nterminal 1.3.8 → 1.3.10

package/dist/client/index.html

@@ -12,8 +12,8 @@
     <link rel="icon" type="image/png" sizes="64x64" href="/icons/favicon-64.png" />
     <link rel="icon" type="image/png" sizes="96x96" href="/icons/favicon-96.png" />
     <title>NTerminal</title>
-    <script type="module" crossorigin src="/assets/index-BOvp6zV9.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CWRDvfyP.css">
+    <script type="module" crossorigin src="/assets/index-WSS03d_S.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D1X7cDQ9.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/accounts/accountService.d.ts

@@ -1,7 +1,8 @@
 import type { AppConfig } from '../config.js';
 import type { TerminalManager } from '../terminal/TerminalManager.js';
-import type { TerminalSummary } from '../../shared/types.js';
 import type { AccountProvider, AccountStatusResponse, AccountRunningProcess, AccountRefreshStatus, AccountUsageResponse } from '../../shared/protocol.js';
+import { type LoginLauncher } from './loginSession.js';
+type CredentialDocument = Record<string, unknown>;
 export type AccountDiagnostic = {
     event: 'account.refresh' | 'account.refresh_scan';
     provider?: AccountProvider;
@@ -49,6 +50,11 @@ export declare class AccountService {
     private readonly paneProcessResolver;
     private readonly processTerminator;
     private readonly processSnapshotReader;
+    private readonly loginSessions;
+    private readonly loginNotices;
+    private readonly loginLauncher;
+    private readonly loginTimeoutMs;
+    private readonly loginExitWaitMs;
     constructor(config: AppConfig, terminalManager: TerminalManager, options?: {
         homeDir?: string;
         now?: () => Date;
@@ -59,15 +65,17 @@ export declare class AccountService {
         processSnapshot?: () => Promise<ProcessSnapshotEntry[]>;
         fetcher?: typeof fetch;
         onDiagnostic?: (event: AccountDiagnostic) => void;
+        loginLauncher?: LoginLauncher;
+        loginTimeoutMs?: number;
+        loginExitWaitMs?: number;
     });
     private mutate;
     synchronize(): Promise<void>;
     select(provider: AccountProvider, profileId: string): Promise<AccountStatusResponse>;
     remove(provider: AccountProvider, profileId: string): Promise<AccountStatusResponse>;
-    beginLogin(provider: AccountProvider): Promise<{
-        terminal: TerminalSummary;
-        command: string;
-    }>;
+    beginLogin(provider: AccountProvider): Promise<AccountStatusResponse>;
+    submitLoginCode(provider: AccountProvider, code: unknown): Promise<AccountStatusResponse>;
+    rename(provider: AccountProvider, profileId: string, label: string): Promise<AccountStatusResponse>;
     completeLogin(provider: AccountProvider, label: string): Promise<AccountStatusResponse>;
     cancelLogin(provider: AccountProvider): Promise<AccountStatusResponse>;
     refresh(provider: AccountProvider, profileId?: string): Promise<AccountStatusResponse>;
@@ -81,10 +89,16 @@ export declare class AccountService {
     private removeUnlocked;
     private beginLoginUnlocked;
     private completeLoginUnlocked;
+    private renameUnlocked;
     private cancelLoginUnlocked;
     private refreshUnlocked;
     start(): void;
     dispose(): void;
+    private loginProcessIds;
+    private stopLoginSession;
+    private expireLogin;
+    private expireLoginNotices;
+    private loginState;
     private refreshExpiringProfiles;
     private refreshAndRecord;
     private reportDiagnostic;
@@ -95,6 +109,7 @@ export declare class AccountService {
     private clearTerminationAcknowledgement;
     private listProcessSnapshot;
     private captureActiveCredentials;
+    private backfillAccountEmails;
     private captureActiveCredential;
     private backupLiveCredential;
     private deactivateProfile;
@@ -118,4 +133,18 @@ export declare class AccountService {
     private removeCredentialFile;
 }
 export declare function parseProcessSnapshot(stdout: string): ProcessSnapshotEntry[];
+export declare function isAutoLabel(profile: {
+    label: string;
+    labelCustomized?: boolean;
+}): boolean;
+export declare function accountEmail(provider: AccountProvider, document: CredentialDocument): string | null;
+export declare function plausibleEmail(value: unknown): string | null;
+export type AccountRenameBody = {
+    profileId: string;
+    label: string;
+};
+export declare const ACCOUNT_LABEL_MAX_INPUT = 256;
+export declare function parseAccountRenameBody(body: unknown): AccountRenameBody | {
+    error: string;
+};
 export {};

package/dist/server/accounts/accountService.js

@@ -6,6 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { accountReloginReason } from '../../shared/accountRelogin.js';
 import { ProviderRequestError, requestAccountUsage, requestTokenRefresh, unavailableUsage } from './providerRequests.js';
+import { createPtyLoginLauncher, LOGIN_TIMEOUT_MS, LoginSessionError, ProviderLoginSession, validateLoginCode } from './loginSession.js';
 const VAULT_DIRECTORY = 'credential-vault';
 const VAULT_INDEX = 'index.json';
 const VAULT_KEY = 'key';
@@ -23,6 +24,9 @@ const PROVIDER_TERMINATE_GRACE_MS = 2_000;
 const TERMINATION_ACKNOWLEDGEMENT_TTL_MS = 5 * 60_000;
 const USAGE_CACHE_TTL_MS = 2 * 60_000;
 const USAGE_FAILURE_TTL_MS = 30_000;
+const LOGIN_COMPLETE_EXIT_WAIT_MS = 5_000;
+const LOGIN_NOTICE_TTL_MS = 10 * 60_000;
+const LOGIN_EXPIRY_RETRY_MS = 500;
 export class AccountServiceError extends Error {
     code;
     constructor(code, message = code) {
@@ -33,7 +37,7 @@ export class AccountServiceError extends Error {
     get statusCode() {
         if (this.code === 'preview_mode')
             return 403;
-        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred'].includes(this.code))
+        if (['provider_panes_running', 'account_operation_busy', 'account_credential_changed', 'account_login_already_pending', 'active_cli_refresh_deferred', 'account_login_code_not_expected', 'account_login_process_unavailable', 'account_login_code_attempts_exceeded'].includes(this.code))
             return 409;
         return 400;
     }
@@ -64,6 +68,12 @@ export class AccountService {
     paneProcessResolver;
     processTerminator;
     processSnapshotReader;
+    // In-popup sign-ins: one private PTY per provider, never a workspace terminal.
+    loginSessions = new Map();
+    loginNotices = new Map();
+    loginLauncher;
+    loginTimeoutMs;
+    loginExitWaitMs;
     constructor(config, terminalManager, options = {}) {
         this.config = config;
         this.terminalManager = terminalManager;
@@ -75,13 +85,17 @@ export class AccountService {
         this.now = options.now ?? (() => new Date());
         this.fetcher = options.fetcher ?? ((...args) => fetch(...args));
         this.onDiagnostic = options.onDiagnostic ?? (() => undefined);
-        this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, await this.listProcessSnapshot()));
+        // The in-popup login CLI is NTerminal's own child, not a user session.
+        this.processLister = options.processLister ?? (async (provider) => providerProcesses(provider, withoutProcessTrees(await this.listProcessSnapshot(), this.loginProcessIds())));
         this.paneProcessResolver = options.paneProcessResolver ?? (options.processLister
             ? async () => new Map()
             : async () => resolvePaneProcesses(this.config.tmuxSocket, await this.listProcessSnapshot()));
         this.processProbe = options.processProbe ?? (async (provider) => (await this.processLister(provider)).length > 0);
-        this.processTerminator = options.processTerminator ?? terminateProviderProcesses;
+        this.processTerminator = options.processTerminator ?? ((provider, processes) => terminateProviderProcesses(provider, processes, this.loginProcessIds()));
         this.processSnapshotReader = options.processSnapshot ?? listUserProcesses;
+        this.loginLauncher = options.loginLauncher ?? createPtyLoginLauncher();
+        this.loginTimeoutMs = options.loginTimeoutMs ?? LOGIN_TIMEOUT_MS;
+        this.loginExitWaitMs = options.loginExitWaitMs ?? LOGIN_COMPLETE_EXIT_WAIT_MS;
     }
     // Reject overlapping mutations instead of accumulating requests behind OAuth I/O.
     async mutate(operation) {
@@ -112,6 +126,37 @@ export class AccountService {
     beginLogin(provider) {
         return this.mutate(() => this.beginLoginUnlocked(provider));
     }
+    // Forwards a pasted Claude authorization code to the login CLI. Only a
+    // strictly shaped `code#state` value is written, followed by Enter.
+    async submitLoginCode(provider, code) {
+        if (this.config.previewMode)
+            throw new AccountServiceError('preview_mode');
+        if (this.disposed)
+            throw new AccountServiceError('account_operation_busy');
+        const valid = validateLoginCode(provider, code);
+        if (!valid)
+            throw new AccountServiceError(provider === 'claude' ? 'account_login_code_invalid' : 'account_login_code_not_expected');
+        const index = await this.readIndex();
+        if (!index.pending[provider])
+            throw new AccountServiceError('account_login_not_pending');
+        const session = this.loginSessions.get(provider);
+        if (!session)
+            throw new AccountServiceError('account_login_process_unavailable');
+        try {
+            session.submitCode(valid);
+        }
+        catch (error) {
+            if (error instanceof LoginSessionError)
+                throw new AccountServiceError(error.code);
+            throw error;
+        }
+        return this.status();
+    }
+    // A non-blank label becomes the profile's custom name. A blank label resets
+    // it to the account email (account_label_required if none is known).
+    rename(provider, profileId, label) {
+        return this.mutate(() => this.renameUnlocked(provider, profileId, label));
+    }
     completeLogin(provider, label) {
         return this.mutate(() => this.completeLoginUnlocked(provider, label));
     }
@@ -227,10 +272,12 @@ export class AccountService {
         }));
         const pendingReady = new Map();
         await Promise.all(['codex', 'claude'].map(async (provider) => {
-            pendingReady.set(provider, Boolean(refreshed.pending[provider] && await this.readCredentialFile(provider).catch(() => null)));
+            const credentials = refreshed.pending[provider] ? await this.readCredentialFile(provider).catch(() => null) : null;
+            pendingReady.set(provider, { ready: Boolean(credentials), suggestedLabel: credentials ? suggestedLabel(refreshed, provider, credentials) : null });
         }));
+        this.expireLoginNotices();
         return {
-            providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, processes.get(provider) ?? [], processCheckUnavailable, pendingReady.get(provider) === true))
+            providers: ['codex', 'claude'].map((provider) => this.providerStatus(refreshed, provider, running, processes.get(provider) ?? [], processCheckUnavailable, pendingReady.get(provider) ?? { ready: false, suggestedLabel: null }))
         };
     }
     // Providers with at least one saved login that needs a new sign-in. Cheap
@@ -305,28 +352,36 @@ export class AccountService {
         index.pending[provider] = {
             provider,
             previousProfileId: index.active[provider] ?? null,
-            startedAt: this.now().toISOString(),
-            terminalId: null
+            startedAt: this.now().toISOString()
         };
         delete index.active[provider];
         await this.writeIndex(index);
-        let terminal;
+        let session;
         try {
+            // `codex login` revokes the tokens of an auth.json it finds, so the CLI
+            // must start only after the archived live file is gone.
             if (current)
                 await this.removeCredentialFile(provider);
-            terminal = await this.terminalManager.createTerminal({ cwd: this.config.workspaceRoot, cols: 100, rows: 30 });
-            const command = provider === 'codex' ? 'codex login --device-auth' : 'claude auth login';
-            const wrote = await this.terminalManager.writeToTerminal(terminal.id, `${command}\r`);
-            if (!wrote)
-                throw new AccountServiceError('account_login_terminal_unavailable');
-            index.pending[provider].terminalId = terminal.id;
-            await this.writeIndex(index);
+            await this.stopLoginSession(provider);
+            let launched;
+            try {
+                launched = this.loginLauncher(provider, { homeDir: this.homeDir });
+            }
+            catch {
+                throw new AccountServiceError('account_login_process_unavailable');
+            }
+            session = new ProviderLoginSession(provider, launched, () => this.now().getTime(), this.loginTimeoutMs, (expired) => void this.expireLogin(provider, expired));
+            this.loginSessions.set(provider, session);
+            this.loginNotices.delete(provider);
             this.clearTerminationAcknowledgement(provider);
-            return { terminal, command };
+            return this.status();
         }
         catch (error) {
-            if (terminal)
-                await this.terminalManager.closeTerminal(terminal.id);
+            if (session) {
+                if (this.loginSessions.get(provider) === session)
+                    this.loginSessions.delete(provider);
+                await session.terminate();
+            }
             if (current)
                 await this.writeCredentialFile(provider, current);
             if (index.active[provider] === undefined && index.pending[provider]?.previousProfileId) {
@@ -342,6 +397,12 @@ export class AccountService {
         const pending = index.pending[provider];
         if (!pending)
             throw new AccountServiceError('account_login_not_pending');
+        if (!await this.readCredentialFile(provider))
+            throw new AccountServiceError('account_login_not_complete');
+        // Let the CLI finish its own post-login writes before the file is captured.
+        const session = this.loginSessions.get(provider);
+        if (session?.running && !await session.waitForExit(this.loginExitWaitMs))
+            await session.terminate();
         const credentials = await this.readCredentialFile(provider);
         if (!credentials)
             throw new AccountServiceError('account_login_not_complete');
@@ -352,10 +413,33 @@ export class AccountService {
         delete index.pending[provider];
         clearExternalSwitch(index, provider);
         await this.writeIndex(index);
+        if (this.loginSessions.get(provider) === session)
+            this.loginSessions.delete(provider);
         this.clearTerminationAcknowledgement(provider);
         return this.status();
     }
+    async renameUnlocked(provider, profileId, label) {
+        const index = await this.readIndex();
+        const profile = index.profiles.find((candidate) => candidate.id === profileId && candidate.provider === provider);
+        if (!profile)
+            throw new AccountServiceError('account_not_found');
+        if (label.trim()) {
+            profile.label = sanitizeLabel(label);
+            profile.labelCustomized = true;
+        }
+        else {
+            const email = typeof profile.email === 'string' ? profile.email : null;
+            if (!email)
+                throw new AccountServiceError('account_label_required');
+            profile.label = sanitizeLabel(email);
+            delete profile.labelCustomized;
+        }
+        await this.writeIndex(index);
+        return this.status();
+    }
     async cancelLoginUnlocked(provider) {
+        // Stop the CLI first so it cannot write a credential after the restore.
+        await this.stopLoginSession(provider);
         const index = await this.readIndex();
         const pending = index.pending[provider];
         if (!pending)
@@ -395,6 +479,68 @@ export class AccountService {
         if (this.refreshTimer)
             clearInterval(this.refreshTimer);
         this.refreshTimer = null;
+        // The pending entry survives in the index; after a restart the dialog
+        // reports the missing login process and offers to cancel and restore.
+        for (const session of this.loginSessions.values())
+            session.dispose();
+        this.loginSessions.clear();
+    }
+    loginProcessIds() {
+        return [...this.loginSessions.values()].filter((session) => session.running).map((session) => session.pid);
+    }
+    async stopLoginSession(provider) {
+        const session = this.loginSessions.get(provider);
+        if (!session)
+            return;
+        this.loginSessions.delete(provider);
+        await session.terminate();
+    }
+    // Timeout: stop the CLI and restore the previous credential through the
+    // normal cancel path, retrying while another account operation holds the lock.
+    async expireLogin(provider, session) {
+        await session.terminate();
+        for (let attempt = 0; attempt < 120 && !this.disposed; attempt += 1) {
+            if (this.loginSessions.get(provider) !== session)
+                return;
+            try {
+                await this.cancelLogin(provider);
+                this.loginNotices.set(provider, { code: 'login_timed_out', at: this.now().toISOString() });
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof AccountServiceError) || error.code !== 'account_operation_busy')
+                    return;
+                await sleep(LOGIN_EXPIRY_RETRY_MS);
+            }
+        }
+    }
+    expireLoginNotices() {
+        for (const [provider, notice] of this.loginNotices) {
+            if (this.now().getTime() - Date.parse(notice.at) > LOGIN_NOTICE_TTL_MS)
+                this.loginNotices.delete(provider);
+        }
+    }
+    loginState(provider, ready) {
+        const session = this.loginSessions.get(provider);
+        if (!session) {
+            return ready ? { phase: 'done' } : {
+                phase: 'failed',
+                message: 'The sign-in process is no longer running (NTerminal may have restarted). Cancel to restore the previous account, then try again.'
+            };
+        }
+        const state = session.state();
+        if (ready) {
+            // The credential exists; wait for the CLI to report success or exit.
+            if (session.succeeded || !session.running)
+                return { phase: 'done' };
+            return { ...state, phase: 'completing' };
+        }
+        if (state.phase === 'done') {
+            return session.running ? { ...state, phase: 'completing' } : {
+                ...state, phase: 'failed', message: 'The CLI reported success, but no credential file was written. Cancel and try again.'
+            };
+        }
+        return state;
     }
     async refreshExpiringProfiles() {
         if (this.refreshInFlight || this.disposed || this.config.previewMode || this.operationInFlight)
@@ -483,7 +629,8 @@ export class AccountService {
         }
         catch { /* Logging cannot interrupt token storage. */ }
     }
-    providerStatus(index, provider, running, runningProcesses, processCheckUnavailable, pendingReady) {
+    providerStatus(index, provider, running, runningProcesses, processCheckUnavailable, pendingCredential) {
+        const pendingReady = pendingCredential.ready;
         const activeId = index.active[provider] ?? null;
         const profile = activeId ? index.profiles.find((candidate) => candidate.id === activeId) ?? null : null;
         const pending = index.pending[provider];
@@ -495,7 +642,11 @@ export class AccountService {
             runningProcesses,
             processCheckUnavailable,
             terminationAcknowledged: this.hasTerminationAcknowledgement(provider),
-            pendingLogin: pending ? { startedAt: pending.startedAt, ready: pendingReady, terminalId: pending.terminalId ?? null } : null,
+            pendingLogin: pending ? {
+                startedAt: pending.startedAt, ready: pendingReady, login: this.loginState(provider, pendingReady),
+                ...(pendingCredential.suggestedLabel ? { suggestedLabel: pendingCredential.suggestedLabel } : {})
+            } : null,
+            loginNotice: pending ? null : this.loginNotices.get(provider) ?? null,
             lastExternalSwitch: index.externalSwitch?.[provider] ?? null,
             credentialPresent: Boolean(profile || pending || false)
         };
@@ -557,6 +708,7 @@ export class AccountService {
                 continue;
             try {
                 await this.captureActiveCredential(index, provider);
+                await this.backfillAccountEmails(index, provider);
                 this.diagnosticSignatures.delete(`account.refresh_scan:${provider}:`);
             }
             catch (error) {
@@ -568,6 +720,17 @@ export class AccountService {
         if (JSON.stringify(index) !== before)
             await this.writeIndex(index);
     }
+    // Profiles saved before emails were recorded: read each vault copy once.
+    // An unreadable copy stays unchecked and is retried on a later scan.
+    async backfillAccountEmails(index, provider) {
+        for (const profile of index.profiles) {
+            if (profile.provider !== provider || profile.email !== undefined)
+                continue;
+            const credentials = await this.readVaultCredentials(profile.id).catch(() => null);
+            if (credentials)
+                applyAccountIdentity(profile, credentials);
+        }
+    }
     // The live CLI file is the source of truth for the active account. Every
     // newer live credential NTerminal observes is also copied into the active
     // profile's encrypted vault backup, so an external overwrite (another login,
@@ -596,6 +759,8 @@ export class AccountService {
                 // Vaults written before active backups existed: create it once.
                 await this.writeVaultCredentials(existing.id, credentials);
             }
+            if (existing.email === undefined)
+                applyAccountIdentity(existing, credentials);
             return;
         }
         // The live file now holds a different account than the index says.
@@ -678,19 +843,22 @@ export class AccountService {
             await this.updateProfile(profile, provider, kept);
         return credentials;
     }
-    // A blank label only names new profiles; re-authenticating an existing
-    // account keeps the label the user gave it.
+    // A blank label only names new profiles (the account email when known);
+    // re-authenticating an existing account keeps the label the user gave it.
     async storeProfile(index, provider, credentials, label = '') {
         const fingerprint = fingerprintFor(provider, credentials);
         const existing = index.profiles.find((profile) => profile.provider === provider && profile.fingerprint === fingerprint);
         const now = this.now().toISOString();
         const timing = credentialTiming(provider, credentials);
         const profile = existing ?? {
-            id: randomUUID(), provider, label: sanitizeLabel(label.trim() || defaultLabel(provider, index.profiles)), createdAt: now, updatedAt: now,
+            id: randomUUID(), provider, label: sanitizeLabel(accountEmail(provider, credentials) ?? defaultLabel(provider, index.profiles)), createdAt: now, updatedAt: now,
             expiresAt: timing.expiresAt, refreshTokenExpiresAt: timing.refreshTokenExpiresAt, fingerprint
         };
-        if (label.trim())
+        if (label.trim()) {
             profile.label = sanitizeLabel(label);
+            profile.labelCustomized = true;
+        }
+        applyAccountIdentity(profile, credentials);
         profile.updatedAt = now;
         profile.expiresAt = timing.expiresAt;
         profile.refreshTokenExpiresAt = timing.refreshTokenExpiresAt;
@@ -708,6 +876,7 @@ export class AccountService {
         profile.expiresAt = timing.expiresAt;
         profile.refreshTokenExpiresAt = timing.refreshTokenExpiresAt;
         profile.credentialHash = hashCredential(credentials);
+        applyAccountIdentity(profile, credentials);
         delete profile.refresh;
         this.retryAfter.delete(profile.id);
         this.usageCache.delete(profile.id);
@@ -1043,8 +1212,8 @@ function displayProcessCommand(command) {
     const basename = path.basename(command);
     return basename.length <= 80 ? basename : basename.slice(0, 80);
 }
-async function terminateProviderProcesses(provider, _processes) {
-    const snapshot = await listUserProcesses();
+async function terminateProviderProcesses(provider, _processes, excludedRoots = []) {
+    const snapshot = withoutProcessTrees(await listUserProcesses(), excludedRoots);
     const daemons = provider === 'codex' ? snapshot.filter(isCodexDaemon) : [];
     // Shared daemon descendants include work for multiple TUI clients. Stop the
     // interactive clients first, then let the daemon's lifecycle command stop it.
@@ -1062,7 +1231,7 @@ async function terminateProviderProcesses(provider, _processes) {
         signalProcess(pid, 'SIGTERM');
     if (targetPids.length > 0) {
         await sleep(PROVIDER_TERMINATE_GRACE_MS);
-        const survivors = new Set(providerProcessTree(provider, await listUserProcesses()));
+        const survivors = new Set(providerProcessTree(provider, withoutProcessTrees(await listUserProcesses(), excludedRoots)));
         for (const pid of targetPids)
             if (survivors.has(pid))
                 signalProcess(pid, 'SIGKILL');
@@ -1085,6 +1254,21 @@ async function stopCodexDaemon(daemons) {
     }
     throw new AccountServiceError('codex_daemon_stop_failed');
 }
+// Drops the given processes and all their descendants from a snapshot.
+function withoutProcessTrees(entries, roots) {
+    if (roots.length === 0)
+        return entries;
+    const excluded = new Set(roots);
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const entry of entries)
+            if (excluded.has(entry.ppid) && !excluded.has(entry.pid)) {
+                excluded.add(entry.pid);
+                changed = true;
+            }
+    }
+    return entries.filter((entry) => !excluded.has(entry.pid));
+}
 function daemonDescendants(entries) {
     const parents = new Map(entries.map((entry) => [entry.pid, entry.ppid]));
     const daemons = new Set(entries.filter(isCodexDaemon).map((entry) => entry.pid));
@@ -1168,7 +1352,82 @@ function isOlderCredential(provider, candidate, reference) {
     return Number.isFinite(a) && Number.isFinite(b) && a < b;
 }
 function toPublicProfile(profile) {
-    return { id: profile.id, provider: profile.provider, label: profile.label, createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt, ...(profile.refresh ? { refresh: profile.refresh } : {}) };
+    const email = typeof profile.email === 'string' ? plausibleEmail(profile.email) : null;
+    return { id: profile.id, provider: profile.provider, label: profile.label, ...(email ? { email } : {}), createdAt: profile.createdAt, updatedAt: profile.updatedAt, expiresAt: profile.expiresAt, refreshTokenExpiresAt: profile.refreshTokenExpiresAt, ...(profile.refresh ? { refresh: profile.refresh } : {}) };
+}
+// Labels NTerminal generated before account emails were known. Only these
+// (and never a label the user chose) follow the account email.
+const AUTO_LABEL = /^(Codex|Claude) account \d+$/;
+export function isAutoLabel(profile) {
+    return profile.labelCustomized !== true && AUTO_LABEL.test(profile.label);
+}
+// Records the credential's account email and upgrades an uncustomized auto
+// label to it. A custom label is never overwritten.
+function applyAccountIdentity(profile, credentials) {
+    const email = accountEmail(profile.provider, credentials);
+    profile.email = email;
+    if (email && isAutoLabel(profile))
+        profile.label = sanitizeLabel(email);
+}
+// The name the login form suggests once the credential exists: the saved name
+// of a re-authenticated account (a blank name keeps it), else the email.
+function suggestedLabel(index, provider, credentials) {
+    const email = accountEmail(provider, credentials);
+    const fingerprint = fingerprintFor(provider, credentials);
+    const existing = index.profiles.find((profile) => profile.provider === provider && profile.fingerprint === fingerprint);
+    if (existing)
+        return email && isAutoLabel(existing) ? sanitizeLabel(email) : existing.label;
+    return email ? sanitizeLabel(email) : null;
+}
+// Display-only: the signed-in account's email from the credential document.
+// JWT signatures are not verified (nothing is authorized with this value) and
+// malformed input yields null. Never log the result.
+export function accountEmail(provider, document) {
+    if (!isRecord(document))
+        return null;
+    if (provider === 'claude') {
+        const metadata = isRecord(document.nterminalAccountMetadata) ? document.nterminalAccountMetadata : {};
+        return plausibleEmail(metadata.emailAddress);
+    }
+    const tokens = isRecord(document.tokens) ? document.tokens : {};
+    const idToken = decodeJwtPayload(tokens.id_token);
+    const accessToken = decodeJwtPayload(tokens.access_token);
+    const profileClaim = (payload) => payload && isRecord(payload['https://api.openai.com/profile']) ? payload['https://api.openai.com/profile'].email : null;
+    return plausibleEmail(idToken?.email) ?? plausibleEmail(profileClaim(idToken)) ?? plausibleEmail(profileClaim(accessToken)) ?? plausibleEmail(accessToken?.email);
+}
+export function plausibleEmail(value) {
+    if (typeof value !== 'string' || value.length > 254)
+        return null;
+    // Controls, format characters (bidi overrides, zero-width) and whitespace
+    // could disguise the displayed name.
+    if (/[\p{Cc}\p{Cf}\p{Z}\s]/u.test(value))
+        return null;
+    const match = /^([^@]{1,64})@([^@.]+(?:\.[^@.]+)+)$/.exec(value);
+    return match ? value : null;
+}
+function decodeJwtPayload(value) {
+    if (typeof value !== 'string' || value.length > 64 * 1024)
+        return null;
+    const parts = value.split('.');
+    if (parts.length < 2 || !parts[1] || !/^[A-Za-z0-9_-]+={0,2}$/.test(parts[1]))
+        return null;
+    try {
+        const decoded = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return isRecord(decoded) ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const ACCOUNT_LABEL_MAX_INPUT = 256;
+// Shared by the local, agent and proxy routes: only these two fields pass.
+export function parseAccountRenameBody(body) {
+    const value = isRecord(body) ? body : {};
+    if (typeof value.profileId !== 'string' || !value.profileId || value.profileId.length > 128)
+        return { error: 'profile_id_required' };
+    if (typeof value.label !== 'string' || value.label.length > ACCOUNT_LABEL_MAX_INPUT)
+        return { error: 'account_label_invalid' };
+    return { profileId: value.profileId, label: value.label };
 }
 function shouldRefreshProfile(profile, now) {
     if (profile.refresh?.state === 'reauth_required')
@@ -1254,7 +1513,7 @@ function applyRefresh(provider, document, response, now) {
 function defaultLabel(provider, profiles) {
     return `${provider === 'codex' ? 'Codex' : 'Claude'} account ${profiles.filter((profile) => profile.provider === provider).length + 1}`;
 }
-function sanitizeLabel(value) { return value.trim().replace(/\s+/g, ' ').slice(0, 80) || 'Account'; }
+function sanitizeLabel(value) { return value.replace(/[\p{Cc}\u200e\u200f\u202a-\u202e\u2066-\u2069]/gu, ' ').trim().replace(/\s+/g, ' ').slice(0, 80).trim() || 'Account'; }
 function fingerprintFor(provider, value) {
     const identity = stableIdentity(provider, value);
     return createHash('sha256').update(identity ?? JSON.stringify(value)).digest('hex');