codexuse-cli 6.2.2 → 6.2.3

package/dist/index.js

@@ -2026,7 +2026,7 @@ var require_toml = __commonJS({
 });
 
 // src/commands/accountPool.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_node_path15 = __toESM(require("path"));
 
 // ../../packages/contracts/src/settings/types.ts
@@ -3347,25 +3347,6 @@ async function updateDocument(input) {
   await finalizeDocumentRecovery(updated.stagedRecovery);
   return updated.value;
 }
-async function deleteDocument(dbPath, namespace) {
-  await withWriteQueue(
-    dbPath,
-    async () => withDatabase(dbPath, (db) => {
-      beginImmediate(db);
-      try {
-        withStatement(
-          db,
-          `DELETE FROM ${APP_STORAGE_TABLE} WHERE namespace = ?`,
-          (statement) => statement.run(namespace)
-        );
-        commit(db);
-      } catch (error) {
-        rollback(db);
-        throw error;
-      }
-    })
-  );
-}
 
 // ../../packages/runtime-app-state/src/storage/cloudSyncTransaction.ts
 var import_node_async_hooks = require("async_hooks");
@@ -3440,7 +3421,8 @@ async function withCloudSyncTransaction(userDataDir, mode, operation) {
 }
 
 // ../../packages/runtime-app-state/src/app/state.ts
-var APP_STATE_DOCUMENT = "desktop.app-state";
+var APP_STATE_DOCUMENT = "desktop.app-state.v2";
+var LEGACY_APP_STATE_DOCUMENT = "desktop.app-state";
 var APP_NAME = "codexuse-desktop";
 var PERSISTENCE_RETRY_COOLDOWN_MS = 5e3;
 var PERSISTENCE_READ_DEADLINE_MS = 8e3;
@@ -3450,6 +3432,7 @@ var appStateCache = null;
 var ephemeralAppState = null;
 var persistenceFailure = null;
 var pendingRendererUiPatch = null;
+var legacyAppStateNeedsMigration = false;
 var nextPersistenceRetryAt = 0;
 var writeLock = Promise.resolve();
 var writeLockContext = new import_node_async_hooks2.AsyncLocalStorage();
@@ -3477,6 +3460,10 @@ function freezeDeep(value3, seen = /* @__PURE__ */ new WeakSet()) {
   return Object.freeze(value3);
 }
 function resolveDefaultUserDataDir() {
+  const configured = process.env.CODEXUSE_DESKTOP_USER_DATA_DIR?.trim();
+  if (configured && import_node_path4.default.isAbsolute(configured)) {
+    return import_node_path4.default.resolve(configured);
+  }
   const home = process.env.HOME || import_node_os.default.homedir();
   if (!home) {
     throw new Error("Unable to resolve home directory for app state.");
@@ -3962,6 +3949,55 @@ function desktopLlmReasoningEffortsMatchStyle(adapter, style, values2) {
   }
   return style !== "openrouter" || !values2.includes("max") && !values2.includes("ultra");
 }
+function recoverDowngradedChatGptWebProfile(input) {
+  const expectedProviderId = `chatgpt-web-provider-${input.id.slice(-36)}`;
+  const provider = input.providers.find(
+    (candidate) => candidate.id === input.providerId
+  );
+  const selectedRoutes = input.modelRoutePublicSlugs.flatMap((publicSlug) => {
+    const route = input.routes.find(
+      (candidate) => candidate.publicSlug === publicSlug
+    );
+    return route ? [route] : [];
+  });
+  if (!/^chatgpt-web-[A-Za-z0-9_-]{36}$/.test(input.id) || !/^chatgpt-web-[A-Za-z0-9_-]{36}$/.test(input.profileHomeId) || input.providerId !== expectedProviderId || input.capabilityRef !== `CODEXUSE_LLM_PROFILE_${input.id}` || provider?.displayName !== "ChatGPT Web" || provider.baseUrl !== "http://127.0.0.1:1" || provider.authMode !== "bearer" || provider.credentialRef !== `CODEXUSE_CHATGPT_WEB_RUNTIME_${input.id}` || provider.transportPolicy.allowInsecureLocal !== true || selectedRoutes.length !== input.modelRoutePublicSlugs.length || selectedRoutes.some(
+    (route) => route.providerId !== input.providerId || route.adapter !== "openai-responses" || route.path !== "/v1/responses" || !chatGptWebRouteEffort(route.upstreamModelId) || route.publicSlug !== chatGptWebPublicSlug(input.id, route.upstreamModelId)
+  )) {
+    return null;
+  }
+  const supported = (capability) => capability.nativeSupport.state === "supported";
+  return {
+    id: input.id,
+    profileHomeId: input.profileHomeId,
+    runtimeId: `chatgpt-web:${input.id}`,
+    browserSessionId: `chatgpt-web:${input.id}`,
+    linkedIdentityVerified: false,
+    interactionMode: "automatic",
+    setupState: "failed",
+    runtimeState: "stopped",
+    availability: "degraded",
+    observedModelRoutes: selectedRoutes.map((route) => ({
+      publicSlug: route.publicSlug,
+      upstreamModelId: route.upstreamModelId,
+      displayName: route.displayName,
+      reasoningEfforts: [chatGptWebRouteEffort(route.upstreamModelId)],
+      contextWindow: route.catalogMetadata.contextWindow,
+      autoCompactTokenLimit: route.catalogMetadata.autoCompactTokenLimit,
+      effectiveContextWindowPercent: route.catalogMetadata.effectiveContextWindowPercent,
+      supportsImages: supported(route.capabilities.inputImage),
+      supportsFunctionTools: false,
+      supportsParallelTools: false,
+      supportsCompaction: route.catalogMetadata.autoCompactTokenLimit !== null,
+      fullHarnessVerified: false
+    })),
+    fullModeConfigured: false,
+    fullCodexHarnessVerified: false,
+    helperProtocolVersion: 0,
+    helperVersion: "unknown",
+    lastRuntimeError: "chatgpt-web-full-setup-required",
+    restartRequired: true
+  };
+}
 function normalizeDesktopLlmRegistry(value3, profiles) {
   if (!isRecord2(value3) || value3.version !== 1 && value3.version !== 2 && value3.version !== 3 && value3.version !== 4) {
     return migrateDesktopLlmRegistry(profiles);
@@ -4124,8 +4160,17 @@ function normalizeDesktopLlmRegistry(value3, profiles) {
     if (!id2 || !name || !profileHomeId || !providerId || modelRoutePublicSlugs.length === 0 || !defaultModelRoutePublicSlug || !capabilityRef || !createdAt || !updatedAt) {
       return [];
     }
-    const kind = entry.kind === "chatgpt-web" ? "chatgpt-web" : "custom";
-    const rawWeb = kind === "chatgpt-web" && isRecord2(entry.chatgptWeb) ? entry.chatgptWeb : null;
+    const recoveredWeb = entry.kind !== "chatgpt-web" ? recoverDowngradedChatGptWebProfile({
+      id: id2,
+      profileHomeId,
+      providerId,
+      capabilityRef,
+      modelRoutePublicSlugs,
+      providers,
+      routes
+    }) : null;
+    const kind = entry.kind === "chatgpt-web" || recoveredWeb ? "chatgpt-web" : "custom";
+    const rawWeb = kind === "chatgpt-web" ? isRecord2(entry.chatgptWeb) ? entry.chatgptWeb : recoveredWeb : null;
     const interactionMode = "automatic";
     const setupState = rawWeb?.setupState === "provisional" || rawWeb?.setupState === "signing-in" || rawWeb?.setupState === "verifying" || rawWeb?.setupState === "ready" || rawWeb?.setupState === "failed" ? rawWeb.setupState : "failed";
     const runtimeState = rawWeb?.runtimeState === "starting" || rawWeb?.runtimeState === "ready" || rawWeb?.runtimeState === "draining" || rawWeb?.runtimeState === "failed" ? rawWeb.runtimeState : "stopped";
@@ -4230,8 +4275,13 @@ function normalizeDesktopLlmRegistry(value3, profiles) {
       (profile) => profile.kind === "chatgpt-web" && profile.chatgptWeb ? [[profile.providerId, profile.chatgptWeb]] : []
     )
   );
+  const canonicalProviders = providers.map(
+    (provider) => webProfilesByProvider.has(provider.id) ? { ...provider, systemManaged: "chatgpt-web" } : provider
+  );
   const canonicalRoutes = routes.map((route) => {
-    const provider = providers.find((candidate) => candidate.id === route.providerId);
+    const provider = canonicalProviders.find(
+      (candidate) => candidate.id === route.providerId
+    );
     if (provider?.systemManaged !== "chatgpt-web") return route;
     const web = webProfilesByProvider.get(route.providerId);
     const observed = web?.observedModelRoutes.find(
@@ -4256,11 +4306,29 @@ function normalizeDesktopLlmRegistry(value3, profiles) {
       standaloneWebSearch: capability(false),
       imageGeneration: capability(false)
     };
-    return { ...route, capabilities };
+    const observedEffort = observed?.reasoningEfforts[0];
+    const reasoningEffort = isDesktopLlmReasoningEffort(observedEffort) ? observedEffort : null;
+    return {
+      ...route,
+      capabilities,
+      requestProfile: {
+        ...route.requestProfile,
+        reasoningStyle: "default",
+        supportsReasoningEffort: Boolean(reasoningEffort)
+      },
+      reasoningEffort: reasoningEffort ? {
+        mode: "selectable",
+        values: [reasoningEffort],
+        defaultValue: reasoningEffort,
+        source: "provider",
+        fetchedAt: route.reasoningEffort.fetchedAt
+      } : route.reasoningEffort,
+      published: observed?.fullHarnessVerified === true && observed.supportsFunctionTools && observed.supportsParallelTools
+    };
   });
   const revision = (0, import_node_crypto2.createHash)("sha256").update(
     JSON.stringify({
-      providers: providers.map((provider) => ({
+      providers: canonicalProviders.map((provider) => ({
         id: provider.id,
         displayName: provider.displayName,
         enabled: provider.enabled,
@@ -4309,7 +4377,7 @@ function normalizeDesktopLlmRegistry(value3, profiles) {
   return {
     version: 4,
     revision,
-    providers,
+    providers: canonicalProviders,
     routes: canonicalRoutes,
     externalProfiles: uniqueExternalProfiles
   };
@@ -4946,11 +5014,22 @@ function deepMerge(base, patch) {
   return next;
 }
 async function readAppStateFromStorage() {
-  return readDocumentStrict(
+  const current = await readDocumentStrict(
     resolveStorageDbPath(),
     APP_STATE_DOCUMENT,
     normalizeAppState
   );
+  if (current) {
+    legacyAppStateNeedsMigration = false;
+    return current;
+  }
+  const legacy = await readDocumentStrict(
+    resolveStorageDbPath(),
+    LEGACY_APP_STATE_DOCUMENT,
+    normalizeAppState
+  );
+  legacyAppStateNeedsMigration = legacy !== null;
+  return legacy;
 }
 async function readStoredAppStateOrNull() {
   try {
@@ -4966,7 +5045,7 @@ async function readStoredAppStateOrNull() {
 }
 async function readStoredAppStateForInit() {
   const stored = await readAppStateFromStorage();
-  if (stored && !pendingRendererUiPatch) {
+  if (stored && !pendingRendererUiPatch && !legacyAppStateNeedsMigration) {
     return stored;
   }
   const pendingUiPatch = pendingRendererUiPatch;
@@ -4974,7 +5053,7 @@ async function readStoredAppStateForInit() {
     dbPath: resolveStorageDbPath(),
     namespace: APP_STATE_DOCUMENT,
     normalize: normalizeAppState,
-    fallback: () => normalizeAppState(null),
+    fallback: () => stored ?? normalizeAppState(null),
     transform: (current) => pendingUiPatch ? deepMerge(current, { ui: pendingUiPatch }) : current,
     cloneBeforeTransform: false,
     cloneResult: false,
@@ -4983,6 +5062,7 @@ async function readStoredAppStateForInit() {
   if (pendingRendererUiPatch === pendingUiPatch) {
     pendingRendererUiPatch = null;
   }
+  legacyAppStateNeedsMigration = false;
   return initialized;
 }
 function degradeToMemory(kind, message) {
@@ -5061,6 +5141,7 @@ async function initializeAppState(userDataDir) {
     ephemeralAppState = null;
     persistenceFailure = null;
     pendingRendererUiPatch = null;
+    legacyAppStateNeedsMigration = false;
     nextPersistenceRetryAt = 0;
   }
   const state = await ensureInitialized();
@@ -5249,7 +5330,7 @@ async function updateAppSettings(transform3, onUpdated) {
 }
 
 // ../../packages/runtime-profiles/src/license/service.ts
-var import_node_crypto7 = __toESM(require("crypto"), 1);
+var import_node_crypto8 = __toESM(require("crypto"), 1);
 
 // ../../packages/runtime-codex/src/codex/settings.ts
 function asString2(value3) {
@@ -5505,8 +5586,8 @@ async function persistLicenseSecret(dbPath, secret) {
   await writeDocument(dbPath, LICENSE_SECRET_DOCUMENT, secret);
   return secret;
 }
-async function getLicenseSecret() {
-  const dbPath = resolveAppStorageDbPath(getUserDataDir());
+async function getLicenseSecret(userDataDir = getUserDataDir()) {
+  const dbPath = resolveAppStorageDbPath(userDataDir);
   const existing = await readDocument(dbPath, LICENSE_SECRET_DOCUMENT, normalizeSecret);
   const normalizedExisting = normalizeSecret(existing);
   if (normalizedExisting.length > 0) {
@@ -5517,7 +5598,7 @@ async function getLicenseSecret() {
 }
 
 // ../../packages/runtime-profiles/src/license/trial.ts
-var import_node_crypto6 = __toESM(require("crypto"), 1);
+var import_node_crypto7 = __toESM(require("crypto"), 1);
 
 // ../../packages/runtime-profiles/src/license/device-id.ts
 var import_node_crypto4 = __toESM(require("crypto"), 1);
@@ -5650,95 +5731,106 @@ async function registerTrialWithServer(input) {
 }
 
 // ../../packages/runtime-profiles/src/license/trial-token-store.ts
+var import_node_crypto6 = require("crypto");
+
+// ../../packages/runtime-profiles/src/secrets/local-secret-store.ts
 var import_node_crypto5 = require("crypto");
-var import_node_child_process2 = require("child_process");
-var KEYCHAIN_SERVICE = "CODEXUSE_TRIAL_TOKEN";
-var KEYCHAIN_ACCOUNT_PREFIX = "device-sha256:";
-var FALLBACK_DOCUMENT_PREFIX = "desktop.trial-token.";
-function keychainAccountForDevice(deviceId) {
-  const digest = (0, import_node_crypto5.createHash)("sha256").update(deviceId).digest("hex");
-  return KEYCHAIN_ACCOUNT_PREFIX + digest;
+var SECRET_NAME = /^[A-Za-z0-9_.:-]{1,220}$/;
+var DOCUMENT_PREFIX = "desktop.local-secret.";
+var ENCRYPTION_CONTEXT = "codexuse-local-secret-v1";
+var SECRET_LIMIT_BYTES = 64 * 1024;
+function validateName(name) {
+  if (!SECRET_NAME.test(name)) {
+    throw new Error("local-secret-name-invalid");
+  }
 }
-function fallbackDocumentForDevice(deviceId) {
-  const digest = (0, import_node_crypto5.createHash)("sha256").update(deviceId).digest("hex");
-  return FALLBACK_DOCUMENT_PREFIX + digest;
+function documentName(name) {
+  return DOCUMENT_PREFIX + (0, import_node_crypto5.createHash)("sha256").update(name).digest("hex");
+}
+function normalizeEnvelope(value3) {
+  if (!value3 || typeof value3 !== "object" || Array.isArray(value3)) {
+    throw new Error("local-secret-envelope-invalid");
+  }
+  const envelope = value3;
+  if (envelope.version !== 1 || typeof envelope.iv !== "string" || typeof envelope.tag !== "string" || typeof envelope.ciphertext !== "string") {
+    throw new Error("local-secret-envelope-invalid");
+  }
+  return envelope;
+}
+async function encryptionKey(userDataDir) {
+  const deviceSecret = await getLicenseSecret(userDataDir);
+  return (0, import_node_crypto5.createHash)("sha256").update(ENCRYPTION_CONTEXT).update("\0").update(deviceSecret).digest();
+}
+async function writeLocalSecret(name, secret, userDataDir = getUserDataDir()) {
+  validateName(name);
+  if (secret.length === 0 || Buffer.byteLength(secret) > SECRET_LIMIT_BYTES) {
+    throw new Error("local-secret-value-invalid");
+  }
+  const iv = (0, import_node_crypto5.randomBytes)(12);
+  const cipher = (0, import_node_crypto5.createCipheriv)("aes-256-gcm", await encryptionKey(userDataDir), iv);
+  cipher.setAAD(Buffer.from(name, "utf8"));
+  const ciphertext = Buffer.concat([
+    cipher.update(secret, "utf8"),
+    cipher.final()
+  ]);
+  const envelope = {
+    version: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ciphertext: ciphertext.toString("base64")
+  };
+  await writeDocument(
+    resolveAppStorageDbPath(userDataDir),
+    documentName(name),
+    envelope
+  );
+}
+async function readLocalSecret(name, userDataDir = getUserDataDir()) {
+  validateName(name);
+  const envelope = await readDocument(
+    resolveAppStorageDbPath(userDataDir),
+    documentName(name),
+    normalizeEnvelope
+  );
+  if (!envelope) return null;
+  try {
+    const decipher = (0, import_node_crypto5.createDecipheriv)(
+      "aes-256-gcm",
+      await encryptionKey(userDataDir),
+      Buffer.from(envelope.iv, "base64")
+    );
+    decipher.setAAD(Buffer.from(name, "utf8"));
+    decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+    return Buffer.concat([
+      decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+      decipher.final()
+    ]).toString("utf8") || null;
+  } catch (error) {
+    throw new Error("local-secret-read-failed", { cause: error });
+  }
+}
+
+// ../../packages/runtime-profiles/src/license/trial-token-store.ts
+var SECRET_PREFIX = "trial-token:";
+function secretNameForDevice(deviceId) {
+  const digest = (0, import_node_crypto6.createHash)("sha256").update(deviceId).digest("hex");
+  return SECRET_PREFIX + digest;
 }
 function normalizeToken(value3) {
   const trimmed = typeof value3 === "string" ? value3.trim() : "";
   return trimmed.length > 0 ? trimmed : null;
 }
-function runSecurityCommand(args2) {
-  return new Promise((resolve2, reject) => {
-    const child = (0, import_node_child_process2.spawn)("security", args2, { stdio: ["ignore", "pipe", "ignore"] });
-    let stdout = "";
-    child.stdout?.on("data", (chunk) => {
-      stdout += String(chunk);
-    });
-    child.on("error", () => {
-      reject(new Error("keychain-command-failed"));
-    });
-    child.on("close", (code) => {
-      resolve2({ code, stdout });
-    });
-  });
-}
 async function readStoredTrialToken(deviceId) {
-  if (process.platform !== "darwin") {
-    const dbPath = resolveAppStorageDbPath(getUserDataDir());
-    return readDocument(
-      dbPath,
-      fallbackDocumentForDevice(deviceId),
-      normalizeToken
-    );
-  }
-  const result2 = await runSecurityCommand([
-    "find-generic-password",
-    "-a",
-    keychainAccountForDevice(deviceId),
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-w"
-  ]).catch(() => null);
-  await deleteDocument(
-    resolveAppStorageDbPath(getUserDataDir()),
-    fallbackDocumentForDevice(deviceId)
-  ).catch(() => void 0);
-  if (!result2 || result2.code !== 0) {
-    return null;
-  }
-  return result2.stdout.length > 0 ? result2.stdout.replace(/\n$/, "") : null;
+  return normalizeToken(
+    await readLocalSecret(secretNameForDevice(deviceId)).catch(() => null)
+  );
 }
 async function writeStoredTrialToken(deviceId, token) {
   const value3 = typeof token === "string" ? token.trim() : "";
   if (!value3) {
     return;
   }
-  if (process.platform !== "darwin") {
-    const dbPath = resolveAppStorageDbPath(getUserDataDir());
-    await writeDocument(
-      dbPath,
-      fallbackDocumentForDevice(deviceId),
-      value3
-    );
-    return;
-  }
-  const result2 = await runSecurityCommand([
-    "add-generic-password",
-    "-U",
-    "-a",
-    keychainAccountForDevice(deviceId),
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-w",
-    value3
-  ]).catch(() => null);
-  await deleteDocument(
-    resolveAppStorageDbPath(getUserDataDir()),
-    fallbackDocumentForDevice(deviceId)
-  ).catch(() => void 0);
-  if (!result2 || result2.code !== 0) {
-    throw new Error("trial-token-keychain-write-failed");
-  }
+  await writeLocalSecret(secretNameForDevice(deviceId), value3);
 }
 
 // ../../packages/runtime-profiles/src/license/trial.ts
@@ -5764,7 +5856,7 @@ function trialSignaturePayload(trial) {
   });
 }
 function signTrial(trial, secret) {
-  return import_node_crypto6.default.createHmac("sha256", secret).update(trialSignaturePayload(trial)).digest("hex");
+  return import_node_crypto7.default.createHmac("sha256", secret).update(trialSignaturePayload(trial)).digest("hex");
 }
 function withTrialSignature(trial, secret) {
   return { ...trial, signature: signTrial(trial, secret) };
@@ -6096,7 +6188,7 @@ function licenseSignaturePayload(license) {
   return JSON.stringify(payload);
 }
 function signLicense(license, secret) {
-  return import_node_crypto7.default.createHmac("sha256", secret).update(licenseSignaturePayload(license)).digest("hex");
+  return import_node_crypto8.default.createHmac("sha256", secret).update(licenseSignaturePayload(license)).digest("hex");
 }
 function withSignature(license, secret) {
   return {
@@ -6457,7 +6549,7 @@ var LicenseService = class {
       throw new Error("License key is required.");
     }
     const secret = await getLicenseSecret();
-    const digest = import_node_crypto7.default.createHash("sha256").update(trimmed).digest("hex");
+    const digest = import_node_crypto8.default.createHash("sha256").update(trimmed).digest("hex");
     const normalized = await requestDeviceActivation(trimmed);
     const stored = {
       licenseKey: trimmed,
@@ -6518,7 +6610,7 @@ function shouldEnforceProfileLimit(status) {
 }
 
 // ../../packages/runtime-profiles/src/profiles/profile-manager.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto15 = require("crypto");
 var import_fs = require("fs");
 var import_node_os5 = __toESM(require("os"), 1);
 var import_path = __toESM(require("path"), 1);
@@ -6576,15 +6668,15 @@ function resolveProfileIdentityKeyFromProfile(profile) {
 }
 
 // ../../packages/runtime-codex/src/codex/rpc.ts
-var import_node_child_process6 = require("child_process");
-var import_node_crypto10 = require("crypto");
+var import_node_child_process5 = require("child_process");
+var import_node_crypto11 = require("crypto");
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_fs6 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path10 = __toESM(require("path"), 1);
 
 // ../../packages/runtime-codex/src/codex/cli.ts
-var import_node_child_process3 = require("child_process");
+var import_node_child_process2 = require("child_process");
 var import_node_fs4 = require("fs");
 var import_node_path5 = __toESM(require("path"), 1);
 var STABLE_CHANNEL = "stable";
@@ -6692,7 +6784,7 @@ function evaluateCodexCliStatus() {
 function runVersionPreflight(cliPath) {
   return new Promise((resolve2) => {
     const useNode = /\.(?:c|m)?js$/i.test(cliPath);
-    const child = (0, import_node_child_process3.spawn)(
+    const child = (0, import_node_child_process2.spawn)(
       useNode ? process.execPath : cliPath,
       useNode ? [cliPath, "--version"] : ["--version"],
       {
@@ -6761,7 +6853,7 @@ async function requireCodexCli() {
 }
 
 // ../../packages/runtime-codex/src/codex/command.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_path6 = __toESM(require("path"), 1);
 var cachedNodeRuntime = null;
 function isJavaScriptEntrypoint(binaryPath) {
@@ -6804,7 +6896,7 @@ function resolveNodeRuntime(env) {
     )
   );
   for (const candidate of candidates) {
-    const probe = (0, import_node_child_process4.spawnSync)(candidate, ["-v"], { env: runtimeEnv, stdio: "ignore" });
+    const probe = (0, import_node_child_process3.spawnSync)(candidate, ["-v"], { env: runtimeEnv, stdio: "ignore" });
     if (!probe.error && probe.status === 0) {
       cachedNodeRuntime = candidate;
       return candidate;
@@ -6829,7 +6921,7 @@ function buildCodexCommand(binaryPath, args2, env) {
 }
 
 // ../../packages/runtime-codex/src/codex/home.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_fs5 = require("fs");
 var import_promises2 = require("fs/promises");
 var import_node_os2 = __toESM(require("os"), 1);
@@ -6869,7 +6961,7 @@ function resolveCodexSqliteHomeDir(codexHomePath) {
 function resolveCurrentProfileCodexHomeDir(profileHomeId) {
   return import_node_path7.default.join(
     resolveProfileCodexHomesRoot(),
-    (0, import_node_crypto8.createHash)("sha256").update(profileHomeId).digest("hex").slice(0, 20)
+    (0, import_node_crypto9.createHash)("sha256").update(profileHomeId).digest("hex").slice(0, 20)
   );
 }
 function resolveProfileCodexHomeDir(profileHomeId) {
@@ -6982,7 +7074,7 @@ function buildCodexChildEnv(overrides = {}) {
 var import_toml = __toESM(require_toml(), 1);
 
 // ../../packages/runtime-codex/src/codex/config-metadata.ts
-var import_node_child_process5 = require("child_process");
+var import_node_child_process4 = require("child_process");
 var import_promises3 = require("fs/promises");
 var import_node_path8 = __toESM(require("path"), 1);
 var CONFIG_SCHEMA_URL = "https://raw.githubusercontent.com/openai/codex/main/codex-rs/core/config.schema.json";
@@ -7094,7 +7186,7 @@ function uniqueSorted(values2) {
 }
 async function runCommand(command, args2, timeoutMs = 3e3) {
   return new Promise((resolve2, reject) => {
-    const child = (0, import_node_child_process5.spawn)(command, args2, {
+    const child = (0, import_node_child_process4.spawn)(command, args2, {
       stdio: ["ignore", "pipe", "pipe"],
       env: buildCodexChildEnv()
     });
@@ -7275,7 +7367,7 @@ async function getCodexConfigMetadata(forceRefresh = false) {
 }
 
 // ../../packages/runtime-codex/src/codex/config-io.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_promises4 = require("fs/promises");
 var import_node_path9 = __toESM(require("path"), 1);
 
@@ -7405,7 +7497,7 @@ async function writeConfigContent(content, options) {
     await removeStaleConfigStagingFiles(targetPath);
     const mode = await resolveConfigWriteMode(targetPath);
     const normalized = ensureTrailingNewline(normalizeLineEndings(content));
-    const stagingPath = `${targetPath}.tmp-${process.pid}-${(0, import_node_crypto9.randomUUID)()}`;
+    const stagingPath = `${targetPath}.tmp-${process.pid}-${(0, import_node_crypto10.randomUUID)()}`;
     try {
       const handle = await (0, import_promises4.open)(stagingPath, "wx", mode);
       try {
@@ -24398,9 +24490,9 @@ var ChatGptWebCreateInput = Schema_exports.Struct({
   newOpenAiProfileName: ChatGptWebOptionalName,
   setupId: ChatGptWebOptionalSetupId,
   interactionMode: Schema_exports.optional(Schema_exports.Literal("automatic")),
-  // A passkey cannot complete in the private browser, so that sign-in is
-  // handed to a throwaway Chrome profile instead. The choice is made before
-  // anything opens, because the two paths open different windows.
+  // Google and passkeys cannot complete in the private browser, so this path
+  // uses a throwaway Chrome profile. The choice is made before anything opens,
+  // because the two paths open different windows.
   signInMethod: Schema_exports.optional(
     Schema_exports.Union([Schema_exports.Literal("password"), Schema_exports.Literal("passkey")])
   ),
@@ -25390,7 +25482,7 @@ function authWritebackPaths(filePath) {
   };
 }
 function fingerprintAuth(content) {
-  return (0, import_node_crypto10.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(content).digest("hex");
 }
 async function readOptionalFile(filePath) {
   try {
@@ -25405,7 +25497,7 @@ async function writeAtomicPath(filePath, content) {
   const dir = import_node_path10.default.dirname(filePath);
   const tempPath = import_node_path10.default.join(
     dir,
-    `.${import_node_path10.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto10.randomUUID)()}.tmp`
+    `.${import_node_path10.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto11.randomUUID)()}.tmp`
   );
   const handle = await import_node_fs6.promises.open(tempPath, "wx", 384);
   try {
@@ -25432,7 +25524,7 @@ async function installAuthFileIfAbsent(filePath, content) {
   const dir = import_node_path10.default.dirname(filePath);
   const tempPath = import_node_path10.default.join(
     dir,
-    `.${import_node_path10.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto10.randomUUID)()}.install`
+    `.${import_node_path10.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto11.randomUUID)()}.install`
   );
   const handle = await import_node_fs6.promises.open(tempPath, "wx", 384);
   try {
@@ -25503,7 +25595,7 @@ async function hasExternalOpenFileHandle(filePath) {
   }
   const lsofCommand = process.platform === "darwin" ? "/usr/sbin/lsof" : "lsof";
   return new Promise((resolve2) => {
-    const child = (0, import_node_child_process6.spawn)(lsofCommand, ["-F", "p", "--", filePath], {
+    const child = (0, import_node_child_process5.spawn)(lsofCommand, ["-F", "p", "--", filePath], {
       stdio: ["ignore", "pipe", "ignore"]
     });
     let output = "";
@@ -25903,7 +25995,7 @@ async function fetchRateLimitsViaRpc(envOverride, options = {}) {
     ["-s", "read-only", "-a", "never", "app-server"],
     childEnv
   );
-  const child = (0, import_node_child_process6.spawn)(command.command, command.args, {
+  const child = (0, import_node_child_process5.spawn)(command.command, command.args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: childEnv,
     shell: command.shell
@@ -26055,7 +26147,7 @@ async function activateResetWindowViaRpcIsolated(envOverride, options, sourceAut
     ["-s", "read-only", "-a", "never", "app-server"],
     childEnv
   );
-  const child = (0, import_node_child_process6.spawn)(command.command, command.args, {
+  const child = (0, import_node_child_process5.spawn)(command.command, command.args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: childEnv,
     shell: command.shell
@@ -26230,8 +26322,8 @@ async function activateResetWindowViaRpcIsolated(envOverride, options, sourceAut
 }
 
 // ../../packages/runtime-codex/src/codex/officialAppRestart.ts
-var import_node_child_process7 = require("child_process");
-var import_node_crypto12 = require("crypto");
+var import_node_child_process6 = require("child_process");
+var import_node_crypto13 = require("crypto");
 var import_node_fs9 = require("fs");
 var import_node_os4 = require("os");
 var import_node_path13 = __toESM(require("path"), 1);
@@ -26565,7 +26657,7 @@ async function findOfficialCodexThreadRecord(profileHome, threadId, options = {}
 }
 
 // ../../packages/runtime-codex/src/codex/sharedHistory.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_node_fs8 = require("fs");
 var import_promises5 = require("fs/promises");
 var import_node_path12 = __toESM(require("path"), 1);
@@ -27002,7 +27094,7 @@ function hashProfileKey(profileKey) {
   if (!profileKey) {
     return null;
   }
-  return (0, import_node_crypto12.createHash)("sha256").update(profileKey).digest("hex").slice(0, 12);
+  return (0, import_node_crypto13.createHash)("sha256").update(profileKey).digest("hex").slice(0, 12);
 }
 function sanitizeOfficialCodexOverlayActionTargetsForRenderer(targets) {
   const sanitized = [];
@@ -30340,7 +30432,7 @@ async function runCdpCommandSequence(debuggerUrl, commands, timeoutMs = CODEX_CD
   });
 }
 async function verifyCdpBindingRoundTrip(debuggerUrl) {
-  const nonce = (0, import_node_crypto12.randomUUID)();
+  const nonce = (0, import_node_crypto13.randomUUID)();
   const expression = `(() => {
     const binding = window[${JSON.stringify(CODEXUSE_BRIDGE_BINDING_NAME)}];
     if (typeof binding !== "function") return false;
@@ -30763,7 +30855,7 @@ async function startOfficialCodexBridgeActionListenerOnce(args2) {
   let closeNotified = false;
   let echoReceived = false;
   const requiredCommandIds = /* @__PURE__ */ new Set();
-  const echoId = (0, import_node_crypto12.randomUUID)();
+  const echoId = (0, import_node_crypto13.randomUUID)();
   const readyTimeout = setTimeout(() => {
     settleReady(false);
     try {
@@ -30837,7 +30929,7 @@ async function startOfficialCodexBridgeActionListenerOnce(args2) {
     }
   };
   bridgeActionListenerVerifiers.set(args2.debuggerUrl, async () => {
-    const id2 = (0, import_node_crypto12.randomUUID)();
+    const id2 = (0, import_node_crypto13.randomUUID)();
     return await new Promise((resolve2) => {
       const waiters = bridgeActionListenerHealthWaiters.get(args2.debuggerUrl) ?? /* @__PURE__ */ new Map();
       bridgeActionListenerHealthWaiters.set(args2.debuggerUrl, waiters);
@@ -31393,7 +31485,7 @@ async function recordOfficialCodexActivity(input) {
   };
   const finite2 = (value3, min4, max4) => typeof value3 === "number" && Number.isFinite(value3) ? Math.max(min4, Math.min(max4, value3)) : null;
   const entry = {
-    id: (0, import_node_crypto12.randomUUID)(),
+    id: (0, import_node_crypto13.randomUUID)(),
     at: now2.toISOString(),
     kind: input.kind,
     status: bounded(input.status, 80) ?? "unknown",
@@ -31463,7 +31555,7 @@ async function recordOfficialCodexActivity(input) {
 }
 function runCommand2(command, args2, timeoutMs = COMMAND_TIMEOUT_MS) {
   return new Promise((resolve2) => {
-    const child = (0, import_node_child_process7.spawn)(command, args2, {
+    const child = (0, import_node_child_process6.spawn)(command, args2, {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -31514,7 +31606,7 @@ var LAUNCH_LOCK_NAME = ".codexuse-launch.lock";
 var LAUNCH_LOCK_WAIT_MS = 6e4;
 async function withProfileLaunchFileLock(profileHome, work, options) {
   const accountKey = options.profileKey?.trim();
-  const lockPath = accountKey ? import_node_path13.default.join(resolveProfileCodexHomesRoot(), ".launch-locks", (0, import_node_crypto12.createHash)("sha256").update(accountKey).digest("hex")) : import_node_path13.default.join(profileHome, LAUNCH_LOCK_NAME);
+  const lockPath = accountKey ? import_node_path13.default.join(resolveProfileCodexHomesRoot(), ".launch-locks", (0, import_node_crypto13.createHash)("sha256").update(accountKey).digest("hex")) : import_node_path13.default.join(profileHome, LAUNCH_LOCK_NAME);
   const deadline = Date.now() + (options.waitMs ?? LAUNCH_LOCK_WAIT_MS);
   for (; ; ) {
     const release = await acquireCrossProcessFileLock(lockPath, { busyTimeoutMs: 0 });
@@ -32363,7 +32455,7 @@ async function openCodexWithProfileHome(candidate, profileHome, profileName, pre
     if (appUserDataDir) {
       (0, import_node_fs9.mkdirSync)(appUserDataDir, { recursive: true });
     }
-    child = (0, import_node_child_process7.spawn)(
+    child = (0, import_node_child_process6.spawn)(
       "/usr/bin/open",
       [
         "-n",
@@ -32671,7 +32763,7 @@ function sharedCodexLaunchOptions(useDefaultUserData, profileIdentity) {
   const userDataDir = !useDefaultUserData && profileIdentity ? import_node_path13.default.join(
     SHARED_CODEX_HOME,
     "codex-app-user-data",
-    (0, import_node_crypto12.createHash)("sha256").update(profileIdentity).digest("hex").slice(0, 16)
+    (0, import_node_crypto13.createHash)("sha256").update(profileIdentity).digest("hex").slice(0, 16)
   ) : void 0;
   return {
     useDefaultUserData,
@@ -35035,7 +35127,7 @@ async function attemptOfficialCodexManagedLiveLogin(args2) {
   }
 }
 async function applyOfficialCodexLiveAccountSwitchOnce(options = {}, takeoverTrace = {
-  operationId: (0, import_node_crypto12.randomUUID)(),
+  operationId: (0, import_node_crypto13.randomUUID)(),
   attempt: 1
 }) {
   let expectedWindowPreflight = options.expectedWindowPreflight;
@@ -36104,7 +36196,7 @@ async function applyOfficialCodexLiveAccountSwitchOnce(options = {}, takeoverTra
 }
 function applyOfficialCodexLiveAccountSwitch(options = {}) {
   return enqueueProfileAction("shared-window", () => withProfileLaunchFileLock(resolveDefaultCodexHomeDir(), async () => {
-    const operationId = (0, import_node_crypto12.randomUUID)();
+    const operationId = (0, import_node_crypto13.randomUUID)();
     let result2 = await applyOfficialCodexLiveAccountSwitchOnce(options, {
       operationId,
       attempt: 1
@@ -36784,16 +36876,16 @@ async function launchOfficialCodexProfileInstanceOnce(options) {
 }
 
 // ../../packages/runtime-app-state/src/app/profileHomeMutationCoordinator.ts
-var import_node_crypto13 = require("crypto");
+var import_node_crypto14 = require("crypto");
 
 // ../../packages/runtime-app-state/src/app/processOwner.ts
-var import_node_child_process8 = require("child_process");
+var import_node_child_process7 = require("child_process");
 function readProcessStartedAt(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0) {
     return null;
   }
   try {
-    const output = (0, import_node_child_process8.execFileSync)("/bin/ps", ["-p", String(pid), "-o", "lstart="], {
+    const output = (0, import_node_child_process7.execFileSync)("/bin/ps", ["-p", String(pid), "-o", "lstart="], {
       encoding: "utf8",
       timeout: 2e3
     }).trim();
@@ -36822,12 +36914,12 @@ function isProcessEpochAlive(pid, expectedStartedAt) {
 // ../../packages/runtime-app-state/src/app/profileHomeMutationCoordinator.ts
 var PROFILE_HOME_MUTATION_TTL_MS = 10 * 60 * 1e3;
 var PROFILE_HOME_MUTATION_RENEW_MS = 30 * 1e3;
-var PROCESS_OWNER_ID = (0, import_node_crypto13.randomUUID)();
+var PROCESS_OWNER_ID = (0, import_node_crypto14.randomUUID)();
 var PROCESS_STARTED_AT = readProcessStartedAt(process.pid);
 var activeRenewals = /* @__PURE__ */ new Map();
 async function acquireProfileHomeMutationIntent(input) {
   const now2 = Date.now();
-  const operationId = (0, import_node_crypto13.randomUUID)();
+  const operationId = (0, import_node_crypto14.randomUUID)();
   const renewal = {
     timer: void 0,
     pending: Promise.resolve(),
@@ -37049,7 +37141,7 @@ var AUTH_MUTATION_MANIFEST_NAME = ".codexuse-auth-transaction.json";
 var AUTH_MUTATION_BACKUP_NAME = ".codexuse-auth-transaction.backup";
 var AUTH_MUTATION_REPLACED_NAME = ".codexuse-auth-transaction.replaced";
 var PROFILE_HOME_MUTATION_MARKER_TTL_MS = 10 * 60 * 1e3;
-var PROCESS_OWNER_ID2 = (0, import_node_crypto14.randomUUID)();
+var PROCESS_OWNER_ID2 = (0, import_node_crypto15.randomUUID)();
 var PROCESS_STARTED_AT2 = readProcessStartedAt(process.pid);
 var globalAuthSwapLock = Promise.resolve();
 var profileOperationLocks = /* @__PURE__ */ new Map();
@@ -37902,7 +37994,7 @@ var ProfileManager = class {
       let attempt = 0;
       let homeId;
       do {
-        homeId = `legacy-${(0, import_node_crypto14.createHash)("sha256").update(profileName).update("\0").update(String(attempt)).digest("hex").slice(0, 32)}`;
+        homeId = `legacy-${(0, import_node_crypto15.createHash)("sha256").update(profileName).update("\0").update(String(attempt)).digest("hex").slice(0, 32)}`;
         attempt += 1;
       } while (profileNamesByHomeId.has(homeId.toLowerCase()));
       homeIdsByProfileName.set(profileName, homeId);
@@ -38112,7 +38204,7 @@ var ProfileManager = class {
     const dir = import_path.default.dirname(filePath);
     const tempPath = import_path.default.join(
       dir,
-      `.${import_path.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto14.randomUUID)()}.tmp`
+      `.${import_path.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto15.randomUUID)()}.tmp`
     );
     await import_fs.promises.mkdir(dir, { recursive: true, mode: 448 });
     if (process.platform !== "win32") {
@@ -38399,7 +38491,7 @@ var ProfileManager = class {
     if (content === null) {
       return null;
     }
-    return (0, import_node_crypto14.createHash)("sha256").update(content).digest("hex");
+    return (0, import_node_crypto15.createHash)("sha256").update(content).digest("hex");
   }
   async readOptionalFile(filePath) {
     try {
@@ -38457,7 +38549,7 @@ var ProfileManager = class {
     const dir = import_path.default.dirname(filePath);
     const tempPath = import_path.default.join(
       dir,
-      `.${import_path.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto14.randomUUID)()}.install`
+      `.${import_path.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto15.randomUUID)()}.install`
     );
     const handle = await import_fs.promises.open(tempPath, "wx", 384);
     try {
@@ -38577,7 +38669,7 @@ var ProfileManager = class {
     });
     const manifest = {
       version: 1,
-      id: (0, import_node_crypto14.randomUUID)(),
+      id: (0, import_node_crypto15.randomUUID)(),
       operation,
       phase: "prepared",
       sourceFingerprint: this.fingerprintAuthContent(sourceRaw),
@@ -39319,7 +39411,7 @@ var ProfileManager = class {
     const displayName = typeof options?.displayName === "string" && options.displayName.trim().length > 0 ? options.displayName.trim() : existingRecord?.displayName ?? resolvedName;
     const record2 = {
       name: resolvedName,
-      homeId: existingRecord?.homeId ?? (options?.homeId ? this.normalizeProfileHomeId(options.homeId, resolvedName) : (0, import_node_crypto14.randomUUID)()),
+      homeId: existingRecord?.homeId ?? (options?.homeId ? this.normalizeProfileHomeId(options.homeId, resolvedName) : (0, import_node_crypto15.randomUUID)()),
       cloudHomeId: existingRecord?.cloudHomeId ?? null,
       displayName,
       data,
@@ -39424,7 +39516,7 @@ var ProfileManager = class {
     const safeName = record2.name.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 48) || "profile";
     const destination = import_path.default.join(
       trashRoot,
-      `CodexUse-${safeName}-${(0, import_node_crypto14.randomUUID)()}`
+      `CodexUse-${safeName}-${(0, import_node_crypto15.randomUUID)()}`
     );
     await import_fs.promises.rename(profileHome, destination);
     return destination;
@@ -39852,7 +39944,7 @@ var ProfileManager = class {
   async acquireProfileRuntimeLease(record2) {
     const leaseDir = this.getProfileRuntimeLeaseDir(record2.homeId);
     const deletingPath = (0, import_path2.join)(leaseDir, ".deleting");
-    const leaseId = (0, import_node_crypto14.randomUUID)();
+    const leaseId = (0, import_node_crypto15.randomUUID)();
     const leasePath = (0, import_path2.join)(leaseDir, `${leaseId}.json`);
     const backupPath = (0, import_path2.join)(leaseDir, `${leaseId}.auth.backup`);
     const releaseIntent = await this.acquireProfileHomeWriteIntent(record2);
@@ -40063,7 +40155,7 @@ var ProfileManager = class {
   async acquireProfileHomeMutationGuard(record2) {
     const leaseDir = this.getProfileRuntimeLeaseDir(record2.homeId);
     const deletingPath = (0, import_path2.join)(leaseDir, ".deleting");
-    const mutationId = (0, import_node_crypto14.randomUUID)();
+    const mutationId = (0, import_node_crypto15.randomUUID)();
     const mutationIntent = await acquireProfileHomeMutationIntent({
       homeId: record2.homeId,
       profileName: record2.name
@@ -41442,8 +41534,8 @@ var ProfileManager = class {
       if (mappedHomeId !== void 0 && !isSafeProfileHomePathSegment(mappedHomeId)) {
         throw new Error(`Cloud Sync restore contains an invalid profile home id.`);
       }
-      const homeId = mappedHomeId ?? (0, import_node_crypto14.randomUUID)();
-      const cloudHomeId = remoteHomeId || existing?.cloudHomeId || existing?.homeId || renamedExisting?.cloudHomeId || renamedExisting?.homeId || (0, import_node_crypto14.randomUUID)();
+      const homeId = mappedHomeId ?? (0, import_node_crypto15.randomUUID)();
+      const cloudHomeId = remoteHomeId || existing?.cloudHomeId || existing?.homeId || renamedExisting?.cloudHomeId || renamedExisting?.homeId || (0, import_node_crypto15.randomUUID)();
       const sourceRecord = renamedExisting ?? existing;
       if (sourceRecord) {
         sourceHomeIdByTargetHomeId.set(homeId, sourceRecord.homeId);
@@ -42408,13 +42500,13 @@ async function listApiKeys(stateDir) {
   return Object.values(store.apiKeysById).filter((key) => key.revokedAt === null).sort((left, right) => right.createdAt.localeCompare(left.createdAt)).map(accountPoolApiKeyView);
 }
 function hashToken(token) {
-  return (0, import_node_crypto15.createHash)("sha256").update(token).digest("hex");
+  return (0, import_node_crypto16.createHash)("sha256").update(token).digest("hex");
 }
 async function createApiKey(stateDir) {
-  const plaintextToken = `cux_pool_${(0, import_node_crypto15.randomBytes)(24).toString("hex")}`;
+  const plaintextToken = `cux_pool_${(0, import_node_crypto16.randomBytes)(24).toString("hex")}`;
   const now2 = (/* @__PURE__ */ new Date()).toISOString();
   const keyRecord = {
-    id: (0, import_node_crypto15.randomUUID)(),
+    id: (0, import_node_crypto16.randomUUID)(),
     tokenHash: hashToken(plaintextToken),
     tokenPreview: `${plaintextToken.slice(0, 8)}...${plaintextToken.slice(-6)}`,
     createdAt: now2,
@@ -42919,7 +43011,7 @@ async function handleAccountPoolCommand(args2, version) {
 }
 
 // src/commands/codex.ts
-var import_node_child_process10 = require("child_process");
+var import_node_child_process9 = require("child_process");
 var import_node_os6 = __toESM(require("os"));
 
 // ../../packages/runtime-profiles/src/profiles/rate-limit-notifier.ts
@@ -43130,7 +43222,7 @@ async function resolveWorkspaceProfileBinding(requestedPath) {
 }
 
 // src/platform/codexCli.ts
-var import_node_child_process9 = require("child_process");
+var import_node_child_process8 = require("child_process");
 var import_node_fs12 = require("fs");
 var import_node_path17 = __toESM(require("path"));
 var ENV_HINTS2 = ["CODEX_BINARY", "CODEX_CLI_PATH", "CODEX_PATH"];
@@ -43202,7 +43294,7 @@ async function runCodexLogin(mode, envOverrides = {}) {
   const resolvedMode = resolveLoginMode(mode ?? null);
   const loginArgs = resolvedMode === "device" ? ["login", "--device-auth"] : ["login"];
   const { command, args: args2, shell } = buildCodexCommand2(codexPath, loginArgs);
-  const child = (0, import_node_child_process9.spawn)(command, args2, {
+  const child = (0, import_node_child_process8.spawn)(command, args2, {
     stdio: "inherit",
     env: { ...process.env, ...envOverrides },
     shell
@@ -43271,7 +43363,7 @@ function compareCandidates(left, right) {
 async function runCommand3(codexPath, args2, timeoutMs) {
   const command = buildCodexCommand2(codexPath, args2);
   return new Promise((resolve2) => {
-    const child = (0, import_node_child_process10.spawn)(command.command, command.args, {
+    const child = (0, import_node_child_process9.spawn)(command.command, command.args, {
       env: process.env,
       shell: command.shell,
       stdio: ["ignore", "pipe", "pipe"]
@@ -43360,7 +43452,7 @@ async function runCodexWithProfile(manager, profileName, codexArgs) {
   });
   const command = buildCodexCommand2(codexPath, codexArgs);
   try {
-    const child = (0, import_node_child_process10.spawn)(command.command, command.args, {
+    const child = (0, import_node_child_process9.spawn)(command.command, command.args, {
       env: runtime.env,
       shell: command.shell,
       stdio: "inherit"
@@ -43611,12 +43703,12 @@ var import_node_os7 = __toESM(require("os"));
 var import_node_path19 = __toESM(require("path"));
 
 // ../../packages/runtime-app-state/src/app/officialCodexSwitchCoordinator.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var import_node_fs13 = require("fs");
 var import_node_path18 = __toESM(require("path"), 1);
 var DEFAULT_SWITCH_INTENT_TTL_MS = 10 * 60 * 1e3;
 var SWITCH_INTENT_RENEW_MS = 30 * 1e3;
-var PROCESS_OWNER_ID3 = (0, import_node_crypto16.randomUUID)();
+var PROCESS_OWNER_ID3 = (0, import_node_crypto17.randomUUID)();
 var PROCESS_STARTED_AT3 = readProcessStartedAt(process.pid);
 var localIntentDepth = /* @__PURE__ */ new Map();
 var pendingLocalIntentAcquisitions = /* @__PURE__ */ new Map();
@@ -43626,7 +43718,7 @@ function nextSwitchIntentGeneration(current) {
 }
 async function acquireOfficialCodexSwitchIntent(input) {
   const now2 = Date.now();
-  const operationId = input.operationId?.trim() || (0, import_node_crypto16.randomUUID)();
+  const operationId = input.operationId?.trim() || (0, import_node_crypto17.randomUUID)();
   const targetProfileName = input.targetProfileName.trim();
   if (!targetProfileName) {
     throw new Error("Profile name is required");
@@ -45945,7 +46037,7 @@ async function pushRemoteSnapshot(access, snapshot2, options) {
 
 // ../../packages/runtime-profiles/src/cloud-sync/journal.ts
 var import_node_fs15 = require("fs");
-var import_node_crypto17 = require("crypto");
+var import_node_crypto18 = require("crypto");
 var import_node_path20 = __toESM(require("path"), 1);
 var JOURNAL_FILENAME = "cloud-sync-pull.journal.json";
 function getCloudSyncJournalPath() {
@@ -45964,7 +46056,7 @@ async function writeCloudSyncJournal(journal) {
   const dir = import_node_path20.default.dirname(target);
   await import_node_fs15.promises.mkdir(dir, { recursive: true, mode: 448 });
   await import_node_fs15.promises.chmod(dir, 448);
-  const staging = `${target}.tmp-${process.pid}-${(0, import_node_crypto17.randomUUID)()}`;
+  const staging = `${target}.tmp-${process.pid}-${(0, import_node_crypto18.randomUUID)()}`;
   await import_node_fs15.promises.writeFile(staging, JSON.stringify(journal), {
     encoding: "utf8",
     flag: "wx",
@@ -45988,10 +46080,8 @@ async function clearCloudSyncJournal() {
 }
 
 // ../../packages/runtime-profiles/src/cloud-sync/encryption.ts
-var import_node_child_process11 = require("child_process");
-var import_node_crypto18 = require("crypto");
-var KEYCHAIN_SERVICE2 = "CODEXUSE_CLOUD_SYNC_PASSPHRASE";
-var KEYCHAIN_ACCOUNT_PREFIX2 = "license-sha256:";
+var import_node_crypto19 = require("crypto");
+var REMEMBERED_PASSPHRASE_PREFIX = "cloud-sync-passphrase:";
 var ENCRYPTION_AAD = Buffer.from("codexuse-cloud-sync-v2", "utf8");
 var SCRYPT_PARAMS = {
   N: 32768,
@@ -46014,7 +46104,7 @@ function requireCloudSyncPassphrase(value3) {
 }
 async function deriveKey(passphrase, salt, params = SCRYPT_PARAMS) {
   return new Promise((resolve2, reject) => {
-    (0, import_node_crypto18.scrypt)(passphrase, salt, params.keyLength, {
+    (0, import_node_crypto19.scrypt)(passphrase, salt, params.keyLength, {
       N: params.N,
       r: params.r,
       p: params.p,
@@ -46051,10 +46141,10 @@ function normalizeDecryptedSnapshot(value3) {
   };
 }
 async function encryptCloudSyncSnapshot(snapshot2, passphrase) {
-  const salt = (0, import_node_crypto18.randomBytes)(16);
-  const iv = (0, import_node_crypto18.randomBytes)(12);
+  const salt = (0, import_node_crypto19.randomBytes)(16);
+  const iv = (0, import_node_crypto19.randomBytes)(12);
   const key = await deriveKey(requireCloudSyncPassphrase(passphrase), salt);
-  const cipher = (0, import_node_crypto18.createCipheriv)("aes-256-gcm", key, iv);
+  const cipher = (0, import_node_crypto19.createCipheriv)("aes-256-gcm", key, iv);
   cipher.setAAD(ENCRYPTION_AAD);
   const plaintext = Buffer.from(JSON.stringify(snapshot2), "utf8");
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
@@ -46081,7 +46171,7 @@ async function decryptCloudSyncSnapshot(snapshot2, passphrase) {
     const tag2 = fromBase64(snapshot2.encryption.tag);
     const ciphertext = fromBase64(snapshot2.encryption.ciphertext);
     const key = await deriveKey(requireCloudSyncPassphrase(passphrase), salt, snapshot2.encryption.kdfParams);
-    const decipher = (0, import_node_crypto18.createDecipheriv)("aes-256-gcm", key, iv);
+    const decipher = (0, import_node_crypto19.createDecipheriv)("aes-256-gcm", key, iv);
     decipher.setAAD(ENCRYPTION_AAD);
     decipher.setAuthTag(tag2);
     const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -46095,60 +46185,16 @@ async function decryptCloudSyncSnapshot(snapshot2, passphrase) {
     throw wrapped;
   }
 }
-function keychainAccountForLicense(licenseKey) {
-  const digest = (0, import_node_crypto18.createHash)("sha256").update(licenseKey).digest("hex");
-  return KEYCHAIN_ACCOUNT_PREFIX2 + digest;
-}
-function runSecurityCommand2(args2) {
-  return new Promise((resolve2, reject) => {
-    const child = (0, import_node_child_process11.spawn)("security", args2, { stdio: ["ignore", "pipe", "ignore"] });
-    let stdout = "";
-    child.stdout?.on("data", (chunk) => {
-      stdout += String(chunk);
-    });
-    child.on("error", () => {
-      reject(new Error("keychain-command-failed"));
-    });
-    child.on("close", (code) => {
-      resolve2({ code, stdout });
-    });
-  });
+function rememberedPassphraseName(licenseKey) {
+  const digest = (0, import_node_crypto19.createHash)("sha256").update(licenseKey).digest("hex");
+  return REMEMBERED_PASSPHRASE_PREFIX + digest;
 }
 async function readRememberedCloudSyncPassphrase(licenseKey) {
-  if (process.platform !== "darwin") {
-    return null;
-  }
-  const result2 = await runSecurityCommand2([
-    "find-generic-password",
-    "-a",
-    keychainAccountForLicense(licenseKey),
-    "-s",
-    KEYCHAIN_SERVICE2,
-    "-w"
-  ]);
-  if (result2.code !== 0) {
-    return null;
-  }
-  return result2.stdout.length > 0 ? result2.stdout.replace(/\n$/, "") : null;
+  return readLocalSecret(rememberedPassphraseName(licenseKey));
 }
 async function writeRememberedCloudSyncPassphrase(licenseKey, passphrase) {
-  if (process.platform !== "darwin") {
-    throw new Error("keychain-unsupported");
-  }
   const value3 = requireCloudSyncPassphrase(passphrase);
-  const result2 = await runSecurityCommand2([
-    "add-generic-password",
-    "-U",
-    "-a",
-    keychainAccountForLicense(licenseKey),
-    "-s",
-    KEYCHAIN_SERVICE2,
-    "-w",
-    value3
-  ]);
-  if (result2.code !== 0) {
-    throw new Error("keychain-write-failed");
-  }
+  await writeLocalSecret(rememberedPassphraseName(licenseKey), value3);
 }
 
 // ../../packages/runtime-profiles/src/cloud-sync/service.ts
@@ -46539,7 +46585,7 @@ async function resolvePassphrase(licenseKey, options) {
   }
   const remembered = await readRememberedCloudSyncPassphrase(licenseKey);
   if (remembered) {
-    return { value: remembered, source: "keychain" };
+    return { value: remembered, source: "local" };
   }
   throw new Error("Cloud Sync passphrase is required.");
 }
@@ -46550,7 +46596,7 @@ async function rememberPassphraseIfRequested(licenseKey, options, passphrase) {
   try {
     await writeRememberedCloudSyncPassphrase(licenseKey, passphrase.value);
   } catch (error) {
-    logWarn("[cloud-sync] failed to remember passphrase in keychain", {
+    logWarn("[cloud-sync] failed to remember passphrase locally", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
@@ -46921,7 +46967,7 @@ async function ensureCliStorageReady() {
 }
 
 // src/app/main.ts
-var VERSION = true ? "6.2.2" : "0.0.0";
+var VERSION = true ? "6.2.3" : "0.0.0";
 async function runCli() {
   const args2 = process.argv.slice(2);
   if (args2.length === 0) {