pi-multi-accounts 0.0.0-stage → 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nvminhtue
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,99 @@
-# Temporary Holding Version
+# pi-multi-accounts
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A [Pi](https://github.com/earendil-works/pi) extension for people with more than one subscription:
+
+- **Claude**: keep **multiple Claude Pro/Max OAuth accounts** for Pi's built-in `/login` and switch between them with a single `/account` command. Pi stores exactly one `anthropic` credential; this extension saves additional logins next to it and swaps the active one on demand.
+- **Codex**: use extra **ChatGPT (Codex) logins as parallel providers** (`openai-codex-<name>`) next to Pi's built-in `openai-codex`. Nothing is switched: pick the account's model with `/model`.
+
+## Install
+
+```bash
+# local checkout
+pi install /absolute/path/to/pi-multi-accounts
+
+# or from git
+pi install git:github.com/<user>/pi-multi-accounts
+```
+
+Then run `/reload` (or restart Pi).
+
+### Migrating from the standalone extensions / the old package
+
+- Remove `~/.pi/agent/extensions/codex-accounts.ts` and `~/.pi/agent/extensions/claude-accounts.ts` if present. Otherwise the commands and providers are registered twice.
+- Remove old `pi-claude-accounts` package entries from your Pi settings.
+- `~/.pi/agent/claude-accounts.json` is kept: your saved Claude accounts continue to work.
+
+## Usage
+
+| Command                 | What it does                                        |
+| ----------------------- | --------------------------------------------------- |
+| `/account`              | Pick a Claude account from a list and switch to it  |
+| `/account <name>`       | Switch to the saved Claude account `<name>`         |
+| `/account save <name>`  | Save the current Anthropic `/login` under `<name>`  |
+| `/account list`         | List Claude accounts (● active, ○ inactive) and Codex providers (login state) |
+| `/account remove <name>`| Forget a saved Claude account (`auth.json` is not changed) |
+| `/account help`         | Show command help                                   |
+
+Switch, save and remove work on **Claude accounts only**. Codex providers are only listed.
+
+Aliases: `add` = `save`, `ls` = `list`, `rm` = `remove`, `use`/`switch` = switch.
+
+The footer shows `claude: <name>` for the active saved account, or `claude: unsaved login` when the login in `auth.json` is not saved yet.
+
+## Logging in to a second account
+
+1. `/login` with your first Claude account, then `/account save work`.
+2. Run `/login` again. Pi reuses the browser's existing claude.ai session, so you would simply get the same account back. To avoid that, do one of:
+   - open the login URL Pi prints in a **private/incognito window**, or
+   - use a **different browser profile**, or
+   - **sign out of claude.ai** first.
+
+   Copy the login URL Pi prints into the private window and sign in with the second account.
+3. `/account save personal`.
+4. Run `/account list` and check that the emails differ.
+
+## Codex accounts
+
+1. For each extra ChatGPT account, log in with the Codex CLI into its own folder: `CODEX_HOME=~/.codex-<name> codex login`.
+2. In Pi, run `/login` and choose **"OpenAI Codex (<name>)"**. This imports the tokens from `~/.codex-<name>/auth.json`; no browser is involved.
+3. Pick the model with `/model`, e.g. `openai-codex-<name>/<model>`. The provider has the same models as the built-in `openai-codex`.
+
+The Codex auth file stays the source of truth: on refresh the extension first adopts newer tokens found in the file (e.g. refreshed by the Codex CLI); otherwise it refreshes with the file's refresh token and writes the rotated tokens back. New `~/.codex-*` folders are discovered at load time, so run `/reload` after creating one.
+
+## How it works (Claude)
+
+- Pi keeps a single `anthropic` entry in `~/.pi/agent/auth.json`. Switching replaces that entry and leaves other providers untouched.
+- Saved logins live in `~/.pi/agent/claude-accounts.json` (mode `0600`).
+- Writes happen under the same `auth.json.lock` directory lock that Pi's `proper-lockfile` uses, so Pi and the extension never write at the same time.
+- Refresh tokens rotate. When Pi refreshes the active token, the extension copies the new one back into the right slot on `session_start`, after each `agent_end`, and during every switch.
+- To tell whose token is whose, it asks `https://api.anthropic.com/api/oauth/profile` for the account id/email. If that lookup fails, it falls back gracefully (matching on the refresh token, or asking you when ownership is unclear).
+
+## Caveats
+
+- `auth.json` is shared: switching affects **every running Pi session**.
+- It relies on Pi internals (the `auth.json` format and its lock directory). Tested with Pi 0.99.2.
+- The Anthropic profile endpoint is unofficial and may change.
+- The OpenAI token endpoint and client id used for Codex refresh are unofficial and may change.
+- The Codex CLI and Pi share each Codex refresh token (single use); if both refresh at once, one of them may need `codex login` and `/login` again.
+- `claude-accounts.json` contains refresh tokens. Keep it private and never commit it.
+
+## Development
+
+```bash
+npm install
+npm run check   # typecheck + tests
+```
+
+Layout:
+
+```text
+src/index.ts                  entry point: registers Codex providers, then the /account command
+src/claude.ts                 Claude account switching (no build step)
+src/codex.ts                  Codex parallel providers
+test/account.test.mjs         node:test suite for /account (temp PI_CODING_AGENT_DIR and HOME, no network)
+test/codex.test.mjs           node:test suite for the Codex providers (stubbed fetch, no network)
+```
+
+## License
+
+MIT

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "pi-multi-accounts",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.1",
+  "private": false,
+  "type": "module",
+  "description": "Pi extension: switch between several Claude Pro/Max OAuth logins with /account, and use extra ChatGPT (Codex) logins as parallel openai-codex-<name> providers",
+  "keywords": ["pi-package", "pi", "claude", "anthropic", "openai", "codex", "chatgpt", "oauth", "multi-account"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nvminhtue/pi-multi-accounts.git"
+  },
+  "pi": {
+    "extensions": ["./src/index.ts"]
+  },
+  "files": ["src", "README.md", "LICENSE"],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "node --experimental-strip-types --test \"test/*.test.mjs\"",
+    "check": "npm run typecheck && npm test"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "0.99.2",
+    "@earendil-works/pi-coding-agent": "0.99.2",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

package/src/claude.ts

@@ -0,0 +1,467 @@
+/**
+ * pi-multi-accounts, Claude part — keep several Anthropic (Claude Pro/Max) OAuth logins and
+ * switch between them.
+ *
+ * Flow:
+ *   1. /login                → built-in Pi login (Anthropic). Pi writes auth.json.
+ *   2. /account save work    → snapshot the current login under the name "work".
+ *   3. /logout, /login with the other Claude account, then /account save personal
+ *   4. /account work | /account personal | /account (picker) to switch.
+ *
+ * How it works: Pi keeps exactly one `anthropic` credential in auth.json and
+ * re-reads the file when its revision changes. This extension stores the other
+ * logins in ~/.pi/agent/claude-accounts.json (mode 0600) and swaps the
+ * `anthropic` entry in auth.json under the same `auth.json.lock` directory lock
+ * that Pi's proper-lockfile uses. All store writes also happen under that lock.
+ *
+ * Refresh tokens rotate: Pi refreshes the active token and writes the new one
+ * to auth.json. The extension syncs that rotated token back into the active
+ * slot (on session start, after each agent run, and inside every switch), so a
+ * stored slot never holds a dead refresh token.
+ *
+ * Note: auth.json is shared — switching affects every running Pi session.
+ */
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { codexRows, type CodexHome } from "./codex.ts";
+
+const PROVIDER = "anthropic";
+const AGENT_DIR = process.env.PI_CODING_AGENT_DIR || join(homedir(), ".pi", "agent");
+const AUTH_PATH = join(AGENT_DIR, "auth.json");
+const STORE_PATH = join(AGENT_DIR, "claude-accounts.json");
+const LOCK_PATH = `${AUTH_PATH}.lock`;
+const LOCK_STALE_MS = 30_000;
+const LOCK_TIMEOUT_MS = 20_000; // a Pi token refresh can hold the lock ~15 s
+const PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const STATUS_KEY = "claude-account";
+let codexHomes: CodexHome[] = [];
+const SUBCOMMANDS = ["save", "add", "list", "ls", "remove", "rm", "use", "switch", "help"];
+
+interface OAuthCred {
+	type: "oauth";
+	refresh: string;
+	access: string;
+	expires: number;
+	[key: string]: unknown;
+}
+
+interface Identity {
+	accountId?: string;
+	email?: string;
+}
+
+interface Slot extends Identity {
+	cred: OAuthCred;
+	savedAt: number;
+}
+
+interface Store {
+	active?: string;
+	accounts: Record<string, Slot>;
+}
+
+// ---------- file helpers ----------
+
+/** Missing file → undefined. Corrupt file → throw (never silently wipe data). */
+function readJsonStrict<T>(path: string): T | undefined {
+	if (!existsSync(path)) return undefined;
+	const text = readFileSync(path, "utf-8").replace(/^\uFEFF/, "");
+	if (!text.trim()) return undefined;
+	try {
+		return JSON.parse(text) as T;
+	} catch {
+		throw new Error(`${path} is not valid JSON; fix or remove it.`);
+	}
+}
+
+function writeAtomic(path: string, data: unknown): void {
+	mkdirSync(AGENT_DIR, { recursive: true, mode: 0o700 });
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 0o600 });
+	renameSync(tmp, path);
+}
+
+function loadStore(): Store {
+	const s = readJsonStrict<Store>(STORE_PATH) ?? { accounts: {} };
+	if (!s.accounts || typeof s.accounts !== "object") s.accounts = {};
+	return s;
+}
+
+function isOAuth(c: unknown): c is OAuthCred {
+	const o = c as OAuthCred | undefined;
+	return !!o && o.type === "oauth" && typeof o.refresh === "string" && typeof o.access === "string";
+}
+
+function readAuth(): Record<string, unknown> {
+	return readJsonStrict<Record<string, unknown>>(AUTH_PATH) ?? {};
+}
+
+function readCurrentCred(): OAuthCred | undefined {
+	const c = readAuth()[PROVIDER];
+	return isOAuth(c) ? c : undefined;
+}
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Same lock directory as proper-lockfile (`auth.json.lock`), so Pi and we
+ * serialize. `fn` must be synchronous: nothing can interleave while we hold it.
+ */
+async function withAuthLock<T>(fn: () => T): Promise<T> {
+	const deadline = Date.now() + LOCK_TIMEOUT_MS;
+	for (;;) {
+		if (Date.now() > deadline) throw new Error("auth.json is locked by another process; try again.");
+		try {
+			mkdirSync(LOCK_PATH);
+			break;
+		} catch (err) {
+			if ((err as { code?: string }).code !== "EEXIST") throw err;
+		}
+		try {
+			if (Date.now() - statSync(LOCK_PATH).mtimeMs > LOCK_STALE_MS) {
+				rmdirSync(LOCK_PATH);
+				continue;
+			}
+		} catch (err) {
+			if ((err as { code?: string }).code === "ENOENT") continue; // lock vanished — retry now
+			throw err;
+		}
+		await sleep(50 + Math.random() * 100);
+	}
+	try {
+		return fn();
+	} finally {
+		try {
+			rmdirSync(LOCK_PATH);
+		} catch {
+			/* already gone */
+		}
+	}
+}
+
+/** Locked read-modify-write of the store. */
+function mutateStore<T>(fn: (store: Store) => T): Promise<T> {
+	return withAuthLock(() => {
+		const store = loadStore();
+		const result = fn(store);
+		writeAtomic(STORE_PATH, store);
+		return result;
+	});
+}
+
+// ---------- identity ----------
+
+/** Best effort: ask Anthropic who owns this token. Undefined on any failure. */
+async function fetchProfile(cred: OAuthCred): Promise<Identity | undefined> {
+	if (!cred.access || cred.expires <= Date.now() + 30_000) return undefined;
+	try {
+		const res = await fetch(PROFILE_URL, {
+			headers: {
+				Authorization: `Bearer ${cred.access}`,
+				"anthropic-beta": "oauth-2025-04-20",
+				"Content-Type": "application/json",
+			},
+			signal: AbortSignal.timeout(5_000),
+		});
+		if (!res.ok) return undefined;
+		const body = (await res.json()) as { account?: { uuid?: string; email_address?: string; email?: string } };
+		const accountId = body.account?.uuid;
+		const email = body.account?.email_address ?? body.account?.email;
+		return accountId || email ? { accountId, email } : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function findByToken(store: Store, cred: OAuthCred): string | undefined {
+	return Object.keys(store.accounts).find((n) => store.accounts[n].cred.refresh === cred.refresh);
+}
+
+function findByIdentity(store: Store, id?: Identity): string | undefined {
+	if (!id) return undefined;
+	return Object.keys(store.accounts).find((n) => {
+		const s = store.accounts[n];
+		return id.accountId ? s.accountId === id.accountId : !!id.email && s.email === id.email;
+	});
+}
+
+// ---------- sync ----------
+
+type SyncResult =
+	| { kind: "none" } // no anthropic OAuth login in auth.json
+	| { kind: "matched"; name: string; cred: OAuthCred } // auth.json belongs to a stored slot
+	| {
+			kind: "unknown"; // no slot owns this login
+			cred: OAuthCred;
+			profile?: Identity; // undefined → identity could not be checked
+			probable?: string; // profile unknown: likely the active slot after a token rotation
+	  };
+
+/**
+ * Reconcile auth.json with the store. Copies a rotated token back into its
+ * slot when ownership is certain (same refresh token, or same account id).
+ */
+async function sync(): Promise<SyncResult> {
+	const cred = readCurrentCred();
+	if (!cred) return { kind: "none" };
+	const store = loadStore();
+
+	let name = findByToken(store, cred);
+	let profile: Identity | undefined;
+	if (!name) {
+		profile = await fetchProfile(cred);
+		name = findByIdentity(store, profile);
+	}
+	if (!name) {
+		const probable = !profile && store.active && store.accounts[store.active] ? store.active : undefined;
+		return { kind: "unknown", cred, profile, probable };
+	}
+
+	const slot = store.accounts[name];
+	if (slot.cred.refresh !== cred.refresh || slot.cred.access !== cred.access || store.active !== name) {
+		const owner = name;
+		await mutateStore((s) => {
+			const now = readCurrentCred();
+			if (!s.accounts[owner] || now?.refresh !== cred.refresh) return; // changed meanwhile; next sync handles it
+			s.accounts[owner].cred = cred;
+			if (profile?.accountId) s.accounts[owner].accountId = profile.accountId;
+			if (profile?.email) s.accounts[owner].email = profile.email;
+			s.active = owner;
+		});
+	}
+	return { kind: "matched", name, cred };
+}
+
+function label(name: string, slot: Slot): string {
+	return slot.email ? `${name} <${slot.email}>` : name;
+}
+
+function updateStatus(ctx: ExtensionContext, result: SyncResult): void {
+	if (!ctx.hasUI) return;
+	const text =
+		result.kind === "matched" ? `claude: ${result.name}` : result.kind === "unknown" ? "claude: unsaved login" : undefined;
+	ctx.ui.setStatus(STATUS_KEY, text);
+}
+
+// ---------- commands ----------
+
+async function cmdSave(name: string, ctx: ExtensionContext): Promise<void> {
+	if (!/^[\w.-]+$/.test(name) || SUBCOMMANDS.includes(name)) {
+		ctx.ui.notify(`Usage: /account save <name>  (letters, digits, . _ -; not ${SUBCOMMANDS.join("/")})`, "warning");
+		return;
+	}
+	const cred = readCurrentCred();
+	if (!cred) {
+		ctx.ui.notify("No Anthropic OAuth login in auth.json. Run /login first.", "warning");
+		return;
+	}
+	const store = loadStore();
+	const owner = findByToken(store, cred);
+	if (owner && owner !== name) {
+		ctx.ui.notify(`This login is already saved as "${owner}".`, "warning");
+		return;
+	}
+	const profile = await fetchProfile(cred);
+	const dup = findByIdentity(store, profile);
+	if (dup && dup !== name) {
+		ctx.ui.notify(`This Claude account is already saved as "${dup}" — updated that slot instead.`, "info");
+		name = dup;
+	} else if (store.accounts[name] && owner !== name) {
+		const ok = await ctx.ui.confirm("Overwrite account?", `"${name}" already exists. Replace it with the current login?`);
+		if (!ok) return;
+	}
+	const target = name;
+	const slot = await mutateStore((s) => {
+		const now = readCurrentCred();
+		if (now?.refresh !== cred.refresh) throw new Error("auth.json changed while saving; run the command again.");
+		s.accounts[target] = { cred: now, accountId: profile?.accountId, email: profile?.email, savedAt: Date.now() };
+		s.active = target;
+		return s.accounts[target];
+	});
+	ctx.ui.notify(`Saved current Anthropic login as "${label(target, slot)}".`, "info");
+	updateStatus(ctx, { kind: "matched", name: target, cred });
+}
+
+async function cmdUse(name: string, ctx: ExtensionContext): Promise<void> {
+	if (!name) return cmdPick(ctx);
+	const known = loadStore().accounts[name];
+	if (!known) {
+		ctx.ui.notify(`Unknown account "${name}". Saved: ${Object.keys(loadStore().accounts).join(", ") || "(none)"}`, "error");
+		return;
+	}
+
+	const before = await sync();
+	if (before.kind === "matched" && before.name === name) {
+		ctx.ui.notify(`Already using "${label(name, known)}".`, "info");
+		updateStatus(ctx, before);
+		return;
+	}
+
+	// Who owns the token now in auth.json? It must be saved before we overwrite it.
+	let owner: string | undefined = before.kind === "matched" ? before.name : undefined;
+	if (before.kind === "unknown") {
+		const who = before.profile?.email ? ` (${before.profile.email})` : "";
+		if (before.probable) {
+			const keep = `Keep it as "${before.probable}" (a refreshed token)`;
+			const drop = "Discard it (it is a different, unsaved login)";
+			const choice = await ctx.ui.select(`The current login${who} could not be identified`, [keep, drop]);
+			if (!choice) return;
+			owner = choice === keep ? before.probable : undefined;
+		} else {
+			const ok = await ctx.ui.confirm(
+				"Unsaved login",
+				`The current Anthropic login${who} is not saved. Switching removes it from auth.json. ` +
+					"Continue? (Cancel, then /account save <name> to keep it.)",
+			);
+			if (!ok) return;
+		}
+	}
+
+	const seen = before.kind === "none" ? undefined : before.cred.refresh;
+	const slot = await mutateStore((s) => {
+		const target = s.accounts[name];
+		if (!target) throw new Error(`Account "${name}" was removed meanwhile.`);
+		const auth = readAuth();
+		const now = isOAuth(auth[PROVIDER]) ? auth[PROVIDER] : undefined;
+		if (now?.refresh !== seen && !owner) {
+			throw new Error("auth.json changed during the switch; run the command again.");
+		}
+		// Save the outgoing token (it may have rotated since sync) into its slot.
+		if (now && owner && s.accounts[owner]) s.accounts[owner].cred = now;
+		auth[PROVIDER] = target.cred;
+		writeAtomic(AUTH_PATH, auth);
+		s.active = name;
+		return target;
+	});
+	ctx.ui.notify(`Switched Anthropic account to "${label(name, slot)}".`, "info");
+	updateStatus(ctx, { kind: "matched", name, cred: slot.cred });
+}
+
+async function cmdRemove(name: string, ctx: ExtensionContext): Promise<void> {
+	if (!loadStore().accounts[name]) {
+		ctx.ui.notify(`Unknown account "${name}".`, "error");
+		return;
+	}
+	const ok = await ctx.ui.confirm("Remove account?", `Forget saved login "${name}"? (auth.json is not changed.)`);
+	if (!ok) return;
+	await mutateStore((s) => {
+		delete s.accounts[name];
+		if (s.active === name) s.active = undefined;
+	});
+	ctx.ui.notify(`Removed "${name}".`, "info");
+	updateStatus(ctx, await sync());
+}
+
+async function overview(ctx: ExtensionContext) {
+	const result = await sync();
+	updateStatus(ctx, result);
+	const store = loadStore();
+	const active = result.kind === "matched" ? result.name : undefined;
+	const names = Object.keys(store.accounts);
+	const rows = names.map((n) => `${n === active ? "●" : "○"} ${label(n, store.accounts[n])}`);
+	return { result, names, rows };
+}
+
+async function cmdList(ctx: ExtensionContext): Promise<void> {
+	const { result, rows } = await overview(ctx);
+	if (result.kind === "unknown") {
+		const who = result.profile?.email ? ` (${result.profile.email})` : "";
+		rows.push(`! unsaved login in auth.json${who} — /account save <name>`);
+	}
+	const claude = rows.length ? rows.join("\n") : "No saved accounts. Run /login, then /account save <name>.";
+	if (codexHomes.length === 0) return ctx.ui.notify(claude, "info");
+	const codex = [
+		"Codex providers (parallel; pick a model with /model; /account does not switch these):",
+		...codexRows(codexHomes, readAuth()),
+	];
+	ctx.ui.notify(["Claude accounts (switch with /account <name>):", claude, "", ...codex].join("\n"), "info");
+}
+
+async function cmdPick(ctx: ExtensionContext): Promise<void> {
+	if (!ctx.hasUI) return cmdList(ctx);
+	const { names, rows } = await overview(ctx);
+	if (!names.length) return cmdList(ctx);
+	const choice = await ctx.ui.select("Switch Claude account", rows);
+	if (!choice) return;
+	await cmdUse(names[rows.indexOf(choice)], ctx);
+}
+
+const HELP = [
+	"/account                 pick a Claude account to switch to",
+	"/account <name>          switch to a saved Claude account",
+	"/account save <name>     save the current Anthropic /login under <name>",
+	"/account list            list saved Claude accounts and Codex providers",
+	"/account remove <name>   forget a saved Claude account",
+	"Switch, save and remove work on Claude accounts only.",
+	"Codex: each ~/.codex-<name>/auth.json is the provider openai-codex-<name>;",
+	'/login "OpenAI Codex (<name>)" once, then pick its model with /model.',
+].join("\n");
+
+export function registerClaude(pi: ExtensionAPI, homes: CodexHome[]): void {
+	codexHomes = homes;
+	pi.registerCommand("account", {
+		description: "Switch saved Claude accounts; list also shows Codex providers — /account help",
+		getArgumentCompletions: (prefix) => {
+			let names: string[] = [];
+			try {
+				names = Object.keys(loadStore().accounts);
+			} catch {
+				/* corrupt store: no name completions */
+			}
+			const [first] = prefix.split(/\s+/);
+			const withName = ["remove", "rm", "use", "switch"];
+			const pool =
+				prefix.includes(" ") && withName.includes(first)
+					? names.map((n) => `${first} ${n}`)
+					: [...names, "save", "list", "remove", "use", "help"];
+			const items = pool.filter((v) => v.startsWith(prefix)).map((v) => ({ value: v, label: v }));
+			return items.length ? items : null;
+		},
+		handler: async (args, ctx) => {
+			const [sub, ...rest] = args.trim().split(/\s+/).filter(Boolean);
+			const arg = rest.join(" ");
+			try {
+				switch (sub) {
+					case undefined:
+						return await cmdPick(ctx);
+					case "save":
+					case "add":
+						return await cmdSave(arg, ctx);
+					case "list":
+					case "ls":
+						return await cmdList(ctx);
+					case "remove":
+					case "rm":
+						return await cmdRemove(arg, ctx);
+					case "use":
+					case "switch":
+						return await cmdUse(arg, ctx);
+					case "help":
+						return ctx.ui.notify(HELP, "info");
+					default:
+						return await cmdUse(sub, ctx);
+				}
+			} catch (err) {
+				ctx.ui.notify(`account: ${(err as Error).message}`, "error");
+			}
+		},
+	});
+
+	const quietSync = async (ctx: ExtensionContext, announce: boolean) => {
+		try {
+			const result = await sync();
+			updateStatus(ctx, result);
+			if (announce && result.kind === "unknown" && !result.probable && ctx.hasUI) {
+				const who = result.profile?.email ? ` (${result.profile.email})` : "";
+				ctx.ui.notify(`Unsaved Anthropic login${who}. Run /account save <name> to keep it.`, "info");
+			}
+		} catch {
+			/* never break the session over account bookkeeping */
+		}
+	};
+
+	pi.on("session_start", (_e, ctx) => quietSync(ctx, true));
+	pi.on("agent_end", (_e, ctx) => quietSync(ctx, false));
+}

package/src/codex.ts

@@ -0,0 +1,197 @@
+/**
+ * pi-multi-accounts, Codex part — use extra ChatGPT (Codex) logins in parallel
+ * with the built-in `openai-codex` provider.
+ *
+ * Every ~/.codex-<name>/auth.json (Codex CLI format) becomes a separate Pi
+ * provider `openai-codex-<name>` with the same models as `openai-codex`, e.g.
+ * ~/.codex-huy → `openai-codex-huy/gpt-5.5`. Streaming reuses Pi's built-in
+ * `openai-codex-responses` implementation; the chatgpt-account-id header is
+ * derived from the access token, so each provider talks as its own account.
+ *
+ * Setup: /login → "OpenAI Codex (<name>)" imports the tokens from the file
+ * (no browser). Then pick the model with /model.
+ *
+ * The Codex auth file stays the source of truth: on refresh the extension
+ * first adopts newer tokens from the file (e.g. refreshed by
+ * `CODEX_HOME=~/.codex-<name> codex`), otherwise it refreshes with the file's
+ * refresh token and writes the rotated tokens back, so Pi and the Codex CLI
+ * keep sharing one valid login.
+ */
+import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
+import type { ExtensionAPI, ProviderModelConfig } from "@earendil-works/pi-coding-agent";
+import { existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const BASE_URL = "https://chatgpt.com/backend-api";
+const JWT_AUTH_CLAIM = "https://api.openai.com/auth";
+const EXPIRY_SKEW_MS = 5 * 60_000;
+const HOME_DIR_PATTERN = /^\.codex-([a-z0-9][a-z0-9_-]*)$/i;
+
+interface CodexAuthFile {
+	auth_mode?: string;
+	tokens?: {
+		id_token?: string;
+		access_token?: string;
+		refresh_token?: string;
+		account_id?: string;
+	};
+	last_refresh?: string;
+	[key: string]: unknown;
+}
+
+export interface CodexCred {
+	access: string;
+	refresh: string;
+	expires: number;
+	accountId: string;
+	[key: string]: unknown;
+}
+
+export interface CodexHome {
+	name: string;
+	dir: string;
+	authPath: string;
+}
+
+function jwtClaims(token: string): Record<string, any> {
+	const payload = token.split(".")[1];
+	if (!payload) throw new Error("access token is not a JWT");
+	return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+}
+
+function readAuthFile(path: string): CodexAuthFile {
+	// Tolerate non-breaking-space indentation left by copy/paste.
+	try {
+		return JSON.parse(readFileSync(path, "utf8").replace(/\u00a0/g, " "));
+	} catch {
+		// Never surface the parser message: it can quote token characters.
+		throw new Error(`${path} is missing or not valid JSON`);
+	}
+}
+
+export function credFromTokens(access: string, refresh: string): CodexCred {
+	const claims = jwtClaims(access);
+	const accountId = claims[JWT_AUTH_CLAIM]?.chatgpt_account_id;
+	if (typeof accountId !== "string" || !accountId) throw new Error("access token has no chatgpt_account_id");
+	if (typeof claims.exp !== "number") throw new Error("access token has no exp claim");
+	return { access, refresh, expires: claims.exp * 1000, accountId };
+}
+
+export function credFromFile(path: string): CodexCred {
+	const tokens = readAuthFile(path).tokens;
+	if (!tokens?.access_token || !tokens.refresh_token) {
+		throw new Error(`${path} has no ChatGPT tokens; run \`CODEX_HOME=${join(path, "..")} codex login\` first`);
+	}
+	return credFromTokens(tokens.access_token, tokens.refresh_token);
+}
+
+export function writeBack(path: string, fresh: { access: string; refresh: string; idToken?: string; accountId: string }): void {
+	const file = readAuthFile(path);
+	file.tokens = {
+		...file.tokens,
+		access_token: fresh.access,
+		refresh_token: fresh.refresh,
+		...(fresh.idToken ? { id_token: fresh.idToken } : {}),
+		account_id: fresh.accountId,
+	};
+	file.last_refresh = new Date().toISOString();
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+	renameSync(tmp, path);
+}
+
+export function isFresh(cred: CodexCred, now = Date.now()): boolean {
+	return cred.expires - now > EXPIRY_SKEW_MS;
+}
+
+/** True when the auth file holds newer, still-valid tokens than `currentAccess`. */
+export function shouldAdopt(fromFile: CodexCred, currentAccess: string, now = Date.now()): boolean {
+	return fromFile.access !== currentAccess && isFresh(fromFile, now);
+}
+
+export async function refreshCred(home: CodexHome, refreshToken: string, signal: AbortSignal): Promise<CodexCred> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: CLIENT_ID }),
+		signal,
+	});
+	if (!response.ok) {
+		// The Codex CLI may have rotated the single-use refresh token meanwhile.
+		const latest = credFromFile(home.authPath);
+		if (latest.refresh !== refreshToken && isFresh(latest)) return latest;
+		const body = (await response.json().catch(() => ({}))) as { error?: unknown };
+		const code = typeof body.error === "string" ? ` (${body.error})` : "";
+		throw new Error(
+			`OpenAI Codex (${home.name}) token refresh failed: HTTP ${response.status}${code}. ` +
+				`Run \`CODEX_HOME=${home.dir} codex login\`, then /login again.`,
+		);
+	}
+	const json = (await response.json()) as { access_token?: string; refresh_token?: string; id_token?: string };
+	if (!json.access_token) throw new Error(`OpenAI Codex (${home.name}) token refresh returned no access token`);
+	const cred = credFromTokens(json.access_token, json.refresh_token ?? refreshToken);
+	try {
+		writeBack(home.authPath, { ...cred, idToken: json.id_token });
+	} catch (error) {
+		// Pi still persists the rotated token; only the Codex CLI copy is stale.
+		console.warn(`pi-multi-accounts: could not update ${home.authPath}: ${(error as Error).message}`);
+	}
+	return cred;
+}
+
+export function discoverHomes(root = homedir()): CodexHome[] {
+	return readdirSync(root, { withFileTypes: true })
+		.filter((entry) => entry.isDirectory() && HOME_DIR_PATTERN.test(entry.name))
+		.map((entry) => ({
+			name: (HOME_DIR_PATTERN.exec(entry.name)?.[1] ?? entry.name).toLowerCase(),
+			dir: join(root, entry.name),
+			authPath: join(root, entry.name, "auth.json"),
+		}))
+		.filter((home) => existsSync(home.authPath));
+}
+
+function codexModels(): ProviderModelConfig[] {
+	return getBuiltinModels("openai-codex").map(({ provider: _provider, ...model }) => ({ ...model }) as ProviderModelConfig);
+}
+
+export function registerCodex(pi: ExtensionAPI, homes = discoverHomes()): CodexHome[] {
+	const models = codexModels();
+	for (const home of homes) {
+		pi.registerProvider(`openai-codex-${home.name}`, {
+			name: `OpenAI Codex (${home.name})`,
+			baseUrl: BASE_URL,
+			api: "openai-codex-responses",
+			models,
+			oauth: {
+				name: `OpenAI Codex (${home.name})`,
+				isSubscription: true,
+				async login(callbacks) {
+					const cred = credFromFile(home.authPath);
+					callbacks.onProgress?.(`Imported ChatGPT login from ${home.authPath}`);
+					return cred;
+				},
+				async refreshToken(credentials, signal) {
+					// Adopt tokens the Codex CLI refreshed meanwhile; otherwise refresh ourselves.
+					const fromFile = credFromFile(home.authPath);
+					if (shouldAdopt(fromFile, credentials.access)) return fromFile;
+					return refreshCred(home, fromFile.refresh, signal);
+				},
+				getApiKey: (credentials) => credentials.access,
+			},
+		});
+	}
+	return homes;
+}
+
+/** Status lines for `/account list`: one per Codex home, by login state in Pi's auth.json. */
+export function codexRows(homes: CodexHome[], auth: Record<string, unknown>): string[] {
+	return homes.map((home) => {
+		const id = `openai-codex-${home.name}`;
+		const entry = auth[id] as { type?: unknown } | undefined;
+		const state = entry?.type === "oauth" ? "logged in" : `not logged in (/login → "OpenAI Codex (${home.name})")`;
+		return `  ${home.name}  ${id}  ${home.authPath}  ${state}`;
+	});
+}

package/src/index.ts

@@ -0,0 +1,9 @@
+/** pi-multi-accounts — several Claude logins (/account) + extra Codex logins as parallel providers. */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { registerClaude } from "./claude.ts";
+import { registerCodex } from "./codex.ts";
+
+export default function (pi: ExtensionAPI) {
+	const codexHomes = registerCodex(pi);
+	registerClaude(pi, codexHomes);
+}