dsh-codex-subscription 2.4.2 → 2.5.1

package/lib/index.js

@@ -14,9 +14,9 @@ import { constants, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { defineTool } from "@deepseek-ai/dsh-tools";
+import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import * as dshCredentials from "@deepseek-ai/dsh-credentials";
 import { dshHomePath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { LlmError, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import z from "@deepseek-ai/schemastery";
 import { openaiCodexProvider as createOpenAICodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
@@ -166,8 +166,7 @@ const IMAGE_FEATURE_DEFAULTS = Object.freeze({
 	imageViewer: true,
 	imageAnnotations: true,
 	imageSketch: false,
-	imageSketchAgent: false,
-	imageSketchAgentPreview: false
+	imageSketchAgent: false
 });
 function readImageFeatures(value = {}) {
 	return Object.fromEntries(Object.entries(IMAGE_FEATURE_DEFAULTS).map(([key, fallback]) => [key, typeof value?.[key] === "boolean" ? value[key] : fallback]));
@@ -1980,2071 +1979,2106 @@ const sketchCommandArray = {
 	})
 };
 //#endregion
-//#region src/sketch-agent-tool.js
-function createSketchAgentTool(bridge, attachments) {
-	return defineTool({
-		name: "codex_sketch",
-		description: "Edit the sketch board in this session using native editable strokes and layers. Use for @sketch requests and explicit follow-up edits to that drawing. The toolbar pen button is for manual drawing; do not require the user to open it. Start with inspect for the runId, documentId, revision and command reference. Draw with the svg op whenever possible: one SVG document per stage (paths, shapes, groups, transforms; see the reference from inspect) is far faster and richer than hand-placed strokes, and still becomes native editable strokes. Draw the shapes, hair, clothing and lettering outlines of every layer with svg; use stroke commands only for small corrections and native text. Apply atomic batches, preview between stages, and call finish to save the finished draft and release the editing lock. save is only a checkpoint. finish returns an image only when the user enables experimental preview feedback. Closing the board does not stop drawing. If the user stops drawing, do not retry. Never generates AI images, sends messages or attaches images automatically. Inspect automatically opens the board in the currently viewed session. Do not ask the user to open it first. If the session is not visible in DSH, ask them to switch to it. On timeout inspect before retrying; reuse the exact requestId only for the same request.",
-		parameters: {
-			action: {
-				type: "string",
-				required: true,
-				enum: [
-					"inspect",
-					"apply",
-					"preview",
-					"save",
-					"finish"
-				]
-			},
-			runId: {
-				type: "string",
-				description: "From inspect; required for all other actions. Never reuse a stopped run."
-			},
-			documentId: {
-				type: "string",
-				description: "From inspect; required except for inspect."
-			},
-			revision: {
-				type: "integer",
-				description: "From latest response; required for apply/save/finish."
-			},
-			requestId: {
-				type: "string",
-				description: "Unique id for apply/save/finish; exact retries are deduplicated. After timeout inspect recentRequests before repeating a write."
-			},
-			commands: {
-				oneOf: [sketchCommandArray, { type: "string" }],
-				description: "Prefer a native command array. Legacy JSON string also accepted. Required for apply. Use named objects and update existing IDs; prefer Bezier start + segments (control1/control2/end) for curves, not hundreds of pen points."
-			},
-			name: {
-				type: "string",
-				description: "Draft name for save/finish."
-			},
-			offset: {
-				type: "integer",
-				description: "inspect only: object list offset, default 0. Follow nextOffset for further pages."
-			},
-			objectId: {
-				type: "string",
-				description: "inspect only: return full editable geometry for this object, in layer (defaults to active layer)."
-			},
-			layer: {
-				type: "integer",
-				description: "inspect only: layer containing objectId."
-			}
-		},
-		timeoutMs: 25e3,
-		isConcurrencySafe: () => false,
-		async execute(args, exec) {
-			const sessionId = exec.agent?.id;
-			if (typeof sessionId !== "string") throw Error("A session-owned sketch call is required");
-			const request = { ...args };
-			if (args.action === "apply") try {
-				request.commands = typeof args.commands === "string" ? JSON.parse(args.commands) : args.commands;
-				if (!Array.isArray(request.commands)) throw Error();
-			} catch {
-				throw Error("commands must be a native array or JSON array string");
-			}
-			const value = await bridge.request(sessionId, request, exec.signal);
-			if (value.png) {
-				if (!/^data:image\/png;base64,/.test(value.png) || value.png.length > 8 * 1024 * 1024) throw Error("Invalid sketch preview");
-				const image = await attachments.saveImage({
-					data: new Uint8Array(Buffer.from(value.png.split(",")[1], "base64")),
-					mediaType: "image/png",
-					name: "sketch-preview.png"
-				});
-				const { png, ...snapshot } = value;
-				return {
-					...snapshot,
-					image
-				};
-			}
-			return value;
-		},
-		output: {
-			schema: {
-				type: "object",
-				additionalProperties: true
-			},
-			render: (_args, value) => [{
-				type: "text",
-				text: JSON.stringify({
-					...value,
-					image: void 0
-				})
-			}, ...value.image ? [{
-				type: "image",
-				attachment: value.image
-			}] : []]
-		}
-	});
+//#region src/subscription-credentials.js
+async function readSubscriptionCredentials(getAuth, readCredential, signal) {
+	for (let attempt = 0; attempt < 2; attempt++) {
+		const auth = await getAuth({ signal });
+		signal?.throwIfAborted();
+		if (typeof auth?.auth?.apiKey !== "string" || !auth.auth.apiKey) break;
+		const credential = await readCredential({ signal });
+		signal?.throwIfAborted();
+		if (credential?.type !== "oauth") break;
+		if (credential.access === auth.auth.apiKey) return {
+			access: credential.access,
+			accountId: credential.accountId
+		};
+	}
+	return {
+		access: void 0,
+		accountId: void 0
+	};
 }
-//#endregion
-//#region src/sketch-codec-route.js
-function registerSketchCodec(connection) {
-	let source;
-	return connection.fetch.register({
-		path: "/api/codex-subscription/sketch-psd-worker",
-		methods: ["GET"],
-		requestBody: "buffered",
-		async fetch() {
-			source ??= await readFile(new URL("./sketch-psd-worker.js", import.meta.url));
-			return new Response(source, { headers: {
-				"content-type": "text/javascript; charset=utf-8",
-				"cache-control": "no-store"
-			} });
-		}
-	});
+const ORIGINAL_IMAGE_CHUNK_BYTES = 4 * 1024 * 1024;
+const ORIGINAL_IMAGE_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
+const positiveInteger$1 = (value) => Number.isSafeInteger(value) && value > 0;
+function decodeOriginalImageRef(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || typeof value.assetId !== "string" || !ORIGINAL_IMAGE_ID_PATTERN.test(value.assetId) || value.mediaType !== "image/png" || !positiveInteger$1(value.bytes) || value.bytes > 48 * 1024 * 1024 || !positiveInteger$1(value.width) || !positiveInteger$1(value.height) || typeof value.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value.name) || typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(value.sha256)) return void 0;
+	return {
+		assetId: value.assetId,
+		mediaType: value.mediaType,
+		bytes: value.bytes,
+		width: value.width,
+		height: value.height,
+		name: value.name,
+		sha256: value.sha256
+	};
 }
-//#endregion
-//#region src/account-vault.js
-const VERSION = 1;
-const DEFAULT_LABEL = "Account 1";
-const clone$1 = (value) => value === void 0 ? void 0 : structuredClone(value);
-const EMAIL_MAX_LENGTH = 254;
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
-/** Keep only a bounded, display-safe email address from a trusted OAuth result. */
-function normalizeAccountEmail(value) {
-	if (typeof value !== "string") return void 0;
-	const email = value.trim();
-	return email.length > 0 && email.length <= EMAIL_MAX_LENGTH && EMAIL_PATTERN.test(email) ? email : void 0;
+function decodeImagePresentation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || value.kind !== "codex-subscription-image" || value.schemaVersion !== 1) return void 0;
+	const original = decodeOriginalImageRef(value.original);
+	return original === void 0 ? void 0 : { original };
 }
-function decodeJwtPayload(access) {
-	if (typeof access !== "string") return void 0;
-	const encoded = access.split(".")[1];
-	if (typeof encoded !== "string" || encoded.length === 0) return void 0;
-	try {
-		return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+function originalImageRefsEqual(left, right) {
+	const a = decodeOriginalImageRef(left);
+	const b = decodeOriginalImageRef(right);
+	return a !== void 0 && b !== void 0 && a.assetId === b.assetId && a.mediaType === b.mediaType && a.bytes === b.bytes && a.width === b.width && a.height === b.height && a.name === b.name && a.sha256 === b.sha256;
+}
+/** Resolve only an exact original reference copied into a DSH fork prefix. */
+function inheritedOriginalImageRef(session, assetId) {
+	const parentSession = session?.header?.parentSession;
+	const seedLength = Number.isSafeInteger(session?.inheritedEventCount) ? session.inheritedEventCount : session?.header?.seedLength;
+	if (typeof parentSession !== "string" || parentSession.length === 0 || !Number.isSafeInteger(seedLength) || seedLength < 0 || !ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) return void 0;
+	let events = session?.events;
+	if (!Array.isArray(events) && typeof session?.snapshotEvents === "function") try {
+		events = session.snapshotEvents();
 	} catch {
 		return;
 	}
+	if (!Array.isArray(events)) return void 0;
+	for (const event of events) {
+		if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq >= seedLength || event.type !== "tool/result") continue;
+		const original = decodeImagePresentation(event.data?.meta)?.original;
+		if (original?.assetId === assetId) return original;
+	}
 }
-function emailFromAccessToken(access) {
-	const payload = decodeJwtPayload(access);
-	return normalizeAccountEmail(payload?.["https://api.openai.com/profile"]?.email ?? payload?.email);
+//#endregion
+//#region src/version.js
+const PACKAGE_VERSION = "2.5.1";
+const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
+//#endregion
+//#region src/codex-images.js
+const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
+const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
+const CODEX_IMAGE_EDIT_URL = "https://chatgpt.com/backend-api/codex/images/edits";
+const MAX_REFERENCE_IMAGES = 5;
+const RESPONSE_ENVELOPE_BYTES = 1024 * 1024;
+const IMAGE_BACKGROUNDS = /* @__PURE__ */ new Set([
+	"auto",
+	"transparent",
+	"opaque"
+]);
+const PNG_SIGNATURE = Buffer.from([
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+]);
+const FULL_ATTACHMENT_ID = /^sha256:[0-9a-f]{64}$/u;
+const BARE_ATTACHMENT_DIGEST = /^[0-9a-f]{64}$/iu;
+const PATH_LIKE_ATTACHMENT_ID = /[\\/]/u;
+const FILE_NAME_ATTACHMENT_ID = /\.[A-Za-z0-9]{1,16}$/u;
+const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const nonEmpty$2 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+const NETWORK_REASONS = {
+	UND_ERR_HEADERS_TIMEOUT: "the image service sent no response within 5 minutes",
+	UND_ERR_BODY_TIMEOUT: "the image response stalled",
+	UND_ERR_CONNECT_TIMEOUT: "the connection to the image service timed out",
+	UND_ERR_SOCKET: "the connection closed unexpectedly",
+	ECONNRESET: "the connection was reset",
+	ETIMEDOUT: "the connection timed out",
+	ENOTFOUND: "DNS lookup failed",
+	ECONNREFUSED: "the connection was refused",
+	EAI_AGAIN: "DNS lookup failed"
+};
+function requestFailureReason(error) {
+	const code = [(error?.cause ?? error)?.code, error?.code].find((value) => typeof value === "string" && /^[A-Z][A-Z0-9_]{2,39}$/u.test(value));
+	if (code !== void 0) return `: ${NETWORK_REASONS[code] ?? "network error"} (${code})`;
+	if (error?.name === "TimeoutError") return ": the image request timed out";
+	return "";
 }
-/** Normalize the one non-secret account attribute that may cross the UI boundary. */
-function sanitizeOAuthCredential(value) {
-	const credential = assertOAuthCredential$1(value);
-	const email = emailFromAccessToken(credential.access) ?? normalizeAccountEmail(credential.email);
-	if (email === void 0) {
-		delete credential.email;
-		return credential;
+function normalizeImageOptions(args) {
+	const quality = nonEmpty$2(args?.quality) ?? "auto";
+	const background = nonEmpty$2(args?.background) ?? "auto";
+	const size = nonEmpty$2(args?.size) ?? "auto";
+	validateImageQuality(resolveImageModel(args?.model), quality);
+	if (!IMAGE_BACKGROUNDS.has(background)) throw new Error("background must be auto, transparent, or opaque");
+	if (size !== "auto") {
+		const match = /^(\d+)x(\d+)$/u.exec(size);
+		const width = Number(match?.[1]);
+		const height = Number(match?.[2]);
+		const short = Math.min(width, height);
+		const long = Math.max(width, height);
+		const pixels = width * height;
+		if (match === null || width % 16 !== 0 || height % 16 !== 0 || long > 3840 || long > short * 3 || pixels < 655360 || pixels > 8294400) throw new Error("size must be auto or a valid GPT Image 2 widthxheight resolution");
 	}
 	return {
-		...credential,
-		email
-	};
-}
-function assertOAuthCredential$1(value) {
-	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex account vault received a malformed OAuth credential");
-	return clone$1(value);
+		quality,
+		background,
+		size
+	};
 }
-function parseOAuthCredential$1(value) {
+function encodedLimit(decodedBytes) {
+	return Math.ceil(decodedBytes / 3) * 4;
+}
+function validBase64Body(value, end) {
+	for (let index = 0; index < end; index += 1) {
+		const code = value.charCodeAt(index);
+		if (!(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return false;
+	}
+	return true;
+}
+async function readJsonWithin(response, maximumBytes) {
+	const contentLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > maximumBytes) throw new Error("Codex image response exceeds the image size limit");
+	if (response.body === null) throw new Error("Codex returned an unreadable image response");
+	const reader = response.body.getReader();
+	const chunks = [];
+	let bytes = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		bytes += value.byteLength;
+		if (bytes > maximumBytes) {
+			await reader.cancel();
+			throw new Error("Codex image response exceeds the image size limit");
+		}
+		chunks.push(value);
+	}
+	const body = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), bytes).toString("utf8");
 	try {
-		return assertOAuthCredential$1(JSON.parse(value));
-	} catch (error) {
-		if (error?.message === "Codex account vault received a malformed OAuth credential") throw error;
-		throw new Error("Codex account vault contains malformed OAuth JSON", { cause: error });
+		return JSON.parse(body);
+	} catch {
+		throw new Error("Codex returned an unreadable image response");
 	}
 }
-function normalizeLabel(value) {
-	if (typeof value !== "string") throw new Error("Codex account label must be text");
-	const label = value.trim().replace(/\s+/gu, " ");
-	if (label.length === 0 || label.length > 48) throw new Error("Codex account label must contain 1 to 48 characters");
-	return label;
+/** Strictly decode one PNG returned by the subscription backend. */
+function decodeCodexPng(value, maximumBytes) {
+	const encoded = nonEmpty$2(value);
+	const padding = encoded?.endsWith("==") ? 2 : encoded?.endsWith("=") ? 1 : 0;
+	if (encoded === void 0 || encoded.length % 4 !== 0 || !validBase64Body(encoded, encoded.length - padding)) throw new Error("Codex returned an invalid base64 PNG");
+	const decodedBytes = encoded.length / 4 * 3 - padding;
+	if (decodedBytes > maximumBytes) throw new Error("Codex image exceeds the image size limit");
+	const data = Buffer.from(encoded, "base64");
+	if (data.length !== decodedBytes || data.length < PNG_SIGNATURE.length || !data.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) throw new Error("Codex returned an invalid PNG");
+	return new Uint8Array(data);
 }
-function assertVaultRecord(record) {
-	if (record?.kind !== "grant" || record.payload?.version !== VERSION || typeof record.payload.activeId !== "string" || !Array.isArray(record.payload.accounts) || record.payload.accounts.length === 0) throw new Error("Codex account vault contains a malformed grant record");
-	const ids = /* @__PURE__ */ new Set();
-	const accounts = record.payload.accounts.map((account) => {
-		if (account === null || typeof account !== "object" || typeof account.id !== "string" || account.id.length === 0 || ids.has(account.id)) throw new Error("Codex account vault contains a malformed account id");
-		ids.add(account.id);
-		return {
-			id: account.id,
-			label: normalizeLabel(account.label),
-			credential: sanitizeOAuthCredential(account.credential)
-		};
+function imageReference(value) {
+	const originalDimensions = record$4(value.originalDimensions) ? {
+		width: value.originalDimensions.width,
+		height: value.originalDimensions.height
+	} : void 0;
+	return {
+		attachmentId: value.attachmentId,
+		mediaType: value.mediaType,
+		bytes: value.bytes,
+		width: value.width,
+		height: value.height,
+		...value.name === void 0 ? {} : { name: value.name },
+		...originalDimensions === void 0 ? {} : { originalDimensions }
+	};
+}
+function normalizeAttachmentId(value) {
+	if (typeof value !== "string") return void 0;
+	if (FULL_ATTACHMENT_ID.test(value)) return value;
+	const bare = BARE_ATTACHMENT_DIGEST.exec(value);
+	return bare === null ? void 0 : `sha256:${bare[0].toLowerCase()}`;
+}
+function invalidAttachmentId(value) {
+	const attachmentId = value?.attachmentId;
+	if (typeof attachmentId === "string" && (PATH_LIKE_ATTACHMENT_ID.test(attachmentId) || FILE_NAME_ATTACHMENT_ID.test(attachmentId))) throw new Error("referenceImages attachmentId is a file path or filename; call read_image on that file and retry with its complete sha256:<64 lowercase hex> attachment reference. Do not omit referenceImages or fall back to new image generation.");
+	throw new Error("referenceImages attachmentId must be sha256:<64 lowercase hex> copied from an image block or read_image result. Do not omit referenceImages or fall back to new image generation.");
+}
+function referenceOf(value, attachments) {
+	const attachmentId = normalizeAttachmentId(value?.attachmentId);
+	if (attachmentId === void 0) invalidAttachmentId(value);
+	if (!record$4(value) || !attachments.imageLimits.mediaTypes.includes(value.mediaType) || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || !Number.isSafeInteger(value.width) || value.width <= 0 || !Number.isSafeInteger(value.height) || value.height <= 0 || value.name !== void 0 && (typeof value.name !== "string" || value.name.length > 256) || value.originalDimensions !== void 0 && (!record$4(value.originalDimensions) || !Number.isSafeInteger(value.originalDimensions.width) || value.originalDimensions.width <= 0 || !Number.isSafeInteger(value.originalDimensions.height) || value.originalDimensions.height <= 0)) throw new Error("referenceImages contains an invalid image reference");
+	return imageReference({
+		...value,
+		attachmentId
 	});
-	if (!ids.has(record.payload.activeId)) throw new Error("Codex account vault active account is missing");
-	const legacyAccountId = record.payload.legacyAccountId;
-	if (legacyAccountId !== void 0 && !ids.has(legacyAccountId)) throw new Error("Codex account vault legacy account is missing");
+}
+function sessionImageReferences(messages) {
+	const references = /* @__PURE__ */ new Map();
+	const visit = (content) => {
+		if (!Array.isArray(content)) return;
+		for (const block of content) if (block?.type === "image" && record$4(block.attachment)) {
+			const id = normalizeAttachmentId(block.attachment.attachmentId);
+			if (id !== void 0) references.set(id, block.attachment);
+		} else if (block?.type === "tool-result") visit(block.content);
+	};
+	for (const message of messages ?? []) visit(message?.content);
+	return references;
+}
+async function readSessionImage(attachmentId, attachments, signal, messages) {
+	const id = normalizeAttachmentId(attachmentId);
+	if (id === void 0) invalidAttachmentId({ attachmentId });
+	const selected = sessionImageReferences(messages).get(id);
+	if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Copy attachmentId from the image block of the user message; never pass a path or filename.");
+	const stored = await attachments.readImage(referenceOf(selected, attachments), signal);
 	return {
-		version: VERSION,
-		activeId: record.payload.activeId,
-		legacyAccountId,
-		accounts
+		data: stored.data,
+		mediaType: stored.ref.mediaType,
+		name: stored.ref.name
 	};
 }
-const grant = (payload) => ({
-	kind: "grant",
-	payload
-});
-var PendingOAuthCredentialStore = class {
-	#credential;
-	async read(providerId) {
-		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
-		return clone$1(this.#credential);
-	}
-	async list() {
-		return this.#credential === void 0 ? [] : [{
-			providerId: "openai-codex",
-			type: "oauth"
-		}];
-	}
-	async modify(providerId, update) {
-		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
-		const next = await update(clone$1(this.#credential));
-		if (next !== void 0) this.#credential = sanitizeOAuthCredential(next);
-		return clone$1(this.#credential);
-	}
-	async delete(providerId) {
-		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
-		this.#credential = void 0;
-	}
-	credential() {
-		return clone$1(this.#credential);
-	}
-};
-/**
-* Multi-account owner state stored in DSH's atomic plugin credential record.
-* The old single-account reference remains as a rollback source and is kept in
-* sync whenever that imported account rotates its refresh token.
-*/
-var DshOAuthAccountVault = class {
-	#tail = Promise.resolve();
-	constructor(credentials, options) {
-		if (credentials === void 0 || credentials === null || typeof credentials.readRecord !== "function" || typeof credentials.modifyRecord !== "function") throw new Error("Codex multi-account requires DSH credential records");
-		this.credentials = credentials;
-		this.key = options.key;
-		this.legacyRef = options.legacyRef;
-		this.legacyRefs = Object.freeze([...options.legacyRefs ?? []]);
-		this.createId = options.createId ?? randomUUID;
-		this.onLegacySyncFailure = options.onLegacySyncFailure ?? (() => {});
-	}
-	#enqueue(operation) {
-		const current = this.#tail.catch(() => void 0).then(operation);
-		this.#tail = current.catch(() => void 0);
-		return current;
-	}
-	async #legacyCredential() {
-		for (const ref of [this.legacyRef, ...this.legacyRefs]) {
-			const hit = await this.credentials.resolve(ref);
-			if (hit?.value === void 0 || hit.value === "") continue;
-			return {
-				ref,
-				credential: parseOAuthCredential$1(hit.value)
-			};
-		}
-	}
-	async #ensurePayload() {
-		const existing = await this.credentials.readRecord(this.key);
-		if (existing !== void 0) return assertVaultRecord(existing);
-		const legacy = await this.#legacyCredential();
-		if (legacy === void 0) return void 0;
-		const id = this.createId();
-		return assertVaultRecord(await this.credentials.modifyRecord(this.key, (current) => {
-			if (current !== void 0) return Promise.resolve(current);
-			return Promise.resolve(grant({
-				version: VERSION,
-				activeId: id,
-				legacyAccountId: id,
-				accounts: [{
-					id,
-					label: DEFAULT_LABEL,
-					credential: legacy.credential
-				}]
-			}));
-		}));
-	}
-	async #modifyPayload(update) {
-		await this.#ensurePayload();
-		let previousLegacy;
-		const payload = assertVaultRecord(await this.credentials.modifyRecord(this.key, async (current) => {
-			if (current === void 0) throw new Error("Codex account vault is not signed in");
-			const payload = assertVaultRecord(current);
-			previousLegacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
-			const next = await update(clone$1(payload));
-			return grant(next);
-		}));
-		const legacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
-		try {
-			if (legacy === void 0) {
-				if (previousLegacy !== void 0) await this.credentials.unset(this.legacyRef);
-			} else if (JSON.stringify(legacy) !== JSON.stringify(previousLegacy)) await this.credentials.set(this.legacyRef, JSON.stringify(legacy));
-		} catch {
-			this.onLegacySyncFailure();
-		}
-		return payload;
-	}
-	list() {
-		return this.#enqueue(async () => {
-			const payload = await this.#ensurePayload();
-			if (payload === void 0) return [];
-			return payload.accounts.map((account) => ({
-				id: account.id,
-				label: account.label,
-				active: account.id === payload.activeId,
-				expiresAt: account.credential.expires,
-				...account.credential.email === void 0 ? {} : { email: account.credential.email }
-			}));
-		});
-	}
-	readActive() {
-		return this.#enqueue(async () => {
-			const payload = await this.#ensurePayload();
-			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
-		});
+async function editImages(values, attachments, signal, messages) {
+	if (!Array.isArray(values) || values.length === 0 || values.length > MAX_REFERENCE_IMAGES) throw new Error(`referenceImages must contain between 1 and ${MAX_REFERENCE_IMAGES} images`);
+	const available = messages === void 0 ? void 0 : sessionImageReferences(messages);
+	const references = values.map((value) => {
+		const id = normalizeAttachmentId(value?.attachmentId);
+		if (id === void 0) invalidAttachmentId(value);
+		if (available === void 0) return referenceOf(value, attachments);
+		const selected = available.get(id);
+		if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Call read_image on the intended image and retry with its returned reference. Do not omit referenceImages or substitute another image.");
+		return referenceOf(selected, attachments);
+	});
+	if (new Set(references.map((value) => value.attachmentId)).size !== references.length) throw new Error("referenceImages must not contain duplicates");
+	const images = [];
+	let totalBytes = 0;
+	for (const reference of references) {
+		const stored = await attachments.readImage(reference, signal);
+		totalBytes += stored.data.byteLength;
+		if (totalBytes > attachments.imageLimits.maxMessageImageBytes) throw new Error("referenceImages exceed the DSH message image limit");
+		images.push({ image_url: `data:${stored.ref.mediaType};base64,${Buffer.from(stored.data).toString("base64")}` });
 	}
-	activeId() {
-		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
-	}
-	add(label, credential) {
-		return this.#enqueue(async () => {
-			const normalizedLabel = normalizeLabel(label);
-			const validated = sanitizeOAuthCredential(credential);
-			await this.#ensurePayload();
-			const id = this.createId();
-			const account = (await this.#modifyPayload((current) => ({
-				...current,
-				activeId: id,
-				accounts: [...current.accounts, {
-					id,
-					label: normalizedLabel,
-					credential: validated
-				}]
-			}))).accounts.find((candidate) => candidate.id === id);
-			return {
-				id,
-				label: account.label,
-				active: true,
-				expiresAt: account.credential.expires,
-				...account.credential.email === void 0 ? {} : { email: account.credential.email }
-			};
-		});
-	}
-	select(id) {
-		return this.#enqueue(async () => {
-			await this.#modifyPayload((current) => {
-				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
-				return {
-					...current,
-					activeId: id
-				};
-			});
-		});
-	}
-	modifyActive(update) {
-		return this.#enqueue(async () => {
-			if (await this.#ensurePayload() === void 0) {
-				const initial = await update(void 0);
-				if (initial === void 0) return void 0;
-				const credential = sanitizeOAuthCredential(initial);
-				await this.credentials.set(this.legacyRef, JSON.stringify(credential));
-				await this.#ensurePayload();
-				return clone$1(credential);
-			}
-			let result;
-			await this.#modifyPayload(async (current) => {
-				const index = current.accounts.findIndex((account) => account.id === current.activeId);
-				const previous = clone$1(current.accounts[index].credential);
-				const next = await update(previous);
-				if (next === void 0) {
-					result = previous;
-					return current;
-				}
-				const credential = sanitizeOAuthCredential(next);
-				if (credential.email === void 0 && previous.email !== void 0) credential.email = previous.email;
-				const accounts = [...current.accounts];
-				accounts[index] = {
-					...accounts[index],
-					credential
-				};
-				result = clone$1(credential);
-				return {
-					...current,
-					accounts
-				};
-			});
-			return result;
-		});
-	}
-	deleteAll() {
-		return this.#enqueue(async () => {
-			await this.credentials.deleteRecord(this.key);
-			await this.credentials.unset(this.legacyRef);
-			for (const ref of this.legacyRefs) await this.credentials.unset(ref);
-		});
-	}
-	remove(id) {
-		return this.#enqueue(async () => {
-			await this.#modifyPayload((current) => {
-				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
-				if (current.accounts.length === 1) throw new Error("Cannot remove the last account; sign out instead");
-				const accounts = current.accounts.filter((account) => account.id !== id);
-				return {
-					...current,
-					activeId: current.activeId === id ? accounts[0].id : current.activeId,
-					legacyAccountId: current.legacyAccountId === id ? void 0 : current.legacyAccountId,
-					accounts
-				};
-			});
-		});
-	}
-};
-//#endregion
-//#region src/credential-store.js
-const PROVIDER$1 = "openai-codex";
-const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
-const clone = (value) => value === void 0 ? void 0 : structuredClone(value);
-function assertProvider(providerId) {
-	if (providerId !== PROVIDER$1) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
+	return images;
 }
-function assertOAuthCredential(value) {
-	if (value === void 0) return void 0;
-	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex credential store received a malformed OAuth credential");
-	return clone(value);
+function imageContent(value) {
+	const label = typeof value.size === "string" && value.size.length > 0 ? `Generated a ${value.size} image.` : "Generated an image.";
+	return [{
+		type: "text",
+		text: value.localPath === void 0 ? label : `${label}\nOriginal PNG saved on the DSH host at: ${JSON.stringify(value.localPath)}. Read this file or copy it to the workspace with a .png extension; this host path is not a browser URL.`
+	}, {
+		type: "image",
+		attachment: imageReference(value.image)
+	}];
 }
-function parseOAuthCredential(value) {
-	try {
-		return assertOAuthCredential(JSON.parse(value));
-	} catch (error) {
-		if (error?.message === "Codex credential store received a malformed OAuth credential") throw error;
-		throw new Error("Codex credential store contains malformed OAuth JSON", { cause: error });
-	}
+function imageOutputSchema() {
+	return {
+		type: "object",
+		additionalProperties: false,
+		properties: {
+			image: {
+				type: "object",
+				required: true,
+				additionalProperties: false,
+				properties: {
+					attachmentId: {
+						type: "string",
+						required: true
+					},
+					mediaType: {
+						type: "string",
+						enum: ["image/png"],
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					width: {
+						type: "integer",
+						required: true
+					},
+					height: {
+						type: "integer",
+						required: true
+					},
+					name: { type: "string" },
+					originalDimensions: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							width: {
+								type: "integer",
+								required: true
+							},
+							height: {
+								type: "integer",
+								required: true
+							}
+						}
+					}
+				}
+			},
+			original: {
+				type: "object",
+				required: true,
+				additionalProperties: false,
+				properties: {
+					assetId: {
+						type: "string",
+						required: true
+					},
+					mediaType: {
+						type: "string",
+						enum: ["image/png"],
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					width: {
+						type: "integer",
+						required: true
+					},
+					height: {
+						type: "integer",
+						required: true
+					},
+					name: {
+						type: "string",
+						required: true
+					},
+					sha256: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			background: { type: "string" },
+			requestedModel: { type: "string" },
+			reportedModel: { type: "string" },
+			requestedSize: { type: "string" },
+			localPath: {
+				type: "string",
+				required: true,
+				description: "Absolute path to the original PNG on the DSH host."
+			},
+			quality: { type: "string" },
+			size: { type: "string" }
+		}
+	};
 }
-/**
-* Adapt DSH's managed string credential service to pi-ai's typed OAuth store.
-* Refresh/login/logout operations are serialized so an older refresh response
-* cannot overwrite a newer rotated token.
-*/
-var DshOAuthCredentialStore = class {
-	#chains = /* @__PURE__ */ new Map();
-	constructor(credentials, ref, legacyRefs = [], options = {}) {
-		if (credentials === void 0 || credentials === null) throw new Error("Codex OAuth requires the DSH credentials service");
-		const expirySkewMs = options.expirySkewMs ?? 0;
-		if (!Number.isFinite(expirySkewMs) || expirySkewMs < 0) throw new Error("Codex OAuth expiry skew must be a non-negative finite number");
-		this.credentials = credentials;
-		this.ref = ref;
-		this.legacyRefs = Object.freeze([...legacyRefs]);
-		this.expirySkewMs = expirySkewMs;
-		this.vault = options.vault;
-	}
-	#enqueue(providerId, operation, options) {
-		assertProvider(providerId);
-		const current = (this.#chains.get(providerId) ?? Promise.resolve()).catch(() => void 0).then(async () => {
-			abortIfNeeded(options);
-			return operation();
-		});
-		const tail = current.catch(() => void 0);
-		this.#chains.set(providerId, tail);
-		tail.finally(() => {
-			if (this.#chains.get(providerId) === tail) this.#chains.delete(providerId);
-		});
-		return current;
-	}
-	async #read(providerId, options) {
-		assertProvider(providerId);
-		abortIfNeeded(options);
-		if (this.vault !== void 0) {
-			const current = await this.vault.readActive();
-			if (current === void 0) return void 0;
-			return this.expirySkewMs === 0 ? current : {
-				...current,
-				expires: current.expires - this.expirySkewMs
+function responseMetadata(value) {
+	const data = Array.isArray(value?.data) ? value.data[0] : void 0;
+	const encoded = record$4(data) ? data.b64_json : void 0;
+	if (typeof encoded !== "string") throw new Error("Codex returned no image data");
+	return {
+		encoded,
+		background: nonEmpty$2(value.background),
+		quality: nonEmpty$2(value.quality),
+		size: nonEmpty$2(value.size),
+		reportedModel: nonEmpty$2(value.model)
+	};
+}
+/** Create the DSH-native image-generation tool backed only by the ChatGPT subscription. */
+function createCodexImageTool(options) {
+	const fetchImage = options.fetch ?? fetch;
+	const attachments = options.attachments;
+	return defineTool({
+		name: CODEX_IMAGE_TOOL_NAME,
+		description: "Generate or edit images only when the user asks for image output, not when merely discussing images. Uses the signed-in Codex subscription. For a new image, omit referenceImages. For edits, copy attachmentId only from the selected session image block; the host supplies its metadata. Never call read_image for an attachmentId or attachment filename. Use read_image only for an actual local file whose reference is not already in the conversation. Never substitute paths, unrelated images, or text-only generation for an edit. For numbered annotations, include the clean source and location-reference image, preserve the requested changes and coordinates in the prompt, and remove guidance markers from the result. If the intended references cannot be identified, ask rather than guessing.",
+		parameters: {
+			model: {
+				type: "string",
+				enum: Object.keys(IMAGE_MODELS),
+				description: "Optional image engine, independent of the conversation model. When omitted, uses the user image setting (initially gpt-image-2). The 2.5 identifiers are experimental subscription candidates; override only when explicitly requested. Never silently retry with another model."
+			},
+			prompt: {
+				type: "string",
+				required: true,
+				description: "A complete, production-ready description of the image to generate."
+			},
+			size: {
+				type: "string",
+				description: "Optional GPT Image 2 output size. Use auto unless the user requests an exact valid widthxheight resolution."
+			},
+			quality: {
+				type: "string",
+				enum: [
+					"auto",
+					"low",
+					"medium",
+					"high",
+					"xhigh",
+					"max"
+				],
+				description: "Optional rendering quality. Use auto unless the user requests draft speed or final quality."
+			},
+			background: {
+				type: "string",
+				enum: [
+					"auto",
+					"transparent",
+					"opaque"
+				],
+				description: "Optional background mode. Request transparent only when the user needs transparency."
+			},
+			referenceImages: {
+				type: "array",
+				description: "Optional references to 1-5 selected images. For session images provide only attachmentId; the host resolves trusted metadata. Omit only for a new image; never drop an invalid reference to bypass editing.",
+				items: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						attachmentId: {
+							type: "string",
+							required: true,
+							description: "Copy the complete attachmentId from the image block or read_image result: sha256:<64 lowercase hex>. Never pass a workspace path, absolute path, or filename. A bare 64-character hex digest is accepted and normalized to sha256:<64 lowercase hex>."
+						},
+						mediaType: {
+							type: "string",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						bytes: {
+							type: "integer",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						width: {
+							type: "integer",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						height: {
+							type: "integer",
+							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+						},
+						name: { type: "string" },
+						originalDimensions: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								width: {
+									type: "integer",
+									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+								},
+								height: {
+									type: "integer",
+									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
+		output: {
+			schema: imageOutputSchema(),
+			render: (_args, value) => imageContent(value),
+			presentationMeta: (_args, value) => ({
+				kind: "codex-subscription-image",
+				schemaVersion: 1,
+				original: value.original,
+				...value.requestedModel === void 0 ? {} : { requestedModel: value.requestedModel },
+				...value.reportedModel === void 0 ? {} : { reportedModel: value.reportedModel },
+				...value.requestedSize === void 0 ? {} : { requestedSize: value.requestedSize }
+			})
+		},
+		timeoutMs: 300 * 1e3,
+		isConcurrencySafe: () => false,
+		async execute(args, exec) {
+			assertImageOperation(options.getFeatures?.(), args.referenceImages !== void 0);
+			const defaults = readImageDefaults(options.getFeatures?.());
+			args = {
+				...args,
+				model: args.model ?? defaults.imageModel,
+				quality: args.quality ?? defaults.imageQuality
 			};
-		}
-		let hit = await this.credentials.resolve(this.ref);
-		if (hit?.value === void 0 || hit.value === "") for (const legacyRef of this.legacyRefs) {
-			const legacy = await this.credentials.resolve(legacyRef);
-			if (legacy?.value === void 0 || legacy.value === "") continue;
-			const migrated = parseOAuthCredential(legacy.value);
-			await this.credentials.set(this.ref, JSON.stringify(migrated));
-			await this.credentials.unset(legacyRef);
-			hit = { value: JSON.stringify(migrated) };
-			break;
-		}
-		abortIfNeeded(options);
-		if (hit?.value === void 0 || hit.value === "") return void 0;
-		const credential = parseOAuthCredential(hit.value);
-		return this.expirySkewMs === 0 ? credential : {
-			...credential,
-			expires: credential.expires - this.expirySkewMs
-		};
-	}
-	read(providerId, options) {
-		return this.#enqueue(providerId, () => this.#read(providerId, options), options);
-	}
-	async list(options) {
-		abortIfNeeded(options);
-		return await this.read(PROVIDER$1, options) === void 0 ? [] : [{
-			providerId: PROVIDER$1,
-			type: "oauth"
-		}];
-	}
-	modify(providerId, update, options) {
-		return this.#enqueue(providerId, async () => {
-			if (this.vault !== void 0) {
-				const next = await this.vault.modifyActive(async (current) => {
-					const visible = current === void 0 || this.expirySkewMs === 0 ? current : {
-						...current,
-						expires: current.expires - this.expirySkewMs
-					};
-					const updated = await update(clone(visible));
-					return updated === void 0 ? void 0 : assertOAuthCredential(updated);
+			const prompt = nonEmpty$2(args.prompt);
+			if (prompt === void 0) throw new Error("prompt must be a non-empty string");
+			const imageOptions = normalizeImageOptions(args);
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, exec.signal);
+			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
+			if (!attachments.imageLimits.mediaTypes.includes("image/png")) throw new Error("This DSH installation does not accept PNG image attachments");
+			const maximumBytes = Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
+			const editing = args.referenceImages !== void 0;
+			const sessionMessages = editing && typeof options.getSessionMessages === "function" ? await options.getSessionMessages(exec.agent?.id) : void 0;
+			const images = editing ? await editImages(args.referenceImages, attachments, exec.signal, sessionMessages ?? (options.getSessionMessages ? [] : void 0)) : void 0;
+			let response;
+			assertImageOperation(options.getFeatures?.(), editing);
+			try {
+				response = await fetchImage(editing ? CODEX_IMAGE_EDIT_URL : CODEX_IMAGE_GENERATION_URL, {
+					method: "POST",
+					redirect: "error",
+					headers: {
+						authorization: `Bearer ${access}`,
+						"chatgpt-account-id": accountId,
+						accept: "application/json",
+						"content-type": "application/json",
+						originator: "pi",
+						"x-codex-image-turn-id": String(exec.callId),
+						"user-agent": USER_AGENT
+					},
+					body: JSON.stringify({
+						...images === void 0 ? {} : { images },
+						prompt,
+						background: imageOptions.background,
+						model: resolveImageModel(args.model),
+						quality: imageOptions.quality,
+						size: imageOptions.size
+					}),
+					signal: exec.signal
 				});
-				abortIfNeeded(options);
-				return clone(next);
+			} catch (error) {
+				if (exec.signal.aborted) throw exec.signal.reason;
+				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
 			}
-			const current = await this.#read(providerId, options);
-			const next = await update(clone(current));
-			abortIfNeeded(options);
-			if (next === void 0) return current;
-			const validated = assertOAuthCredential(next);
-			await this.credentials.set(this.ref, JSON.stringify(validated));
-			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
-			abortIfNeeded(options);
-			return clone(validated);
-		}, options);
-	}
-	delete(providerId, options) {
-		return this.#enqueue(providerId, async () => {
-			if (this.vault !== void 0) {
-				await this.vault.deleteAll();
-				abortIfNeeded(options);
-				return;
+			if (!response.ok) {
+				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
+				if (response.status === 429) throw new Error("Codex image generation quota is unavailable");
+				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})`);
 			}
-			await this.credentials.unset(this.ref);
-			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
-			abortIfNeeded(options);
-		}, options);
-	}
-};
-/** Return only account state that is safe to expose to the browser client. */
-function createCodexAuthService(models, store, options = {}) {
-	const runLogin = options.runLogin ?? ((run) => run());
-	const accountVault = options.accountVault;
-	const createLoginModels = options.createLoginModels;
-	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
-	return Object.freeze({
-		async status(options) {
-			const current = await store.read(PROVIDER$1, options);
-			const accounts = await accountVault?.list();
-			if (current === void 0) return {
-				authenticated: false,
-				provider: PROVIDER$1,
-				...accounts === void 0 ? {} : { accounts }
-			};
-			return {
-				authenticated: true,
-				provider: PROVIDER$1,
-				type: "oauth",
-				expiresAt: current.expires,
-				...accounts === void 0 ? {} : { accounts }
+			const metadata = responseMetadata(await readJsonWithin(response, encodedLimit(maximumBytes) + RESPONSE_ENVELOPE_BYTES));
+			const data = decodeCodexPng(metadata.encoded, maximumBytes);
+			const sessionId = exec.agent?.id;
+			if (sessionId === void 0) throw new Error("Codex image generation requires a session-owned tool call");
+			const original = await options.originalImages.save(String(sessionId), data);
+			let ref;
+			try {
+				ref = await attachments.saveImage({
+					data,
+					mediaType: "image/png",
+					name: "codex-generated.png"
+				});
+			} catch (error) {
+				await options.originalImages.remove(original);
+				throw error;
+			}
+			const result = {
+				requestedModel: resolveImageModel(args.model),
+				requestedSize: imageOptions.size,
+				...metadata.reportedModel === void 0 ? {} : { reportedModel: metadata.reportedModel },
+				image: imageReference(ref),
+				original,
+				localPath: options.originalImages.originalPath(original.assetId),
+				...metadata.background === void 0 ? {} : { background: metadata.background },
+				...metadata.quality === void 0 ? {} : { quality: metadata.quality },
+				size: `${original.width}x${original.height}`
 			};
+			if (exec.parent !== void 0) exec.deferContext(createUserMessage({
+				content: imageContent(result),
+				source: { kind: "codex-subscription-image" }
+			}));
+			return result;
+		}
+	});
+}
+//#endregion
+//#region src/sketch-agent-tool.js
+const MAX_REFERENCE_BYTES = 14e5;
+function createSketchAgentTool(bridge, attachments, getSessionMessages = () => []) {
+	return defineTool({
+		name: "codex_sketch",
+		description: "Edit the sketch board in this session using native editable strokes and layers. Use for @sketch requests and explicit follow-up edits to that drawing. The toolbar pen button is for manual drawing; do not require the user to open it. Start with inspect for the runId, documentId, revision and command reference. Draw with the svg op whenever possible: one SVG document per stage (paths, shapes, groups, transforms; see the reference from inspect) is far faster and richer than hand-placed strokes, and still becomes native editable strokes. Draw the shapes, hair, clothing and lettering outlines of every layer with svg; use stroke commands only for small corrections and native text. Apply atomic batches and preview between stages. When the user attached a reference image, call reference with its attachmentId once after inspect to put it on the board as a hidden picture layer. When a reference picture is on the board, keep its layer hidden while drawing (compare shows it anyway), measure its key positions with preview grid, draw big shapes first, and after each stage check preview compare and fix the largest offset before adding detail. For repeated details such as hair strands or lace, generate the SVG with a script instead of placing each one by hand. and call finish to save the finished draft and release the editing lock. save is only a checkpoint. Closing the board does not stop drawing. If the user stops drawing, do not retry. Never generates AI images, sends messages or attaches images automatically. Inspect automatically opens the board in the currently viewed session. Do not ask the user to open it first. If the session is not visible in DSH, ask them to switch to it. On timeout inspect before retrying; reuse the exact requestId only for the same request.",
+		parameters: {
+			action: {
+				type: "string",
+				required: true,
+				enum: [
+					"inspect",
+					"apply",
+					"reference",
+					"preview",
+					"save",
+					"finish"
+				]
+			},
+			runId: {
+				type: "string",
+				description: "From inspect; required for all other actions. Never reuse a stopped run."
+			},
+			documentId: {
+				type: "string",
+				description: "From inspect; required except for inspect."
+			},
+			revision: {
+				type: "integer",
+				description: "From latest response; required for apply/reference/save/finish."
+			},
+			requestId: {
+				type: "string",
+				description: "Unique id for apply/reference/save/finish; exact retries are deduplicated. After timeout inspect recentRequests before repeating a write."
+			},
+			commands: {
+				oneOf: [sketchCommandArray, { type: "string" }],
+				description: "Prefer a native command array. Legacy JSON string also accepted. Required for apply. Use named objects and update existing IDs; prefer Bezier start + segments (control1/control2/end) for curves, not hundreds of pen points."
+			},
+			name: {
+				type: "string",
+				description: "Draft name for save/finish."
+			},
+			attachmentId: {
+				type: "string",
+				description: "reference only: the attachmentId of an image the user attached to this session (copy it from the image block, never a path or filename). It is added to the board as a hidden picture layer, ready for preview compare."
+			},
+			compare: {
+				type: "boolean",
+				description: "preview only: blend the drawing 50/50 with the reference picture layer on the board, so offsets show as ghosting. Needs a picture layer; if there is none, ask the user to add the reference with the pictures button."
+			},
+			grid: {
+				type: "boolean",
+				description: "preview only: overlay a labelled grid every 100 canvas pixels, to read positions and sizes instead of guessing them."
+			},
+			offset: {
+				type: "integer",
+				description: "inspect only: object list offset, default 0. Follow nextOffset for further pages."
+			},
+			objectId: {
+				type: "string",
+				description: "inspect only: return full editable geometry for this object, in layer (defaults to active layer)."
+			},
+			layer: {
+				type: "integer",
+				description: "inspect only: layer containing objectId."
+			}
 		},
-		login(interaction, input = {}) {
-			if (input.label !== void 0) {
-				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
-				return runLogin(async () => {
-					const pending = createPendingStore();
-					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
-					const credential = pending.credential();
-					if (credential === void 0) throw new Error("Codex login did not return credentials");
-					await accountVault.add(input.label, credential);
+		timeoutMs: 25e3,
+		isConcurrencySafe: () => false,
+		async execute(args, exec) {
+			const sessionId = exec.agent?.id;
+			if (typeof sessionId !== "string") throw Error("A session-owned sketch call is required");
+			const request = { ...args };
+			delete request.attachmentId;
+			if (args.action === "apply") try {
+				request.commands = typeof args.commands === "string" ? JSON.parse(args.commands) : args.commands;
+				if (!Array.isArray(request.commands)) throw Error();
+			} catch {
+				throw Error("commands must be a native array or JSON array string");
+			}
+			if (args.action === "reference") {
+				const image = await readSessionImage(args.attachmentId, attachments, exec.signal, await getSessionMessages(sessionId));
+				if (image.data.byteLength > MAX_REFERENCE_BYTES) throw Error("The reference image is too large to send to the board; ask the user to add it with the pictures button on the board");
+				request.image = `data:${image.mediaType};base64,${Buffer.from(image.data).toString("base64")}`;
+				request.name = image.name ?? "reference";
+			}
+			const value = await bridge.request(sessionId, request, exec.signal);
+			if (value.png) {
+				if (!/^data:image\/png;base64,/.test(value.png) || value.png.length > 8 * 1024 * 1024) throw Error("Invalid sketch preview");
+				const image = await attachments.saveImage({
+					data: new Uint8Array(Buffer.from(value.png.split(",")[1], "base64")),
+					mediaType: "image/png",
+					name: "sketch-preview.png"
 				});
+				const { png, ...snapshot } = value;
+				return {
+					...snapshot,
+					image
+				};
 			}
-			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
-		},
-		async select(id) {
-			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
-			await accountVault.select(id);
-			return this.status();
-		},
-		async remove(id) {
-			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
-			await accountVault.remove(id);
-			return this.status();
+			return value;
 		},
-		logout(options) {
-			return models.logout(PROVIDER$1, options);
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify({
+					...value,
+					image: void 0
+				})
+			}, ...value.image ? [{
+				type: "image",
+				attachment: value.image
+			}] : []]
 		}
 	});
 }
 //#endregion
-//#region src/external-url.js
-const OPENAI_AUTH_ORIGIN = "https://auth.openai.com";
-/** Validate the only external origin this plugin may launch. */
-function assertCodexAuthUrl(value) {
-	let url;
+//#region src/sketch-codec-route.js
+function registerSketchCodec(connection) {
+	let source;
+	return connection.fetch.register({
+		path: "/api/codex-subscription/sketch-psd-worker",
+		methods: ["GET"],
+		requestBody: "buffered",
+		async fetch() {
+			source ??= await readFile(new URL("./sketch-psd-worker.js", import.meta.url));
+			return new Response(source, { headers: {
+				"content-type": "text/javascript; charset=utf-8",
+				"cache-control": "no-store"
+			} });
+		}
+	});
+}
+//#endregion
+//#region src/account-vault.js
+const VERSION = 1;
+const DEFAULT_LABEL = "Account 1";
+const clone$1 = (value) => value === void 0 ? void 0 : structuredClone(value);
+const EMAIL_MAX_LENGTH = 254;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+/** Keep only a bounded, display-safe email address from a trusted OAuth result. */
+function normalizeAccountEmail(value) {
+	if (typeof value !== "string") return void 0;
+	const email = value.trim();
+	return email.length > 0 && email.length <= EMAIL_MAX_LENGTH && EMAIL_PATTERN.test(email) ? email : void 0;
+}
+function decodeJwtPayload(access) {
+	if (typeof access !== "string") return void 0;
+	const encoded = access.split(".")[1];
+	if (typeof encoded !== "string" || encoded.length === 0) return void 0;
 	try {
-		url = new URL(value);
+		return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
 	} catch {
-		throw new Error("Codex auth URL is invalid");
+		return;
 	}
-	if (url.protocol !== "https:") throw new Error("Codex auth URL must use HTTPS");
-	if (url.origin !== OPENAI_AUTH_ORIGIN || url.username !== "" || url.password !== "") throw new Error("Codex auth URL must use the OpenAI auth origin");
-	return url.href;
 }
-/** Return a shell-free native opener command for the current desktop. */
-function commandForCodexAuthUrl(value, platform = process.platform) {
-	const url = assertCodexAuthUrl(value);
-	if (platform === "win32") return {
-		file: "rundll32.exe",
-		args: ["url.dll,FileProtocolHandler", url],
-		shell: false
-	};
-	if (platform === "darwin") return {
-		file: "open",
-		args: [url],
-		shell: false
-	};
-	if (platform === "linux") return {
-		file: "xdg-open",
-		args: [url],
-		shell: false
+function emailFromAccessToken(access) {
+	const payload = decodeJwtPayload(access);
+	return normalizeAccountEmail(payload?.["https://api.openai.com/profile"]?.email ?? payload?.email);
+}
+/** Normalize the one non-secret account attribute that may cross the UI boundary. */
+function sanitizeOAuthCredential(value) {
+	const credential = assertOAuthCredential$1(value);
+	const email = emailFromAccessToken(credential.access) ?? normalizeAccountEmail(credential.email);
+	if (email === void 0) {
+		delete credential.email;
+		return credential;
+	}
+	return {
+		...credential,
+		email
 	};
-	throw new Error(`Codex auth URL opener is unsupported on ${platform}`);
 }
-function openCodexAuthUrl(value, options = {}) {
-	const command = commandForCodexAuthUrl(value, options.platform);
-	const spawnProcess = options.spawn ?? spawn;
-	return new Promise((resolve, reject) => {
-		const child = spawnProcess(command.file, command.args, {
-			detached: true,
-			stdio: "ignore",
-			windowsHide: true,
-			shell: command.shell
-		});
-		child.once("error", reject);
-		child.once("spawn", () => {
-			child.unref();
-			resolve();
-		});
-	});
+function assertOAuthCredential$1(value) {
+	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex account vault received a malformed OAuth credential");
+	return clone$1(value);
 }
-//#endregion
-//#region src/login-coordinator.js
-const LOGIN_METHODS = /* @__PURE__ */ new Set(["browser", "device_code"]);
-const TERMINAL_PHASES = /* @__PURE__ */ new Set([
-	"authenticated",
-	"failed",
-	"cancelled"
-]);
-const publicClone = (value) => structuredClone(value);
-const asObject = (value) => value !== null && typeof value === "object" ? value : {};
-const ok = (value) => ({
-	ok: true,
-	value
-});
-const badRequest = (message) => ({
-	ok: false,
-	error: {
-		code: "bad-request",
-		message,
-		details: { issues: [] }
-	}
-});
-const accountStatusError = (message) => ({
-	ok: false,
-	error: {
-		code: "internal",
-		message,
-		details: { issues: [] }
+function parseOAuthCredential$1(value) {
+	try {
+		return assertOAuthCredential$1(JSON.parse(value));
+	} catch (error) {
+		if (error?.message === "Codex account vault received a malformed OAuth credential") throw error;
+		throw new Error("Codex account vault contains malformed OAuth JSON", { cause: error });
 	}
-});
-const classifyAccountStatusError = (error) => {
-	const message = error instanceof Error ? error.message : "";
-	if (/malformed (?:OAuth|grant|account vault)|received a malformed OAuth|contains malformed OAuth/iu.test(message)) return ["credential-malformed", "Codex account credentials are malformed"];
-	if (/credential|account vault|readRecord|credential store|credentials service/iu.test(message)) return ["credential-unavailable", "Codex account credentials are unavailable"];
-	const code = typeof error?.code === "string" ? error.code.toUpperCase() : "";
-	if (error?.name === "TimeoutError" || [
-		"TIMEOUT",
-		"ETIMEDOUT",
-		"UND_ERR_CONNECT_TIMEOUT"
-	].includes(code)) return ["transport", "Codex account status service is unavailable"];
-	if ([
-		"ECONNRESET",
-		"ECONNREFUSED",
-		"ENOTFOUND",
-		"EAI_AGAIN",
-		"NETWORK",
-		"NETWORK_ERROR",
-		"TRANSPORT"
-	].includes(code) || error?.name === "NetworkError") return ["transport", "Codex account status service is unavailable"];
-	return ["unknown", "Could not read Codex account status"];
-};
-const deferred = () => {
-	let resolve;
-	let reject;
+}
+function normalizeLabel(value) {
+	if (typeof value !== "string") throw new Error("Codex account label must be text");
+	const label = value.trim().replace(/\s+/gu, " ");
+	if (label.length === 0 || label.length > 48) throw new Error("Codex account label must contain 1 to 48 characters");
+	return label;
+}
+function assertVaultRecord(record) {
+	if (record?.kind !== "grant" || record.payload?.version !== VERSION || typeof record.payload.activeId !== "string" || !Array.isArray(record.payload.accounts) || record.payload.accounts.length === 0) throw new Error("Codex account vault contains a malformed grant record");
+	const ids = /* @__PURE__ */ new Set();
+	const accounts = record.payload.accounts.map((account) => {
+		if (account === null || typeof account !== "object" || typeof account.id !== "string" || account.id.length === 0 || ids.has(account.id)) throw new Error("Codex account vault contains a malformed account id");
+		ids.add(account.id);
+		return {
+			id: account.id,
+			label: normalizeLabel(account.label),
+			credential: sanitizeOAuthCredential(account.credential)
+		};
+	});
+	if (!ids.has(record.payload.activeId)) throw new Error("Codex account vault active account is missing");
+	const legacyAccountId = record.payload.legacyAccountId;
+	if (legacyAccountId !== void 0 && !ids.has(legacyAccountId)) throw new Error("Codex account vault legacy account is missing");
 	return {
-		promise: new Promise((onResolve, onReject) => {
-			resolve = onResolve;
-			reject = onReject;
-		}),
-		resolve,
-		reject
+		version: VERSION,
+		activeId: record.payload.activeId,
+		legacyAccountId,
+		accounts
 	};
-};
-const publicPrompt = (prompt) => ({
-	type: prompt.type,
-	message: String(prompt.message ?? ""),
-	...typeof prompt.placeholder === "string" ? { placeholder: prompt.placeholder } : {}
-});
-function classifyLoginFailure(error) {
-	const message = error instanceof Error ? error.message : "";
-	if (/token exchange failed/iu.test(message)) return "token-exchange";
-	if (/fetch failed|\b(?:ECONN|ENOTFOUND|ETIMEDOUT|CERT_|socket|network)\b/iu.test(message)) return "network";
-	if (/extract accountId|account[_ -]?id/iu.test(message)) return "account-claim";
-	if (/credential|credentials-local|OAuth JSON/iu.test(message)) return "credential-store";
-	if (/Missing authorization code|State mismatch|callback/iu.test(message)) return "callback";
-	return "provider";
 }
-/** Own one host-side login without exposing tokens to the browser client. */
-var CodexLoginCoordinator = class {
-	#sessions = /* @__PURE__ */ new Map();
-	#activeId;
-	constructor(auth, options = {}) {
-		this.auth = auth;
-		this.createId = options.createId ?? (() => crypto.randomUUID());
+const grant = (payload) => ({
+	kind: "grant",
+	payload
+});
+var PendingOAuthCredentialStore = class {
+	#credential;
+	async read(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		return clone$1(this.#credential);
 	}
-	async accountStatus(options) {
-		return publicClone(await this.auth.status(options));
+	async list() {
+		return this.#credential === void 0 ? [] : [{
+			providerId: "openai-codex",
+			type: "oauth"
+		}];
 	}
-	supportState() {
-		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
-		if (active === void 0) return { phase: "idle" };
-		return {
-			method: active.view.method,
-			phase: active.view.phase,
-			...active.view.phase === "failed" ? { failure: classifyLoginFailure(active.hostError) } : {}
-		};
+	async modify(providerId, update) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		const next = await update(clone$1(this.#credential));
+		if (next !== void 0) this.#credential = sanitizeOAuthCredential(next);
+		return clone$1(this.#credential);
 	}
-	async start({ method, label }) {
-		if (!LOGIN_METHODS.has(method)) throw new Error(`unsupported Codex login method: ${String(method)}`);
-		if (label !== void 0 && (typeof label !== "string" || label.trim().length === 0 || label.trim().length > 48)) throw new Error("unsupported Codex account label");
-		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
-		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) {
-			active.view = {
-				id: active.view.id,
-				provider: "openai-codex",
-				method: active.view.method,
-				phase: "cancelled",
-				authenticated: false
-			};
-			active.controller.abort(/* @__PURE__ */ new Error("Codex login replaced by a new attempt"));
-		}
-		if (active !== void 0) this.#sessions.delete(active.view.id);
-		const id = this.createId();
-		const ready = deferred();
-		const controller = new AbortController();
-		const session = {
-			controller,
-			prompt: void 0,
-			ready,
-			view: {
-				id,
-				provider: "openai-codex",
-				method,
-				phase: "starting",
-				authenticated: false
-			}
-		};
-		this.#sessions.set(id, session);
-		this.#activeId = id;
-		const publishReady = () => ready.resolve(publicClone(session.view));
-		const interaction = {
-			signal: controller.signal,
-			prompt: async (prompt) => {
-				controller.signal.throwIfAborted();
-				if (prompt.type === "select") return method;
-				if (![
-					"manual_code",
-					"text",
-					"secret"
-				].includes(prompt.type)) throw new Error(`unsupported Codex auth prompt: ${String(prompt.type)}`);
-				const answer = deferred();
-				session.prompt = answer;
-				session.view = {
-					...session.view,
-					phase: "waiting_input",
-					prompt: publicPrompt(prompt)
-				};
-				const abortPrompt = () => answer.reject(controller.signal.reason ?? /* @__PURE__ */ new Error("login cancelled"));
-				controller.signal.addEventListener("abort", abortPrompt, { once: true });
-				prompt.signal?.addEventListener("abort", abortPrompt, { once: true });
-				publishReady();
-				try {
-					return await answer.promise;
-				} finally {
-					controller.signal.removeEventListener("abort", abortPrompt);
-					prompt.signal?.removeEventListener("abort", abortPrompt);
-					if (session.prompt === answer) session.prompt = void 0;
-				}
-			},
-			notify: (event) => {
-				if (controller.signal.aborted) return;
-				if (event.type === "auth_url") session.view = {
-					...session.view,
-					phase: "waiting_browser",
-					authUrl: assertCodexAuthUrl(event.url),
-					...typeof event.instructions === "string" ? { instructions: event.instructions } : {}
-				};
-				else if (event.type === "device_code") session.view = {
-					...session.view,
-					phase: "waiting_device",
-					deviceCode: {
-						userCode: event.userCode,
-						verificationUri: assertCodexAuthUrl(event.verificationUri),
-						...typeof event.intervalSeconds === "number" ? { intervalSeconds: event.intervalSeconds } : {},
-						...typeof event.expiresInSeconds === "number" ? { expiresInSeconds: event.expiresInSeconds } : {}
-					}
-				};
-				else session.view = {
-					...session.view,
-					message: String(event.message ?? "")
-				};
-				publishReady();
-			}
-		};
-		session.run = Promise.resolve().then(() => this.auth.login(interaction, label === void 0 ? {} : { label: label.trim() })).then(async () => {
-			if (controller.signal.aborted) return;
-			const status = await this.auth.status();
-			session.view = {
-				id,
-				provider: "openai-codex",
-				method,
-				phase: "authenticated",
-				authenticated: status.authenticated === true,
-				...typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}
-			};
-		}).catch(async (error) => {
-			if (controller.signal.aborted) {
-				session.view = {
-					id,
-					provider: "openai-codex",
-					method,
-					phase: "cancelled",
-					authenticated: false
-				};
-				return;
-			}
-			try {
-				if (label !== void 0) throw error;
-				const status = await this.auth.status();
-				if (status.authenticated === true) {
-					session.view = {
-						id,
-						provider: "openai-codex",
-						method,
-						phase: "authenticated",
-						authenticated: true,
-						...typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}
-					};
-					return;
-				}
-			} catch {}
-			session.view = {
-				id,
-				provider: "openai-codex",
-				method,
-				phase: "failed",
-				authenticated: false,
-				error: "Codex login failed"
-			};
-			session.hostError = error;
-		}).finally(publishReady);
-		return ready.promise;
+	async delete(providerId) {
+		if (providerId !== "openai-codex") throw new Error("Pending Codex login received an unknown provider");
+		this.#credential = void 0;
 	}
-	read(id) {
-		const session = this.#sessions.get(id);
-		if (session === void 0) throw new Error("unknown Codex login");
-		return publicClone(session.view);
+	credential() {
+		return clone$1(this.#credential);
 	}
-	async submit({ id, value }) {
-		const session = this.#sessions.get(id);
-		if (session === void 0) throw new Error("unknown Codex login");
-		if (session.prompt === void 0 || session.view.phase !== "waiting_input") throw new Error("Codex login is not waiting for input");
-		if (typeof value !== "string" || value.trim() === "") throw new Error("Codex login input is empty");
-		const answer = session.prompt;
-		session.prompt = void 0;
-		session.view = {
-			...session.view,
-			phase: session.view.authUrl === void 0 ? "starting" : "waiting_browser",
-			prompt: void 0
-		};
-		answer.resolve(value);
-		return this.read(id);
+};
+/**
+* Multi-account owner state stored in DSH's atomic plugin credential record.
+* The old single-account reference remains as a rollback source and is kept in
+* sync whenever that imported account rotates its refresh token.
+*/
+var DshOAuthAccountVault = class {
+	#tail = Promise.resolve();
+	constructor(credentials, options) {
+		if (credentials === void 0 || credentials === null || typeof credentials.readRecord !== "function" || typeof credentials.modifyRecord !== "function") throw new Error("Codex multi-account requires DSH credential records");
+		this.credentials = credentials;
+		this.key = options.key;
+		this.legacyRef = options.legacyRef;
+		this.legacyRefs = Object.freeze([...options.legacyRefs ?? []]);
+		this.createId = options.createId ?? randomUUID;
+		this.onLegacySyncFailure = options.onLegacySyncFailure ?? (() => {});
 	}
-	async cancel(id) {
-		const session = this.#sessions.get(id);
-		if (session === void 0) throw new Error("unknown Codex login");
-		if (!TERMINAL_PHASES.has(session.view.phase)) {
-			session.view = {
-				id,
-				provider: "openai-codex",
-				method: session.view.method,
-				phase: "cancelled",
-				authenticated: false
+	#enqueue(operation) {
+		const current = this.#tail.catch(() => void 0).then(operation);
+		this.#tail = current.catch(() => void 0);
+		return current;
+	}
+	async #legacyCredential() {
+		for (const ref of [this.legacyRef, ...this.legacyRefs]) {
+			const hit = await this.credentials.resolve(ref);
+			if (hit?.value === void 0 || hit.value === "") continue;
+			return {
+				ref,
+				credential: parseOAuthCredential$1(hit.value)
 			};
-			session.controller.abort(/* @__PURE__ */ new Error("Codex login cancelled"));
 		}
-		return this.read(id);
 	}
-	async logout(options) {
-		if (this.#activeId !== void 0) {
-			const active = this.#sessions.get(this.#activeId);
-			if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) await this.cancel(active.view.id);
+	async #ensurePayload() {
+		const existing = await this.credentials.readRecord(this.key);
+		if (existing !== void 0) return assertVaultRecord(existing);
+		const legacy = await this.#legacyCredential();
+		if (legacy === void 0) return void 0;
+		const id = this.createId();
+		return assertVaultRecord(await this.credentials.modifyRecord(this.key, (current) => {
+			if (current !== void 0) return Promise.resolve(current);
+			return Promise.resolve(grant({
+				version: VERSION,
+				activeId: id,
+				legacyAccountId: id,
+				accounts: [{
+					id,
+					label: DEFAULT_LABEL,
+					credential: legacy.credential
+				}]
+			}));
+		}));
+	}
+	async #modifyPayload(update) {
+		await this.#ensurePayload();
+		let previousLegacy;
+		const payload = assertVaultRecord(await this.credentials.modifyRecord(this.key, async (current) => {
+			if (current === void 0) throw new Error("Codex account vault is not signed in");
+			const payload = assertVaultRecord(current);
+			previousLegacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+			const next = await update(clone$1(payload));
+			return grant(next);
+		}));
+		const legacy = payload.accounts.find((account) => account.id === payload.legacyAccountId)?.credential;
+		try {
+			if (legacy === void 0) {
+				if (previousLegacy !== void 0) await this.credentials.unset(this.legacyRef);
+			} else if (JSON.stringify(legacy) !== JSON.stringify(previousLegacy)) await this.credentials.set(this.legacyRef, JSON.stringify(legacy));
+		} catch {
+			this.onLegacySyncFailure();
 		}
-		await this.auth.logout(options);
-		return this.accountStatus(options);
+		return payload;
 	}
-	async selectAccount(id) {
-		return publicClone(await this.auth.select(id));
+	list() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			if (payload === void 0) return [];
+			return payload.accounts.map((account) => ({
+				id: account.id,
+				label: account.label,
+				active: account.id === payload.activeId,
+				expiresAt: account.credential.expires,
+				...account.credential.email === void 0 ? {} : { email: account.credential.email }
+			}));
+		});
 	}
-	async removeAccount(id) {
-		return publicClone(await this.auth.remove(id));
+	readActive() {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
+		});
 	}
-};
-/** Map the loopback-only DSH Connection channel onto the coordinator. */
-function createCodexRpcHandler(coordinator, options = {}) {
-	const openExternal = options.openExternal;
-	return async (endpoint, payload, signal) => {
-		try {
-			signal.throwIfAborted();
-			const input = asObject(payload);
-			if (endpoint === "status") try {
-				return ok(await coordinator.accountStatus({ signal }));
-			} catch (error) {
-				if (signal.aborted) throw error;
-				const [, message] = classifyAccountStatusError(error);
-				return accountStatusError(message);
-			}
-			if (endpoint === "login/start") {
-				const started = await coordinator.start({
-					method: input.method,
-					label: input.label
-				});
-				if (input.openExternal !== true) return ok(started);
-				const url = started.authUrl ?? started.deviceCode?.verificationUri;
-				if (typeof url !== "string" || openExternal === void 0) return ok({
-					...started,
-					externalOpened: false
-				});
-				try {
-					await openExternal(url);
-					return ok({
-						...started,
-						externalOpened: true
-					});
-				} catch {
-					return ok({
-						...started,
-						externalOpened: false
-					});
-				}
-			}
-			if (endpoint === "login/status") return ok(coordinator.read(input.id));
-			if (endpoint === "login/submit") return ok(await coordinator.submit({
-				id: input.id,
-				value: input.value
-			}));
-			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
-			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
-			if (endpoint === "account/select") return ok(await coordinator.selectAccount(input.id));
-			if (endpoint === "account/remove") return ok(await coordinator.removeAccount(input.id));
-			return badRequest(`unknown Codex auth endpoint: ${endpoint}`);
-		} catch (error) {
-			if (signal.aborted) throw error;
-			const message = error instanceof Error && /^(unknown|unsupported|a Codex|Codex login)/.test(error.message) ? error.message : "Codex request failed";
-			return badRequest(message);
-		}
-	};
-}
-//#endregion
-//#region src/transport-failure.js
-function normalizeTransportEvent(event, signal) {
-	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
-	const message = event.error?.errorMessage;
-	if (typeof message !== "string" || !/^WebSocket closed (?:1006|1011|1012|1013)(?:\s|$)/.test(message)) return event;
-	return {
-		...event,
-		error: {
-			...event.error,
-			errorMessage: `Network transport failure: ${message}`
-		}
-	};
-}
-//#endregion
-//#region src/pi-ai-runtime.js
-const FAST_SERVICE_TIER = "priority";
-const ULTRAFAST_SERVICE_TIER = "ultrafast";
-/** Apply the chosen detail to user and tool-result images after the provider assembles the request. */
-function withInputImageDetail(payload, detail) {
-	if (!Array.isArray(payload.input)) return payload;
-	let changed = false;
-	const input = payload.input.map((item) => {
-		const field = Array.isArray(item?.content) ? "content" : ["function_call_output", "custom_tool_call_output"].includes(item?.type) && Array.isArray(item.output) ? "output" : void 0;
-		if (field === void 0) return item;
-		let itemChanged = false;
-		const parts = item[field].map((part) => {
-			if (part?.type !== "input_image" || part.detail === detail) return part;
-			itemChanged = true;
+	activeId() {
+		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
+	}
+	add(label, credential) {
+		return this.#enqueue(async () => {
+			const normalizedLabel = normalizeLabel(label);
+			const validated = sanitizeOAuthCredential(credential);
+			await this.#ensurePayload();
+			const id = this.createId();
+			const account = (await this.#modifyPayload((current) => ({
+				...current,
+				activeId: id,
+				accounts: [...current.accounts, {
+					id,
+					label: normalizedLabel,
+					credential: validated
+				}]
+			}))).accounts.find((candidate) => candidate.id === id);
 			return {
-				...part,
-				detail
+				id,
+				label: account.label,
+				active: true,
+				expiresAt: account.credential.expires,
+				...account.credential.email === void 0 ? {} : { email: account.credential.email }
 			};
 		});
-		if (!itemChanged) return item;
-		changed = true;
-		return {
-			...item,
-			[field]: parts
-		};
-	});
-	return changed ? {
-		...payload,
-		input
-	} : payload;
+	}
+	select(id) {
+		return this.#enqueue(async () => {
+			await this.#modifyPayload((current) => {
+				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
+				return {
+					...current,
+					activeId: id
+				};
+			});
+		});
+	}
+	modifyActive(update) {
+		return this.#enqueue(async () => {
+			if (await this.#ensurePayload() === void 0) {
+				const initial = await update(void 0);
+				if (initial === void 0) return void 0;
+				const credential = sanitizeOAuthCredential(initial);
+				await this.credentials.set(this.legacyRef, JSON.stringify(credential));
+				await this.#ensurePayload();
+				return clone$1(credential);
+			}
+			let result;
+			await this.#modifyPayload(async (current) => {
+				const index = current.accounts.findIndex((account) => account.id === current.activeId);
+				const previous = clone$1(current.accounts[index].credential);
+				const next = await update(previous);
+				if (next === void 0) {
+					result = previous;
+					return current;
+				}
+				const credential = sanitizeOAuthCredential(next);
+				if (credential.email === void 0 && previous.email !== void 0) credential.email = previous.email;
+				const accounts = [...current.accounts];
+				accounts[index] = {
+					...accounts[index],
+					credential
+				};
+				result = clone$1(credential);
+				return {
+					...current,
+					accounts
+				};
+			});
+			return result;
+		});
+	}
+	deleteAll() {
+		return this.#enqueue(async () => {
+			await this.credentials.deleteRecord(this.key);
+			await this.credentials.unset(this.legacyRef);
+			for (const ref of this.legacyRefs) await this.credentials.unset(ref);
+		});
+	}
+	remove(id) {
+		return this.#enqueue(async () => {
+			await this.#modifyPayload((current) => {
+				if (!current.accounts.some((account) => account.id === id)) throw new Error("Unknown Codex account");
+				if (current.accounts.length === 1) throw new Error("Cannot remove the last account; sign out instead");
+				const accounts = current.accounts.filter((account) => account.id !== id);
+				return {
+					...current,
+					activeId: current.activeId === id ? accounts[0].id : current.activeId,
+					legacyAccountId: current.legacyAccountId === id ? void 0 : current.legacyAccountId,
+					accounts
+				};
+			});
+		});
+	}
+};
+//#endregion
+//#region src/credential-store.js
+const PROVIDER$1 = "openai-codex";
+const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
+const clone = (value) => value === void 0 ? void 0 : structuredClone(value);
+function assertProvider(providerId) {
+	if (providerId !== PROVIDER$1) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
+}
+function assertOAuthCredential(value) {
+	if (value === void 0) return void 0;
+	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Codex credential store received a malformed OAuth credential");
+	return clone(value);
+}
+function parseOAuthCredential(value) {
+	try {
+		return assertOAuthCredential(JSON.parse(value));
+	} catch (error) {
+		if (error?.message === "Codex credential store received a malformed OAuth credential") throw error;
+		throw new Error("Codex credential store contains malformed OAuth JSON", { cause: error });
+	}
 }
 /**
-* Preserve pi-ai's native Codex OAuth provider while allowing DSH's generic
-* PiAiAdapter to pass the access token resolved by the host credential store.
-*
-* PiAiAdapter owns a request-local Models collection backed by the same DSH
-* credential store as this provider. A pure OAuth provider ignores its
-* `apiKey` request override and otherwise fails before dispatch with "Provider
-* is not configured". This non-interactive bridge teaches that collection how
-* to consume only the already-refreshed token for this request; login, refresh,
-* persistence, headers, transport, and model behavior remain owned by the
-* original provider.
+* Adapt DSH's managed string credential service to pi-ai's typed OAuth store.
+* Refresh/login/logout operations are serialized so an older refresh response
+* cannot overwrite a newer rotated token.
 */
-function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, resolveOutputVerbosity = () => OUTPUT_VERBOSITY_DEFAULT, resolveInputImageDetail = () => void 0, resolveContextMode = () => void 0, resolveCustomContextWindow = () => void 0, catalog, connection, compaction, runNetwork = (_area, operation) => operation() } = {}) {
-	const provider = createOpenAICodexProvider();
-	const requestToken = Object.freeze({
-		name: "DSH-managed Codex OAuth request token",
-		async resolve({ credential }) {
-			const token = credential?.type === "api_key" ? credential.key : void 0;
-			if (typeof token !== "string" || token.length === 0) return void 0;
-			return {
-				auth: { apiKey: token },
-				source: "DSH-managed OAuth request"
+var DshOAuthCredentialStore = class {
+	#chains = /* @__PURE__ */ new Map();
+	constructor(credentials, ref, legacyRefs = [], options = {}) {
+		if (credentials === void 0 || credentials === null) throw new Error("Codex OAuth requires the DSH credentials service");
+		const expirySkewMs = options.expirySkewMs ?? 0;
+		if (!Number.isFinite(expirySkewMs) || expirySkewMs < 0) throw new Error("Codex OAuth expiry skew must be a non-negative finite number");
+		this.credentials = credentials;
+		this.ref = ref;
+		this.legacyRefs = Object.freeze([...legacyRefs]);
+		this.expirySkewMs = expirySkewMs;
+		this.vault = options.vault;
+	}
+	#enqueue(providerId, operation, options) {
+		assertProvider(providerId);
+		const current = (this.#chains.get(providerId) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+			abortIfNeeded(options);
+			return operation();
+		});
+		const tail = current.catch(() => void 0);
+		this.#chains.set(providerId, tail);
+		tail.finally(() => {
+			if (this.#chains.get(providerId) === tail) this.#chains.delete(providerId);
+		});
+		return current;
+	}
+	async #read(providerId, options) {
+		assertProvider(providerId);
+		abortIfNeeded(options);
+		if (this.vault !== void 0) {
+			const current = await this.vault.readActive();
+			if (current === void 0) return void 0;
+			return this.expirySkewMs === 0 ? current : {
+				...current,
+				expires: current.expires - this.expirySkewMs
 			};
 		}
-	});
-	const modelMetadata = (model) => catalog?.metadata(model?.id);
-	const supportsVerbosity = (model) => modelMetadata(model)?.supportVerbosity ?? model?.id !== "gpt-5.3-codex-spark";
-	const withPreferences = (model, options = {}) => {
-		const metadata = modelMetadata(model);
-		const requestedVerbosity = resolveOutputVerbosity();
-		const textVerbosity = supportsVerbosity(model) ? requestedVerbosity === "default" ? metadata?.defaultVerbosity ?? "medium" : requestedVerbosity : void 0;
-		const speedMode = resolveSpeedMode();
-		const serviceTier = speedMode === "ultrafast" && metadata?.supportsUltrafast === true ? ULTRAFAST_SERVICE_TIER : speedMode === "fast" && (metadata?.supportsFast ?? supportsCodexFastMode(model?.id)) ? FAST_SERVICE_TIER : void 0;
-		const inputImageDetail = normalizeInputImageDetail(resolveInputImageDetail());
-		const onPayload = options.onPayload;
-		return {
-			...options,
-			...textVerbosity === void 0 ? {} : { textVerbosity },
-			...serviceTier === void 0 ? {} : { serviceTier },
-			async onPayload(payload, requestModel) {
-				const preferred = {
-					...payload,
-					...textVerbosity === void 0 ? {} : { text: {
-						...payload.text ?? {},
-						verbosity: textVerbosity
-					} },
-					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
-				};
-				const managed = compaction?.preparePayload(preferred, model?.contextWindow) ?? preferred;
-				const next = await onPayload?.(managed, requestModel);
-				const detailed = inputImageDetail === "auto" ? next ?? managed : withInputImageDetail(next ?? managed, inputImageDetail);
-				return {
-					...detailed,
-					...textVerbosity === void 0 ? {} : { text: {
-						...detailed.text ?? {},
-						verbosity: textVerbosity
-					} },
-					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
-				};
-			}
-		};
-	};
-	const getModels = () => (catalog?.getModels() ?? provider.getModels()).map((model) => {
-		const maximum = modelContextMaximum(model);
-		const mode = resolveContextMode();
-		if (model.id === "gpt-5.3-codex-spark" || !["extended", "custom"].includes(mode)) return model;
-		if (mode === "extended") {
-			const contextWindow = maximum;
-			return {
-				...model,
-				contextWindow
-			};
+		let hit = await this.credentials.resolve(this.ref);
+		if (hit?.value === void 0 || hit.value === "") for (const legacyRef of this.legacyRefs) {
+			const legacy = await this.credentials.resolve(legacyRef);
+			if (legacy?.value === void 0 || legacy.value === "") continue;
+			const migrated = parseOAuthCredential(legacy.value);
+			await this.credentials.set(this.ref, JSON.stringify(migrated));
+			await this.credentials.unset(legacyRef);
+			hit = { value: JSON.stringify(migrated) };
+			break;
 		}
-		const requested = clampModelContext(resolveCustomContextWindow(customContextModelKey(model.id)), maximum, model.contextWindow);
-		return {
-			...model,
-			contextWindow: requested
-		};
-	});
-	const networkIterable = (factory, options) => {
-		let iterator;
-		let prepared;
-		const step = async (method, value) => {
-			const request = await (prepared ??= connection?.prepare(options) ?? Promise.resolve({ options }));
-			const result = await runNetwork("model", () => {
-				iterator ??= factory(compaction?.requestOptions(request.options) ?? request.options)[Symbol.asyncIterator]();
-				return iterator[method]?.(value) ?? (method === "throw" ? Promise.reject(value) : Promise.resolve({
-					done: true,
-					value
-				}));
-			}, compaction?.networkOptions(request.network) ?? request.network);
-			return result.done ? result : {
-				...result,
-				value: normalizeTransportEvent(result.value, request.options?.signal)
-			};
-		};
-		return {
-			[Symbol.asyncIterator]() {
-				return this;
-			},
-			next: (value) => step("next", value),
-			return: (value) => iterator ? step("return", value) : Promise.resolve({
-				done: true,
-				value
-			}),
-			throw: (error) => iterator ? step("throw", error) : Promise.reject(error)
-		};
-	};
-	return Object.freeze({
-		...provider,
-		auth: Object.freeze({
-			...provider.auth,
-			apiKey: requestToken
-		}),
-		getModels,
-		stream: (model, context, options) => networkIterable((prepared) => provider.stream(model, context, prepared), withPreferences(model, options)),
-		streamSimple: (model, context, options) => networkIterable((prepared) => provider.streamSimple(model, context, prepared), withPreferences(model, options))
-	});
-}
-Object.freeze([
-	"0.82.1",
-	"0.85.1",
-	"0.87.1"
-]);
-//#endregion
-//#region src/subscription-credentials.js
-async function readSubscriptionCredentials(getAuth, readCredential, signal) {
-	for (let attempt = 0; attempt < 2; attempt++) {
-		const auth = await getAuth({ signal });
-		signal?.throwIfAborted();
-		if (typeof auth?.auth?.apiKey !== "string" || !auth.auth.apiKey) break;
-		const credential = await readCredential({ signal });
-		signal?.throwIfAborted();
-		if (credential?.type !== "oauth") break;
-		if (credential.access === auth.auth.apiKey) return {
-			access: credential.access,
-			accountId: credential.accountId
+		abortIfNeeded(options);
+		if (hit?.value === void 0 || hit.value === "") return void 0;
+		const credential = parseOAuthCredential(hit.value);
+		return this.expirySkewMs === 0 ? credential : {
+			...credential,
+			expires: credential.expires - this.expirySkewMs
 		};
 	}
-	return {
-		access: void 0,
-		accountId: void 0
-	};
-}
-//#endregion
-//#region src/version.js
-const PACKAGE_VERSION = "2.4.2";
-const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
-//#endregion
-//#region src/model-catalog.js
-const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${encodeURIComponent(PACKAGE_VERSION)}`;
-const LEVELS = [
-	"off",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const DEFAULT_REFRESH_TIMEOUT_MS = 1e4;
-const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const nonEmpty$2 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-const positiveInteger$1 = (value) => Number.isSafeInteger(value) && value > 0 ? value : void 0;
-function upgradeModelId(value) {
-	return (typeof value.upgrade === "string" ? nonEmpty$2(value.upgrade) : record$4(value.upgrade) ? nonEmpty$2(value.upgrade.model) : void 0) ?? (record$4(value.upgrade_info) ? nonEmpty$2(value.upgrade_info.model) : void 0) ?? (record$4(value.upgradeInfo) ? nonEmpty$2(value.upgradeInfo.model) : void 0);
-}
-function retirementMillis(value) {
-	for (const source of [
-		value,
-		value.upgrade,
-		value.upgrade_info,
-		value.upgradeInfo
-	]) {
-		if (!record$4(source)) continue;
-		for (const raw of [source.retirement_at, source.retirementAt]) {
-			const seconds = positiveInteger$1(raw);
-			if (seconds !== void 0 && Number.isSafeInteger(seconds * 1e3)) return seconds * 1e3;
-			if (typeof raw === "string" && /^\d{4}-\d{2}-\d{2}T[\d:.]+(?:Z|[+-]\d{2}:\d{2})$/u.test(raw)) {
-				const parsed = Date.parse(raw);
-				if (Number.isFinite(parsed) && parsed > 0) return parsed;
+	read(providerId, options) {
+		return this.#enqueue(providerId, () => this.#read(providerId, options), options);
+	}
+	async list(options) {
+		abortIfNeeded(options);
+		return await this.read(PROVIDER$1, options) === void 0 ? [] : [{
+			providerId: PROVIDER$1,
+			type: "oauth"
+		}];
+	}
+	modify(providerId, update, options) {
+		return this.#enqueue(providerId, async () => {
+			if (this.vault !== void 0) {
+				const next = await this.vault.modifyActive(async (current) => {
+					const visible = current === void 0 || this.expirySkewMs === 0 ? current : {
+						...current,
+						expires: current.expires - this.expirySkewMs
+					};
+					const updated = await update(clone(visible));
+					return updated === void 0 ? void 0 : assertOAuthCredential(updated);
+				});
+				abortIfNeeded(options);
+				return clone(next);
+			}
+			const current = await this.#read(providerId, options);
+			const next = await update(clone(current));
+			abortIfNeeded(options);
+			if (next === void 0) return current;
+			const validated = assertOAuthCredential(next);
+			await this.credentials.set(this.ref, JSON.stringify(validated));
+			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
+			abortIfNeeded(options);
+			return clone(validated);
+		}, options);
+	}
+	delete(providerId, options) {
+		return this.#enqueue(providerId, async () => {
+			if (this.vault !== void 0) {
+				await this.vault.deleteAll();
+				abortIfNeeded(options);
+				return;
+			}
+			await this.credentials.unset(this.ref);
+			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
+			abortIfNeeded(options);
+		}, options);
+	}
+};
+/** Return only account state that is safe to expose to the browser client. */
+function createCodexAuthService(models, store, options = {}) {
+	const runLogin = options.runLogin ?? ((run) => run());
+	const accountVault = options.accountVault;
+	const createLoginModels = options.createLoginModels;
+	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
+	return Object.freeze({
+		async status(options) {
+			const current = await store.read(PROVIDER$1, options);
+			const accounts = await accountVault?.list();
+			if (current === void 0) return {
+				authenticated: false,
+				provider: PROVIDER$1,
+				...accounts === void 0 ? {} : { accounts }
+			};
+			return {
+				authenticated: true,
+				provider: PROVIDER$1,
+				type: "oauth",
+				expiresAt: current.expires,
+				...accounts === void 0 ? {} : { accounts }
+			};
+		},
+		login(interaction, input = {}) {
+			if (input.label !== void 0) {
+				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
+				return runLogin(async () => {
+					const pending = createPendingStore();
+					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
+					const credential = pending.credential();
+					if (credential === void 0) throw new Error("Codex login did not return credentials");
+					await accountVault.add(input.label, credential);
+				});
 			}
+			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
+		},
+		async select(id) {
+			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
+			await accountVault.select(id);
+			return this.status();
+		},
+		async remove(id) {
+			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
+			await accountVault.remove(id);
+			return this.status();
+		},
+		logout(options) {
+			return models.logout(PROVIDER$1, options);
 		}
+	});
+}
+//#endregion
+//#region src/external-url.js
+const OPENAI_AUTH_ORIGIN = "https://auth.openai.com";
+/** Validate the only external origin this plugin may launch. */
+function assertCodexAuthUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Codex auth URL is invalid");
 	}
+	if (url.protocol !== "https:") throw new Error("Codex auth URL must use HTTPS");
+	if (url.origin !== OPENAI_AUTH_ORIGIN || url.username !== "" || url.password !== "") throw new Error("Codex auth URL must use the OpenAI auth origin");
+	return url.href;
 }
-function retirementNotice(value, now = Date.now(), targetDisplayName) {
-	if (!record$4(value) || !Number.isFinite(now)) return void 0;
-	const at = retirementMillis(value);
-	if (at === void 0 || at <= now) return void 0;
-	const date = new Date(at);
-	if (!Number.isFinite(date.getTime())) return void 0;
-	const dateText = `${String(date.getUTCFullYear()).padStart(4, "0")}-${String(date.getUTCMonth() + 1).padStart(2, "0")}-${String(date.getUTCDate()).padStart(2, "0")}`;
-	const upgradeTo = upgradeModelId(value);
-	const upgradeName = upgradeTo === void 0 ? void 0 : nonEmpty$2(targetDisplayName) ?? upgradeTo;
-	return {
-		text: `Retires on ${dateText} (UTC).${upgradeName === void 0 ? "" : ` Switch to ${upgradeName} to keep working.`}`,
-		at,
-		upgradeTo,
-		dateText
+/** Return a shell-free native opener command for the current desktop. */
+function commandForCodexAuthUrl(value, platform = process.platform) {
+	const url = assertCodexAuthUrl(value);
+	if (platform === "win32") return {
+		file: "rundll32.exe",
+		args: ["url.dll,FileProtocolHandler", url],
+		shell: false
 	};
-}
-function reasoningMap(levels) {
-	const supported = new Set((Array.isArray(levels) ? levels : []).map((level) => nonEmpty$2(record$4(level) ? level.effort : void 0)).filter(Boolean));
-	const map = Object.fromEntries(LEVELS.map((level) => [level, null]));
-	if (supported.has("none")) map.off = "none";
-	for (const level of LEVELS.slice(1)) if (supported.has(level)) map[level] = level;
-	return map;
-}
-const capabilityNames = (values) => [...new Set(values.filter((value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,31}$/u.test(value)))].sort().slice(0, 16);
-const speedTierIds = (value) => [...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []];
-function unsupportedCapabilities(value) {
-	const reasoning = capabilityNames((value.supported_reasoning_levels ?? []).map((item) => item?.effort)).filter((level) => !["none", ...LEVELS.slice(1)].includes(level));
-	const inputs = capabilityNames(Array.isArray(value.input_modalities) ? value.input_modalities : []).filter((input) => !["text", "image"].includes(input));
-	const speeds = capabilityNames([...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []]).filter((tier) => ![
-		"auto",
-		"default",
-		"standard",
-		"fast",
-		"priority",
-		"ultrafast"
-	].includes(tier));
-	return {
-		...reasoning.length ? { reasoning } : {},
-		...inputs.length ? { inputs } : {},
-		...speeds.length ? { speeds } : {}
+	if (platform === "darwin") return {
+		file: "open",
+		args: [url],
+		shell: false
+	};
+	if (platform === "linux") return {
+		file: "xdg-open",
+		args: [url],
+		shell: false
 	};
+	throw new Error(`Codex auth URL opener is unsupported on ${platform}`);
 }
-function visibleModel(value, displayNames, now) {
-	if (!record$4(value)) return void 0;
-	const id = nonEmpty$2(value.slug);
-	const reserve = id === "gpt-reserve" && ["list", "hide"].includes(value.visibility);
-	if (id === void 0 || value.visibility !== "list" && !reserve) return void 0;
-	const supported = Array.isArray(value.supported_reasoning_levels) ? value.supported_reasoning_levels : [];
-	const input = Array.isArray(value.input_modalities) ? value.input_modalities.filter((item) => ["text", "image"].includes(item)) : ["text", "image"];
-	const unsupported = unsupportedCapabilities({
-		...value,
-		supported_reasoning_levels: supported
+function openCodexAuthUrl(value, options = {}) {
+	const command = commandForCodexAuthUrl(value, options.platform);
+	const spawnProcess = options.spawn ?? spawn;
+	return new Promise((resolve, reject) => {
+		const child = spawnProcess(command.file, command.args, {
+			detached: true,
+			stdio: "ignore",
+			windowsHide: true,
+			shell: command.shell
+		});
+		child.once("error", reject);
+		child.once("spawn", () => {
+			child.unref();
+			resolve();
+		});
 	});
-	const upgradeTo = upgradeModelId(value);
-	const retirement = retirementNotice(value, now, displayNames.get(upgradeTo));
-	const notice = retirement?.text;
-	const description = nonEmpty$2(value.description);
-	return {
-		...Object.keys(unsupported).length ? { unsupported } : {},
-		id,
-		name: `${reserve ? "GPT-Reserve (Experimental)" : nonEmpty$2(value.display_name) ?? id}${retirement === void 0 ? "" : ` (retires ${retirement.dateText})`}`,
-		description: notice === void 0 ? description : description === void 0 ? notice : `${description}\n${notice}`,
-		...retirement === void 0 ? {} : { retirement: {
-			at: retirement.at,
-			upgradeTo: retirement.upgradeTo
-		} },
-		priority: Number.isFinite(value.priority) ? value.priority : 0,
-		input: input.length > 0 ? input : ["text"],
-		contextWindow: positiveInteger$1(value.context_window) ?? positiveInteger$1(value.max_context_window),
-		...positiveInteger$1(value.max_context_window) === void 0 ? {} : { maxContextWindow: value.max_context_window },
-		reasoning: supported.length > 0,
-		thinkingLevelMap: reasoningMap(supported),
-		supportVerbosity: value.support_verbosity === true,
-		defaultVerbosity: [
-			"low",
-			"medium",
-			"high"
-		].includes(value.default_verbosity) ? value.default_verbosity : void 0,
-		supportsFast: speedTierIds(value).some((tier) => tier === "fast" || tier === "priority"),
-		supportsUltrafast: speedTierIds(value).includes("ultrafast")
-	};
 }
-function parseOfficialModelCatalog(value, now = Date.now()) {
-	if (!record$4(value) || !Array.isArray(value.models)) throw new Error("Codex returned a malformed model catalog");
-	const displayNames = /* @__PURE__ */ new Map();
-	for (const model of value.models) {
-		if (!record$4(model)) continue;
-		const id = nonEmpty$2(model.slug);
-		const name = nonEmpty$2(model.display_name);
-		if (id !== void 0 && name !== void 0 && !displayNames.has(id)) displayNames.set(id, name);
+//#endregion
+//#region src/login-coordinator.js
+const LOGIN_METHODS = /* @__PURE__ */ new Set(["browser", "device_code"]);
+const TERMINAL_PHASES = /* @__PURE__ */ new Set([
+	"authenticated",
+	"failed",
+	"cancelled"
+]);
+const publicClone = (value) => structuredClone(value);
+const asObject = (value) => value !== null && typeof value === "object" ? value : {};
+const ok = (value) => ({
+	ok: true,
+	value
+});
+const badRequest = (message) => ({
+	ok: false,
+	error: {
+		code: "bad-request",
+		message,
+		details: { issues: [] }
 	}
-	const seen = /* @__PURE__ */ new Set();
-	return value.models.map((model) => visibleModel(model, displayNames, now)).filter((model) => model !== void 0 && !seen.has(model.id) && seen.add(model.id)).sort((left, right) => Number(left.id === "gpt-reserve") - Number(right.id === "gpt-reserve") || right.priority - left.priority);
-}
-function mergeModel(baseModels, remote) {
-	const base = baseModels.find((model) => model.id === remote.id) ?? baseModels.find((model) => model.id !== "gpt-5.3-codex-spark") ?? baseModels[0];
-	if (base === void 0) return void 0;
+});
+const accountStatusError = (message) => ({
+	ok: false,
+	error: {
+		code: "internal",
+		message,
+		details: { issues: [] }
+	}
+});
+const classifyAccountStatusError = (error) => {
+	const message = error instanceof Error ? error.message : "";
+	if (/malformed (?:OAuth|grant|account vault)|received a malformed OAuth|contains malformed OAuth/iu.test(message)) return ["credential-malformed", "Codex account credentials are malformed"];
+	if (/credential|account vault|readRecord|credential store|credentials service/iu.test(message)) return ["credential-unavailable", "Codex account credentials are unavailable"];
+	const code = typeof error?.code === "string" ? error.code.toUpperCase() : "";
+	if (error?.name === "TimeoutError" || [
+		"TIMEOUT",
+		"ETIMEDOUT",
+		"UND_ERR_CONNECT_TIMEOUT"
+	].includes(code)) return ["transport", "Codex account status service is unavailable"];
+	if ([
+		"ECONNRESET",
+		"ECONNREFUSED",
+		"ENOTFOUND",
+		"EAI_AGAIN",
+		"NETWORK",
+		"NETWORK_ERROR",
+		"TRANSPORT"
+	].includes(code) || error?.name === "NetworkError") return ["transport", "Codex account status service is unavailable"];
+	return ["unknown", "Could not read Codex account status"];
+};
+const deferred = () => {
+	let resolve;
+	let reject;
 	return {
-		...base,
-		id: remote.id,
-		name: remote.name,
-		...remote.retirement === void 0 || remote.description === void 0 ? {} : { description: remote.description },
-		input: remote.input,
-		reasoning: remote.reasoning,
-		thinkingLevelMap: remote.thinkingLevelMap,
-		...remote.contextWindow === void 0 ? {} : { contextWindow: remote.contextWindow },
-		...remote.maxContextWindow === void 0 ? {} : { maxContextWindow: remote.maxContextWindow },
-		...base.id === remote.id ? {} : { cost: {
-			input: 0,
-			output: 0,
-			cacheRead: 0,
-			cacheWrite: 0
-		} }
+		promise: new Promise((onResolve, onReject) => {
+			resolve = onResolve;
+			reject = onReject;
+		}),
+		resolve,
+		reject
 	};
+};
+const publicPrompt = (prompt) => ({
+	type: prompt.type,
+	message: String(prompt.message ?? ""),
+	...typeof prompt.placeholder === "string" ? { placeholder: prompt.placeholder } : {}
+});
+function classifyLoginFailure(error) {
+	const message = error instanceof Error ? error.message : "";
+	if (/token exchange failed/iu.test(message)) return "token-exchange";
+	if (/fetch failed|\b(?:ECONN|ENOTFOUND|ETIMEDOUT|CERT_|socket|network)\b/iu.test(message)) return "network";
+	if (/extract accountId|account[_ -]?id/iu.test(message)) return "account-claim";
+	if (/credential|credentials-local|OAuth JSON/iu.test(message)) return "credential-store";
+	if (/Missing authorization code|State mismatch|callback/iu.test(message)) return "callback";
+	return "provider";
 }
-function createOfficialModelCatalog(options = {}) {
-	const fetchCatalog = options.fetch ?? fetch;
-	const getNow = options.now ?? Date.now;
-	const scheduleTimeout = options.setTimeout ?? setTimeout;
-	const cancelTimeout = options.clearTimeout ?? clearTimeout;
-	const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : DEFAULT_REFRESH_TIMEOUT_MS;
-	let models;
-	let metadata = /* @__PURE__ */ new Map();
-	let etag;
-	let rawCatalog;
-	let revision = 0;
-	let refreshing;
-	let generation = 0;
-	let refreshStatus = "idle";
-	const refresh = ({ signal } = {}) => {
-		if (signal?.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
-		if (refreshing?.generation === generation) return refreshing.promise;
-		const currentGeneration = generation;
-		refreshStatus = "refreshing";
-		let outcome = "idle";
-		const controller = new AbortController();
-		const abort = () => {
-			if (!controller.signal.aborted) controller.abort(signal?.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+/** Own one host-side login without exposing tokens to the browser client. */
+var CodexLoginCoordinator = class {
+	#sessions = /* @__PURE__ */ new Map();
+	#activeId;
+	constructor(auth, options = {}) {
+		this.auth = auth;
+		this.createId = options.createId ?? (() => crypto.randomUUID());
+	}
+	async accountStatus(options) {
+		return publicClone(await this.auth.status(options));
+	}
+	supportState() {
+		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
+		if (active === void 0) return { phase: "idle" };
+		return {
+			method: active.view.method,
+			phase: active.view.phase,
+			...active.view.phase === "failed" ? { failure: classifyLoginFailure(active.hostError) } : {}
 		};
-		signal?.addEventListener("abort", abort, { once: true });
-		const requestSignal = controller.signal;
-		let timer;
-		const timeoutError = /* @__PURE__ */ new Error("Codex model catalog refresh timed out");
-		const work = (async () => {
-			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, requestSignal);
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) return false;
-			const headers = {
-				authorization: `Bearer ${access}`,
-				"chatgpt-account-id": accountId,
-				accept: "application/json",
-				originator: "pi",
-				"user-agent": USER_AGENT,
-				...etag === void 0 ? {} : { "if-none-match": etag }
+	}
+	async start({ method, label }) {
+		if (!LOGIN_METHODS.has(method)) throw new Error(`unsupported Codex login method: ${String(method)}`);
+		if (label !== void 0 && (typeof label !== "string" || label.trim().length === 0 || label.trim().length > 48)) throw new Error("unsupported Codex account label");
+		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
+		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) {
+			active.view = {
+				id: active.view.id,
+				provider: "openai-codex",
+				method: active.view.method,
+				phase: "cancelled",
+				authenticated: false
 			};
-			const response = await fetchCatalog(CODEX_MODELS_URL, {
-				method: "GET",
-				redirect: "error",
-				headers,
-				signal: requestSignal
-			});
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			if (response.status === 304) {
-				outcome = "ok";
-				if (rawCatalog === void 0) return false;
-				const remote = parseOfficialModelCatalog(rawCatalog, getNow());
-				const next = remote.map((model) => mergeModel(options.baseModels(), model)).filter(Boolean);
-				if (next.length === 0 || JSON.stringify(next) === JSON.stringify(models)) return false;
-				models = next;
-				metadata = new Map(remote.map((model) => [model.id, model]));
-				revision += 1;
-				options.onUpdated?.();
-				return true;
+			active.controller.abort(/* @__PURE__ */ new Error("Codex login replaced by a new attempt"));
+		}
+		if (active !== void 0) this.#sessions.delete(active.view.id);
+		const id = this.createId();
+		const ready = deferred();
+		const controller = new AbortController();
+		const session = {
+			controller,
+			prompt: void 0,
+			ready,
+			view: {
+				id,
+				provider: "openai-codex",
+				method,
+				phase: "starting",
+				authenticated: false
 			}
-			if (!response.ok) throw new Error(`Codex model catalog failed (HTTP ${response.status})`);
-			const raw = await response.json();
-			const remote = parseOfficialModelCatalog(raw, getNow());
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			if (remote.length === 0) throw new Error("Codex returned an empty model catalog");
-			const baseModels = options.baseModels();
-			const next = remote.map((model) => mergeModel(baseModels, model)).filter(Boolean);
-			if (next.length === 0) throw new Error("Codex model catalog has no compatible models");
-			if (currentGeneration !== generation || requestSignal.aborted) return false;
-			models = next;
-			rawCatalog = raw;
-			metadata = new Map(remote.map((model) => [model.id, model]));
-			etag = nonEmpty$2(response.headers.get("etag")) ?? etag;
-			revision += 1;
-			outcome = "ok";
-			options.onUpdated?.();
-			return true;
-		})();
-		let rejectAborted;
-		const abortPromise = new Promise((_, reject) => {
-			rejectAborted = () => reject(requestSignal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
-			if (requestSignal.aborted) rejectAborted();
-			else requestSignal.addEventListener("abort", rejectAborted, { once: true });
-		});
-		timer = scheduleTimeout(() => controller.abort(timeoutError), timeoutMs);
-		timer.unref?.();
-		const promise = Promise.race([work, abortPromise]).catch((error) => {
-			outcome = "failed";
-			throw error;
-		}).finally(() => {
-			cancelTimeout(timer);
-			signal?.removeEventListener("abort", abort);
-			requestSignal.removeEventListener("abort", rejectAborted);
-			if (refreshing?.promise === promise) {
-				refreshing = void 0;
-				refreshStatus = outcome;
+		};
+		this.#sessions.set(id, session);
+		this.#activeId = id;
+		const publishReady = () => ready.resolve(publicClone(session.view));
+		const interaction = {
+			signal: controller.signal,
+			prompt: async (prompt) => {
+				controller.signal.throwIfAborted();
+				if (prompt.type === "select") return method;
+				if (![
+					"manual_code",
+					"text",
+					"secret"
+				].includes(prompt.type)) throw new Error(`unsupported Codex auth prompt: ${String(prompt.type)}`);
+				const answer = deferred();
+				session.prompt = answer;
+				session.view = {
+					...session.view,
+					phase: "waiting_input",
+					prompt: publicPrompt(prompt)
+				};
+				const abortPrompt = () => answer.reject(controller.signal.reason ?? /* @__PURE__ */ new Error("login cancelled"));
+				controller.signal.addEventListener("abort", abortPrompt, { once: true });
+				prompt.signal?.addEventListener("abort", abortPrompt, { once: true });
+				publishReady();
+				try {
+					return await answer.promise;
+				} finally {
+					controller.signal.removeEventListener("abort", abortPrompt);
+					prompt.signal?.removeEventListener("abort", abortPrompt);
+					if (session.prompt === answer) session.prompt = void 0;
+				}
+			},
+			notify: (event) => {
+				if (controller.signal.aborted) return;
+				if (event.type === "auth_url") session.view = {
+					...session.view,
+					phase: "waiting_browser",
+					authUrl: assertCodexAuthUrl(event.url),
+					...typeof event.instructions === "string" ? { instructions: event.instructions } : {}
+				};
+				else if (event.type === "device_code") session.view = {
+					...session.view,
+					phase: "waiting_device",
+					deviceCode: {
+						userCode: event.userCode,
+						verificationUri: assertCodexAuthUrl(event.verificationUri),
+						...typeof event.intervalSeconds === "number" ? { intervalSeconds: event.intervalSeconds } : {},
+						...typeof event.expiresInSeconds === "number" ? { expiresInSeconds: event.expiresInSeconds } : {}
+					}
+				};
+				else session.view = {
+					...session.view,
+					message: String(event.message ?? "")
+				};
+				publishReady();
+			}
+		};
+		session.run = Promise.resolve().then(() => this.auth.login(interaction, label === void 0 ? {} : { label: label.trim() })).then(async () => {
+			if (controller.signal.aborted) return;
+			const status = await this.auth.status();
+			session.view = {
+				id,
+				provider: "openai-codex",
+				method,
+				phase: "authenticated",
+				authenticated: status.authenticated === true,
+				...typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}
+			};
+		}).catch(async (error) => {
+			if (controller.signal.aborted) {
+				session.view = {
+					id,
+					provider: "openai-codex",
+					method,
+					phase: "cancelled",
+					authenticated: false
+				};
+				return;
 			}
-		});
-		refreshing = {
-			generation: currentGeneration,
-			promise,
-			cancel: () => controller.abort()
+			try {
+				if (label !== void 0) throw error;
+				const status = await this.auth.status();
+				if (status.authenticated === true) {
+					session.view = {
+						id,
+						provider: "openai-codex",
+						method,
+						phase: "authenticated",
+						authenticated: true,
+						...typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}
+					};
+					return;
+				}
+			} catch {}
+			session.view = {
+				id,
+				provider: "openai-codex",
+				method,
+				phase: "failed",
+				authenticated: false,
+				error: "Codex login failed"
+			};
+			session.hostError = error;
+		}).finally(publishReady);
+		return ready.promise;
+	}
+	read(id) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Codex login");
+		return publicClone(session.view);
+	}
+	async submit({ id, value }) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Codex login");
+		if (session.prompt === void 0 || session.view.phase !== "waiting_input") throw new Error("Codex login is not waiting for input");
+		if (typeof value !== "string" || value.trim() === "") throw new Error("Codex login input is empty");
+		const answer = session.prompt;
+		session.prompt = void 0;
+		session.view = {
+			...session.view,
+			phase: session.view.authUrl === void 0 ? "starting" : "waiting_browser",
+			prompt: void 0
 		};
-		return promise;
-	};
-	return Object.freeze({
-		refresh,
-		getModels: () => models ?? [],
-		metadata: (modelId) => metadata.get(modelId),
-		revision: () => revision,
-		capabilityGaps: () => [...metadata.values()].filter((model) => model.unsupported && /^[a-z][a-z0-9._-]{0,79}$/u.test(model.id)).slice(0, 20).map((model) => ({
-			model: model.id,
-			...structuredClone(model.unsupported)
-		})),
-		status: () => ({
-			source: models === void 0 ? "unavailable" : "online",
-			refresh: refreshStatus
-		}),
-		clear() {
-			generation += 1;
-			const flight = refreshing;
-			refreshing = void 0;
-			flight?.cancel();
-			models = void 0;
-			rawCatalog = void 0;
-			metadata = /* @__PURE__ */ new Map();
-			etag = void 0;
-			refreshStatus = "idle";
-			revision += 1;
-			options.onUpdated?.();
+		answer.resolve(value);
+		return this.read(id);
+	}
+	async cancel(id) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Codex login");
+		if (!TERMINAL_PHASES.has(session.view.phase)) {
+			session.view = {
+				id,
+				provider: "openai-codex",
+				method: session.view.method,
+				phase: "cancelled",
+				authenticated: false
+			};
+			session.controller.abort(/* @__PURE__ */ new Error("Codex login cancelled"));
 		}
-	});
-}
-//#endregion
-//#region src/codex-search.js
-const CODEX_SEARCH_PROVIDER_ID = "codex-subscription";
-const CODEX_AUTO_SEARCH_PROVIDER_ID = "codex-subscription-auto";
-const CODEX_SEARCH_URL = "https://chatgpt.com/backend-api/codex/alpha/search";
-const DEFAULT_MODEL = "gpt-5.6-luna";
-const MAX_OUTPUT_TOKENS = 4096;
-const MAX_SOURCE_DATE = 64;
-const record$3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const nonEmpty$1 = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
-const displayText = (value) => {
-	const text = nonEmpty$1(value)?.replace(/\s+/gu, " ").trim();
-	if (text === void 0 || text.length === 0) return void 0;
-	return text;
-};
-const boundedDisplayText = (value, maximum) => {
-	const text = displayText(value);
-	if (text === void 0 || text.length <= maximum) return text;
-	return `${text.slice(0, maximum - 1)}…`;
-};
-function sourceOf(value) {
-	if (!record$3(value)) return void 0;
-	const url = nonEmpty$1(value.url);
-	if (url === void 0) return void 0;
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return;
+		return this.read(id);
 	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
-	const title = displayText(value.title) ?? parsed.hostname;
-	const snippet = displayText(value.snippet);
-	const publishedAt = boundedDisplayText(value.published_at, MAX_SOURCE_DATE) ?? boundedDisplayText(value.publishedAt, MAX_SOURCE_DATE);
-	return {
-		url,
-		title,
-		...snippet === void 0 ? {} : { snippet },
-		...publishedAt === void 0 ? {} : { publishedAt }
-	};
-}
-function parseSearchResponse(value) {
-	if (!record$3(value) || !Array.isArray(value.results)) throw new Error("Codex returned a malformed search response");
-	const seen = /* @__PURE__ */ new Set();
-	const sources = [];
-	for (const result of value.results ?? []) {
-		const source = sourceOf(result);
-		if (source === void 0 || seen.has(source.url)) continue;
-		seen.add(source.url);
-		sources.push(source);
+	async logout(options) {
+		if (this.#activeId !== void 0) {
+			const active = this.#sessions.get(this.#activeId);
+			if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) await this.cancel(active.view.id);
+		}
+		await this.auth.logout(options);
+		return this.accountStatus(options);
 	}
-	return {
-		sources,
-		truncated: false
-	};
-}
-/** Create the DSH web provider backed only by the ChatGPT subscription search endpoint. */
-function createCodexSearchProvider(options) {
-	const fetchSearch = options.fetch ?? fetch;
-	return Object.freeze({
-		id: CODEX_SEARCH_PROVIDER_ID,
-		available: () => true,
-		async search(request, signal) {
-			signal?.throwIfAborted();
-			const preferences = readCapabilitySettings(options.resolvePreferences?.());
-			if (preferences.searchMode === "disabled") throw new WebError("Codex search is disabled in subscription settings", "WEB_PROVIDER_UNAVAILABLE");
-			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, signal);
-			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new WebError("ChatGPT subscription is not signed in", "WEB_PROVIDER_CREDENTIAL_MISSING");
-			const model = nonEmpty$1(options.resolveModel?.()) ?? DEFAULT_MODEL;
-			const id = nonEmpty$1(options.resolveSessionId?.()) ?? randomUUID();
-			let response;
-			try {
-				response = await fetchSearch(CODEX_SEARCH_URL, {
-					method: "POST",
-					redirect: "error",
-					headers: {
-						authorization: `Bearer ${access}`,
-						"chatgpt-account-id": accountId,
-						accept: "application/json",
-						"content-type": "application/json",
-						originator: "pi",
-						"user-agent": USER_AGENT
-					},
-					body: JSON.stringify({
-						id,
-						model,
-						input: request.query,
-						commands: {
-							search_query: [{ q: request.query }],
-							response_length: "short"
-						},
-						settings: {
-							allowed_callers: ["direct"],
-							external_web_access: preferences.searchMode === "live"
-						},
-						max_output_tokens: MAX_OUTPUT_TOKENS
-					}),
-					signal
-				});
-			} catch (error) {
-				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
-				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
-			}
-			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
-			let value;
-			try {
-				value = await response.json();
+	async selectAccount(id) {
+		return publicClone(await this.auth.select(id));
+	}
+	async removeAccount(id) {
+		return publicClone(await this.auth.remove(id));
+	}
+};
+/** Map the loopback-only DSH Connection channel onto the coordinator. */
+function createCodexRpcHandler(coordinator, options = {}) {
+	const openExternal = options.openExternal;
+	return async (endpoint, payload, signal) => {
+		try {
+			signal.throwIfAborted();
+			const input = asObject(payload);
+			if (endpoint === "status") try {
+				return ok(await coordinator.accountStatus({ signal }));
 			} catch (error) {
-				throw new WebError("Codex returned an unreadable search response", "WEB_PROVIDER_ERROR", { cause: error });
+				if (signal.aborted) throw error;
+				const [, message] = classifyAccountStatusError(error);
+				return accountStatusError(message);
 			}
-			try {
-				const result = parseSearchResponse(value);
-				if (preferences.searchDomains.length > 0) result.sources = result.sources.filter((source) => {
-					const hostname = new URL(source.url).hostname.toLowerCase();
-					return preferences.searchDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
+			if (endpoint === "login/start") {
+				const started = await coordinator.start({
+					method: input.method,
+					label: input.label
 				});
-				return result;
-			} catch (error) {
-				throw new WebError("Codex returned a malformed search response", "WEB_PROVIDER_ERROR", { cause: error });
+				if (input.openExternal !== true) return ok(started);
+				const url = started.authUrl ?? started.deviceCode?.verificationUri;
+				if (typeof url !== "string" || openExternal === void 0) return ok({
+					...started,
+					externalOpened: false
+				});
+				try {
+					await openExternal(url);
+					return ok({
+						...started,
+						externalOpened: true
+					});
+				} catch {
+					return ok({
+						...started,
+						externalOpened: false
+					});
+				}
 			}
+			if (endpoint === "login/status") return ok(coordinator.read(input.id));
+			if (endpoint === "login/submit") return ok(await coordinator.submit({
+				id: input.id,
+				value: input.value
+			}));
+			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
+			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
+			if (endpoint === "account/select") return ok(await coordinator.selectAccount(input.id));
+			if (endpoint === "account/remove") return ok(await coordinator.removeAccount(input.id));
+			return badRequest(`unknown Codex auth endpoint: ${endpoint}`);
+		} catch (error) {
+			if (signal.aborted) throw error;
+			const message = error instanceof Error && /^(unknown|unsupported|a Codex|Codex login)/.test(error.message) ? error.message : "Codex request failed";
+			return badRequest(message);
 		}
-	});
-}
-/** Route each request by its initiating model without changing the user's explicit overrides. */
-function createCodexAutoSearchProvider(options) {
-	return Object.freeze({
-		id: CODEX_AUTO_SEARCH_PROVIDER_ID,
-		available: () => true,
-		async search(request, signal) {
-			if (options.resolveModelProvider?.() === "openai-codex") return options.codex.search(request, signal);
-			const provider = options.resolveDshProvider?.();
-			if (provider === void 0 || provider.id === "codex-subscription-auto" || provider.id === "codex-subscription" || provider.available() !== true) throw new WebError("DSH default search is unavailable", "WEB_PROVIDER_UNAVAILABLE");
-			return provider.search(request, signal);
-		}
-	});
+	};
 }
-const ORIGINAL_IMAGE_CHUNK_BYTES = 4 * 1024 * 1024;
-const ORIGINAL_IMAGE_ID_PATTERN = /^img_[0-9a-f]{32}$/u;
-const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0;
-function decodeOriginalImageRef(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || typeof value.assetId !== "string" || !ORIGINAL_IMAGE_ID_PATTERN.test(value.assetId) || value.mediaType !== "image/png" || !positiveInteger(value.bytes) || value.bytes > 48 * 1024 * 1024 || !positiveInteger(value.width) || !positiveInteger(value.height) || typeof value.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value.name) || typeof value.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(value.sha256)) return void 0;
+//#endregion
+//#region src/transport-failure.js
+function normalizeTransportEvent(event, signal) {
+	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
+	const message = event.error?.errorMessage;
+	if (typeof message !== "string" || !/^WebSocket closed (?:1006|1011|1012|1013)(?:\s|$)/.test(message)) return event;
 	return {
-		assetId: value.assetId,
-		mediaType: value.mediaType,
-		bytes: value.bytes,
-		width: value.width,
-		height: value.height,
-		name: value.name,
-		sha256: value.sha256
+		...event,
+		error: {
+			...event.error,
+			errorMessage: `Network transport failure: ${message}`
+		}
 	};
 }
-function decodeImagePresentation(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || value.kind !== "codex-subscription-image" || value.schemaVersion !== 1) return void 0;
-	const original = decodeOriginalImageRef(value.original);
-	return original === void 0 ? void 0 : { original };
-}
-function originalImageRefsEqual(left, right) {
-	const a = decodeOriginalImageRef(left);
-	const b = decodeOriginalImageRef(right);
-	return a !== void 0 && b !== void 0 && a.assetId === b.assetId && a.mediaType === b.mediaType && a.bytes === b.bytes && a.width === b.width && a.height === b.height && a.name === b.name && a.sha256 === b.sha256;
-}
-/** Resolve only an exact original reference copied into a DSH fork prefix. */
-function inheritedOriginalImageRef(session, assetId) {
-	const parentSession = session?.header?.parentSession;
-	const seedLength = Number.isSafeInteger(session?.inheritedEventCount) ? session.inheritedEventCount : session?.header?.seedLength;
-	if (typeof parentSession !== "string" || parentSession.length === 0 || !Number.isSafeInteger(seedLength) || seedLength < 0 || !ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) return void 0;
-	let events = session?.events;
-	if (!Array.isArray(events) && typeof session?.snapshotEvents === "function") try {
-		events = session.snapshotEvents();
-	} catch {
-		return;
-	}
-	if (!Array.isArray(events)) return void 0;
-	for (const event of events) {
-		if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq >= seedLength || event.type !== "tool/result") continue;
-		const original = decodeImagePresentation(event.data?.meta)?.original;
-		if (original?.assetId === assetId) return original;
-	}
-}
 //#endregion
-//#region src/codex-images.js
-const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
-const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
-const CODEX_IMAGE_EDIT_URL = "https://chatgpt.com/backend-api/codex/images/edits";
-const MAX_REFERENCE_IMAGES = 5;
-const RESPONSE_ENVELOPE_BYTES = 1024 * 1024;
-const IMAGE_BACKGROUNDS = /* @__PURE__ */ new Set([
-	"auto",
-	"transparent",
-	"opaque"
-]);
-const PNG_SIGNATURE = Buffer.from([
-	137,
-	80,
-	78,
-	71,
-	13,
-	10,
-	26,
-	10
-]);
-const FULL_ATTACHMENT_ID = /^sha256:[0-9a-f]{64}$/u;
-const BARE_ATTACHMENT_DIGEST = /^[0-9a-f]{64}$/iu;
-const PATH_LIKE_ATTACHMENT_ID = /[\\/]/u;
-const FILE_NAME_ATTACHMENT_ID = /\.[A-Za-z0-9]{1,16}$/u;
-const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const nonEmpty = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-const NETWORK_REASONS = {
-	UND_ERR_HEADERS_TIMEOUT: "the image service sent no response within 5 minutes",
-	UND_ERR_BODY_TIMEOUT: "the image response stalled",
-	UND_ERR_CONNECT_TIMEOUT: "the connection to the image service timed out",
-	UND_ERR_SOCKET: "the connection closed unexpectedly",
-	ECONNRESET: "the connection was reset",
-	ETIMEDOUT: "the connection timed out",
-	ENOTFOUND: "DNS lookup failed",
-	ECONNREFUSED: "the connection was refused",
-	EAI_AGAIN: "DNS lookup failed"
-};
-function requestFailureReason(error) {
-	const code = [(error?.cause ?? error)?.code, error?.code].find((value) => typeof value === "string" && /^[A-Z][A-Z0-9_]{2,39}$/u.test(value));
-	if (code !== void 0) return `: ${NETWORK_REASONS[code] ?? "network error"} (${code})`;
-	if (error?.name === "TimeoutError") return ": the image request timed out";
-	return "";
+//#region src/pi-ai-runtime.js
+const FAST_SERVICE_TIER = "priority";
+const ULTRAFAST_SERVICE_TIER = "ultrafast";
+/** Apply the chosen detail to user and tool-result images after the provider assembles the request. */
+function withInputImageDetail(payload, detail) {
+	if (!Array.isArray(payload.input)) return payload;
+	let changed = false;
+	const input = payload.input.map((item) => {
+		const field = Array.isArray(item?.content) ? "content" : ["function_call_output", "custom_tool_call_output"].includes(item?.type) && Array.isArray(item.output) ? "output" : void 0;
+		if (field === void 0) return item;
+		let itemChanged = false;
+		const parts = item[field].map((part) => {
+			if (part?.type !== "input_image" || part.detail === detail) return part;
+			itemChanged = true;
+			return {
+				...part,
+				detail
+			};
+		});
+		if (!itemChanged) return item;
+		changed = true;
+		return {
+			...item,
+			[field]: parts
+		};
+	});
+	return changed ? {
+		...payload,
+		input
+	} : payload;
 }
-function normalizeImageOptions(args) {
-	const quality = nonEmpty(args?.quality) ?? "auto";
-	const background = nonEmpty(args?.background) ?? "auto";
-	const size = nonEmpty(args?.size) ?? "auto";
-	validateImageQuality(resolveImageModel(args?.model), quality);
-	if (!IMAGE_BACKGROUNDS.has(background)) throw new Error("background must be auto, transparent, or opaque");
-	if (size !== "auto") {
-		const match = /^(\d+)x(\d+)$/u.exec(size);
-		const width = Number(match?.[1]);
-		const height = Number(match?.[2]);
-		const short = Math.min(width, height);
-		const long = Math.max(width, height);
-		const pixels = width * height;
-		if (match === null || width % 16 !== 0 || height % 16 !== 0 || long > 3840 || long > short * 3 || pixels < 655360 || pixels > 8294400) throw new Error("size must be auto or a valid GPT Image 2 widthxheight resolution");
-	}
-	return {
-		quality,
-		background,
-		size
+/**
+* Preserve pi-ai's native Codex OAuth provider while allowing DSH's generic
+* PiAiAdapter to pass the access token resolved by the host credential store.
+*
+* PiAiAdapter owns a request-local Models collection backed by the same DSH
+* credential store as this provider. A pure OAuth provider ignores its
+* `apiKey` request override and otherwise fails before dispatch with "Provider
+* is not configured". This non-interactive bridge teaches that collection how
+* to consume only the already-refreshed token for this request; login, refresh,
+* persistence, headers, transport, and model behavior remain owned by the
+* original provider.
+*/
+function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, resolveOutputVerbosity = () => OUTPUT_VERBOSITY_DEFAULT, resolveInputImageDetail = () => void 0, resolveContextMode = () => void 0, resolveCustomContextWindow = () => void 0, catalog, connection, compaction, runNetwork = (_area, operation) => operation() } = {}) {
+	const provider = createOpenAICodexProvider();
+	const requestToken = Object.freeze({
+		name: "DSH-managed Codex OAuth request token",
+		async resolve({ credential }) {
+			const token = credential?.type === "api_key" ? credential.key : void 0;
+			if (typeof token !== "string" || token.length === 0) return void 0;
+			return {
+				auth: { apiKey: token },
+				source: "DSH-managed OAuth request"
+			};
+		}
+	});
+	const modelMetadata = (model) => catalog?.metadata(model?.id);
+	const supportsVerbosity = (model) => modelMetadata(model)?.supportVerbosity ?? model?.id !== "gpt-5.3-codex-spark";
+	const withPreferences = (model, options = {}) => {
+		const metadata = modelMetadata(model);
+		const requestedVerbosity = resolveOutputVerbosity();
+		const textVerbosity = supportsVerbosity(model) ? requestedVerbosity === "default" ? metadata?.defaultVerbosity ?? "medium" : requestedVerbosity : void 0;
+		const speedMode = resolveSpeedMode();
+		const serviceTier = speedMode === "ultrafast" && metadata?.supportsUltrafast === true ? ULTRAFAST_SERVICE_TIER : speedMode === "fast" && (metadata?.supportsFast ?? supportsCodexFastMode(model?.id)) ? FAST_SERVICE_TIER : void 0;
+		const inputImageDetail = normalizeInputImageDetail(resolveInputImageDetail());
+		const onPayload = options.onPayload;
+		return {
+			...options,
+			...textVerbosity === void 0 ? {} : { textVerbosity },
+			...serviceTier === void 0 ? {} : { serviceTier },
+			async onPayload(payload, requestModel) {
+				const preferred = {
+					...payload,
+					...textVerbosity === void 0 ? {} : { text: {
+						...payload.text ?? {},
+						verbosity: textVerbosity
+					} },
+					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
+				};
+				const managed = compaction?.preparePayload(preferred, model?.contextWindow) ?? preferred;
+				const next = await onPayload?.(managed, requestModel);
+				const detailed = inputImageDetail === "auto" ? next ?? managed : withInputImageDetail(next ?? managed, inputImageDetail);
+				return {
+					...detailed,
+					...textVerbosity === void 0 ? {} : { text: {
+						...detailed.text ?? {},
+						verbosity: textVerbosity
+					} },
+					...serviceTier === void 0 ? {} : { service_tier: serviceTier }
+				};
+			}
+		};
+	};
+	const getModels = () => (catalog?.getModels() ?? provider.getModels()).map((model) => {
+		const maximum = modelContextMaximum(model);
+		const mode = resolveContextMode();
+		if (model.id === "gpt-5.3-codex-spark" || !["extended", "custom"].includes(mode)) return model;
+		if (mode === "extended") {
+			const contextWindow = maximum;
+			return {
+				...model,
+				contextWindow
+			};
+		}
+		const requested = clampModelContext(resolveCustomContextWindow(customContextModelKey(model.id)), maximum, model.contextWindow);
+		return {
+			...model,
+			contextWindow: requested
+		};
+	});
+	const networkIterable = (factory, options) => {
+		let iterator;
+		let prepared;
+		const step = async (method, value) => {
+			const request = await (prepared ??= connection?.prepare(options) ?? Promise.resolve({ options }));
+			const result = await runNetwork("model", () => {
+				iterator ??= factory(compaction?.requestOptions(request.options) ?? request.options)[Symbol.asyncIterator]();
+				return iterator[method]?.(value) ?? (method === "throw" ? Promise.reject(value) : Promise.resolve({
+					done: true,
+					value
+				}));
+			}, compaction?.networkOptions(request.network) ?? request.network);
+			return result.done ? result : {
+				...result,
+				value: normalizeTransportEvent(result.value, request.options?.signal)
+			};
+		};
+		return {
+			[Symbol.asyncIterator]() {
+				return this;
+			},
+			next: (value) => step("next", value),
+			return: (value) => iterator ? step("return", value) : Promise.resolve({
+				done: true,
+				value
+			}),
+			throw: (error) => iterator ? step("throw", error) : Promise.reject(error)
+		};
 	};
+	return Object.freeze({
+		...provider,
+		auth: Object.freeze({
+			...provider.auth,
+			apiKey: requestToken
+		}),
+		getModels,
+		stream: (model, context, options) => networkIterable((prepared) => provider.stream(model, context, prepared), withPreferences(model, options)),
+		streamSimple: (model, context, options) => networkIterable((prepared) => provider.streamSimple(model, context, prepared), withPreferences(model, options))
+	});
 }
-function encodedLimit(decodedBytes) {
-	return Math.ceil(decodedBytes / 3) * 4;
-}
-function validBase64Body(value, end) {
-	for (let index = 0; index < end; index += 1) {
-		const code = value.charCodeAt(index);
-		if (!(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return false;
-	}
-	return true;
+Object.freeze([
+	"0.82.1",
+	"0.85.1",
+	"0.87.1"
+]);
+//#endregion
+//#region src/model-catalog.js
+const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${encodeURIComponent(PACKAGE_VERSION)}`;
+const LEVELS = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const DEFAULT_REFRESH_TIMEOUT_MS = 1e4;
+const record$3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const nonEmpty$1 = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0 ? value : void 0;
+function upgradeModelId(value) {
+	return (typeof value.upgrade === "string" ? nonEmpty$1(value.upgrade) : record$3(value.upgrade) ? nonEmpty$1(value.upgrade.model) : void 0) ?? (record$3(value.upgrade_info) ? nonEmpty$1(value.upgrade_info.model) : void 0) ?? (record$3(value.upgradeInfo) ? nonEmpty$1(value.upgradeInfo.model) : void 0);
 }
-async function readJsonWithin(response, maximumBytes) {
-	const contentLength = Number(response.headers.get("content-length"));
-	if (Number.isFinite(contentLength) && contentLength > maximumBytes) throw new Error("Codex image response exceeds the image size limit");
-	if (response.body === null) throw new Error("Codex returned an unreadable image response");
-	const reader = response.body.getReader();
-	const chunks = [];
-	let bytes = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		bytes += value.byteLength;
-		if (bytes > maximumBytes) {
-			await reader.cancel();
-			throw new Error("Codex image response exceeds the image size limit");
+function retirementMillis(value) {
+	for (const source of [
+		value,
+		value.upgrade,
+		value.upgrade_info,
+		value.upgradeInfo
+	]) {
+		if (!record$3(source)) continue;
+		for (const raw of [source.retirement_at, source.retirementAt]) {
+			const seconds = positiveInteger(raw);
+			if (seconds !== void 0 && Number.isSafeInteger(seconds * 1e3)) return seconds * 1e3;
+			if (typeof raw === "string" && /^\d{4}-\d{2}-\d{2}T[\d:.]+(?:Z|[+-]\d{2}:\d{2})$/u.test(raw)) {
+				const parsed = Date.parse(raw);
+				if (Number.isFinite(parsed) && parsed > 0) return parsed;
+			}
 		}
-		chunks.push(value);
 	}
-	const body = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), bytes).toString("utf8");
-	try {
-		return JSON.parse(body);
-	} catch {
-		throw new Error("Codex returned an unreadable image response");
-	}
-}
-/** Strictly decode one PNG returned by the subscription backend. */
-function decodeCodexPng(value, maximumBytes) {
-	const encoded = nonEmpty(value);
-	const padding = encoded?.endsWith("==") ? 2 : encoded?.endsWith("=") ? 1 : 0;
-	if (encoded === void 0 || encoded.length % 4 !== 0 || !validBase64Body(encoded, encoded.length - padding)) throw new Error("Codex returned an invalid base64 PNG");
-	const decodedBytes = encoded.length / 4 * 3 - padding;
-	if (decodedBytes > maximumBytes) throw new Error("Codex image exceeds the image size limit");
-	const data = Buffer.from(encoded, "base64");
-	if (data.length !== decodedBytes || data.length < PNG_SIGNATURE.length || !data.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) throw new Error("Codex returned an invalid PNG");
-	return new Uint8Array(data);
 }
-function imageReference(value) {
-	const originalDimensions = record$2(value.originalDimensions) ? {
-		width: value.originalDimensions.width,
-		height: value.originalDimensions.height
-	} : void 0;
+function retirementNotice(value, now = Date.now(), targetDisplayName) {
+	if (!record$3(value) || !Number.isFinite(now)) return void 0;
+	const at = retirementMillis(value);
+	if (at === void 0 || at <= now) return void 0;
+	const date = new Date(at);
+	if (!Number.isFinite(date.getTime())) return void 0;
+	const dateText = `${String(date.getUTCFullYear()).padStart(4, "0")}-${String(date.getUTCMonth() + 1).padStart(2, "0")}-${String(date.getUTCDate()).padStart(2, "0")}`;
+	const upgradeTo = upgradeModelId(value);
+	const upgradeName = upgradeTo === void 0 ? void 0 : nonEmpty$1(targetDisplayName) ?? upgradeTo;
 	return {
-		attachmentId: value.attachmentId,
-		mediaType: value.mediaType,
-		bytes: value.bytes,
-		width: value.width,
-		height: value.height,
-		...value.name === void 0 ? {} : { name: value.name },
-		...originalDimensions === void 0 ? {} : { originalDimensions }
+		text: `Retires on ${dateText} (UTC).${upgradeName === void 0 ? "" : ` Switch to ${upgradeName} to keep working.`}`,
+		at,
+		upgradeTo,
+		dateText
 	};
 }
-function normalizeAttachmentId(value) {
-	if (typeof value !== "string") return void 0;
-	if (FULL_ATTACHMENT_ID.test(value)) return value;
-	const bare = BARE_ATTACHMENT_DIGEST.exec(value);
-	return bare === null ? void 0 : `sha256:${bare[0].toLowerCase()}`;
+function reasoningMap(levels) {
+	const supported = new Set((Array.isArray(levels) ? levels : []).map((level) => nonEmpty$1(record$3(level) ? level.effort : void 0)).filter(Boolean));
+	const map = Object.fromEntries(LEVELS.map((level) => [level, null]));
+	if (supported.has("none")) map.off = "none";
+	for (const level of LEVELS.slice(1)) if (supported.has(level)) map[level] = level;
+	return map;
 }
-function invalidAttachmentId(value) {
-	const attachmentId = value?.attachmentId;
-	if (typeof attachmentId === "string" && (PATH_LIKE_ATTACHMENT_ID.test(attachmentId) || FILE_NAME_ATTACHMENT_ID.test(attachmentId))) throw new Error("referenceImages attachmentId is a file path or filename; call read_image on that file and retry with its complete sha256:<64 lowercase hex> attachment reference. Do not omit referenceImages or fall back to new image generation.");
-	throw new Error("referenceImages attachmentId must be sha256:<64 lowercase hex> copied from an image block or read_image result. Do not omit referenceImages or fall back to new image generation.");
+const capabilityNames = (values) => [...new Set(values.filter((value) => typeof value === "string" && /^[a-z][a-z0-9_-]{0,31}$/u.test(value)))].sort().slice(0, 16);
+const speedTierIds = (value) => [...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []];
+function unsupportedCapabilities(value) {
+	const reasoning = capabilityNames((value.supported_reasoning_levels ?? []).map((item) => item?.effort)).filter((level) => !["none", ...LEVELS.slice(1)].includes(level));
+	const inputs = capabilityNames(Array.isArray(value.input_modalities) ? value.input_modalities : []).filter((input) => !["text", "image"].includes(input));
+	const speeds = capabilityNames([...Array.isArray(value.additional_speed_tiers) ? value.additional_speed_tiers : [], ...Array.isArray(value.service_tiers) ? value.service_tiers.map((tier) => tier?.id) : []]).filter((tier) => ![
+		"auto",
+		"default",
+		"standard",
+		"fast",
+		"priority",
+		"ultrafast"
+	].includes(tier));
+	return {
+		...reasoning.length ? { reasoning } : {},
+		...inputs.length ? { inputs } : {},
+		...speeds.length ? { speeds } : {}
+	};
 }
-function referenceOf(value, attachments) {
-	const attachmentId = normalizeAttachmentId(value?.attachmentId);
-	if (attachmentId === void 0) invalidAttachmentId(value);
-	if (!record$2(value) || !attachments.imageLimits.mediaTypes.includes(value.mediaType) || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || !Number.isSafeInteger(value.width) || value.width <= 0 || !Number.isSafeInteger(value.height) || value.height <= 0 || value.name !== void 0 && (typeof value.name !== "string" || value.name.length > 256) || value.originalDimensions !== void 0 && (!record$2(value.originalDimensions) || !Number.isSafeInteger(value.originalDimensions.width) || value.originalDimensions.width <= 0 || !Number.isSafeInteger(value.originalDimensions.height) || value.originalDimensions.height <= 0)) throw new Error("referenceImages contains an invalid image reference");
-	return imageReference({
+function visibleModel(value, displayNames, now) {
+	if (!record$3(value)) return void 0;
+	const id = nonEmpty$1(value.slug);
+	const reserve = id === "gpt-reserve" && ["list", "hide"].includes(value.visibility);
+	if (id === void 0 || value.visibility !== "list" && !reserve) return void 0;
+	const supported = Array.isArray(value.supported_reasoning_levels) ? value.supported_reasoning_levels : [];
+	const input = Array.isArray(value.input_modalities) ? value.input_modalities.filter((item) => ["text", "image"].includes(item)) : ["text", "image"];
+	const unsupported = unsupportedCapabilities({
 		...value,
-		attachmentId
+		supported_reasoning_levels: supported
 	});
+	const upgradeTo = upgradeModelId(value);
+	const retirement = retirementNotice(value, now, displayNames.get(upgradeTo));
+	const notice = retirement?.text;
+	const description = nonEmpty$1(value.description);
+	return {
+		...Object.keys(unsupported).length ? { unsupported } : {},
+		id,
+		name: `${reserve ? "GPT-Reserve (Experimental)" : nonEmpty$1(value.display_name) ?? id}${retirement === void 0 ? "" : ` (retires ${retirement.dateText})`}`,
+		description: notice === void 0 ? description : description === void 0 ? notice : `${description}\n${notice}`,
+		...retirement === void 0 ? {} : { retirement: {
+			at: retirement.at,
+			upgradeTo: retirement.upgradeTo
+		} },
+		priority: Number.isFinite(value.priority) ? value.priority : 0,
+		input: input.length > 0 ? input : ["text"],
+		contextWindow: positiveInteger(value.context_window) ?? positiveInteger(value.max_context_window),
+		...positiveInteger(value.max_context_window) === void 0 ? {} : { maxContextWindow: value.max_context_window },
+		reasoning: supported.length > 0,
+		thinkingLevelMap: reasoningMap(supported),
+		supportVerbosity: value.support_verbosity === true,
+		defaultVerbosity: [
+			"low",
+			"medium",
+			"high"
+		].includes(value.default_verbosity) ? value.default_verbosity : void 0,
+		supportsFast: speedTierIds(value).some((tier) => tier === "fast" || tier === "priority"),
+		supportsUltrafast: speedTierIds(value).includes("ultrafast")
+	};
 }
-function sessionImageReferences(messages) {
-	const references = /* @__PURE__ */ new Map();
-	const visit = (content) => {
-		if (!Array.isArray(content)) return;
-		for (const block of content) if (block?.type === "image" && record$2(block.attachment)) {
-			const id = normalizeAttachmentId(block.attachment.attachmentId);
-			if (id !== void 0) references.set(id, block.attachment);
-		} else if (block?.type === "tool-result") visit(block.content);
+function parseOfficialModelCatalog(value, now = Date.now()) {
+	if (!record$3(value) || !Array.isArray(value.models)) throw new Error("Codex returned a malformed model catalog");
+	const displayNames = /* @__PURE__ */ new Map();
+	for (const model of value.models) {
+		if (!record$3(model)) continue;
+		const id = nonEmpty$1(model.slug);
+		const name = nonEmpty$1(model.display_name);
+		if (id !== void 0 && name !== void 0 && !displayNames.has(id)) displayNames.set(id, name);
+	}
+	const seen = /* @__PURE__ */ new Set();
+	return value.models.map((model) => visibleModel(model, displayNames, now)).filter((model) => model !== void 0 && !seen.has(model.id) && seen.add(model.id)).sort((left, right) => Number(left.id === "gpt-reserve") - Number(right.id === "gpt-reserve") || right.priority - left.priority);
+}
+function mergeModel(baseModels, remote) {
+	const base = baseModels.find((model) => model.id === remote.id) ?? baseModels.find((model) => model.id !== "gpt-5.3-codex-spark") ?? baseModels[0];
+	if (base === void 0) return void 0;
+	return {
+		...base,
+		id: remote.id,
+		name: remote.name,
+		...remote.retirement === void 0 || remote.description === void 0 ? {} : { description: remote.description },
+		input: remote.input,
+		reasoning: remote.reasoning,
+		thinkingLevelMap: remote.thinkingLevelMap,
+		...remote.contextWindow === void 0 ? {} : { contextWindow: remote.contextWindow },
+		...remote.maxContextWindow === void 0 ? {} : { maxContextWindow: remote.maxContextWindow },
+		...base.id === remote.id ? {} : { cost: {
+			input: 0,
+			output: 0,
+			cacheRead: 0,
+			cacheWrite: 0
+		} }
+	};
+}
+function createOfficialModelCatalog(options = {}) {
+	const fetchCatalog = options.fetch ?? fetch;
+	const getNow = options.now ?? Date.now;
+	const scheduleTimeout = options.setTimeout ?? setTimeout;
+	const cancelTimeout = options.clearTimeout ?? clearTimeout;
+	const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : DEFAULT_REFRESH_TIMEOUT_MS;
+	let models;
+	let metadata = /* @__PURE__ */ new Map();
+	let etag;
+	let rawCatalog;
+	let revision = 0;
+	let refreshing;
+	let generation = 0;
+	let refreshStatus = "idle";
+	const refresh = ({ signal } = {}) => {
+		if (signal?.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+		if (refreshing?.generation === generation) return refreshing.promise;
+		const currentGeneration = generation;
+		refreshStatus = "refreshing";
+		let outcome = "idle";
+		const controller = new AbortController();
+		const abort = () => {
+			if (!controller.signal.aborted) controller.abort(signal?.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+		};
+		signal?.addEventListener("abort", abort, { once: true });
+		const requestSignal = controller.signal;
+		let timer;
+		const timeoutError = /* @__PURE__ */ new Error("Codex model catalog refresh timed out");
+		const work = (async () => {
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, requestSignal);
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) return false;
+			const headers = {
+				authorization: `Bearer ${access}`,
+				"chatgpt-account-id": accountId,
+				accept: "application/json",
+				originator: "pi",
+				"user-agent": USER_AGENT,
+				...etag === void 0 ? {} : { "if-none-match": etag }
+			};
+			const response = await fetchCatalog(CODEX_MODELS_URL, {
+				method: "GET",
+				redirect: "error",
+				headers,
+				signal: requestSignal
+			});
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			if (response.status === 304) {
+				outcome = "ok";
+				if (rawCatalog === void 0) return false;
+				const remote = parseOfficialModelCatalog(rawCatalog, getNow());
+				const next = remote.map((model) => mergeModel(options.baseModels(), model)).filter(Boolean);
+				if (next.length === 0 || JSON.stringify(next) === JSON.stringify(models)) return false;
+				models = next;
+				metadata = new Map(remote.map((model) => [model.id, model]));
+				revision += 1;
+				options.onUpdated?.();
+				return true;
+			}
+			if (!response.ok) throw new Error(`Codex model catalog failed (HTTP ${response.status})`);
+			const raw = await response.json();
+			const remote = parseOfficialModelCatalog(raw, getNow());
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			if (remote.length === 0) throw new Error("Codex returned an empty model catalog");
+			const baseModels = options.baseModels();
+			const next = remote.map((model) => mergeModel(baseModels, model)).filter(Boolean);
+			if (next.length === 0) throw new Error("Codex model catalog has no compatible models");
+			if (currentGeneration !== generation || requestSignal.aborted) return false;
+			models = next;
+			rawCatalog = raw;
+			metadata = new Map(remote.map((model) => [model.id, model]));
+			etag = nonEmpty$1(response.headers.get("etag")) ?? etag;
+			revision += 1;
+			outcome = "ok";
+			options.onUpdated?.();
+			return true;
+		})();
+		let rejectAborted;
+		const abortPromise = new Promise((_, reject) => {
+			rejectAborted = () => reject(requestSignal.reason ?? /* @__PURE__ */ new Error("Codex model catalog refresh aborted"));
+			if (requestSignal.aborted) rejectAborted();
+			else requestSignal.addEventListener("abort", rejectAborted, { once: true });
+		});
+		timer = scheduleTimeout(() => controller.abort(timeoutError), timeoutMs);
+		timer.unref?.();
+		const promise = Promise.race([work, abortPromise]).catch((error) => {
+			outcome = "failed";
+			throw error;
+		}).finally(() => {
+			cancelTimeout(timer);
+			signal?.removeEventListener("abort", abort);
+			requestSignal.removeEventListener("abort", rejectAborted);
+			if (refreshing?.promise === promise) {
+				refreshing = void 0;
+				refreshStatus = outcome;
+			}
+		});
+		refreshing = {
+			generation: currentGeneration,
+			promise,
+			cancel: () => controller.abort()
+		};
+		return promise;
 	};
-	for (const message of messages ?? []) visit(message?.content);
-	return references;
-}
-async function editImages(values, attachments, signal, messages) {
-	if (!Array.isArray(values) || values.length === 0 || values.length > MAX_REFERENCE_IMAGES) throw new Error(`referenceImages must contain between 1 and ${MAX_REFERENCE_IMAGES} images`);
-	const available = messages === void 0 ? void 0 : sessionImageReferences(messages);
-	const references = values.map((value) => {
-		const id = normalizeAttachmentId(value?.attachmentId);
-		if (id === void 0) invalidAttachmentId(value);
-		if (available === void 0) return referenceOf(value, attachments);
-		const selected = available.get(id);
-		if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Call read_image on the intended image and retry with its returned reference. Do not omit referenceImages or substitute another image.");
-		return referenceOf(selected, attachments);
+	return Object.freeze({
+		refresh,
+		getModels: () => models ?? [],
+		metadata: (modelId) => metadata.get(modelId),
+		revision: () => revision,
+		capabilityGaps: () => [...metadata.values()].filter((model) => model.unsupported && /^[a-z][a-z0-9._-]{0,79}$/u.test(model.id)).slice(0, 20).map((model) => ({
+			model: model.id,
+			...structuredClone(model.unsupported)
+		})),
+		status: () => ({
+			source: models === void 0 ? "unavailable" : "online",
+			refresh: refreshStatus
+		}),
+		clear() {
+			generation += 1;
+			const flight = refreshing;
+			refreshing = void 0;
+			flight?.cancel();
+			models = void 0;
+			rawCatalog = void 0;
+			metadata = /* @__PURE__ */ new Map();
+			etag = void 0;
+			refreshStatus = "idle";
+			revision += 1;
+			options.onUpdated?.();
+		}
 	});
-	if (new Set(references.map((value) => value.attachmentId)).size !== references.length) throw new Error("referenceImages must not contain duplicates");
-	const images = [];
-	let totalBytes = 0;
-	for (const reference of references) {
-		const stored = await attachments.readImage(reference, signal);
-		totalBytes += stored.data.byteLength;
-		if (totalBytes > attachments.imageLimits.maxMessageImageBytes) throw new Error("referenceImages exceed the DSH message image limit");
-		images.push({ image_url: `data:${stored.ref.mediaType};base64,${Buffer.from(stored.data).toString("base64")}` });
-	}
-	return images;
-}
-function imageContent(value) {
-	const label = typeof value.size === "string" && value.size.length > 0 ? `Generated a ${value.size} image.` : "Generated an image.";
-	return [{
-		type: "text",
-		text: value.localPath === void 0 ? label : `${label}\nOriginal PNG saved on the DSH host at: ${JSON.stringify(value.localPath)}. Read this file or copy it to the workspace with a .png extension; this host path is not a browser URL.`
-	}, {
-		type: "image",
-		attachment: imageReference(value.image)
-	}];
 }
-function imageOutputSchema() {
-	return {
-		type: "object",
-		additionalProperties: false,
-		properties: {
-			image: {
-				type: "object",
-				required: true,
-				additionalProperties: false,
-				properties: {
-					attachmentId: {
-						type: "string",
-						required: true
-					},
-					mediaType: {
-						type: "string",
-						enum: ["image/png"],
-						required: true
-					},
-					bytes: {
-						type: "integer",
-						required: true
-					},
-					width: {
-						type: "integer",
-						required: true
-					},
-					height: {
-						type: "integer",
-						required: true
-					},
-					name: { type: "string" },
-					originalDimensions: {
-						type: "object",
-						additionalProperties: false,
-						properties: {
-							width: {
-								type: "integer",
-								required: true
-							},
-							height: {
-								type: "integer",
-								required: true
-							}
-						}
-					}
-				}
-			},
-			original: {
-				type: "object",
-				required: true,
-				additionalProperties: false,
-				properties: {
-					assetId: {
-						type: "string",
-						required: true
-					},
-					mediaType: {
-						type: "string",
-						enum: ["image/png"],
-						required: true
-					},
-					bytes: {
-						type: "integer",
-						required: true
-					},
-					width: {
-						type: "integer",
-						required: true
-					},
-					height: {
-						type: "integer",
-						required: true
-					},
-					name: {
-						type: "string",
-						required: true
-					},
-					sha256: {
-						type: "string",
-						required: true
-					}
-				}
-			},
-			background: { type: "string" },
-			requestedModel: { type: "string" },
-			reportedModel: { type: "string" },
-			requestedSize: { type: "string" },
-			localPath: {
-				type: "string",
-				required: true,
-				description: "Absolute path to the original PNG on the DSH host."
-			},
-			quality: { type: "string" },
-			size: { type: "string" }
-		}
+//#endregion
+//#region src/codex-search.js
+const CODEX_SEARCH_PROVIDER_ID = "codex-subscription";
+const CODEX_AUTO_SEARCH_PROVIDER_ID = "codex-subscription-auto";
+const CODEX_SEARCH_URL = "https://chatgpt.com/backend-api/codex/alpha/search";
+const DEFAULT_MODEL = "gpt-5.6-luna";
+const MAX_OUTPUT_TOKENS = 4096;
+const MAX_SOURCE_DATE = 64;
+const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const nonEmpty = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
+const displayText = (value) => {
+	const text = nonEmpty(value)?.replace(/\s+/gu, " ").trim();
+	if (text === void 0 || text.length === 0) return void 0;
+	return text;
+};
+const boundedDisplayText = (value, maximum) => {
+	const text = displayText(value);
+	if (text === void 0 || text.length <= maximum) return text;
+	return `${text.slice(0, maximum - 1)}…`;
+};
+function sourceOf(value) {
+	if (!record$2(value)) return void 0;
+	const url = nonEmpty(value.url);
+	if (url === void 0) return void 0;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+	const title = displayText(value.title) ?? parsed.hostname;
+	const snippet = displayText(value.snippet);
+	const publishedAt = boundedDisplayText(value.published_at, MAX_SOURCE_DATE) ?? boundedDisplayText(value.publishedAt, MAX_SOURCE_DATE);
+	return {
+		url,
+		title,
+		...snippet === void 0 ? {} : { snippet },
+		...publishedAt === void 0 ? {} : { publishedAt }
 	};
 }
-function responseMetadata(value) {
-	const data = Array.isArray(value?.data) ? value.data[0] : void 0;
-	const encoded = record$2(data) ? data.b64_json : void 0;
-	if (typeof encoded !== "string") throw new Error("Codex returned no image data");
+function parseSearchResponse(value) {
+	if (!record$2(value) || !Array.isArray(value.results)) throw new Error("Codex returned a malformed search response");
+	const seen = /* @__PURE__ */ new Set();
+	const sources = [];
+	for (const result of value.results ?? []) {
+		const source = sourceOf(result);
+		if (source === void 0 || seen.has(source.url)) continue;
+		seen.add(source.url);
+		sources.push(source);
+	}
 	return {
-		encoded,
-		background: nonEmpty(value.background),
-		quality: nonEmpty(value.quality),
-		size: nonEmpty(value.size),
-		reportedModel: nonEmpty(value.model)
+		sources,
+		truncated: false
 	};
 }
-/** Create the DSH-native image-generation tool backed only by the ChatGPT subscription. */
-function createCodexImageTool(options) {
-	const fetchImage = options.fetch ?? fetch;
-	const attachments = options.attachments;
-	return defineTool({
-		name: CODEX_IMAGE_TOOL_NAME,
-		description: "Generate or edit images only when the user asks for image output, not when merely discussing images. Uses the signed-in Codex subscription. For a new image, omit referenceImages. For edits, copy attachmentId only from the selected session image block; the host supplies its metadata. Never call read_image for an attachmentId or attachment filename. Use read_image only for an actual local file whose reference is not already in the conversation. Never substitute paths, unrelated images, or text-only generation for an edit. For numbered annotations, include the clean source and location-reference image, preserve the requested changes and coordinates in the prompt, and remove guidance markers from the result. If the intended references cannot be identified, ask rather than guessing.",
-		parameters: {
-			model: {
-				type: "string",
-				enum: Object.keys(IMAGE_MODELS),
-				description: "Optional image engine, independent of the conversation model. When omitted, uses the user image setting (initially gpt-image-2). The 2.5 identifiers are experimental subscription candidates; override only when explicitly requested. Never silently retry with another model."
-			},
-			prompt: {
-				type: "string",
-				required: true,
-				description: "A complete, production-ready description of the image to generate."
-			},
-			size: {
-				type: "string",
-				description: "Optional GPT Image 2 output size. Use auto unless the user requests an exact valid widthxheight resolution."
-			},
-			quality: {
-				type: "string",
-				enum: [
-					"auto",
-					"low",
-					"medium",
-					"high",
-					"xhigh",
-					"max"
-				],
-				description: "Optional rendering quality. Use auto unless the user requests draft speed or final quality."
-			},
-			background: {
-				type: "string",
-				enum: [
-					"auto",
-					"transparent",
-					"opaque"
-				],
-				description: "Optional background mode. Request transparent only when the user needs transparency."
-			},
-			referenceImages: {
-				type: "array",
-				description: "Optional references to 1-5 selected images. For session images provide only attachmentId; the host resolves trusted metadata. Omit only for a new image; never drop an invalid reference to bypass editing.",
-				items: {
-					type: "object",
-					additionalProperties: false,
-					properties: {
-						attachmentId: {
-							type: "string",
-							required: true,
-							description: "Copy the complete attachmentId from the image block or read_image result: sha256:<64 lowercase hex>. Never pass a workspace path, absolute path, or filename. A bare 64-character hex digest is accepted and normalized to sha256:<64 lowercase hex>."
-						},
-						mediaType: {
-							type: "string",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						bytes: {
-							type: "integer",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						width: {
-							type: "integer",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						height: {
-							type: "integer",
-							...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-						},
-						name: { type: "string" },
-						originalDimensions: {
-							type: "object",
-							additionalProperties: false,
-							properties: {
-								width: {
-									type: "integer",
-									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-								},
-								height: {
-									type: "integer",
-									...typeof options.getSessionMessages !== "function" ? { required: true } : {}
-								}
-							}
-						}
-					}
-				}
-			}
-		},
-		output: {
-			schema: imageOutputSchema(),
-			render: (_args, value) => imageContent(value),
-			presentationMeta: (_args, value) => ({
-				kind: "codex-subscription-image",
-				schemaVersion: 1,
-				original: value.original,
-				...value.requestedModel === void 0 ? {} : { requestedModel: value.requestedModel },
-				...value.reportedModel === void 0 ? {} : { reportedModel: value.reportedModel },
-				...value.requestedSize === void 0 ? {} : { requestedSize: value.requestedSize }
-			})
-		},
-		timeoutMs: 300 * 1e3,
-		isConcurrencySafe: () => false,
-		async execute(args, exec) {
-			assertImageOperation(options.getFeatures?.(), args.referenceImages !== void 0);
-			const defaults = readImageDefaults(options.getFeatures?.());
-			args = {
-				...args,
-				model: args.model ?? defaults.imageModel,
-				quality: args.quality ?? defaults.imageQuality
-			};
-			const prompt = nonEmpty(args.prompt);
-			if (prompt === void 0) throw new Error("prompt must be a non-empty string");
-			const imageOptions = normalizeImageOptions(args);
-			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, exec.signal);
-			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new Error("ChatGPT subscription is not signed in");
-			if (!attachments.imageLimits.mediaTypes.includes("image/png")) throw new Error("This DSH installation does not accept PNG image attachments");
-			const maximumBytes = Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
-			const editing = args.referenceImages !== void 0;
-			const sessionMessages = editing && typeof options.getSessionMessages === "function" ? await options.getSessionMessages(exec.agent?.id) : void 0;
-			const images = editing ? await editImages(args.referenceImages, attachments, exec.signal, sessionMessages ?? (options.getSessionMessages ? [] : void 0)) : void 0;
+/** Create the DSH web provider backed only by the ChatGPT subscription search endpoint. */
+function createCodexSearchProvider(options) {
+	const fetchSearch = options.fetch ?? fetch;
+	return Object.freeze({
+		id: CODEX_SEARCH_PROVIDER_ID,
+		available: () => true,
+		async search(request, signal) {
+			signal?.throwIfAborted();
+			const preferences = readCapabilitySettings(options.resolvePreferences?.());
+			if (preferences.searchMode === "disabled") throw new WebError("Codex search is disabled in subscription settings", "WEB_PROVIDER_UNAVAILABLE");
+			const { access, accountId } = await readSubscriptionCredentials(options.getAuth, options.readCredential, signal);
+			if (typeof access !== "string" || access.length === 0 || typeof accountId !== "string" || accountId.length === 0) throw new WebError("ChatGPT subscription is not signed in", "WEB_PROVIDER_CREDENTIAL_MISSING");
+			const model = nonEmpty(options.resolveModel?.()) ?? DEFAULT_MODEL;
+			const id = nonEmpty(options.resolveSessionId?.()) ?? randomUUID();
 			let response;
-			assertImageOperation(options.getFeatures?.(), editing);
 			try {
-				response = await fetchImage(editing ? CODEX_IMAGE_EDIT_URL : CODEX_IMAGE_GENERATION_URL, {
+				response = await fetchSearch(CODEX_SEARCH_URL, {
 					method: "POST",
 					redirect: "error",
 					headers: {
@@ -4053,60 +4087,58 @@ function createCodexImageTool(options) {
 						accept: "application/json",
 						"content-type": "application/json",
 						originator: "pi",
-						"x-codex-image-turn-id": String(exec.callId),
 						"user-agent": USER_AGENT
 					},
 					body: JSON.stringify({
-						...images === void 0 ? {} : { images },
-						prompt,
-						background: imageOptions.background,
-						model: resolveImageModel(args.model),
-						quality: imageOptions.quality,
-						size: imageOptions.size
+						id,
+						model,
+						input: request.query,
+						commands: {
+							search_query: [{ q: request.query }],
+							response_length: "short"
+						},
+						settings: {
+							allowed_callers: ["direct"],
+							external_web_access: preferences.searchMode === "live"
+						},
+						max_output_tokens: MAX_OUTPUT_TOKENS
 					}),
-					signal: exec.signal
+					signal
 				});
 			} catch (error) {
-				if (exec.signal.aborted) throw exec.signal.reason;
-				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
+				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
+				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			if (!response.ok) {
-				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
-				if (response.status === 429) throw new Error("Codex image generation quota is unavailable");
-				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})`);
+			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			let value;
+			try {
+				value = await response.json();
+			} catch (error) {
+				throw new WebError("Codex returned an unreadable search response", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			const metadata = responseMetadata(await readJsonWithin(response, encodedLimit(maximumBytes) + RESPONSE_ENVELOPE_BYTES));
-			const data = decodeCodexPng(metadata.encoded, maximumBytes);
-			const sessionId = exec.agent?.id;
-			if (sessionId === void 0) throw new Error("Codex image generation requires a session-owned tool call");
-			const original = await options.originalImages.save(String(sessionId), data);
-			let ref;
 			try {
-				ref = await attachments.saveImage({
-					data,
-					mediaType: "image/png",
-					name: "codex-generated.png"
+				const result = parseSearchResponse(value);
+				if (preferences.searchDomains.length > 0) result.sources = result.sources.filter((source) => {
+					const hostname = new URL(source.url).hostname.toLowerCase();
+					return preferences.searchDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`));
 				});
+				return result;
 			} catch (error) {
-				await options.originalImages.remove(original);
-				throw error;
+				throw new WebError("Codex returned a malformed search response", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			const result = {
-				requestedModel: resolveImageModel(args.model),
-				requestedSize: imageOptions.size,
-				...metadata.reportedModel === void 0 ? {} : { reportedModel: metadata.reportedModel },
-				image: imageReference(ref),
-				original,
-				localPath: options.originalImages.originalPath(original.assetId),
-				...metadata.background === void 0 ? {} : { background: metadata.background },
-				...metadata.quality === void 0 ? {} : { quality: metadata.quality },
-				size: `${original.width}x${original.height}`
-			};
-			if (exec.parent !== void 0) exec.deferContext(createUserMessage({
-				content: imageContent(result),
-				source: { kind: "codex-subscription-image" }
-			}));
-			return result;
+		}
+	});
+}
+/** Route each request by its initiating model without changing the user's explicit overrides. */
+function createCodexAutoSearchProvider(options) {
+	return Object.freeze({
+		id: CODEX_AUTO_SEARCH_PROVIDER_ID,
+		available: () => true,
+		async search(request, signal) {
+			if (options.resolveModelProvider?.() === "openai-codex") return options.codex.search(request, signal);
+			const provider = options.resolveDshProvider?.();
+			if (provider === void 0 || provider.id === "codex-subscription-auto" || provider.id === "codex-subscription" || provider.available() !== true) throw new WebError("DSH default search is unavailable", "WEB_PROVIDER_UNAVAILABLE");
+			return provider.search(request, signal);
 		}
 	});
 }
@@ -4792,6 +4824,24 @@ function safeCounters(source, keys) {
 	return Object.fromEntries(keys.filter((key) => Number.isSafeInteger(values?.[key]) && values[key] >= 0).map((key) => [key, values[key]]));
 }
 //#endregion
+//#region src/credit-expiry.js
+const PRO_200_COMPENSATION = Object.freeze({
+	credits: 62500,
+	expiresAt: Date.UTC(2026, 11, 31, 12)
+});
+/** Expiry of the balance: the API's own value when it has one, otherwise the known grant. */
+function creditExpiry({ planType, balance, apiExpiresAt }, now = Date.now()) {
+	if (Number.isFinite(apiExpiresAt) && apiExpiresAt > now) return {
+		expiresAt: apiExpiresAt,
+		source: "api"
+	};
+	const amount = Number(balance);
+	if (planType === "pro" && Number.isFinite(amount) && amount >= PRO_200_COMPENSATION.credits && now < PRO_200_COMPENSATION.expiresAt) return {
+		expiresAt: PRO_200_COMPENSATION.expiresAt,
+		source: "estimate"
+	};
+}
+//#endregion
 //#region src/usage.js
 const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
 const DEFAULT_TTL_MS = 6e4;
@@ -4833,15 +4883,44 @@ function epochSeconds(value, label) {
 	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`Codex returned an invalid ${label}`);
 	return value;
 }
-function creditsOf(value) {
+function messageRange(value) {
+	return Array.isArray(value) && value.length === 2 && value.every((item) => Number.isSafeInteger(item) && item >= 0) ? [value[0], value[1]] : void 0;
+}
+function expiryOf(value) {
+	const raw = value?.expires_at;
+	if (Number.isSafeInteger(raw) && raw > 0) return raw * 1e3;
+	if (typeof raw === "string" && raw.length <= 64) {
+		const parsed = Date.parse(raw);
+		if (Number.isFinite(parsed) && parsed > 0) return parsed;
+	}
+}
+function creditsOf(value, planType) {
 	if (value === void 0 || value === null) return void 0;
 	if (!record$1(value) || typeof value.has_credits !== "boolean" || typeof value.unlimited !== "boolean") throw new Error("Codex returned malformed credit details");
 	if (!value.has_credits) return void 0;
+	const balance = value.balance === void 0 || value.balance === null ? void 0 : decimal(value.balance, "credit balance");
+	const expiry = value.unlimited ? void 0 : creditExpiry({
+		planType,
+		balance,
+		apiExpiresAt: expiryOf(value)
+	});
+	const local = messageRange(value.approx_local_messages), cloud = messageRange(value.approx_cloud_messages);
 	return {
 		unlimited: value.unlimited,
-		...value.balance === void 0 || value.balance === null ? {} : { balance: decimal(value.balance, "credit balance") }
+		...balance === void 0 ? {} : { balance },
+		...expiry === void 0 ? {} : {
+			expiresAt: expiry.expiresAt,
+			expirySource: expiry.source
+		},
+		...local === void 0 ? {} : { approxLocalMessages: local },
+		...cloud === void 0 ? {} : { approxCloudMessages: cloud }
 	};
 }
+function chatPassOf(value) {
+	if (!record$1(value) || !Array.isArray(value.windows)) return void 0;
+	const windows = value.windows.map(windowOf).filter(Boolean);
+	return windows.length === 0 ? void 0 : { windows };
+}
 function individualOf(value) {
 	if (value === void 0 || value === null) return void 0;
 	if (!record$1(value)) throw new Error("Codex returned malformed spend control");
@@ -4905,12 +4984,14 @@ function parseCodexUsage(value) {
 		addLimit(limitOf(entry.metered_feature, entry.limit_name || void 0, entry.rate_limit));
 	}
 	addLimit(limitOf("code_review", "Code review", value.code_review_rate_limit));
-	const credits = creditsOf(value.credits);
+	const chatPass = chatPassOf(value.chatpass);
+	const credits = creditsOf(value.credits, typeof value.plan_type === "string" ? value.plan_type : void 0);
 	const individualLimit = individualOf(value.spend_control);
 	const spendControlReached = spendControlReachedOf(value.spend_control);
 	const resetCredits = resetCreditsOf(value.rate_limit_reset_credits);
 	return {
 		rateLimits,
+		...chatPass === void 0 ? {} : { chatPass },
 		...credits === void 0 ? {} : { credits },
 		...individualLimit === void 0 ? {} : { individualLimit },
 		...spendControlReached === void 0 ? {} : { spendControlReached },
@@ -6478,7 +6559,7 @@ function apply(ctx, config = {}) {
 		let dispose;
 		const sync = () => {
 			const value = settings.get();
-			if (value.imageSketchAgent && value.imageSketch && value.imageEditing) dispose ??= ctx.tools.register(createSketchAgentTool(sketchBridge, ctx.attachments));
+			if (value.imageSketchAgent && value.imageSketch && value.imageEditing) dispose ??= ctx.tools.register(createSketchAgentTool(sketchBridge, ctx.attachments, (sessionId) => ctx.get?.("sessions")?.get?.(sessionId)?.deriveMessages?.() ?? []));
 			else {
 				dispose?.();
 				dispose = void 0;