRecordFromStateDb(profileHome, threadId) {
   }
 }
 async function findOfficialCodexThreadRecord(profileHome, threadId) {
-  const stateRecord = await readThreadRecordFromStateDb(profileHome, threadId);
-  if (stateRecord) {
-    return stateRecord;
+  const records = [];
+  for (const dbPath of await collectSessionDatabasePaths(profileHome)) {
+    const stateRecord = await readThreadRecordFromDb(profileHome, dbPath, threadId);
+    if (stateRecord) {
+      records.push(stateRecord);
+    }
+  }
+  if (records.length > 0) {
+    records.sort((left, right) => (right.updatedAtMs ?? 0) - (left.updatedAtMs ?? 0));
+    return records[0] ?? null;
   }
   const rolloutMatch = await findRolloutFileByScan(profileHome, threadId);
   if (!rolloutMatch) {
@@ -10150,13 +9887,14 @@ async function readCdpTargets(port) {
   }
   throw lastError instanceof Error ? lastError : new Error("cdp-list-failed");
 }
-function pickCodexCdpTarget(targets) {
+function pickCodexCdpTarget(targets, options = {}) {
   const pages = targets.filter(
     (target) => target.webSocketDebuggerUrl && (target.type === "page" || target.type === "webview" || !target.type)
   );
-  return pages.find(
+  const codexPage = pages.find(
     (target) => `${target.title ?? ""} ${target.url ?? ""}`.toLowerCase().includes("codex")
-  ) ?? pages[0] ?? null;
+  ) ?? null;
+  return codexPage ?? (options.allowAnyPage === true ? pages[0] ?? null : null);
 }
 function buildCdpDevToolsUrl(port, target) {
   const frontendUrl = target.devtoolsFrontendUrl?.trim();
@@ -10500,6 +10238,8 @@ function buildInCodexStatusOverlayCssRules() {
     `${chip} .codexuse-handoff-hide{display:inline-flex;width:20px;height:20px;align-items:center;justify-content:center;margin-right:3px;border-radius:50%;color:var(--cu-muted);cursor:pointer;font-size:12px;line-height:1;}`,
     `${chip} .codexuse-handoff-hide:hover{background:var(--cu-border);color:var(--cu-fg,#ececf1);}`,
     `body>[data-radix-popper-content-wrapper],body>[data-floating-ui-portal]{z-index:2147483004!important;}`,
+    // Official Codex marks its titlebar draggable; injected controls must opt out.
+    `${id},${id} *,${chip},${chip} *,${picker},${picker} *{-webkit-app-region:no-drag;}`,
     // Hand-off account picker is a standalone body child (not inside the pill),
     // so the pill-scoped popover rules don't reach it — give it its own palette
     // + popover styling, mirroring the chip.
@@ -10881,6 +10621,7 @@ function createBridgeApplyQolExpression(settings) {
     const overlayPosKey = "codexuse:overlay:pos";
     const handoffHiddenKey = "codexuse:handoff:hidden";
     const handoffPosKey = "codexuse:handoff:pos:v2";
+    const defaultPosKey = "codexuse:overlay:top-default:v1";
     const readOverlayStore = (key) => {
       try {
         return window.localStorage.getItem(key);
@@ -10975,8 +10716,8 @@ function createBridgeApplyQolExpression(settings) {
     };
     const placeInitialOverlayPosition = (pill) => {
       const rect = pill.getBoundingClientRect();
-      const x = Math.round((window.innerWidth - rect.width) / 2);
-      const y = Math.max(72, Math.min(140, Math.round(window.innerHeight * 0.16)));
+      const x = Math.max(8, window.innerWidth - rect.width - 32);
+      const y = Math.max(96, Math.min(132, Math.round(window.innerHeight * 0.12)));
       placeOverlay(pill, x, y);
     };
     const rectsOverlap = (a, b, gap = 0) =>
@@ -10990,30 +10731,17 @@ function createBridgeApplyQolExpression(settings) {
       right: pos.x + rect.width,
       bottom: pos.y + rect.height
     });
-    const placeInitialHandoffPosition = (chip, anchorRect = null) => {
+    const placeInitialHandoffPosition = (chip) => {
       const rect = chip.getBoundingClientRect();
-      if (anchorRect && rect.width > 0 && rect.height > 0) {
-        const gap = 8;
-        const middleY = Math.round(anchorRect.top + (anchorRect.height - rect.height) / 2);
-        const candidates = [
-          { x: anchorRect.right + gap, y: middleY },
-          { x: anchorRect.left - rect.width - gap, y: middleY },
-          { x: anchorRect.right - rect.width, y: anchorRect.top - rect.height - gap },
-          { x: anchorRect.left, y: anchorRect.top - rect.height - gap },
-          { x: anchorRect.right - rect.width, y: anchorRect.bottom + gap }
-        ];
-        for (const candidate of candidates) {
-          const next = clampOverlayXY(chip, candidate.x, candidate.y);
-          if (!rectsOverlap(positionedRect(rect, next), anchorRect, 6)) {
-            placeOverlay(chip, next.x, next.y);
-            return;
-          }
-        }
-      }
-      const x = Math.max(8, window.innerWidth - rect.width - 16);
-      const y = Math.max(64, Math.min(128, Math.round(window.innerHeight * 0.14)));
+      const x = Math.round((window.innerWidth - rect.width) / 2);
+      const y = 14;
       placeOverlay(chip, x, y);
     };
+    if (readOverlayStore(defaultPosKey) !== "1") {
+      writeOverlayStore(overlayPosKey, null);
+      writeOverlayStore(handoffPosKey, null);
+      writeOverlayStore(defaultPosKey, "1");
+    }
     const setOverlayMessage = (value) => {
       const node = document.querySelector("#" + statusId + " [data-codexuse-action-status]");
       if (node) node.textContent = value || "";
@@ -11143,7 +10871,8 @@ function createBridgeApplyQolExpression(settings) {
           renderHandoff();
         }, true);
         document.body.appendChild(pill);
-        applyStoredOverlayPosition(pill);
+        if (hasStoredPosition) applyStoredOverlayPosition(pill);
+        else placeInitialOverlayPosition(pill);
         return true;
       }
       pill.dataset.open = currentAutoRollDecision || wasOpen || shouldShowIntro ? "true" : "false";
@@ -11448,6 +11177,8 @@ function createBridgeApplyQolExpression(settings) {
       if (shouldShowIntro) {
         placeInitialOverlayPosition(pill);
         writeOverlayStore(overlayIntroKey, "1");
+      } else if (!hasStoredPosition) {
+        placeInitialOverlayPosition(pill);
       } else {
         applyStoredOverlayPosition(pill);
       }
@@ -11692,18 +11423,18 @@ function createBridgeApplyQolExpression(settings) {
             const next = clampOverlayXY(chip, pos.x, pos.y);
             const chipRect = chip.getBoundingClientRect();
             if (rectsOverlap(positionedRect(chipRect, next), rect, 6)) {
-              placeInitialHandoffPosition(chip, rect);
+              placeInitialHandoffPosition(chip);
             } else {
               placeOverlay(chip, next.x, next.y);
             }
           } else {
-            placeInitialHandoffPosition(chip, rect);
+            placeInitialHandoffPosition(chip);
           }
         } catch {
-          placeInitialHandoffPosition(chip, rect);
+          placeInitialHandoffPosition(chip);
         }
       } else {
-        placeInitialHandoffPosition(chip, rect);
+        placeInitialHandoffPosition(chip);
       }
       if (wasOpen) openPicker();
       reportHandoff("rendered");
@@ -12055,11 +11786,23 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
             || typeof item.name === "string"
           )
         );
-      const patchModelArray = (items, allowEmpty = false) => {
+      const modelLabelLooksKnown = (value) =>
+        typeof value === "string" && /(?:gpt|codex|chatgpt|claude|gemini|llama|mistral|qwen|deepseek|grok|davinci|\\bo[1-9]\\b)/i.test(value);
+      const objectArrayLooksModelLike = (items) =>
+        objectArrayLooksPatchable(items)
+        && items.some((item) =>
+          modelLabelLooksKnown(item.model)
+          || modelLabelLooksKnown(item.id)
+          || modelLabelLooksKnown(item.slug)
+          || modelLabelLooksKnown(item.name)
+          || modelLabelLooksKnown(item.displayName)
+          || modelLabelLooksKnown(item.title)
+        );
+      const patchModelArray = (items, allowEmpty = false, requireModelLike = false) => {
         if (!Array.isArray(items)) return false;
         let localChanged = false;
-        unhideArray(items);
         if (stringArrayLooksPatchable(items)) {
+          if (requireModelLike && !items.some(modelLabelLooksKnown)) return false;
           for (const model of modelWhitelistModels) {
             if (!items.includes(model)) {
               items.push(model);
@@ -12068,7 +11811,8 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
           }
           return localChanged;
         }
-        if (objectArrayLooksPatchable(items, allowEmpty)) {
+        if (objectArrayLooksPatchable(items, allowEmpty) && (!requireModelLike || allowEmpty || objectArrayLooksModelLike(items))) {
+          unhideArray(items);
           const existing = new Set();
           for (const item of items) {
             existing.add(String(item.model || item.id || item.slug || item.name || ""));
@@ -12083,8 +11827,8 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
         return localChanged;
       };
       if (patchModelArray(value.models, "defaultModel" in value || "availableModels" in value)) changed = true;
-      if (patchModelArray(value.data)) changed = true;
-      if (patchModelArray(value.result)) changed = true;
+      if (patchModelArray(value.data, false, true)) changed = true;
+      if (patchModelArray(value.result, false, true)) changed = true;
       if (patchModelArray(value.availableModels, true)) changed = true;
       if (patchModelArray(value.available_models, true)) changed = true;
       if (value.available_models instanceof Set) {
@@ -12201,11 +11945,23 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
       return changed;
     };
     const reactFiberKeys = (element) => Object.keys(element || {}).filter((key) => key.startsWith("__reactFiber") || key.startsWith("__reactInternalInstance") || key.startsWith("__reactProps"));
+    const reactModelStatePatchSelector = "[role='menu'],[role='dialog'],[role='listbox'],[data-radix-popper-content-wrapper],[data-floating-ui-portal]";
+    const isWorkspaceChromeNode = (node) => {
+      if (!node || node.nodeType !== 1) return false;
+      if (node.closest?.("[data-app-action-sidebar-section-heading='Chats'],[data-app-action-sidebar-section-heading='Projects'],[data-app-action-sidebar-thread-id],[data-app-action-sidebar-project-row],[data-app-action-sidebar-project-id]")) {
+        return true;
+      }
+      return Boolean(node.closest?.("main aside"));
+    };
+    const reactModelStatePatchNodes = () => {
+      return Array.from(document.querySelectorAll(reactModelStatePatchSelector))
+        .filter((node) => node && !isWorkspaceChromeNode(node));
+    };
     const patchReactModelState = () => {
       if (!enabled.modelWhitelistUnlock) return false;
       try {
         const visited = new WeakSet();
-        const nodes = [document.body, ...Array.from(document.querySelectorAll("button,[role='menu'],[role='dialog'],[data-radix-popper-content-wrapper]"))].filter(Boolean);
+        const nodes = reactModelStatePatchNodes();
         let changed = false;
         for (const node of nodes.slice(0, 220)) {
           for (const key of reactFiberKeys(node)) {
@@ -12220,6 +11976,39 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
         return false;
       }
     };
+    const installModelReactStateObserver = () => {
+      if (typeof state.cleanupModelReactStateObserver === "function") {
+        state.cleanupModelReactStateObserver();
+        state.cleanupModelReactStateObserver = null;
+      }
+      if (!enabled.modelWhitelistUnlock) return false;
+      let frame = 0;
+      const schedulePatch = () => {
+        if (frame) return;
+        frame = requestAnimationFrame(() => {
+          frame = 0;
+          patchReactModelState();
+        });
+      };
+      const isPatchableMutationNode = (node) => {
+        const element = node?.nodeType === 1 ? node : node?.parentElement;
+        return Boolean(
+          element?.matches?.(reactModelStatePatchSelector)
+          || element?.querySelector?.(reactModelStatePatchSelector)
+        );
+      };
+      const observer = new MutationObserver((mutations) => {
+        if (mutations.some((mutation) => Array.from(mutation.addedNodes).some(isPatchableMutationNode))) {
+          schedulePatch();
+        }
+      });
+      observer.observe(document.body, { childList: true, subtree: true });
+      state.cleanupModelReactStateObserver = () => {
+        observer.disconnect();
+        if (frame) cancelAnimationFrame(frame);
+      };
+      return true;
+    };
     const patchPluginContainer = (value, visited = new WeakSet(), depth = 0, inheritedMarketplaceName = null) => {
       if (!enabled.pluginMarketplaceUnlock || !value || typeof value !== "object" || visited.has(value) || depth > 4) return false;
       visited.add(value);
@@ -12763,6 +12552,7 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
     const modelStatsigPatchApplied = enabled.modelWhitelistUnlock
       ? patchStatsigModelWhitelist()
       : false;
+    installModelReactStateObserver();
     const modelReactStatePatched = enabled.modelWhitelistUnlock
       ? patchReactModelState()
       : false;
@@ -13939,14 +13729,16 @@ async function reloadOfficialCodexBridgePage(debuggerUrl) {
     return false;
   }
 }
-async function probeOfficialCodexBridge(instance, forceInstall = false) {
+async function probeOfficialCodexBridge(instance, forceInstall = false, allowAnyPageTarget = false) {
   const checkedAt = Date.now();
   if (!instance.cdpPort) {
     return bridgeStateUnavailable();
   }
   try {
     const targets = await readCdpTargets(instance.cdpPort);
-    const target = pickCodexCdpTarget(targets);
+    const target = pickCodexCdpTarget(targets, {
+      allowAnyPage: allowAnyPageTarget
+    });
     if (!target?.webSocketDebuggerUrl) {
       return bridgeStateUnhealthy(
         instance.cdpPort,
@@ -14016,14 +13808,16 @@ async function probeOfficialCodexBridge(instance, forceInstall = false) {
     );
   }
 }
-async function reapplyDesiredBridgeSettings(instance, bridge) {
+async function reapplyDesiredBridgeSettings(instance, bridge, allowAnyPageTarget = false) {
   const shouldClearPowerRuntime = !instance.desiredPowerSettings && hasEnabledBridgePowerRuntime(bridge.bridgePower);
   if (bridge.bridgeStatus !== "healthy" || !instance.cdpPort || !instance.desiredQolSettings && !instance.desiredPowerSettings && !shouldClearPowerRuntime) {
     return bridge;
   }
   try {
     const targets = await readCdpTargets(instance.cdpPort);
-    const target = pickCodexCdpTarget(targets);
+    const target = pickCodexCdpTarget(targets, {
+      allowAnyPage: allowAnyPageTarget
+    });
     if (!target?.webSocketDebuggerUrl) {
       return bridge;
     }
@@ -14109,7 +13903,7 @@ async function reapplyDesiredBridgeSettings(instance, bridge) {
     };
   }
 }
-async function refreshBridgeStateIfNeeded(instance, running, force = false, reapplyDesired = false) {
+async function refreshBridgeStateIfNeeded(instance, running, force = false, reapplyDesired = false, allowAnyPageTarget = false) {
   if (!running || !instance.cdpPort) {
     return bridgeStateUnavailable();
   }
@@ -14117,12 +13911,16 @@ async function refreshBridgeStateIfNeeded(instance, running, force = false, reap
   if (!force && checkedAt && Date.now() - checkedAt < CODEX_BRIDGE_PROBE_TTL_MS) {
     return bridgeStateForStoredInstance(instance, true);
   }
-  const bridge = await probeOfficialCodexBridge(instance, force);
-  return reapplyDesired ? await reapplyDesiredBridgeSettings(instance, bridge) : bridge;
+  const bridge = await probeOfficialCodexBridge(
+    instance,
+    force,
+    allowAnyPageTarget
+  );
+  return reapplyDesired ? await reapplyDesiredBridgeSettings(instance, bridge, allowAnyPageTarget) : bridge;
 }
 async function waitForBridgeStateAfterLaunch(instance) {
   const deadline = Date.now() + CODEX_BRIDGE_LAUNCH_WAIT_MS;
-  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true);
+  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true, true);
   while (latest.bridgeStatus !== "healthy" && Date.now() < deadline) {
     await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
     latest = await refreshBridgeStateIfNeeded(
@@ -14132,6 +13930,7 @@ async function waitForBridgeStateAfterLaunch(instance) {
       },
       true,
       true,
+      true,
       true
     );
   }
@@ -14140,7 +13939,7 @@ async function waitForBridgeStateAfterLaunch(instance) {
 async function waitForBridgeStateAfterReload(instance) {
   const deadline = Date.now() + CODEX_BRIDGE_LAUNCH_WAIT_MS;
   await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
-  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true);
+  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true, true);
   while (latest.bridgeStatus !== "healthy" && Date.now() < deadline) {
     await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
     latest = await refreshBridgeStateIfNeeded(
@@ -14150,6 +13949,7 @@ async function waitForBridgeStateAfterReload(instance) {
       },
       true,
       true,
+      true,
       true
     );
   }
@@ -14519,7 +14319,7 @@ async function openCodexWithProfileHome(candidate, profileHome, profileName, cdp
       ],
       {
         detached: true,
-        env: process.env,
+        env: buildCodexChildEnv(),
         stdio: "ignore"
       }
     );
@@ -15487,7 +15287,7 @@ function summarizeRateLimitSnapshot(snapshot) {
   return summary;
 }
 function fallbackUsage(profile) {
-  const usageSummary = summarizeRateLimitSnapshot(profile.rateLimit ?? null);
+  const usageSummary = summarizeRateLimitSnapshot(null);
   if (!profile.isValid) {
     return { summary: "invalid", rows: null, usageSummary };
   }
@@ -15503,8 +15303,7 @@ async function resolveProfileUsage(manager, profile, codexPath) {
   try {
     const snapshot = await manager.readLiveRateLimits(profile.name, { codexPath });
     if (!snapshot) {
-      const usageSummary = summarizeRateLimitSnapshot(profile.rateLimit ?? null);
-      return { summary: "n/a", rows: null, usageSummary };
+      return fallbackUsage(profile);
     }
     const rows = [];
     if (snapshot.primary) {
@@ -15556,7 +15355,7 @@ function computeAutoRollCandidate(profiles, usageMap, currentProfileName, curren
     (profile) => profile.name !== currentProfileName && !blockedProfileNames.has(profile.name) && profile.isValid && !profile.tokenStatus?.requiresUserAction
   ).map((profile) => ({
     profile,
-    usageSummary: usageMap.get(profile.name)?.usageSummary ?? summarizeRateLimitSnapshot(profile.rateLimit ?? null)
+    usageSummary: usageMap.get(profile.name)?.usageSummary ?? summarizeRateLimitSnapshot(null)
   }));
   if (candidates.length === 0) {
     return null;
@@ -15971,7 +15770,7 @@ async function runAutoRollPass(manager, options) {
       target: null
     };
   }
-  const currentUsage = usageMap.get(current.name)?.usageSummary ?? summarizeRateLimitSnapshot(currentProfile.rateLimit ?? null);
+  const currentUsage = usageMap.get(current.name)?.usageSummary ?? summarizeRateLimitSnapshot(null);
   if (!currentUsage.hasUsage) {
     return {
       switched: false,
@@ -16089,7 +15888,7 @@ async function handleProfileCommand(args, version) {
             usageMap.set(profile.name, {
               summary: "codex cli missing",
               rows: null,
-              usageSummary: summarizeRateLimitSnapshot(profile.rateLimit ?? null)
+              usageSummary: summarizeRateLimitSnapshot(null)
             });
           }
         } else {
@@ -16460,7 +16259,7 @@ async function pushRemoteSnapshot(access, snapshot, options) {
 }
 
 // ../../packages/runtime-codex/src/codex/config.ts
-var import_toml3 = __toESM(require_toml(), 1);
+var import_toml2 = __toESM(require_toml(), 1);
 
 // ../../packages/runtime-codex/src/codex/config-metadata.ts
 var import_node_child_process8 = require("child_process");
@@ -16577,7 +16376,7 @@ async function runCommand3(command, args, timeoutMs = 3e3) {
   return new Promise((resolve, reject) => {
     const child = (0, import_node_child_process8.spawn)(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: process.env
+      env: buildCodexChildEnv()
     });
     let stdout = "";
     let stderr = "";
@@ -17099,7 +16898,7 @@ function formatUserFacingError(error, options = {}) {
 // ../../packages/runtime-codex/src/codex/config.ts
 function tryParseToml(content) {
   try {
-    const parsed = (0, import_toml3.parse)(content);
+    const parsed = (0, import_toml2.parse)(content);
     return { data: parsed ?? {}, error: null };
   } catch (error) {
     const maybe = error;
@@ -18138,7 +17937,7 @@ async function ensureCliStorageReady() {
 }
 
 // src/app/main.ts
-var VERSION = true ? "5.1.1" : "0.0.0";
+var VERSION = true ? "5.1.6" : "0.0.0";
 async function runCli() {
   const args = process.argv.slice(2);
   if (args.length === 0) {