synabun 2.0.5 → 2.0.9

package/neural-interface/public/shared/assistant/asst-accounts.js

@@ -1,21 +1,27 @@
 // ═══════════════════════════════════════════
 // SynaBun Assistant — account profiles (Claude + Codex)
 // ═══════════════════════════════════════════
-// Claude: POST /api/assistant/claude/accounts → POST …/:id/login opens a
-// claude-code terminal tab under CLAUDE_CONFIG_DIR (emit terminal:attach-floating)
-// → wait for sync:assistant:accounts-changed. Codex: POST …/codex/accounts/add-start
-// → show the device-auth URL/code → poll fetchCodexAccounts(true).
+// One manager for both providers, from the same server state as the side
+// panels' header account menus (lib/claude-accounts.js, lib/codex-accounts.js
+// describe()): every account with what it runs on and who it is, its "Uses"
+// switch when it holds both credentials, each credential's sign-in or sign-out,
+// an API key pasted into it, the worker choice, rename and remove. Adding an
+// account makes it at once; its row then offers the two ways to sign it in:
+// the provider's own login in a SynaBun terminal (`claude auth login` /
+// `codex login` under the account's folder), or an API key.
 
-import { emit, on } from '../state.js';
-import { fetchClaudeAccounts, fetchCodexAccounts, getCachedClaudeAccounts, getCachedCodexAccounts } from '../agent-runtime-options.js';
+import { on } from '../state.js';
+import {
+  fetchClaudeAccounts, fetchCodexAccounts, getCachedClaudeAccounts, getCachedCodexAccounts, getClaudeWorkerAccountId, getCodexWorkerAccountId,
+} from '../agent-runtime-options.js';
 import { getProviderMeta } from '../provider-icons.js';
 import {
-  createClaudeAccount, deleteClaudeAccount, loginClaudeAccount, patchClaudeAccount,
-  deleteCodexAccount, patchCodexAccount, startCodexAccountAdd,
+  createClaudeAccount, deleteClaudeAccount, loginClaudeAccount, patchClaudeAccount, setClaudeWorkerAccount, signOutClaudeAccount,
+  createCodexAccount, deleteCodexAccount, loginCodexAccount, patchCodexAccount, setCodexWorkerAccount, signOutCodexAccount,
 } from './asst-api.js';
+import { accountBadge, accountIdentity, accountName, accountText, accountUsable, apiKeyErrorText, credentialRows, modeChoices } from '../account-view.js';
+import { providerApiKeyRequest } from '../ui-provider-terminal-auth.js';
 
-const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
-const CODEX_POLL_MS = 3000;
 const ICON_X = '<svg viewBox="0 0 24 24"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>';
 
 function el(tag, className, text) {
@@ -36,84 +42,44 @@ function tf(t) {
   };
 }
 
-function listFor(provider) {
-  return provider === 'codex' ? getCachedCodexAccounts() : getCachedClaudeAccounts();
-}
-
-async function refreshFor(provider) {
-  return provider === 'codex' ? fetchCodexAccounts(true) : fetchClaudeAccounts(true);
-}
-
-/** Resolve once `sync:assistant:accounts-changed` fires for the provider (or times out). */
-function waitForAccountsChanged(provider, timeoutMs = LOGIN_TIMEOUT_MS) {
-  return new Promise((resolve) => {
-    let done = false;
-    const off = on('sync:assistant:accounts-changed', (msg) => {
-      if (done) return;
-      if (msg?.provider && msg.provider !== provider) return;
-      done = true;
-      off();
-      clearTimeout(timer);
-      resolve(true);
-    });
-    const timer = setTimeout(() => { if (!done) { done = true; off(); resolve(false); } }, timeoutMs);
-  });
-}
+// What each provider's account calls on the server (assistant API + the panels' owner-guarded routes).
+const PROVIDER_API = {
+  'claude-code': {
+    view: 'claude', list: getCachedClaudeAccounts, refresh: () => fetchClaudeAccounts(true), worker: getClaudeWorkerAccountId,
+    create: createClaudeAccount, login: loginClaudeAccount, patch: patchClaudeAccount, remove: deleteClaudeAccount,
+    setWorker: setClaudeWorkerAccount, signOut: signOutClaudeAccount, keyProvider: 'claude', changed: 'sync:claude:accounts-changed',
+  },
+  codex: {
+    view: 'codex', list: getCachedCodexAccounts, refresh: () => fetchCodexAccounts(true), worker: getCodexWorkerAccountId,
+    create: createCodexAccount, login: loginCodexAccount, patch: patchCodexAccount, remove: deleteCodexAccount,
+    setWorker: setCodexWorkerAccount, signOut: signOutCodexAccount, keyProvider: 'codex', changed: 'sync:codex:accounts-changed',
+  },
+};
+const apiFor = (provider) => PROVIDER_API[provider === 'codex' ? 'codex' : 'claude-code'];
 
 /**
- * Add-account flow. Returns { ok, account, cancelled }.
- * ui: { t, setStatus(text), showLogin({ authUrl, userCode }), isCancelled() }
+ * Add-account flow: the account is made at once; how it signs in (the provider's own login, or an API key)
+ * is chosen on its row next. Returns { ok, choose: true, account }.
  */
 export async function startAddAccount(provider, label, ui = {}) {
   const t = tf(ui.t);
-  const name = String(label || '').trim() || (provider === 'codex' ? 'Codex account' : 'Claude account');
-  if (provider === 'claude-code') {
-    const created = await createClaudeAccount(name);
-    const account = created?.account || created;
-    if (!account?.id) throw new Error(t('assistant.accounts.createFailed', 'Account could not be created'));
-    ui.setStatus?.(t('assistant.accounts.openingLogin', 'Opening a Claude Code terminal for login…'));
-    const login = await loginClaudeAccount(account.id);
-    if (login?.terminalSessionId) {
-      emit('terminal:expect-managed');
-      emit('terminal:attach-floating', { terminalSessionId: login.terminalSessionId, profile: login.profile || 'claude-code', snapToPanel: true });
-    }
-    ui.setStatus?.(t('assistant.accounts.waitingLogin', 'Finish the login in the terminal window. Waiting…'));
-    const changed = await waitForAccountsChanged('claude-code');
-    const accounts = await refreshFor('claude-code');
-    const fresh = accounts.find(a => a.id === account.id) || account;
-    return { ok: changed || !!fresh?.email, account: fresh, timedOut: !changed };
-  }
-  if (provider === 'codex') {
-    const started = await startCodexAccountAdd(name);
-    const accountId = started?.accountId || started?.account?.id;
-    const login = started?.login || {};
-    ui.showLogin?.({ authUrl: login.authUrl || login.url || '', userCode: login.userCode || login.code || '' });
-    ui.setStatus?.(t('assistant.accounts.waitingDevice', 'Complete the sign-in in your browser. Waiting…'));
-    const deadline = Date.now() + LOGIN_TIMEOUT_MS;
-    let changedEarly = false;
-    const offChanged = on('sync:assistant:accounts-changed', (msg) => { if (!msg?.provider || msg.provider === 'codex') changedEarly = true; });
-    try {
-      while (Date.now() < deadline) {
-        if (ui.isCancelled?.()) return { ok: false, cancelled: true };
-        const accounts = await fetchCodexAccounts(true).catch(() => []);
-        const found = accounts.find(a => a.id === accountId);
-        if (found && (found.email || found.loggedIn === true || found.status === 'ready' || changedEarly)) return { ok: true, account: found };
-        await new Promise(r => setTimeout(r, CODEX_POLL_MS));
-      }
-    } finally {
-      offChanged();
-    }
-    return { ok: false, timedOut: true, account: { id: accountId, label: name } };
-  }
-  throw new Error(`Unsupported provider: ${provider}`);
+  const api = apiFor(provider);
+  const name = String(label || '').trim();
+  const created = await api.create(name || undefined);
+  const account = created?.account || created;
+  if (!account?.id) throw new Error(t('assistant.accounts.createFailed', 'Account could not be created'));
+  const accounts = await api.refresh();
+  return { ok: true, choose: true, account: accounts.find((a) => a.id === account.id) || account };
 }
 
 /**
  * Accounts manager modal. hooks: { t, onChanged(provider), onSelect(accountId) }
- * Returns { el, close }.
+ * Returns { el, close, renderList, openAdd }.
  */
 export function openAccountsManager({ provider = 'claude-code', t: tRaw, onChanged, onSelect } = {}) {
   const t = tf(tRaw);
+  const api = apiFor(provider);
+  const p = api.view;
   const meta = getProviderMeta(provider);
   const overlay = el('div', 'asst-modal-overlay');
   overlay.setAttribute('role', 'dialog');
@@ -124,8 +90,8 @@ export function openAccountsManager({ provider = 'claude-code', t: tRaw, onChang
     <div class="asst-modal-head"><span class="asst-icon" style="color:${esc(meta.color)}">${meta.icon}</span><span>${esc(t('assistant.accounts.title', '{provider} accounts', { provider: meta.label }))}</span><button type="button" class="asst-iconbtn asst-modal-close" aria-label="${esc(t('common.close', 'Close'))}">${ICON_X}</button></div>
     <div class="asst-modal-body">
       <div class="asst-modal-note">${esc(provider === 'codex'
-        ? t('assistant.accounts.noteCodex', 'Each account maps to its own CODEX_HOME. Removing an account that a run is using is refused.')
-        : t('assistant.accounts.noteClaude', 'Each account gets its own CLAUDE_CONFIG_DIR (settings, credentials, sessions). "Default" is your ambient ~/.claude.'))}</div>
+        ? t('assistant.accounts.noteCodex2', 'Each account has its own CODEX_HOME (sign-in, sessions) and runs on its ChatGPT subscription or its API key. "Default" is your ambient ~/.codex.')
+        : t('assistant.accounts.noteClaude2', 'Each account has its own CLAUDE_CONFIG_DIR (settings, sign-in, sessions) and runs on its Claude subscription or its API key. "Default" is your ambient ~/.claude.'))}</div>
       <div class="asst-account-list"></div>
       <div class="asst-account-add"></div>
     </div>
@@ -140,12 +106,12 @@ export function openAccountsManager({ provider = 'claude-code', t: tRaw, onChang
 
   const list = modal.querySelector('.asst-account-list');
   const addBox = modal.querySelector('.asst-account-add');
-  let cancelled = false;
   let busy = false;
+  let offChanged = null;
 
   function close() {
-    cancelled = true;
     document.removeEventListener('keydown', onKey, true);
+    offChanged?.();
     overlay.remove();
   }
   function onKey(e) {
@@ -157,94 +123,138 @@ export function openAccountsManager({ provider = 'claude-code', t: tRaw, onChang
   modal.querySelector('.asst-modal-close').addEventListener('click', close);
   modal.querySelector('.asst-account-done').addEventListener('click', close);
 
+  // Which account is fresh (just added: its row offers the two ways to sign in), which row has its API-key
+  // form open, and the last thing a row said.
+  const ui = { fresh: '', keyOpen: '', notice: null };
+  async function openSignIn(acc) {
+    const res = await api.login(acc.id);
+    const sessionId = res?.login?.terminalSessionId || res?.terminalSessionId;
+    if (sessionId) {
+      const { openProviderLoginTerminal } = await import('../ui-terminal.js');
+      await openProviderLoginTerminal(sessionId, `${p === 'codex' ? 'Codex' : 'Claude'} sign-in · ${accountName(acc, p)}`);
+    }
+  }
+  function notice(id, text) { ui.notice = text ? { id, text } : null; renderList(); }
+  async function act(acc, work, done = '') {
+    try {
+      await work();
+      ui.notice = done ? { id: acc.id, text: done } : null;
+      await api.refresh();
+      onChanged?.(provider);
+    } catch (err) { ui.notice = { id: acc.id, text: err?.message || String(err) }; }
+    if (overlay.isConnected) renderList();
+  }
+  function button(row, text, onClick, kind = 'secondary') {
+    const b = el('button', `asst-btn asst-btn-${kind}`, text);
+    b.type = 'button';
+    b.addEventListener('click', async () => { b.disabled = true; try { await onClick(); } finally { b.disabled = false; } });
+    row.appendChild(b);
+    return b;
+  }
+  function renderActions(acc, actionsRow, row) {
+    const worker = api.worker() === acc.id;
+    const label = accountName(acc, p);
+    if (onSelect) {
+      const use = button(actionsRow, t('assistant.accounts.useBrain', 'Use for the brain'), async () => { onSelect(acc.id); close(); });
+      use.disabled = !accountUsable(acc);
+    }
+    if (!worker) {
+      const workersSet = provider === 'codex'
+        ? t('assistant.accounts.codexWorkersSet', 'Codex workers now use {label} when a dispatch names no account.', { label })
+        : t('assistant.accounts.workersSet', 'Claude Code workers now use {label} when a dispatch names no account.', { label });
+      const w = button(actionsRow, t('assistant.accounts.useWorkers', 'Use for workers'), () => act(acc, () => api.setWorker(acc.id), workersSet));
+      w.disabled = !accountUsable(acc);
+    }
+    for (const m of modeChoices(acc, p)) {
+      if (m.current) continue;
+      button(actionsRow, `${accountText('uses', {}, p)}: ${m.label}`, () => act(acc, () => api.patch(acc.id, { mode: m.mode }),
+        accountText(m.mode === 'apiKey' ? 'modeSetApiKey' : 'modeSetSubscription', { label }, p)));
+    }
+    for (const c of credentialRows(acc, p)) {
+      if (c.action === 'signIn') button(actionsRow, c.actionText, () => act(acc, () => openSignIn(acc), accountText('signInPending', {}, p)), ui.fresh === acc.id ? 'primary' : 'secondary');
+      if (c.action === 'addKey') button(actionsRow, c.actionText, async () => { ui.keyOpen = acc.id; ui.notice = null; renderList(); });
+      if (c.action === 'signOut') button(actionsRow, `${c.actionText} · ${c.name}`, async () => {
+        if (!window.confirm(accountText('confirmSignOut', { label }, p))) return;
+        await act(acc, () => api.signOut(acc.id, 'subscription'), accountText('signedOutNote', { label }, p));
+      });
+      if (c.action === 'removeKey') button(actionsRow, c.actionText, async () => {
+        if (!window.confirm(accountText('confirmRemoveKey', { label }, p))) return;
+        await act(acc, () => api.signOut(acc.id, 'apiKey'), accountText('keyRemovedNote', { label }, p));
+      });
+    }
+    if (ui.keyOpen === acc.id) {
+      const form = el('form', 'asst-account-form');
+      const input = document.createElement('input');
+      input.type = 'password'; input.autocomplete = 'off'; input.spellcheck = false; input.required = true;
+      input.className = 'asst-dd-input'; input.placeholder = accountText('keyPlaceholder', {}, p);
+      input.setAttribute('aria-label', accountText('keyLabel', { label }, p));
+      const save = el('button', 'asst-btn asst-btn-primary', accountText('save', {}, p)); save.type = 'submit';
+      const cancel = el('button', 'asst-btn asst-btn-secondary', accountText('cancel', {}, p)); cancel.type = 'button';
+      cancel.addEventListener('click', () => { input.value = ''; ui.keyOpen = ''; renderList(); });
+      input.addEventListener('keydown', (e) => e.stopPropagation());
+      form.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        let key = input.value; input.value = '';
+        if (!key) return;
+        save.disabled = cancel.disabled = input.disabled = true;
+        notice(acc.id, accountText('checkingKey', {}, p));
+        try {
+          await providerApiKeyRequest(api.keyProvider, acc.id, key);
+          ui.keyOpen = ''; ui.fresh = '';
+          ui.notice = { id: acc.id, text: accountText('keySavedNote', { label }, p) };
+          await api.refresh();
+          onChanged?.(provider);
+        } catch (err) { ui.notice = { id: acc.id, text: apiKeyErrorText(p, err?.code) }; }
+        finally { key = null; }
+        if (overlay.isConnected) renderList();
+      });
+      form.append(input, save, cancel);
+      row.appendChild(form);
+      setTimeout(() => input.focus(), 0);
+    }
+    if (ui.notice?.id === acc.id) row.appendChild(el('div', 'asst-account-msg', ui.notice.text));
+  }
+
   function renderList() {
-    const accounts = listFor(provider);
+    const accounts = api.list();
     list.innerHTML = '';
     if (!accounts.length) { list.appendChild(el('div', 'asst-modal-note', t('assistant.accounts.empty', 'No accounts yet.'))); return; }
     for (const acc of accounts) {
-      const row = el('div', 'asst-account-row');
+      const row = el('div', `asst-account-row ${p}`);
       row.dataset.id = acc.id;
       const main = el('div', 'asst-account-main');
-      main.appendChild(el('div', 'asst-account-label', acc.label || acc.id));
-      const sub = [acc.email, acc.isDefault || acc.id === 'default' ? t('assistant.accounts.ambient', 'ambient config') : '', acc.inUse ? t('assistant.accounts.inUse', 'in use') : ''].filter(Boolean).join(' · ');
-      main.appendChild(el('div', 'asst-account-sub', sub || acc.id));
-      row.appendChild(main);
-
-      if (onSelect) {
-        const use = el('button', 'asst-btn asst-btn-secondary', t('assistant.accounts.use', 'Use'));
-        use.type = 'button';
-        use.addEventListener('click', () => { onSelect(acc.id); close(); });
-        row.appendChild(use);
+      const head = el('div', 'asst-account-head');
+      head.appendChild(el('span', 'asst-account-label', accountName(acc, p)));
+      const badge = accountBadge(acc, p);
+      const chip = el('span', 'asst-account-badge', badge.text);
+      chip.dataset.tone = badge.tone;
+      head.appendChild(chip);
+      main.appendChild(head);
+      const worker = api.worker() === acc.id;
+      const sub = [accountIdentity(acc) || (acc.signedIn === false ? accountText('notSignedIn', {}, p) : accountText('checking', {}, p)), worker ? t('assistant.accounts.workerTag', 'workers use it') : ''].filter(Boolean).join(' · ');
+      main.appendChild(el('div', 'asst-account-sub', sub));
+      const creds = el('div', 'asst-account-creds');
+      for (const c of credentialRows(acc, p)) {
+        const line = el('div', 'asst-account-cred');
+        line.appendChild(el('span', 'asst-account-cred-k', c.name));
+        line.appendChild(el('span', '', `${c.text}${c.inUse ? ` · ${accountText('inUse', {}, p)}` : ''}`));
+        creds.appendChild(line);
       }
-      if (provider === 'claude-code' && !acc.email && acc.id !== 'default') {
-        const login = el('button', 'asst-btn asst-btn-secondary', t('assistant.accounts.login', 'Log in'));
-        login.type = 'button';
-        login.addEventListener('click', async () => {
-          login.disabled = true;
-          try {
-            const res = await loginClaudeAccount(acc.id);
-            if (res?.terminalSessionId) {
-              emit('terminal:expect-managed');
-              emit('terminal:attach-floating', { terminalSessionId: res.terminalSessionId, profile: res.profile || 'claude-code', snapToPanel: true });
-            }
-            await waitForAccountsChanged('claude-code');
-            await refreshFor(provider);
-            onChanged?.(provider);
-            renderList();
-          } catch (err) {
-            addBox.textContent = err?.message || String(err);
-          } finally { login.disabled = false; }
-        });
-        row.appendChild(login);
-      }
-      const rename = el('button', 'asst-btn asst-btn-secondary', t('common.rename', 'Rename'));
-      rename.type = 'button';
-      rename.addEventListener('click', () => {
-        const input = document.createElement('input');
-        input.type = 'text';
-        input.className = 'asst-dd-input';
-        input.value = acc.label || '';
-        main.replaceWith(input);
-        input.focus();
-        input.select();
-        const commit = async () => {
-          const value = input.value.trim();
-          if (value && value !== acc.label) {
-            try {
-              if (provider === 'codex') await patchCodexAccount(acc.id, { label: value });
-              else await patchClaudeAccount(acc.id, { label: value });
-              await refreshFor(provider);
-              onChanged?.(provider);
-            } catch (err) { addBox.textContent = err?.message || String(err); }
-          }
-          renderList();
-        };
-        input.addEventListener('blur', commit, { once: true });
-        input.addEventListener('keydown', (e) => {
-          e.stopPropagation();
-          if (e.key === 'Enter') { e.preventDefault(); input.blur(); }
-          if (e.key === 'Escape') { input.value = acc.label || ''; input.blur(); }
-        });
-      });
-      row.appendChild(rename);
+      main.appendChild(creds);
+      row.appendChild(main);
+      const actions = el('div', 'asst-account-actions');
+      row.appendChild(actions);
+      renderActions(acc, actions, row);
       if (acc.id !== 'default' && !acc.isDefault) {
-        const remove = el('button', 'asst-btn asst-btn-danger', t('common.remove', 'Remove'));
-        remove.type = 'button';
-        remove.addEventListener('click', async () => {
-          if (!window.confirm(t('assistant.accounts.confirmRemove', 'Remove account "{label}"? Its config directory is kept on disk.', { label: acc.label || acc.id }))) return;
-          remove.disabled = true;
-          try {
-            if (provider === 'codex') await deleteCodexAccount(acc.id);
-            else await deleteClaudeAccount(acc.id);
-            await refreshFor(provider);
-            onChanged?.(provider);
-            renderList();
-          } catch (err) {
-            addBox.textContent = err?.status === 409 ? t('assistant.accounts.inUseError', 'That account is in use by a running session.') : (err?.message || String(err));
-            remove.disabled = false;
-          }
+        button(actions, t('common.rename', 'Rename'), async () => {
+          const value = window.prompt(t('assistant.accounts.renamePrompt', 'Name for {label}', { label: accountName(acc, p) }), acc.label || '');
+          if (!value || !value.trim() || value.trim() === acc.label) return;
+          await act(acc, () => api.patch(acc.id, { label: value.trim() }));
         });
-        row.appendChild(remove);
+        button(actions, t('common.remove', 'Remove'), async () => {
+          if (!window.confirm(accountText('confirmRemove', { label: accountName(acc, p) }, p))) return;
+          await act(acc, () => api.remove(acc.id));
+        }, 'danger');
       }
       list.appendChild(row);
     }
@@ -260,46 +270,29 @@ export function openAccountsManager({ provider = 'claude-code', t: tRaw, onChang
     input.placeholder = t('assistant.accounts.labelPlaceholder', 'Label (e.g. Work)');
     input.setAttribute('aria-label', input.placeholder);
     const actions = el('div', 'asst-control-actions');
-    const go = el('button', 'asst-btn asst-btn-primary', provider === 'codex' ? t('assistant.accounts.startDevice', 'Start sign-in') : t('assistant.accounts.createAndLogin', 'Create & log in'));
+    const go = el('button', 'asst-btn asst-btn-primary', t('assistant.accounts.create', 'Add account'));
     go.type = 'button';
     const cancel = el('button', 'asst-btn asst-btn-secondary', t('common.cancel', 'Cancel'));
     cancel.type = 'button';
     const status = el('div', 'asst-modal-note');
-    const loginInfo = el('div', 'asst-login-box');
-    loginInfo.hidden = true;
     actions.append(go, cancel);
-    form.append(input, actions, status, loginInfo);
+    form.append(input, actions, status);
     addBox.appendChild(form);
     input.focus();
     input.addEventListener('keydown', (e) => { e.stopPropagation(); if (e.key === 'Enter') go.click(); });
-    cancel.addEventListener('click', () => { cancelled = true; addBox.innerHTML = ''; });
+    cancel.addEventListener('click', () => { addBox.innerHTML = ''; });
     go.addEventListener('click', async () => {
       if (busy) return;
       busy = true;
-      cancelled = false;
       go.disabled = true;
       input.disabled = true;
       try {
-        const result = await startAddAccount(provider, input.value, {
-          t: tRaw,
-          setStatus: (text) => { status.textContent = text; },
-          isCancelled: () => cancelled,
-          showLogin: ({ authUrl, userCode }) => {
-            loginInfo.hidden = false;
-            loginInfo.innerHTML = `${authUrl ? `<a class="asst-btn asst-btn-primary" href="${esc(authUrl)}" target="_blank" rel="noopener">${esc(t('assistant.accounts.openLogin', 'Open sign-in page'))}</a>` : ''}${userCode ? `<div>${esc(t('assistant.accounts.enterCode', 'Enter this code:'))} <span class="asst-login-code">${esc(userCode)}</span></div>` : ''}`;
-          },
-        });
-        await refreshFor(provider);
+        const result = await startAddAccount(provider, input.value, { t: tRaw });
         onChanged?.(provider);
+        ui.fresh = result.account.id;
+        ui.notice = { id: result.account.id, text: accountText('freshPrompt', { label: accountName(result.account, p) }, p) };
+        addBox.innerHTML = '';
         renderList();
-        if (result.ok) {
-          addBox.innerHTML = '';
-          if (onSelect && result.account?.id) onSelect(result.account.id);
-        } else if (result.cancelled) {
-          addBox.innerHTML = '';
-        } else {
-          status.textContent = t('assistant.accounts.loginTimeout', 'Login was not confirmed. The account was created — use "Log in" to retry.');
-        }
       } catch (err) {
         status.textContent = err?.message || String(err);
       } finally {
@@ -312,7 +305,12 @@ export function openAccountsManager({ provider = 'claude-code', t: tRaw, onChang
 
   modal.querySelector('.asst-account-add-btn').addEventListener('click', renderAddForm);
   renderList();
-  refreshFor(provider).then(() => { if (overlay.isConnected) renderList(); }).catch(() => {});
+  api.refresh().then(() => { if (overlay.isConnected) renderList(); }).catch(() => {});
+  // Another window or surface changed an account (signed in, a key, its mode): the list follows.
+  offChanged = on(api.changed, () => {
+    if (!overlay.isConnected) { offChanged?.(); return; }
+    api.refresh().then(() => { if (overlay.isConnected && !ui.keyOpen) renderList(); }).catch(() => {});
+  });
 
   return { el: overlay, close, renderList, openAdd: renderAddForm };
 }

package/neural-interface/public/shared/assistant/asst-api.js

@@ -75,9 +75,9 @@ export function putRouting(patch, version) {
   return jsonFetch('/api/assistant/routing', jsonBody({ version, routing: patch || {} }, 'PUT'));
 }
 
-// ── Budget (money caps) ─────────────────────
+// ── Budget (one saved per-session amount) ─────────────────────
 
-/** → { ok, version, budget, defaults, sources, repairs, bounds, session|null, pricing, enforcement } */
+/** → { ok, version, budget, defaults, bounds, session|null, pricing, enforcement } */
 export function getBudget(sessionId = null) {
   return jsonFetch(`/api/assistant/budget${sessionId ? `?sessionId=${enc(sessionId)}` : ''}`);
 }
@@ -255,8 +255,23 @@ export function loginClaudeAccount(id) {
   return jsonFetch(`/api/assistant/claude/accounts/${enc(id)}/login`, jsonBody({}));
 }
 
+/** The account a Claude Code worker uses when its dispatch names none ('default' or null = Default). */
+export function setClaudeWorkerAccount(accountId) {
+  return jsonFetch('/api/assistant/claude/worker-account', jsonBody({ accountId: accountId || null }, 'PUT'));
+}
+
+/** Remove one of an account's credentials: 'subscription' (Claude Code's own sign-out) or 'apiKey'. */
+export function signOutClaudeAccount(id, credential) {
+  return jsonFetch(`/api/claude/accounts/${enc(id)}/auth/logout`, jsonBody({ credential }));
+}
+
 // ── Codex accounts ───────────────────────────
 
+export function createCodexAccount(label) {
+  return jsonFetch('/api/assistant/codex/accounts', jsonBody({ label }));
+}
+
+/** Older callers: create the account and open its ChatGPT sign-in at once. */
 export function startCodexAccountAdd(label) {
   return jsonFetch('/api/assistant/codex/accounts/add-start', jsonBody({ label }));
 }
@@ -268,3 +283,25 @@ export function patchCodexAccount(id, patch) {
 export function deleteCodexAccount(id) {
   return jsonFetch(`/api/assistant/codex/accounts/${enc(id)}`, { method: 'DELETE' });
 }
+
+/** `codex login` under the account's CODEX_HOME, in a SynaBun terminal. */
+export function loginCodexAccount(id) {
+  return jsonFetch(`/api/assistant/codex/accounts/${enc(id)}/login`, jsonBody({}));
+}
+
+/** The account a Codex worker uses when its dispatch names none ('default' or null = Default). */
+export function setCodexWorkerAccount(accountId) {
+  return jsonFetch('/api/assistant/codex/worker-account', jsonBody({ accountId: accountId || null }, 'PUT'));
+}
+
+// ── Admin sandbox (global, every agent SynaBun starts) ──
+
+/** PUT { adminSandbox } → { ok, adminSandbox, providers }. Agents get 403 UI_ONLY. */
+export function setAdminSandbox(enabled) {
+  return jsonFetch('/api/assistant/admin-sandbox', jsonBody({ adminSandbox: enabled === true }, 'PUT'));
+}
+
+/** Remove one of an account's credentials: 'subscription' (Codex's own sign-out) or 'apiKey'. */
+export function signOutCodexAccount(id, credential) {
+  return jsonFetch(`/api/codex/accounts/${enc(id)}/auth/logout`, jsonBody({ credential }));
+}