dsh-codex-subscription 2.2.2 → 2.2.3

package/lib/index.js

@@ -369,6 +369,54 @@ const PREFERENCE_FIELDS = Object.freeze({
 	}
 });
 //#endregion
+//#region src/diagnostic-events.js
+const areas = /* @__PURE__ */ new Set([
+	"login",
+	"model",
+	"catalog",
+	"quota",
+	"quota-reset",
+	"search",
+	"image"
+]);
+const codes$1 = /* @__PURE__ */ new Set([
+	"timeout",
+	"dns",
+	"tls",
+	"connection",
+	"network",
+	"http-error"
+]);
+/** Process-local bounded evidence. No bodies, URLs, exception strings or identities. */
+function createDiagnosticEvents({ limit = 32, now = Date.now } = {}) {
+	const events = [];
+	const capacity = Math.max(1, Math.min(128, Number.isInteger(limit) ? limit : 32));
+	let dropped = 0, sequence = 0;
+	return {
+		record(area, value) {
+			if (!areas.has(area) || !["ok", "failed"].includes(value?.status)) return;
+			events.push({
+				sequence: ++sequence,
+				area,
+				status: value.status,
+				observedAt: now(),
+				...codes$1.has(value.code) ? { code: value.code } : {},
+				...Number.isInteger(value.httpStatus) && value.httpStatus >= 100 && value.httpStatus <= 599 ? { httpStatus: value.httpStatus } : {}
+			});
+			if (events.length > capacity) {
+				events.shift();
+				dropped++;
+			}
+		},
+		snapshot: () => ({
+			scope: "plugin-process",
+			capacity,
+			dropped,
+			events: events.map((value) => ({ ...value }))
+		})
+	};
+}
+//#endregion
 //#region src/oauth-network.js
 const execFileAsync = promisify(execFile);
 const CODEX_AUTH_HOST = "auth.openai.com";
@@ -612,6 +660,11 @@ const elapsedBucket = (elapsed) => elapsed < 1e3 ? "under-1s" : elapsed < 5e3 ?
 function createCodexNetworkTransport(options = {}) {
 	const attempts = /* @__PURE__ */ new Map();
 	const now = options.now ?? Date.now;
+	const evidence = createDiagnosticEvents({ now });
+	const remember = (area, value) => {
+		attempts.set(area, value);
+		evidence.record(area, value);
+	};
 	const run = async (area, operation, connection = {}) => {
 		const startedAt = now();
 		let route = attempts.get(area)?.route ?? "direct";
@@ -625,7 +678,7 @@ function createCodexNetworkTransport(options = {}) {
 					routed = true;
 				}
 			});
-			if (value instanceof Response && !value.ok) attempts.set(area, {
+			if (value instanceof Response && !value.ok) remember(area, {
 				status: "failed",
 				stage: "http",
 				code: "http-error",
@@ -633,14 +686,14 @@ function createCodexNetworkTransport(options = {}) {
 				route,
 				elapsed: elapsedBucket(now() - startedAt)
 			});
-			else if (routed || value instanceof Response) attempts.set(area, {
+			else if (routed || value instanceof Response) remember(area, {
 				status: "ok",
 				route,
 				elapsed: elapsedBucket(now() - startedAt)
 			});
 			return value;
 		} catch (error) {
-			if (routed) attempts.set(area, {
+			if (routed) remember(area, {
 				status: "failed",
 				stage: "transport",
 				code: classifyTransportError(error),
@@ -652,6 +705,7 @@ function createCodexNetworkTransport(options = {}) {
 	};
 	return Object.freeze({
 		run,
+		history: evidence.snapshot,
 		fetch: (area, input, init) => run(area, () => globalThis.fetch(input, init)),
 		snapshot: () => Object.fromEntries([...attempts].map(([area, value]) => [area, { ...value }]))
 	});
@@ -1316,6 +1370,21 @@ function createSubagentBackendSwitcher({ entries, prepare, persist }) {
 		backgroundMode: "one-shot",
 		maxDepth: "provider-managed"
 	});
+	const ownedFields = [
+		"provider",
+		"modelSelectionSettings",
+		"backgroundMode",
+		"maxDepth"
+	];
+	const restore = (current, original) => {
+		const result = { ...current }, applied = convert(original);
+		for (const key of ownedFields) {
+			if (current[key] !== applied[key]) continue;
+			if (Object.hasOwn(original, key)) result[key] = original[key];
+			else delete result[key];
+		}
+		return result;
+	};
 	const configure = (fiber, config) => {
 		if (!standard(fiber.entry, config)) return config;
 		if (!originals.has(fiber)) originals.set(fiber, { ...config });
@@ -1345,7 +1414,8 @@ function createSubagentBackendSwitcher({ entries, prepare, persist }) {
 						fiber,
 						before
 					});
-					await fiber.update(mode === "codex" ? convert(original) : original, true);
+					if (mode === "codex" && before.provider !== "codex-subscription-subagent") originals.set(fiber, { ...before });
+					await fiber.update(mode === "codex" ? convert(before) : restore(before, original), true);
 				}
 				await persist?.(mode);
 			} catch (error) {
@@ -1364,7 +1434,7 @@ function createSubagentBackendSwitcher({ entries, prepare, persist }) {
 			await tail.catch(() => {});
 			disposed = true;
 			selected = "dsh";
-			for (const [fiber, original] of originals) if (fiber.config?.provider === "codex-subscription-subagent") await fiber.update(original, true);
+			for (const [fiber, original] of originals) if (fiber.config?.provider === "codex-subscription-subagent") await fiber.update(restore(fiber.config, original), true);
 			originals.clear();
 		}
 	};
@@ -2860,8 +2930,28 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 }
 Object.freeze(["0.82.1", "0.85.1"]);
 //#endregion
+//#region src/subscription-credentials.js
+async function readSubscriptionCredentials(getAuth, readCredential, signal) {
+	for (let attempt = 0; attempt < 2; attempt++) {
+		const auth = await getAuth({ signal });
+		signal?.throwIfAborted();
+		if (typeof auth?.auth?.apiKey !== "string" || !auth.auth.apiKey) break;
+		const credential = await readCredential({ signal });
+		signal?.throwIfAborted();
+		if (credential?.type !== "oauth") break;
+		if (credential.access === auth.auth.apiKey) return {
+			access: credential.access,
+			accountId: credential.accountId
+		};
+	}
+	return {
+		access: void 0,
+		accountId: void 0
+	};
+}
+//#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "2.2.2";
+const PACKAGE_VERSION = "2.2.3";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/model-catalog.js
@@ -2986,12 +3076,8 @@ function createOfficialModelCatalog(options = {}) {
 		let timer;
 		const timeoutError = /* @__PURE__ */ new Error("Codex model catalog refresh timed out");
 		const work = (async () => {
-			const auth = await options.getAuth({ signal: requestSignal });
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, requestSignal);
 			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			const credential = await options.readCredential({ signal: requestSignal });
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			const access = auth?.auth?.apiKey;
-			const accountId = credential?.type === "oauth" ? credential.accountId : void 0;
 			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) return false;
 			const headers = {
 				authorization: `Bearer ${access}`,
@@ -3148,10 +3234,7 @@ function createCodexSearchProvider(options) {
 			signal?.throwIfAborted();
 			const preferences = readCapabilitySettings(options.resolvePreferences?.());
 			if (preferences.searchMode === "disabled") throw new WebError("Codex search is disabled in subscription settings", "WEB_PROVIDER_UNAVAILABLE");
-			const auth = await options.getAuth({ signal });
-			const credential = await options.readCredential({ signal });
-			const access = auth?.auth?.apiKey;
-			const accountId = credential?.type === "oauth" ? credential.accountId : void 0;
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, signal);
 			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new WebError("ChatGPT subscription is not signed in", "WEB_PROVIDER_CREDENTIAL_MISSING");
 			const model = nonEmpty$1(options.resolveModel?.()) ?? DEFAULT_MODEL;
 			const id = nonEmpty$1(options.resolveSessionId?.()) ?? randomUUID();
@@ -3662,10 +3745,7 @@ function createCodexImageTool(options) {
 			const prompt = nonEmpty(args.prompt);
 			if (prompt === void 0) throw new Error("prompt must be a non-empty string");
 			const imageOptions = normalizeImageOptions(args);
-			const auth = await options.getAuth({ signal: exec.signal });
-			const credential = await options.readCredential({ signal: exec.signal });
-			const access = auth?.auth?.apiKey;
-			const accountId = credential?.type === "oauth" ? credential.accountId : void 0;
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, exec.signal);
 			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
 			if (!attachments.imageLimits.mediaTypes.includes("image/png")) throw new Error("This DSH installation does not accept PNG image attachments");
 			const maximumBytes = Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
@@ -3907,6 +3987,229 @@ var OriginalImageStore = class {
 	}
 };
 //#endregion
+//#region src/diagnostic-checks.js
+const states = /* @__PURE__ */ new Set([
+	"pass",
+	"fail",
+	"warn",
+	"unknown",
+	"not-applicable"
+]);
+/** Adapters return bounded reason codes, never exceptions or raw service data. */
+async function collectChecks(definitions, { timeoutMs = 1500, now = Date.now, source = "server", scope = "plugin-process" } = {}) {
+	return Promise.all(definitions.map(async ({ id, capability, run }) => {
+		const startedAt = now();
+		let timer;
+		const controller = new AbortController();
+		const base = {
+			id,
+			capability,
+			source,
+			scope
+		};
+		try {
+			if (!run) return {
+				...base,
+				status: "unknown",
+				reason: "not-instrumented",
+				observedAt: now()
+			};
+			const result = await Promise.race([Promise.resolve().then(() => run(controller.signal)), new Promise((resolve) => {
+				timer = setTimeout(() => {
+					controller.abort();
+					resolve({
+						status: "unknown",
+						reason: "inspection-timeout"
+					});
+				}, timeoutMs);
+			})]);
+			const valid = states.has(result?.status) && /^[a-z][a-z0-9-]{0,63}$/u.test(result?.reason ?? "");
+			return {
+				...base,
+				status: valid ? result.status : "unknown",
+				reason: valid ? result.reason : "invalid-inspection-result",
+				observedAt: now(),
+				elapsedMs: Math.max(0, now() - startedAt)
+			};
+		} catch {
+			return {
+				...base,
+				status: "unknown",
+				reason: "inspection-failed",
+				observedAt: now(),
+				elapsedMs: Math.max(0, now() - startedAt)
+			};
+		} finally {
+			clearTimeout(timer);
+		}
+	}));
+}
+const diagnosticCapabilities = Object.freeze([
+	"account",
+	"accounts",
+	"settings",
+	"models",
+	"quota",
+	"search",
+	"images",
+	"sketch",
+	"subagents",
+	"compaction",
+	"transport",
+	"storage",
+	"host-ui"
+]);
+//#endregion
+//#region src/diagnostic-capabilities.js
+function capabilityCoverage({ account, preference, runtime, catalog, tools, storage, checks, operations, now = Date.now() }) {
+	const disabled = {
+		images: preference.imageGeneration === false && preference.imageEditing === false,
+		sketch: preference.imageSketch === false || preference.imageEditing === false,
+		search: preference.searchMode === "disabled",
+		compaction: preference.compactionMode === "dsh",
+		subagents: preference.subagentBackend === "dsh"
+	};
+	return diagnosticCapabilities.map((id) => {
+		let readiness = "unknown", reason = "not-instrumented", blockedBy;
+		if (disabled[id]) {
+			readiness = "not-applicable";
+			reason = "disabled-or-host-owned";
+		} else if ([
+			"models",
+			"quota",
+			"search",
+			"images",
+			"compaction"
+		].includes(id) && account.status === "signed-out") {
+			readiness = "warn";
+			reason = "sign-in-required";
+			blockedBy = "account";
+		} else if (id === "account") {
+			readiness = account.status === "signed-in" ? "pass" : "unknown";
+			reason = account.status === "signed-in" ? "local-sign-in-present" : "sign-in-unverified";
+		} else if (id === "settings" && typeof preference.writable === "boolean") {
+			readiness = preference.writable ? "pass" : "warn";
+			reason = preference.writable ? "settings-writable" : "settings-readonly";
+		} else if (id === "subagents" && runtime) {
+			readiness = runtime.installed && !runtime.restartRequired ? "pass" : "warn";
+			reason = runtime.restartRequired ? "restart-required" : runtime.installed ? "runtime-present" : "runtime-missing";
+		} else if (id === "models" && catalog) {
+			readiness = catalog.source === "online" ? "pass" : "warn";
+			reason = catalog.source === "online" ? "catalog-online" : "catalog-fallback";
+		} else if (id === "storage" && storage?.readable) {
+			readiness = "pass";
+			reason = "storage-readable";
+		} else if (tools && (id === "images" || id === "sketch" && preference.imageSketchAgent === true)) {
+			readiness = tools[id] ? "pass" : "warn";
+			reason = tools[id] ? "tool-registered" : "tool-missing";
+		}
+		const recent = (operations?.events ?? []).filter((event) => event.capability === id && now >= event.observedAt && now - event.observedAt <= 15 * 6e4).at(-1);
+		return {
+			id,
+			readiness,
+			reason,
+			...blockedBy ? { blockedBy } : {},
+			checks: checks.filter((check) => check.capability === id).map((check) => check.id),
+			execution: recent ? "observed" : "not-verified",
+			...recent ? { latest: {
+				action: recent.action,
+				source: recent.source,
+				status: recent.status,
+				observedAt: recent.observedAt
+			} } : {}
+		};
+	});
+}
+//#endregion
+//#region src/diagnostic-operations.js
+const actions = Object.freeze({
+	"login/start": "account",
+	"login/submit": "account",
+	"login/cancel": "account",
+	logout: "account",
+	"account/select": "accounts",
+	"account/remove": "accounts",
+	"preferences/update": "settings",
+	"account/cleanup": "accounts",
+	usage: "quota",
+	"preferences/models": "models",
+	"storage/status": "storage",
+	"storage/clear-forecast": "storage",
+	"runtime/install": "subagents",
+	"runtime/remove": "subagents",
+	"runtime/cancel": "subagents",
+	codex_image_generate: "images",
+	codex_sketch: "sketch"
+});
+function safeOperations(raw) {
+	if (!Array.isArray(raw?.events)) return void 0;
+	return {
+		scope: "plugin-process",
+		capacity: 32,
+		dropped: (Number.isSafeInteger(raw.dropped) && raw.dropped >= 0 ? raw.dropped : 0) + Math.max(0, raw.events.length - 32),
+		events: raw.events.slice(-32).flatMap((value) => {
+			if (!Object.hasOwn(actions, value?.action ?? "") || ![
+				"completed",
+				"failed",
+				"cancelled"
+			].includes(value.status) || !["rpc", "tool"].includes(value.source) || !Number.isSafeInteger(value.observedAt) || value.observedAt < 0) return [];
+			return [{
+				capability: actions[value.action],
+				action: value.action,
+				status: value.status,
+				source: value.source,
+				observedAt: value.observedAt
+			}];
+		})
+	};
+}
+function createDiagnosticOperations({ now = Date.now } = {}) {
+	const events = [];
+	let sequence = 0, dropped = 0;
+	const record = (action, status, source = "rpc") => {
+		if (!Object.hasOwn(actions, action) || ![
+			"completed",
+			"failed",
+			"cancelled"
+		].includes(status) || !["rpc", "tool"].includes(source)) return;
+		events.push({
+			sequence: ++sequence,
+			capability: actions[action],
+			action,
+			source,
+			status,
+			observedAt: now()
+		});
+		if (events.length > 32) {
+			events.shift();
+			dropped++;
+		}
+	};
+	return {
+		record,
+		wrap: (handler) => async (endpoint, payload, signal) => {
+			try {
+				const result = await handler(endpoint, payload, signal);
+				record(endpoint, result?.ok === true ? "completed" : "failed");
+				return result;
+			} catch (error) {
+				record(endpoint, signal?.aborted ? "cancelled" : "failed");
+				throw error;
+			}
+		},
+		tool: (exec, result) => {
+			if (!["codex_image_generate", "codex_sketch"].includes(exec?.name)) return;
+			record(exec.name, exec.signal?.aborted ? "cancelled" : result?.isError === true ? "failed" : result?.isError === false ? "completed" : "failed", "tool");
+		},
+		snapshot: () => ({
+			scope: "plugin-process",
+			capacity: 32,
+			dropped,
+			events: events.map((value) => ({ ...value }))
+		})
+	};
+}
+//#endregion
 //#region src/diagnostics.js
 const requestAreas = /* @__PURE__ */ new Set([
 	"login",
@@ -3939,6 +4242,26 @@ const elapsedBuckets = /* @__PURE__ */ new Set([
 	"5-15s",
 	"over-15s"
 ]);
+function safeHistory(raw) {
+	if (!raw || !Array.isArray(raw.events)) return void 0;
+	const events = raw.events.slice(-32).flatMap((value) => {
+		if (!value || !requestAreas.has(value.area) || !statuses.has(value.status) || !Number.isSafeInteger(value.sequence) || value.sequence < 1 || !Number.isSafeInteger(value.observedAt) || value.observedAt < 0) return [];
+		return [{
+			area: value.area,
+			status: value.status,
+			sequence: value.sequence,
+			observedAt: value.observedAt,
+			...codes.has(value.code) ? { code: value.code } : {},
+			...Number.isInteger(value.httpStatus) && value.httpStatus >= 100 && value.httpStatus <= 599 ? { httpStatus: value.httpStatus } : {}
+		}];
+	});
+	return {
+		scope: "plugin-process",
+		capacity: 32,
+		dropped: (Number.isSafeInteger(raw.dropped) && raw.dropped >= 0 ? raw.dropped : 0) + Math.max(0, raw.events.length - 32),
+		events
+	};
+}
 function safeRequests(network) {
 	const raw = network?.snapshot?.() ?? {};
 	const result = {};
@@ -3957,17 +4280,113 @@ function safeRequests(network) {
 	return result;
 }
 /** Build a support report that deliberately excludes OAuth and account metadata. */
-async function createSubscriptionDiagnostics({ auth, preferences, login = { phase: "idle" }, network, modelCatalog, connection, compaction }) {
+async function createSubscriptionDiagnostics({ auth, preferences, login = { phase: "idle" }, network, modelCatalog, connection, compaction, inspectionOptions, operations, runtimeManagement, storage, tools }) {
+	const collected = {};
+	const checks = await collectChecks([
+		[
+			"account",
+			"account",
+			() => auth.status()
+		],
+		[
+			"preferences",
+			"settings",
+			() => preferences.status()
+		],
+		[
+			"catalog",
+			"models",
+			() => modelCatalog?.status?.()
+		],
+		[
+			"gaps",
+			"models",
+			() => modelCatalog?.capabilityGaps?.()
+		],
+		[
+			"requests",
+			"transport",
+			() => network?.snapshot ? safeRequests(network) : void 0
+		],
+		[
+			"history",
+			"transport",
+			() => safeHistory(network?.history?.())
+		],
+		[
+			"websocket",
+			"transport",
+			() => connection ? safeCounters(connection, [
+				"requests",
+				"connectionsCreated",
+				"connectionsReused",
+				"deltaRequests",
+				"websocketFailures",
+				"sseFallbacks"
+			]) : void 0
+		],
+		[
+			"compaction",
+			"compaction",
+			() => compaction ? safeCounters(compaction, [
+				"requests",
+				"checkpointsSaved",
+				"checkpointsReused"
+			]) : void 0
+		],
+		[
+			"operations",
+			"transport",
+			() => safeOperations(operations?.snapshot?.())
+		],
+		[
+			"runtime",
+			"subagents",
+			async () => {
+				const value = await runtimeManagement?.status?.();
+				return value ? Object.fromEntries([
+					"available",
+					"installed",
+					"restartRequired"
+				].filter((key) => typeof value[key] === "boolean").map((key) => [key, value[key]])) : void 0;
+			}
+		],
+		[
+			"storage",
+			"storage",
+			async () => typeof storage === "function" ? (await storage(), { readable: true }) : void 0
+		],
+		[
+			"tools",
+			"host-ui",
+			() => typeof tools?.get === "function" ? {
+				images: !!tools.get("codex_image_generate"),
+				sketch: !!tools.get("codex_sketch")
+			} : void 0
+		]
+	].map(([id, capability, read]) => ({
+		id,
+		capability,
+		run: read ? async (signal) => {
+			const value = await read();
+			if (value === void 0) return {
+				status: "unknown",
+				reason: "not-instrumented"
+			};
+			if (!signal.aborted) collected[id] = value;
+			return {
+				status: "pass",
+				reason: "inspection-completed"
+			};
+		} : void 0
+	})), inspectionOptions);
 	let account = { status: "unknown" };
 	const issues = [];
-	try {
-		account = { status: (await auth.status()).authenticated === true ? "signed-in" : "signed-out" };
-	} catch {
-		issues.push({ code: "account-status-unavailable" });
-	}
-	const preference = preferences.status();
-	const catalog = modelCatalog?.status?.();
-	const gaps = (modelCatalog?.capabilityGaps?.() ?? []).slice(0, 20).flatMap((value) => {
+	if (collected.account) account = { status: collected.account.authenticated === true ? "signed-in" : "signed-out" };
+	else issues.push({ code: "account-status-unavailable" });
+	const preference = collected.preferences ?? {};
+	const catalog = collected.catalog;
+	const gaps = (Array.isArray(collected.gaps) ? collected.gaps : []).slice(0, 20).flatMap((value) => {
 		if (!value || typeof value.model !== "string" || !/^[a-z][a-z0-9._-]{0,79}$/u.test(value.model)) return [];
 		const fields = Object.fromEntries([
 			"reasoning",
@@ -3985,6 +4404,22 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 	if (gaps.length) issues.push({ code: "catalog-capabilities-not-adapted" });
 	return {
 		schemaVersion: 3,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		inspection: {
+			schemaVersion: 1,
+			meaning: "collection-success-is-not-feature-success",
+			checks,
+			capabilities: capabilityCoverage({
+				account,
+				preference,
+				runtime: collected.runtime,
+				catalog,
+				tools: collected.tools,
+				storage: collected.storage,
+				checks,
+				operations: collected.operations
+			})
+		},
 		package: "dsh-codex-subscription",
 		version: PACKAGE_VERSION,
 		runtime: {
@@ -3994,20 +4429,11 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 		},
 		account,
 		login,
-		requests: safeRequests(network),
-		...connection ? { websocket: safeCounters(connection, [
-			"requests",
-			"connectionsCreated",
-			"connectionsReused",
-			"deltaRequests",
-			"websocketFailures",
-			"sseFallbacks"
-		]) } : {},
-		...compaction ? { compaction: safeCounters(compaction, [
-			"requests",
-			"checkpointsSaved",
-			"checkpointsReused"
-		]) } : {},
+		requests: collected.requests ?? {},
+		...collected.history ? { requestHistory: collected.history } : {},
+		...collected.operations ? { operations: collected.operations } : {},
+		...collected.websocket ? { websocket: collected.websocket } : {},
+		...collected.compaction ? { compaction: collected.compaction } : {},
 		...catalog && ["fallback", "online"].includes(catalog.source) && [
 			"idle",
 			"refreshing",
@@ -4025,7 +4451,7 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 			...typeof preference.outputVerbosity === "string" ? { outputVerbosity: preference.outputVerbosity } : {},
 			searchProvider: preference.searchProvider,
 			speedMode: preference.speedMode,
-			writable: preference.writable === true
+			...typeof preference.writable === "boolean" ? { writable: preference.writable } : {}
 		},
 		issues
 	};
@@ -4192,10 +4618,7 @@ function createCodexUsageReader(options) {
 	let inFlight;
 	let generation = 0;
 	const load = async (signal) => {
-		const auth = await getAuth({ signal });
-		const credential = await readCredential({ signal });
-		const access = auth?.auth?.apiKey;
-		const accountId = credential?.type === "oauth" ? credential.accountId : void 0;
+		const { access, accountId } = await readSubscriptionCredentials(getAuth, readCredential, signal);
 		if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
 		const response = await fetchUsage(CODEX_USAGE_URL, {
 			method: "GET",
@@ -4851,9 +5274,7 @@ const requestSignal = (signal, timeoutMs) => {
 function safeCopy(value) {
 	return typeof value === "string" && value.length > 0 ? value.slice(0, MAX_COPY_LENGTH) : void 0;
 }
-function credentialsOf(auth, credential) {
-	const access = auth?.auth?.apiKey;
-	const accountId = credential?.type === "oauth" ? credential.accountId : void 0;
+function credentialsOf({ access, accountId }) {
 	if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
 	return {
 		access,
@@ -4938,7 +5359,7 @@ function createCodexResetCreditService(options) {
 		...credit.title === void 0 ? {} : { name: credit.title },
 		...credit.creditExpiresAt === void 0 ? {} : { expiresAt: credit.creditExpiresAt }
 	});
-	const resolveCredentials = async (signal) => credentialsOf(await getAuth({ signal }), await readCredential({ signal }));
+	const resolveCredentials = async (signal) => credentialsOf(await readSubscriptionCredentials(getAuth, readCredential, signal));
 	const readDetails = async (signal, credentials) => {
 		const { access, accountId } = credentials ?? await resolveCredentials(signal);
 		const response = await fetchReset(CODEX_RESET_CREDITS_URL, {
@@ -5129,7 +5550,7 @@ const publicError = (code, message) => ({
 		details: { issues: [] }
 	}
 });
-function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditService, preferences, runtimeManagement, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged }) {
+function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditService, preferences, runtimeManagement, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
 	return async (endpoint, payload, signal) => {
 		if (endpoint === "storage/status" || endpoint === "storage/clear-forecast") try {
 			signal.throwIfAborted();
@@ -5287,23 +5708,20 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, resetCreditSer
 			return publicError("internal", message);
 		}
 		const result = await authHandler(endpoint, payload, signal);
-		if (result.ok === true && [
-			"logout",
-			"account/select",
-			"account/remove"
-		].includes(endpoint)) closeConnections?.();
-		if (endpoint === "account/remove" && result.ok === true && typeof payload?.id === "string") await usageReader.clearScope(payload.id);
-		if (endpoint === "logout" && result.ok === true) {
-			await usageReader.clear();
-			resetCreditService.clear();
-			modelCatalog?.clear();
-			onAccountChanged?.();
-		} else if (result.ok === true && (endpoint === "account/select" || endpoint === "account/remove" || endpoint === "login/status" && result.value?.authenticated === true)) {
-			usageReader.clearCache();
-			resetCreditService.clear();
-			modelCatalog?.clear();
-			onAccountChanged?.();
-			modelCatalog?.refresh({ signal: void 0 }).catch(() => {});
+		if (result.ok === true && (endpoint === "logout" || endpoint === "account/select" || endpoint === "account/remove" || endpoint === "login/status" && result.value?.authenticated === true)) {
+			const tasks = [
+				() => closeConnections?.(),
+				() => usageReader.clearCache(),
+				() => resetCreditService.clear(),
+				() => modelCatalog?.clear(),
+				() => onAccountChanged?.()
+			];
+			if (endpoint === "logout") tasks.push(() => usageReader.clear());
+			if (endpoint === "account/remove" && typeof payload?.id === "string") tasks.push(() => usageReader.clearScope(payload.id));
+			if ((await Promise.allSettled(tasks.map((task) => Promise.resolve().then(task)))).some((value) => value.status === "rejected")) try {
+				onCleanupFailure?.();
+			} catch {}
+			if (endpoint !== "logout") Promise.resolve().then(() => modelCatalog?.refresh({ signal: void 0 })).catch(() => {});
 		} else if (result.ok === true && (endpoint === "status" || result.value?.authenticated === true)) modelCatalog?.refresh({ signal: void 0 }).catch(() => {});
 		return result;
 	};
@@ -5381,6 +5799,8 @@ function apply(ctx, config = {}) {
 	const settings = createSettingsAdapter(ctx, z.object(settingsFields), config, SETTINGS_NAMESPACE);
 	const searchProvider = createSearchProviderSwitcher(ctx.loader);
 	const network = createCodexNetworkTransport();
+	const diagnosticOperations = createDiagnosticOperations();
+	ctx.effect(() => ctx.on?.("tools/result", (exec, result) => diagnosticOperations.tool(exec, result)), "codex-subscription: operation evidence");
 	const originalImages = new OriginalImageStore();
 	const accountVault = ACCOUNT_VAULT_KEY !== void 0 && typeof ctx.credentials.readRecord === "function" && typeof ctx.credentials.modifyRecord === "function" && typeof ctx.credentials.deleteRecord === "function" ? new DshOAuthAccountVault(ctx.credentials, {
 		key: ACCOUNT_VAULT_KEY,
@@ -5714,14 +6134,19 @@ function apply(ctx, config = {}) {
 			network,
 			modelCatalog,
 			connection,
-			compaction
+			compaction,
+			operations: diagnosticOperations,
+			runtimeManagement,
+			storage: () => usageReader.storage(),
+			tools: ctx.tools
 		}),
+		onCleanupFailure: () => diagnosticOperations.record("account/cleanup", "failed"),
 		modelCatalog,
 		closeConnections: () => connection.dispose(),
 		originalImages,
 		resolveInheritedOriginal: (sessionId, assetId) => inheritedOriginalImageRef(ctx.get?.("sessions")?.get?.(sessionId), assetId)
 	});
-	const handler = (endpoint, payload, signal) => endpoint.startsWith("sketch/") ? sketchBridge.rpc(endpoint, payload) : subscriptionHandler(endpoint, payload, signal);
+	const handler = diagnosticOperations.wrap((endpoint, payload, signal) => endpoint.startsWith("sketch/") ? sketchBridge.rpc(endpoint, payload) : subscriptionHandler(endpoint, payload, signal));
 	ctx.effect(() => {
 		modelCatalog.refresh().catch((error) => ctx.logger?.debug?.("could not refresh Codex model catalog: %s", error.message));
 	}, "codex-subscription: official model catalog");