dsh-codex-subscription 3.0.0-beta.6 → 3.0.0-beta.8

package/lib/index.js

@@ -12,7 +12,7 @@ import { clientRequestSchema } from "@deepseek-ai/dsh-client-connection";
 import { lstat, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { constants, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
@@ -1199,6 +1199,7 @@ const RPC_ENDPOINTS = Object.freeze([
 	"account/select",
 	"account/remove",
 	"usage",
+	"usage/accounts",
 	"usage/history",
 	"usage/profile",
 	"diagnostics",
@@ -1400,7 +1401,9 @@ const SUPPORTED_RUNTIME_VERSIONS = Object.freeze([
 	"0.2.0-rc.2",
 	"0.2.1-alpha.1",
 	"0.2.1-alpha.2",
-	"0.2.1-alpha.3"
+	"0.2.1-alpha.3",
+	"0.2.1-alpha.4",
+	"0.2.1-alpha.5"
 ]);
 const require = createRequire(import.meta.url);
 const execute = promisify(execFile);
@@ -2158,9 +2161,36 @@ function inheritedOriginalImageRef(session, assetId) {
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "3.0.0-beta.6";
+const PACKAGE_VERSION = "3.0.0-beta.8";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
+//#region src/http-failure.js
+const SIGN_IN_RENEW = "ChatGPT sign-in needs to be renewed";
+const REQUEST_BLOCKED = "ChatGPT blocked this request before it reached your account (HTTP 403); your sign-in is fine, try again later or check your network, proxy or VPN";
+const CHALLENGE_MARKERS = /just a moment|cf-chl|_cf_chl_opt|attention required|enable javascript and cookies|challenge-platform/iu;
+/** Whether error text is a Cloudflare / network-protection page (pi-ai keeps only the body of a failed request, not its status). */
+const isChallengePage = (text) => typeof text === "string" && /^\s*<(?:!doctype|html)/iu.test(text) && CHALLENGE_MARKERS.test(text);
+/** Whether a 403 response is a Cloudflare / network-protection page rather than an answer from the ChatGPT backend. */
+async function isBlockedByNetwork(response) {
+	if (response?.status !== 403) return false;
+	try {
+		const header = (name) => String(response.headers?.get?.(name) ?? "");
+		if (/challenge/iu.test(header("cf-mitigated"))) return true;
+		if (!/html/iu.test(header("content-type"))) return false;
+		if (/cloudflare/iu.test(header("server"))) return true;
+		const text = typeof response.clone === "function" ? (await response.clone().text()).slice(0, 8192) : "";
+		return CHALLENGE_MARKERS.test(text);
+	} catch {
+		return false;
+	}
+}
+/** The error message for a 401 or 403 answer, or undefined for any other status. */
+async function authFailureMessage(response) {
+	if (response?.status === 401) return SIGN_IN_RENEW;
+	if (response?.status !== 403) return void 0;
+	return await isBlockedByNetwork(response) ? REQUEST_BLOCKED : SIGN_IN_RENEW;
+}
+//#endregion
 //#region src/codex-images.js
 const CODEX_IMAGE_TOOL_NAME = "codex_image_generate";
 const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
@@ -2663,7 +2693,8 @@ function createCodexImageTool(options) {
 				throw new Error(`Codex image ${editing ? "edit" : "generation"} request failed${requestFailureReason(error)}`, { cause: error });
 			}
 			if (!response.ok) {
-				if (response.status === 401 || response.status === 403) throw new Error("ChatGPT sign-in needs to be renewed");
+				const authFailure = await authFailureMessage(response);
+				if (authFailure !== void 0) throw new Error(authFailure);
 				const requestId = supportId(response);
 				if (response.status === 429) throw new Error(`${await limitMessage(response)}${requestId}`);
 				throw new Error(`Codex image ${editing ? "edit" : "generation"} failed (HTTP ${response.status})${requestId}`);
@@ -3969,7 +4000,7 @@ const emptyTurn = () => ({
 	completedAt: null,
 	durationMs: null
 });
-const textOf = (content) => (content ?? []).map((block) => block?.type === "text" ? block.text : "").filter(Boolean).join("\n");
+const textOf$1 = (content) => (content ?? []).map((block) => block?.type === "text" ? block.text : "").filter(Boolean).join("\n");
 const inputText = (input) => (Array.isArray(input) ? input : []).map((part) => part?.type === "text" ? part.text : "").filter(Boolean).join("\n");
 /** Skills the phone picked, written the way DSH invokes a skill: a /name gesture ahead of the text. */
 const skillGestures = (input) => (Array.isArray(input) ? input : []).filter((part) => part?.type === "skill" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(String(part.name))).map((part) => `/${part.name}`);
@@ -3996,7 +4027,7 @@ function parseArguments(value) {
 	}
 }
 /** What the person typed: DSH appends its own system reminders (skills, context) to user messages. */
-const visibleText = (content) => textOf(content).replace(/<system-reminder>[\s\S]*?<\/system-reminder>/gu, "").trim();
+const visibleText = (content) => textOf$1(content).replace(/<system-reminder>[\s\S]*?<\/system-reminder>/gu, "").trim();
 /** Text of a user-role message the person wrote; DSH's own injected ones (runtime context, notices) carry another source kind. */
 const typedText = (message) => message.role === "user" && (message.source === void 0 || message.source?.kind === "user") ? visibleText(message.content) : "";
 const lines = (text) => String(text ?? "").split("\n");
@@ -4101,7 +4132,7 @@ function finishTool(item, message, imageUrls) {
 	const failed = Boolean(message.isError);
 	item.status = failed ? "failed" : "completed";
 	if (item.type === "commandExecution") {
-		item.aggregatedOutput = textOf(message.content);
+		item.aggregatedOutput = textOf$1(message.content);
 		item.exitCode = failed ? 1 : 0;
 	} else if (item.type === "imageGeneration") {
 		const url = imageBlocks(message).map((block) => imageUrls.get(block.attachment.attachmentId)).find(Boolean);
@@ -4111,7 +4142,7 @@ function finishTool(item, message, imageUrls) {
 		item.contentItems = toolOutput(message, imageUrls);
 		item.success = !failed;
 	} else if (item.type === "mcpToolCall") {
-		const text = textOf(message.content);
+		const text = textOf$1(message.content);
 		if (failed) item.error = { message: text.slice(0, 500) || "The connector tool failed" };
 		else item.result = {
 			content: [{
@@ -4125,7 +4156,7 @@ function finishTool(item, message, imageUrls) {
 const imageBlocks = (message) => (message.content ?? []).filter((block) => block?.type === "image" && block.attachment);
 const toolOutput = (message, imageUrls) => [{
 	type: "inputText",
-	text: textOf(message.content)
+	text: textOf$1(message.content)
 }, ...imageBlocks(message).map((block) => imageUrls.get(block.attachment.attachmentId)).filter(Boolean).map((imageUrl) => ({
 	type: "inputImage",
 	imageUrl
@@ -4242,7 +4273,7 @@ function thread({ id, title, preview, cwd, createdAt, updatedAt, running, turns
 */
 const PHONE_RETURN_MS = 12e4;
 const ADOPT_WITHIN_MS = 6e5;
-function createDshRemoteControl({ controller, agents, permissions = () => void 0, workspaces = () => void 0, attachments = () => void 0, usage = () => void 0, usageProfile = () => void 0, projections = () => void 0, skills = () => void 0, llm = () => void 0, trace = () => {}, phoneReturnMs = PHONE_RETURN_MS, userAgent }) {
+function createDshRemoteControl({ controller, agents, permissions = () => void 0, workspaces = () => void 0, attachments = () => void 0, usage = () => void 0, usageProfile = () => void 0, projections = () => void 0, skills = () => void 0, commands = () => void 0, llm = () => void 0, trace = () => {}, phoneReturnMs = PHONE_RETURN_MS, userAgent }) {
 	const subscribers = /* @__PURE__ */ new Map();
 	const active = /* @__PURE__ */ new Map();
 	const queues = /* @__PURE__ */ new Map();
@@ -4314,6 +4345,16 @@ function createDshRemoteControl({ controller, agents, permissions = () => void 0
 			reasoningEffort: agent.options.reasoningEffort
 		} : void 0;
 	};
+	const directoryOf = (session) => {
+		try {
+			const events = typeof session?.snapshotEvents === "function" ? session.snapshotEvents() : session?.eventsSnapshot;
+			for (let index = (events?.length ?? 0) - 1; index >= 0; index -= 1) {
+				const cwd = events[index]?.type === "working-directory/change" ? events[index].data?.cwd : void 0;
+				if (typeof cwd === "string" && cwd !== "") return cwd;
+			}
+		} catch {}
+		return session?.meta?.cwd;
+	};
 	const sameSelection = (a, b) => a?.provider === b?.provider && a?.model === b?.model && a?.reasoningEffort === b?.reasoningEffort;
 	const selection = (agent) => {
 		const saved = recorded(agent);
@@ -4435,16 +4476,17 @@ function createDshRemoteControl({ controller, agents, permissions = () => void 0
 		const messages = session.deriveMessages();
 		const first = messages.find((message) => typedText(message) !== "");
 		const imageUrls = await imageUrlsOf(messages);
+		const cwd = directoryOf(session);
 		return {
 			agent,
 			thread: thread({
 				id,
-				cwd: session.meta?.cwd,
+				cwd,
 				createdAt: session.meta?.createdAt,
 				running: active.has(id),
 				projectId: projectIdOf(id),
 				preview: first ? visibleText(first.content).slice(0, 200) : "",
-				turns: withLiveTurn(id, projectTurns(messages, session.meta?.createdAt, imageUrls, session.meta?.cwd))
+				turns: withLiveTurn(id, projectTurns(messages, session.meta?.createdAt, imageUrls, cwd))
 			})
 		};
 	};
@@ -5051,6 +5093,92 @@ function createDshRemoteControl({ controller, agents, permissions = () => void 0
 		"turn/start": (params, { notify }) => titles.has(params?.threadId) ? titleTurn(params, notify) : startTurn(params, notify),
 		"turn/interrupt": (params) => {
 			service().cancel({ sessionId: params?.threadId });
+			active.get(params?.threadId)?.abort?.abort();
+			return {};
+		},
+		"thread/compact/start": async (params, { notify }) => {
+			const id = params?.threadId;
+			const registry = commands();
+			const agent = await agentFor(id);
+			if (typeof registry?.execute !== "function" || registry.find?.(agent, "compact") === void 0) throw new RpcError(-32601, "This DSH version cannot compact a conversation on request");
+			if (active.has(id)) throw new RpcError(-32602, "A turn is already running in this conversation");
+			subscribe(id, notify);
+			const turn = emptyTurn();
+			const abort = new AbortController();
+			active.set(id, {
+				turn,
+				ended: void 0,
+				abort
+			});
+			emit(id, "turn/started", {
+				threadId: id,
+				turn
+			});
+			emit(id, "thread/status/changed", {
+				threadId: id,
+				status: {
+					type: "active",
+					activeFlags: []
+				}
+			});
+			(async () => {
+				try {
+					const result = (await registry.execute(agent, "/compact", [], abort.signal))?.result;
+					if (result?.kind === "error") throw new Error(result.text || "Compaction failed");
+					if (result?.sourceEventSeq !== void 0 && turn.items.length === 0) {
+						const item = {
+							type: "contextCompaction",
+							id: randomUUID()
+						};
+						turn.items.push(item);
+						emit(id, "item/started", {
+							threadId: id,
+							turnId: turn.id,
+							item,
+							startedAtMs: Date.now()
+						});
+						emit(id, "item/completed", {
+							threadId: id,
+							turnId: turn.id,
+							item,
+							completedAtMs: Date.now()
+						});
+					}
+					turn.status = "completed";
+				} catch (error) {
+					turn.status = abort.signal.aborted ? "interrupted" : "failed";
+					if (turn.status === "failed") {
+						turn.error = {
+							message: String(error?.message ?? "Compaction failed").slice(0, 500),
+							codexErrorInfo: null,
+							additionalDetails: null
+						};
+						emit(id, "error", {
+							threadId: id,
+							turnId: turn.id,
+							willRetry: false,
+							error: turn.error
+						});
+					}
+				}
+				turn.completedAt = seconds(Date.now());
+				active.delete(id);
+				compactions.delete(id);
+				const usageNow = tokenUsage(agent.session);
+				if (usageNow) emit(id, "thread/tokenUsage/updated", {
+					threadId: id,
+					turnId: turn.id,
+					tokenUsage: usageNow
+				});
+				emit(id, "turn/completed", {
+					threadId: id,
+					turn
+				});
+				emit(id, "thread/status/changed", {
+					threadId: id,
+					status: { type: "idle" }
+				});
+			})();
 			return {};
 		},
 		"turn/steer": async (params) => {
@@ -5255,7 +5383,7 @@ function createDshRemoteControl({ controller, agents, permissions = () => void 0
 		}) : askPhone(request, "item/commandExecution/requestApproval", {
 			...common,
 			command: commandText(session, request),
-			cwd: session.meta?.cwd ?? null,
+			cwd: directoryOf(session) ?? null,
 			reason,
 			commandActions: [],
 			availableDecisions: [
@@ -5389,7 +5517,7 @@ function createDshRemoteControl({ controller, agents, permissions = () => void 0
 				type: "text",
 				text: "x"
 			}]
-		}, message], void 0, void 0, session.meta?.cwd).flatMap((turn) => turn.items.slice(1));
+		}, message], void 0, void 0, directoryOf(session)).flatMap((turn) => turn.items.slice(1));
 		const stream = streams.get(session.id);
 		streams.delete(session.id);
 		let reuse = stream?.item;
@@ -5686,6 +5814,42 @@ var DshOAuthAccountVault = class {
 			return clone$1(payload?.accounts.find((account) => account.id === payload.activeId)?.credential);
 		});
 	}
+	/** One account's credential, whether or not it is the active one. */
+	readAccount(id) {
+		return this.#enqueue(async () => {
+			const payload = await this.#ensurePayload();
+			return clone$1(payload?.accounts.find((account) => account.id === id)?.credential);
+		});
+	}
+	/** Update one account's credential (a token refresh) without changing which account is active. */
+	modifyAccount(id, update) {
+		return this.#enqueue(async () => {
+			let result;
+			await this.#modifyPayload(async (current) => {
+				const index = current.accounts.findIndex((account) => account.id === id);
+				if (index < 0) throw new Error("Unknown Codex account");
+				const previous = clone$1(current.accounts[index].credential);
+				const next = await update(previous);
+				if (next === void 0) {
+					result = previous;
+					return current;
+				}
+				const credential = sanitizeOAuthCredential(next);
+				if (credential.email === void 0 && previous.email !== void 0) credential.email = previous.email;
+				const accounts = [...current.accounts];
+				accounts[index] = {
+					...accounts[index],
+					credential
+				};
+				result = clone$1(credential);
+				return {
+					...current,
+					accounts
+				};
+			});
+			return result;
+		});
+	}
 	activeId() {
 		return this.#enqueue(async () => (await this.#ensurePayload())?.activeId);
 	}
@@ -5785,11 +5949,11 @@ var DshOAuthAccountVault = class {
 };
 //#endregion
 //#region src/credential-store.js
-const PROVIDER$1 = "openai-codex";
+const PROVIDER$2 = "openai-codex";
 const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
 const clone = (value) => value === void 0 ? void 0 : structuredClone(value);
-function assertProvider(providerId) {
-	if (providerId !== PROVIDER$1) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
+function assertProvider$1(providerId) {
+	if (providerId !== PROVIDER$2) throw new Error(`Codex credential store does not own provider ${JSON.stringify(providerId)}`);
 }
 function assertOAuthCredential(value) {
 	if (value === void 0) return void 0;
@@ -5822,7 +5986,7 @@ var DshOAuthCredentialStore = class {
 		this.vault = options.vault;
 	}
 	#enqueue(providerId, operation, options) {
-		assertProvider(providerId);
+		assertProvider$1(providerId);
 		const current = (this.#chains.get(providerId) ?? Promise.resolve()).catch(() => void 0).then(async () => {
 			abortIfNeeded(options);
 			return operation();
@@ -5835,7 +5999,7 @@ var DshOAuthCredentialStore = class {
 		return current;
 	}
 	async #read(providerId, options) {
-		assertProvider(providerId);
+		assertProvider$1(providerId);
 		abortIfNeeded(options);
 		if (this.vault !== void 0) {
 			const current = await this.vault.readActive();
@@ -5868,8 +6032,8 @@ var DshOAuthCredentialStore = class {
 	}
 	async list(options) {
 		abortIfNeeded(options);
-		return await this.read(PROVIDER$1, options) === void 0 ? [] : [{
-			providerId: PROVIDER$1,
+		return await this.read(PROVIDER$2, options) === void 0 ? [] : [{
+			providerId: PROVIDER$2,
 			type: "oauth"
 		}];
 	}
@@ -5919,16 +6083,16 @@ function createCodexAuthService(models, store, options = {}) {
 	const createPendingStore = options.createPendingStore ?? (() => new PendingOAuthCredentialStore());
 	return Object.freeze({
 		async status(options) {
-			const current = await store.read(PROVIDER$1, options);
+			const current = await store.read(PROVIDER$2, options);
 			const accounts = await accountVault?.list();
 			if (current === void 0) return {
 				authenticated: false,
-				provider: PROVIDER$1,
+				provider: PROVIDER$2,
 				...accounts === void 0 ? {} : { accounts }
 			};
 			return {
 				authenticated: true,
-				provider: PROVIDER$1,
+				provider: PROVIDER$2,
 				type: "oauth",
 				expiresAt: current.expires,
 				...accounts === void 0 ? {} : { accounts }
@@ -5939,13 +6103,13 @@ function createCodexAuthService(models, store, options = {}) {
 				if (accountVault === void 0 || createLoginModels === void 0) throw new Error("Codex multi-account is unavailable");
 				return runLogin(async () => {
 					const pending = createPendingStore();
-					await createLoginModels(pending).login(PROVIDER$1, "oauth", interaction);
+					await createLoginModels(pending).login(PROVIDER$2, "oauth", interaction);
 					const credential = pending.credential();
 					if (credential === void 0) throw new Error("Codex login did not return credentials");
 					await accountVault.add(input.label, credential);
 				});
 			}
-			return runLogin(() => models.login(PROVIDER$1, "oauth", interaction));
+			return runLogin(() => models.login(PROVIDER$2, "oauth", interaction));
 		},
 		async select(id) {
 			if (accountVault === void 0) throw new Error("Codex multi-account is unavailable");
@@ -5958,7 +6122,7 @@ function createCodexAuthService(models, store, options = {}) {
 			return this.status();
 		},
 		logout(options) {
-			return models.logout(PROVIDER$1, options);
+			return models.logout(PROVIDER$2, options);
 		}
 	});
 }
@@ -6431,6 +6595,62 @@ function redactRequest(value) {
 	return walk(value, "", 0);
 }
 //#endregion
+//#region src/pi-ai-compat.js
+const versionOf = (specifier) => {
+	try {
+		let path = fileURLToPath(import.meta.resolve(specifier));
+		for (let depth = 0; depth < 6; depth += 1) {
+			path = path.replace(/[\\/][^\\/]+$/u, "");
+			try {
+				const manifest = JSON.parse(readFileSync(`${path}/package.json`, "utf8"));
+				if (typeof manifest.version === "string") return manifest.version;
+			} catch {}
+		}
+	} catch {}
+};
+let cached;
+/** Versions of the pi-ai library and of DSH's adapter this plugin runs against. */
+function runtimeVersions() {
+	cached ??= {
+		piAi: versionOf("@earendil-works/pi-ai"),
+		adapter: versionOf("@deepseek-ai/dsh-llm-pi-ai")
+	};
+	return cached;
+}
+const atLeast087 = (version) => {
+	const match = /^(\d+)\.(\d+)/u.exec(version ?? "");
+	return match !== null && (Number(match[1]) > 0 || Number(match[2]) >= 87);
+};
+/** Whether the installed pi-ai understands system messages inside the transcript. */
+const understandsSystemMessages = (version) => atLeast087(version);
+const textOf = (content) => typeof content === "string" ? content : Array.isArray(content) ? content.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n") : "";
+/**
+* Fold the transcript's leading system messages back into `systemPrompt` and `tools`,
+* the form every pi-ai release accepts. Messages after the first non-system one stay.
+*/
+function hoistLeadingSystem(context) {
+	const messages = context?.messages;
+	if (!Array.isArray(messages) || messages[0]?.role !== "system") return context;
+	let end = 0;
+	const texts = context.systemPrompt ? [context.systemPrompt] : [];
+	const tools = [...Array.isArray(context.tools) ? context.tools : []];
+	while (messages[end]?.role === "system") {
+		const message = messages[end];
+		const text = [textOf(message.content), ...Object.values(message.sections ?? {}).filter((value) => typeof value === "string")].filter(Boolean).join("\n\n");
+		if (text !== "") texts.push(text);
+		if (Array.isArray(message.toolsAdded)) tools.push(...message.toolsAdded);
+		end += 1;
+	}
+	const { systemPrompt: _systemPrompt, tools: _tools, ...rest } = context;
+	const systemPrompt = texts.join("\n\n");
+	return {
+		...rest,
+		...systemPrompt === "" ? {} : { systemPrompt },
+		...tools.length === 0 ? {} : { tools },
+		messages: messages.slice(end)
+	};
+}
+//#endregion
 //#region src/transport-failure.js
 const TRANSIENT_WEBSOCKET_CLOSE = /^WebSocket closed (?:1000|1006|1011|1012|1013)(?:\s|$)/;
 const GATEWAY_REPLAY_BUFFER_EXCEEDED = /^\s*exceeded request buffer limit while retrying upstream\s*$/;
@@ -6438,6 +6658,13 @@ function normalizeTransportEvent(event, signal) {
 	if (signal?.aborted || event?.type !== "error" || event.reason !== "error") return event;
 	const message = event.error?.errorMessage;
 	if (typeof message !== "string") return event;
+	if (isChallengePage(message)) return {
+		...event,
+		error: {
+			...event.error,
+			errorMessage: REQUEST_BLOCKED
+		}
+	};
 	if (!TRANSIENT_WEBSOCKET_CLOSE.test(message) && !GATEWAY_REPLAY_BUFFER_EXCEEDED.test(message)) return event;
 	return {
 		...event,
@@ -6724,7 +6951,8 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 			throw: (error) => iterator ? step("throw", error) : Promise.reject(error)
 		};
 	};
-	const routed = (method, model, context, options) => {
+	const routed = (method, model, transcript, options) => {
+		const context = understandsSystemMessages(runtimeVersions().piAi) ? transcript : hoistLeadingSystem(transcript);
 		const route = reviewRoute(model, context);
 		const source = {
 			method,
@@ -6753,7 +6981,8 @@ Object.freeze([
 	"0.85.1",
 	"0.87.1",
 	"1.1.0",
-	"1.2.0"
+	"1.2.0",
+	"1.3.0"
 ]);
 //#endregion
 //#region src/model-catalog.js
@@ -7160,7 +7389,10 @@ function createCodexSearchProvider(options) {
 				if (signal?.aborted || error?.name === "AbortError") throw new WebError("Codex search aborted", "WEB_ABORTED", { cause: error });
 				throw new WebError("Codex search request failed", "WEB_PROVIDER_ERROR", { cause: error });
 			}
-			if (!response.ok) throw response.status === 401 || response.status === 403 ? new WebError("ChatGPT sign-in needs to be renewed", "WEB_PROVIDER_CREDENTIAL_MISSING") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			if (!response.ok) {
+				const authFailure = await authFailureMessage(response);
+				throw authFailure === "ChatGPT sign-in needs to be renewed" ? new WebError(authFailure, "WEB_PROVIDER_CREDENTIAL_MISSING") : authFailure !== void 0 ? new WebError(authFailure, "WEB_PROVIDER_ERROR") : new WebError(`Codex search request failed (HTTP ${response.status})`, "WEB_PROVIDER_ERROR");
+			}
 			let value;
 			try {
 				value = await response.json();
@@ -7691,6 +7923,15 @@ function safeRequests(network) {
 	}
 	return result;
 }
+/** pi-ai and DSH's adapter come from the host; a profile can pair an adapter with an older library, so the report names both. */
+function libraryVersions() {
+	const { piAi, adapter } = runtimeVersions();
+	const valid = (value) => typeof value === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]{1,32})?$/u.test(value);
+	return {
+		...valid(piAi) ? { piAi } : {},
+		...valid(adapter) ? { adapter } : {}
+	};
+}
 /** Build a support report that deliberately excludes OAuth and account metadata. */
 async function createSubscriptionDiagnostics({ auth, preferences, login = { phase: "idle" }, network, modelCatalog, connection, compaction, review, inspectionOptions, operations, runtimeManagement, storage, tools }) {
 	const collected = {};
@@ -7869,7 +8110,8 @@ async function createSubscriptionDiagnostics({ auth, preferences, login = { phas
 			node: process.version,
 			platform: process.platform,
 			arch: process.arch,
-			...hostDshVersion() ? { dsh: hostDshVersion() } : {}
+			...hostDshVersion() ? { dsh: hostDshVersion() } : {},
+			...libraryVersions()
 		},
 		account,
 		login,
@@ -8149,7 +8391,7 @@ function createCodexUsageReader(options) {
 			signal: requestSignal$1(signal, timeoutMs)
 		});
 		if (!response.ok) {
-			const error = /* @__PURE__ */ new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT usage request failed (HTTP ${response.status})`);
+			const error = new Error(await authFailureMessage(response) ?? `ChatGPT usage request failed (HTTP ${response.status})`);
 			Object.defineProperty(error, "retryAfterMs", { value: retryAfterMs(response, now, maxRetryAfterMs) });
 			throw error;
 		}
@@ -8200,6 +8442,102 @@ function createCodexUsageReader(options) {
 	});
 }
 //#endregion
+//#region src/account-usage.js
+const PROVIDER$1 = "openai-codex";
+const MAX_PARALLEL = 4;
+const assertProvider = (providerId) => {
+	if (providerId !== PROVIDER$1) throw new Error("Codex account usage received an unknown provider");
+};
+/** pi-ai's OAuth credential store, bound to one account of the vault. */
+function accountCredentialStore(vault, id, expirySkewMs = 0) {
+	const shift = (credential) => credential === void 0 || expirySkewMs === 0 ? credential : {
+		...credential,
+		expires: credential.expires - expirySkewMs
+	};
+	return {
+		async read(providerId) {
+			assertProvider(providerId);
+			return shift(await vault.readAccount(id));
+		},
+		async list() {
+			return await vault.readAccount(id) === void 0 ? [] : [{
+				providerId: PROVIDER$1,
+				type: "oauth"
+			}];
+		},
+		async modify(providerId, update) {
+			assertProvider(providerId);
+			return vault.modifyAccount(id, async (current) => update(shift(current)));
+		},
+		async delete() {
+			throw new Error("An account usage read cannot remove a sign-in");
+		}
+	};
+}
+/**
+* @param {object} options
+* @param {{ list(): Promise<object[]>, readAccount(id: string): Promise<object|undefined>, modifyAccount: Function }} options.vault
+* @param {(credentials: object) => object} options.createModels builds a pi-ai Models over a credential store, with the Codex provider set
+* @param {typeof fetch} options.fetch
+*/
+function createAccountUsageReader({ vault, createModels, fetch, expirySkewMs = 0, now = Date.now, activeReader }) {
+	const readers = /* @__PURE__ */ new Map();
+	const readerFor = (id) => {
+		let reader = readers.get(id);
+		if (reader === void 0) {
+			const models = createModels(accountCredentialStore(vault, id, expirySkewMs));
+			reader = createCodexUsageReader({
+				getAuth: () => models.getAuth(PROVIDER$1),
+				readCredential: () => vault.readAccount(id).then((credential) => credential),
+				fetch,
+				now
+			});
+			readers.set(id, reader);
+		}
+		return reader;
+	};
+	const summarize = (error, signal) => {
+		if (signal?.aborted) throw error;
+		const message = error instanceof Error ? error.message : "";
+		return ["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"].includes(message) || message.includes("blocked this request") ? message : "Could not read ChatGPT usage";
+	};
+	return Object.freeze({
+		/** One entry per account: its usage reading, or the reason it could not be read. */
+		async readAll({ force = false, signal } = {}) {
+			const accounts = await vault.list();
+			for (const id of [...readers.keys()]) if (!accounts.some((account) => account.id === id)) readers.delete(id);
+			const entries = new Array(accounts.length);
+			let next = 0;
+			const worker = async () => {
+				while (next < accounts.length) {
+					const index = next++;
+					const account = accounts[index];
+					try {
+						const reader = account.active && activeReader !== void 0 ? activeReader : readerFor(account.id);
+						entries[index] = {
+							id: account.id,
+							usage: await reader.read({
+								force,
+								signal
+							})
+						};
+					} catch (error) {
+						entries[index] = {
+							id: account.id,
+							error: summarize(error, signal)
+						};
+					}
+				}
+			};
+			await Promise.all(Array.from({ length: Math.min(MAX_PARALLEL, accounts.length) }, worker));
+			return entries;
+		},
+		clear() {
+			readers.clear();
+		}
+	});
+}
+//#endregion
 //#region src/plan-history.js
 const CODEX_PLAN_HISTORY_URL = "https://chatgpt.com/backend-api/wham/usage/plan_limit_history?days=7";
 const DIMENSIONS = Object.freeze([
@@ -8279,7 +8617,7 @@ function createReportReader({ url, parse, label, getAuth, readCredential, fetch:
 			available: false,
 			fetchedAt: now()
 		};
-		if (!response.ok) throw new Error(response.status === 401 ? "ChatGPT sign-in needs to be renewed" : response.status === 403 ? `ChatGPT does not offer the ${label} to this account` : `ChatGPT ${label} request failed (HTTP ${response.status})`);
+		if (!response.ok) throw new Error(response.status === 401 ? SIGN_IN_RENEW : response.status === 403 ? await isBlockedByNetwork(response) ? REQUEST_BLOCKED : `ChatGPT does not offer the ${label} to this account` : `ChatGPT ${label} request failed (HTTP ${response.status})`);
 		let body;
 		try {
 			body = await response.json();
@@ -8460,8 +8798,8 @@ function createConnectorsClient({ getAuth, readCredential, fetch: fetchRpc = fet
 			}),
 			signal: signal === void 0 ? timeout : AbortSignal.any([signal, timeout])
 		});
-		if (response.status === 401) throw new Error("ChatGPT sign-in needs to be renewed");
-		if (response.status === 403) throw new Error("ChatGPT does not offer connectors to this account");
+		if (response.status === 401) throw new Error(SIGN_IN_RENEW);
+		if (response.status === 403) throw new Error(await isBlockedByNetwork(response) ? REQUEST_BLOCKED : "ChatGPT does not offer connectors to this account");
 		if (!response.ok) throw new Error(`ChatGPT connectors request failed (HTTP ${response.status})`);
 		const message = await readRpc(response);
 		if (record$1(message.error)) throw new Error(`Connector error: ${clip(oneLine(String(message.error.message ?? message.error.code ?? "failed")), 200)}`);
@@ -9392,7 +9730,7 @@ function createCodexResetCreditService(options) {
 			},
 			signal: requestSignal(signal, timeoutMs)
 		});
-		if (!response.ok) throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT quota reset request failed (HTTP ${response.status})`);
+		if (!response.ok) throw new Error(await authFailureMessage(response) ?? `ChatGPT quota reset request failed (HTTP ${response.status})`);
 		let raw;
 		try {
 			raw = await response.json();
@@ -9526,7 +9864,7 @@ function createCodexResetCreditService(options) {
 						throw new Error(UNCERTAIN_RESET_RESULT);
 					}
 					if (response.status !== 401 && response.status !== 403) retryable = false;
-					throw new Error(response.status === 401 || response.status === 403 ? "ChatGPT sign-in needs to be renewed" : `ChatGPT quota reset request failed (HTTP ${response.status})`);
+					throw new Error(await authFailureMessage(response) ?? `ChatGPT quota reset request failed (HTTP ${response.status})`);
 				}
 				let raw;
 				try {
@@ -9582,7 +9920,7 @@ async function settlesLive(preferences, patch, signal, { attempts = 8, delayMs =
 	}
 	return live();
 }
-function createSubscriptionRpcHandler({ authHandler, usageReader, planHistoryReader, usageProfileReader, resetCreditService, preferences, defaultModel, runtimeManagement, remoteControl, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
+function createSubscriptionRpcHandler({ authHandler, usageReader, accountUsageReader, planHistoryReader, usageProfileReader, resetCreditService, preferences, defaultModel, runtimeManagement, remoteControl, diagnosticsReader, modelCatalog, originalImages, resolveInheritedOriginal, closeConnections, onAccountChanged, onCleanupFailure }) {
 	return async (endpoint, payload, signal) => {
 		if (endpoint === "default-model/status" || endpoint === "default-model/select") try {
 			signal.throwIfAborted();
@@ -9751,7 +10089,11 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, planHistoryRea
 			};
 		} catch (error) {
 			if (signal.aborted) throw error;
-			const known = /* @__PURE__ */ new Set(["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"]);
+			const known = /* @__PURE__ */ new Set([
+				"ChatGPT subscription is not signed in",
+				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED
+			]);
 			const message = error instanceof Error && known.has(error.message) ? error.message : "Could not read ChatGPT usage";
 			return publicError("internal", message);
 		}
@@ -9766,9 +10108,26 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, planHistoryRea
 			};
 		} catch (error) {
 			if (signal.aborted) throw error;
-			const known = /* @__PURE__ */ new Set(["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"]);
+			const known = /* @__PURE__ */ new Set([
+				"ChatGPT subscription is not signed in",
+				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED
+			]);
 			return publicError("internal", error instanceof Error && known.has(error.message) ? error.message : "Could not read ChatGPT usage profile");
 		}
+		if (endpoint === "usage/accounts") try {
+			signal.throwIfAborted();
+			return {
+				ok: true,
+				value: { accounts: await accountUsageReader.readAll({
+					force: payload?.force === true,
+					signal
+				}) }
+			};
+		} catch (error) {
+			if (signal.aborted) throw error;
+			return publicError("internal", "Could not read the usage of the signed-in accounts");
+		}
 		if (endpoint === "usage/history") try {
 			signal.throwIfAborted();
 			return {
@@ -9780,7 +10139,11 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, planHistoryRea
 			};
 		} catch (error) {
 			if (signal.aborted) throw error;
-			const known = /* @__PURE__ */ new Set(["ChatGPT subscription is not signed in", "ChatGPT sign-in needs to be renewed"]);
+			const known = /* @__PURE__ */ new Set([
+				"ChatGPT subscription is not signed in",
+				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED
+			]);
 			return publicError("internal", error instanceof Error && known.has(error.message) ? error.message : "Could not read ChatGPT usage history");
 		}
 		if (endpoint === "reset-credit/inspect" || endpoint === "reset-credit/prepare" || endpoint === "reset-credit/consume") try {
@@ -9801,6 +10164,7 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, planHistoryRea
 			const known = /* @__PURE__ */ new Set([
 				"ChatGPT subscription is not signed in",
 				"ChatGPT sign-in needs to be renewed",
+				REQUEST_BLOCKED,
 				"No quota reset is available",
 				"No usable quota reset is available",
 				"The available quota reset expires too soon",
@@ -9825,7 +10189,7 @@ function createSubscriptionRpcHandler({ authHandler, usageReader, planHistoryRea
 				() => modelCatalog?.clear(),
 				() => onAccountChanged?.()
 			];
-			if (endpoint === "logout") tasks.push(() => usageReader.clear());
+			if (endpoint === "logout") tasks.push(() => usageReader.clear(), () => accountUsageReader?.clear());
 			if (endpoint === "account/remove" && typeof payload?.id === "string") tasks.push(() => usageReader.clearScope(payload.id));
 			if ((await Promise.allSettled(tasks.map((task) => Promise.resolve().then(task)))).some((value) => value.status === "rejected")) try {
 				onCleanupFailure?.();
@@ -10227,6 +10591,7 @@ function apply(ctx, config = {}) {
 		usageProfile: () => usageProfileReader,
 		projections: () => ctx.get?.("sessionProjections"),
 		skills: () => ctx.get?.("skills"),
+		commands: () => ctx.get?.("commands"),
 		llm: () => ctx.llm,
 		trace: (entry) => {
 			try {
@@ -10379,9 +10744,21 @@ function apply(ctx, config = {}) {
 			sketchBridge.dispose();
 		};
 	}, "codex-subscription: native sketch tool");
+	const accountUsageReader = createAccountUsageReader({
+		vault: accountVault,
+		createModels: (credentials) => {
+			const accountModels = createModels({ credentials });
+			accountModels.setProvider(provider);
+			return accountModels;
+		},
+		fetch: (input, init) => network.fetch("quota", input, init),
+		expirySkewMs: OAUTH_EXPIRY_SKEW_MS,
+		activeReader: baseUsageReader
+	});
 	const subscriptionHandler = createSubscriptionRpcHandler({
 		authHandler: createCodexRpcHandler(coordinator, { openExternal: openCodexAuthUrl }),
 		usageReader,
+		accountUsageReader,
 		planHistoryReader,
 		usageProfileReader,
 		resetCreditService,