very-happy-cli 0.2.191 → 0.2.193

package/dist/accountService-Cd7bnkfd.mjs

@@ -0,0 +1,916 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { G as AGENT_PROFILE_FEATURE_LAUNCH, H as AgentProfileAddRequestSchema, I as AgentProfileLoginStartRequestSchema, J as AgentProfileLoginSubmitRequestSchema, K as AgentProfileBindRequestSchema } from './index-D1YnIih6.mjs';
+import { spawn } from 'node:child_process';
+import { A as ACCOUNT_STRIPPED_ENV_KEYS } from './claudeAccountEnv-BL1pR_37.mjs';
+import { C as CODEX_ALWAYS_STRIPPED_ENV_KEYS, r as readCodexProviders, s as syncCodexOverlay, b as baseCodexHome } from './codexAccount-NOX5pmQf.mjs';
+import { createInterface } from 'node:readline';
+import { h as buildAgentProfilesState, d as defaultSecretProbe, a as readAccounts, s as summarizeAccount, c as readAccountsFileV2, n as newAccountId, i as writeAccountSecret, f as writeAccountsFile, j as sessionsBoundTo, r as readSessionBindings, k as removeAccountSecret, b as accountSecretPath, e as expandHome, l as accountCodexHomePath, m as SUBSCRIPTION_TOKEN_TTL_MS, w as writeSessionBinding, o as readSessionBindingV2 } from './store-Vej_738f.mjs';
+
+const CHECK_TIMEOUT_MS = 2e4;
+const DEFAULT_CHECK_MODEL = "claude-haiku-4-5";
+function classifyHttpCheck(kind, status, bodySnippet, now) {
+  if (status >= 200 && status < 300) return { status: "ok", at: now };
+  if (status === 401 || status === 403) {
+    return { status: kind === "claude-subscription" ? "expired" : "invalid", at: now, detail: `HTTP ${status}` };
+  }
+  return { status: "unverified", at: now, detail: `HTTP ${status}${bodySnippet ? `: ${sanitizeDetail(bodySnippet)}` : ""}` };
+}
+function classifyClaudeCheck(exitCode, output, now) {
+  if (exitCode === 0) return { status: "ok", at: now };
+  if (/\b401\b|OAuth access token is invalid|invalid.*token|token.*(expired|revoked)/i.test(output)) {
+    return { status: "expired", at: now, detail: sanitizeDetail(lastLine(output)) };
+  }
+  return { status: "unverified", at: now, detail: sanitizeDetail(lastLine(output) || `exit ${exitCode}`) };
+}
+function lastLine(text) {
+  return text.trim().split("\n").filter(Boolean).pop() ?? "";
+}
+function sanitizeDetail(text) {
+  return text.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-\u2026").replace(/\b(sk|rk)-[A-Za-z0-9_-]{16,}/g, "$1-\u2026").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+async function checkApiAccount(record, key, now = Date.now) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${record.baseUrl}/v1/messages`, {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "content-type": "application/json",
+        "anthropic-version": "2023-06-01",
+        "x-api-key": key,
+        authorization: `Bearer ${key}`
+      },
+      body: JSON.stringify({
+        model: record.models?.[0] ?? DEFAULT_CHECK_MODEL,
+        max_tokens: 1,
+        messages: [{ role: "user", content: "ping" }]
+      })
+    });
+    const text = res.ok ? "" : (await res.text().catch(() => "")).slice(0, 400);
+    return classifyHttpCheck(record.kind, res.status, text, now());
+  } catch (error) {
+    return { status: "unverified", at: now(), detail: sanitizeDetail(error instanceof Error ? error.message : String(error)) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkSubscriptionAccount(token, scratchDir, now = Date.now) {
+  mkdirSync(scratchDir, { recursive: true });
+  const settingsPath = join(scratchDir, "check-settings.json");
+  writeFileSync(settingsPath, JSON.stringify({ disableAllHooks: true }));
+  const env = { ...process.env };
+  for (const key of ACCOUNT_STRIPPED_ENV_KEYS) delete env[key];
+  env.CLAUDE_CODE_OAUTH_TOKEN = token;
+  return new Promise((resolve) => {
+    let output = "";
+    const child = spawn("claude", ["-p", "ping", "--model", "haiku", "--no-session-persistence", "--strict-mcp-config", "--settings", settingsPath], {
+      cwd: scratchDir,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const timer = setTimeout(() => child.kill("SIGKILL"), CHECK_TIMEOUT_MS);
+    child.stdout.on("data", (d) => {
+      output += d;
+    });
+    child.stderr.on("data", (d) => {
+      output += d;
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({ status: "unverified", at: now(), detail: sanitizeDetail(error.message) });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve(classifyClaudeCheck(code, output.slice(-2e3), now()));
+    });
+  });
+}
+
+const LOGIN_CODE_TIMEOUT_MS = 10 * 6e4;
+const LOGIN_URL_TIMEOUT_MS = 2e4;
+const LOGIN_EXCHANGE_TIMEOUT_MS = 6e4;
+const LOGIN_RETAIN_MS$1 = 10 * 6e4;
+function stripAnsi(text) {
+  return text.replace(/\x1b\][^\x07\x1b]*(\x07|\x1b\\)/g, "").replace(/\x1b\[[0-9;?<>=]*[ -/]*[@-~]/g, " ").replace(/\x1b[()][A-Za-z0-9]/g, "").replace(/\x1b[=>78]/g, "");
+}
+function findAuthorizeUrl(clean) {
+  const m = clean.match(/https:\/\/[^\s]*\/oauth\/authorize\?[^\s]+/);
+  return m ? m[0] : null;
+}
+function findSetupToken(clean) {
+  const m = clean.match(/sk-ant-oat01-[A-Za-z0-9_-]{20,}/);
+  return m ? m[0] : null;
+}
+function findLoginError(clean) {
+  const m = clean.match(/(OAuth error:[^\n]*?)(?:\s{2,}|Press|$)/) ?? clean.match(/(Login failed[^\n]*)/);
+  return m ? m[1].replace(/\s+/g, " ").trim().slice(0, 200) : null;
+}
+function setupTokenEnv(base) {
+  const env = {};
+  for (const [k, v] of Object.entries(base)) if (typeof v === "string") env[k] = v;
+  for (const key of ACCOUNT_STRIPPED_ENV_KEYS) delete env[key];
+  env.BROWSER = "true";
+  env.TERM = "xterm-256color";
+  return env;
+}
+class SetupTokenLoginManager {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  logins = /* @__PURE__ */ new Map();
+  now;
+  /** One login at a time per machine: a second start cancels nothing and is refused. */
+  activeLoginId() {
+    for (const [id, e] of this.logins) if (e.status.state === "waiting-code" || e.status.state === "exchanging") return id;
+    return null;
+  }
+  async start() {
+    const busy = this.activeLoginId();
+    if (busy) throw Object.assign(new Error("another login is in progress"), { code: "login-busy", loginId: busy });
+    const loginId = this.deps.newId();
+    const entry = {
+      status: { loginId, state: "starting" },
+      pty: null,
+      output: "",
+      timers: []
+    };
+    this.logins.set(loginId, entry);
+    const urlReady = new Promise((resolve) => {
+      entry.resolveUrl = resolve;
+    });
+    try {
+      entry.pty = this.deps.spawnPty(setupTokenEnv(this.deps.env));
+    } catch (error) {
+      this.finish(entry, "failed", `could not start claude setup-token: ${error instanceof Error ? error.message : String(error)}`);
+      return { ...entry.status };
+    }
+    entry.pty.onData((data) => this.onData(entry, data));
+    entry.pty.onExit(({ exitCode }) => {
+      entry.pty = null;
+      if (entry.tokenSeen) return;
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code" || entry.status.state === "exchanging") {
+        this.finish(entry, "failed", findLoginError(stripAnsi(entry.output)) ?? `claude setup-token exited (${exitCode})`);
+      }
+    });
+    entry.timers.push(setTimeout(() => {
+      if (entry.status.state === "starting") this.finish(entry, "failed", "claude setup-token printed no sign-in URL");
+    }, LOGIN_URL_TIMEOUT_MS));
+    await Promise.race([urlReady, new Promise((r) => entry.timers.push(setTimeout(r, LOGIN_URL_TIMEOUT_MS + 50)))]);
+    return { ...entry.status };
+  }
+  submit(loginId, code) {
+    const entry = this.get(loginId);
+    if (entry.status.state !== "waiting-code" || !entry.pty) return { ...entry.status };
+    entry.status = { ...entry.status, state: "exchanging" };
+    entry.output = "";
+    entry.pty.write(code.trim().replace(/[\r\n]/g, "") + "\r");
+    entry.timers.push(setTimeout(() => {
+      if (entry.status.state === "exchanging" && !entry.tokenSeen) this.finish(entry, "failed", "timed out waiting for Claude to issue the token");
+    }, LOGIN_EXCHANGE_TIMEOUT_MS));
+    return { ...entry.status };
+  }
+  status(loginId) {
+    return { ...this.get(loginId).status };
+  }
+  cancel(loginId) {
+    const entry = this.get(loginId);
+    if (entry.status.state === "starting" || entry.status.state === "waiting-code" || entry.status.state === "exchanging") {
+      this.finish(entry, "canceled");
+    }
+    return { ...entry.status };
+  }
+  dispose() {
+    for (const entry of this.logins.values()) this.finish(entry, entry.status.state === "succeeded" ? "succeeded" : "canceled");
+    this.logins.clear();
+  }
+  get(loginId) {
+    const entry = this.logins.get(loginId);
+    if (!entry) throw Object.assign(new Error("unknown or expired login"), { code: "login-not-found" });
+    return entry;
+  }
+  onData(entry, data) {
+    entry.output = (entry.output + data).slice(-64e3);
+    const clean = stripAnsi(entry.output);
+    if (entry.status.state === "starting") {
+      const url = findAuthorizeUrl(clean);
+      if (url) {
+        const expiresAt = this.now() + LOGIN_CODE_TIMEOUT_MS;
+        entry.status = { ...entry.status, state: "waiting-code", url, expiresAt };
+        entry.timers.push(setTimeout(() => {
+          if (entry.status.state === "waiting-code") this.finish(entry, "expired");
+        }, LOGIN_CODE_TIMEOUT_MS));
+        entry.resolveUrl?.();
+      }
+      return;
+    }
+    if (entry.status.state !== "exchanging" || entry.tokenSeen) return;
+    const token = findSetupToken(clean);
+    if (token) {
+      entry.tokenSeen = true;
+      entry.output = "";
+      this.deps.onToken(entry.status.loginId, token).then(
+        (account) => this.finish(entry, "succeeded", void 0, account),
+        (error2) => this.finish(entry, "failed", error2 instanceof Error ? error2.message : String(error2))
+      );
+      return;
+    }
+    const error = findLoginError(clean);
+    if (error) this.finish(entry, "failed", error);
+  }
+  finish(entry, state, error, account) {
+    for (const t2 of entry.timers) clearTimeout(t2);
+    entry.timers = [];
+    const { loginId, url, expiresAt } = entry.status;
+    entry.status = { loginId, state, ...url && state !== "succeeded" ? { url } : {}, ...expiresAt ? { expiresAt } : {}, ...account ? { account } : {}, ...error ? { error } : {} };
+    entry.resolveUrl?.();
+    const pty = entry.pty;
+    entry.pty = null;
+    try {
+      pty?.kill();
+    } catch {
+    }
+    entry.output = "";
+    const loginId_ = loginId;
+    const t = setTimeout(() => this.logins.delete(loginId_), LOGIN_RETAIN_MS$1);
+    t.unref?.();
+  }
+}
+
+const DEVICE_LOGIN_TIMEOUT_MS = 15 * 6e4;
+const DEVICE_LOGIN_START_TIMEOUT_MS = 2e4;
+const LOGIN_RETAIN_MS = 10 * 6e4;
+const END_AFTER_CLOSE_MS = 5e3;
+function codexLoginEnv(base, codexHome) {
+  const env = {};
+  for (const [k, v] of Object.entries(base)) if (typeof v === "string") env[k] = v;
+  for (const key of CODEX_ALWAYS_STRIPPED_ENV_KEYS) delete env[key];
+  env.CODEX_HOME = codexHome;
+  env.RUST_LOG = "warn";
+  return env;
+}
+const spawnCodexRpc = (codexHome, env) => {
+  const child = spawn("codex", ["app-server", "--listen", "stdio://"], { env, cwd: codexHome, stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = [];
+  let nextId = 1;
+  createInterface({ input: child.stdout }).on("line", (line) => {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (msg.id != null && pending.has(msg.id)) {
+      const p = pending.get(msg.id);
+      pending.delete(msg.id);
+      if (msg.error) p.reject(new Error(msg.error.message ?? "codex app-server error"));
+      else p.resolve(msg.result);
+    } else if (msg.method && msg.id == null) {
+      for (const cb of listeners) cb(msg.method, msg.params);
+    }
+  });
+  const send = (obj) => child.stdin?.writable && child.stdin.write(JSON.stringify(obj) + "\n");
+  const request = (method, params, timeoutMs = 15e3) => new Promise((resolve, reject) => {
+    const id = nextId++;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(`${method} timed out`));
+    }, timeoutMs);
+    pending.set(id, { resolve: (v) => {
+      clearTimeout(timer);
+      resolve(v);
+    }, reject: (e) => {
+      clearTimeout(timer);
+      reject(e);
+    } });
+    send({ jsonrpc: "2.0", id, method, params });
+  });
+  child.on("error", () => {
+  });
+  const initialized = request("initialize", { clientInfo: { name: "very-happy-accounts", version: "1" } }).then(() => send({ jsonrpc: "2.0", method: "initialized" }));
+  return {
+    request: async (method, params, timeoutMs) => {
+      await initialized;
+      return request(method, params, timeoutMs);
+    },
+    onNotification: (cb) => {
+      listeners.push(cb);
+    },
+    onExit: (cb) => {
+      child.on("exit", (code) => cb(code));
+    },
+    close: () => {
+      child.kill();
+    }
+  };
+};
+class CodexDeviceLoginManager {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  logins = /* @__PURE__ */ new Map();
+  now;
+  activeLoginId() {
+    for (const [id, e] of this.logins) if (e.status.state === "starting" || e.status.state === "waiting-code") return id;
+    return null;
+  }
+  has(loginId) {
+    return this.logins.has(loginId);
+  }
+  async start(codexHome) {
+    const busy = this.activeLoginId();
+    if (busy) throw Object.assign(new Error("another Codex sign-in is in progress"), { code: "login-busy", loginId: busy });
+    const loginId = this.deps.newId();
+    const entry = { status: { loginId, state: "starting", flow: "device-code" }, rpc: null, timers: [] };
+    this.logins.set(loginId, entry);
+    let rpc;
+    try {
+      rpc = this.deps.spawnRpc(codexHome, codexLoginEnv(this.deps.env, codexHome));
+    } catch (error) {
+      this.finish(entry, "failed", `could not start codex: ${error instanceof Error ? error.message : String(error)}`);
+      return { ...entry.status };
+    }
+    entry.rpc = rpc;
+    rpc.onExit(() => {
+      entry.rpc = null;
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code") this.finish(entry, "failed", "codex app-server exited");
+    });
+    rpc.onNotification((method, params) => {
+      if (method !== "account/login/completed") return;
+      if (entry.status.state !== "starting" && entry.status.state !== "waiting-code") return;
+      if (params?.loginId && entry.codexLoginId && params.loginId !== entry.codexLoginId) return;
+      if (params?.success) void this.complete(entry);
+      else this.finish(entry, "failed", sanitizeDetail(String(params?.error ?? "sign-in failed")));
+    });
+    try {
+      const result = await rpc.request("account/login/start", { type: "chatgptDeviceCode" }, DEVICE_LOGIN_START_TIMEOUT_MS);
+      if (typeof result?.verificationUrl !== "string" || typeof result?.userCode !== "string") throw new Error("codex returned no device code");
+      entry.codexLoginId = typeof result.loginId === "string" ? result.loginId : void 0;
+      if (entry.status.state === "starting") {
+        entry.status = { ...entry.status, state: "waiting-code", url: result.verificationUrl, userCode: result.userCode, expiresAt: this.now() + DEVICE_LOGIN_TIMEOUT_MS };
+        entry.timers.push(setTimeout(() => {
+          if (entry.status.state === "waiting-code") this.finish(entry, "expired");
+        }, DEVICE_LOGIN_TIMEOUT_MS));
+      }
+    } catch (error) {
+      this.finish(entry, "failed", sanitizeDetail(error instanceof Error ? error.message : String(error)));
+    }
+    return { ...entry.status };
+  }
+  async complete(entry) {
+    if (entry.status.state !== "waiting-code" && entry.status.state !== "starting") return;
+    let account = {};
+    try {
+      const read = await entry.rpc?.request("account/read", { refreshToken: false });
+      const a = read?.account;
+      if (a?.type === "chatgpt") account = { ...a.email ? { email: String(a.email) } : {}, ...a.planType ? { planType: String(a.planType) } : {} };
+    } catch {
+    }
+    try {
+      const summary = await this.deps.onSuccess(entry.status.loginId, account);
+      entry.status = { ...entry.status, account: summary };
+      this.finish(entry, "succeeded");
+    } catch (error) {
+      this.finish(entry, "failed", error instanceof Error ? error.message : String(error));
+    }
+  }
+  status(loginId) {
+    return { ...this.get(loginId).status };
+  }
+  cancel(loginId) {
+    const entry = this.get(loginId);
+    if (entry.status.state === "starting" || entry.status.state === "waiting-code") {
+      if (entry.codexLoginId) void entry.rpc?.request("account/login/cancel", { loginId: entry.codexLoginId }, 5e3).catch(() => {
+      });
+      this.finish(entry, "canceled");
+    }
+    return { ...entry.status };
+  }
+  dispose() {
+    for (const entry of this.logins.values()) {
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code") this.finish(entry, "canceled");
+      for (const t of entry.timers) clearTimeout(t);
+    }
+    this.logins.clear();
+    for (const end of [...this.pendingEnds]) end(true);
+  }
+  /** finish() → onEnd still waiting for its app-server to exit; dispose() runs them at once. */
+  pendingEnds = /* @__PURE__ */ new Set();
+  settleWaiters = [];
+  /** Resolves once every finished login's onEnd has run (a CLI exiting right after Ctrl-C waits for the cleanup). */
+  settle() {
+    if (this.pendingEnds.size === 0) return Promise.resolve();
+    return new Promise((resolve) => this.settleWaiters.push(resolve));
+  }
+  get(loginId) {
+    const entry = this.logins.get(loginId);
+    if (!entry) throw Object.assign(new Error(`no login "${loginId}"`), { code: "login-not-found" });
+    return entry;
+  }
+  finish(entry, state, error) {
+    entry.status = { ...entry.status, state, ...error ? { error } : {} };
+    for (const t2 of entry.timers) clearTimeout(t2);
+    entry.timers = [];
+    const rpc = entry.rpc;
+    entry.rpc = null;
+    const loginId = entry.status.loginId;
+    if (!rpc) this.deps.onEnd?.(loginId, state);
+    else {
+      let ended = false;
+      const end = (closeNow) => {
+        if (ended) return;
+        ended = true;
+        this.pendingEnds.delete(end);
+        if (closeNow) rpc.close();
+        this.deps.onEnd?.(loginId, state);
+        if (this.pendingEnds.size === 0) for (const resolve of this.settleWaiters.splice(0)) resolve();
+      };
+      this.pendingEnds.add(end);
+      rpc.onExit(() => end());
+      setTimeout(() => rpc.close(), state === "canceled" ? 500 : 0).unref?.();
+      setTimeout(() => end(), END_AFTER_CLOSE_MS).unref?.();
+    }
+    const t = setTimeout(() => this.logins.delete(entry.status.loginId), LOGIN_RETAIN_MS);
+    t.unref?.();
+  }
+}
+function classifyChatgptRead(read, now) {
+  const account = read?.account;
+  if (account && account.type === "chatgpt") return { status: "ok", at: now };
+  return { status: "expired", at: now, detail: "not signed in" };
+}
+async function checkCodexChatgptAccount(codexHome, env, spawnRpc = spawnCodexRpc, now = Date.now) {
+  let rpc = null;
+  try {
+    rpc = spawnRpc(codexHome, codexLoginEnv(env, codexHome));
+    const read = await rpc.request("account/read", { refreshToken: true }, CHECK_TIMEOUT_MS);
+    return classifyChatgptRead(read, now());
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/refresh token|401|unauthori[sz]ed|sign in again|log in again/i.test(message)) return { status: "expired", at: now(), detail: sanitizeDetail(message) };
+    return { status: "unverified", at: now(), detail: sanitizeDetail(message) };
+  } finally {
+    rpc?.close();
+  }
+}
+async function checkCodexProviderAccount(baseUrl, key, headers = {}, now = Date.now) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/models`, { signal: controller.signal, headers: { ...headers, authorization: `Bearer ${key}` } });
+    const body = res.ok ? "" : (await res.text().catch(() => "")).slice(0, 300);
+    return classifyHttpCheck("codex-provider", res.status, body, now());
+  } catch (error) {
+    return { status: "unverified", at: now(), detail: sanitizeDetail(error instanceof Error ? error.message : String(error)) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+const ACCOUNT_AGENTS = ["claude", "codex"];
+class AccountError extends Error {
+  constructor(code, message, sessions) {
+    super(message);
+    this.code = code;
+    this.sessions = sessions;
+  }
+}
+const DAEMON_DOWN = /^(No daemon running|Daemon is not running)/;
+function localRestartFailure(error, stillRunning) {
+  return { ok: false, stillRunning, notRunning: !stillRunning && (error.startsWith("restart-precheck:not-tracked") || DAEMON_DOWN.test(error)), error };
+}
+function bindResultMessages(result, sessionId, target, noun) {
+  const bound = `Bound ${sessionId} \u2192 ${target}.`;
+  if (result.restart === "done") return { out: [bound, "Restarted in place (history kept)."], err: [], exitCode: 0 };
+  if (result.restart === "pending") return { out: [bound, "Restart in progress."], err: [], exitCode: 0 };
+  if (result.restart === "skipped") return { out: [bound, `Not restarted${result.error ? ` (${result.error})` : ""}; applies when the session next starts.`], err: [], exitCode: 0 };
+  if (result.rolledBack) return { out: [], err: [`Not switched: the restart failed (${result.error}). The session keeps running on its previous ${noun}; the binding was not changed.`], exitCode: 1 };
+  return { out: [], err: [`Binding to ${target} saved, but the restart failed (${result.error}); the session is not running and starts on ${target} next time.`], exitCode: 1 };
+}
+const BIND_RESTART_BUDGET_MS = 22e3;
+class AccountService {
+  constructor(deps) {
+    this.deps = deps;
+    this.home = deps.home;
+    this.env = deps.env ?? process.env;
+    this.now = deps.now ?? Date.now;
+  }
+  home;
+  env;
+  now;
+  logins = null;
+  codexLogins = null;
+  /** loginId → account to (re)write when its token arrives. */
+  loginTargets = /* @__PURE__ */ new Map();
+  state() {
+    const state = buildAgentProfilesState(this.home, readAccounts(this.home), defaultSecretProbe(this.env), this.now(), this.deps.daemonPid ?? process.pid);
+    const codexProviders = readCodexProviders(this.env).map((p) => ({ id: p.id, ...p.name ? { name: p.name } : {}, ...p.baseUrl ? { baseUrl: p.baseUrl } : {}, ...p.envKey ? { envKey: p.envKey } : {} }));
+    const withFeatures = { ...state, features: [AGENT_PROFILE_FEATURE_LAUNCH] };
+    return codexProviders.length > 0 ? { ...withFeatures, codexProviders } : withFeatures;
+  }
+  summary(id) {
+    const record = readAccounts(this.home).accounts[id];
+    if (!record) throw new AccountError("not-found", `no account "${id}"`);
+    return summarizeAccount(this.home, id, record, defaultSecretProbe(this.env), this.now());
+  }
+  changed() {
+    try {
+      this.deps.onChanged?.();
+    } catch {
+    }
+  }
+  editable(id) {
+    const file = readAccountsFileV2(this.home);
+    const record = file.accounts[id];
+    if (!record) {
+      if (readAccounts(this.home).accounts[id]?.legacy) throw new AccountError("legacy-readonly", `"${id}" comes from providers.json; edit or remove it there`);
+      throw new AccountError("not-found", `no account "${id}"`);
+    }
+    return { file, record };
+  }
+  // ---- add / edit -----------------------------------------------------------
+  async add(params) {
+    const parsed = AgentProfileAddRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    const req = parsed.data;
+    if (req.agent === "codex" && req.provider && !readCodexProviders(this.env).some((p) => p.id === req.provider)) {
+      throw new AccountError("not-found", `no [model_providers.${req.provider}] in the machine's Codex config.toml`);
+    }
+    const file = readAccountsFileV2(this.home);
+    const id = newAccountId(req.label, req.kind, Object.keys(readAccounts(this.home).accounts));
+    const models = [];
+    const contextWindows = {};
+    for (const m of req.models ?? []) {
+      if (typeof m === "string") models.push(m);
+      else {
+        models.push(m.id);
+        if (m.contextWindow) contextWindows[m.id] = m.contextWindow;
+      }
+    }
+    const record = {
+      label: req.label,
+      agent: req.agent,
+      kind: req.kind,
+      createdAt: this.now(),
+      ...req.baseUrl ? { baseUrl: req.baseUrl.replace(/\/+$/, "") } : {},
+      ...req.agent === "codex" && req.provider ? { provider: req.provider } : {},
+      ...req.agent === "codex" && req.wireApi ? { wireApi: req.wireApi } : {},
+      key: req.key.source === "paste" ? { source: "stored" } : req.key.source === "file" ? { source: "file", path: req.key.path } : { source: "env", name: req.key.name },
+      ...models.length > 0 ? { models } : {},
+      ...Object.keys(contextWindows).length > 0 ? { contextWindows } : {}
+    };
+    if (req.key.source === "paste") writeAccountSecret(this.home, id, req.key.value);
+    file.accounts[id] = record;
+    writeAccountsFile(this.home, file);
+    this.changed();
+    return this.test(id);
+  }
+  rename(accountId, label) {
+    if (typeof accountId !== "string" || typeof label !== "string" || !label.trim() || label.trim().length > 60) {
+      throw new AccountError("invalid-params", "accountId and a 1\u201360 character label are required");
+    }
+    const { file, record } = this.editable(accountId);
+    record.label = label.trim();
+    writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(accountId);
+  }
+  /**
+   * `force` with bound sessions: the credential is gone, so each of those
+   * sessions restarts in place right away and comes back `unavailable`
+   * (refusing turns, Q3) instead of running on the deleted credential until
+   * its next start. Restarts run in parallel within the bind budget; one
+   * still going reports 'pending'.
+   */
+  async remove(accountId, force) {
+    if (typeof accountId !== "string") throw new AccountError("invalid-params", "accountId is required");
+    const { file } = this.editable(accountId);
+    const sessions = sessionsBoundTo(readSessionBindings(this.home), accountId);
+    if (sessions.length > 0 && force !== true) {
+      throw new AccountError("in-use", `${sessions.length} session(s) use this account; switch them first or remove with force`, sessions);
+    }
+    delete file.accounts[accountId];
+    for (const [agent, id] of Object.entries(file.defaults)) if (id === accountId) delete file.defaults[agent];
+    writeAccountsFile(this.home, file);
+    removeAccountSecret(this.home, accountId);
+    this.changed();
+    if (sessions.length === 0 || !this.deps.restartSession) return { removed: true, sessions };
+    const restarts = {};
+    await Promise.all(sessions.map(async (sessionId) => {
+      restarts[sessionId] = await this.restartWithinBudget(sessionId);
+    }));
+    return { removed: true, sessions, restarts };
+  }
+  /** 'done' | 'skipped' (not running here) | 'pending' (still going after the budget) | 'failed' */
+  async restartWithinBudget(sessionId) {
+    const outcome = await Promise.race([
+      this.deps.restartSession(sessionId),
+      new Promise((r) => setTimeout(() => r("pending"), BIND_RESTART_BUDGET_MS).unref?.())
+    ]);
+    if (outcome === "pending") return "pending";
+    if (outcome.ok) return "done";
+    return outcome.notRunning ? "skipped" : "failed";
+  }
+  setDefault(agent, accountId) {
+    if (!ACCOUNT_AGENTS.includes(agent)) throw new AccountError("invalid-params", 'agent must be "claude" or "codex"');
+    if (accountId !== null && typeof accountId !== "string") throw new AccountError("invalid-params", "accountId must be a string or null");
+    if (typeof accountId === "string") {
+      const record = readAccounts(this.home).accounts[accountId];
+      if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+      if (record.agent !== agent) throw new AccountError("invalid-params", `"${accountId}" is not a ${agent} account`);
+    }
+    const file = readAccountsFileV2(this.home);
+    if (accountId === null) delete file.defaults[agent];
+    else file.defaults[agent] = accountId;
+    writeAccountsFile(this.home, file);
+    this.changed();
+    return this.state();
+  }
+  // ---- check ---------------------------------------------------------------
+  readSecretFor(id, record) {
+    try {
+      if (record.kind === "claude-subscription" || record.key?.source === "stored") return readFileSync(accountSecretPath(this.home, id), "utf8").trim() || null;
+      if (record.key?.source === "file") return readFileSync(expandHome(record.key.path), "utf8").trim() || null;
+      if (record.key?.source === "env") return this.env[record.key.name]?.trim() || null;
+    } catch {
+      return null;
+    }
+    return null;
+  }
+  async test(accountId) {
+    if (typeof accountId !== "string") throw new AccountError("invalid-params", "accountId is required");
+    const record = readAccounts(this.home).accounts[accountId];
+    if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+    let check;
+    if (record.kind === "codex-chatgpt") {
+      if (this.summary(accountId).status === "missing-secret") return this.summary(accountId);
+      const codexHome = accountCodexHomePath(this.home, accountId);
+      syncCodexOverlay(codexHome, baseCodexHome(this.env), this.now());
+      check = this.deps.check ? await this.deps.check(record, "") : await checkCodexChatgptAccount(codexHome, this.env, this.deps.spawnCodexRpc ?? spawnCodexRpc, this.now);
+    } else {
+      const secret = this.readSecretFor(accountId, record);
+      if (!secret) return this.summary(accountId);
+      check = this.deps.check ? await this.deps.check(record, secret) : record.kind === "claude-subscription" ? await checkSubscriptionAccount(secret, join(this.home, "tmp", "account-check"), this.now) : record.kind === "codex-provider" ? await this.checkCodexProvider(record, secret) : await checkApiAccount(record, secret, this.now);
+    }
+    if (!record.legacy) {
+      const file = readAccountsFileV2(this.home);
+      if (file.accounts[accountId]) {
+        file.accounts[accountId].check = check;
+        writeAccountsFile(this.home, file);
+        this.changed();
+      }
+      return this.summary(accountId);
+    }
+    return { ...this.summary(accountId), status: check.status, checkedAt: check.at, ...check.detail ? { statusDetail: check.detail } : {} };
+  }
+  async checkCodexProvider(record, secret) {
+    const base = record.provider ? readCodexProviders(this.env).find((p) => p.id === record.provider) : void 0;
+    const baseUrl = record.baseUrl ?? base?.baseUrl;
+    if (!baseUrl) return { status: "unverified", at: this.now(), detail: `provider "${record.provider}" is not in the machine's Codex config.toml` };
+    const headers = {};
+    const raw = base?.table.http_headers;
+    if (raw && typeof raw === "object") {
+      for (const [k, v] of Object.entries(raw)) if (typeof v === "string") headers[k] = v;
+    }
+    return checkCodexProviderAccount(baseUrl, secret, headers, this.now);
+  }
+  // ---- remote login (claude setup-token) -------------------------------------
+  loginManager() {
+    if (this.logins) return this.logins;
+    const spawnPty = this.deps.spawnPty;
+    if (!spawnPty) throw new AccountError("internal", "remote login is not available in this process");
+    this.logins = new SetupTokenLoginManager({
+      spawnPty,
+      env: this.env,
+      newId: () => randomUUID(),
+      now: this.now,
+      onToken: async (loginId, token) => {
+        const target = this.loginTargets.get(loginId) ?? {};
+        this.loginTargets.delete(loginId);
+        return this.storeSubscriptionToken(token, target);
+      }
+    });
+    return this.logins;
+  }
+  /** Also the terminal path (`very-happy account login`). */
+  storeSubscriptionToken(token, target) {
+    const file = readAccountsFileV2(this.home);
+    const now = this.now();
+    let id = target.accountId;
+    if (id) {
+      const record = file.accounts[id];
+      if (!record || record.kind !== "claude-subscription") throw new AccountError("not-found", `no subscription account "${id}"`);
+      record.expiresAt = now + SUBSCRIPTION_TOKEN_TTL_MS;
+      record.check = { status: "ok", at: now };
+    } else {
+      const label = target.label?.trim() || "Claude";
+      id = newAccountId(label, "claude-subscription", Object.keys(readAccounts(this.home).accounts));
+      file.accounts[id] = { label, agent: "claude", kind: "claude-subscription", createdAt: now, expiresAt: now + SUBSCRIPTION_TOKEN_TTL_MS, check: { status: "ok", at: now } };
+    }
+    writeAccountSecret(this.home, id, token);
+    writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(id);
+  }
+  async loginStart(params) {
+    const parsed = AgentProfileLoginStartRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    if (parsed.data.agent === "codex") return this.codexLoginStart(parsed.data.accountId, parsed.data.label);
+    const { accountId, label } = parsed.data;
+    if (accountId) {
+      const record = readAccounts(this.home).accounts[accountId];
+      if (!record || record.kind !== "claude-subscription") throw new AccountError("not-found", `no subscription account "${accountId}"`);
+    } else if (!label) {
+      throw new AccountError("invalid-params", "label is required for a new account");
+    }
+    let status;
+    try {
+      status = await this.loginManager().start();
+    } catch (error) {
+      const code = error.code ?? "setup-token-failed";
+      throw new AccountError(code, error instanceof Error ? error.message : String(error));
+    }
+    this.loginTargets.set(status.loginId, { accountId, label });
+    return { ...status, flow: "paste-code" };
+  }
+  // ---- remote login (Codex ChatGPT device code) — B-850b ----------------------
+  codexLoginManager() {
+    if (this.codexLogins) return this.codexLogins;
+    this.codexLogins = new CodexDeviceLoginManager({
+      spawnRpc: this.deps.spawnCodexRpc ?? spawnCodexRpc,
+      env: this.env,
+      newId: () => randomUUID(),
+      now: this.now,
+      onSuccess: async (loginId, info) => {
+        const target = this.codexLoginTargets.get(loginId);
+        this.codexLoginTargets.delete(loginId);
+        if (!target) throw new AccountError("internal", "sign-in target lost");
+        return this.storeChatgptAccount(target, info);
+      },
+      onEnd: (loginId, state) => {
+        const target = this.codexLoginTargets.get(loginId);
+        if (state === "succeeded" || !target) return;
+        this.codexLoginTargets.delete(loginId);
+        if (target.isNew) removeAccountSecret(this.home, target.accountId);
+      }
+    });
+    return this.codexLogins;
+  }
+  /** loginId → the account a Codex sign-in writes. */
+  codexLoginTargets = /* @__PURE__ */ new Map();
+  async codexLoginStart(accountId, label) {
+    const accounts = readAccounts(this.home).accounts;
+    let target;
+    if (accountId) {
+      const record = accounts[accountId];
+      if (!record || record.kind !== "codex-chatgpt") throw new AccountError("not-found", `no ChatGPT account "${accountId}"`);
+      target = { accountId, isNew: false };
+    } else {
+      const taken = [...Object.keys(accounts), ...[...this.codexLoginTargets.values()].map((t) => t.accountId)];
+      target = { accountId: newAccountId(label ?? "", "codex-chatgpt", taken), ...label ? { label } : {}, isNew: true };
+    }
+    const manager = this.codexLoginManager();
+    const busy = manager.activeLoginId();
+    if (busy) throw new AccountError("login-busy", "another Codex sign-in is in progress");
+    const codexHome = accountCodexHomePath(this.home, target.accountId);
+    syncCodexOverlay(codexHome, baseCodexHome(this.env), this.now());
+    const status = await manager.start(codexHome);
+    if (status.state === "failed" || status.state === "canceled" || status.state === "expired") {
+      if (target.isNew) removeAccountSecret(this.home, target.accountId);
+      return status;
+    }
+    this.codexLoginTargets.set(status.loginId, target);
+    return status;
+  }
+  /** A finished ChatGPT sign-in → the account record (new) or its refreshed status (re-login). */
+  storeChatgptAccount(target, info) {
+    const file = readAccountsFileV2(this.home);
+    const now = this.now();
+    const existing = file.accounts[target.accountId];
+    if (existing && existing.kind === "codex-chatgpt") {
+      existing.check = { status: "ok", at: now };
+      if (info.email) existing.email = info.email;
+      if (info.planType) existing.planType = info.planType;
+    } else {
+      file.accounts[target.accountId] = {
+        label: target.label?.trim() || info.email || "ChatGPT",
+        agent: "codex",
+        kind: "codex-chatgpt",
+        createdAt: now,
+        check: { status: "ok", at: now },
+        ...info.email ? { email: info.email } : {},
+        ...info.planType ? { planType: info.planType } : {}
+      };
+    }
+    writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(target.accountId);
+  }
+  loginOp(fn, loginId, codex) {
+    try {
+      if (codex && typeof loginId === "string" && this.codexLogins?.has(loginId)) return codex(this.codexLogins);
+      return fn(this.loginManager());
+    } catch (error) {
+      const code = error.code ?? "internal";
+      throw new AccountError(code, error instanceof Error ? error.message : String(error));
+    }
+  }
+  loginSubmit(params) {
+    const parsed = AgentProfileLoginSubmitRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", "loginId and code are required");
+    if (this.codexLogins?.has(parsed.data.loginId)) throw new AccountError("invalid-params", "a Codex device-code sign-in has nothing to submit: enter the code on the sign-in page");
+    return this.loginOp((m) => m.submit(parsed.data.loginId, parsed.data.code));
+  }
+  loginStatus(loginId) {
+    if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
+    return this.loginOp((m) => m.status(loginId), loginId, (m) => m.status(loginId));
+  }
+  loginCancel(loginId) {
+    if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
+    const status = this.loginOp((m) => m.cancel(loginId), loginId, (m) => m.cancel(loginId));
+    this.loginTargets.delete(loginId);
+    return status;
+  }
+  dispose() {
+    this.logins?.dispose();
+    this.codexLogins?.dispose();
+  }
+  /** B-850d2: waits until finished Codex sign-ins are cleaned up (their app-server gone, a canceled new account's overlay removed). */
+  settleLogins() {
+    return this.codexLogins?.settle() ?? Promise.resolve();
+  }
+  // ---- sessions --------------------------------------------------------------
+  /** Validates and writes a session binding (no restart). */
+  writeBinding(sessionId, accountId, model) {
+    if (accountId !== null) {
+      const record = readAccounts(this.home).accounts[accountId];
+      if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+      const agent = this.deps.sessionAgent?.(sessionId);
+      if (agent && agent !== record.agent) throw new AccountError("invalid-params", `"${accountId}" is a ${record.agent} account; this session runs ${agent}`);
+      if (model !== void 0) {
+        if (record.kind === "claude-subscription") throw new AccountError("invalid-params", "model applies to API and Codex accounts only");
+        if (record.models && record.models.length > 0 && !record.models.includes(model)) {
+          throw new AccountError("invalid-params", `model "${model}" is not in ${accountId}'s models (${record.models.join(", ")})`);
+        }
+      }
+    } else if (model !== void 0) {
+      throw new AccountError("invalid-params", "model cannot be set for the machine login");
+    }
+    writeSessionBinding(this.home, sessionId, { account: accountId, ...model ? { model } : {} });
+  }
+  async bind(params) {
+    const parsed = AgentProfileBindRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    const { sessionId, accountId, model, restart } = parsed.data;
+    const previous = readSessionBindingV2(this.home, sessionId);
+    this.writeBinding(sessionId, accountId, model);
+    this.changed();
+    if (restart === false || !this.deps.restartSession) return { bound: true, restart: "skipped" };
+    const outcome = await Promise.race([
+      this.deps.restartSession(sessionId),
+      new Promise((r) => setTimeout(() => r("pending"), BIND_RESTART_BUDGET_MS).unref?.())
+    ]);
+    if (outcome === "pending") return { bound: true, restart: "pending" };
+    if (outcome.ok) return { bound: true, restart: "done" };
+    if (outcome.stillRunning) {
+      writeSessionBinding(this.home, sessionId, previous);
+      this.changed();
+      return { bound: false, rolledBack: true, restart: "failed", error: outcome.error };
+    }
+    if (outcome.notRunning) return { bound: true, restart: "skipped", error: outcome.error };
+    return { bound: true, restart: "failed", error: outcome.error };
+  }
+  /** B-850d: the account a session is bound to (null = machine login, also when unbound). */
+  sessionAccount(sessionId) {
+    return readSessionBindings(this.home)[sessionId]?.account ?? null;
+  }
+  /**
+   * Spawn-time choice → the account a NEW session starts on.
+   *   undefined → the machine default for this agent (none = machine login)
+   *   null      → machine login
+   *   id        → that account; must exist and be usable (Q3: never fall back)
+   */
+  resolveSpawnAccount(agent, requested) {
+    if (requested !== void 0 && requested !== null && typeof requested !== "string") {
+      throw new AccountError("invalid-params", "agentProfileId must be a string or null");
+    }
+    const file = readAccounts(this.home);
+    const id = requested === void 0 ? file.defaults[agent] ?? null : requested;
+    if (id === null || id === "") return null;
+    const record = file.accounts[id];
+    if (!record) throw new AccountError("agent-profile-unavailable", `agent-profile-unavailable:missing: no account "${id}" on this machine`);
+    if (record.agent !== agent) throw new AccountError("agent-profile-unavailable", `agent-profile-unavailable:agent-mismatch: "${id}" is a ${record.agent} account`);
+    const { status } = summarizeAccount(this.home, id, record, defaultSecretProbe(this.env), this.now());
+    if (status === "missing-secret" || status === "expired" || status === "invalid") {
+      throw new AccountError("agent-profile-unavailable", `agent-profile-unavailable:${status}: account "${record.label}"`);
+    }
+    return id;
+  }
+}
+
+export { AccountService as A, AccountError as a, bindResultMessages as b, localRestartFailure as l };