dsh-codex-subscription 2.4.2 → 2.5.0

package/lib/index.js

@@ -14,9 +14,9 @@ import { constants, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { defineTool } from "@deepseek-ai/dsh-tools";
+import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import * as dshCredentials from "@deepseek-ai/dsh-credentials";
 import { dshHomePath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import z from "@deepseek-ai/schemastery";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
@@ -166,8 +166,7 @@ const IMAGE_FEATURE_DEFAULTS = Object.freeze({
 	imageViewer: true,
 	imageAnnotations: true,
 	imageSketch: false,
-	imageSketchAgent: false,
-	imageSketchAgentPreview: false
+	imageSketchAgent: false
 });
 function readImageFeatures(value = {}) {
 	return Object.fromEntries(Object.entries(IMAGE_FEATURE_DEFAULTS).map(([key, fallback]) => [key, typeof value?.[key] === "boolean" ? value[key] : fallback]));
@@ -1980,322 +1979,913 @@ const sketchCommandArray = {
 	})
 };
 //#endregion
-//#region src/sketch-agent-tool.js
-function createSketchAgentTool(bridge, attachments) {
-	return defineTool({
-		name: "codex_sketch",
-		description: "Edit the sketch board in this session using native editable strokes and layers. Use for @sketch requests and explicit follow-up edits to that drawing. The toolbar pen button is for manual drawing; do not require the user to open it. Start with inspect for the runId, documentId, revision and command reference. Draw with the svg op whenever possible: one SVG document per stage (paths, shapes, groups, transforms; see the reference from inspect) is far faster and richer than hand-placed strokes, and still becomes native editable strokes. Draw the shapes, hair, clothing and lettering outlines of every layer with svg; use stroke commands only for small corrections and native text. Apply atomic batches, preview between stages, and call finish to save the finished draft and release the editing lock. save is only a checkpoint. finish returns an image only when the user enables experimental preview feedback. Closing the board does not stop drawing. If the user stops drawing, do not retry. Never generates AI images, sends messages or attaches images automatically. Inspect automatically opens the board in the currently viewed session. Do not ask the user to open it first. If the session is not visible in DSH, ask them to switch to it. On timeout inspect before retrying; reuse the exact requestId only for the same request.",
-		parameters: {
-			action: {
-				type: "string",
-				required: true,
-				enum: [
-					"inspect",
-					"apply",
-					"preview",
-					"save",
-					"finish"
-				]
-			},
-			runId: {
-				type: "string",
-				description: "From inspect; required for all other actions. Never reuse a stopped run."
-			},
-			documentId: {
-				type: "string",
-				description: "From inspect; required except for inspect."
-			},
-			revision: {
-				type: "integer",
-				description: "From latest response; required for apply/save/finish."
-			},
-			requestId: {
-				type: "string",
-				description: "Unique id for apply/save/finish; exact retries are deduplicated. After timeout inspect recentRequests before repeating a write."
-			},
-			commands: {
-				oneOf: [sketchCommandArray, { type: "string" }],
-				description: "Prefer a native command array. Legacy JSON string also accepted. Required for apply. Use named objects and update existing IDs; prefer Bezier start + segments (control1/control2/end) for curves, not hundreds of pen points."
-			},
-			name: {
-				type: "string",
-				description: "Draft name for save/finish."
-			},
-			offset: {
-				type: "integer",
-				description: "inspect only: object list offset, default 0. Follow nextOffset for further pages."
-			},
-			objectId: {
-				type: "string",
-				description: "inspect only: return full editable geometry for this object, in layer (defaults to active layer)."
-			},
-			layer: {
-				type: "integer",
-				description: "inspect only: layer containing objectId."
-			}
-		},
-		timeoutMs: 25e3,
-		isConcurrencySafe: () => false,
-		async execute(args, exec) {
-			const sessionId = exec.agent?.id;
-			if (typeof sessionId !== "string") throw Error("A session-owned sketch call is required");
-			const request = { ...args };
-			if (args.action === "apply") try {
-				request.commands = typeof args.commands === "string" ? JSON.parse(args.commands) : args.commands;
-				if (!Array.isArray(request.commands)) throw Error();
-			} catch {
-				throw Error("commands must be a native array or JSON array string");
-			}
-			const value = await bridge.request(sessionId, request, exec.signal);
-			if (value.png) {
-				if (!/^data:image\/png;base64,/.test(value.png) || value.png.length > 8 * 1024 * 1024) throw Error("Invalid sketch preview");
-				const image = await attachments.saveImage({
-					data: new Uint8Array(Buffer.from(value.png.split(",")[1], "base64")),
-					mediaType: "image/png",
-					name: "sketch-preview.png"
-				});
-				const { png, ...snapshot } = value;
-				return {
-					...snapshot,
-					image
-				};
-			}
-			return value;
-		},
-		output: {
-			schema: {
-				type: "object",
-				additionalProperties: true
-			},
-			render: (_args, value) => [{
-				type: "text",
-				text: JSON.stringify({
-					...value,
-					image: void 0
-				})
-			}, ...value.image ? [{
-				type: "image",
-				attachment: value.image
-			}] : []]
-		}
-	});
+//#region src/subscription-credentials.js
+async function readSubscriptionCredentials(getAuth, readCredential, signal) {
+	for (let attempt = 0; attempt < 2; attempt++) {
+		const auth = await getAuth({ signal });
+		signal?.throwIfAborted();
+		if (typeof auth?.auth?.apiKey !== "string" || !auth.auth.apiKey) break;
+		const credential = await readCredential({ signal });
+		signal?.throwIfAborted();
+		if (credential?.type !== "oauth") break;
+		if (credential.access === auth.auth.apiKey) return {
+			access: credential.access,
+			accountId: credential.accountId
+		};
+	}
+	return {
+		access: void 0,
+		accountId: void 0
+	};
 }
-//#endregion
-//#region src/sketch-codec-route.js
-function registerSketchCodec(connection) {
-	let source;
-	return connection.fetch.register({
-		path: "/api/codex-subscription/sketch-psd-worker",
-		methods: ["GET"],
-		requestBody: "buffered",
-		async fetch() {
-			source ??= await readFile(new URL("./sketch-psd-worker.js", import.meta.url));
-			return new Response(source, { headers: {
-				"content-type": "text/javascript; charset=utf-8",
-				"cache-control": "no-store"
-			} });
-		}
-	});
+const ORIGINAL_IMAGE_CHUNK_BYTES = 4 * 1024 * 1024;
+const ORIGINAL_IMAGE_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
+const positiveInteger$1 = (value) => Number.isSafeInteger(value) && value > 0;
+function decodeOriginalImageRef(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || typeof value.assetId !== "string" || !ORIGINAL_IMAGE_ID_PATTERN.test(value.assetId) || value.mediaType !== "image/png" || !positiveInteger$1(value.bytes) || value.bytes > 48 * 1024 * 1024 || !positiveInteger$1(value.width) || !positiveInteger$1(value.height) || typeof value.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value.name) || typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(value.sha256)) return void 0;
+	return {
+		assetId: value.assetId,
+		mediaType: value.mediaType,
+		bytes: value.bytes,
+		width: value.width,
+		height: value.height,
+		name: value.name,
+		sha256: value.sha256
+	};
 }
-//#endregion
-//#region src/account-vault.js
-const VERSION = 1;
-const DEFAULT_LABEL = "Account 1";
-const clone$1 = (value) => value === void 0 ? void 0 : structuredClone(value);
-const EMAIL_MAX_LENGTH = 254;
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
-/** Keep only a bounded, display-safe email address from a trusted OAuth result. */
-function normalizeAccountEmail(value) {
-	if (typeof value !== "string") return void 0;
-	const email = value.trim();
-	return email.length > 0 && email.length <= EMAIL_MAX_LENGTH && EMAIL_PATTERN.test(email) ? email : void 0;
+function decodeImagePresentation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || value.kind !== "codex-subscription-image" || value.schemaVersion !== 1) return void 0;
+	const original = decodeOriginalImageRef(value.original);
+	return original === void 0 ? void 0 : { original };
 }
-function decodeJwtPayload(access) {
-	if (typeof access !== "string") return void 0;
-	const encoded = access.split(".")[1];
-	if (typeof encoded !== "string" || encoded.length === 0) return void 0;
-	try {
-		return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+function originalImageRefsEqual(left, right) {
+	const a = decodeOriginalImageRef(left);
+	const b = decodeOriginalImageRef(right);
+	return a !== void 0 && b !== void 0 && a.assetId === b.assetId && a.mediaType === b.mediaType && a.bytes === b.bytes && a.width === b.width && a.height === b.height && a.name === b.name && a.sha256 === b.sha256;
+}
+/** Resolve only an exact original reference copied into a DSH fork prefix. */
+function inheritedOriginalImageRef(session, assetId) {
+	const parentSession = session?.header?.parentSession;
+	const seedLength = Number.isSafeInteger(session?.inheritedEventCount) ? session.inheritedEventCount : session?.header?.seedLength;
+	if (typeof parentSession !== "string" || parentSession.length === 0 || !Number.isSafeInteger(seedLength) || seedLength < 0 || !ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) return void 0;
+	let events = session?.events;
+	if (!Array.isArray(events) && typeof session?.snapshotEvents === "function") try {
+		events = session.snapshotEvents();
 	} catch {
 		return;
 	}
+	if (!Array.isArray(events)) return void 0;
+	for (const event of events) {
+		if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq >= seedLength || event.type !== "tool/result") continue;
+		const original = decodeImagePresentation(event.data?.meta)?.original;
+		if (original?.assetId === assetId) return original;
+	}
 }
-function emailFromAccessToken(access) {
-	const payload = decodeJwtPayload(access);
-	return normalizeAccountEmail(payload?.["https://api.openai.com/profile"]?.email ?? payload?.email);
+//#endregion
+//#region src/version.js
+const PACKAGE_VERSION = "2.5.0";
+const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
+//#endregion
+//#region src/codex-images.js
+const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
+const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
+const CODEX_IMAGE_EDIT_URL = "https://chatgpt.com/backend-api/codex/images/edits";
+const MAX_REFERENCE_IMAGES = 5;
+const RESPONSE_ENVELOPE_BYTES = 1024 * 1024;
+const IMAGE_BACKGROUNDS = /* @__PURE__ */ new Set([
+	"auto",
+	"transparent",
+	"opaque"
+]);
+const PNG_SIGNATURE = Buffer.from([
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+]);
+const FULL_ATTACHMENT_ID = /^sha256:[0-9a-f]{64}$/u;
+const BARE_ATTACHMENT_DIGEST = /^[0-9a-f]{64}$/iu;
+const PATH_LIKE_ATTACHMENT_ID = /[\\/]/u;
+const FILE_NAME_ATTACHMENT_ID = /\.[A-Za-z0-9]{1,16}$/u;
+const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const nonEmpty$2 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+const NETWORK_REASONS = {
+	UND_ERR_HEADERS_TIMEOUT: "the image service sent no response within 5 minutes",
+	UND_ERR_BODY_TIMEOUT: "the image response stalled",
+	UND_ERR_CONNECT_TIMEOUT: "the connection to the image service timed out",
+	UND_ERR_SOCKET: "the connection closed unexpectedly",
+	ECONNRESET: "the connection was reset",
+	ETIMEDOUT: "the connection timed out",
+	ENOTFOUND: "DNS lookup failed",
+	ECONNREFUSED: "the connection was refused",
+	EAI_AGAIN: "DNS lookup failed"
+};
+function requestFailureReason(error) {
+	const code = [(error?.cause ?? error)?.code, error?.code].find((value) => typeof value === "string" && /^[A-Z][A-Z0-9_]{2,39}$/u.test(value));
+	if (code !== void 0) return `: ${NETWORK_REASONS[code] ?? "network error"} (${code})`;
+	if (error?.name === "TimeoutError") return ": the image request timed out";
+	return "";
 }
-/** Normalize the one non-secret account attribute that may cross the UI boundary. */
-function sanitizeOAuthCredential(value) {
-	const credential = assertOAuthCredential$1(value);
-	const email = emailFromAccessToken(credential.access) ?? normalizeAccountEmail(credential.email);
-	if (email === void 0) {
-		delete credential.email;
-		return credential;
+function normalizeImageOptions(args) {
+	const quality = nonEmpty$2(args?.quality) ?? "auto";
+	const background = nonEmpty$2(args?.background) ?? "auto";
+	const size = nonEmpty$2(args?.size) ?? "auto";
+	validateImageQuality(resolveImageModel(args?.model), quality);
+	if (!IMAGE_BACKGROUNDS.has(background)) throw new Error("background must be auto, transparent, or opaque");
+	if (size !== "auto") {
+		const match = /^(\d+)x(\d+)$/u.exec(size);
+		const width = Number(match?.[1]);
+		const height = Number(match?.[2]);
+		const short = Math.min(width, height);
+		const long = Math.max(width, height);
+		const pixels = width * height;
+		if (match === null || width % 16 !== 0 || height % 16 !== 0 || long > 3840 || long > short * 3 || pixels < 655360 || pixels > 8294400) throw new Error("size must be auto or a valid GPT Image 2 widthxheight resolution");
 	}
 	return {
-		...credential,
-		email
-	};
-}
-function assertOAuthCredential$1(value) {
-	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex account vault received a malformed OAuth credential");
-	return clone$1(value);
+		quality,
+		background,
+		size
+	};
 }
-function parseOAuthCredential$1(value) {
+function encodedLimit(decodedBytes) {
+	return Math.ceil(decodedBytes / 3) * 4;
+}
+function validBase64Body(value, end) {
+	for (let index = 0; index < end; index += 1) {
+		const code = value.charCodeAt(index);
+		if (!(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return false;
+	}
+	return true;
+}
+async function readJsonWithin(response, maximumBytes) {
+	const contentLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > maximumBytes) throw new Error("Codex image response exceeds the image size limit");
+	if (response.body === null) throw new Error("Codex returned an unreadable image response");
+	const reader = response.body.getReader();
+	const chunks = [];
+	let bytes = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		bytes += value.byteLength;
+		if (bytes > maximumBytes) {
+			await reader.cancel();
+			throw new Error("Codex image response exceeds the image size limit");
+		}
+		chunks.push(value);
+	}
+	const body = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), bytes).toString("utf8");
 	try {
-		return assertOAuthCredential$1(JSON.parse(value));
-	} catch (error) {
-		if (error?.message === "Codex account vault received a malformed OAuth credential") throw error;
-		throw new Error("Codex account vault contains malformed OAuth JSON", { cause: error });
+		return JSON.parse(body);
+	} catch {
+		throw new Error("Codex returned an unreadable image response");
 	}
 }
-function normalizeLabel(value) {
-	if (typeof value !== "string") throw new Error("Codex account label must be text");
-	const label = value.trim().replace(/\s+/gu, " ");
-	if (label.length === 0 || label.length > 48) throw new Error("Codex account label must contain 1 to 48 characters");
-	return label;
+/** Strictly decode one PNG returned by the subscription backend. */
+function decodeCodexPng(value, maximumBytes) {
+	const encoded = nonEmpty$2(value);
+	const padding = encoded?.endsWith("==") ? 2 : encoded?.endsWith("=") ? 1 : 0;
+	if (encoded === void 0 || encoded.length % 4 !== 0 || !validBase64Body(encoded, encoded.length - padding)) throw new Error("Codex returned an invalid base64 PNG");
+	const decodedBytes = encoded.length / 4 * 3 - padding;
+	if (decodedBytes > maximumBytes) throw new Error("Codex image exceeds the image size limit");
+	const data = Buffer.from(encoded, "base64");
+	if (data.length !== decodedBytes || data.length < PNG_SIGNATURE.length || !data.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) throw new Error("Codex returned an invalid PNG");
+	return new Uint8Array(data);
 }
-function assertVaultRecord(record) {
-	if (record?.kind !== "grant" || record.payload?.version !== VERSION || typeof record.payload.activeId !== "string" || !Array.isArray(record.payload.accounts) || record.payload.accounts.length === 0) throw new Error("Codex account vault contains a malformed grant record");
-	const ids = /* @__PURE__ */ new Set();
-	const accounts = record.payload.accounts.map((account) => {
-		if (account === null || typeof account !== "object" || typeof account.id !== "string" || account.id.length === 0 || ids.has(account.id)) throw new Error("Codex account vault contains a malformed account id");
-		ids.add(account.id);
-		return {
-			id: account.id,
-			label: normalizeLabel(account.label),
-			credential: sanitizeOAuthCredential(account.credential)
-		};
+function imageReference(value) {
+	const originalDimensions = record$4(value.originalDimensions) ? {
+		width: value.originalDimensions.width,
+		height: value.originalDimensions.height
+	} : void 0;
+	return {
+		attachmentId: value.attachmentId,
+		mediaType: value.mediaType,
+		bytes: value.bytes,
+		width: value.width,
+		height: value.height,
+		...value.name === void 0 ? {} : { name: value.name },
+		...originalDimensions === void 0 ? {} : { originalDimensions }
+	};
+}
+function normalizeAttachmentId(value) {
+	if (typeof value !== "string") return void 0;
+	if (FULL_ATTACHMENT_ID.test(value)) return value;
+	const bare = BARE_ATTACHMENT_DIGEST.exec(value);
+	return bare === null ? void 0 : `sha256:${bare[0].toLowerCase()}`;
+}
+function invalidAttachmentId(value) {
+	const attachmentId = value?.attachmentId;
+	if (typeof attachmentId === "string" && (PATH_LIKE_ATTACHMENT_ID.test(attachmentId) || FILE_NAME_ATTACHMENT_ID.test(attachmentId))) throw new Error("referenceImages attachmentId is a file path or filename; call read_image on that file and retry with its complete sha256:<64 lowercase hex> attachment reference. Do not omit referenceImages or fall back to new image generation.");
+	throw new Error("referenceImages attachmentId must be sha256:<64 lowercase hex> copied from an image block or read_image result. Do not omit referenceImages or fall back to new image generation.");
+}
+function referenceOf(value, attachments) {
+	const attachmentId = normalizeAttachmentId(value?.attachmentId);
+	if (attachmentId === void 0) invalidAttachmentId(value);
+	if (!record$4(value) || !attachments.imageLimits.mediaTypes.includes(value.mediaType) || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || !Number.isSafeInteger(value.width) || value.width <= 0 || !Number.isSafeInteger(value.height) || value.height <= 0 || value.name !== void 0 && (typeof value.name !== "string" || value.name.length > 256) || value.originalDimensions !== void 0 && (!record$4(value.originalDimensions) || !Number.isSafeInteger(value.originalDimensions.width) || value.originalDimensions.width <= 0 || !Number.isSafeInteger(value.originalDimensions.height) || value.originalDimensions.height <= 0)) throw new Error("referenceImages contains an invalid image reference");
+	return imageReference({
+		...value,
+		attachmentId
 	});
-	if (!ids.has(record.payload.activeId)) throw new Error("Codex account vault active account is missing");
-	const legacyAccountId = record.payload.legacyAccountId;
-	if (legacyAccountId !== void 0 && !ids.has(legacyAccountId)) throw new Error("Codex account vault legacy account is missing");
+}
+function sessionImageReferences(messages) {
+	const references = /* @__PURE__ */ new Map();
+	const visit = (content) => {
+		if (!Array.isArray(content)) return;
+		for (const block of content) if (block?.type === "image" && record$4(block.attachment)) {
+			const id = normalizeAttachmentId(block.attachment.attachmentId);
+			if (id !== void 0) references.set(id, block.attachment);
+		} else if (block?.type === "tool-result") visit(block.content);
+	};
+	for (const message of messages ?? []) visit(message?.content);
+	return references;
+}
+async function readSessionImage(attachmentId, attachments, signal, messages) {
+	const id = normalizeAttachmentId(attachmentId);
+	if (id === void 0) invalidAttachmentId({ attachmentId });
+	const selected = sessionImageReferences(messages).get(id);
+	if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Copy attachmentId from the image block of the user message; never pass a path or filename.");
+	const stored = await attachments.readImage(referenceOf(selected, attachments), signal);
 	return {
-		version: VERSION,
-		activeId: record.payload.activeId,
-		legacyAccountId,
-		accounts
+		data: stored.data,
+		mediaType: stored.ref.mediaType,
+		name: stored.ref.name
 	};
 }
-const grant = (payload) => ({
-	kind: "grant",
-	payload
-});
-var PendingOAuthCredentialStore = class {
-	#credential;
-	async read(providerId) {
-		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
-		return clone$1(this.#credential);
-	}
-	async list() {
-		return this.#credential === void 0 ? [] : [{
-			providerId: "openai-codex",
-			type: "oauth"
-		}];
-	}
-	async modify(providerId, update) {
-		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
-		const next = await update(clone$1(this.#credential));
-		if (next !== void 0) this.#credential = sanitizeOAuthCredential(next);
-		return clone$1(this.#credential);
-	}
-	async delete(providerId) {
-		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
-		this.#credential = void 0;
-	}
-	credential() {
-		return clone$1(this.#credential);
-	}
-};
-/**
-* Multi-account owner state stored in DSH's atomic plugin credential record.
-* The old single-account reference remains as a rollback source and is kept in
-* sync whenever that imported account rotates its refresh token.
-*/
-var DshOAuthAccountVault = class {
-	#tail = Promise.resolve();
-	constructor(credentials, options) {
-		if (credentials === void 0 || credentials === null || typeof credentials.readRecord !== "function" || typeof credentials.modifyRecord !== "function") throw new Error("Codex multi-account requires DSH credential records");
-		this.credentials = credentials;
-		this.key = options.key;
-		this.legacyRef = options.legacyRef;
-		this.legacyRefs = Object.freeze([...options.legacyRefs ?? []]);
-		this.createId = options.createId ?? randomUUID;
-		this.onLegacySyncFailure = options.onLegacySyncFailure ?? (() => {});
-	}
-	#enqueue(operation) {
-		const current = this.#tail.catch(() => void 0).then(operation);
-		this.#tail = current.catch(() => void 0);
-		return current;
-	}
-	async #legacyCredential() {
-		for (const ref of [this.legacyRef, ...this.legacyRefs]) {
-			const hit = await this.credentials.resolve(ref);
-			if (hit?.value === void 0 || hit.value === "") continue;
-			return {
-				ref,
-				credential: parseOAuthCredential$1(hit.value)
-			};
-		}
-	}
-	async #ensurePayload() {
-		const existing = await this.credentials.readRecord(this.key);
-		if (existing !== void 0) return assertVaultRecord(existing);
-		const legacy = await this.#legacyCredential();
-		if (legacy === void 0) return void 0;
-		const id = this.createId();
-		return assertVaultRecord(await this.credentials.modifyRecord(this.key, (current) => {
-			if (current !== void 0) return Promise.resolve(current);
-			return Promise.resolve(grant({
-				version: VERSION,
-				activeId: id,
-				legacyAccountId: id,
-				accounts: [{
-					id,
-					label: DEFAULT_LABEL,
-					credential: legacy.credential
-				}]
-			}));
-		}));
-	}
-	async #modifyPayload(update) {
-		await this.#ensurePayload();
-		let previousLegacy;
-		const payload = assertVaultRecord(await this.credentials.modifyRecord(this.key, async (current) => {
-			if (current === void 0) throw new Error("Codex account vault is not signed in");
-			const payload = assertVaultRecord(current);
-			previousLegacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
-			const next = await update(clone$1(payload));
-			return grant(next);
-		}));
-		const legacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
-		try {
-			if (legacy === void 0) {
-				if (previousLegacy !== void 0) await this.credentials.unset(this.legacyRef);
-			} else if (JSON.stringify(legacy) !== JSON.stringify(previousLegacy)) await this.credentials.set(this.legacyRef, JSON.stringify(legacy));
-		} catch {
-			this.onLegacySyncFailure();
-		}
-		return payload;
-	}
-	list() {
-		return this.#enqueue(async () => {
-			const payload = await this.#ensurePayload();
-			if (payload === void 0) return [];
-			return payload.accounts.map((account) => ({
-				id: account.id,
-				label: account.label,
-				active: account.id === payload.activeId,
-				expiresAt: account.credential.expires,
-				...account.credential.email === void 0 ? {} : { email: account.credential.email }
-			}));
-		});
-	}
-	readActive() {
-		return this.#enqueue(async () => {
-			const payload = await this.#ensurePayload();
-			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
-		});
+async function editImages(values, attachments, signal, messages) {
+	if (!Array.isArray(values) || values.length === 0 || values.length > MAX_REFERENCE_IMAGES) throw new Error(`referenceImages must contain between 1 and ${MAX_REFERENCE_IMAGES} images`);
+	const available = messages === void 0 ? void 0 : sessionImageReferences(messages);
+	const references = values.map((value) => {
+		const id = normalizeAttachmentId(value?.attachmentId);
+		if (id === void 0) invalidAttachmentId(value);
+		if (available === void 0) return referenceOf(value, attachments);
+		const selected = available.get(id);
+		if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Call read_image on the intended image and retry with its returned reference. Do not omit referenceImages or substitute another image.");
+		return referenceOf(selected, attachments);
+	});
+	if (new Set(references.map((value) => value.attachmentId)).size !== references.length) throw new Error("referenceImages must not contain duplicates");
+	const images = [];
+	let totalBytes = 0;
+	for (const reference of references) {
+		const stored = await attachments.readImage(reference, signal);
+		totalBytes += stored.data.byteLength;
+		if (totalBytes > attachments.imageLimits.maxMessageImageBytes) throw new Error("referenceImages exceed the DSH message image limit");
+		images.push({ image_url: `data:${stored.ref.mediaType};base64,${Buffer.from(stored.data).toString("base64")}` });
+	}
+	return images;
+}
+function imageContent(value) {
+	const label = typeof value.size === "string" && value.size.length > 0 ? `Generated a ${value.size} image.` : "Generated an image.";
+	return [{
+		type: "text",
+		text: value.localPath === void 0 ? label : `${label}\nOriginal PNG saved on the DSH host at: ${JSON.stringify(value.localPath)}. Read this file or copy it to the workspace with a .png extension; this host path is not a browser URL.`
+	}, {
+		type: "image",
+		attachment: imageReference(value.image)
+	}];
+}
+function imageOutputSchema() {
+	return {
+		type: "object",
+		additionalProperties: false,
+		properties: {
+			image: {
+				type: "object",
+				required: true,
+				additionalProperties: false,
+				properties: {
+					attachmentId: {
+						type: "string",
+						required: true
+					},
+					mediaType: {
+						type: "string",
+						enum: ["image/png"],
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					width: {
+						type: "integer",
+						required: true
+					},
+					height: {
+						type: "integer",
+						required: true
+					},
+					name: { type: "string" },
+					originalDimensions: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							width: {
+								type: "integer",
+								required: true
+							},
+							height: {
+								type: "integer",
+								required: true
+							}
+						}
+					}
+				}
+			},
+			original: {
+				type: "object",
+				required: true,
+				additionalProperties: false,
+				properties: {
+					assetId: {
+						type: "string",
+						required: true
+					},
+					mediaType: {
+						type: "string",
+						enum: ["image/png"],
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					width: {
+						type: "integer",
+						required: true
+					},
+					height: {
+						type: "integer",
+						required: true
+					},
+					name: {
+						type: "string",
+						required: true
+					},
+					sha256: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			background: { type: "string" },
+			requestedModel: { type: "string" },
+			reportedModel: { type: "string" },
+			requestedSize: { type: "string" },
+			localPath: {
+				type: "string",
+				required: true,
+				description: "Absolute path to the original PNG on the DSH host."
+			},
+			quality: { type: "string" },
+			size: { type: "string" }
+		}
+	};
+}
+function responseMetadata(value) {
+	const data = Array.isArray(value?.data) ? value.data[0] : void 0;
+	const encoded = record$4(data) ? data.b64_json : void 0;
+	if (typeof encoded !== "string") throw new Error("Codex returned no image data");
+	return {
+		encoded,
+		background: nonEmpty$2(value.background),
+		quality: nonEmpty$2(value.quality),
+		size: nonEmpty$2(value.size),
+		reportedModel: nonEmpty$2(value.model)
+	};
+}
+/** Create the DSH-native image-generation tool backed only by the ChatGPT subscription. */
+function createCodexImageTool(options) {
+	const fetchImage = options.fetch ?? fetch;
+	const attachments = options.attachments;
+	return defineTool({
+		name: CODEX_IMAGE_TOOL_NAME,
+		description: "Generate or edit images only when the user asks for image output, not when merely discussing images. Uses the signed-in Codex subscription. For a new image, omit referenceImages. For edits, copy attachmentId only from the selected session image block; the host supplies its metadata. Never call read_image for an attachmentId or attachment filename. Use read_image only for an actual local file whose reference is not already in the conversation. Never substitute paths, unrelated images, or text-only generation for an edit. For numbered annotations, include the clean source and location-reference image, preserve the requested changes and coordinates in the prompt, and remove guidance markers from the result. If the intended references cannot be identified, ask rather than guessing.",
+		parameters: {
+			model: {
+				type: "string",
+				enum: Object.keys(IMAGE_MODELS),
+				description: "Optional image engine, independent of the conversation model. When omitted, uses the user image setting (initially gpt-image-2). The 2.5 identifiers are experimental subscription candidates; override only when explicitly requested. Never silently retry with another model."
+			},
+			prompt: {
+				type: "string",
+				required: true,
+				description: "A complete, production-ready description of the image to generate."
+			},
+			size: {
+				type: "string",
+				description: "Optional GPT Image 2 output size. Use auto unless the user requests an exact valid widthxheight resolution."
+			},
+			quality: {
+				type: "string",
+				enum: [
+					"auto",
+					"low",
+					"medium",
+					"high",
+					"xhigh",
+					"max"
+				],
+				description: "Optional rendering quality. Use auto unless the user requests draft speed or final quality."
+			},
+			background: {
+				type: "string",
+				enum: [
+					"auto",
+					"transparent",
+					"opaque"
+				],
+				description: "Optional background mode. Request transparent only when the user needs transparency."
+			},
+			referenceImages: {
+				type: "array",
+				description: "Optional references to 1-5 selected images. For session images provide only attachmentId; the host resolves trusted metadata. Omit only for a new image; never drop an invalid reference to bypass editing.",
+				items: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						attachmentId: {
+							type: "string",
+							required: true,
+							description: "Copy the complete attachmentId from the image block or read_image result: sha256:<64 lowercase hex>. Never pass a workspace path, absolute path, or filename. A bare 64-character hex digest is accepted and normalized to sha256:<64 lowercase hex>."
+						},
+						mediaType: {
+							type: "string",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						bytes: {
+							type: "integer",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						width: {
+							type: "integer",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						height: {
+							type: "integer",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						name: { type: "string" },
+						originalDimensions: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								width: {
+									type: "integer",
+									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+								},
+								height: {
+									type: "integer",
+									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
+		output: {
+			schema: imageOutputSchema(),
+			render: (_args, value) => imageContent(value),
+			presentationMeta: (_args, value) => ({
+				kind: "codex-subscription-image",
+				schemaVersion: 1,
+				original: value.original,
+				...value.requestedModel === void 0 ? {} : { requestedModel: value.requestedModel },
+				...value.reportedModel === void 0 ? {} : { reportedModel: value.reportedModel },
+				...value.requestedSize === void 0 ? {} : { requestedSize: value.requestedSize }
+			})
+		},
+		timeoutMs: 300 * 1e3,
+		isConcurrencySafe: () => false,
+		async execute(args, exec) {
+			assertImageOperation(options.getFeatures?.(), args.referenceImages !== void 0);
+			const defaults = readImageDefaults(options.getFeatures?.());
+			args = {
+				...args,
+				model: args.model ?? defaults.imageModel,
+				quality: args.quality ?? defaults.imageQuality
+			};
+			const prompt = nonEmpty$2(args.prompt);
+			if (prompt === void 0) throw new Error("prompt must be a non-empty string");
+			const imageOptions = normalizeImageOptions(args);
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, exec.signal);
+			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
+			if (!attachments.imageLimits.mediaTypes.includes("image/png")) throw new Error("This DSH installation does not accept PNG image attachments");
+			const maximumBytes = Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
+			const editing = args.referenceImages !== void 0;
+			const sessionMessages = editing && typeof options.getSessionMessages === "function" ? await options.getSessionMessages(exec.agent?.id) : void 0;
+			const images = editing ? await editImages(args.referenceImages, attachments, exec.signal, sessionMessages ?? (options.getSessionMessages ? [] : void 0)) : void 0;
+			let response;
+			assertImageOperation(options.getFeatures?.(), editing);
+			try {
+				response = await fetchImage(editing ? CODEX_IMAGE_EDIT_URL : CODEX_IMAGE_GENERATION_URL, {
+					method: "POST",
+					redirect: "error",
+					headers: {
+						authorization: `Bearer ${access}`,
+						"chatgpt-account-id": accountId,
+						accept: "application/json",
+						"content-type": "application/json",
+						originator: "pi",
+						"x-codex-image-turn-id": String(exec.callId),
+						"user-agent": USER_AGENT
+					},
+					body: JSON.stringify({
+						...images === void 0 ? {} : { images },
+						prompt,
+						background: imageOptions.background,
+						model: resolveImageModel(args.model),
+						quality: imageOptions.quality,
+						size: imageOptions.size
+					}),
+					signal: exec.signal
+				});
+			} catch (error) {
+				if (exec.signal.aborted) throw exec.signal.reason;
+				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
+			}
+			if (!response.ok) {
+				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
+				if (response.status === 429) throw new Error("Codex image generation quota is unavailable");
+				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})`);
+			}
+			const metadata = responseMetadata(await readJsonWithin(response, encodedLimit(maximumBytes) + RESPONSE_ENVELOPE_BYTES));
+			const data = decodeCodexPng(metadata.encoded, maximumBytes);
+			const sessionId = exec.agent?.id;
+			if (sessionId === void 0) throw new Error("Codex image generation requires a session-owned tool call");
+			const original = await options.originalImages.save(String(sessionId), data);
+			let ref;
+			try {
+				ref = await attachments.saveImage({
+					data,
+					mediaType: "image/png",
+					name: "codex-generated.png"
+				});
+			} catch (error) {
+				await options.originalImages.remove(original);
+				throw error;
+			}
+			const result = {
+				requestedModel: resolveImageModel(args.model),
+				requestedSize: imageOptions.size,
+				...metadata.reportedModel === void 0 ? {} : { reportedModel: metadata.reportedModel },
+				image: imageReference(ref),
+				original,
+				localPath: options.originalImages.originalPath(original.assetId),
+				...metadata.background === void 0 ? {} : { background: metadata.background },
+				...metadata.quality === void 0 ? {} : { quality: metadata.quality },
+				size: `${original.width}x${original.height}`
+			};
+			if (exec.parent !== void 0) exec.deferContext(createUserMessage({
+				content: imageContent(result),
+				source: { kind: "codex-subscription-image" }
+			}));
+			return result;
+		}
+	});
+}
+//#endregion
+//#region src/sketch-agent-tool.js
+const MAX_REFERENCE_BYTES = 14e5;
+function createSketchAgentTool(bridge, attachments, getSessionMessages = () => []) {
+	return defineTool({
+		name: "codex_sketch",
+		description: "Edit the sketch board in this session using native editable strokes and layers. Use for @sketch requests and explicit follow-up edits to that drawing. The toolbar pen button is for manual drawing; do not require the user to open it. Start with inspect for the runId, documentId, revision and command reference. Draw with the svg op whenever possible: one SVG document per stage (paths, shapes, groups, transforms; see the reference from inspect) is far faster and richer than hand-placed strokes, and still becomes native editable strokes. Draw the shapes, hair, clothing and lettering outlines of every layer with svg; use stroke commands only for small corrections and native text. Apply atomic batches and preview between stages. When the user attached a reference image, call reference with its attachmentId once after inspect to put it on the board as a hidden picture layer. When a reference picture is on the board, keep its layer hidden while drawing (compare shows it anyway), measure its key positions with preview grid, draw big shapes first, and after each stage check preview compare and fix the largest offset before adding detail. For repeated details such as hair strands or lace, generate the SVG with a script instead of placing each one by hand. and call finish to save the finished draft and release the editing lock. save is only a checkpoint. Closing the board does not stop drawing. If the user stops drawing, do not retry. Never generates AI images, sends messages or attaches images automatically. Inspect automatically opens the board in the currently viewed session. Do not ask the user to open it first. If the session is not visible in DSH, ask them to switch to it. On timeout inspect before retrying; reuse the exact requestId only for the same request.",
+		parameters: {
+			action: {
+				type: "string",
+				required: true,
+				enum: [
+					"inspect",
+					"apply",
+					"reference",
+					"preview",
+					"save",
+					"finish"
+				]
+			},
+			runId: {
+				type: "string",
+				description: "From inspect; required for all other actions. Never reuse a stopped run."
+			},
+			documentId: {
+				type: "string",
+				description: "From inspect; required except for inspect."
+			},
+			revision: {
+				type: "integer",
+				description: "From latest response; required for apply/reference/save/finish."
+			},
+			requestId: {
+				type: "string",
+				description: "Unique id for apply/reference/save/finish; exact retries are deduplicated. After timeout inspect recentRequests before repeating a write."
+			},
+			commands: {
+				oneOf: [sketchCommandArray, { type: "string" }],
+				description: "Prefer a native command array. Legacy JSON string also accepted. Required for apply. Use named objects and update existing IDs; prefer Bezier start + segments (control1/control2/end) for curves, not hundreds of pen points."
+			},
+			name: {
+				type: "string",
+				description: "Draft name for save/finish."
+			},
+			attachmentId: {
+				type: "string",
+				description: "reference only: the attachmentId of an image the user attached to this session (copy it from the image block, never a path or filename). It is added to the board as a hidden picture layer, ready for preview compare."
+			},
+			compare: {
+				type: "boolean",
+				description: "preview only: blend the drawing 50/50 with the reference picture layer on the board, so offsets show as ghosting. Needs a picture layer; if there is none, ask the user to add the reference with the pictures button."
+			},
+			grid: {
+				type: "boolean",
+				description: "preview only: overlay a labelled grid every 100 canvas pixels, to read positions and sizes instead of guessing them."
+			},
+			offset: {
+				type: "integer",
+				description: "inspect only: object list offset, default 0. Follow nextOffset for further pages."
+			},
+			objectId: {
+				type: "string",
+				description: "inspect only: return full editable geometry for this object, in layer (defaults to active layer)."
+			},
+			layer: {
+				type: "integer",
+				description: "inspect only: layer containing objectId."
+			}
+		},
+		timeoutMs: 25e3,
+		isConcurrencySafe: () => false,
+		async execute(args, exec) {
+			const sessionId = exec.agent?.id;
+			if (typeof sessionId !== "string") throw Error("A session-owned sketch call is required");
+			const request = { ...args };
+			delete request.attachmentId;
+			if (args.action === "apply") try {
+				request.commands = typeof args.commands === "string" ? JSON.parse(args.commands) : args.commands;
+				if (!Array.isArray(request.commands)) throw Error();
+			} catch {
+				throw Error("commands must be a native array or JSON array string");
+			}
+			if (args.action === "reference") {
+				const image = await readSessionImage(args.attachmentId, attachments, exec.signal, await getSessionMessages(sessionId));
+				if (image.data.byteLength > MAX_REFERENCE_BYTES) throw Error("The reference image is too large to send to the board; ask the user to add it with the pictures button on the board");
+				request.image = `data:${image.mediaType};base64,${Buffer.from(image.data).toString("base64")}`;
+				request.name = image.name ?? "reference";
+			}
+			const value = await bridge.request(sessionId, request, exec.signal);
+			if (value.png) {
+				if (!/^data:image\/png;base64,/.test(value.png) || value.png.length > 8 * 1024 * 1024) throw Error("Invalid sketch preview");
+				const image = await attachments.saveImage({
+					data: new Uint8Array(Buffer.from(value.png.split(",")[1], "base64")),
+					mediaType: "image/png",
+					name: "sketch-preview.png"
+				});
+				const { png, ...snapshot } = value;
+				return {
+					...snapshot,
+					image
+				};
+			}
+			return value;
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify({
+					...value,
+					image: void 0
+				})
+			}, ...value.image ? [{
+				type: "image",
+				attachment: value.image
+			}] : []]
+		}
+	});
+}
+//#endregion
+//#region src/sketch-codec-route.js
+function registerSketchCodec(connection) {
+	let source;
+	return connection.fetch.register({
+		path: "/api/codex-subscription/sketch-psd-worker",
+		methods: ["GET"],
+		requestBody: "buffered",
+		async fetch() {
+			source ??= await readFile(new URL("./sketch-psd-worker.js", import.meta.url));
+			return new Response(source, { headers: {
+				"content-type": "text/javascript; charset=utf-8",
+				"cache-control": "no-store"
+			} });
+		}
+	});
+}
+//#endregion
+//#region src/account-vault.js
+const VERSION = 1;
+const DEFAULT_LABEL = "Account 1";
+const clone$1 = (value) => value === void 0 ? void 0 : structuredClone(value);
+const EMAIL_MAX_LENGTH = 254;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+/** Keep only a bounded, display-safe email address from a trusted OAuth result. */
+function normalizeAccountEmail(value) {
+	if (typeof value !== "string") return void 0;
+	const email = value.trim();
+	return email.length > 0 && email.length <= EMAIL_MAX_LENGTH && EMAIL_PATTERN.test(email) ? email : void 0;
+}
+function decodeJwtPayload(access) {
+	if (typeof access !== "string") return void 0;
+	const encoded = access.split(".")[1];
+	if (typeof encoded !== "string" || encoded.length === 0) return void 0;
+	try {
+		return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+	} catch {
+		return;
+	}
+}
+function emailFromAccessToken(access) {
+	const payload = decodeJwtPayload(access);
+	return normalizeAccountEmail(payload?.["https://api.openai.com/profile"]?.email ?? payload?.email);
+}
+/** Normalize the one non-secret account attribute that may cross the UI boundary. */
+function sanitizeOAuthCredential(value) {
+	const credential = assertOAuthCredential$1(value);
+	const email = emailFromAccessToken(credential.access) ?? normalizeAccountEmail(credential.email);
+	if (email === void 0) {
+		delete credential.email;
+		return credential;
+	}
+	return {
+		...credential,
+		email
+	};
+}
+function assertOAuthCredential$1(value) {
+	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex account vault received a malformed OAuth credential");
+	return clone$1(value);
+}
+function parseOAuthCredential$1(value) {
+	try {
+		return assertOAuthCredential$1(JSON.parse(value));
+	} catch (error) {
+		if (error?.message === "Codex account vault received a malformed OAuth credential") throw error;
+		throw new Error("Codex account vault contains malformed OAuth JSON", { cause: error });
+	}
+}
+function normalizeLabel(value) {
+	if (typeof value !== "string") throw new Error("Codex account label must be text");
+	const label = value.trim().replace(/\s+/gu, " ");
+	if (label.length === 0 || label.length > 48) throw new Error("Codex account label must contain 1 to 48 characters");
+	return label;
+}
+function assertVaultRecord(record) {
+	if (record?.kind !== "grant" || record.payload?.version !== VERSION || typeof record.payload.activeId !== "string" || !Array.isArray(record.payload.accounts) || record.payload.accounts.length === 0) throw new Error("Codex account vault contains a malformed grant record");
+	const ids = /* @__PURE__ */ new Set();
+	const accounts = record.payload.accounts.map((account) => {
+		if (account === null || typeof account !== "object" || typeof account.id !== "string" || account.id.length === 0 || ids.has(account.id)) throw new Error("Codex account vault contains a malformed account id");
+		ids.add(account.id);
+		return {
+			id: account.id,
+			label: normalizeLabel(account.label),
+			credential: sanitizeOAuthCredential(account.credential)
+		};
+	});
+	if (!ids.has(record.payload.activeId)) throw new Error("Codex account vault active account is missing");
+	const legacyAccountId = record.payload.legacyAccountId;
+	if (legacyAccountId !== void 0 && !ids.has(legacyAccountId)) throw new Error("Codex account vault legacy account is missing");
+	return {
+		version: VERSION,
+		activeId: record.payload.activeId,
+		legacyAccountId,
+		accounts
+	};
+}
+const grant = (payload) => ({
+	kind: "grant",
+	payload
+});
+var PendingOAuthCredentialStore = class {
+	#credential;
+	async read(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		return clone$1(this.#credential);
+	}
+	async list() {
+		return this.#credential === void 0 ? [] : [{
+			providerId: "openai-codex",
+			type: "oauth"
+		}];
+	}
+	async modify(providerId, update) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		const next = await update(clone$1(this.#credential));
+		if (next !== void 0) this.#credential = sanitizeOAuthCredential(next);
+		return clone$1(this.#credential);
+	}
+	async delete(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		this.#credential = void 0;
+	}
+	credential() {
+		return clone$1(this.#credential);
+	}
+};
+/**
+* Multi-account owner state stored in DSH's atomic plugin credential record.
+* The old single-account reference remains as a rollback source and is kept in
+* sync whenever that imported account rotates its refresh token.
+*/
+var DshOAuthAccountVault = class {
+	#tail = Promise.resolve();
+	constructor(credentials, options) {
+		if (credentials === void 0 || credentials === null || typeof credentials.readRecord !== "function" || typeof credentials.modifyRecord !== "function") throw new Error("Codex multi-account requires DSH credential records");
+		this.credentials = credentials;
+		this.key = options.key;
+		this.legacyRef = options.legacyRef;
+		this.legacyRefs = Object.freeze([...options.legacyRefs ?? []]);
+		this.createId = options.createId ?? randomUUID;
+		this.onLegacySyncFailure = options.onLegacySyncFailure ?? (() => {});
+	}
+	#enqueue(operation) {
+		const current = this.#tail.catch(() => void 0).then(operation);
+		this.#tail = current.catch(() => void 0);
+		return current;
+	}
+	async #legacyCredential() {
+		for (const ref of [this.legacyRef, ...this.legacyRefs]) {
+			const hit = await this.credentials.resolve(ref);
+			if (hit?.value === void 0 || hit.value === "") continue;
+			return {
+				ref,
+				credential: parseOAuthCredential$1(hit.value)
+			};
+		}
+	}
+	async #ensurePayload() {
+		const existing = await this.credentials.readRecord(this.key);
+		if (existing !== void 0) return assertVaultRecord(existing);
+		const legacy = await this.#legacyCredential();
+		if (legacy === void 0) return void 0;
+		const id = this.createId();
+		return assertVaultRecord(await this.credentials.modifyRecord(this.key, (current) => {
+			if (current !== void 0) return Promise.resolve(current);
+			return Promise.resolve(grant({
+				version: VERSION,
+				activeId: id,
+				legacyAccountId: id,
+				accounts: [{
+					id,
+					label: DEFAULT_LABEL,
+					credential: legacy.credential
+				}]
+			}));
+		}));
+	}
+	async #modifyPayload(update) {
+		await this.#ensurePayload();
+		let previousLegacy;
+		const payload = assertVaultRecord(await this.credentials.modifyRecord(this.key, async (current) => {
+			if (current === void 0) throw new Error("Codex account vault is not signed in");
+			const payload = assertVaultRecord(current);
+			previousLegacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+			const next = await update(clone$1(payload));
+			return grant(next);
+		}));
+		const legacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+		try {
+			if (legacy === void 0) {
+				if (previousLegacy !== void 0) await this.credentials.unset(this.legacyRef);
+			} else if (JSON.stringify(legacy) !== JSON.stringify(previousLegacy)) await this.credentials.set(this.legacyRef, JSON.stringify(legacy));
+		} catch {
+			this.onLegacySyncFailure();
+		}
+		return payload;
+	}
+	list() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			if (payload === void 0) return [];
+			return payload.accounts.map((account) => ({
+				id: account.id,
+				label: account.label,
+				active: account.id === payload.activeId,
+				expiresAt: account.credential.expires,
+				...account.credential.email === void 0 ? {} : { email: account.credential.email }
+			}));
+		});
+	}
+	readActive() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
+		});
 	}
 	activeId() {
 		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
@@ -2843,1208 +3433,652 @@ var CodexLoginCoordinator = class {
 						...typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}
 					};
 					return;
-				}
-			} catch {}
-			session.view = {
-				id,
-				provider: "openai-codex",
-				method,
-				phase: "failed",
-				authenticated: false,
-				error: "Codex login failed"
-			};
-			session.hostError = error;
-		}).finally(publishReady);
-		return ready.promise;
-	}
-	read(id) {
-		const session = this.#sessions.get(id);
-		if (session === void 0) throw new Error("unknown Codex login");
-		return publicClone(session.view);
-	}
-	async submit({ id, value }) {
-		const session = this.#sessions.get(id);
-		if (session === void 0) throw new Error("unknown Codex login");
-		if (session.prompt === void 0 || session.view.phase !== "waiting_input") throw new Error("Codex login is not waiting for input");
-		if (typeof value !== "string" || value.trim() === "") throw new Error("Codex login input is empty");
-		const answer = session.prompt;
-		session.prompt = void 0;
-		session.view = {
-			...session.view,
-			phase: session.view.authUrl === void 0 ? "starting" : "waiting_browser",
-			prompt: void 0
-		};
-		answer.resolve(value);
-		return this.read(id);
-	}
-	async cancel(id) {
-		const session = this.#sessions.get(id);
-		if (session === void 0) throw new Error("unknown Codex login");
-		if (!TERMINAL_PHASES.has(session.view.phase)) {
-			session.view = {
-				id,
-				provider: "openai-codex",
-				method: session.view.method,
-				phase: "cancelled",
-				authenticated: false
-			};
-			session.controller.abort(/* @__PURE__ */ new Error("Codex login cancelled"));
-		}
-		return this.read(id);
-	}
-	async logout(options) {
-		if (this.#activeId !== void 0) {
-			const active = this.#sessions.get(this.#activeId);
-			if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) await this.cancel(active.view.id);
-		}
-		await this.auth.logout(options);
-		return this.accountStatus(options);
-	}
-	async selectAccount(id) {
-		return publicClone(await this.auth.select(id));
-	}
-	async removeAccount(id) {
-		return publicClone(await this.auth.remove(id));
-	}
-};
-/** Map the loopback-only DSH Connection channel onto the coordinator. */
-function createCodexRpcHandler(coordinator, options = {}) {
-	const openExternal = options.openExternal;
-	return async (endpoint, payload, signal) => {
-		try {
-			signal.throwIfAborted();
-			const input = asObject(payload);
-			if (endpoint === "status") try {
-				return ok(await coordinator.accountStatus({ signal }));
-			} catch (error) {
-				if (signal.aborted) throw error;
-				const [, message] = classifyAccountStatusError(error);
-				return accountStatusError(message);
-			}
-			if (endpoint === "login/start") {
-				const started = await coordinator.start({
-					method: input.method,
-					label: input.label
-				});
-				if (input.openExternal !== true) return ok(started);
-				const url = started.authUrl ?? started.deviceCode?.verificationUri;
-				if (typeof url !== "string" || openExternal === void 0) return ok({
-					...started,
-					externalOpened: false
-				});
-				try {
-					await openExternal(url);
-					return ok({
-						...started,
-						externalOpened: true
-					});
-				} catch {
-					return ok({
-						...started,
-						externalOpened: false
-					});
-				}
-			}
-			if (endpoint === "login/status") return ok(coordinator.read(input.id));
-			if (endpoint === "login/submit") return ok(await coordinator.submit({
-				id: input.id,
-				value: input.value
-			}));
-			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
-			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
-			if (endpoint === "account/select") return ok(await coordinator.selectAccount(input.id));
-			if (endpoint === "account/remove") return ok(await coordinator.removeAccount(input.id));
-			return badRequest(`unknown Codex auth endpoint: ${endpoint}`);
-		} catch (error) {
-			if (signal.aborted) throw error;
-			const message = error instanceof Error && /^(unknown|unsupported|a Codex|Codex login)/.test(error.message) ? error.message : "Codex request failed";
-			return badRequest(message);
-		}
-	};
-}
-//#endregion
-//#region src/transport-failure.js
-function normalizeTransportEvent(event, signal) {
-	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
-	const message = event.error?.errorMessage;
-	if (typeof message !== "string" || !/^WebSocket closed (?:1006|1011|1012|1013)(?:\s|$)/.test(message)) return event;
-	return {
-		...event,
-		error: {
-			...event.error,
-			errorMessage: `Network transport failure: ${message}`
-		}
-	};
-}
-//#endregion
-//#region src/pi-ai-runtime.js
-const FAST_SERVICE_TIER = "priority";
-const ULTRAFAST_SERVICE_TIER = "ultrafast";
-/** Apply the chosen detail to user and tool-result images after the provider assembles the request. */
-function withInputImageDetail(payload, detail) {
-	if (!Array.isArray(payload.input)) return payload;
-	let changed = false;
-	const input = payload.input.map((item) => {
-		const field = Array.isArray(item?.content) ? "content" : ["function_call_output", "custom_tool_call_output"].includes(item?.type) && Array.isArray(item.output) ? "output" : void 0;
-		if (field === void 0) return item;
-		let itemChanged = false;
-		const parts = item[field].map((part) => {
-			if (part?.type !== "input_image" || part.detail === detail) return part;
-			itemChanged = true;
-			return {
-				...part,
-				detail
-			};
-		});
-		if (!itemChanged) return item;
-		changed = true;
-		return {
-			...item,
-			[field]: parts
-		};
-	});
-	return changed ? {
-		...payload,
-		input
-	} : payload;
-}
-/**
-* Preserve pi-ai's native Codex OAuth provider while allowing DSH's generic
-* PiAiAdapter to pass the access token resolved by the host credential store.
-*
-* PiAiAdapter owns a request-local Models collection backed by the same DSH
-* credential store as this provider. A pure OAuth provider ignores its
-* `apiKey` request override and otherwise fails before dispatch with "Provider
-* is not configured". This non-interactive bridge teaches that collection how
-* to consume only the already-refreshed token for this request; login, refresh,
-* persistence, headers, transport, and model behavior remain owned by the
-* original provider.
-*/
-function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, resolveOutputVerbosity = () => OUTPUT_VERBOSITY_DEFAULT, resolveInputImageDetail = () => void 0, resolveContextMode = () => void 0, resolveCustomContextWindow = () => void 0, catalog, connection, compaction, runNetwork = (_area, operation) => operation() } = {}) {
-	const provider = createOpenAICodexProvider();
-	const requestToken = Object.freeze({
-		name: "DSH-managed Codex OAuth request token",
-		async resolve({ credential }) {
-			const token = credential?.type === "api_key" ? credential.key : void 0;
-			if (typeof token !== "string" || token.length === 0) return void 0;
-			return {
-				auth: { apiKey: token },
-				source: "DSH-managed OAuth request"
-			};
-		}
-	});
-	const modelMetadata = (model) => catalog?.metadata(model?.id);
-	const supportsVerbosity = (model) => modelMetadata(model)?.supportVerbosity ?? model?.id !== "gpt-5.3-codex-spark";
-	const withPreferences = (model, options = {}) => {
-		const metadata = modelMetadata(model);
-		const requestedVerbosity = resolveOutputVerbosity();
-		const textVerbosity = supportsVerbosity(model) ? requestedVerbosity === "default" ? metadata?.defaultVerbosity ?? "medium" : requestedVerbosity : void 0;
-		const speedMode = resolveSpeedMode();
-		const serviceTier = speedMode === "ultrafast" && metadata?.supportsUltrafast === true ? ULTRAFAST_SERVICE_TIER : speedMode === "fast" && (metadata?.supportsFast ?? supportsCodexFastMode(model?.id)) ? FAST_SERVICE_TIER : void 0;
-		const inputImageDetail = normalizeInputImageDetail(resolveInputImageDetail());
-		const onPayload = options.onPayload;
-		return {
-			...options,
-			...textVerbosity === void 0 ? {} : { textVerbosity },
-			...serviceTier === void 0 ? {} : { serviceTier },
-			async onPayload(payload, requestModel) {
-				const preferred = {
-					...payload,
-					...textVerbosity === void 0 ? {} : { text: {
-						...payload.text ?? {},
-						verbosity: textVerbosity
-					} },
-					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
-				};
-				const managed = compaction?.preparePayload(preferred, model?.contextWindow) ?? preferred;
-				const next = await onPayload?.(managed, requestModel);
-				const detailed = inputImageDetail === "auto" ? next ?? managed : withInputImageDetail(next ?? managed, inputImageDetail);
-				return {
-					...detailed,
-					...textVerbosity === void 0 ? {} : { text: {
-						...detailed.text ?? {},
-						verbosity: textVerbosity
-					} },
-					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
-				};
-			}
-		};
-	};
-	const getModels = () => (catalog?.getModels() ?? provider.getModels()).map((model) => {
-		const maximum = modelContextMaximum(model);
-		const mode = resolveContextMode();
-		if (model.id === "gpt-5.3-codex-spark" || !["extended", "custom"].includes(mode)) return model;
-		if (mode === "extended") {
-			const contextWindow = maximum;
-			return {
-				...model,
-				contextWindow
+				}
+			} catch {}
+			session.view = {
+				id,
+				provider: "openai-codex",
+				method,
+				phase: "failed",
+				authenticated: false,
+				error: "Codex login failed"
 			};
-		}
-		const requested = clampModelContext(resolveCustomContextWindow(customContextModelKey(model.id)), maximum, model.contextWindow);
-		return {
-			...model,
-			contextWindow: requested
+			session.hostError = error;
+		}).finally(publishReady);
+		return ready.promise;
+	}
+	read(id) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Codex login");
+		return publicClone(session.view);
+	}
+	async submit({ id, value }) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Codex login");
+		if (session.prompt === void 0 || session.view.phase !== "waiting_input") throw new Error("Codex login is not waiting for input");
+		if (typeof value !== "string" || value.trim() === "") throw new Error("Codex login input is empty");
+		const answer = session.prompt;
+		session.prompt = void 0;
+		session.view = {
+			...session.view,
+			phase: session.view.authUrl === void 0 ? "starting" : "waiting_browser",
+			prompt: void 0
 		};
-	});
-	const networkIterable = (factory, options) => {
-		let iterator;
-		let prepared;
-		const step = async (method, value) => {
-			const request = await (prepared ??= connection?.prepare(options) ?? Promise.resolve({ options }));
-			const result = await runNetwork("model", () => {
-				iterator ??= factory(compaction?.requestOptions(request.options) ?? request.options)[Symbol.asyncIterator]();
-				return iterator[method]?.(value) ?? (method === "throw" ? Promise.reject(value) : Promise.resolve({
-					done: true,
-					value
-				}));
-			}, compaction?.networkOptions(request.network) ?? request.network);
-			return result.done ? result : {
-				...result,
-				value: normalizeTransportEvent(result.value, request.options?.signal)
+		answer.resolve(value);
+		return this.read(id);
+	}
+	async cancel(id) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Codex login");
+		if (!TERMINAL_PHASES.has(session.view.phase)) {
+			session.view = {
+				id,
+				provider: "openai-codex",
+				method: session.view.method,
+				phase: "cancelled",
+				authenticated: false
 			};
-		};
-		return {
-			[Symbol.asyncIterator]() {
-				return this;
-			},
-			next: (value) => step("next", value),
-			return: (value) => iterator ? step("return", value) : Promise.resolve({
-				done: true,
-				value
-			}),
-			throw: (error) => iterator ? step("throw", error) : Promise.reject(error)
-		};
-	};
-	return Object.freeze({
-		...provider,
-		auth: Object.freeze({
-			...provider.auth,
-			apiKey: requestToken
-		}),
-		getModels,
-		stream: (model, context, options) => networkIterable((prepared) => provider.stream(model, context, prepared), withPreferences(model, options)),
-		streamSimple: (model, context, options) => networkIterable((prepared) => provider.streamSimple(model, context, prepared), withPreferences(model, options))
-	});
-}
-Object.freeze([
-	"0.82.1",
-	"0.85.1",
-	"0.87.1"
-]);
-//#endregion
-//#region src/subscription-credentials.js
-async function readSubscriptionCredentials(getAuth, readCredential, signal) {
-	for (let attempt = 0; attempt < 2; attempt++) {
-		const auth = await getAuth({ signal });
-		signal?.throwIfAborted();
-		if (typeof auth?.auth?.apiKey !== "string" || !auth.auth.apiKey) break;
-		const credential = await readCredential({ signal });
-		signal?.throwIfAborted();
-		if (credential?.type !== "oauth") break;
-		if (credential.access === auth.auth.apiKey) return {
-			access: credential.access,
-			accountId: credential.accountId
-		};
+			session.controller.abort(/* @__PURE__ */ new Error("Codex login cancelled"));
+		}
+		return this.read(id);
 	}
-	return {
-		access: void 0,
-		accountId: void 0
-	};
-}
-//#endregion
-//#region src/version.js
-const PACKAGE_VERSION = "2.4.2";
-const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
-//#endregion
-//#region src/model-catalog.js
-const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${encodeURIComponent(PACKAGE_VERSION)}`;
-const LEVELS = [
-	"off",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const DEFAULT_REFRESH_TIMEOUT_MS = 1e4;
-const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const nonEmpty$2 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-const positiveInteger$1 = (value) => Number.isSafeInteger(value) && value > 0 ? value : void 0;
-function upgradeModelId(value) {
-	return (typeof value.upgrade === "string" ? nonEmpty$2(value.upgrade) : record$4(value.upgrade) ? nonEmpty$2(value.upgrade.model) : void 0) ?? (record$4(value.upgrade_info) ? nonEmpty$2(value.upgrade_info.model) : void 0) ?? (record$4(value.upgradeInfo) ? nonEmpty$2(value.upgradeInfo.model) : void 0);
-}
-function retirementMillis(value) {
-	for (const source of [
-		value,
-		value.upgrade,
-		value.upgrade_info,
-		value.upgradeInfo
-	]) {
-		if (!record$4(source)) continue;
-		for (const raw of [source.retirement_at, source.retirementAt]) {
-			const seconds = positiveInteger$1(raw);
-			if (seconds !== void 0 && Number.isSafeInteger(seconds * 1e3)) return seconds * 1e3;
-			if (typeof raw === "string" && /^\d{4}-\d{2}-\d{2}T[\d:.]+(?:Z|[+-]\d{2}:\d{2})$/u.test(raw)) {
-				const parsed = Date.parse(raw);
-				if (Number.isFinite(parsed) && parsed > 0) return parsed;
-			}
+	async logout(options) {
+		if (this.#activeId !== void 0) {
+			const active = this.#sessions.get(this.#activeId);
+			if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) await this.cancel(active.view.id);
 		}
+		await this.auth.logout(options);
+		return this.accountStatus(options);
 	}
-}
-function retirementNotice(value, now = Date.now(), targetDisplayName) {
-	if (!record$4(value) || !Number.isFinite(now)) return void 0;
-	const at = retirementMillis(value);
-	if (at === void 0 || at <= now) return void 0;
-	const date = new Date(at);
-	if (!Number.isFinite(date.getTime())) return void 0;
-	const dateText = `${String(date.getUTCFullYear()).padStart(4, "0")}-${String(date.getUTCMonth() + 1).padStart(2, "0")}-${String(date.getUTCDate()).padStart(2, "0")}`;
-	const upgradeTo = upgradeModelId(value);
-	const upgradeName = upgradeTo === void 0 ? void 0 : nonEmpty$2(targetDisplayName) ?? upgradeTo;
-	return {
-		text: `Retires on ${dateText} (UTC).${upgradeName === void 0 ? "" : ` Switch to ${upgradeName} to keep working.`}`,
-		at,
-		upgradeTo,
-		dateText
-	};
-}
-function reasoningMap(levels) {
-	const supported = new Set((Array.isArray(levels) ? levels : []).map((level) => nonEmpty$2(record$4(level) ? level.effort : void 0)).filter(Boolean));
-	const map = Object.fromEntries(LEVELS.map((level) => [level, null]));
-	if (supported.has("none")) map.off = "none";
-	for (const level of LEVELS.slice(1)) if (supported.has(level)) map[level] = level;
-	return map;
-}
-const capabilityNames = (values) => [...new Set(values.filter((value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,31}$/u.test(value)))].sort().slice(0, 16);
-const speedTierIds = (value) => [...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []];
-function unsupportedCapabilities(value) {
-	const reasoning = capabilityNames((value.supported_reasoning_levels ?? []).map((item) => item?.effort)).filter((level) => !["none", ...LEVELS.slice(1)].includes(level));
-	const inputs = capabilityNames(Array.isArray(value.input_modalities) ? value.input_modalities : []).filter((input) => !["text", "image"].includes(input));
-	const speeds = capabilityNames([...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []]).filter((tier) => ![
-		"auto",
-		"default",
-		"standard",
-		"fast",
-		"priority",
-		"ultrafast"
-	].includes(tier));
-	return {
-		...reasoning.length ? { reasoning } : {},
-		...inputs.length ? { inputs } : {},
-		...speeds.length ? { speeds } : {}
-	};
-}
-function visibleModel(value, displayNames, now) {
-	if (!record$4(value)) return void 0;
-	const id = nonEmpty$2(value.slug);
-	const reserve = id === "gpt-reserve" && ["list", "hide"].includes(value.visibility);
-	if (id === void 0 || value.visibility !== "list" && !reserve) return void 0;
-	const supported = Array.isArray(value.supported_reasoning_levels) ? value.supported_reasoning_levels : [];
-	const input = Array.isArray(value.input_modalities) ? value.input_modalities.filter((item) => ["text", "image"].includes(item)) : ["text", "image"];
-	const unsupported = unsupportedCapabilities({
-		...value,
-		supported_reasoning_levels: supported
-	});
-	const upgradeTo = upgradeModelId(value);
-	const retirement = retirementNotice(value, now, displayNames.get(upgradeTo));
-	const notice = retirement?.text;
-	const description = nonEmpty$2(value.description);
-	return {
-		...Object.keys(unsupported).length ? { unsupported } : {},
-		id,
-		name: `${reserve ? "GPT-Reserve (Experimental)" : nonEmpty$2(value.display_name) ?? id}${retirement === void 0 ? "" : ` (retires ${retirement.dateText})`}`,
-		description: notice === void 0 ? description : description === void 0 ? notice : `${description}\n${notice}`,
-		...retirement === void 0 ? {} : { retirement: {
-			at: retirement.at,
-			upgradeTo: retirement.upgradeTo
-		} },
-		priority: Number.isFinite(value.priority) ? value.priority : 0,
-		input: input.length > 0 ? input : ["text"],
-		contextWindow: positiveInteger$1(value.context_window) ?? positiveInteger$1(value.max_context_window),
-		...positiveInteger$1(value.max_context_window) === void 0 ? {} : { maxContextWindow: value.max_context_window },
-		reasoning: supported.length > 0,
-		thinkingLevelMap: reasoningMap(supported),
-		supportVerbosity: value.support_verbosity === true,
-		defaultVerbosity: [
-			"low",
-			"medium",
-			"high"
-		].includes(value.default_verbosity) ? value.default_verbosity : void 0,
-		supportsFast: speedTierIds(value).some((tier) => tier === "fast" || tier === "priority"),
-		supportsUltrafast: speedTierIds(value).includes("ultrafast")
+	async selectAccount(id) {
+		return publicClone(await this.auth.select(id));
+	}
+	async removeAccount(id) {
+		return publicClone(await this.auth.remove(id));
+	}
+};
+/** Map the loopback-only DSH Connection channel onto the coordinator. */
+function createCodexRpcHandler(coordinator, options = {}) {
+	const openExternal = options.openExternal;
+	return async (endpoint, payload, signal) => {
+		try {
+			signal.throwIfAborted();
+			const input = asObject(payload);
+			if (endpoint === "status") try {
+				return ok(await coordinator.accountStatus({ signal }));
+			} catch (error) {
+				if (signal.aborted) throw error;
+				const [, message] = classifyAccountStatusError(error);
+				return accountStatusError(message);
+			}
+			if (endpoint === "login/start") {
+				const started = await coordinator.start({
+					method: input.method,
+					label: input.label
+				});
+				if (input.openExternal !== true) return ok(started);
+				const url = started.authUrl ?? started.deviceCode?.verificationUri;
+				if (typeof url !== "string" || openExternal === void 0) return ok({
+					...started,
+					externalOpened: false
+				});
+				try {
+					await openExternal(url);
+					return ok({
+						...started,
+						externalOpened: true
+					});
+				} catch {
+					return ok({
+						...started,
+						externalOpened: false
+					});
+				}
+			}
+			if (endpoint === "login/status") return ok(coordinator.read(input.id));
+			if (endpoint === "login/submit") return ok(await coordinator.submit({
+				id: input.id,
+				value: input.value
+			}));
+			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
+			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
+			if (endpoint === "account/select") return ok(await coordinator.selectAccount(input.id));
+			if (endpoint === "account/remove") return ok(await coordinator.removeAccount(input.id));
+			return badRequest(`unknown Codex auth endpoint: ${endpoint}`);
+		} catch (error) {
+			if (signal.aborted) throw error;
+			const message = error instanceof Error && /^(unknown|unsupported|a Codex|Codex login)/.test(error.message) ? error.message : "Codex request failed";
+			return badRequest(message);
+		}
 	};
 }
-function parseOfficialModelCatalog(value, now = Date.now()) {
-	if (!record$4(value) || !Array.isArray(value.models)) throw new Error("Codex returned a malformed model catalog");
-	const displayNames = /* @__PURE__ */ new Map();
-	for (const model of value.models) {
-		if (!record$4(model)) continue;
-		const id = nonEmpty$2(model.slug);
-		const name = nonEmpty$2(model.display_name);
-		if (id !== void 0 && name !== void 0 && !displayNames.has(id)) displayNames.set(id, name);
-	}
-	const seen = /* @__PURE__ */ new Set();
-	return value.models.map((model) => visibleModel(model, displayNames, now)).filter((model) => model !== void 0 && !seen.has(model.id) && seen.add(model.id)).sort((left, right) => Number(left.id === "gpt-reserve") - Number(right.id === "gpt-reserve") || right.priority - left.priority);
-}
-function mergeModel(baseModels, remote) {
-	const base = baseModels.find((model) => model.id === remote.id) ?? baseModels.find((model) => model.id !== "gpt-5.3-codex-spark") ?? baseModels[0];
-	if (base === void 0) return void 0;
+//#endregion
+//#region src/transport-failure.js
+function normalizeTransportEvent(event, signal) {
+	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
+	const message = event.error?.errorMessage;
+	if (typeof message !== "string" || !/^WebSocket closed (?:1006|1011|1012|1013)(?:\s|$)/.test(message)) return event;
 	return {
-		...base,
-		id: remote.id,
-		name: remote.name,
-		...remote.retirement === void 0 || remote.description === void 0 ? {} : { description: remote.description },
-		input: remote.input,
-		reasoning: remote.reasoning,
-		thinkingLevelMap: remote.thinkingLevelMap,
-		...remote.contextWindow === void 0 ? {} : { contextWindow: remote.contextWindow },
-		...remote.maxContextWindow === void 0 ? {} : { maxContextWindow: remote.maxContextWindow },
-		...base.id === remote.id ? {} : { cost: {
-			input: 0,
-			output: 0,
-			cacheRead: 0,
-			cacheWrite: 0
-		} }
+		...event,
+		error: {
+			...event.error,
+			errorMessage: `Network transport failure: ${message}`
+		}
 	};
 }
-function createOfficialModelCatalog(options = {}) {
-	const fetchCatalog = options.fetch ?? fetch;
-	const getNow = options.now ?? Date.now;
-	const scheduleTimeout = options.setTimeout ?? setTimeout;
-	const cancelTimeout = options.clearTimeout ?? clearTimeout;
-	const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : DEFAULT_REFRESH_TIMEOUT_MS;
-	let models;
-	let metadata = /* @__PURE__ */ new Map();
-	let etag;
-	let rawCatalog;
-	let revision = 0;
-	let refreshing;
-	let generation = 0;
-	let refreshStatus = "idle";
-	const refresh = ({ signal } = {}) => {
-		if (signal?.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
-		if (refreshing?.generation === generation) return refreshing.promise;
-		const currentGeneration = generation;
-		refreshStatus = "refreshing";
-		let outcome = "idle";
-		const controller = new AbortController();
-		const abort = () => {
-			if (!controller.signal.aborted) controller.abort(signal?.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
-		};
-		signal?.addEventListener("abort", abort, { once: true });
-		const requestSignal = controller.signal;
-		let timer;
-		const timeoutError = /* @__PURE__ */ new Error("Codex model catalog refresh timed out");
-		const work = (async () => {
-			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, requestSignal);
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) return false;
-			const headers = {
-				authorization: `Bearer ${access}`,
-				"chatgpt-account-id": accountId,
-				accept: "application/json",
-				originator: "pi",
-				"user-agent": USER_AGENT,
-				...etag === void 0 ? {} : { "if-none-match": etag }
+//#endregion
+//#region src/pi-ai-runtime.js
+const FAST_SERVICE_TIER = "priority";
+const ULTRAFAST_SERVICE_TIER = "ultrafast";
+/** Apply the chosen detail to user and tool-result images after the provider assembles the request. */
+function withInputImageDetail(payload, detail) {
+	if (!Array.isArray(payload.input)) return payload;
+	let changed = false;
+	const input = payload.input.map((item) => {
+		const field = Array.isArray(item?.content) ? "content" : ["function_call_output", "custom_tool_call_output"].includes(item?.type) && Array.isArray(item.output) ? "output" : void 0;
+		if (field === void 0) return item;
+		let itemChanged = false;
+		const parts = item[field].map((part) => {
+			if (part?.type !== "input_image" || part.detail === detail) return part;
+			itemChanged = true;
+			return {
+				...part,
+				detail
 			};
-			const response = await fetchCatalog(CODEX_MODELS_URL, {
-				method: "GET",
-				redirect: "error",
-				headers,
-				signal: requestSignal
-			});
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			if (response.status === 304) {
-				outcome = "ok";
-				if (rawCatalog === void 0) return false;
-				const remote = parseOfficialModelCatalog(rawCatalog, getNow());
-				const next = remote.map((model) => mergeModel(options.baseModels(), model)).filter(Boolean);
-				if (next.length === 0 || JSON.stringify(next) === JSON.stringify(models)) return false;
-				models = next;
-				metadata = new Map(remote.map((model) => [model.id, model]));
-				revision += 1;
-				options.onUpdated?.();
-				return true;
-			}
-			if (!response.ok) throw new Error(`Codex model catalog failed (HTTP ${response.status})`);
-			const raw = await response.json();
-			const remote = parseOfficialModelCatalog(raw, getNow());
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			if (remote.length === 0) throw new Error("Codex returned an empty model catalog");
-			const baseModels = options.baseModels();
-			const next = remote.map((model) => mergeModel(baseModels, model)).filter(Boolean);
-			if (next.length === 0) throw new Error("Codex model catalog has no compatible models");
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			models = next;
-			rawCatalog = raw;
-			metadata = new Map(remote.map((model) => [model.id, model]));
-			etag = nonEmpty$2(response.headers.get("etag")) ?? etag;
-			revision += 1;
-			outcome = "ok";
-			options.onUpdated?.();
-			return true;
-		})();
-		let rejectAborted;
-		const abortPromise = new Promise((_, reject) => {
-			rejectAborted = () => reject(requestSignal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
-			if (requestSignal.aborted) rejectAborted();
-			else requestSignal.addEventListener("abort", rejectAborted, { once: true });
 		});
-		timer = scheduleTimeout(() => controller.abort(timeoutError), timeoutMs);
-		timer.unref?.();
-		const promise = Promise.race([work, abortPromise]).catch((error) => {
-			outcome = "failed";
-			throw error;
-		}).finally(() => {
-			cancelTimeout(timer);
-			signal?.removeEventListener("abort", abort);
-			requestSignal.removeEventListener("abort", rejectAborted);
-			if (refreshing?.promise === promise) {
-				refreshing = void 0;
-				refreshStatus = outcome;
+		if (!itemChanged) return item;
+		changed = true;
+		return {
+			...item,
+			[field]: parts
+		};
+	});
+	return changed ? {
+		...payload,
+		input
+	} : payload;
+}
+/**
+* Preserve pi-ai's native Codex OAuth provider while allowing DSH's generic
+* PiAiAdapter to pass the access token resolved by the host credential store.
+*
+* PiAiAdapter owns a request-local Models collection backed by the same DSH
+* credential store as this provider. A pure OAuth provider ignores its
+* `apiKey` request override and otherwise fails before dispatch with "Provider
+* is not configured". This non-interactive bridge teaches that collection how
+* to consume only the already-refreshed token for this request; login, refresh,
+* persistence, headers, transport, and model behavior remain owned by the
+* original provider.
+*/
+function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, resolveOutputVerbosity = () => OUTPUT_VERBOSITY_DEFAULT, resolveInputImageDetail = () => void 0, resolveContextMode = () => void 0, resolveCustomContextWindow = () => void 0, catalog, connection, compaction, runNetwork = (_area, operation) => operation() } = {}) {
+	const provider = createOpenAICodexProvider();
+	const requestToken = Object.freeze({
+		name: "DSH-managed Codex OAuth request token",
+		async resolve({ credential }) {
+			const token = credential?.type === "api_key" ? credential.key : void 0;
+			if (typeof token !== "string" || token.length === 0) return void 0;
+			return {
+				auth: { apiKey: token },
+				source: "DSH-managed OAuth request"
+			};
+		}
+	});
+	const modelMetadata = (model) => catalog?.metadata(model?.id);
+	const supportsVerbosity = (model) => modelMetadata(model)?.supportVerbosity ?? model?.id !== "gpt-5.3-codex-spark";
+	const withPreferences = (model, options = {}) => {
+		const metadata = modelMetadata(model);
+		const requestedVerbosity = resolveOutputVerbosity();
+		const textVerbosity = supportsVerbosity(model) ? requestedVerbosity === "default" ? metadata?.defaultVerbosity ?? "medium" : requestedVerbosity : void 0;
+		const speedMode = resolveSpeedMode();
+		const serviceTier = speedMode === "ultrafast" && metadata?.supportsUltrafast === true ? ULTRAFAST_SERVICE_TIER : speedMode === "fast" && (metadata?.supportsFast ?? supportsCodexFastMode(model?.id)) ? FAST_SERVICE_TIER : void 0;
+		const inputImageDetail = normalizeInputImageDetail(resolveInputImageDetail());
+		const onPayload = options.onPayload;
+		return {
+			...options,
+			...textVerbosity === void 0 ? {} : { textVerbosity },
+			...serviceTier === void 0 ? {} : { serviceTier },
+			async onPayload(payload, requestModel) {
+				const preferred = {
+					...payload,
+					...textVerbosity === void 0 ? {} : { text: {
+						...payload.text ?? {},
+						verbosity: textVerbosity
+					} },
+					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
+				};
+				const managed = compaction?.preparePayload(preferred, model?.contextWindow) ?? preferred;
+				const next = await onPayload?.(managed, requestModel);
+				const detailed = inputImageDetail === "auto" ? next ?? managed : withInputImageDetail(next ?? managed, inputImageDetail);
+				return {
+					...detailed,
+					...textVerbosity === void 0 ? {} : { text: {
+						...detailed.text ?? {},
+						verbosity: textVerbosity
+					} },
+					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
+				};
 			}
-		});
-		refreshing = {
-			generation: currentGeneration,
-			promise,
-			cancel: () => controller.abort()
 		};
-		return promise;
+	};
+	const getModels = () => (catalog?.getModels() ?? provider.getModels()).map((model) => {
+		const maximum = modelContextMaximum(model);
+		const mode = resolveContextMode();
+		if (model.id === "gpt-5.3-codex-spark" || !["extended", "custom"].includes(mode)) return model;
+		if (mode === "extended") {
+			const contextWindow = maximum;
+			return {
+				...model,
+				contextWindow
+			};
+		}
+		const requested = clampModelContext(resolveCustomContextWindow(customContextModelKey(model.id)), maximum, model.contextWindow);
+		return {
+			...model,
+			contextWindow: requested
+		};
+	});
+	const networkIterable = (factory, options) => {
+		let iterator;
+		let prepared;
+		const step = async (method, value) => {
+			const request = await (prepared ??= connection?.prepare(options) ?? Promise.resolve({ options }));
+			const result = await runNetwork("model", () => {
+				iterator ??= factory(compaction?.requestOptions(request.options) ?? request.options)[Symbol.asyncIterator]();
+				return iterator[method]?.(value) ?? (method === "throw" ? Promise.reject(value) : Promise.resolve({
+					done: true,
+					value
+				}));
+			}, compaction?.networkOptions(request.network) ?? request.network);
+			return result.done ? result : {
+				...result,
+				value: normalizeTransportEvent(result.value, request.options?.signal)
+			};
+		};
+		return {
+			[Symbol.asyncIterator]() {
+				return this;
+			},
+			next: (value) => step("next", value),
+			return: (value) => iterator ? step("return", value) : Promise.resolve({
+				done: true,
+				value
+			}),
+			throw: (error) => iterator ? step("throw", error) : Promise.reject(error)
+		};
 	};
 	return Object.freeze({
-		refresh,
-		getModels: () => models ?? [],
-		metadata: (modelId) => metadata.get(modelId),
-		revision: () => revision,
-		capabilityGaps: () => [...metadata.values()].filter((model) => model.unsupported && /^[a-z][a-z0-9._-]{0,79}$/u.test(model.id)).slice(0, 20).map((model) => ({
-			model: model.id,
-			...structuredClone(model.unsupported)
-		})),
-		status: () => ({
-			source: models === void 0 ? "unavailable" : "online",
-			refresh: refreshStatus
+		...provider,
+		auth: Object.freeze({
+			...provider.auth,
+			apiKey: requestToken
 		}),
-		clear() {
-			generation += 1;
-			const flight = refreshing;
-			refreshing = void 0;
-			flight?.cancel();
-			models = void 0;
-			rawCatalog = void 0;
-			metadata = /* @__PURE__ */ new Map();
-			etag = void 0;
-			refreshStatus = "idle";
-			revision += 1;
-			options.onUpdated?.();
-		}
+		getModels,
+		stream: (model, context, options) => networkIterable((prepared) => provider.stream(model, context, prepared), withPreferences(model, options)),
+		streamSimple: (model, context, options) => networkIterable((prepared) => provider.streamSimple(model, context, prepared), withPreferences(model, options))
 	});
 }
+Object.freeze([
+	"0.82.1",
+	"0.85.1",
+	"0.87.1"
+]);
 //#endregion
-//#region src/codex-search.js
-const CODEX_SEARCH_PROVIDER_ID = "codex-subscription";
-const CODEX_AUTO_SEARCH_PROVIDER_ID = "codex-subscription-auto";
-const CODEX_SEARCH_URL = "https://chatgpt.com/backend-api/codex/alpha/search";
-const DEFAULT_MODEL = "gpt-5.6-luna";
-const MAX_OUTPUT_TOKENS = 4096;
-const MAX_SOURCE_DATE = 64;
+//#region src/model-catalog.js
+const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${encodeURIComponent(PACKAGE_VERSION)}`;
+const LEVELS = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const DEFAULT_REFRESH_TIMEOUT_MS = 1e4;
 const record$3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const nonEmpty$1 = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
-const displayText = (value) => {
-	const text = nonEmpty$1(value)?.replace(/\s+/gu, " ").trim();
-	if (text === void 0 || text.length === 0) return void 0;
-	return text;
-};
-const boundedDisplayText = (value, maximum) => {
-	const text = displayText(value);
-	if (text === void 0 || text.length <= maximum) return text;
-	return `${text.slice(0, maximum - 1)}…`;
-};
-function sourceOf(value) {
-	if (!record$3(value)) return void 0;
-	const url = nonEmpty$1(value.url);
-	if (url === void 0) return void 0;
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return;
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
-	const title = displayText(value.title) ?? parsed.hostname;
-	const snippet = displayText(value.snippet);
-	const publishedAt = boundedDisplayText(value.published_at, MAX_SOURCE_DATE) ?? boundedDisplayText(value.publishedAt, MAX_SOURCE_DATE);
-	return {
-		url,
-		title,
-		...snippet === void 0 ? {} : { snippet },
-		...publishedAt === void 0 ? {} : { publishedAt }
-	};
+const nonEmpty$1 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0 ? value : void 0;
+function upgradeModelId(value) {
+	return (typeof value.upgrade === "string" ? nonEmpty$1(value.upgrade) : record$3(value.upgrade) ? nonEmpty$1(value.upgrade.model) : void 0) ?? (record$3(value.upgrade_info) ? nonEmpty$1(value.upgrade_info.model) : void 0) ?? (record$3(value.upgradeInfo) ? nonEmpty$1(value.upgradeInfo.model) : void 0);
 }
-function parseSearchResponse(value) {
-	if (!record$3(value) || !Array.isArray(value.results)) throw new Error("Codex returned a malformed search response");
-	const seen = /* @__PURE__ */ new Set();
-	const sources = [];
-	for (const result of value.results ?? []) {
-		const source = sourceOf(result);
-		if (source === void 0 || seen.has(source.url)) continue;
-		seen.add(source.url);
-		sources.push(source);
+function retirementMillis(value) {
+	for (const source of [
+		value,
+		value.upgrade,
+		value.upgrade_info,
+		value.upgradeInfo
+	]) {
+		if (!record$3(source)) continue;
+		for (const raw of [source.retirement_at, source.retirementAt]) {
+			const seconds = positiveInteger(raw);
+			if (seconds !== void 0 && Number.isSafeInteger(seconds * 1e3)) return seconds * 1e3;
+			if (typeof raw === "string" && /^\d{4}-\d{2}-\d{2}T[\d:.]+(?:Z|[+-]\d{2}:\d{2})$/u.test(raw)) {
+				const parsed = Date.parse(raw);
+				if (Number.isFinite(parsed) && parsed > 0) return parsed;
+			}
+		}
 	}
+}
+function retirementNotice(value, now = Date.now(), targetDisplayName) {
+	if (!record$3(value) || !Number.isFinite(now)) return void 0;
+	const at = retirementMillis(value);
+	if (at === void 0 || at <= now) return void 0;
+	const date = new Date(at);
+	if (!Number.isFinite(date.getTime())) return void 0;
+	const dateText = `${String(date.getUTCFullYear()).padStart(4, "0")}-${String(date.getUTCMonth() + 1).padStart(2, "0")}-${String(date.getUTCDate()).padStart(2, "0")}`;
+	const upgradeTo = upgradeModelId(value);
+	const upgradeName = upgradeTo === void 0 ? void 0 : nonEmpty$1(targetDisplayName) ?? upgradeTo;
 	return {
-		sources,
-		truncated: false
+		text: `Retires on ${dateText} (UTC).${upgradeName === void 0 ? "" : ` Switch to ${upgradeName} to keep working.`}`,
+		at,
+		upgradeTo,
+		dateText
 	};
 }
-/** Create the DSH web provider backed only by the ChatGPT subscription search endpoint. */
-function createCodexSearchProvider(options) {
-	const fetchSearch = options.fetch ?? fetch;
-	return Object.freeze({
-		id: CODEX_SEARCH_PROVIDER_ID,
-		available: () => true,
-		async search(request, signal) {
-			signal?.throwIfAborted();
-			const preferences = readCapabilitySettings(options.resolvePreferences?.());
-			if (preferences.searchMode === "disabled") throw new WebError("Codex search is disabled in subscription settings", "WEB_PROVIDER_UNAVAILABLE");
-			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, signal);
-			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new WebError("ChatGPT subscription is not signed in", "WEB_PROVIDER_CREDENTIAL_MISSING");
-			const model = nonEmpty$1(options.resolveModel?.()) ?? DEFAULT_MODEL;
-			const id = nonEmpty$1(options.resolveSessionId?.()) ?? randomUUID();
-			let response;
-			try {
-				response = await fetchSearch(CODEX_SEARCH_URL, {
-					method: "POST",
-					redirect: "error",
-					headers: {
-						authorization: `Bearer ${access}`,
-						"chatgpt-account-id": accountId,
-						accept: "application/json",
-						"content-type": "application/json",
-						originator: "pi",
-						"user-agent": USER_AGENT
-					},
-					body: JSON.stringify({
-						id,
-						model,
-						input: request.query,
-						commands: {
-							search_query: [{ q: request.query }],
-							response_length: "short"
-						},
-						settings: {
-							allowed_callers: ["direct"],
-							external_web_access: preferences.searchMode === "live"
-						},
-						max_output_tokens: MAX_OUTPUT_TOKENS
-					}),
-					signal
-				});
-			} catch (error) {
-				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
-				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
-			}
-			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
-			let value;
-			try {
-				value = await response.json();
-			} catch (error) {
-				throw new WebError("Codex returned an unreadable search response", "WEB_PROVIDER_ERROR", { cause: error });
-			}
-			try {
-				const result = parseSearchResponse(value);
-				if (preferences.searchDomains.length > 0) result.sources = result.sources.filter((source) => {
-					const hostname = new URL(source.url).hostname.toLowerCase();
-					return preferences.searchDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
-				});
-				return result;
-			} catch (error) {
-				throw new WebError("Codex returned a malformed search response", "WEB_PROVIDER_ERROR", { cause: error });
-			}
-		}
-	});
-}
-/** Route each request by its initiating model without changing the user's explicit overrides. */
-function createCodexAutoSearchProvider(options) {
-	return Object.freeze({
-		id: CODEX_AUTO_SEARCH_PROVIDER_ID,
-		available: () => true,
-		async search(request, signal) {
-			if (options.resolveModelProvider?.() === "openai-codex") return options.codex.search(request, signal);
-			const provider = options.resolveDshProvider?.();
-			if (provider === void 0 || provider.id === "codex-subscription-auto" || provider.id === "codex-subscription" || provider.available() !== true) throw new WebError("DSH default search is unavailable", "WEB_PROVIDER_UNAVAILABLE");
-			return provider.search(request, signal);
-		}
-	});
+function reasoningMap(levels) {
+	const supported = new Set((Array.isArray(levels) ? levels : []).map((level) => nonEmpty$1(record$3(level) ? level.effort : void 0)).filter(Boolean));
+	const map = Object.fromEntries(LEVELS.map((level) => [level, null]));
+	if (supported.has("none")) map.off = "none";
+	for (const level of LEVELS.slice(1)) if (supported.has(level)) map[level] = level;
+	return map;
 }
-const ORIGINAL_IMAGE_CHUNK_BYTES = 4 * 1024 * 1024;
-const ORIGINAL_IMAGE_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
-const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0;
-function decodeOriginalImageRef(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || typeof value.assetId !== "string" || !ORIGINAL_IMAGE_ID_PATTERN.test(value.assetId) || value.mediaType !== "image/png" || !positiveInteger(value.bytes) || value.bytes > 48 * 1024 * 1024 || !positiveInteger(value.width) || !positiveInteger(value.height) || typeof value.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value.name) || typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(value.sha256)) return void 0;
+const capabilityNames = (values) => [...new Set(values.filter((value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,31}$/u.test(value)))].sort().slice(0, 16);
+const speedTierIds = (value) => [...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []];
+function unsupportedCapabilities(value) {
+	const reasoning = capabilityNames((value.supported_reasoning_levels ?? []).map((item) => item?.effort)).filter((level) => !["none", ...LEVELS.slice(1)].includes(level));
+	const inputs = capabilityNames(Array.isArray(value.input_modalities) ? value.input_modalities : []).filter((input) => !["text", "image"].includes(input));
+	const speeds = capabilityNames([...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []]).filter((tier) => ![
+		"auto",
+		"default",
+		"standard",
+		"fast",
+		"priority",
+		"ultrafast"
+	].includes(tier));
 	return {
-		assetId: value.assetId,
-		mediaType: value.mediaType,
-		bytes: value.bytes,
-		width: value.width,
-		height: value.height,
-		name: value.name,
-		sha256: value.sha256
+		...reasoning.length ? { reasoning } : {},
+		...inputs.length ? { inputs } : {},
+		...speeds.length ? { speeds } : {}
 	};
 }
-function decodeImagePresentation(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || value.kind !== "codex-subscription-image" || value.schemaVersion !== 1) return void 0;
-	const original = decodeOriginalImageRef(value.original);
-	return original === void 0 ? void 0 : { original };
-}
-function originalImageRefsEqual(left, right) {
-	const a = decodeOriginalImageRef(left);
-	const b = decodeOriginalImageRef(right);
-	return a !== void 0 && b !== void 0 && a.assetId === b.assetId && a.mediaType === b.mediaType && a.bytes === b.bytes && a.width === b.width && a.height === b.height && a.name === b.name && a.sha256 === b.sha256;
+function visibleModel(value, displayNames, now) {
+	if (!record$3(value)) return void 0;
+	const id = nonEmpty$1(value.slug);
+	const reserve = id === "gpt-reserve" && ["list", "hide"].includes(value.visibility);
+	if (id === void 0 || value.visibility !== "list" && !reserve) return void 0;
+	const supported = Array.isArray(value.supported_reasoning_levels) ? value.supported_reasoning_levels : [];
+	const input = Array.isArray(value.input_modalities) ? value.input_modalities.filter((item) => ["text", "image"].includes(item)) : ["text", "image"];
+	const unsupported = unsupportedCapabilities({
+		...value,
+		supported_reasoning_levels: supported
+	});
+	const upgradeTo = upgradeModelId(value);
+	const retirement = retirementNotice(value, now, displayNames.get(upgradeTo));
+	const notice = retirement?.text;
+	const description = nonEmpty$1(value.description);
+	return {
+		...Object.keys(unsupported).length ? { unsupported } : {},
+		id,
+		name: `${reserve ? "GPT-Reserve (Experimental)" : nonEmpty$1(value.display_name) ?? id}${retirement === void 0 ? "" : ` (retires ${retirement.dateText})`}`,
+		description: notice === void 0 ? description : description === void 0 ? notice : `${description}\n${notice}`,
+		...retirement === void 0 ? {} : { retirement: {
+			at: retirement.at,
+			upgradeTo: retirement.upgradeTo
+		} },
+		priority: Number.isFinite(value.priority) ? value.priority : 0,
+		input: input.length > 0 ? input : ["text"],
+		contextWindow: positiveInteger(value.context_window) ?? positiveInteger(value.max_context_window),
+		...positiveInteger(value.max_context_window) === void 0 ? {} : { maxContextWindow: value.max_context_window },
+		reasoning: supported.length > 0,
+		thinkingLevelMap: reasoningMap(supported),
+		supportVerbosity: value.support_verbosity === true,
+		defaultVerbosity: [
+			"low",
+			"medium",
+			"high"
+		].includes(value.default_verbosity) ? value.default_verbosity : void 0,
+		supportsFast: speedTierIds(value).some((tier) => tier === "fast" || tier === "priority"),
+		supportsUltrafast: speedTierIds(value).includes("ultrafast")
+	};
 }
-/** Resolve only an exact original reference copied into a DSH fork prefix. */
-function inheritedOriginalImageRef(session, assetId) {
-	const parentSession = session?.header?.parentSession;
-	const seedLength = Number.isSafeInteger(session?.inheritedEventCount) ? session.inheritedEventCount : session?.header?.seedLength;
-	if (typeof parentSession !== "string" || parentSession.length === 0 || !Number.isSafeInteger(seedLength) || seedLength < 0 || !ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) return void 0;
-	let events = session?.events;
-	if (!Array.isArray(events) && typeof session?.snapshotEvents === "function") try {
-		events = session.snapshotEvents();
-	} catch {
-		return;
-	}
-	if (!Array.isArray(events)) return void 0;
-	for (const event of events) {
-		if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq >= seedLength || event.type !== "tool/result") continue;
-		const original = decodeImagePresentation(event.data?.meta)?.original;
-		if (original?.assetId === assetId) return original;
+function parseOfficialModelCatalog(value, now = Date.now()) {
+	if (!record$3(value) || !Array.isArray(value.models)) throw new Error("Codex returned a malformed model catalog");
+	const displayNames = /* @__PURE__ */ new Map();
+	for (const model of value.models) {
+		if (!record$3(model)) continue;
+		const id = nonEmpty$1(model.slug);
+		const name = nonEmpty$1(model.display_name);
+		if (id !== void 0 && name !== void 0 && !displayNames.has(id)) displayNames.set(id, name);
 	}
+	const seen = /* @__PURE__ */ new Set();
+	return value.models.map((model) => visibleModel(model, displayNames, now)).filter((model) => model !== void 0 && !seen.has(model.id) && seen.add(model.id)).sort((left, right) => Number(left.id === "gpt-reserve") - Number(right.id === "gpt-reserve") || right.priority - left.priority);
 }
-//#endregion
-//#region src/codex-images.js
-const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
-const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
-const CODEX_IMAGE_EDIT_URL = "https://chatgpt.com/backend-api/codex/images/edits";
-const MAX_REFERENCE_IMAGES = 5;
-const RESPONSE_ENVELOPE_BYTES = 1024 * 1024;
-const IMAGE_BACKGROUNDS = /* @__PURE__ */ new Set([
-	"auto",
-	"transparent",
-	"opaque"
-]);
-const PNG_SIGNATURE = Buffer.from([
-	137,
-	80,
-	78,
-	71,
-	13,
-	10,
-	26,
-	10
-]);
-const FULL_ATTACHMENT_ID = /^sha256:[0-9a-f]{64}$/u;
-const BARE_ATTACHMENT_DIGEST = /^[0-9a-f]{64}$/iu;
-const PATH_LIKE_ATTACHMENT_ID = /[\\/]/u;
-const FILE_NAME_ATTACHMENT_ID = /\.[A-Za-z0-9]{1,16}$/u;
-const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const nonEmpty = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-const NETWORK_REASONS = {
-	UND_ERR_HEADERS_TIMEOUT: "the image service sent no response within 5 minutes",
-	UND_ERR_BODY_TIMEOUT: "the image response stalled",
-	UND_ERR_CONNECT_TIMEOUT: "the connection to the image service timed out",
-	UND_ERR_SOCKET: "the connection closed unexpectedly",
-	ECONNRESET: "the connection was reset",
-	ETIMEDOUT: "the connection timed out",
-	ENOTFOUND: "DNS lookup failed",
-	ECONNREFUSED: "the connection was refused",
-	EAI_AGAIN: "DNS lookup failed"
-};
-function requestFailureReason(error) {
-	const code = [(error?.cause ?? error)?.code, error?.code].find((value) => typeof value === "string" && /^[A-Z][A-Z0-9_]{2,39}$/u.test(value));
-	if (code !== void 0) return `: ${NETWORK_REASONS[code] ?? "network error"} (${code})`;
-	if (error?.name === "TimeoutError") return ": the image request timed out";
-	return "";
-}
-function normalizeImageOptions(args) {
-	const quality = nonEmpty(args?.quality) ?? "auto";
-	const background = nonEmpty(args?.background) ?? "auto";
-	const size = nonEmpty(args?.size) ?? "auto";
-	validateImageQuality(resolveImageModel(args?.model), quality);
-	if (!IMAGE_BACKGROUNDS.has(background)) throw new Error("background must be auto, transparent, or opaque");
-	if (size !== "auto") {
-		const match = /^(\d+)x(\d+)$/u.exec(size);
-		const width = Number(match?.[1]);
-		const height = Number(match?.[2]);
-		const short = Math.min(width, height);
-		const long = Math.max(width, height);
-		const pixels = width * height;
-		if (match === null || width % 16 !== 0 || height % 16 !== 0 || long > 3840 || long > short * 3 || pixels < 655360 || pixels > 8294400) throw new Error("size must be auto or a valid GPT Image 2 widthxheight resolution");
-	}
+function mergeModel(baseModels, remote) {
+	const base = baseModels.find((model) => model.id === remote.id) ?? baseModels.find((model) => model.id !== "gpt-5.3-codex-spark") ?? baseModels[0];
+	if (base === void 0) return void 0;
 	return {
-		quality,
-		background,
-		size
+		...base,
+		id: remote.id,
+		name: remote.name,
+		...remote.retirement === void 0 || remote.description === void 0 ? {} : { description: remote.description },
+		input: remote.input,
+		reasoning: remote.reasoning,
+		thinkingLevelMap: remote.thinkingLevelMap,
+		...remote.contextWindow === void 0 ? {} : { contextWindow: remote.contextWindow },
+		...remote.maxContextWindow === void 0 ? {} : { maxContextWindow: remote.maxContextWindow },
+		...base.id === remote.id ? {} : { cost: {
+			input: 0,
+			output: 0,
+			cacheRead: 0,
+			cacheWrite: 0
+		} }
+	};
+}
+function createOfficialModelCatalog(options = {}) {
+	const fetchCatalog = options.fetch ?? fetch;
+	const getNow = options.now ?? Date.now;
+	const scheduleTimeout = options.setTimeout ?? setTimeout;
+	const cancelTimeout = options.clearTimeout ?? clearTimeout;
+	const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : DEFAULT_REFRESH_TIMEOUT_MS;
+	let models;
+	let metadata = /* @__PURE__ */ new Map();
+	let etag;
+	let rawCatalog;
+	let revision = 0;
+	let refreshing;
+	let generation = 0;
+	let refreshStatus = "idle";
+	const refresh = ({ signal } = {}) => {
+		if (signal?.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+		if (refreshing?.generation === generation) return refreshing.promise;
+		const currentGeneration = generation;
+		refreshStatus = "refreshing";
+		let outcome = "idle";
+		const controller = new AbortController();
+		const abort = () => {
+			if (!controller.signal.aborted) controller.abort(signal?.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+		};
+		signal?.addEventListener("abort", abort, { once: true });
+		const requestSignal = controller.signal;
+		let timer;
+		const timeoutError = /* @__PURE__ */ new Error("Codex model catalog refresh timed out");
+		const work = (async () => {
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, requestSignal);
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) return false;
+			const headers = {
+				authorization: `Bearer ${access}`,
+				"chatgpt-account-id": accountId,
+				accept: "application/json",
+				originator: "pi",
+				"user-agent": USER_AGENT,
+				...etag === void 0 ? {} : { "if-none-match": etag }
+			};
+			const response = await fetchCatalog(CODEX_MODELS_URL, {
+				method: "GET",
+				redirect: "error",
+				headers,
+				signal: requestSignal
+			});
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			if (response.status === 304) {
+				outcome = "ok";
+				if (rawCatalog === void 0) return false;
+				const remote = parseOfficialModelCatalog(rawCatalog, getNow());
+				const next = remote.map((model) => mergeModel(options.baseModels(), model)).filter(Boolean);
+				if (next.length === 0 || JSON.stringify(next) === JSON.stringify(models)) return false;
+				models = next;
+				metadata = new Map(remote.map((model) => [model.id, model]));
+				revision += 1;
+				options.onUpdated?.();
+				return true;
+			}
+			if (!response.ok) throw new Error(`Codex model catalog failed (HTTP ${response.status})`);
+			const raw = await response.json();
+			const remote = parseOfficialModelCatalog(raw, getNow());
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			if (remote.length === 0) throw new Error("Codex returned an empty model catalog");
+			const baseModels = options.baseModels();
+			const next = remote.map((model) => mergeModel(baseModels, model)).filter(Boolean);
+			if (next.length === 0) throw new Error("Codex model catalog has no compatible models");
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			models = next;
+			rawCatalog = raw;
+			metadata = new Map(remote.map((model) => [model.id, model]));
+			etag = nonEmpty$1(response.headers.get("etag")) ?? etag;
+			revision += 1;
+			outcome = "ok";
+			options.onUpdated?.();
+			return true;
+		})();
+		let rejectAborted;
+		const abortPromise = new Promise((_, reject) => {
+			rejectAborted = () => reject(requestSignal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+			if (requestSignal.aborted) rejectAborted();
+			else requestSignal.addEventListener("abort", rejectAborted, { once: true });
+		});
+		timer = scheduleTimeout(() => controller.abort(timeoutError), timeoutMs);
+		timer.unref?.();
+		const promise = Promise.race([work, abortPromise]).catch((error) => {
+			outcome = "failed";
+			throw error;
+		}).finally(() => {
+			cancelTimeout(timer);
+			signal?.removeEventListener("abort", abort);
+			requestSignal.removeEventListener("abort", rejectAborted);
+			if (refreshing?.promise === promise) {
+				refreshing = void 0;
+				refreshStatus = outcome;
+			}
+		});
+		refreshing = {
+			generation: currentGeneration,
+			promise,
+			cancel: () => controller.abort()
+		};
+		return promise;
 	};
-}
-function encodedLimit(decodedBytes) {
-	return Math.ceil(decodedBytes / 3) * 4;
-}
-function validBase64Body(value, end) {
-	for (let index = 0; index < end; index += 1) {
-		const code = value.charCodeAt(index);
-		if (!(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return false;
-	}
-	return true;
-}
-async function readJsonWithin(response, maximumBytes) {
-	const contentLength = Number(response.headers.get("content-length"));
-	if (Number.isFinite(contentLength) && contentLength > maximumBytes) throw new Error("Codex image response exceeds the image size limit");
-	if (response.body === null) throw new Error("Codex returned an unreadable image response");
-	const reader = response.body.getReader();
-	const chunks = [];
-	let bytes = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		bytes += value.byteLength;
-		if (bytes > maximumBytes) {
-			await reader.cancel();
-			throw new Error("Codex image response exceeds the image size limit");
+	return Object.freeze({
+		refresh,
+		getModels: () => models ?? [],
+		metadata: (modelId) => metadata.get(modelId),
+		revision: () => revision,
+		capabilityGaps: () => [...metadata.values()].filter((model) => model.unsupported && /^[a-z][a-z0-9._-]{0,79}$/u.test(model.id)).slice(0, 20).map((model) => ({
+			model: model.id,
+			...structuredClone(model.unsupported)
+		})),
+		status: () => ({
+			source: models === void 0 ? "unavailable" : "online",
+			refresh: refreshStatus
+		}),
+		clear() {
+			generation += 1;
+			const flight = refreshing;
+			refreshing = void 0;
+			flight?.cancel();
+			models = void 0;
+			rawCatalog = void 0;
+			metadata = /* @__PURE__ */ new Map();
+			etag = void 0;
+			refreshStatus = "idle";
+			revision += 1;
+			options.onUpdated?.();
 		}
-		chunks.push(value);
-	}
-	const body = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), bytes).toString("utf8");
-	try {
-		return JSON.parse(body);
-	} catch {
-		throw new Error("Codex returned an unreadable image response");
-	}
-}
-/** Strictly decode one PNG returned by the subscription backend. */
-function decodeCodexPng(value, maximumBytes) {
-	const encoded = nonEmpty(value);
-	const padding = encoded?.endsWith("==") ? 2 : encoded?.endsWith("=") ? 1 : 0;
-	if (encoded === void 0 || encoded.length % 4 !== 0 || !validBase64Body(encoded, encoded.length - padding)) throw new Error("Codex returned an invalid base64 PNG");
-	const decodedBytes = encoded.length / 4 * 3 - padding;
-	if (decodedBytes > maximumBytes) throw new Error("Codex image exceeds the image size limit");
-	const data = Buffer.from(encoded, "base64");
-	if (data.length !== decodedBytes || data.length < PNG_SIGNATURE.length || !data.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) throw new Error("Codex returned an invalid PNG");
-	return new Uint8Array(data);
-}
-function imageReference(value) {
-	const originalDimensions = record$2(value.originalDimensions) ? {
-		width: value.originalDimensions.width,
-		height: value.originalDimensions.height
-	} : void 0;
-	return {
-		attachmentId: value.attachmentId,
-		mediaType: value.mediaType,
-		bytes: value.bytes,
-		width: value.width,
-		height: value.height,
-		...value.name === void 0 ? {} : { name: value.name },
-		...originalDimensions === void 0 ? {} : { originalDimensions }
-	};
-}
-function normalizeAttachmentId(value) {
-	if (typeof value !== "string") return void 0;
-	if (FULL_ATTACHMENT_ID.test(value)) return value;
-	const bare = BARE_ATTACHMENT_DIGEST.exec(value);
-	return bare === null ? void 0 : `sha256:${bare[0].toLowerCase()}`;
-}
-function invalidAttachmentId(value) {
-	const attachmentId = value?.attachmentId;
-	if (typeof attachmentId === "string" && (PATH_LIKE_ATTACHMENT_ID.test(attachmentId) || FILE_NAME_ATTACHMENT_ID.test(attachmentId))) throw new Error("referenceImages attachmentId is a file path or filename; call read_image on that file and retry with its complete sha256:<64 lowercase hex> attachment reference. Do not omit referenceImages or fall back to new image generation.");
-	throw new Error("referenceImages attachmentId must be sha256:<64 lowercase hex> copied from an image block or read_image result. Do not omit referenceImages or fall back to new image generation.");
-}
-function referenceOf(value, attachments) {
-	const attachmentId = normalizeAttachmentId(value?.attachmentId);
-	if (attachmentId === void 0) invalidAttachmentId(value);
-	if (!record$2(value) || !attachments.imageLimits.mediaTypes.includes(value.mediaType) || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || !Number.isSafeInteger(value.width) || value.width <= 0 || !Number.isSafeInteger(value.height) || value.height <= 0 || value.name !== void 0 && (typeof value.name !== "string" || value.name.length > 256) || value.originalDimensions !== void 0 && (!record$2(value.originalDimensions) || !Number.isSafeInteger(value.originalDimensions.width) || value.originalDimensions.width <= 0 || !Number.isSafeInteger(value.originalDimensions.height) || value.originalDimensions.height <= 0)) throw new Error("referenceImages contains an invalid image reference");
-	return imageReference({
-		...value,
-		attachmentId
-	});
-}
-function sessionImageReferences(messages) {
-	const references = /* @__PURE__ */ new Map();
-	const visit = (content) => {
-		if (!Array.isArray(content)) return;
-		for (const block of content) if (block?.type === "image" && record$2(block.attachment)) {
-			const id = normalizeAttachmentId(block.attachment.attachmentId);
-			if (id !== void 0) references.set(id, block.attachment);
-		} else if (block?.type === "tool-result") visit(block.content);
-	};
-	for (const message of messages ?? []) visit(message?.content);
-	return references;
-}
-async function editImages(values, attachments, signal, messages) {
-	if (!Array.isArray(values) || values.length === 0 || values.length > MAX_REFERENCE_IMAGES) throw new Error(`referenceImages must contain between 1 and ${MAX_REFERENCE_IMAGES} images`);
-	const available = messages === void 0 ? void 0 : sessionImageReferences(messages);
-	const references = values.map((value) => {
-		const id = normalizeAttachmentId(value?.attachmentId);
-		if (id === void 0) invalidAttachmentId(value);
-		if (available === void 0) return referenceOf(value, attachments);
-		const selected = available.get(id);
-		if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Call read_image on the intended image and retry with its returned reference. Do not omit referenceImages or substitute another image.");
-		return referenceOf(selected, attachments);
 	});
-	if (new Set(references.map((value) => value.attachmentId)).size !== references.length) throw new Error("referenceImages must not contain duplicates");
-	const images = [];
-	let totalBytes = 0;
-	for (const reference of references) {
-		const stored = await attachments.readImage(reference, signal);
-		totalBytes += stored.data.byteLength;
-		if (totalBytes > attachments.imageLimits.maxMessageImageBytes) throw new Error("referenceImages exceed the DSH message image limit");
-		images.push({ image_url: `data:${stored.ref.mediaType};base64,${Buffer.from(stored.data).toString("base64")}` });
-	}
-	return images;
-}
-function imageContent(value) {
-	const label = typeof value.size === "string" && value.size.length > 0 ? `Generated a ${value.size} image.` : "Generated an image.";
-	return [{
-		type: "text",
-		text: value.localPath === void 0 ? label : `${label}\nOriginal PNG saved on the DSH host at: ${JSON.stringify(value.localPath)}. Read this file or copy it to the workspace with a .png extension; this host path is not a browser URL.`
-	}, {
-		type: "image",
-		attachment: imageReference(value.image)
-	}];
 }
-function imageOutputSchema() {
-	return {
-		type: "object",
-		additionalProperties: false,
-		properties: {
-			image: {
-				type: "object",
-				required: true,
-				additionalProperties: false,
-				properties: {
-					attachmentId: {
-						type: "string",
-						required: true
-					},
-					mediaType: {
-						type: "string",
-						enum: ["image/png"],
-						required: true
-					},
-					bytes: {
-						type: "integer",
-						required: true
-					},
-					width: {
-						type: "integer",
-						required: true
-					},
-					height: {
-						type: "integer",
-						required: true
-					},
-					name: { type: "string" },
-					originalDimensions: {
-						type: "object",
-						additionalProperties: false,
-						properties: {
-							width: {
-								type: "integer",
-								required: true
-							},
-							height: {
-								type: "integer",
-								required: true
-							}
-						}
-					}
-				}
-			},
-			original: {
-				type: "object",
-				required: true,
-				additionalProperties: false,
-				properties: {
-					assetId: {
-						type: "string",
-						required: true
-					},
-					mediaType: {
-						type: "string",
-						enum: ["image/png"],
-						required: true
-					},
-					bytes: {
-						type: "integer",
-						required: true
-					},
-					width: {
-						type: "integer",
-						required: true
-					},
-					height: {
-						type: "integer",
-						required: true
-					},
-					name: {
-						type: "string",
-						required: true
-					},
-					sha256: {
-						type: "string",
-						required: true
-					}
-				}
-			},
-			background: { type: "string" },
-			requestedModel: { type: "string" },
-			reportedModel: { type: "string" },
-			requestedSize: { type: "string" },
-			localPath: {
-				type: "string",
-				required: true,
-				description: "Absolute path to the original PNG on the DSH host."
-			},
-			quality: { type: "string" },
-			size: { type: "string" }
-		}
+//#endregion
+//#region src/codex-search.js
+const CODEX_SEARCH_PROVIDER_ID = "codex-subscription";
+const CODEX_AUTO_SEARCH_PROVIDER_ID = "codex-subscription-auto";
+const CODEX_SEARCH_URL = "https://chatgpt.com/backend-api/codex/alpha/search";
+const DEFAULT_MODEL = "gpt-5.6-luna";
+const MAX_OUTPUT_TOKENS = 4096;
+const MAX_SOURCE_DATE = 64;
+const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const nonEmpty = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
+const displayText = (value) => {
+	const text = nonEmpty(value)?.replace(/\s+/gu, " ").trim();
+	if (text === void 0 || text.length === 0) return void 0;
+	return text;
+};
+const boundedDisplayText = (value, maximum) => {
+	const text = displayText(value);
+	if (text === void 0 || text.length <= maximum) return text;
+	return `${text.slice(0, maximum - 1)}…`;
+};
+function sourceOf(value) {
+	if (!record$2(value)) return void 0;
+	const url = nonEmpty(value.url);
+	if (url === void 0) return void 0;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+	const title = displayText(value.title) ?? parsed.hostname;
+	const snippet = displayText(value.snippet);
+	const publishedAt = boundedDisplayText(value.published_at, MAX_SOURCE_DATE) ?? boundedDisplayText(value.publishedAt, MAX_SOURCE_DATE);
+	return {
+		url,
+		title,
+		...snippet === void 0 ? {} : { snippet },
+		...publishedAt === void 0 ? {} : { publishedAt }
 	};
 }
-function responseMetadata(value) {
-	const data = Array.isArray(value?.data) ? value.data[0] : void 0;
-	const encoded = record$2(data) ? data.b64_json : void 0;
-	if (typeof encoded !== "string") throw new Error("Codex returned no image data");
+function parseSearchResponse(value) {
+	if (!record$2(value) || !Array.isArray(value.results)) throw new Error("Codex returned a malformed search response");
+	const seen = /* @__PURE__ */ new Set();
+	const sources = [];
+	for (const result of value.results ?? []) {
+		const source = sourceOf(result);
+		if (source === void 0 || seen.has(source.url)) continue;
+		seen.add(source.url);
+		sources.push(source);
+	}
 	return {
-		encoded,
-		background: nonEmpty(value.background),
-		quality: nonEmpty(value.quality),
-		size: nonEmpty(value.size),
-		reportedModel: nonEmpty(value.model)
+		sources,
+		truncated: false
 	};
 }
-/** Create the DSH-native image-generation tool backed only by the ChatGPT subscription. */
-function createCodexImageTool(options) {
-	const fetchImage = options.fetch ?? fetch;
-	const attachments = options.attachments;
-	return defineTool({
-		name: CODEX_IMAGE_TOOL_NAME,
-		description: "Generate or edit images only when the user asks for image output, not when merely discussing images. Uses the signed-in Codex subscription. For a new image, omit referenceImages. For edits, copy attachmentId only from the selected session image block; the host supplies its metadata. Never call read_image for an attachmentId or attachment filename. Use read_image only for an actual local file whose reference is not already in the conversation. Never substitute paths, unrelated images, or text-only generation for an edit. For numbered annotations, include the clean source and location-reference image, preserve the requested changes and coordinates in the prompt, and remove guidance markers from the result. If the intended references cannot be identified, ask rather than guessing.",
-		parameters: {
-			model: {
-				type: "string",
-				enum: Object.keys(IMAGE_MODELS),
-				description: "Optional image engine, independent of the conversation model. When omitted, uses the user image setting (initially gpt-image-2). The 2.5 identifiers are experimental subscription candidates; override only when explicitly requested. Never silently retry with another model."
-			},
-			prompt: {
-				type: "string",
-				required: true,
-				description: "A complete, production-ready description of the image to generate."
-			},
-			size: {
-				type: "string",
-				description: "Optional GPT Image 2 output size. Use auto unless the user requests an exact valid widthxheight resolution."
-			},
-			quality: {
-				type: "string",
-				enum: [
-					"auto",
-					"low",
-					"medium",
-					"high",
-					"xhigh",
-					"max"
-				],
-				description: "Optional rendering quality. Use auto unless the user requests draft speed or final quality."
-			},
-			background: {
-				type: "string",
-				enum: [
-					"auto",
-					"transparent",
-					"opaque"
-				],
-				description: "Optional background mode. Request transparent only when the user needs transparency."
-			},
-			referenceImages: {
-				type: "array",
-				description: "Optional references to 1-5 selected images. For session images provide only attachmentId; the host resolves trusted metadata. Omit only for a new image; never drop an invalid reference to bypass editing.",
-				items: {
-					type: "object",
-					additionalProperties: false,
-					properties: {
-						attachmentId: {
-							type: "string",
-							required: true,
-							description: "Copy the complete attachmentId from the image block or read_image result: sha256:<64 lowercase hex>. Never pass a workspace path, absolute path, or filename. A bare 64-character hex digest is accepted and normalized to sha256:<64 lowercase hex>."
-						},
-						mediaType: {
-							type: "string",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						bytes: {
-							type: "integer",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						width: {
-							type: "integer",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						height: {
-							type: "integer",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						name: { type: "string" },
-						originalDimensions: {
-							type: "object",
-							additionalProperties: false,
-							properties: {
-								width: {
-									type: "integer",
-									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-								},
-								height: {
-									type: "integer",
-									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-								}
-							}
-						}
-					}
-				}
-			}
-		},
-		output: {
-			schema: imageOutputSchema(),
-			render: (_args, value) => imageContent(value),
-			presentationMeta: (_args, value) => ({
-				kind: "codex-subscription-image",
-				schemaVersion: 1,
-				original: value.original,
-				...value.requestedModel === void 0 ? {} : { requestedModel: value.requestedModel },
-				...value.reportedModel === void 0 ? {} : { reportedModel: value.reportedModel },
-				...value.requestedSize === void 0 ? {} : { requestedSize: value.requestedSize }
-			})
-		},
-		timeoutMs: 300 * 1e3,
-		isConcurrencySafe: () => false,
-		async execute(args, exec) {
-			assertImageOperation(options.getFeatures?.(), args.referenceImages !== void 0);
-			const defaults = readImageDefaults(options.getFeatures?.());
-			args = {
-				...args,
-				model: args.model ?? defaults.imageModel,
-				quality: args.quality ?? defaults.imageQuality
-			};
-			const prompt = nonEmpty(args.prompt);
-			if (prompt === void 0) throw new Error("prompt must be a non-empty string");
-			const imageOptions = normalizeImageOptions(args);
-			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, exec.signal);
-			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
-			if (!attachments.imageLimits.mediaTypes.includes("image/png")) throw new Error("This DSH installation does not accept PNG image attachments");
-			const maximumBytes = Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
-			const editing = args.referenceImages !== void 0;
-			const sessionMessages = editing && typeof options.getSessionMessages === "function" ? await options.getSessionMessages(exec.agent?.id) : void 0;
-			const images = editing ? await editImages(args.referenceImages, attachments, exec.signal, sessionMessages ?? (options.getSessionMessages ? [] : void 0)) : void 0;
+/** Create the DSH web provider backed only by the ChatGPT subscription search endpoint. */
+function createCodexSearchProvider(options) {
+	const fetchSearch = options.fetch ?? fetch;
+	return Object.freeze({
+		id: CODEX_SEARCH_PROVIDER_ID,
+		available: () => true,
+		async search(request, signal) {
+			signal?.throwIfAborted();
+			const preferences = readCapabilitySettings(options.resolvePreferences?.());
+			if (preferences.searchMode === "disabled") throw new WebError("Codex search is disabled in subscription settings", "WEB_PROVIDER_UNAVAILABLE");
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, signal);
+			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new WebError("ChatGPT subscription is not signed in", "WEB_PROVIDER_CREDENTIAL_MISSING");
+			const model = nonEmpty(options.resolveModel?.()) ?? DEFAULT_MODEL;
+			const id = nonEmpty(options.resolveSessionId?.()) ?? randomUUID();
 			let response;
-			assertImageOperation(options.getFeatures?.(), editing);
 			try {
-				response = await fetchImage(editing ? CODEX_IMAGE_EDIT_URL : CODEX_IMAGE_GENERATION_URL, {
+				response = await fetchSearch(CODEX_SEARCH_URL, {
 					method: "POST",
 					redirect: "error",
 					headers: {
@@ -4053,60 +4087,58 @@ function createCodexImageTool(options) {
 						accept: "application/json",
 						"content-type": "application/json",
 						originator: "pi",
-						"x-codex-image-turn-id": String(exec.callId),
 						"user-agent": USER_AGENT
 					},
 					body: JSON.stringify({
-						...images === void 0 ? {} : { images },
-						prompt,
-						background: imageOptions.background,
-						model: resolveImageModel(args.model),
-						quality: imageOptions.quality,
-						size: imageOptions.size
+						id,
+						model,
+						input: request.query,
+						commands: {
+							search_query: [{ q: request.query }],
+							response_length: "short"
+						},
+						settings: {
+							allowed_callers: ["direct"],
+							external_web_access: preferences.searchMode === "live"
+						},
+						max_output_tokens: MAX_OUTPUT_TOKENS
 					}),
-					signal: exec.signal
+					signal
 				});
 			} catch (error) {
-				if (exec.signal.aborted) throw exec.signal.reason;
-				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
+				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
+				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			if (!response.ok) {
-				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
-				if (response.status === 429) throw new Error("Codex image generation quota is unavailable");
-				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})`);
+			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			let value;
+			try {
+				value = await response.json();
+			} catch (error) {
+				throw new WebError("Codex returned an unreadable search response", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			const metadata = responseMetadata(await readJsonWithin(response, encodedLimit(maximumBytes) + RESPONSE_ENVELOPE_BYTES));
-			const data = decodeCodexPng(metadata.encoded, maximumBytes);
-			const sessionId = exec.agent?.id;
-			if (sessionId === void 0) throw new Error("Codex image generation requires a session-owned tool call");
-			const original = await options.originalImages.save(String(sessionId), data);
-			let ref;
 			try {
-				ref = await attachments.saveImage({
-					data,
-					mediaType: "image/png",
-					name: "codex-generated.png"
+				const result = parseSearchResponse(value);
+				if (preferences.searchDomains.length > 0) result.sources = result.sources.filter((source) => {
+					const hostname = new URL(source.url).hostname.toLowerCase();
+					return preferences.searchDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
 				});
+				return result;
 			} catch (error) {
-				await options.originalImages.remove(original);
-				throw error;
+				throw new WebError("Codex returned a malformed search response", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			const result = {
-				requestedModel: resolveImageModel(args.model),
-				requestedSize: imageOptions.size,
-				...metadata.reportedModel === void 0 ? {} : { reportedModel: metadata.reportedModel },
-				image: imageReference(ref),
-				original,
-				localPath: options.originalImages.originalPath(original.assetId),
-				...metadata.background === void 0 ? {} : { background: metadata.background },
-				...metadata.quality === void 0 ? {} : { quality: metadata.quality },
-				size: `${original.width}x${original.height}`
-			};
-			if (exec.parent !== void 0) exec.deferContext(createUserMessage({
-				content: imageContent(result),
-				source: { kind: "codex-subscription-image" }
-			}));
-			return result;
+		}
+	});
+}
+/** Route each request by its initiating model without changing the user's explicit overrides. */
+function createCodexAutoSearchProvider(options) {
+	return Object.freeze({
+		id: CODEX_AUTO_SEARCH_PROVIDER_ID,
+		available: () => true,
+		async search(request, signal) {
+			if (options.resolveModelProvider?.() === "openai-codex") return options.codex.search(request, signal);
+			const provider = options.resolveDshProvider?.();
+			if (provider === void 0 || provider.id === "codex-subscription-auto" || provider.id === "codex-subscription" || provider.available() !== true) throw new WebError("DSH default search is unavailable", "WEB_PROVIDER_UNAVAILABLE");
+			return provider.search(request, signal);
 		}
 	});
 }
@@ -6478,7 +6510,7 @@ function apply(ctx, config = {}) {
 		let dispose;
 		const sync = () => {
 			const value = settings.get();
-			if (value.imageSketchAgent && value.imageSketch && value.imageEditing) dispose ??= ctx.tools.register(createSketchAgentTool(sketchBridge, ctx.attachments));
+			if (value.imageSketchAgent && value.imageSketch && value.imageEditing) dispose ??= ctx.tools.register(createSketchAgentTool(sketchBridge, ctx.attachments, (sessionId) => ctx.get?.("sessions")?.get?.(sessionId)?.deriveMessages?.() ?? []));
 			else {
 				dispose?.();
 				dispose = void 0;