dsh-codex-connect 0.1.0-alpha.4.25 → 0.1.0-alpha.4.26

package/INSTALL.md

@@ -1,6 +1,6 @@
 # Installation Runbook for CLI Agents
 
-Alpha 4.25 is verified with DSH `0.1.2-alpha.5` and its declared pi-ai range `^0.84.2`; the verified registry installation resolves pi-ai `0.84.4`.
+Alpha 4.26 is verified with DSH `0.1.2-rc.1` and its declared pi-ai range `^0.84.2`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
@@ -23,13 +23,14 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.26` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
 
 If your exact DSH version is unknown or not listed, stop and verify the combination before installing. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.25's verified contract is DSH plugin API packages `0.1.2-alpha.5`, `@earendil-works/pi-ai` `^0.84.2` (resolved as `0.84.4` during verification), and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.24 remains an earlier verified choice for the same DSH version, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
+Alpha 4.26's verified contract is DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
 
-These choices reflect the repository's existing verification record, not a new installation or runtime probe. This guidance does not fix upstream DSH compatibility or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+The Alpha 4.26 row reflects a fresh isolated installation and runtime probe. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
 ### Install the selected version and validate
 
@@ -52,23 +53,30 @@ These choices reflect the repository's existing verification record, not a new i
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
+   For DSH `0.1.2-rc.1`, use Alpha 4.26:
+
+   ```sh
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.26
+   ```
+
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
 
    ```sh
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.26'` only for the DSH `0.1.2-rc.1` combination.
 
-3. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
-4. Confirm the effective `agent-default-model` and `web.searchProvider` values are unchanged from before installation.
-5. Run secret-free diagnostics:
+3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
+4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
+5. Confirm the effective `agent-default-model` and `web.searchProvider` values are unchanged from before installation.
+6. Run secret-free diagnostics:
 
    ```sh
    dsh plugin --profile web exec dsh-codex-connect doctor
    ```
 
-6. If the user explicitly requests login, open **Settings → Plugins → Plugin configuration → Codex Connect**, or check `status` and then use `login` or `login --device-code`. OAuth approval belongs to the user.
+7. If the user explicitly requests login, open **Settings → Plugins → Plugin configuration → Codex Connect**, or check `status` and then use `login` or `login --device-code`. OAuth approval belongs to the user.
 
    Alpha 4.25 offers the same account actions in **Settings → Models → Openai-Codex**, plus a shared **More settings** dialog for model visibility, proxy, search, image, context-budget, and Auto-review controls. The original Plugin settings entry remains available; neither entry automatically starts login or changes model/search defaults.
 

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 65a8d94c57ae1bd869f5247f158cb1f8d221f4c0
-docs/README.zh.md: 1bdd0641d14d6c27da312ce9ac954fbb2664beae
+README.md: c2fb988676d46f1d05d96b2e665df6c4b0505fce
+docs/README.zh.md: 54386abdfc31e6d3a243892ee9f8508642033b59

package/README.md

@@ -18,19 +18,23 @@ The setup and image-result screenshots in this English guide are captured from t
 
 ## Quick start (about five minutes)
 
-This quick start targets DSH `0.1.2-alpha.5` with Codex Connect Alpha 4.25. Check `dsh --version` first. For DSH `0.1.2-alpha.2`, `0.1.1-rc.2`, or `0.1.0-rc.7`, select the matching plugin version in [INSTALL.md](INSTALL.md). This guide uses the `web` profile; replace `web` with the name of the Harness profile you already use. From a DeepSeek Harness source checkout, prefix the commands with `pnpm`.
+This quick start targets DSH `0.1.2-rc.1` with Codex Connect Alpha 4.26. Check `dsh --version` first. For DSH `0.1.2-alpha.5`, `0.1.2-alpha.2`, `0.1.1-rc.2`, or `0.1.0-rc.7`, select the matching plugin version in [INSTALL.md](INSTALL.md). This guide uses the `web` profile; replace `web` with the name of the Harness profile you already use. From a DeepSeek Harness source checkout, prefix the commands with `pnpm`.
 
 ### 1. Install the plugin into one profile
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.26
 ```
 
 Expected result: the package is added to that profile. This does not change the profile's default model or global search route.
 
 Use the exact version above to keep the verified DSH and plugin pair reproducible. `alpha` is a moving npm tag, not a compatibility guarantee.
 
-### What's new in Alpha 4.25
+### What's new in Alpha 4.26
+
+- Add verified compatibility with DSH `0.1.2-rc.1`, including an isolated install, profile composition, diagnostics, model-catalog, and disposal canary.
+
+### Previously in Alpha 4.25
 
 - Show the exact 5-hour and weekly quota windows returned by ChatGPT for the selected Codex model. Missing windows stay hidden, Spark remains separate, and plan names do not suppress server data.
 - Separate verified compatibility from maintainer follow-up. The settings card no longer treats missing verification as a known runtime failure or recommends a plugin downgrade.
@@ -322,7 +326,7 @@ The command sends one fixed, synthetic no-op to the hidden reviewer through the
 
 ## Compatibility and security boundary
 
-- Alpha 4.25 is verified with DSH plugin API packages `0.1.2-alpha.5`, `@earendil-works/pi-ai` `^0.84.2` (resolved as `0.84.4` during verification), and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.24 remains an earlier verified choice for the same DSH version, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, and Alpha 4.21 remains verified with DSH `0.1.1-rc.2` and pi-ai `0.82.1`. [verified-compatibility.json](verified-compatibility.json) records the exact pairs; see [INSTALL.md](INSTALL.md) for installation commands.
+- Alpha 4.26 is verified with DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, and Alpha 4.21 remains verified with DSH `0.1.1-rc.2` and pi-ai `0.82.1`. [verified-compatibility.json](verified-compatibility.json) records the exact pairs; see [INSTALL.md](INSTALL.md) for installation commands.
 - The new DSH client splits its former runtime into Session Controller, Settings, Store, and Renderer packages. Codex Connect uses those public interfaces for settings and image actions. DSH owns normalized preview encoding and dimensions; Codex Connect retains the exact original image separately.
 - Upgrade the DSH plugin API packages and `@earendil-works/pi-ai` as one group, then run `dsh-codex-connect doctor --json` and the compatibility check again. This contract does not make claims about future versions.
 - When the daily upstream check finds a new `latest` or `next` DSH candidate, it installs Codex Connect into an isolated profile, boots the installed model runtime without OAuth credentials, verifies model and reasoning-effort discovery, and confirms provider disposal. Live sign-in, quota, and model requests still require manual validation in the test profile.

package/compatibility.json

@@ -4,7 +4,7 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "dshPluginApi": {
-    "version": "0.1.2-alpha.5",
+    "version": "0.1.2-rc.1",
     "packages": [
       "@deepseek-ai/dsh-agent",
       "@deepseek-ai/dsh-atomic-write",

package/docs/README.zh.md

@@ -18,19 +18,23 @@
 
 ## 五分钟快速开始
 
-本快速指南适用于 DSH `0.1.2-alpha.5` 与 Codex Connect Alpha 4.25。请先运行 `dsh --version`。如果使用 DSH `0.1.2-alpha.2`、`0.1.1-rc.2` 或 `0.1.0-rc.7`，请在 [INSTALL.md](../INSTALL.md) 中选择匹配的插件版本。本指南使用 `web` profile；请把 `web` 替换成你已经在用的 Harness profile 名称。如果在 DeepSeek Harness 源码 checkout 中运行，请在命令前加 `pnpm`。
+本快速指南适用于 DSH `0.1.2-rc.1` 与 Codex Connect Alpha 4.26。请先运行 `dsh --version`。如果使用 DSH `0.1.2-alpha.5`、`0.1.2-alpha.2`、`0.1.1-rc.2` 或 `0.1.0-rc.7`，请在 [INSTALL.md](../INSTALL.md) 中选择匹配的插件版本。本指南使用 `web` profile；请把 `web` 替换成你已经在用的 Harness profile 名称。如果在 DeepSeek Harness 源码 checkout 中运行，请在命令前加 `pnpm`。
 
 ### 1. 将插件装入一个 profile
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.26
 ```
 
 预期结果：包被加入该 profile。这个动作不会更改 profile 的默认模型或全局搜索路由。
 
 请使用上面的精确版本，确保已验证的 DSH 与插件组合可以复现。`alpha` 是会移动的 npm 标签，不是兼容性保证。
 
-### Alpha 4.25 更新内容
+### Alpha 4.26 更新内容
+
+- 新增对 DSH `0.1.2-rc.1` 的已验证兼容性，覆盖隔离安装、profile 组合、诊断、模型目录和卸载清理 canary。
+
+### Alpha 4.25 既有内容
 
 - 显示 ChatGPT 为当前 Codex 模型实际返回的 5 小时和每周额度窗口。缺少的窗口不会凭空出现，Spark 额度保持独立，也不会因套餐名称而隐藏服务端数据。
 - 将“当前组合是否已验证”和“是否需要提醒维护者”分开判断。缺少验证记录不再被说成已知运行失败，也不会建议降级插件。
@@ -324,7 +328,7 @@ dsh plugin --profile web exec dsh-codex-connect auto-review-probe --json
 
 ## 兼容性与安全边界
 
-- Alpha 4.25 已与 DSH 插件 API packages `0.1.2-alpha.5`、`@earendil-works/pi-ai` `^0.84.2`（验证时解析为 `0.84.4`）和 Node.js `^22.19.0 || >=24.0.0` 完成验证。Alpha 4.24 仍是同一 DSH 版本较早的已验证选择；Alpha 4.23 仍是 DSH `0.1.2-alpha.2` 的已验证选择；Alpha 4.21 仍与 DSH `0.1.1-rc.2` 和 pi-ai `0.82.1` 保持已验证状态。[verified-compatibility.json](../verified-compatibility.json) 记录精确组合；安装命令见 [INSTALL.md](../INSTALL.md)。
+- Alpha 4.26 已与 DSH 插件 API packages `0.1.2-rc.1`、`@earendil-works/pi-ai` `^0.84.2` 和 Node.js `^22.19.0 || >=24.0.0` 完成验证。Alpha 4.25 仍是 DSH `0.1.2-alpha.5` 的已验证选择；Alpha 4.23 仍是 DSH `0.1.2-alpha.2` 的已验证选择；Alpha 4.21 仍与 DSH `0.1.1-rc.2` 和 pi-ai `0.82.1` 保持已验证状态。[verified-compatibility.json](../verified-compatibility.json) 记录精确组合；安装命令见 [INSTALL.md](../INSTALL.md)。
 - 新版 DSH 将原来的 client runtime 拆分为 Session Controller、Settings、Store 和 Renderer 包。Codex Connect 通过这些公开接口接入设置和图片操作。规范化预览的编码与尺寸由 DSH 决定；Codex Connect 另行保留字节完全一致的原图。
 - 升级时请将 DSH 插件 API packages 与 `@earendil-works/pi-ai` 作为一组升级，再运行 `dsh-codex-connect doctor --json` 和兼容性检查。本契约不对未来版本作判断。
 - 每日上游检查发现新的 DSH `latest` 或 `next` 候选版本时，会把 Codex Connect 安装到隔离 Profile 中，在没有 OAuth 凭据的情况下启动已安装的模型运行时，验证模型与推理强度发现，并确认提供方可被正确卸载。真实登录、额度和模型请求仍需在测试 Profile 中人工验证。

package/docs/design.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the design document. Re-record with:
 #   git hash-object docs/design.md docs/design.zh.md
-design.md: 86c383527dad511eb3458fb6c6389d5f8e9e9c16
-design.zh.md: f6112594d2c88ebab0f35e5f8f8dd2e949e611b5
+design.md: 6a633995a2ca0261f6c01f2b17710bf64dca87c7
+design.zh.md: 6bf9359f089f52ef6b8e821f9a9aeab784e020bd

package/docs/design.md

@@ -10,7 +10,9 @@ The Host registers `llm-openai-codex` as the plugin-owned capability settings na
 
 ## OAuth persistence
 
-The plugin uses `$DSH_HOME/.openai-codex-auth.json`, separate from Codex CLI/Desktop state. The file format is strict and versioned. POSIX reads reject group/world-accessible files. Parent directories and files are created with owner-only modes, writes are atomic, and refresh mutations use the Harness cross-process file lock. Callers receive cloned credentials. Browser-origin trust is a separate `$DSH_HOME/.openai-codex-trusted-origins.json` sidecar with `version: 1`, `mode: "allowlist"`, and exact normalized HTTP(S) origins; it never contains OAuth material and is changed only by the standalone CLI.
+The plugin uses `$DSH_HOME/.openai-codex-auth.json`, separate from Codex CLI/Desktop state. Format version 2 stores at most 16 OAuth accounts and names exactly one active account. Existing version-1 documents remain readable and migrate on the first credential mutation; that migration first creates the owner-only `.openai-codex-auth.json.v1-backup` rollback copy. A pre-existing rollback copy must be owner-only and match the current version-1 document or migration stops before replacing the main document. Removing any account or signing out deletes the rollback copy so removed credentials do not persist there. Documents are limited to 512 KiB. POSIX reads reject group/world-accessible files, non-regular files are rejected, writes are atomic, and mutations use the Harness cross-process file lock. Callers receive cloned credentials.
+
+Browser account routes expose deterministic plugin-derived keys, local display labels, masked email addresses when present in the OAuth token, and active state. They never expose the provider's account id or token fields. Activation and deletion are serialized with browser OAuth. After OAuth resolution, quota, image-generation, and Auto-review requests resolve the account id stored with that exact access token, so a concurrent account switch cannot combine credentials from different accounts. Deleting the active account while another remains requires the caller to name the replacement; provider-global logout deletes every account. Browser-origin trust is a separate `$DSH_HOME/.openai-codex-trusted-origins.json` sidecar with `version: 1`, `mode: "allowlist"`, and exact normalized HTTP(S) origins; it never contains OAuth material and is changed only by the standalone CLI.
 
 The settings routes and CLI reuse the existing OAuth path and route names for migration compatibility. Only an explicit login operation emits an authorization URL or code. Browser requests are accepted by default only from loopback; a remote request must use an exact effective HTTP(S) origin in the current sidecar, must not carry cross-site Fetch Metadata, and must match any supplied Origin exactly. The sidecar is re-read for every request, and unknown fields or modes fail closed. A login challenge accepts only credential-free HTTPS URLs and fails closed after 30 seconds or when the provider finishes without a URL; logout and disposal cancel pending waiters. Status responses are redacted. Doctor uses `lstat` metadata and never opens the document.
 
@@ -26,4 +28,4 @@ Before registration the plugin checks current provider ids. An existing `openai-
 
 ## Compatibility boundary
 
-Alpha 4.25 pins Harness `0.1.2-alpha.5` development dependencies and follows its pi-ai range `^0.84.2`; the verified release lockfile selects pi-ai `0.84.4`. Supported Node.js remains `^22.19.0 || >=24.0.0`. The keyed `settings.plugin.item` integration remains, while client types come from their Session Controller, Settings, Store, and Renderer owners. The published compatibility record lists the exact Alpha 4.25 and DSH `0.1.2-alpha.5` pair. Backend eligibility, quotas, models, service-side context capacity, and protocol details remain controlled upstream. Tests use temporary OAuth documents and mocked network responses; CI does not perform real authentication.
+Alpha 4.26 pins Harness `0.1.2-rc.1` development dependencies and follows its pi-ai range `^0.84.2`. Supported Node.js remains `^22.19.0 || >=24.0.0`. The keyed `settings.plugin.item` integration remains, while client types come from their Session Controller, Settings, Store, and Renderer owners. The published compatibility record lists the exact Alpha 4.26 and DSH `0.1.2-rc.1` pair. Backend eligibility, quotas, models, service-side context capacity, and protocol details remain controlled upstream. Tests use temporary OAuth documents and mocked network responses; CI does not perform real authentication.

package/docs/design.zh.md

@@ -10,7 +10,9 @@ Host 将 `llm-openai-codex` 注册为插件自有的能力 settings namespace。
 
 ## OAuth 持久化
 
-插件使用 `$DSH_HOME/.openai-codex-auth.json`，与 Codex CLI/Desktop 状态分离。文件格式严格且有版本号；POSIX 上会拒绝组/其他用户可读文件。父目录和文件按仅所有者权限创建，写入采用原子替换，刷新修改使用 Harness 跨进程文件锁，返回给调用方的是凭据副本。浏览器 origin 授权单独存放于 `$DSH_HOME/.openai-codex-trusted-origins.json`，格式为 `version: 1`、`mode: "allowlist"` 和规范化的精确 HTTP(S) origin；其中不含 OAuth 内容，且只能通过独立 CLI 修改。
+插件使用 `$DSH_HOME/.openai-codex-auth.json`，与 Codex CLI/Desktop 状态分离。格式 version 2 最多保存 16 个 OAuth 账户，并明确指定唯一当前账户。原 version 1 文件仍可读取，第一次修改凭据时才迁移；迁移前会先生成仅所有者可读的 `.openai-codex-auth.json.v1-backup` 回退副本。若该副本已存在，它必须仅所有者可读且与当前 version 1 文件一致，否则迁移会在替换主文件前停止。移除任一账户或执行退出登录时会删除该副本，避免已移除凭据继续留存。文档大小上限为 512 KiB。POSIX 上拒绝组/其他用户可读文件，也拒绝非普通文件；写入采用原子替换，所有修改使用 Harness 跨进程文件锁，返回给调用方的是凭据副本。
+
+浏览器账户路由只返回插件派生的稳定键、本地显示名称、OAuth token 中存在邮箱时的脱敏地址以及当前账户状态，不返回 provider 原始 account id 或 token 字段。账户切换和删除与浏览器 OAuth 串行执行；OAuth 解析完成后，额度、图片生成和 Auto-review 请求会查找与该 access token 精确配套的 account id，因此并发切换账户不会混用两个账户的凭据。仍有其他账户时，删除当前账户必须由调用方明确指定接替账户；provider 级退出登录会删除全部账户。浏览器 origin 授权单独存放于 `$DSH_HOME/.openai-codex-trusted-origins.json`，格式为 `version: 1`、`mode: "allowlist"` 和规范化的精确 HTTP(S) origin；其中不含 OAuth 内容，且只能通过独立 CLI 修改。
 
 为兼容迁移，设置页路由、OAuth 路径和 provider id 不改名。浏览器请求默认只允许 loopback；远程请求必须使用当前 sidecar 中的精确有效 HTTP(S) origin，不能带 cross-site Fetch Metadata，若带 Origin 还必须精确匹配。每次请求都会重新读取 sidecar；未知字段或错误 mode 会快速失败。登录挑战只接受不含凭据的 HTTPS 地址；30 秒内未得到地址、provider 已结束但没有地址、退出登录或插件卸载时，所有 waiter 都会被清理。只有显式登录会输出授权 URL 或代码；状态输出会脱敏。doctor 只用 `lstat` 检查元数据，不打开文件。
 
@@ -22,4 +24,4 @@ Host 将 `llm-openai-codex` 注册为插件自有的能力 settings namespace。
 
 注册前检查现有 provider id；发现 `openai-codex` 已被占用时，给出旧 bundle 或手动 provider 配置的定向迁移提示。boot-free CLI doctor 只报告包/运行时版本、OAuth 路径元数据、能力默认值和安全提示。
 
-Alpha 4.25 固定使用 Harness `0.1.2-alpha.5` 开发依赖，并跟随其 pi-ai 版本范围 `^0.84.2`；已验证的发布锁文件选择 pi-ai `0.84.4`。Node.js 支持范围仍为 `^22.19.0 || >=24.0.0`。keyed `settings.plugin.item` 集成保持不变，客户端类型继续从 Session Controller、Settings、Store 和 Renderer 的所属包导入。已发布兼容性记录列出 Alpha 4.25 与 DSH `0.1.2-alpha.5` 的精确组合。资格、额度、模型、服务端上下文容量和后端协议仍由上游控制。测试仅使用临时 OAuth 文档和模拟网络响应，CI 不执行真实认证。
+Alpha 4.26 固定使用 Harness `0.1.2-rc.1` 开发依赖，并跟随其 pi-ai 版本范围 `^0.84.2`。Node.js 支持范围仍为 `^22.19.0 || >=24.0.0`。keyed `settings.plugin.item` 集成保持不变，客户端类型继续从 Session Controller、Settings、Store 和 Renderer 的所属包导入。已发布兼容性记录列出 Alpha 4.26 与 DSH `0.1.2-rc.1` 的精确组合。资格、额度、模型、服务端上下文容量和后端协议仍由上游控制。测试仅使用临时 OAuth 文档和模拟网络响应，CI 不执行真实认证。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { At as logoutOpenAICodex, Ft as OpenAICodexCredentialStore, H as DSH_PLUGIN_API_PACKAGES, It as openAICodexAuthPath, Mt as openAICodexModelCatalog, N as CODEX_CONNECT_VERSION, Pt as OPENAI_CODEX_PROVIDER, Tt as normalizeTrustedOrigin, X as readInstalledPackageVersion, Y as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, jt as openAICodexAuthStatus, kt as loginOpenAICodex, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, wt as OpenAICodexTrustedOriginsStore } from "./src-Di2xxpDv.js";
+import { At as logoutOpenAICodex, H as DSH_PLUGIN_API_PACKAGES, Lt as OPENAI_CODEX_PROVIDER, Mt as openAICodexModelCatalog, N as CODEX_CONNECT_VERSION, Rt as OpenAICodexCredentialStore, Tt as normalizeTrustedOrigin, X as readInstalledPackageVersion, Y as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, jt as openAICodexAuthStatus, kt as loginOpenAICodex, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, wt as OpenAICodexTrustedOriginsStore, zt as openAICodexAuthPath } from "./src-FSN1b9Tk.js";
 import { createHash } from "node:crypto";
 import { Agent, ProxyAgent, fetch } from "undici";
 import { fileURLToPath } from "node:url";
@@ -208,7 +208,7 @@ var CodexCapabilityDiagnostics = class {
 			packageVersions: versions
 		});
 		const missing = Object.values(versions).some((value) => value === null) || !/^v?\d+\.\d+\.\d+$/u.test(versions["node"] ?? "");
-		const runtime = DSH_PLUGIN_API_PACKAGES.some((name) => versions[name] !== null && versions[name] !== "0.1.2-alpha.5") || compatibility.status === "incompatible" ? result("rejected", "declared-version-mismatch", "Use DSH API 0.1.2-alpha.5 and pi-ai ^0.84.2 together. DSH 0.1.0-rc.7 requires Codex Connect 0.1.0-alpha.4.14.") : missing || compatibility.status === "unknown" ? result("unknown", "version-metadata-unavailable", "Run this command from the plugin installation in the intended profile.") : result("supported", "declared-host-versions-match", "Host package versions satisfy the declared requirements; this is not a live profile or browser compatibility test.");
+		const runtime = DSH_PLUGIN_API_PACKAGES.some((name) => versions[name] !== null && versions[name] !== "0.1.2-rc.1") || compatibility.status === "incompatible" ? result("rejected", "declared-version-mismatch", "Use DSH API 0.1.2-rc.1 and pi-ai ^0.84.2 together. DSH 0.1.0-rc.7 requires Codex Connect 0.1.0-alpha.4.14.") : missing || compatibility.status === "unknown" ? result("unknown", "version-metadata-unavailable", "Run this command from the plugin installation in the intended profile.") : result("supported", "declared-host-versions-match", "Host package versions satisfy the declared requirements; this is not a live profile or browser compatibility test.");
 		const model = this.deps.catalog().find((item) => item.id === request.model)?.id ?? null;
 		const unknownNetwork = result("unknown", "not-probed", "Run capabilities --model <catalog-id> --probe explicitly; this sends a fixed short request and may consume quota.");
 		const checks = {

package/lib/client.js

@@ -5725,7 +5725,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.ts
-		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.25";
+		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.26";
 		//#endregion
 		//#region src/client/OpenAICodexModelsCard.tsx
 		/** Compact Models account entry with quota disclosure and shared configuration. */

package/lib/index.d.ts

@@ -1,13 +1,29 @@
 import z from "@deepseek-ai/schemastery";
-import { AuthInteraction, Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+import { AuthInteraction, Credential, CredentialInfo, CredentialStore, OAuthCredential } from "@earendil-works/pi-ai";
 import "@deepseek-ai/dsh-tools";
 import { Context, Service } from "@deepseek-ai/cordis";
 import { WebSearchProvider, WebSearchRequest, WebSearchResult } from "@deepseek-ai/dsh-web";
+//#region src/account-profile.d.ts
+type OpenAICodexAccountProfileSource = 'oauth' | 'generated';
+//#endregion
 //#region src/store.d.ts
 /** Provider route and pi-ai provider id owned by this bundle. */
 declare const OPENAI_CODEX_PROVIDER = "openai-codex";
 /** Basename of the OAuth document inside the Harness home. */
 declare const OPENAI_CODEX_AUTH_FILENAME = ".openai-codex-auth.json";
+/** Maximum number of stored OpenAI Codex accounts. */
+declare const OPENAI_CODEX_ACCOUNT_LIMIT = 16;
+/** Maximum serialized credential document size. */
+declare const OPENAI_CODEX_AUTH_DOCUMENT_LIMIT: number;
+/** Suffix used for the one-time version-1 rollback copy. */
+declare const OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX = ".v1-backup";
+interface OpenAICodexAccountSummary {
+  accountKey: string;
+  displayName: string;
+  maskedEmail?: string;
+  profileSource: OpenAICodexAccountProfileSource;
+  active: boolean;
+}
 /**
  * Resolve the default OAuth document path.
  * @param dshHome - optional Harness-home override.
@@ -18,16 +34,28 @@ declare function openAICodexAuthPath(dshHome?: string): string;
 declare class OpenAICodexCredentialStore implements CredentialStore {
   /** Absolute credential document path. */
   readonly filename: string;
+  /** Owner-only version-1 rollback copy, created at the first migration write. */
+  readonly version1BackupFilename: string;
   /**
    * @param filename - explicit document path, defaulting under `$DSH_HOME`.
    */
   constructor(filename?: string);
   /** Read and validate the current document without acquiring the writer lock. */
-  private readCurrent;
+  private readDocument;
+  private readDocumentAt;
+  private writeDocument;
   /** @inheritdoc */
   read(providerId: string): Promise<Credential | undefined>;
   /** @inheritdoc */
   list(): Promise<readonly CredentialInfo[]>;
+  /** List browser-safe account summaries without exposing provider account ids. */
+  accounts(): Promise<readonly OpenAICodexAccountSummary[]>;
+  /** Resolve the account id stored with one exact access token. */
+  accountIdForAccess(access: string): Promise<string | undefined>;
+  /** Select a stored account using its browser-safe key. */
+  activate(selectedAccountKey: string): Promise<OAuthCredential>;
+  /** Remove one account; active removal requires an explicit stored replacement. */
+  removeAccount(selectedAccountKey: string, replacementAccountKey?: string): Promise<void>;
   /** @inheritdoc */
   modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
   /** @inheritdoc */
@@ -180,7 +208,7 @@ declare const IMAGE_GENERATE_TOOL_NAME = "codex_connect_image_generate";
 //#region src/compatibility.d.ts
 declare const COMPATIBILITY_SCHEMA_VERSION: 1;
 declare const SUPPORTED_NODE_RANGE = "^22.19.0 || >=24.0.0";
-declare const SUPPORTED_DSH_PLUGIN_API_VERSION = "0.1.2-alpha.5";
+declare const SUPPORTED_DSH_PLUGIN_API_VERSION = "0.1.2-rc.1";
 declare const SUPPORTED_PI_AI_RANGE = "^0.84.2";
 declare const PI_AI_PACKAGE = "@earendil-works/pi-ai";
 declare const DSH_PLUGIN_API_PACKAGES: readonly ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-host-webserver", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-pi-ai", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-util-values", "@deepseek-ai/dsh-web"];
@@ -224,7 +252,7 @@ declare const COMPATIBILITY_CONTRACT: {
     readonly node: "^22.19.0 || >=24.0.0";
   };
   readonly dshPluginApi: {
-    readonly version: "0.1.2-alpha.5";
+    readonly version: "0.1.2-rc.1";
     readonly packages: readonly ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-attachment", "@deepseek-ai/dsh-home-paths", "@deepseek-ai/dsh-host-webserver", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-llm-pi-ai", "@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-settings", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-util-values", "@deepseek-ai/dsh-web"];
   };
   readonly piAi: {
@@ -731,4 +759,4 @@ declare const Config: z<Config>;
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, type CompatibilityDetectionOptions, type CompatibilityEntry, type CompatibilityEvaluationInput, type CompatibilityPackageName, type CompatibilityReport, type CompatibilityStatus, Config, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, type GeneratedImagePayload, IMAGE_GENERATE_TOOL_NAME, type ImageGenerationRequest, type ImageGenerationResponse, type ImageRequestContext, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, type OpenAICodexAuthStatus, OpenAICodexCredentialStore, type OpenAICodexCredits, type OpenAICodexDiagnosticOptions, type OpenAICodexDiagnosticReport, type OpenAICodexHistoryMigrationFile, type OpenAICodexHistoryMigrationOptions, type OpenAICodexHistoryMigrationResult, type OpenAICodexIndividualLimit, OpenAICodexProxyManager, type OpenAICodexProxyProbeClassification, type OpenAICodexProxyProbeResult, type OpenAICodexRateLimit, type OpenAICodexRateLimitWindow, type OpenAICodexSearchContextSize, type OpenAICodexSearchMode, OpenAICodexSearchProvider, type OpenAICodexSearchProviderOptions, type OpenAICodexSearchRequestRecord, type OpenAICodexSettingsConfig, OpenAICodexTransport, OpenAICodexTransportError, type OpenAICodexTransportErrorCode, type OpenAICodexTransportV1, type OpenAICodexUpdateResult, type OpenAICodexUsage, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };
+export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, type CompatibilityDetectionOptions, type CompatibilityEntry, type CompatibilityEvaluationInput, type CompatibilityPackageName, type CompatibilityReport, type CompatibilityStatus, Config, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, type GeneratedImagePayload, IMAGE_GENERATE_TOOL_NAME, type ImageGenerationRequest, type ImageGenerationResponse, type ImageRequestContext, OPENAI_CODEX_ACCOUNT_LIMIT, OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, type OpenAICodexAccountSummary, type OpenAICodexAuthStatus, OpenAICodexCredentialStore, type OpenAICodexCredits, type OpenAICodexDiagnosticOptions, type OpenAICodexDiagnosticReport, type OpenAICodexHistoryMigrationFile, type OpenAICodexHistoryMigrationOptions, type OpenAICodexHistoryMigrationResult, type OpenAICodexIndividualLimit, OpenAICodexProxyManager, type OpenAICodexProxyProbeClassification, type OpenAICodexProxyProbeResult, type OpenAICodexRateLimit, type OpenAICodexRateLimitWindow, type OpenAICodexSearchContextSize, type OpenAICodexSearchMode, OpenAICodexSearchProvider, type OpenAICodexSearchProviderOptions, type OpenAICodexSearchRequestRecord, type OpenAICodexSettingsConfig, OpenAICodexTransport, OpenAICodexTransportError, type OpenAICodexTransportErrorCode, type OpenAICodexTransportV1, type OpenAICodexUpdateResult, type OpenAICodexUsage, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };

package/lib/index.js

@@ -1,2 +1,2 @@
-import { $ as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, A as assertNoOpenAICodexProviderConflict, At as logoutOpenAICodex, B as COMPATIBILITY_PACKAGES, C as OPENAI_CODEX_TRANSPORT_ERROR_CODES, Ct as isFastModeSessionId, D as isOpenAICodexTransportError, Dt as parseOpenAICodexUsage, E as OpenAICodexTransportError, Et as OPENAI_CODEX_USAGE_URL, F as checkForOpenAICodexUpdate, Ft as OpenAICodexCredentialStore, G as SUPPORTED_NODE_RANGE, H as DSH_PLUGIN_API_PACKAGES, I as compareOpenAICodexVersions, It as openAICodexAuthPath, J as detectCompatibility, K as SUPPORTED_PI_AI_RANGE, L as parseOpenAICodexUpdateResult, M as openAICodexConflictMessage, Nt as OPENAI_CODEX_AUTH_FILENAME, O as VIEW_IMAGE_TOOL_NAME, Ot as readOpenAICodexRateLimits, P as OPENAI_CODEX_UPDATE_PATH, Pt as OPENAI_CODEX_PROVIDER, Q as OPENAI_CODEX_PROXY_TEST_PATH, R as parseOpenAICodexVersion, S as OPENAI_CODEX_TRANSPORT_API_VERSION, St as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, T as OpenAICodexTransport, U as PI_AI_PACKAGE, V as COMPATIBILITY_SCHEMA_VERSION, W as SUPPORTED_DSH_PLUGIN_API_VERSION, Y as evaluateCompatibility, Z as OPENAI_CODEX_PROXY_DETECT_PATH, _ as OPENAI_CODEX_IMAGE_MAX_COUNT, _t as resolveOpenAICodexProxyUrl, a as name, at as listOpenAICodexProxyCandidates, b as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, bt as FastModeRegistry, c as migrateOpenAICodexSearchHistory, ct as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, d as OPENAI_CODEX_BASE_URL, dt as DEFAULT_OPENAI_CODEX_SETTINGS, et as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_SETTINGS_NAMESPACE, g as OPENAI_CODEX_IMAGE_GENERATION_URL, h as mapOpenAICodexSearchResponse, ht as isValidOpenAICodexProxyUrl, i as inject, it as detectOpenAICodexProxies, j as diagnoseOpenAICodex, jt as openAICodexAuthStatus, k as IMAGE_GENERATE_TOOL_NAME, kt as loginOpenAICodex, lt as DEFAULT_OPENAI_CODEX_SEARCH_MODE, m as OpenAICodexSearchProvider, mt as isValidOpenAICodexContextWindowOverrides, n as OPENAI_CODEX_SETTINGS_NS, nt as OPENAI_CODEX_PROXY_PROBE_URL, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as DEFAULT_OPENAI_CODEX_PROXY_URL, p as OPENAI_CODEX_SEARCH_URL, pt as decodeOpenAICodexSettings, q as assessCompatibility, r as apply, rt as OpenAICodexProxyManager, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, t as Config, tt as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, ut as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, v as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, vt as resolveOpenAICodexSettings, w as OPENAI_CODEX_TRANSPORT_SERVICE, x as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, xt as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, y as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, yt as OPENAI_CODEX_FAST_MODE_PATH, z as COMPATIBILITY_CONTRACT } from "./src-Di2xxpDv.js";
-export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, Config, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, IMAGE_GENERATE_TOOL_NAME, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, OpenAICodexCredentialStore, OpenAICodexProxyManager, OpenAICodexSearchProvider, OpenAICodexTransport, OpenAICodexTransportError, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };
+import { $ as OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, A as assertNoOpenAICodexProviderConflict, At as logoutOpenAICodex, B as COMPATIBILITY_PACKAGES, C as OPENAI_CODEX_TRANSPORT_ERROR_CODES, Ct as isFastModeSessionId, D as isOpenAICodexTransportError, Dt as parseOpenAICodexUsage, E as OpenAICodexTransportError, Et as OPENAI_CODEX_USAGE_URL, F as checkForOpenAICodexUpdate, Ft as OPENAI_CODEX_AUTH_FILENAME, G as SUPPORTED_NODE_RANGE, H as DSH_PLUGIN_API_PACKAGES, I as compareOpenAICodexVersions, It as OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, J as detectCompatibility, K as SUPPORTED_PI_AI_RANGE, L as parseOpenAICodexUpdateResult, Lt as OPENAI_CODEX_PROVIDER, M as openAICodexConflictMessage, Nt as OPENAI_CODEX_ACCOUNT_LIMIT, O as VIEW_IMAGE_TOOL_NAME, Ot as readOpenAICodexRateLimits, P as OPENAI_CODEX_UPDATE_PATH, Pt as OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, Q as OPENAI_CODEX_PROXY_TEST_PATH, R as parseOpenAICodexVersion, Rt as OpenAICodexCredentialStore, S as OPENAI_CODEX_TRANSPORT_API_VERSION, St as OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, T as OpenAICodexTransport, U as PI_AI_PACKAGE, V as COMPATIBILITY_SCHEMA_VERSION, W as SUPPORTED_DSH_PLUGIN_API_VERSION, Y as evaluateCompatibility, Z as OPENAI_CODEX_PROXY_DETECT_PATH, _ as OPENAI_CODEX_IMAGE_MAX_COUNT, _t as resolveOpenAICodexProxyUrl, a as name, at as listOpenAICodexProxyCandidates, b as OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, bt as FastModeRegistry, c as migrateOpenAICodexSearchHistory, ct as DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, d as OPENAI_CODEX_BASE_URL, dt as DEFAULT_OPENAI_CODEX_SETTINGS, et as OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, f as OPENAI_CODEX_SEARCH_PROVIDER, ft as OPENAI_CODEX_SETTINGS_NAMESPACE, g as OPENAI_CODEX_IMAGE_GENERATION_URL, h as mapOpenAICodexSearchResponse, ht as isValidOpenAICodexProxyUrl, i as inject, it as detectOpenAICodexProxies, j as diagnoseOpenAICodex, jt as openAICodexAuthStatus, k as IMAGE_GENERATE_TOOL_NAME, kt as loginOpenAICodex, lt as DEFAULT_OPENAI_CODEX_SEARCH_MODE, m as OpenAICodexSearchProvider, mt as isValidOpenAICodexContextWindowOverrides, n as OPENAI_CODEX_SETTINGS_NS, nt as OPENAI_CODEX_PROXY_PROBE_URL, o as OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, ot as DEFAULT_OPENAI_CODEX_PROXY_URL, p as OPENAI_CODEX_SEARCH_URL, pt as decodeOpenAICodexSettings, q as assessCompatibility, r as apply, rt as OpenAICodexProxyManager, s as OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, st as DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, t as Config, tt as OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, ut as DEFAULT_OPENAI_CODEX_SEARCH_MODEL, v as OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, vt as resolveOpenAICodexSettings, w as OPENAI_CODEX_TRANSPORT_SERVICE, x as OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, xt as OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, y as OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, yt as OPENAI_CODEX_FAST_MODE_PATH, z as COMPATIBILITY_CONTRACT, zt as openAICodexAuthPath } from "./src-FSN1b9Tk.js";
+export { COMPATIBILITY_CONTRACT, COMPATIBILITY_PACKAGES, COMPATIBILITY_SCHEMA_VERSION, Config, DEFAULT_OPENAI_CODEX_PROXY_URL, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS, DEFAULT_OPENAI_CODEX_SEARCH_MODE, DEFAULT_OPENAI_CODEX_SEARCH_MODEL, DEFAULT_OPENAI_CODEX_SETTINGS, DSH_PLUGIN_API_PACKAGES, FastModeRegistry, FastModeRegistry as OpenAICodexFastModeRegistry, IMAGE_GENERATE_TOOL_NAME, OPENAI_CODEX_ACCOUNT_LIMIT, OPENAI_CODEX_AUTH_DOCUMENT_LIMIT, OPENAI_CODEX_AUTH_FILENAME, OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX, OPENAI_CODEX_BASE_URL, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH, OPENAI_CODEX_FAST_MODE_PATH, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX, OPENAI_CODEX_IMAGE_GENERATION_URL, OPENAI_CODEX_IMAGE_MAX_COUNT, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS, OPENAI_CODEX_LOCAL_PROXY_CANDIDATES, OPENAI_CODEX_PROVIDER, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT, OPENAI_CODEX_PROXY_DETECT_PATH, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS, OPENAI_CODEX_PROXY_PROBE_URL, OPENAI_CODEX_PROXY_TEST_PATH, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT, OPENAI_CODEX_SEARCH_PROVIDER, OPENAI_CODEX_SEARCH_URL, OPENAI_CODEX_SETTINGS_NAMESPACE, OPENAI_CODEX_SETTINGS_NS, OPENAI_CODEX_TRANSPORT_API_VERSION, OPENAI_CODEX_TRANSPORT_ERROR_CODES, OPENAI_CODEX_TRANSPORT_SERVICE, OPENAI_CODEX_UPDATE_PATH, OPENAI_CODEX_USAGE_URL, OpenAICodexCredentialStore, OpenAICodexProxyManager, OpenAICodexSearchProvider, OpenAICodexTransport, OpenAICodexTransportError, PI_AI_PACKAGE, SUPPORTED_DSH_PLUGIN_API_VERSION, SUPPORTED_NODE_RANGE, SUPPORTED_PI_AI_RANGE, VIEW_IMAGE_TOOL_NAME, apply, assertNoOpenAICodexProviderConflict, assessCompatibility, checkForOpenAICodexUpdate, compareOpenAICodexVersions, decodeOpenAICodexSettings, detectCompatibility, detectOpenAICodexProxies, diagnoseOpenAICodex, evaluateCompatibility, inject, isFastModeSessionId, isOpenAICodexTransportError, isValidOpenAICodexContextWindowOverrides, isValidOpenAICodexProxyUrl, listOpenAICodexProxyCandidates, loginOpenAICodex, logoutOpenAICodex, mapOpenAICodexSearchResponse, migrateOpenAICodexSearchHistory, name, openAICodexAuthPath, openAICodexAuthStatus, openAICodexConflictMessage, parseOpenAICodexUpdateResult, parseOpenAICodexUsage, parseOpenAICodexVersion, readOpenAICodexRateLimits, resolveOpenAICodexProxyUrl, resolveOpenAICodexSettings };

package/lib/{src-Di2xxpDv.js → src-FSN1b9Tk.js}

@@ -9,6 +9,7 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { link, lstat, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Agent, Dispatcher, ProxyAgent, fetch as fetch$1, getGlobalDispatcher, setGlobalDispatcher } from "undici";
 import { fileURLToPath } from "node:url";
@@ -23,6 +24,55 @@ import { Service } from "@deepseek-ai/cordis";
 import { constants } from "node:fs";
 import { WebError } from "@deepseek-ai/dsh-web";
 import { constants as constants$1, zstdCompressSync, zstdDecompressSync } from "node:zlib";
+//#region src/account-profile.ts
+/** Safe browser labels derived locally from OpenAI Codex OAuth credentials. */
+const PROFILE_CLAIM = "https://api.openai.com/profile";
+const MAX_JWT_PAYLOAD_LENGTH = 65536;
+const MAX_LABEL_LENGTH = 128;
+const MAX_EMAIL_LENGTH = 320;
+function boundedText$1(value, maximum) {
+	if (typeof value !== "string") return void 0;
+	const normalized = value.replace(/[\u0000-\u001f\u007f]/gu, "").trim();
+	return normalized.length > 0 && normalized.length <= maximum ? normalized : void 0;
+}
+function maskEmail(email) {
+	const separator = email.lastIndexOf("@");
+	if (separator <= 0 || separator === email.length - 1) return "••••";
+	const local = email.slice(0, separator);
+	const domain = email.slice(separator + 1);
+	return `${local.slice(0, Math.min(2, local.length))}••@${domain}`;
+}
+function decodeOauthProfile(access) {
+	const payload = access.split(".")[1];
+	if (payload === void 0 || payload.length === 0 || payload.length > MAX_JWT_PAYLOAD_LENGTH) return {};
+	try {
+		const decoded = JSON.parse(Buffer$1.from(payload, "base64url").toString("utf8"));
+		if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return {};
+		const profile = decoded[PROFILE_CLAIM];
+		if (typeof profile !== "object" || profile === null || Array.isArray(profile)) return {};
+		const record = profile;
+		const name = boundedText$1(record["name"], MAX_LABEL_LENGTH);
+		const email = boundedText$1(record["email"], MAX_EMAIL_LENGTH);
+		return {
+			...name === void 0 ? {} : { name },
+			...email === void 0 ? {} : { email }
+		};
+	} catch {
+		return {};
+	}
+}
+/** Resolve display-only labels without network access or provider account identifiers. */
+function resolveOpenAICodexAccountProfiles(credentials) {
+	return credentials.map((credential, index) => {
+		const oauth = decodeOauthProfile(credential.access);
+		return {
+			displayName: oauth.name ?? `ChatGPT account ${String(index + 1)}`,
+			...oauth.email === void 0 ? {} : { maskedEmail: maskEmail(oauth.email) },
+			source: oauth.name === void 0 && oauth.email === void 0 ? "generated" : "oauth"
+		};
+	});
+}
+//#endregion
 //#region src/store.ts
 /**
 * Owner-only persistent OAuth credential storage for the OpenAI Codex bundle.
@@ -32,40 +82,28 @@ import { constants as constants$1, zstdCompressSync, zstdDecompressSync } from "
 const OPENAI_CODEX_PROVIDER = "openai-codex";
 /** Basename of the OAuth document inside the Harness home. */
 const OPENAI_CODEX_AUTH_FILENAME = ".openai-codex-auth.json";
-/** Current on-disk format; pre-release readers reject every other version. */
-const AUTH_FORMAT_VERSION = 1;
+/** Current multi-account on-disk format. */
+const AUTH_FORMAT_VERSION = 2;
+/** Maximum number of stored OpenAI Codex accounts. */
+const OPENAI_CODEX_ACCOUNT_LIMIT = 16;
+/** Maximum serialized credential document size. */
+const OPENAI_CODEX_AUTH_DOCUMENT_LIMIT = 524288;
+/** Suffix used for the one-time version-1 rollback copy. */
+const OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX = ".v1-backup";
 /** Whether a filesystem error reports an absent path. */
 function isENOENT$1(error) {
 	return error?.code === "ENOENT";
 }
 /** Reject a credential document readable by another POSIX user. */
-async function assertOwnerOnly$1(filename) {
-	let mode;
-	try {
-		mode = (await stat(filename)).mode;
-	} catch (error) {
-		if (isENOENT$1(error)) return;
-		throw error;
-	}
+function assertOwnerOnly$1(filename, mode) {
 	/* v8 ignore next -- native Windows coverage takes the mode-less branch */
 	if (process.platform === "win32") return;
 	/* v8 ignore start -- POSIX tests cover this branch; Windows cannot express it */
 	if ((mode & 63) !== 0) throw new Error(`openai-codex: ${filename} is readable beyond its owner (mode ${(mode & 511).toString(8)}); run "chmod 600 ${filename}" before starting again`);
 	/* v8 ignore stop */
 }
-/** Validate the strict JSON document without quoting token-bearing input. */
-function parseDocument$2(text, filename) {
-	let value;
-	try {
-		value = JSON.parse(text);
-	} catch {
-		throw new Error(`openai-codex: ${filename} is not valid JSON`);
-	}
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`openai-codex: ${filename} must contain an object`);
-	const document = value;
-	if (document["version"] !== AUTH_FORMAT_VERSION) throw new Error(`openai-codex: ${filename} has unsupported auth format version ${String(document["version"])}`);
-	if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) throw new Error(`openai-codex: ${filename} contains an unknown top-level field`);
-	const raw = document["credential"];
+/** Validate one OAuth credential without quoting token-bearing input. */
+function parseCredential(raw, filename) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`openai-codex: ${filename} credential must be an object`);
 	const credential = raw;
 	if (Object.keys(credential).some((key) => ![
@@ -82,15 +120,65 @@ function parseDocument$2(text, filename) {
 		"accountId"
 	]) if (typeof credential[key] !== "string" || credential[key].length === 0) throw new Error(`openai-codex: ${filename} credential ${key} must be a non-empty string`);
 	if (typeof credential["expires"] !== "number" || !Number.isFinite(credential["expires"]) || credential["expires"] <= 0) throw new Error(`openai-codex: ${filename} credential expires must be a positive finite number`);
+	return credential;
+}
+/** Validate the strict JSON document without quoting token-bearing input. */
+function parseDocument$2(text, filename) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		throw new Error(`openai-codex: ${filename} is not valid JSON`);
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`openai-codex: ${filename} must contain an object`);
+	const document = value;
+	if (document["version"] === 1) {
+		if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) throw new Error(`openai-codex: ${filename} contains an unknown top-level field`);
+		return {
+			version: 1,
+			credential: parseCredential(document["credential"], filename)
+		};
+	}
+	if (document["version"] !== AUTH_FORMAT_VERSION) throw new Error(`openai-codex: ${filename} has unsupported auth format version ${String(document["version"])}`);
+	if (Object.keys(document).some((key) => ![
+		"version",
+		"activeAccountId",
+		"credentials"
+	].includes(key))) throw new Error(`openai-codex: ${filename} contains an unknown top-level field`);
+	if (typeof document["activeAccountId"] !== "string" || document["activeAccountId"].length === 0) throw new Error(`openai-codex: ${filename} activeAccountId must be a non-empty string`);
+	if (!Array.isArray(document["credentials"]) || document["credentials"].length === 0) throw new Error(`openai-codex: ${filename} credentials must be a non-empty array`);
+	if (document["credentials"].length > 16) throw new Error(`openai-codex: ${filename} exceeds the ${String(16)} account limit`);
+	const credentials = document["credentials"].map((raw) => parseCredential(raw, filename));
+	const accountIds = new Set(credentials.map((credential) => credential.accountId));
+	if (accountIds.size !== credentials.length) throw new Error(`openai-codex: ${filename} contains duplicate accountId values`);
+	if (!accountIds.has(document["activeAccountId"])) throw new Error(`openai-codex: ${filename} activeAccountId does not identify a stored credential`);
 	return {
 		version: AUTH_FORMAT_VERSION,
-		credential
+		activeAccountId: document["activeAccountId"],
+		credentials
 	};
 }
 /** Detach a credential from callers that may mutate provider-owned extras. */
 function cloneCredential(credential) {
 	return structuredClone(credential);
 }
+function documentCredentials(document) {
+	return document.version === 1 ? [document.credential] : document.credentials;
+}
+function activeCredential(document) {
+	if (document.version === 1) return document.credential;
+	const active = document.credentials.find((credential) => credential.accountId === document.activeAccountId);
+	if (active === void 0) throw new Error("openai-codex: active credential invariant failed");
+	return active;
+}
+function accountKey$1(accountId) {
+	return `acct_${createHash("sha256").update(accountId).digest("base64url")}`;
+}
+function serializeDocument(document) {
+	const text = `${JSON.stringify(document, null, 2)}\n`;
+	if (Buffer.byteLength(text) > 524288) throw new Error(`openai-codex: credential document exceeds ${String(OPENAI_CODEX_AUTH_DOCUMENT_LIMIT)} bytes`);
+	return text;
+}
 /**
 * Resolve the default OAuth document path.
 * @param dshHome - optional Harness-home override.
@@ -103,35 +191,140 @@ function openAICodexAuthPath(dshHome) {
 var OpenAICodexCredentialStore = class {
 	/** Absolute credential document path. */
 	filename;
+	/** Owner-only version-1 rollback copy, created at the first migration write. */
+	version1BackupFilename;
 	/**
 	* @param filename - explicit document path, defaulting under `$DSH_HOME`.
 	*/
 	constructor(filename = openAICodexAuthPath()) {
 		this.filename = resolve(filename);
+		this.version1BackupFilename = join(dirname(this.filename), `${basename(this.filename)}${OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX}`);
 	}
 	/** Read and validate the current document without acquiring the writer lock. */
-	async readCurrent() {
-		await assertOwnerOnly$1(this.filename);
-		let text;
+	async readDocument() {
+		return this.readDocumentAt(this.filename);
+	}
+	async readDocumentAt(filename) {
+		let handle;
 		try {
-			text = await readFile(this.filename, "utf8");
+			handle = await open(filename, "r");
 		} catch (error) {
 			if (isENOENT$1(error)) return void 0;
 			throw error;
 		}
-		return cloneCredential(parseDocument$2(text, this.filename).credential);
+		try {
+			const info = await handle.stat();
+			if (!info.isFile()) throw new Error(`openai-codex: ${filename} must be a regular file`);
+			assertOwnerOnly$1(filename, info.mode);
+			if (info.size > 524288) throw new Error(`openai-codex: ${filename} exceeds ${String(OPENAI_CODEX_AUTH_DOCUMENT_LIMIT)} bytes`);
+			return parseDocument$2(await handle.readFile("utf8"), filename);
+		} finally {
+			await handle.close();
+		}
+	}
+	async writeDocument(document, previous) {
+		const text = serializeDocument(document);
+		if (previous?.version === 1) {
+			const existingBackup = await this.readDocumentAt(this.version1BackupFilename);
+			if (existingBackup === void 0) await writeFileAtomic(this.version1BackupFilename, serializeDocument(previous), {
+				mode: 384,
+				dirMode: 448
+			});
+			else if (existingBackup.version !== 1 || serializeDocument(existingBackup) !== serializeDocument(previous)) throw new Error(`openai-codex: ${this.version1BackupFilename} rollback copy does not match the current version 1 credential`);
+		}
+		await writeFileAtomic(this.filename, text, {
+			mode: 384,
+			dirMode: 448
+		});
 	}
 	/** @inheritdoc */
 	async read(providerId) {
-		return providerId === "openai-codex" ? this.readCurrent() : void 0;
+		if (providerId !== "openai-codex") return void 0;
+		const document = await this.readDocument();
+		return document === void 0 ? void 0 : cloneCredential(activeCredential(document));
 	}
 	/** @inheritdoc */
 	async list() {
-		return await this.readCurrent() === void 0 ? [] : [{
+		return await this.readDocument() === void 0 ? [] : [{
 			providerId: OPENAI_CODEX_PROVIDER,
 			type: "oauth"
 		}];
 	}
+	/** List browser-safe account summaries without exposing provider account ids. */
+	async accounts() {
+		const document = await this.readDocument();
+		if (document === void 0) return [];
+		const credentials = documentCredentials(document);
+		const profiles = resolveOpenAICodexAccountProfiles(credentials);
+		const activeAccountId = activeCredential(document).accountId;
+		return credentials.map((credential, index) => ({
+			accountKey: accountKey$1(credential.accountId),
+			displayName: profiles[index].displayName,
+			...profiles[index].maskedEmail === void 0 ? {} : { maskedEmail: profiles[index].maskedEmail },
+			profileSource: profiles[index].source,
+			active: credential.accountId === activeAccountId
+		}));
+	}
+	/** Resolve the account id stored with one exact access token. */
+	async accountIdForAccess(access) {
+		const document = await this.readDocument();
+		if (document === void 0) return void 0;
+		return documentCredentials(document).find((credential) => credential.access === access)?.accountId;
+	}
+	/** Select a stored account using its browser-safe key. */
+	async activate(selectedAccountKey) {
+		await mkdir(dirname(this.filename), {
+			recursive: true,
+			mode: 448
+		});
+		return withFileLock(this.filename, async () => {
+			const document = await this.readDocument();
+			if (document === void 0) throw new Error("openai-codex: account not found");
+			const credentials = documentCredentials(document);
+			const selected = credentials.find((credential) => accountKey$1(credential.accountId) === selectedAccountKey);
+			if (selected === void 0) throw new Error("openai-codex: account not found");
+			await this.writeDocument({
+				version: AUTH_FORMAT_VERSION,
+				activeAccountId: selected.accountId,
+				credentials: credentials.map(cloneCredential)
+			}, document);
+			return cloneCredential(selected);
+		});
+	}
+	/** Remove one account; active removal requires an explicit stored replacement. */
+	async removeAccount(selectedAccountKey, replacementAccountKey) {
+		await mkdir(dirname(this.filename), {
+			recursive: true,
+			mode: 448
+		});
+		await withFileLock(this.filename, async () => {
+			const document = await this.readDocument();
+			if (document === void 0) throw new Error("openai-codex: account not found");
+			const credentials = [...documentCredentials(document)];
+			const removeIndex = credentials.findIndex((credential) => accountKey$1(credential.accountId) === selectedAccountKey);
+			if (removeIndex < 0) throw new Error("openai-codex: account not found");
+			const removed = credentials[removeIndex];
+			const active = activeCredential(document);
+			const remaining = credentials.filter((_, index) => index !== removeIndex);
+			let nextActive = active.accountId;
+			if (removed.accountId === active.accountId && remaining.length > 0) {
+				if (replacementAccountKey === void 0) throw new Error("openai-codex: removing the active account requires replacementAccountKey");
+				const replacement = remaining.find((credential) => accountKey$1(credential.accountId) === replacementAccountKey);
+				if (replacement === void 0) throw new Error("openai-codex: replacement account not found");
+				nextActive = replacement.accountId;
+			} else if (replacementAccountKey !== void 0) throw new Error("openai-codex: replacementAccountKey is only valid when removing the active account");
+			await rm(this.version1BackupFilename, { force: true });
+			if (remaining.length === 0) {
+				await rm(this.filename, { force: true });
+				return;
+			}
+			await this.writeDocument({
+				version: AUTH_FORMAT_VERSION,
+				activeAccountId: nextActive,
+				credentials: remaining.map(cloneCredential)
+			});
+		});
+	}
 	/** @inheritdoc */
 	async modify(providerId, fn) {
 		if (providerId !== "openai-codex") throw new Error(`openai-codex: credential store does not own provider "${providerId}"`);
@@ -140,18 +333,22 @@ var OpenAICodexCredentialStore = class {
 			mode: 448
 		});
 		return withFileLock(this.filename, async () => {
-			const current = await this.readCurrent();
+			const currentDocument = await this.readDocument();
+			const current = currentDocument === void 0 ? void 0 : cloneCredential(activeCredential(currentDocument));
 			const candidate = await fn(current);
 			if (candidate === void 0) return current;
-			const document = parseDocument$2(JSON.stringify({
+			const validated = parseCredential(candidate, this.filename);
+			const credentials = currentDocument === void 0 ? [] : [...documentCredentials(currentDocument)];
+			const existingIndex = credentials.findIndex((credential) => credential.accountId === validated.accountId);
+			if (existingIndex >= 0) credentials[existingIndex] = validated;
+			else credentials.push(validated);
+			if (credentials.length > 16) throw new Error(`openai-codex: credential store accepts at most ${String(16)} accounts`);
+			await this.writeDocument({
 				version: AUTH_FORMAT_VERSION,
-				credential: candidate
-			}), this.filename);
-			await writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}\n`, {
-				mode: 384,
-				dirMode: 448
-			});
-			return cloneCredential(document.credential);
+				activeAccountId: validated.accountId,
+				credentials: credentials.map(cloneCredential)
+			}, currentDocument);
+			return cloneCredential(validated);
 		});
 	}
 	/** @inheritdoc */
@@ -161,7 +358,10 @@ var OpenAICodexCredentialStore = class {
 			recursive: true,
 			mode: 448
 		});
-		await withFileLock(this.filename, () => rm(this.filename, { force: true }));
+		await withFileLock(this.filename, async () => {
+			await rm(this.filename, { force: true });
+			await rm(this.version1BackupFilename, { force: true });
+		});
 	}
 };
 //#endregion
@@ -528,10 +728,8 @@ function parseOpenAICodexUsage(value) {
 async function readOpenAICodexRateLimits(store) {
 	const models = createModels({ credentials: store });
 	models.setProvider(openaiCodexProvider());
-	const auth = await models.getAuth(OPENAI_CODEX_PROVIDER);
-	const credential = await store.read(OPENAI_CODEX_PROVIDER);
-	const access = auth?.auth.apiKey;
-	const accountId = credential?.type === "oauth" ? credential.accountId : void 0;
+	const access = (await models.getAuth(OPENAI_CODEX_PROVIDER))?.auth.apiKey;
+	const accountId = access === void 0 ? void 0 : await store.accountIdForAccess(access);
 	if (access === void 0 || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("OpenAI Codex is signed out");
 	const response = await fetch(OPENAI_CODEX_USAGE_URL, {
 		method: "GET",
@@ -568,6 +766,8 @@ const OPENAI_CODEX_AUTH_LOGIN_PATH = "/plugins/dsh-openai-codex/auth/login";
 const OPENAI_CODEX_AUTH_LOGOUT_PATH = "/plugins/dsh-openai-codex/auth/logout";
 /** Cancel only the pending authorization; never delete a stored credential. */
 const OPENAI_CODEX_AUTH_CANCEL_PATH = "/plugins/dsh-openai-codex/auth/cancel";
+/** List, activate, and remove stored OpenAI Codex accounts. */
+const OPENAI_CODEX_AUTH_ACCOUNTS_PATH = "/plugins/dsh-openai-codex/auth/accounts";
 //#endregion
 //#region src/trusted-origins.ts
 /** Owner-only allowlist for browser origins that may reach the Web OAuth routes. */
@@ -881,6 +1081,14 @@ var OpenAICodexWebAuth = class {
 	async cancel() {
 		await this.finishLogin("cancel");
 	}
+	/** Cancel pending OAuth and select one already stored account. */
+	async activateAccount(accountKey) {
+		return this.mutateStoredAccount(() => this.store.activate(accountKey));
+	}
+	/** Cancel pending OAuth and remove exactly one stored account. */
+	async removeAccount(accountKey, replacementAccountKey) {
+		return this.mutateStoredAccount(() => this.store.removeAccount(accountKey, replacementAccountKey));
+	}
 	/** Stop the owned callback listener during plugin disposal. */
 	async dispose() {
 		this.disposed = true;
@@ -905,6 +1113,28 @@ var OpenAICodexWebAuth = class {
 			if (this.transition === transition) this.transition = void 0;
 		}
 	}
+	async mutateStoredAccount(operation) {
+		while (this.transition !== void 0) await this.transition;
+		if (this.disposed) throw new Error("OpenAI Codex plugin disposed");
+		const login = this.operation;
+		this.cancelSignIn(/* @__PURE__ */ new Error("OpenAI Codex sign-in cancelled"));
+		let result;
+		const transition = (async () => {
+			await login?.catch(() => void 0);
+			this.challenge = void 0;
+			await operation();
+			result = await this.readStoredStatus();
+			this.state = result;
+		})();
+		this.transition = transition;
+		try {
+			await transition;
+			if (result === void 0) throw new Error("openai-codex: account mutation did not produce status");
+			return result;
+		} finally {
+			if (this.transition === transition) this.transition = void 0;
+		}
+	}
 	start() {
 		const cancellation = new AbortController();
 		this.cancellation = cancellation;
@@ -1153,6 +1383,44 @@ function fastModeBody(value) {
 		enabled
 	} : void 0;
 }
+function accountKey(value) {
+	return typeof value === "string" && /^acct_[A-Za-z0-9_-]{43}$/u.test(value) ? value : void 0;
+}
+function activateAccountBody(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (Object.keys(record).length !== 1) return void 0;
+	const parsed = accountKey(record["accountKey"]);
+	return parsed === void 0 ? void 0 : { accountKey: parsed };
+}
+function removeAccountBody(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const record = value;
+	if (Object.keys(record).some((key) => key !== "accountKey" && key !== "replacementAccountKey")) return void 0;
+	const selected = accountKey(record["accountKey"]);
+	if (selected === void 0) return void 0;
+	if (record["replacementAccountKey"] === void 0) return { accountKey: selected };
+	const replacement = accountKey(record["replacementAccountKey"]);
+	return replacement === void 0 ? void 0 : {
+		accountKey: selected,
+		replacementAccountKey: replacement
+	};
+}
+function accountMutationError(error) {
+	const message = safeMessage(error);
+	if (/account not found/u.test(message)) return {
+		status: 404,
+		error: message
+	};
+	if (/requires replacementAccountKey|only valid when removing/u.test(message)) return {
+		status: 409,
+		error: message
+	};
+	return {
+		status: 500,
+		error: message
+	};
+}
 /** Register the plugin-owned OAuth routes when the Web server is composed. */
 function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastModeOverride, proxyManager, resolveProxyUrl, authorizationTimeoutMs) {
 	const auth = new OpenAICodexWebAuth(store, {
@@ -1177,7 +1445,11 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 				handler: async (req, res) => {
 					if (req.method !== "GET") return json$4(res, 405, { error: "method not allowed" });
 					if (!await authorize(req, res)) return;
-					json$4(res, 200, await auth.status());
+					const [status, accounts] = await Promise.all([auth.status(), store.accounts()]);
+					json$4(res, 200, {
+						...status,
+						accounts
+					});
 				}
 			}),
 			ctx.webServer.register({
@@ -1221,6 +1493,33 @@ function registerOpenAICodexAuthRoutes(ctx, store, trustedOriginsOverride, fastM
 					}
 				}
 			}),
+			ctx.webServer.register({
+				kind: "exact",
+				path: OPENAI_CODEX_AUTH_ACCOUNTS_PATH,
+				handler: async (req, res) => {
+					if (req.method !== "GET" && req.method !== "POST" && req.method !== "DELETE") return json$4(res, 405, { error: "method not allowed" });
+					if (!await authorize(req, res)) return;
+					if (req.method === "GET") return json$4(res, 200, { accounts: await store.accounts() });
+					const type = header(req, "content-type");
+					if (type === void 0 || !/^application\/json(?:\s*;|$)/iu.test(type.trim())) return json$4(res, 415, { error: "unsupported content type" });
+					try {
+						const raw = await readFastModeBody(req);
+						if (req.method === "POST") {
+							const body = activateAccountBody(raw);
+							if (body === void 0) return json$4(res, 400, { error: "invalid input" });
+							return json$4(res, 200, await auth.activateAccount(body.accountKey));
+						}
+						const body = removeAccountBody(raw);
+						if (body === void 0) return json$4(res, 400, { error: "invalid input" });
+						return json$4(res, 200, await auth.removeAccount(body.accountKey, body.replacementAccountKey));
+					} catch (error) {
+						if (error instanceof RangeError) return json$4(res, 413, { error: "request body too large" });
+						if (error instanceof TypeError) return json$4(res, 400, { error: "invalid input" });
+						const mapped = accountMutationError(error);
+						return json$4(res, mapped.status, { error: mapped.error });
+					}
+				}
+			}),
 			ctx.webServer.register({
 				kind: "exact",
 				path: OPENAI_CODEX_FAST_MODE_PATH,
@@ -1510,7 +1809,10 @@ var OpenAICodexProxyManager = class {
 	agentFor(proxyUrl) {
 		let agent = this.agents.get(proxyUrl);
 		if (agent !== void 0) return agent;
-		agent = new ProxyAgent(proxyUrl);
+		agent = new ProxyAgent({
+			uri: proxyUrl,
+			proxyTunnel: true
+		});
 		this.agents.set(proxyUrl, agent);
 		return agent;
 	}
@@ -1678,7 +1980,7 @@ function registerOpenAICodexProxyRoutes(ctx, trustedOrigins, manager) {
 //#region src/compatibility.ts
 const COMPATIBILITY_SCHEMA_VERSION = 1;
 const SUPPORTED_NODE_RANGE = "^22.19.0 || >=24.0.0";
-const SUPPORTED_DSH_PLUGIN_API_VERSION = "0.1.2-alpha.5";
+const SUPPORTED_DSH_PLUGIN_API_VERSION = "0.1.2-rc.1";
 const SUPPORTED_PI_AI_RANGE = "^0.84.2";
 const PI_AI_PACKAGE = "@earendil-works/pi-ai";
 const DSH_PLUGIN_API_PACKAGES = [
@@ -2563,7 +2865,7 @@ function registerOpenAICodexOriginalImageRoute(ctx, trustedOrigins, assets) {
 }
 //#endregion
 //#region src/version.ts
-const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.25";
+const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.26";
 //#endregion
 //#region src/doctor.ts
 /** Secret-free diagnostics and duplicate-provider guidance. */
@@ -3576,9 +3878,8 @@ var OpenAICodexTransport = class extends Service {
 		} catch {
 			throw new OpenAICodexTransportError(OPENAI_CODEX_TRANSPORT_ERROR_CODES.reauthRequired);
 		}
-		const refreshed = await this.credentials.read(OPENAI_CODEX_PROVIDER);
 		const access = auth?.auth.apiKey;
-		const accountId = refreshed?.type === "oauth" ? refreshed.accountId : void 0;
+		const accountId = access === void 0 ? void 0 : await this.credentials.accountIdForAccess(access);
 		if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new OpenAICodexTransportError(OPENAI_CODEX_TRANSPORT_ERROR_CODES.reauthRequired);
 		if (isAborted(context.signal)) throw new OpenAICodexTransportError(OPENAI_CODEX_TRANSPORT_ERROR_CODES.canceled);
 		const traceId = randomUUID();
@@ -4394,8 +4695,7 @@ var OpenAICodexAutoReviewBackend = class {
 		}, AUTO_REVIEW_TIMEOUT_MS);
 		try {
 			const access = (await this.models.getAuth(OPENAI_CODEX_PROVIDER, { signal: controller.signal }))?.auth.apiKey;
-			const stored = await this.credentialStore.read(OPENAI_CODEX_PROVIDER);
-			const accountId = stored?.type === "oauth" && typeof stored.accountId === "string" ? stored.accountId : void 0;
+			const accountId = access === void 0 ? void 0 : await this.credentialStore.accountIdForAccess(access);
 			if (access === void 0 || access.length === 0 || accountId === void 0 || accountId.length === 0) return { status: "unavailable" };
 			const response = await this.proxyManager.run(this.resolveProxyUrl(), () => fetch$1(`${OPENAI_CODEX_BASE_URL}/responses`, {
 				method: "POST",
@@ -5279,4 +5579,4 @@ function apply(ctx, config) {
 	scheduleCapabilities();
 }
 //#endregion
-export { OPENAI_CODEX_LOCAL_PROXY_CANDIDATES as $, assertNoOpenAICodexProviderConflict as A, logoutOpenAICodex as At, COMPATIBILITY_PACKAGES as B, OPENAI_CODEX_TRANSPORT_ERROR_CODES as C, isFastModeSessionId as Ct, isOpenAICodexTransportError as D, parseOpenAICodexUsage as Dt, OpenAICodexTransportError as E, OPENAI_CODEX_USAGE_URL as Et, checkForOpenAICodexUpdate as F, OpenAICodexCredentialStore as Ft, SUPPORTED_NODE_RANGE as G, DSH_PLUGIN_API_PACKAGES as H, compareOpenAICodexVersions as I, openAICodexAuthPath as It, detectCompatibility as J, SUPPORTED_PI_AI_RANGE as K, parseOpenAICodexUpdateResult as L, openAICodexConflictMessage as M, openAICodexModelCatalog as Mt, CODEX_CONNECT_VERSION as N, OPENAI_CODEX_AUTH_FILENAME as Nt, VIEW_IMAGE_TOOL_NAME as O, readOpenAICodexRateLimits as Ot, OPENAI_CODEX_UPDATE_PATH as P, OPENAI_CODEX_PROVIDER as Pt, OPENAI_CODEX_PROXY_TEST_PATH as Q, parseOpenAICodexVersion as R, OPENAI_CODEX_TRANSPORT_API_VERSION as S, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH as St, OpenAICodexTransport as T, normalizeTrustedOrigin as Tt, PI_AI_PACKAGE as U, COMPATIBILITY_SCHEMA_VERSION as V, SUPPORTED_DSH_PLUGIN_API_VERSION as W, readInstalledPackageVersion as X, evaluateCompatibility as Y, OPENAI_CODEX_PROXY_DETECT_PATH as Z, OPENAI_CODEX_IMAGE_MAX_COUNT as _, resolveOpenAICodexProxyUrl as _t, name as a, listOpenAICodexProxyCandidates as at, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH as b, FastModeRegistry as bt, migrateOpenAICodexSearchHistory as c, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS as ct, OPENAI_CODEX_BASE_URL as d, DEFAULT_OPENAI_CODEX_SETTINGS as dt, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT as et, OPENAI_CODEX_SEARCH_PROVIDER as f, OPENAI_CODEX_SETTINGS_NAMESPACE as ft, OPENAI_CODEX_IMAGE_GENERATION_URL as g, normalizeOpenAICodexProxyUrl as gt, mapOpenAICodexSearchResponse as h, isValidOpenAICodexProxyUrl as ht, inject as i, detectOpenAICodexProxies as it, diagnoseOpenAICodex as j, openAICodexAuthStatus as jt, IMAGE_GENERATE_TOOL_NAME as k, loginOpenAICodex as kt, CODEX_AUTO_REVIEW_MODEL as l, DEFAULT_OPENAI_CODEX_SEARCH_MODE as lt, OpenAICodexSearchProvider as m, isValidOpenAICodexContextWindowOverrides as mt, OPENAI_CODEX_SETTINGS_NS as n, OPENAI_CODEX_PROXY_PROBE_URL as nt, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX as o, DEFAULT_OPENAI_CODEX_PROXY_URL as ot, OPENAI_CODEX_SEARCH_URL as p, decodeOpenAICodexSettings as pt, assessCompatibility as q, apply as r, OpenAICodexProxyManager as rt, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT as s, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE as st, Config as t, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS as tt, probeCodexAutoReview as u, DEFAULT_OPENAI_CODEX_SEARCH_MODEL as ut, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES as v, resolveOpenAICodexSettings as vt, OPENAI_CODEX_TRANSPORT_SERVICE as w, OpenAICodexTrustedOriginsStore as wt, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS as x, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS as xt, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES as y, OPENAI_CODEX_FAST_MODE_PATH as yt, COMPATIBILITY_CONTRACT as z };
+export { OPENAI_CODEX_LOCAL_PROXY_CANDIDATES as $, assertNoOpenAICodexProviderConflict as A, logoutOpenAICodex as At, COMPATIBILITY_PACKAGES as B, OPENAI_CODEX_TRANSPORT_ERROR_CODES as C, isFastModeSessionId as Ct, isOpenAICodexTransportError as D, parseOpenAICodexUsage as Dt, OpenAICodexTransportError as E, OPENAI_CODEX_USAGE_URL as Et, checkForOpenAICodexUpdate as F, OPENAI_CODEX_AUTH_FILENAME as Ft, SUPPORTED_NODE_RANGE as G, DSH_PLUGIN_API_PACKAGES as H, compareOpenAICodexVersions as I, OPENAI_CODEX_AUTH_V1_BACKUP_SUFFIX as It, detectCompatibility as J, SUPPORTED_PI_AI_RANGE as K, parseOpenAICodexUpdateResult as L, OPENAI_CODEX_PROVIDER as Lt, openAICodexConflictMessage as M, openAICodexModelCatalog as Mt, CODEX_CONNECT_VERSION as N, OPENAI_CODEX_ACCOUNT_LIMIT as Nt, VIEW_IMAGE_TOOL_NAME as O, readOpenAICodexRateLimits as Ot, OPENAI_CODEX_UPDATE_PATH as P, OPENAI_CODEX_AUTH_DOCUMENT_LIMIT as Pt, OPENAI_CODEX_PROXY_TEST_PATH as Q, parseOpenAICodexVersion as R, OpenAICodexCredentialStore as Rt, OPENAI_CODEX_TRANSPORT_API_VERSION as S, OPENAI_CODEX_FAST_MODE_MAX_SESSION_ID_LENGTH as St, OpenAICodexTransport as T, normalizeTrustedOrigin as Tt, PI_AI_PACKAGE as U, COMPATIBILITY_SCHEMA_VERSION as V, SUPPORTED_DSH_PLUGIN_API_VERSION as W, readInstalledPackageVersion as X, evaluateCompatibility as Y, OPENAI_CODEX_PROXY_DETECT_PATH as Z, OPENAI_CODEX_IMAGE_MAX_COUNT as _, resolveOpenAICodexProxyUrl as _t, name as a, listOpenAICodexProxyCandidates as at, OPENAI_CODEX_IMAGE_PROMPT_MAX_LENGTH as b, FastModeRegistry as bt, migrateOpenAICodexSearchHistory as c, DEFAULT_OPENAI_CODEX_SEARCH_MAX_OUTPUT_TOKENS as ct, OPENAI_CODEX_BASE_URL as d, DEFAULT_OPENAI_CODEX_SETTINGS as dt, OPENAI_CODEX_PROXY_CANDIDATE_LIMIT as et, OPENAI_CODEX_SEARCH_PROVIDER as f, OPENAI_CODEX_SETTINGS_NAMESPACE as ft, OPENAI_CODEX_IMAGE_GENERATION_URL as g, normalizeOpenAICodexProxyUrl as gt, mapOpenAICodexSearchResponse as h, isValidOpenAICodexProxyUrl as ht, inject as i, detectOpenAICodexProxies as it, diagnoseOpenAICodex as j, openAICodexAuthStatus as jt, IMAGE_GENERATE_TOOL_NAME as k, loginOpenAICodex as kt, CODEX_AUTO_REVIEW_MODEL as l, DEFAULT_OPENAI_CODEX_SEARCH_MODE as lt, OpenAICodexSearchProvider as m, isValidOpenAICodexContextWindowOverrides as mt, OPENAI_CODEX_SETTINGS_NS as n, OPENAI_CODEX_PROXY_PROBE_URL as nt, OPENAI_CODEX_HISTORY_BACKUP_SUFFIX as o, DEFAULT_OPENAI_CODEX_PROXY_URL as ot, OPENAI_CODEX_SEARCH_URL as p, decodeOpenAICodexSettings as pt, assessCompatibility as q, apply as r, OpenAICodexProxyManager as rt, OPENAI_CODEX_SEARCH_MODEL_REQUEST_EVENT as s, DEFAULT_OPENAI_CODEX_SEARCH_CONTEXT_SIZE as st, Config as t, OPENAI_CODEX_PROXY_PROBE_TIMEOUT_MS as tt, probeCodexAutoReview as u, DEFAULT_OPENAI_CODEX_SEARCH_MODEL as ut, OPENAI_CODEX_IMAGE_MAX_ERROR_BYTES as v, resolveOpenAICodexSettings as vt, OPENAI_CODEX_TRANSPORT_SERVICE as w, OpenAICodexTrustedOriginsStore as wt, OPENAI_CODEX_IMAGE_REQUEST_TIMEOUT_MS as x, OPENAI_CODEX_FAST_MODE_MAX_SESSIONS as xt, OPENAI_CODEX_IMAGE_MAX_RESPONSE_BYTES as y, OPENAI_CODEX_FAST_MODE_PATH as yt, COMPATIBILITY_CONTRACT as z, openAICodexAuthPath as zt };

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-codex-connect",
   "displayName": "Codex Connect",
   "description": "ChatGPT OAuth and Codex models for DeepSeek Harness.",
-  "version": "0.1.0-alpha.4.25",
+  "version": "0.1.0-alpha.4.26",
   "author": "Frank Song",
   "contributors": [
     "Yan-Zero (original dsh-codex author)"
@@ -78,7 +78,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "undici": "^7.29.0"
+    "undici": "^8.10.0"
   },
   "license": "Apache-2.0",
   "dsh": {
@@ -104,24 +104,24 @@
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.2",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-atomic-write": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-attachment": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-commands": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-home-paths": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-host-webserver": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-invariants": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-settings": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-util-values": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-web": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-util-values": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0"
   },
@@ -135,61 +135,61 @@
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/cordis-plugin-include": "1.0.7",
     "@deepseek-ai/cordis-plugin-loader": "1.0.3",
-    "@deepseek-ai/dsh-agent": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-agent-default-model": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-agent-presets": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-api-gateway": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-api-session-controller": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-atomic-write": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-attachment": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-attachment-local": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-authorization": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-store": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-session": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-code-runtime": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-commands": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-file-reference": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs-local": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-home-paths": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-host-webserver": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-invariants": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-launch-environment": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-native-command": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-scope": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-persistence": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-projection": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-query": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-title": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-settings": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-skill": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-storage": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-storage-domain": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subagent": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-system-prompt": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-typert-registry": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-user-approval": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-util-values": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-web": "0.1.2-alpha.5",
-    "@deepseek-ai/dsh-workspace": "0.1.2-alpha.5",
+    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-gateway": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-attachment-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-code-runtime": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-file-reference": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-native-command": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-query": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-title": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-storage": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-storage-domain": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-util-values": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-workspace": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "3.18.2",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",