pi-multi-accounts 0.0.0-stage → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nvminhtue
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,113 @@
-# Temporary Holding Version
+# pi-multi-accounts
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A [Pi](https://github.com/earendil-works/pi) extension for people with more than one subscription:
+
+- **Claude**: keep **multiple Claude Pro/Max OAuth accounts** for Pi's built-in `/login` and switch between them with a single `/account` command. Pi stores exactly one `anthropic` credential; this extension saves additional logins next to it and swaps the active one on demand.
+- **Codex**: use extra **ChatGPT (Codex) logins as parallel providers** (`openai-codex-<name>`) next to Pi's built-in `openai-codex`. Use `/account` to select a provider for this session, or pick its model with `/model`.
+
+## Install
+
+```bash
+# local checkout
+pi install /absolute/path/to/pi-multi-accounts
+
+# or from git
+pi install git:github.com/<user>/pi-multi-accounts
+```
+
+Then run `/reload` (or restart Pi).
+
+### Migrating from the standalone extensions / the old package
+
+- Remove `~/.pi/agent/extensions/codex-accounts.ts` and `~/.pi/agent/extensions/claude-accounts.ts` if present. Otherwise the commands and providers are registered twice.
+- Remove old `pi-claude-accounts` package entries from your Pi settings.
+- `~/.pi/agent/claude-accounts.json` is kept: your saved Claude accounts continue to work.
+
+## Usage
+
+| Command                       | What it does                                        |
+| ----------------------------- | --------------------------------------------------- |
+| `/account login`              | Ask which account type, then run the matching login below |
+| `/account login claude <name>`| Log in to a Claude Pro/Max account in the browser and save it as `<name>` |
+| `/account login codex <name>` | Import `~/.codex-<name>` (a Codex CLI login) as provider `openai-codex-<name>` |
+| `/account`                    | Pick a Claude account or a registered Codex provider |
+| `/account <name/id>`          | Use an exact saved Claude name or registered Codex provider ID |
+| `/account save <name>`        | Save the current built-in Anthropic `/login` under `<name>` |
+| `/account list`               | List Claude accounts (● active, ○ inactive) and Codex providers (login state) |
+| `/account remove <name>`      | Forget a saved Claude account (`auth.json` is not changed) |
+| `/account help`               | Show command help                                   |
+
+Use `/account login` instead of Pi's built-in `/login` for this extension's accounts. It explains every step in the session, saves the Claude login under a name, and registers new Codex homes without `/reload`. The built-in `/login` still works; adopt its Claude login with `/account save <name>`.
+
+Save and remove work on **Claude accounts only**. Their arguments are literal Claude names, not provider qualifiers. `login` is a reserved name: a Claude account saved as `login` by an older version stays reachable with `/account use login` or `/account claude:login`.
+
+Claude selection changes shared credentials. It does not change the session model. Codex selection changes only this session's model. It does not change Claude credentials or the default model for new sessions.
+
+Use an unqualified name or ID when it matches exactly one provider. If a saved Claude name equals a registered Codex ID, use `/account claude:<name>` or `/account codex:<provider-id>`. Existing Claude names such as `openai-codex-team` remain valid. The picker identifies each provider and does not need qualifiers.
+
+`/account use` and `/account switch` without a target open the same picker. Prefix completions include the aliases, saved names, registered Codex IDs, and qualified targets. Completions for `remove` and `rm` include only literal Claude names.
+
+Aliases: `add` = `save`, `ls` = `list`, `rm` = `remove`, `use`/`switch` = switch.
+
+The footer shows `claude: <name>` for the active saved account, or `claude: unsaved login` when the login in `auth.json` is not saved yet.
+
+## Logging in to Claude accounts
+
+1. `/account login claude work`. Pi prints a claude.ai login URL and waits; it does not open the browser itself. Sign in, and the login is saved as `work`. If the browser cannot reach `localhost`, paste the final redirect URL or code into the prompt.
+2. `/account login claude personal` for the second account. claude.ai reuses the browser's signed-in session, so the URL in a normal window gives you `work` again. Instead, either:
+   - open the URL in a **private/incognito window**, or
+   - use a **different browser profile**, or
+   - **sign out of claude.ai** first.
+
+   If the browser still returns an account that is already saved, the command reports it and saves nothing. This check uses the Anthropic profile lookup; when that lookup fails, compare the emails with `/account list`.
+3. A login is activated at once when `auth.json` has no Claude login or holds the same account. Otherwise you are asked whether to switch, because a switch affects every running Pi session.
+4. Run `/account list` and check that the emails differ.
+
+## Codex accounts
+
+1. For each extra ChatGPT account, log in with the Codex CLI into its own folder: `CODEX_HOME=~/.codex-<name> codex login`. For a second account, finish that login in a private window, or sign out of chatgpt.com first.
+2. In Pi, run `/account login codex <name>`. This imports the tokens from `~/.codex-<name>/auth.json`; no browser is involved. A folder created after Pi started is registered on the spot. Without `<name>`, the command lists the found homes. If the folder has no login yet, it prints the exact `codex login` command. (The built-in `/login` → **"OpenAI Codex (<name>)"** does the same import for already registered homes.)
+3. Select the provider with `/account openai-codex-<name>`, or use the unified `/account` picker. `/account login codex` also offers to switch right away. The command keeps the current model ID if the target provider supports it. Otherwise, it asks you to choose a target model. Cancel leaves the session unchanged. Without dialog support, choose explicitly with `/model`, e.g. `openai-codex-<name>/<model>`.
+
+The provider has the same models as the built-in `openai-codex`. The command reports success only after Pi accepts the model change. `/account list` shows each provider's auth path, login state, and current-session active marker.
+
+The Codex auth file stays the source of truth: on refresh the extension first adopts newer tokens found in the file (e.g. refreshed by the Codex CLI); otherwise it refreshes with the file's refresh token and writes the rotated tokens back. `~/.codex-*` folders are discovered at load time; later ones are added by `/account login codex <name>` or `/reload`.
+
+## How it works (Claude)
+
+- Pi keeps a single `anthropic` entry in `~/.pi/agent/auth.json`. Switching replaces that entry and leaves other providers untouched.
+- Saved logins live in `~/.pi/agent/claude-accounts.json` (mode `0600`).
+- Writes happen under the same `auth.json.lock` directory lock that Pi's `proper-lockfile` uses, so Pi and the extension never write at the same time.
+- Refresh tokens rotate. When Pi refreshes the active token, the extension copies the new one back into the right slot on `session_start`, after each `agent_end`, and during every switch.
+- To tell whose token is whose, it asks `https://api.anthropic.com/api/oauth/profile` for the account id/email. If that lookup fails, it falls back gracefully (matching on the refresh token, or asking you when ownership is unclear).
+
+## Caveats
+
+- `auth.json` is shared: a Claude switch affects **every running Pi session**. A Codex switch changes only the current session model.
+- It relies on Pi internals (the `auth.json` format and its lock directory). Tested with Pi 0.99.2.
+- The Anthropic profile endpoint is unofficial and may change.
+- The OpenAI token endpoint and client id used for Codex refresh are unofficial and may change.
+- The Codex CLI and Pi share each Codex refresh token (single use); if both refresh at once, one of them may need `codex login` and `/login` again.
+- `claude-accounts.json` contains refresh tokens. Keep it private and never commit it.
+
+## Development
+
+```bash
+npm install
+npm run check   # typecheck + tests
+```
+
+Layout:
+
+```text
+src/index.ts                  entry point: shares one registered Codex-home snapshot
+src/accounts.ts               /account command, typed entries, exact resolution and completions
+src/claude.ts                 Claude credentials, status, validation and lifecycle sync
+src/codex.ts                  Codex parallel providers and session-model selection
+test/account.test.mjs         node:test suite for /account (temp PI_CODING_AGENT_DIR and HOME, no network)
+test/codex.test.mjs           node:test suite for the Codex providers (stubbed fetch, no network)
+```
+
+## License
+
+MIT

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "pi-multi-accounts",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "private": false,
+  "type": "module",
+  "description": "Pi extension: switch between several Claude Pro/Max OAuth logins with /account, and use extra ChatGPT (Codex) logins as parallel openai-codex-<name> providers",
+  "keywords": ["pi-package", "pi", "claude", "anthropic", "openai", "codex", "chatgpt", "oauth", "multi-account"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nvminhtue/pi-multi-accounts.git"
+  },
+  "pi": {
+    "extensions": ["./src/index.ts"]
+  },
+  "files": ["src", "README.md", "LICENSE"],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "node --experimental-strip-types --test \"test/*.test.mjs\"",
+    "check": "npm run typecheck && npm test"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "0.99.2",
+    "@earendil-works/pi-coding-agent": "0.99.2",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

package/src/accounts.ts

@@ -0,0 +1,203 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { ClaudeProvider, SUBCOMMANDS } from "./claude.ts";
+import { createCodexProvider } from "./codex.ts";
+import type { CodexHome } from "./codex.ts";
+
+export interface ClaudeEntry {
+	provider: "claude";
+	id: string;
+	name: string;
+	email?: string;
+	isActive: boolean;
+}
+
+export interface CodexEntry {
+	provider: "codex";
+	id: string;
+	name: string;
+	authPath: string;
+	isLoggedIn: boolean;
+	isActive: boolean;
+}
+
+export interface ClaudeStatus {
+	entries: ClaudeEntry[];
+	unsavedLogin?: { email?: string };
+}
+
+type AccountEntry = ClaudeEntry | CodexEntry;
+
+function formatClaudeName(entry: ClaudeEntry): string {
+	return entry.email ? `${entry.name} <${entry.email}>` : entry.name;
+}
+
+function formatPickerLabel(entry: AccountEntry): string {
+	const marker = entry.isActive ? "●" : "○";
+	if (entry.provider === "claude") {
+		return `[Claude] ${marker} ${formatClaudeName(entry)} (claude:${entry.id})`;
+	}
+	return `[Codex] ${marker} ${entry.name} (codex:${entry.id})`;
+}
+
+function formatList(claude: ClaudeStatus, codex: CodexEntry[]): string {
+	const lines = ["Claude accounts (credentials shared across Pi sessions):"];
+	for (const entry of claude.entries) {
+		const marker = entry.isActive ? "●" : "○";
+		lines.push(`[Claude] ${marker} ${formatClaudeName(entry)}`);
+	}
+	if (!claude.entries.length) lines.push("No saved accounts. Run /account login claude <name>.");
+	if (claude.unsavedLogin) {
+		const email = claude.unsavedLogin.email ? ` (${claude.unsavedLogin.email})` : "";
+		lines.push(`! unsaved login in auth.json${email} — /account save <name>`);
+	}
+	lines.push("", "Codex providers (model selection for this session only):");
+	for (const entry of codex) {
+		const state = entry.isLoggedIn ? "logged in" : `not logged in (/account login codex ${entry.name})`;
+		const marker = entry.isActive ? "●" : "○";
+		lines.push(`  ${marker} ${entry.name}  ${entry.id}  ${entry.authPath}  ${state}`);
+	}
+	if (!codex.length) lines.push("No registered Codex homes. Run /account login codex <name> to add one.");
+	return lines.join("\n");
+}
+
+function getTargetSuggestions(names: string[], ids: string[]): string[] {
+	const collisions = names.filter((name) => ids.includes(name));
+	return [
+		...names.filter((name) => !collisions.includes(name)),
+		...ids.filter((id) => !collisions.includes(id)),
+		...names.map((name) => `claude:${name}`),
+		...ids.map((id) => `codex:${id}`),
+	];
+}
+
+function getCompletions(prefix: string, ids: string[]) {
+	let names: string[] = [];
+	try {
+		names = ClaudeProvider.getSavedNames();
+	} catch {
+		/* Keep static and registered Codex completions available for a corrupt store. */
+	}
+	const targets = getTargetSuggestions(names, ids);
+	const candidates = [
+		...SUBCOMMANDS,
+		...targets,
+		...targets.flatMap((target) => [`use ${target}`, `switch ${target}`]),
+		...names.flatMap((name) => [`remove ${name}`, `rm ${name}`]),
+		"login claude",
+		"login codex",
+		...ids.map((id) => `login codex ${id.replace(/^openai-codex-/, "")}`),
+	];
+	const matches = candidates.filter((candidate) => candidate.startsWith(prefix));
+	return matches.length ? matches.map((value) => ({ value, label: value })) : null;
+}
+
+export function registerAccounts(pi: ExtensionAPI, homes: readonly CodexHome[]): void {
+	const codex = createCodexProvider(pi, homes);
+
+	async function cmdList(ctx: ExtensionContext): Promise<void> {
+		const claude = await ClaudeProvider.getStatus(ctx);
+		ctx.ui.notify(formatList(claude, codex.getEntries(ctx)), "info");
+	}
+
+	async function useEntry(entry: AccountEntry, ctx: ExtensionContext): Promise<void> {
+		if (entry.provider === "claude") await ClaudeProvider.useAccount(entry.id, ctx);
+		else await codex.useAccount(entry.id, ctx);
+	}
+
+	async function cmdPick(ctx: ExtensionContext): Promise<void> {
+		if (!ctx.hasUI) return cmdList(ctx);
+		const claude = await ClaudeProvider.getStatus(ctx);
+		const entries: AccountEntry[] = [...claude.entries, ...codex.getEntries(ctx)];
+		if (!entries.length) return cmdList(ctx);
+		const labels = entries.map(formatPickerLabel);
+		const choice = await ctx.ui.select("Switch account or provider", labels);
+		const entry = entries.find((_entry, index) => labels[index] === choice);
+		if (entry) await useEntry(entry, ctx);
+	}
+
+	async function cmdUse(target: string, ctx: ExtensionContext): Promise<void> {
+		if (!target) return cmdPick(ctx);
+		const separator = target.indexOf(":");
+		const qualifier = separator < 0 ? undefined : target.slice(0, separator);
+		const id = separator < 0 ? target : target.slice(separator + 1);
+		if (qualifier !== undefined && qualifier !== "claude" && qualifier !== "codex") {
+			throw new Error(`Unknown account qualifier "${qualifier}". Use claude: or codex:.`);
+		}
+		const isCodex = qualifier !== "claude" && codex.getIds().includes(id);
+		const isClaude = qualifier !== "codex" && ClaudeProvider.getSavedNames().includes(id);
+		if (isClaude && isCodex) {
+			throw new Error(`Ambiguous account "${id}". Use claude:${id} or codex:${id}.`);
+		}
+		if (isClaude) await ClaudeProvider.useAccount(id, ctx);
+		else if (isCodex) await codex.useAccount(id, ctx);
+		else throw new Error(`Unknown account "${target}". Run /account list; new Codex homes require /reload.`);
+	}
+
+	async function cmdLogin(arg: string, ctx: ExtensionContext): Promise<void> {
+		const [first = "", ...rest] = arg.split(/\s+/).filter(Boolean);
+		let provider = first === "claude" || first === "codex" ? first : undefined;
+		const name = provider ? rest.join(" ") : arg;
+		if (!provider) {
+			if (!ctx.hasUI) {
+				ctx.ui.notify("Usage: /account login claude <name> | /account login codex <name>", "warning");
+				return;
+			}
+			const claude = "Claude Pro/Max — browser login, saved as a switchable account";
+			const codex = "Codex (ChatGPT) — import a Codex CLI login as provider openai-codex-<name>";
+			const choice = await ctx.ui.select("Log in to which account type?", [claude, codex]);
+			if (!choice) return;
+			provider = choice === claude ? "claude" : "codex";
+		}
+		if (provider === "claude") await ClaudeProvider.login(name, ctx);
+		else await codex.login(name, ctx);
+	}
+
+	async function handleCommand(args: string, ctx: ExtensionContext): Promise<void> {
+		const [sub, ...rest] = args.trim().split(/\s+/).filter(Boolean);
+		const arg = rest.join(" ");
+		switch (sub) {
+			case undefined: return cmdPick(ctx);
+			case "login": return cmdLogin(arg, ctx);
+			case "save":
+			case "add": return ClaudeProvider.saveAccount(arg, ctx);
+			case "remove":
+			case "rm": return ClaudeProvider.removeAccount(arg, ctx);
+			case "use":
+			case "switch": return cmdUse(arg, ctx);
+			case "list":
+			case "ls": return cmdList(ctx);
+			case "help": return ctx.ui.notify(HELP, "info");
+			default: return cmdUse(args.trim(), ctx);
+		}
+	}
+
+	pi.registerCommand("account", {
+		description: "Unified account and provider management — /account help",
+		getArgumentCompletions: (prefix) => getCompletions(prefix, codex.getIds()),
+		handler: async (args, ctx) => {
+			try {
+				await handleCommand(args, ctx);
+			} catch (err) {
+				ctx.ui.notify(`account: ${(err as Error).message}`, "error");
+			}
+		},
+	});
+}
+
+const HELP = [
+	"/account login claude <name>  log in to a Claude Pro/Max account in the browser and save it as <name>",
+	"/account login codex <name>   import ~/.codex-<name> (made by `CODEX_HOME=~/.codex-<name> codex login`)",
+	"/account                 pick a Claude account or Codex provider",
+	"/account <name/id>       use an exact saved Claude name or registered Codex ID",
+	"/account use|switch      pick or use a target",
+	"/account claude:<name>   choose Claude when a name collides with a Codex ID",
+	"/account codex:<id>      choose Codex when an ID collides with a Claude name",
+	"/account save|add <name> save the current built-in /login as a Claude account (literal Claude name)",
+	"/account remove|rm <name> forget saved Claude login (literal Claude name)",
+	"/account list|ls         list accounts, login states and auth paths",
+	"Another account of the same service? Open the login URL in a private window, or the browser reuses the signed-in account.",
+	"Claude changes shared credentials, not the session model. Save and remove are Claude-only.",
+	"Codex changes only this session's model, not Claude credentials or the default model.",
+	"Codex IDs: openai-codex-<name>.",
+	"Codex keeps the current model ID when supported; otherwise choose a model (or use /model without UI).",
+].join("\n");

package/src/claude.ts

@@ -0,0 +1,530 @@
+/**
+ * pi-multi-accounts, Claude part — keep several Anthropic (Claude Pro/Max) OAuth logins and
+ * switch between them.
+ *
+ * Flow:
+ *   1. /account login claude work      → browser login, saved as "work".
+ *   2. /account login claude personal  → open the printed URL in a private window
+ *                                        so claude.ai does not reuse "work".
+ *   3. /account work | /account personal | /account (picker) to switch.
+ * An existing built-in /login can still be adopted with /account save <name>.
+ *
+ * How it works: Pi keeps exactly one `anthropic` credential in auth.json and
+ * re-reads the file when its revision changes. This extension stores the other
+ * logins in ~/.pi/agent/claude-accounts.json (mode 0600) and swaps the
+ * `anthropic` entry in auth.json under the same `auth.json.lock` directory lock
+ * that Pi's proper-lockfile uses. All store writes also happen under that lock.
+ *
+ * Refresh tokens rotate: Pi refreshes the active token and writes the new one
+ * to auth.json. The extension syncs that rotated token back into the active
+ * slot (on session start, after each agent run, and inside every switch), so a
+ * stored slot never holds a dead refresh token.
+ *
+ * Note: auth.json is shared — switching affects every running Pi session.
+ */
+import type { AuthEvent, AuthPrompt, OAuthAuth, ProviderAuthInteraction } from "@earendil-works/pi-ai";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { ClaudeEntry, ClaudeStatus } from "./accounts.ts";
+
+const PROVIDER = "anthropic";
+const AGENT_DIR = process.env.PI_CODING_AGENT_DIR || join(homedir(), ".pi", "agent");
+const AUTH_PATH = join(AGENT_DIR, "auth.json");
+const STORE_PATH = join(AGENT_DIR, "claude-accounts.json");
+const LOCK_PATH = `${AUTH_PATH}.lock`;
+const LOCK_STALE_MS = 30_000;
+const LOCK_TIMEOUT_MS = 20_000; // a Pi token refresh can hold the lock ~15 s
+const PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const STATUS_KEY = "claude-account";
+export const SUBCOMMANDS = ["login", "save", "add", "list", "ls", "remove", "rm", "use", "switch", "help"];
+const LOGIN_HINT =
+	"Adding another Claude account? Open the URL in a private/incognito window or another browser profile " +
+	"(or sign out of claude.ai first); otherwise claude.ai logs in the account that is already signed in.";
+
+interface OAuthCred {
+	type: "oauth";
+	refresh: string;
+	access: string;
+	expires: number;
+	[key: string]: unknown;
+}
+
+interface Identity {
+	accountId?: string;
+	email?: string;
+}
+
+interface Slot extends Identity {
+	cred: OAuthCred;
+	savedAt: number;
+}
+
+interface Store {
+	active?: string;
+	accounts: Record<string, Slot>;
+}
+
+// ---------- file helpers ----------
+
+/** Missing file → undefined. Corrupt file → throw (never silently wipe data). */
+function readJsonStrict<T>(path: string): T | undefined {
+	if (!existsSync(path)) return undefined;
+	const text = readFileSync(path, "utf-8").replace(/^\uFEFF/, "");
+	if (!text.trim()) return undefined;
+	try {
+		return JSON.parse(text) as T;
+	} catch {
+		throw new Error(`${path} is not valid JSON; fix or remove it.`);
+	}
+}
+
+function writeAtomic(path: string, data: unknown): void {
+	mkdirSync(AGENT_DIR, { recursive: true, mode: 0o700 });
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 0o600 });
+	renameSync(tmp, path);
+}
+
+function loadStore(): Store {
+	const s = readJsonStrict<Store>(STORE_PATH) ?? { accounts: {} };
+	if (!s.accounts || typeof s.accounts !== "object") s.accounts = {};
+	return s;
+}
+
+function isOAuth(c: unknown): c is OAuthCred {
+	const o = c as OAuthCred | undefined;
+	return !!o && o.type === "oauth" && typeof o.refresh === "string" && typeof o.access === "string";
+}
+
+export function readAuth(): Record<string, unknown> {
+	return readJsonStrict<Record<string, unknown>>(AUTH_PATH) ?? {};
+}
+
+/** Locked read-modify-write of auth.json; other providers' entries are kept. */
+export function mutateAuth(fn: (auth: Record<string, unknown>) => void): Promise<void> {
+	return withAuthLock(() => {
+		const auth = readAuth();
+		fn(auth);
+		writeAtomic(AUTH_PATH, auth);
+	});
+}
+
+function readCurrentCred(): OAuthCred | undefined {
+	const c = readAuth()[PROVIDER];
+	return isOAuth(c) ? c : undefined;
+}
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Same lock directory as proper-lockfile (`auth.json.lock`), so Pi and we
+ * serialize. `fn` must be synchronous: nothing can interleave while we hold it.
+ */
+async function withAuthLock<T>(fn: () => T): Promise<T> {
+	const deadline = Date.now() + LOCK_TIMEOUT_MS;
+	for (;;) {
+		if (Date.now() > deadline) throw new Error("auth.json is locked by another process; try again.");
+		try {
+			mkdirSync(LOCK_PATH);
+			break;
+		} catch (err) {
+			if ((err as { code?: string }).code !== "EEXIST") throw err;
+		}
+		try {
+			if (Date.now() - statSync(LOCK_PATH).mtimeMs > LOCK_STALE_MS) {
+				rmdirSync(LOCK_PATH);
+				continue;
+			}
+		} catch (err) {
+			if ((err as { code?: string }).code === "ENOENT") continue; // lock vanished — retry now
+			throw err;
+		}
+		await sleep(50 + Math.random() * 100);
+	}
+	try {
+		return fn();
+	} finally {
+		try {
+			rmdirSync(LOCK_PATH);
+		} catch {
+			/* already gone */
+		}
+	}
+}
+
+/** Locked read-modify-write of the store. */
+function mutateStore<T>(fn: (store: Store) => T): Promise<T> {
+	return withAuthLock(() => {
+		const store = loadStore();
+		const result = fn(store);
+		writeAtomic(STORE_PATH, store);
+		return result;
+	});
+}
+
+// ---------- identity ----------
+
+/** Best effort: ask Anthropic who owns this token. Undefined on any failure. */
+async function fetchProfile(cred: OAuthCred): Promise<Identity | undefined> {
+	if (!cred.access || cred.expires <= Date.now() + 30_000) return undefined;
+	try {
+		const res = await fetch(PROFILE_URL, {
+			headers: {
+				Authorization: `Bearer ${cred.access}`,
+				"anthropic-beta": "oauth-2025-04-20",
+				"Content-Type": "application/json",
+			},
+			signal: AbortSignal.timeout(5_000),
+		});
+		if (!res.ok) return undefined;
+		const body = (await res.json()) as { account?: { uuid?: string; email_address?: string; email?: string } };
+		const accountId = body.account?.uuid;
+		const email = body.account?.email_address ?? body.account?.email;
+		return accountId || email ? { accountId, email } : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function findByToken(store: Store, cred: OAuthCred): string | undefined {
+	return Object.keys(store.accounts).find((n) => store.accounts[n].cred.refresh === cred.refresh);
+}
+
+function findByIdentity(store: Store, id?: Identity): string | undefined {
+	if (!id) return undefined;
+	return Object.keys(store.accounts).find((n) => {
+		const s = store.accounts[n];
+		return id.accountId ? s.accountId === id.accountId : !!id.email && s.email === id.email;
+	});
+}
+
+// ---------- sync ----------
+
+type SyncResult =
+	| { kind: "none" } // no anthropic OAuth login in auth.json
+	| { kind: "matched"; name: string; cred: OAuthCred } // auth.json belongs to a stored slot
+	| {
+			kind: "unknown"; // no slot owns this login
+			cred: OAuthCred;
+			profile?: Identity; // undefined → identity could not be checked
+			probable?: string; // profile unknown: likely the active slot after a token rotation
+	  };
+
+/**
+ * Reconcile auth.json with the store. Copies a rotated token back into its
+ * slot when ownership is certain (same refresh token, or same account id).
+ */
+async function sync(): Promise<SyncResult> {
+	const cred = readCurrentCred();
+	if (!cred) return { kind: "none" };
+	const store = loadStore();
+
+	let name = findByToken(store, cred);
+	let profile: Identity | undefined;
+	if (!name) {
+		profile = await fetchProfile(cred);
+		name = findByIdentity(store, profile);
+	}
+	if (!name) {
+		const probable = !profile && store.active && store.accounts[store.active] ? store.active : undefined;
+		return { kind: "unknown", cred, profile, probable };
+	}
+
+	const slot = store.accounts[name];
+	if (slot.cred.refresh !== cred.refresh || slot.cred.access !== cred.access || store.active !== name) {
+		const owner = name;
+		await mutateStore((s) => {
+			const now = readCurrentCred();
+			if (!s.accounts[owner] || now?.refresh !== cred.refresh) return; // changed meanwhile; next sync handles it
+			s.accounts[owner].cred = cred;
+			if (profile?.accountId) s.accounts[owner].accountId = profile.accountId;
+			if (profile?.email) s.accounts[owner].email = profile.email;
+			s.active = owner;
+		});
+	}
+	return { kind: "matched", name, cred };
+}
+
+function label(name: string, slot: Slot): string {
+	return slot.email ? `${name} <${slot.email}>` : name;
+}
+
+function updateStatus(ctx: ExtensionContext, result: SyncResult): void {
+	if (!ctx.hasUI) return;
+	const text =
+		result.kind === "matched" ? `claude: ${result.name}` : result.kind === "unknown" ? "claude: unsaved login" : undefined;
+	ctx.ui.setStatus(STATUS_KEY, text);
+}
+
+// ---------- Claude adapter ----------
+
+export const ClaudeProvider = {
+	getStatus: overview,
+	getSavedNames: () => Object.keys(loadStore().accounts),
+	useAccount: cmdUse,
+	saveAccount: cmdSave,
+	removeAccount: cmdRemove,
+	login: cmdLogin,
+};
+
+function isValidName(name: string): boolean {
+	return /^[\w.-]+$/.test(name) && !SUBCOMMANDS.includes(name);
+}
+
+const NAME_RULES = `letters, digits, . _ -; not ${SUBCOMMANDS.join("/")}`;
+
+async function cmdSave(name: string, ctx: ExtensionContext): Promise<void> {
+	if (!isValidName(name)) {
+		ctx.ui.notify(`Usage: /account save <name>  (${NAME_RULES})`, "warning");
+		return;
+	}
+	const cred = readCurrentCred();
+	if (!cred) {
+		ctx.ui.notify("No Anthropic OAuth login in auth.json. Run /account login claude <name> to log in and save it.", "warning");
+		return;
+	}
+	const store = loadStore();
+	const owner = findByToken(store, cred);
+	if (owner && owner !== name) {
+		ctx.ui.notify(`This login is already saved as "${owner}".`, "warning");
+		return;
+	}
+	const profile = await fetchProfile(cred);
+	const dup = findByIdentity(store, profile);
+	if (dup && dup !== name) {
+		ctx.ui.notify(`This Claude account is already saved as "${dup}" — updated that slot instead.`, "info");
+		name = dup;
+	} else if (store.accounts[name] && owner !== name) {
+		const ok = await ctx.ui.confirm("Overwrite account?", `"${name}" already exists. Replace it with the current login?`);
+		if (!ok) return;
+	}
+	const target = name;
+	const slot = await mutateStore((s) => {
+		const now = readCurrentCred();
+		if (now?.refresh !== cred.refresh) throw new Error("auth.json changed while saving; run the command again.");
+		s.accounts[target] = { cred: now, accountId: profile?.accountId, email: profile?.email, savedAt: Date.now() };
+		s.active = target;
+		return s.accounts[target];
+	});
+	ctx.ui.notify(`Saved current Anthropic login as "${label(target, slot)}".`, "info");
+	updateStatus(ctx, { kind: "matched", name: target, cred });
+}
+
+async function cmdUse(name: string, ctx: ExtensionContext): Promise<void> {
+	const known = loadStore().accounts[name];
+	if (!known) {
+		ctx.ui.notify(`Unknown account "${name}". Saved: ${Object.keys(loadStore().accounts).join(", ") || "(none)"}`, "error");
+		return;
+	}
+
+	const before = await sync();
+	if (before.kind === "matched" && before.name === name) {
+		ctx.ui.notify(`Already using "${label(name, known)}".`, "info");
+		updateStatus(ctx, before);
+		return;
+	}
+
+	// Who owns the token now in auth.json? It must be saved before we overwrite it.
+	let owner: string | undefined = before.kind === "matched" ? before.name : undefined;
+	if (before.kind === "unknown") {
+		const who = before.profile?.email ? ` (${before.profile.email})` : "";
+		if (before.probable) {
+			const keep = `Keep it as "${before.probable}" (a refreshed token)`;
+			const drop = "Discard it (it is a different, unsaved login)";
+			const choice = await ctx.ui.select(`The current login${who} could not be identified`, [keep, drop]);
+			if (!choice) return;
+			owner = choice === keep ? before.probable : undefined;
+		} else {
+			const ok = await ctx.ui.confirm(
+				"Unsaved login",
+				`The current Anthropic login${who} is not saved. Switching removes it from auth.json. ` +
+					"Continue? (Cancel, then /account save <name> to keep it.)",
+			);
+			if (!ok) return;
+		}
+	}
+
+	const seen = before.kind === "none" ? undefined : before.cred.refresh;
+	const slot = await mutateStore((s) => {
+		const target = s.accounts[name];
+		if (!target) throw new Error(`Account "${name}" was removed meanwhile.`);
+		const auth = readAuth();
+		const now = isOAuth(auth[PROVIDER]) ? auth[PROVIDER] : undefined;
+		if (now?.refresh !== seen && !owner) {
+			throw new Error("auth.json changed during the switch; run the command again.");
+		}
+		// Save the outgoing token (it may have rotated since sync) into its slot.
+		if (now && owner && s.accounts[owner]) s.accounts[owner].cred = now;
+		auth[PROVIDER] = target.cred;
+		writeAtomic(AUTH_PATH, auth);
+		s.active = name;
+		return target;
+	});
+	ctx.ui.notify(`Switched Anthropic account to "${label(name, slot)}".`, "info");
+	updateStatus(ctx, { kind: "matched", name, cred: slot.cred });
+}
+
+/**
+ * Bridges Pi's provider login prompts to extension dialogs. The login URL is
+ * shown, never opened: a second account needs a private browser window.
+ */
+function createInteraction(ctx: ExtensionContext, controller: AbortController): ProviderAuthInteraction {
+	const dismissed = (signal: AbortSignal): never => {
+		// The flow itself withdrew the prompt (e.g. the browser callback won the race).
+		if (signal.aborted) throw new Error("Login prompt dismissed.");
+		controller.abort();
+		throw new Error("Login cancelled.");
+	};
+	return {
+		signal: controller.signal,
+		notify(event: AuthEvent) {
+			if (event.type === "auth_url") {
+				ctx.ui.notify(["Open this URL to log in to Claude:", event.url, "", LOGIN_HINT].join("\n"), "info");
+			} else if (event.type === "device_code") {
+				ctx.ui.notify(`Open ${event.verificationUri} and enter the code ${event.userCode}.`, "info");
+			} else {
+				ctx.ui.notify(event.message, "info");
+			}
+		},
+		async prompt(prompt: AuthPrompt) {
+			const signal = prompt.signal ? AbortSignal.any([prompt.signal, controller.signal]) : controller.signal;
+			if (prompt.type === "select") {
+				const labels = prompt.options.map((option) => option.label);
+				const choice = await ctx.ui.select(prompt.message, labels, { signal });
+				const option = prompt.options.find((_option, index) => labels[index] === choice);
+				return option ? option.id : dismissed(signal);
+			}
+			const value = await ctx.ui.input(prompt.message, prompt.placeholder, { signal });
+			return value ?? dismissed(signal);
+		},
+	};
+}
+
+/** Runs Pi's Anthropic OAuth flow. Undefined when the user cancels. */
+async function runOAuthLogin(oauth: OAuthAuth, ctx: ExtensionContext): Promise<OAuthCred | undefined> {
+	const controller = new AbortController();
+	try {
+		return await oauth.login(createInteraction(ctx, controller));
+	} catch (err) {
+		if (controller.signal.aborted) return undefined;
+		throw err;
+	}
+}
+
+/** Log in to Claude in the browser and save the result as `name`, no built-in /login needed. */
+async function cmdLogin(name: string, ctx: ExtensionContext): Promise<void> {
+	if (!ctx.hasUI) {
+		ctx.ui.notify("/account login claude needs the interactive UI (browser login with prompts).", "error");
+		return;
+	}
+	if (!name) {
+		name = (await ctx.ui.input("Name for this Claude account", "e.g. work"))?.trim() ?? "";
+		if (!name) return;
+	}
+	if (!isValidName(name)) {
+		ctx.ui.notify(`Usage: /account login claude <name>  (${NAME_RULES})`, "warning");
+		return;
+	}
+	const oauth = ctx.modelRegistry.getProvider(PROVIDER)?.auth.oauth;
+	if (!oauth) throw new Error("This Pi build has no Anthropic (Claude Pro/Max) OAuth login.");
+	const existing = loadStore().accounts[name];
+	if (existing) {
+		const ok = await ctx.ui.confirm("Replace account?", `"${label(name, existing)}" already exists. Log in again and replace it?`);
+		if (!ok) return;
+	}
+
+	const cred = await runOAuthLogin(oauth, ctx);
+	if (!cred) {
+		ctx.ui.notify("Login cancelled. Nothing changed.", "info");
+		return;
+	}
+	const profile = await fetchProfile(cred);
+	const dup = findByIdentity(loadStore(), profile);
+	if (dup && dup !== name) {
+		const who = profile?.email ? ` (${profile.email})` : "";
+		ctx.ui.notify(
+			`This is the same Claude account as "${dup}"${who}: the browser reused its claude.ai session. Nothing was saved. ` +
+				`Run /account login claude ${name} again and open the URL in a private window, or sign out of claude.ai first.`,
+			"warning",
+		);
+		return;
+	}
+
+	// Activate at once when nothing in auth.json would be lost: no login, or this same account.
+	const before = await sync();
+	const replacesCurrent =
+		before.kind === "none" ||
+		(before.kind === "matched" && before.name === name) ||
+		(before.kind === "unknown" && !!profile?.accountId && before.profile?.accountId === profile.accountId);
+	const seen = before.kind === "none" ? undefined : before.cred.refresh;
+	const slot: Slot = { cred, accountId: profile?.accountId, email: profile?.email, savedAt: Date.now() };
+	const activated = await mutateStore((s) => {
+		s.accounts[name] = slot;
+		if (!replacesCurrent || readCurrentCred()?.refresh !== seen) return false;
+		const auth = readAuth();
+		auth[PROVIDER] = cred;
+		writeAtomic(AUTH_PATH, auth);
+		s.active = name;
+		return true;
+	});
+	if (activated) {
+		ctx.ui.notify(`Logged in and switched Claude to "${label(name, slot)}".`, "info");
+		updateStatus(ctx, { kind: "matched", name, cred });
+		return;
+	}
+	ctx.ui.notify(`Logged in and saved Claude account "${label(name, slot)}".`, "info");
+	const ok = await ctx.ui.confirm("Switch account?", `Switch Claude to "${name}" now? This affects every running Pi session.`);
+	if (ok) await cmdUse(name, ctx);
+	else ctx.ui.notify(`Run /account ${name} to switch later.`, "info");
+}
+
+async function cmdRemove(name: string, ctx: ExtensionContext): Promise<void> {
+	if (!loadStore().accounts[name]) {
+		ctx.ui.notify(`Unknown account "${name}".`, "error");
+		return;
+	}
+	const ok = await ctx.ui.confirm("Remove account?", `Forget saved login "${name}"? (auth.json is not changed.)`);
+	if (!ok) return;
+	await mutateStore((s) => {
+		delete s.accounts[name];
+		if (s.active === name) s.active = undefined;
+	});
+	ctx.ui.notify(`Removed "${name}".`, "info");
+	updateStatus(ctx, await sync());
+}
+
+async function overview(ctx: ExtensionContext): Promise<ClaudeStatus> {
+	const result = await sync();
+	updateStatus(ctx, result);
+	const store = loadStore();
+	const active = result.kind === "matched" ? result.name : undefined;
+	const entries: ClaudeEntry[] = Object.keys(store.accounts).map((name) => ({
+		provider: "claude",
+		id: name,
+		name,
+		email: store.accounts[name].email,
+		isActive: name === active,
+	}));
+	const unsavedLogin = result.kind === "unknown" ? { email: result.profile?.email } : undefined;
+	return { entries, unsavedLogin };
+}
+
+export function registerClaude(pi: ExtensionAPI): void {
+	const quietSync = async (ctx: ExtensionContext, announce: boolean) => {
+		try {
+			const result = await sync();
+			updateStatus(ctx, result);
+			if (announce && result.kind === "unknown" && !result.probable && ctx.hasUI) {
+				const who = result.profile?.email ? ` (${result.profile.email})` : "";
+				ctx.ui.notify(`Unsaved Anthropic login${who}. Run /account save <name> to keep it.`, "info");
+			}
+		} catch {
+			/* never break the session over account bookkeeping */
+		}
+	};
+
+	pi.on("session_start", (_e, ctx) => quietSync(ctx, true));
+	pi.on("agent_end", (_e, ctx) => quietSync(ctx, false));
+}

package/src/codex.ts

@@ -0,0 +1,319 @@
+/**
+ * pi-multi-accounts, Codex part — use extra ChatGPT (Codex) logins in parallel
+ * with the built-in `openai-codex` provider.
+ *
+ * Every ~/.codex-<name>/auth.json (Codex CLI format) becomes a separate Pi
+ * provider `openai-codex-<name>` with the same models as `openai-codex`, e.g.
+ * ~/.codex-huy → `openai-codex-huy/gpt-5.5`. Streaming reuses Pi's built-in
+ * `openai-codex-responses` implementation; the chatgpt-account-id header is
+ * derived from the access token, so each provider talks as its own account.
+ *
+ * Setup: `CODEX_HOME=~/.codex-<name> codex login`, then `/account login codex
+ * <name>` imports the tokens from the file (no browser) and registers the
+ * provider when the home is new. Then pick it with /account or /model.
+ *
+ * The Codex auth file stays the source of truth: on refresh the extension
+ * first adopts newer tokens from the file (e.g. refreshed by
+ * `CODEX_HOME=~/.codex-<name> codex`), otherwise it refreshes with the file's
+ * refresh token and writes the rotated tokens back, so Pi and the Codex CLI
+ * keep sharing one valid login.
+ */
+import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
+import type { ExtensionAPI, ProviderModelConfig, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mutateAuth, readAuth } from "./claude.ts";
+import type { CodexEntry } from "./accounts.ts";
+
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const BASE_URL = "https://chatgpt.com/backend-api";
+const JWT_AUTH_CLAIM = "https://api.openai.com/auth";
+const EXPIRY_SKEW_MS = 5 * 60_000;
+const HOME_DIR_PATTERN = /^\.codex-([a-z0-9][a-z0-9_-]*)$/i;
+
+interface CodexAuthFile {
+	auth_mode?: string;
+	tokens?: {
+		id_token?: string;
+		access_token?: string;
+		refresh_token?: string;
+		account_id?: string;
+	};
+	last_refresh?: string;
+	[key: string]: unknown;
+}
+
+export interface CodexCred {
+	access: string;
+	refresh: string;
+	expires: number;
+	accountId: string;
+	[key: string]: unknown;
+}
+
+export interface CodexHome {
+	name: string;
+	dir: string;
+	authPath: string;
+}
+
+function jwtClaims(token: string): Record<string, unknown> {
+	const payload = token.split(".")[1];
+	if (!payload) throw new Error("access token is not a JWT");
+	try {
+		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+	} catch {
+		throw new Error("Failed to parse JWT payload");
+	}
+}
+
+function readAuthFile(path: string): CodexAuthFile {
+	// Tolerate non-breaking-space indentation left by copy/paste.
+	try {
+		return JSON.parse(readFileSync(path, "utf8").replace(/\u00a0/g, " "));
+	} catch {
+		// Never surface the parser message: it can quote token characters.
+		throw new Error(`${path} is missing or not valid JSON`);
+	}
+}
+
+export function credFromTokens(access: string, refresh: string): CodexCred {
+	const claims = jwtClaims(access) as Record<string, unknown>;
+	const authClaim = claims[JWT_AUTH_CLAIM];
+	const accountId = typeof authClaim === "object" && authClaim !== null
+		? (authClaim as Record<string, unknown>).chatgpt_account_id
+		: undefined;
+	if (typeof accountId !== "string" || !accountId) throw new Error("access token has no chatgpt_account_id");
+	if (typeof claims.exp !== "number") throw new Error("access token has no exp claim");
+	return { access, refresh, expires: claims.exp * 1000, accountId };
+}
+
+export function credFromFile(path: string): CodexCred {
+	const tokens = readAuthFile(path).tokens;
+	if (!tokens?.access_token || !tokens.refresh_token) {
+		throw new Error(`${path} has no ChatGPT tokens; run \`CODEX_HOME=${join(path, "..")} codex login\` first`);
+	}
+	return credFromTokens(tokens.access_token, tokens.refresh_token);
+}
+
+export function writeBack(path: string, fresh: { access: string; refresh: string; idToken?: string; accountId: string }): void {
+	const file = readAuthFile(path);
+	file.tokens = {
+		...file.tokens,
+		access_token: fresh.access,
+		refresh_token: fresh.refresh,
+		...(fresh.idToken ? { id_token: fresh.idToken } : {}),
+		account_id: fresh.accountId,
+	};
+	file.last_refresh = new Date().toISOString();
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+	renameSync(tmp, path);
+}
+
+export function isFresh(cred: CodexCred, now = Date.now()): boolean {
+	return cred.expires - now > EXPIRY_SKEW_MS;
+}
+
+/** True when the auth file holds newer, still-valid tokens than `currentAccess`. */
+export function shouldAdopt(fromFile: CodexCred, currentAccess: string, now = Date.now()): boolean {
+	return fromFile.access !== currentAccess && isFresh(fromFile, now);
+}
+
+export async function refreshCred(home: CodexHome, refreshToken: string, signal: AbortSignal): Promise<CodexCred> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: CLIENT_ID }),
+		signal,
+	});
+	if (!response.ok) {
+		// The Codex CLI may have rotated the single-use refresh token meanwhile.
+		const latest = credFromFile(home.authPath);
+		if (latest.refresh !== refreshToken && isFresh(latest)) return latest;
+		const body = (await response.json().catch(() => ({}))) as { error?: unknown };
+		const code = typeof body.error === "string" ? ` (${body.error})` : "";
+		throw new Error(
+			`OpenAI Codex (${home.name}) token refresh failed: HTTP ${response.status}${code}. ` +
+				`Run \`CODEX_HOME=${home.dir} codex login\`, then /account login codex ${home.name}.`,
+		);
+	}
+	const json = (await response.json()) as { access_token?: string; refresh_token?: string; id_token?: string };
+	if (!json.access_token) throw new Error(`OpenAI Codex (${home.name}) token refresh returned no access token`);
+	const cred = credFromTokens(json.access_token, json.refresh_token ?? refreshToken);
+	try {
+		writeBack(home.authPath, { ...cred, idToken: json.id_token });
+	} catch (error) {
+		// Pi still persists the rotated token; only the Codex CLI copy is stale.
+		console.warn(`pi-multi-accounts: could not update ${home.authPath}: ${(error as Error).message}`);
+	}
+	return cred;
+}
+
+export function discoverHomes(root = homedir()): CodexHome[] {
+	return readdirSync(root, { withFileTypes: true })
+		.filter((entry) => entry.isDirectory() && HOME_DIR_PATTERN.test(entry.name))
+		.map((entry) => ({
+			name: (HOME_DIR_PATTERN.exec(entry.name)?.[1] ?? entry.name).toLowerCase(),
+			dir: join(root, entry.name),
+			authPath: join(root, entry.name, "auth.json"),
+		}))
+		.filter((home) => existsSync(home.authPath));
+}
+
+function codexModels(): ProviderModelConfig[] {
+	return getBuiltinModels("openai-codex").map(({ provider: _provider, ...model }) => ({ ...model }) as ProviderModelConfig);
+}
+
+function registerHome(pi: ExtensionAPI, home: CodexHome, models: ProviderModelConfig[]): void {
+	pi.registerProvider(`openai-codex-${home.name}`, {
+		name: `OpenAI Codex (${home.name})`,
+		baseUrl: BASE_URL,
+		api: "openai-codex-responses",
+		models,
+		oauth: {
+			name: `OpenAI Codex (${home.name})`,
+			isSubscription: true,
+			async login(callbacks) {
+				const cred = credFromFile(home.authPath);
+				callbacks.onProgress?.(`Imported ChatGPT login from ${home.authPath}`);
+				return cred;
+			},
+			async refreshToken(credentials, signal) {
+				// Adopt tokens the Codex CLI refreshed meanwhile; otherwise refresh ourselves.
+				const fromFile = credFromFile(home.authPath);
+				if (shouldAdopt(fromFile, credentials.access)) return fromFile;
+				return refreshCred(home, fromFile.refresh, signal);
+			},
+			getApiKey: (credentials) => credentials.access,
+		},
+	});
+}
+
+export function registerCodex(pi: ExtensionAPI, homes = discoverHomes()): CodexHome[] {
+	const models = codexModels();
+	for (const home of homes) registerHome(pi, home, models);
+	return homes;
+}
+
+/** One adapter per registration snapshot; /account login codex registers homes created later. */
+export function createCodexProvider(pi: ExtensionAPI, homes: readonly CodexHome[]) {
+	const registeredHomes = [...homes];
+	const getProviderId = (home: CodexHome) => `openai-codex-${home.name}`;
+	const getIds = () => registeredHomes.map(getProviderId);
+
+	function getEntries(ctx: ExtensionContext): CodexEntry[] {
+		const auth = readAuth();
+		return registeredHomes.map((home) => {
+			const id = getProviderId(home);
+			const credential = auth[id] as { type?: unknown } | undefined;
+			return {
+				provider: "codex",
+				id,
+				name: home.name,
+				authPath: home.authPath,
+				isLoggedIn: credential?.type === "oauth",
+				isActive: ctx.model?.provider === id,
+			};
+		});
+	}
+
+	function notifyLogin(id: string, ctx: ExtensionContext): void {
+		const home = registeredHomes.find((home) => getProviderId(home) === id);
+		ctx.ui.notify(`No configured auth for ${id}. Run /account login codex ${home?.name} first.`, "error");
+	}
+
+	async function chooseModel(id: string, ctx: ExtensionContext) {
+		const models = ctx.modelRegistry.getAll().filter((model) => model.provider === id);
+		if (!models.length) {
+			ctx.ui.notify(`No registered models for ${id}. Run /reload.`, "error");
+			return;
+		}
+		const available = models.filter((model) => ctx.modelRegistry.hasConfiguredAuth(model));
+		if (!available.length) return notifyLogin(id, ctx);
+		if (!ctx.hasUI) {
+			ctx.ui.notify(`Choose a model for ${id} explicitly with /model.`, "warning");
+			return;
+		}
+		const labels = available.map((model) => `${model.name} (${model.id})`);
+		const choice = await ctx.ui.select(`Choose a model for ${id}`, labels);
+		return available.find((_model, index) => labels[index] === choice);
+	}
+
+	async function useAccount(id: string, ctx: ExtensionContext): Promise<void> {
+		if (!getIds().includes(id)) {
+			ctx.ui.notify(`Unknown Codex provider "${id}". Run /account login codex <name> to add a home.`, "error");
+			return;
+		}
+		const sameModel = ctx.model ? ctx.modelRegistry.find(id, ctx.model.id) : undefined;
+		const model = sameModel ?? await chooseModel(id, ctx);
+		if (!model) return;
+		if (!ctx.modelRegistry.hasConfiguredAuth(model)) return notifyLogin(id, ctx);
+		const hasChanged = await pi.setModel(model);
+		if (!hasChanged) return notifyLogin(id, ctx);
+		ctx.ui.notify(`Switched this session to ${id}/${model.id}.`, "info");
+	}
+
+	/** Existing ~/.codex-<name> by name, else the path `codex login` should create. */
+	function findHome(name: string): CodexHome {
+		const known = [...registeredHomes, ...discoverHomes()].find((home) => home.name === name);
+		const dir = join(homedir(), `.codex-${name}`);
+		return known ?? { name, dir, authPath: join(dir, "auth.json") };
+	}
+
+	/** Undefined when cancelled. */
+	async function pickName(ctx: ExtensionContext): Promise<string | undefined> {
+		const names = [...new Set([...registeredHomes, ...discoverHomes()].map((home) => home.name))];
+		const other = "Another ChatGPT account (new ~/.codex-<name>)";
+		const choice = names.length ? await ctx.ui.select("Log in which Codex home?", [...names, other]) : other;
+		if (choice !== other) return choice;
+		return (await ctx.ui.input("Name for the Codex home (~/.codex-<name>)", "e.g. work"))?.trim() || undefined;
+	}
+
+	/** Import ~/.codex-<name>/auth.json into Pi, i.e. the built-in /login → "OpenAI Codex (<name>)". */
+	async function login(rawName: string, ctx: ExtensionContext): Promise<void> {
+		let name = rawName.toLowerCase();
+		if (!name && ctx.hasUI) {
+			name = (await pickName(ctx))?.toLowerCase() ?? "";
+			if (!name) return;
+		}
+		if (!HOME_DIR_PATTERN.test(`.codex-${name}`)) {
+			ctx.ui.notify("Usage: /account login codex <name>  (letters, digits, _ -; starts with a letter or digit)", "warning");
+			return;
+		}
+		const home = findHome(name);
+		if (!existsSync(home.authPath)) {
+			ctx.ui.notify(
+				[
+					`No ChatGPT login in ${home.authPath} yet. In a terminal, run:`,
+					`  CODEX_HOME=${home.dir} codex login`,
+					"Adding another ChatGPT account? Finish that login in a private/incognito window (or sign out of chatgpt.com first); " +
+						"otherwise the browser logs in the account that is already signed in.",
+					`Then run /account login codex ${name} again.`,
+				].join("\n"),
+				"warning",
+			);
+			return;
+		}
+		const cred = credFromFile(home.authPath);
+		const id = getProviderId(home);
+		if (!getIds().includes(id)) {
+			registerHome(pi, home, codexModels());
+			registeredHomes.push(home);
+		}
+		await mutateAuth((auth) => {
+			auth[id] = { type: "oauth", ...cred };
+		});
+		await ctx.modelRegistry.refresh({ providers: [id], allowNetwork: false });
+		ctx.ui.notify(`Logged in ${id} with the ChatGPT login from ${home.authPath}.`, "info");
+		if (!ctx.hasUI) {
+			ctx.ui.notify(`Run /account ${id} to use it in this session.`, "info");
+			return;
+		}
+		if (await ctx.ui.confirm("Use it now?", `Switch this session to ${id}?`)) await useAccount(id, ctx);
+	}
+
+	return { getIds, getEntries, useAccount, login };
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+/** pi-multi-accounts — several Claude logins (/account) + extra Codex logins as parallel providers. */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { registerClaude } from "./claude.ts";
+import { registerCodex } from "./codex.ts";
+import { registerAccounts } from "./accounts.ts";
+
+export default function (pi: ExtensionAPI) {
+	const codexHomes = registerCodex(pi);
+	registerClaude(pi);
+	registerAccounts(pi, codexHomes);
+}