very-happy-cli 0.2.191 → 0.2.193

package/dist/{codexAppServerClient-DXhAf6i-.mjs → codexAppServerClient-B3QJV6Ey.mjs}

@@ -1,11 +1,11 @@
 import { execSync } from 'node:child_process';
 import { spawn } from 'cross-spawn';
 import { createInterface } from 'node:readline';
-import { l as logger } from './logger-GcbI0eg2.mjs';
+import { l as logger } from './logger-JV7-4Q_6.mjs';
 import { e as errorLogMetadata, c as contentLogMetadata } from './contentLogMetadata-BlWI0egu.mjs';
 import { i as initializeSandbox, w as wrapForMcpTransport } from './manager-BEsI4qt3.mjs';
-import { p as packageJson } from './package-BsUHyqWe.mjs';
-import { s as shouldReadCodexRateLimits, i as isUnsupportedCodexMethodError } from './rateLimitWindows-j_qQk0KY.mjs';
+import { p as packageJson } from './package-Bw3H6VLn.mjs';
+import { s as shouldReadCodexRateLimits, i as isUnsupportedCodexMethodError } from './rateLimitWindows-CRARnKaI.mjs';
 import { s as stopProcessGracefully, k as killProcessTree } from './processTree-CP5IvQ2Z.mjs';
 
 const CODEX_HELPER_LABEL_MAX_CHARS = 80;
@@ -195,6 +195,15 @@ class CodexAppServerClient {
   rateLimitReadAt = 0;
   rateLimitReadInFlight = false;
   rateLimitReadUnsupported = false;
+  /**
+   * B-850b: the session's account (agentProfiles/codexWrapperAccount.ts) —
+   * env for the app-server (a ChatGPT account's CODEX_HOME overlay) and the
+   * provider every thread runs on. Kept across idle-release respawns.
+   */
+  accountOverrides = { env: {} };
+  setAccountOverrides(overrides) {
+    this.accountOverrides = overrides;
+  }
   constructor(sandboxConfig) {
     this.sandboxConfig = sandboxConfig;
   }
@@ -560,6 +569,7 @@ class CodexAppServerClient {
     if (this.sandboxEnabled) {
       env.CODEX_SANDBOX = "seatbelt";
     }
+    Object.assign(env, this.accountOverrides.env);
     logger.debug(`[CodexAppServer] Spawning: ${command} ${args.join(" ")}`);
     const epoch = ++this.processEpoch;
     const proc = spawn(command, args, {
@@ -730,7 +740,8 @@ ${text}`.slice(-400);
     }
   }
   buildThreadConfig(mcpServers) {
-    return mcpServers ? { mcp_servers: mcpServers } : null;
+    const config = { ...mcpServers ? { mcp_servers: mcpServers } : {}, ...this.accountOverrides.config };
+    return Object.keys(config).length > 0 ? config : null;
   }
   rememberThreadDefaults(opts) {
     this.threadDefaults = {
@@ -746,7 +757,7 @@ ${text}`.slice(-400);
     await this.ensureConnected();
     const params = {
       model: opts.model ?? null,
-      modelProvider: null,
+      modelProvider: this.accountOverrides.modelProvider ?? null,
       profile: null,
       cwd: opts.cwd ?? process.cwd(),
       approvalPolicy: opts.approvalPolicy ?? null,
@@ -777,7 +788,7 @@ ${text}`.slice(-400);
     const params = {
       threadId,
       model: opts?.model ?? defaults.model ?? null,
-      modelProvider: null,
+      modelProvider: this.accountOverrides.modelProvider ?? null,
       cwd: opts?.cwd ?? defaults.cwd ?? process.cwd(),
       approvalPolicy: opts?.approvalPolicy ?? defaults.approvalPolicy ?? null,
       sandbox: opts?.sandbox ?? defaults.sandbox ?? null,
@@ -806,7 +817,7 @@ ${text}`.slice(-400);
     const params = {
       threadId: opts.threadId,
       model: opts.model ?? defaults.model ?? null,
-      modelProvider: null,
+      modelProvider: this.accountOverrides.modelProvider ?? null,
       cwd: opts.cwd ?? defaults.cwd ?? process.cwd(),
       approvalPolicy: opts.approvalPolicy ?? defaults.approvalPolicy ?? null,
       sandbox: opts.sandbox ?? defaults.sandbox ?? null,

package/dist/{codexAppServerClient-DKXeikEe.cjs → codexAppServerClient-DWEsZUC4.cjs}

@@ -3,11 +3,11 @@
 var node_child_process = require('node:child_process');
 var spawn = require('cross-spawn');
 var node_readline = require('node:readline');
-var logger = require('./logger-Ct2zvaq0.cjs');
+var logger = require('./logger-CX3x2eI4.cjs');
 var contentLogMetadata = require('./contentLogMetadata-ZSFk_NjQ.cjs');
 var manager = require('./manager-HrEj442o.cjs');
-var _package = require('./package-9n7wd2dT.cjs');
-var rateLimitWindows = require('./rateLimitWindows-B2Kx6L0S.cjs');
+var _package = require('./package-uzlvxa5S.cjs');
+var rateLimitWindows = require('./rateLimitWindows-BZl6GMwQ.cjs');
 var processTree = require('./processTree-CMHWlVse.cjs');
 
 const CODEX_HELPER_LABEL_MAX_CHARS = 80;
@@ -197,6 +197,15 @@ class CodexAppServerClient {
   rateLimitReadAt = 0;
   rateLimitReadInFlight = false;
   rateLimitReadUnsupported = false;
+  /**
+   * B-850b: the session's account (agentProfiles/codexWrapperAccount.ts) —
+   * env for the app-server (a ChatGPT account's CODEX_HOME overlay) and the
+   * provider every thread runs on. Kept across idle-release respawns.
+   */
+  accountOverrides = { env: {} };
+  setAccountOverrides(overrides) {
+    this.accountOverrides = overrides;
+  }
   constructor(sandboxConfig) {
     this.sandboxConfig = sandboxConfig;
   }
@@ -562,6 +571,7 @@ class CodexAppServerClient {
     if (this.sandboxEnabled) {
       env.CODEX_SANDBOX = "seatbelt";
     }
+    Object.assign(env, this.accountOverrides.env);
     logger.logger.debug(`[CodexAppServer] Spawning: ${command} ${args.join(" ")}`);
     const epoch = ++this.processEpoch;
     const proc = spawn.spawn(command, args, {
@@ -732,7 +742,8 @@ ${text}`.slice(-400);
     }
   }
   buildThreadConfig(mcpServers) {
-    return mcpServers ? { mcp_servers: mcpServers } : null;
+    const config = { ...mcpServers ? { mcp_servers: mcpServers } : {}, ...this.accountOverrides.config };
+    return Object.keys(config).length > 0 ? config : null;
   }
   rememberThreadDefaults(opts) {
     this.threadDefaults = {
@@ -748,7 +759,7 @@ ${text}`.slice(-400);
     await this.ensureConnected();
     const params = {
       model: opts.model ?? null,
-      modelProvider: null,
+      modelProvider: this.accountOverrides.modelProvider ?? null,
       profile: null,
       cwd: opts.cwd ?? process.cwd(),
       approvalPolicy: opts.approvalPolicy ?? null,
@@ -779,7 +790,7 @@ ${text}`.slice(-400);
     const params = {
       threadId,
       model: opts?.model ?? defaults.model ?? null,
-      modelProvider: null,
+      modelProvider: this.accountOverrides.modelProvider ?? null,
       cwd: opts?.cwd ?? defaults.cwd ?? process.cwd(),
       approvalPolicy: opts?.approvalPolicy ?? defaults.approvalPolicy ?? null,
       sandbox: opts?.sandbox ?? defaults.sandbox ?? null,
@@ -808,7 +819,7 @@ ${text}`.slice(-400);
     const params = {
       threadId: opts.threadId,
       model: opts.model ?? defaults.model ?? null,
-      modelProvider: null,
+      modelProvider: this.accountOverrides.modelProvider ?? null,
       cwd: opts.cwd ?? defaults.cwd ?? process.cwd(),
       approvalPolicy: opts.approvalPolicy ?? defaults.approvalPolicy ?? null,
       sandbox: opts.sandbox ?? defaults.sandbox ?? null,

package/dist/{codexCommand-DvbbpYBS.cjs → codexCommand-Bg8AmxVm.cjs}

@@ -1,109 +1,114 @@
 'use strict';
 
-var auth = require('./auth-DnxoVkkf.cjs');
-var index = require('./index-CLUHaPU8.cjs');
-var defaultPermissionMode = require('./defaultPermissionMode-oqTupStc.cjs');
-var deterministicJson = require('./deterministicJson-CpFFgUL_.cjs');
-var client = require('./client-C5-C0t2a.cjs');
+var auth = require('./auth-DCjxpI6Z.cjs');
+var index = require('./index-BUFrKZeQ.cjs');
+var defaultPermissionMode = require('./defaultPermissionMode-BakXiqRr.cjs');
+var deterministicJson = require('./deterministicJson-t33SsuRC.cjs');
+var client = require('./client-CJr8Pjwm.cjs');
 var promises = require('node:fs/promises');
 var forkBackfill = require('./forkBackfill-8eLDeS73.cjs');
 var node_crypto = require('node:crypto');
 var cuid2 = require('@paralleldrive/cuid2');
-var api = require('./api-BBxZ7y2z.cjs');
+var api = require('./api-CBE_a88I.cjs');
 var heldInput = require('./heldInput-BOtqFO2r.cjs');
-var attachmentContent = require('./attachmentContent-BO2njyza.cjs');
+var attachmentContent = require('./attachmentContent-B3AzuYqk.cjs');
 var ink = require('ink');
-var sessionLock = require('./sessionLock-BmLA2S8K.cjs');
+var sessionLock = require('./sessionLock-DdDCuNUs.cjs');
 var React = require('react');
-var codexAppServerClient = require('./codexAppServerClient-DKXeikEe.cjs');
-var rateLimitReporter = require('./rateLimitReporter-CaTzBe3x.cjs');
-var logger = require('./logger-Ct2zvaq0.cjs');
-var BasePermissionHandler = require('./BasePermissionHandler-C9Ag7yvs.cjs');
-var codexTermination = require('./codexTermination-BszWfyk5.cjs');
+var codexAppServerClient = require('./codexAppServerClient-DWEsZUC4.cjs');
+var rateLimitReporter = require('./rateLimitReporter-BZ8x0-6-.cjs');
+var logger = require('./logger-CX3x2eI4.cjs');
+var BasePermissionHandler = require('./BasePermissionHandler-5iG-cvA2.cjs');
+var codexTermination = require('./codexTermination-ByX9GcEJ.cjs');
 var node_child_process = require('node:child_process');
-var persistence = require('./persistence-A2NeERZJ.cjs');
-var machineMetadata = require('./machineMetadata-DDCVWb_x.cjs');
-var configuration = require('./configuration-DfPBa-9d.cjs');
-var registerKillSessionHandler = require('./registerKillSessionHandler-hvCsEn7b.cjs');
+var persistence = require('./persistence-CsmAgN-C.cjs');
+var machineMetadata = require('./machineMetadata-DhZuM0iB.cjs');
+var configuration = require('./configuration-BBK0rmmj.cjs');
+var registerKillSessionHandler = require('./registerKillSessionHandler-C3EDnW4F.cjs');
 var projectPath = require('./projectPath-C3ioB4Bu.cjs');
 var path = require('node:path');
-var createSessionMetadata = require('./createSessionMetadata-Cf78KHtt.cjs');
+var createSessionMetadata = require('./createSessionMetadata-DqZ6h02H.cjs');
 var sessionExitLifecycle = require('./sessionExitLifecycle-DFltxXU8.cjs');
-var controlClient = require('./controlClient-C13_pSKG.cjs');
-var startupSessionCreate = require('./startupSessionCreate-CcF7rGGB.cjs');
+var controlClient = require('./controlClient-DwWTns3A.cjs');
+var startupSessionCreate = require('./startupSessionCreate-rBHd4tc1.cjs');
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
-var setupOfflineReconnection = require('./setupOfflineReconnection-BKLfOd-i.cjs');
+var setupOfflineReconnection = require('./setupOfflineReconnection-DxMiW7OV.cjs');
 var trimIdent = require('./trimIdent-4gvk9Wk6.cjs');
 var specialCommands = require('./specialCommands-J3JFOq0J.cjs');
 var constants = require('./constants-VJ0N6WuG.cjs');
 var editPaths = require('./editPaths-Bqp4OFPw.cjs');
-var ensureDaemonRunning = require('./ensureDaemonRunning-BUuH-pbE.cjs');
+var reconnectEnv = require('./reconnectEnv-B31lY4nR.cjs');
+var store = require('./store-CkNa6oj4.cjs');
+var node_fs = require('node:fs');
+var codexAccount = require('./codexAccount-BDQjRbtI.cjs');
+var wrapperAccount = require('./wrapperAccount-D2A4DuZy.cjs');
+var ensureDaemonRunning = require('./ensureDaemonRunning-CoAg11Zi.cjs');
 require('tweetnacl');
 require('axios');
-require('./time-Cy0a-7YX.cjs');
-require('./browser-BTgZ9d4i.cjs');
+require('./time-BTLcO8jp.cjs');
+require('./browser-v1pdPP1E.cjs');
 require('open');
 require('zod');
 require('./prompt-Bof2aQkI.cjs');
-require('./reportProgressTool-tzQLCLIw.cjs');
-require('./client-BscskEBk.cjs');
+require('./reportProgressTool-Ddg1yVq2.cjs');
+require('./client-D2GWkd-T.cjs');
 require('./precheckCompat-CWOi5c9L.cjs');
 require('./agentGuidance-BtBx2xxE.cjs');
-require('node:fs');
 require('node:os');
 require('./pi-DlsrPCTa.cjs');
 require('./fileStore-7qhnbs6N.cjs');
-require('./client-C-OdTbrU.cjs');
+require('./client-DLlnmAPL.cjs');
 require('node:util');
-require('./context-Co7hUaW-.cjs');
-require('./sessionOps-DXlTmS7J.cjs');
+require('./context-wDp0aZBK.cjs');
+require('./sessionOps-XSEjIqNq.cjs');
 require('socket.io-client');
 require('./backgroundTaskActivity-CBvUdj39.cjs');
 require('./resources-BZ_Be0qM.cjs');
-require('./tools-B1x1j6tz.cjs');
-require('./peerTools-CElYh-5u.cjs');
+require('./tools-CcebYtLj.cjs');
+require('./peerTools-D-VNNFw-.cjs');
 require('./ids-B6ZC0HGt.cjs');
-require('./remoteSessionClient-6ymeMVa4.cjs');
+require('./remoteSessionClient-CcSP24Zq.cjs');
 require('@modelcontextprotocol/sdk/server/mcp.js');
 require('node:http');
 require('@modelcontextprotocol/sdk/server/streamableHttp.js');
 require('./limits-C-a7gr04.cjs');
-require('./downloadTarget-CikzJv1h.cjs');
+require('./downloadTarget-T1id2Gh6.cjs');
 require('./terminals-B_bfC9c2.cjs');
 require('./terminalTitleSuggest-DhvRFX3H.cjs');
 require('./tmuxSocket-D-Xt6Vn-.cjs');
-require('./bootstrap-sly4qPPY.cjs');
-require('./package-9n7wd2dT.cjs');
+require('./bootstrap-CoJu9VnB.cjs');
+require('./package-uzlvxa5S.cjs');
 require('./webPanels-FCgFKvVe.cjs');
-require('./pushNotifications-23YSd-0l.cjs');
+require('./pushNotifications-BCg7YAiu.cjs');
 require('./contentLogMetadata-ZSFk_NjQ.cjs');
 require('./previewPath-B0rBdhy1.cjs');
 require('crypto');
-require('./lidState-C9_DoF9i.cjs');
+require('./lidState-B_v6qgfE.cjs');
 require('os');
 require('child_process');
 require('node:events');
-require('./registerCommonHandlers-D1MiSfcB.cjs');
+require('./registerCommonHandlers-CZGmrPbT.cjs');
 require('util');
 require('fs/promises');
 require('path');
 require('cross-spawn');
-require('./sync-Ba8N6xba.cjs');
+require('./sync-WYBwkJvG.cjs');
 require('chalk');
 require('./cliUpdate-DsKXPFYp.cjs');
 require('./processTreeSnapshot-mDbnuojn.cjs');
 require('node:readline');
 require('./manager-HrEj442o.cjs');
 require('@anthropic-ai/sandbox-runtime');
-require('./rateLimitWindows-B2Kx6L0S.cjs');
+require('./rateLimitWindows-BZl6GMwQ.cjs');
 require('./processTree-CMHWlVse.cjs');
 require('./detectCLI-BuYR_Qxe.cjs');
 require('fs');
-require('./localHappyAgentAuth-CCjUvOfi.cjs');
+require('./localHappyAgentAuth-jJH0n67S.cjs');
 require('./fsMkdir-0K3yENml.cjs');
 require('./types-CRS-srZK.cjs');
 require('url');
-require('./spawnHappyCLI-CF_gLi92.cjs');
+require('./claudeAccountEnv-CEX_EMZr.cjs');
+require('./spawnHappyCLI-BYGOUda1.cjs');
 require('./doctorReadiness-Dl6yRQCy.cjs');
 
 function getStartedSubagents(state) {
@@ -1185,7 +1190,8 @@ async function resumeExistingThread(opts) {
     const resumedThread = await opts.client.resumeThread({
       threadId: opts.threadId,
       cwd: opts.cwd,
-      mcpServers: opts.mcpServers
+      mcpServers: opts.mcpServers,
+      ...opts.model ? { model: opts.model } : {}
     });
     opts.session.updateMetadata((currentMetadata) => ({
       ...currentMetadata,
@@ -1463,6 +1469,70 @@ function codexPublishablePermissionMode(mode) {
   return typeof mode === "string" && CODEX_REMOTE_PERMISSION_MODES.includes(mode) ? mode : null;
 }
 
+const MACHINE_CODEX_ACCOUNT = { profile: null, overrides: { env: {} }, unavailable: false, notices: [], cleanup: () => {
+} };
+function loadCodexWrapperAccount(happyHome, sessionId, spawnAccountId, env = process.env, now = Date.now()) {
+  let bindings = store.readSessionBindings(happyHome);
+  if (wrapperAccount.shouldRecordSpawnAccount(spawnAccountId, sessionId in bindings)) {
+    store.writeSessionBinding(happyHome, sessionId, { account: spawnAccountId });
+    bindings = { ...bindings, [sessionId]: { account: spawnAccountId } };
+  }
+  const probe = store.defaultSecretProbe(env);
+  const resolution = codexAccount.resolveCodexAccount(sessionId, {
+    home: happyHome,
+    accounts: store.readAccounts(happyHome),
+    bindings,
+    providers: codexAccount.readCodexProviders(env),
+    fileReadable: probe.fileReadable,
+    env,
+    nodePath: process.execPath,
+    envKeyCopyPath: (id) => path.join(happyHome, "tmp", "accounts", `key-${process.pid}-${id}`)
+  });
+  if (resolution.kind === "machine") return MACHINE_CODEX_ACCOUNT;
+  let cleanup = () => {
+  };
+  if (resolution.kind === "active" && resolution.envKeyCopy) {
+    const { name, path: path$1 } = resolution.envKeyCopy;
+    node_fs.mkdirSync(path.dirname(path$1), { recursive: true, mode: 448 });
+    node_fs.writeFileSync(path$1, (env[name] ?? "").trim() + "\n", { mode: 384 });
+    node_fs.chmodSync(path$1, 384);
+    cleanup = () => node_fs.rmSync(path$1, { force: true });
+  }
+  for (const key of resolution.unset) delete env[key];
+  if (resolution.kind === "active" && resolution.envKeyCopy) delete env[resolution.envKeyCopy.name];
+  if (resolution.kind === "unavailable") {
+    return { profile: resolution.profile, overrides: { env: {} }, unavailable: true, notices: [wrapperAccount.unavailableNotice(resolution.profile)], cleanup };
+  }
+  const overrides = { env: {}, modelProvider: resolution.modelProvider, ...resolution.config ? { config: resolution.config } : {} };
+  if (resolution.codexHome) {
+    codexAccount.syncCodexOverlay(resolution.codexHome, codexAccount.baseCodexHome(env), now);
+    overrides.env.CODEX_HOME = resolution.codexHome;
+  }
+  return {
+    profile: resolution.profile,
+    overrides,
+    ...resolution.pinnedModel ? { pinnedModel: resolution.pinnedModel } : {},
+    ...resolution.models ? { models: resolution.models } : {},
+    unavailable: false,
+    notices: [],
+    cleanup
+  };
+}
+function markCodexAccountRejected(happyHome, accountId, now = Date.now()) {
+  try {
+    const file = store.readAccountsFileV2(happyHome);
+    const record = file.accounts[accountId];
+    if (!record || record.agent !== "codex") return null;
+    const status = record.kind === "codex-chatgpt" ? "expired" : "invalid";
+    if (record.check?.status === status) return status;
+    record.check = { status, at: now, detail: "rejected during a session" };
+    store.writeAccountsFile(happyHome, file);
+    return status;
+  } catch {
+    return null;
+  }
+}
+
 const DEFAULT_CODEX_MODEL = void 0;
 const DEFAULT_CODEX_EFFORT = "medium";
 async function runCodex(opts) {
@@ -1479,6 +1549,8 @@ async function runCodex(opts) {
     console.error("  \x1B[36mvery-happy claude\x1B[0m\n");
     process.exit(1);
   }
+  const spawnAccountId = process.env[store.SPAWN_ACCOUNT_ENV] || void 0;
+  delete process.env[store.SPAWN_ACCOUNT_ENV];
   const sessionTag = node_crypto.randomUUID();
   api.connectionState.setBackend("Codex");
   const api$1 = await api.ApiClient.create(opts.credentials);
@@ -1507,7 +1579,7 @@ async function runCodex(opts) {
     dangerouslySkipPermissions: initialPermissionMode === "yolo" || initialPermissionMode === "bypassPermissions",
     ...forkedFromSessionId ? { parentSessionId: forkedFromSessionId } : {},
     ...forkedFromMessageId ? { forkedFromMessageId } : {},
-    capabilities: [index.PROMPT_QUEUE_CAPABILITY, forkBackfill.FORK_BACKFILL_CAPABILITY, persistence.HIBERNATION_CAPABILITY, sessionLock.AUTO_RESTART_CAPABILITY, index.CODEX_STEER_CAPABILITY, index.PROJECT_SESSION_CAPABILITY, index.CODEX_COMPACT_CAPABILITY, index.RUN_INTENT_CAPABILITY]
+    capabilities: [index.PROMPT_QUEUE_CAPABILITY, forkBackfill.FORK_BACKFILL_CAPABILITY, persistence.HIBERNATION_CAPABILITY, sessionLock.AUTO_RESTART_CAPABILITY, index.CODEX_STEER_CAPABILITY, index.PROJECT_SESSION_CAPABILITY, index.CODEX_COMPACT_CAPABILITY, index.RUN_INTENT_CAPABILITY, index.AGENT_PROFILE_SESSION_CAPABILITY]
   });
   metadata.attachmentKinds = [...attachmentContent.CLAUDE_ATTACHMENT_KINDS];
   metadata.stickyModel = null;
@@ -1520,12 +1592,13 @@ async function runCodex(opts) {
     const importTitle = process.env.HAPPY_IMPORT_TITLE;
     if (importTitle) metadata.summary = { text: importTitle, updatedAt: Date.now() };
   }
-  const reconnectSessionId = process.env.HAPPY_RECONNECT_SESSION_ID;
-  const reconnectKeyBase64 = process.env.HAPPY_RECONNECT_ENCRYPTION_KEY;
-  const reconnectVariant = process.env.HAPPY_RECONNECT_ENCRYPTION_VARIANT;
-  const reconnectSeq = process.env.HAPPY_RECONNECT_SEQ;
-  const reconnectMetadataVersion = process.env.HAPPY_RECONNECT_METADATA_VERSION;
-  const reconnectAgentStateVersion = process.env.HAPPY_RECONNECT_AGENT_STATE_VERSION;
+  const reconnectEnv$1 = reconnectEnv.takeReconnectEnv();
+  const reconnectSessionId = reconnectEnv$1.HAPPY_RECONNECT_SESSION_ID;
+  const reconnectKeyBase64 = reconnectEnv$1.HAPPY_RECONNECT_ENCRYPTION_KEY;
+  const reconnectVariant = reconnectEnv$1.HAPPY_RECONNECT_ENCRYPTION_VARIANT;
+  const reconnectSeq = reconnectEnv$1.HAPPY_RECONNECT_SEQ;
+  const reconnectMetadataVersion = reconnectEnv$1.HAPPY_RECONNECT_METADATA_VERSION;
+  const reconnectAgentStateVersion = reconnectEnv$1.HAPPY_RECONNECT_AGENT_STATE_VERSION;
   let response;
   if (reconnectSessionId && reconnectKeyBase64 && reconnectVariant) {
     logger.logger.debug(`[START] Reconnecting to existing session ${reconnectSessionId}`);
@@ -1568,6 +1641,21 @@ async function runCodex(opts) {
     }
   }
   const resumedEffort = reconnectSeeded && response ? index.restoredEffort(response.metadata, { useReportedLevel: true }) : void 0;
+  let codexAccount$1 = MACHINE_CODEX_ACCOUNT;
+  if (response) {
+    try {
+      codexAccount$1 = loadCodexWrapperAccount(configuration.configuration.happyHomeDir, response.id, spawnAccountId);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      logger.logger.debug(`[START] B-850b account resolution failed: ${reason}`);
+      if (spawnAccountId) {
+        codexAccount$1 = { ...MACHINE_CODEX_ACCOUNT, profile: { id: spawnAccountId, label: spawnAccountId, kind: "unknown", status: "unavailable", reason: "error" }, unavailable: true, notices: [`Account "${spawnAccountId}" could not be loaded: ${reason}`] };
+      }
+    }
+  }
+  const accountSwitched = !!reconnectSessionId && reconnectSeeded && !!response && codexAccount.codexAccountSwitched(response.metadata?.agentProfile, codexAccount$1.profile);
+  if (accountSwitched && !codexAccount$1.profile) codexAccount$1 = { ...codexAccount$1, overrides: { env: {}, modelProvider: codexAccount.readCodexDefaultProvider() } };
+  logger.logger.debug(`[START] B-850b account: ${codexAccount$1.profile ? `${codexAccount$1.profile.id} ${codexAccount$1.profile.kind} ${codexAccount$1.profile.status}` : "machine login"}${accountSwitched ? " (switched)" : ""}`);
   let session;
   let permissionHandler;
   let client$1;
@@ -1596,6 +1684,25 @@ async function runCodex(opts) {
     if (!wakingFromHibernation) void session.cancelUndeliveredQueuedInputs(reconnectReplay ? { maxSeq: reconnectReplay.seq } : void 0);
     session.updateMetadata((meta) => sessionLock.mergeReconnectMetadata(meta, metadata, Date.now()));
   }
+  session.updateMetadata((current) => ({
+    ...current,
+    agentProfile: codexAccount$1.profile,
+    ...accountSwitched ? { stickyModel: null, modelIntent: null } : {}
+  }));
+  for (const notice of codexAccount$1.notices) {
+    session.sendSessionEvent({ type: "message", message: notice, kind: codexAccount$1.unavailable ? "agent-profile-unavailable" : "agent-profile-warning" });
+  }
+  let historyRejectionReported = false;
+  const noteAccountFailure = (text) => {
+    if (!codexAccount$1.profile || codexAccount$1.unavailable) return;
+    if (accountSwitched && !historyRejectionReported && codexAccount.isHistoryRejectedError(text)) {
+      historyRejectionReported = true;
+      session.sendSessionEvent({ type: "message", message: `This conversation's history cannot continue on account "${codexAccount$1.profile.label}". Start a new session on it, or switch back to the previous account.`, kind: "agent-profile-history-rejected" });
+    } else if (codexAccount.isCodexAuthRejection(text)) {
+      const marked = markCodexAccountRejected(configuration.configuration.happyHomeDir, codexAccount$1.profile.id);
+      if (marked) session.sendSessionEvent({ type: "message", message: `Account "${codexAccount$1.profile.label}" was rejected (${marked}). Sign in again or switch accounts.`, kind: "agent-profile-auth-failed" });
+    }
+  };
   if (response) {
     try {
       logger.logger.debug(`[START] Reporting session ${response.id} to daemon`);
@@ -1688,6 +1795,11 @@ async function runCodex(opts) {
   };
   let userMessageDelivery = Promise.resolve();
   session.onUserMessage((message) => {
+    if (codexAccount$1.unavailable && codexAccount$1.profile) {
+      if (message.localKey) session.sendQueueCancelReason([message.localKey], "failed");
+      session.sendSessionEvent({ type: "message", message: codexAccount$1.notices[0] ?? `Account "${codexAccount$1.profile.label}" is unavailable.`, kind: "agent-profile-unavailable" });
+      return;
+    }
     const downloads = session.drainAttachmentsForUserMessage();
     userMessageDelivery = userMessageDelivery.then(async () => {
       const attachments = await downloads;
@@ -1952,6 +2064,7 @@ async function runCodex(opts) {
     process.stdin.setEncoding("utf8");
   }
   client$1 = new codexAppServerClient.CodexAppServerClient(sandboxConfig);
+  client$1.setAccountOverrides(codexAccount$1.overrides);
   const idleRelease = new CodexIdleReleaseTimer({
     delayMs: resolveCodexIdleReleaseMs(process.env[CODEX_IDLE_RELEASE_ENV]),
     isIdle: () => shouldReleaseIdleCodex({
@@ -2021,6 +2134,7 @@ async function runCodex(opts) {
       if (failure) {
         messageBuffer.addMessage(`Task failed: ${failure}`, "status");
         session.sendSessionEvent({ type: "message", message: `Codex error: ${failure}` });
+        noteAccountFailure(failure);
       } else {
         messageBuffer.addMessage("Task completed", "status");
       }
@@ -2029,6 +2143,7 @@ async function runCodex(opts) {
       if (failure) {
         messageBuffer.addMessage(`Turn aborted: ${failure}`, "status");
         session.sendSessionEvent({ type: "message", message: `Codex error: ${failure}` });
+        noteAccountFailure(failure);
       } else {
         messageBuffer.addMessage("Turn aborted", "status");
       }
@@ -2135,6 +2250,11 @@ async function runCodex(opts) {
         logger.logger.debug("[Codex] config/read unavailable", safeCodexErrorMetadata(error));
       }
       machineDefaultModel = configured?.model ?? discoveredModels.find((model) => model.isDefault)?.model;
+      const accountDefault = codexAccount.codexAccountDefaultModel(codexAccount$1, configured?.model ?? null, discoveredModels);
+      if (codexAccount$1.profile && !codexAccount$1.unavailable) {
+        machineDefaultModel = accountDefault;
+        if (codexAccount$1.models?.length) discoveredModels = codexAccount.accountModelsAsCatalog(codexAccount$1.models, discoveredModels);
+      }
       if (discoveredModels.length > 0 || configured) {
         session.updateMetadata((metadata2) => ({
           ...metadata2,
@@ -2147,22 +2267,30 @@ async function runCodex(opts) {
               defaultReasoningEffort: model.defaultReasoningEffort
             }))
           } : {},
-          defaultModelCode: configured?.model ?? discoveredModels.find((model) => model.isDefault)?.model,
-          ...configured ? { configuredModel: configured.model } : {}
+          defaultModelCode: codexAccount$1.profile && !codexAccount$1.unavailable ? accountDefault : configured?.model ?? discoveredModels.find((model) => model.isDefault)?.model,
+          ...configured ? { configuredModel: codexAccount$1.profile && !codexAccount$1.unavailable ? accountDefault ?? null : configured.model } : {}
         }));
       }
     } catch (error) {
       logger.logger.debug("[Codex] Model discovery unavailable; using compatibility fallback", safeCodexErrorMetadata(error));
     }
-    if (opts.resumeThreadId) {
-      await resumeExistingThread({
-        client: client$1,
-        session,
-        messageBuffer,
-        threadId: opts.resumeThreadId,
-        cwd: process.cwd(),
-        mcpServers
-      });
+    if (opts.resumeThreadId && !codexAccount$1.unavailable) {
+      try {
+        await resumeExistingThread({
+          client: client$1,
+          session,
+          messageBuffer,
+          threadId: opts.resumeThreadId,
+          cwd: process.cwd(),
+          mcpServers,
+          // B-850b: after an account switch the thread moves to the
+          // new account's model (its old one is sticky otherwise).
+          ...accountSwitched && machineDefaultModel ? { model: machineDefaultModel } : {}
+        });
+      } catch (error) {
+        noteAccountFailure(error instanceof Error ? error.message : String(error));
+        throw error;
+      }
       first = false;
       appendSystemPromptInjected = true;
     }
@@ -2358,7 +2486,10 @@ async function runCodex(opts) {
         }
         if (!client$1.hasActiveThread()) {
           const startedThread = await client$1.startThread({
-            model: turnModel,
+            // B-850b: a new thread on an account starts on the account's
+            // model — Codex would otherwise pick config.toml's, which
+            // belongs to the machine's own provider.
+            model: turnModel ?? (codexAccount$1.profile && !codexAccount$1.unavailable ? machineDefaultModel : void 0),
             cwd: process.cwd(),
             approvalPolicy: executionPolicy.approvalPolicy,
             sandbox: executionPolicy.sandbox,
@@ -2413,6 +2544,7 @@ async function runCodex(opts) {
         if (reason) {
           messageBuffer.addMessage(`Task failed: ${reason}`, "status");
           session.sendSessionEvent({ type: "message", message: `Codex error: ${reason}` });
+          noteAccountFailure(reason);
         } else {
           const tail = codexStderrTailOf(error);
           messageBuffer.addMessage("Process exited unexpectedly", "status");