very-happy-cli 0.2.192 → 0.2.193

package/dist/lib.d.cts

@@ -199,25 +199,6 @@ declare const sessionStreamFrameSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     t: z.ZodLiteral<"turn-end">;
 }, z.core.$strip>], "t">;
 type SessionStreamFrame = z.infer<typeof sessionStreamFrameSchema>;
-
-/**
- * Runtime context occupancy, never cumulative billing. null after compaction is unknown.
- *
- * B-727 (specs/2026-10-pi-context-usage.md): `contextWindow` stays required so
- * older webs keep rendering; `windowSource` says whether it may be used as a
- * denominator. Free strings + read whitelist (iron rule 14): an unknown value
- * must not make the whole agentState fail to parse.
- */
-declare const ContextUsageSchema: z$1.ZodObject<{
-    source: z$1.ZodLiteral<"pi">;
-    tokens: z$1.ZodNullable<z$1.ZodNumber>;
-    contextWindow: z$1.ZodNumber;
-    updatedAt: z$1.ZodNumber;
-    windowSource: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
-    model: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
-    compactedAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodNumber>>;
-}, z$1.core.$strip>;
-type ContextUsage = z$1.infer<typeof ContextUsageSchema>;
 declare const AgentProfileSummarySchema: z$1.ZodObject<{
     id: z$1.ZodString;
     label: z$1.ZodString;
@@ -233,6 +214,9 @@ declare const AgentProfileSummarySchema: z$1.ZodObject<{
     keySource: z$1.ZodOptional<z$1.ZodString>;
     keyRef: z$1.ZodOptional<z$1.ZodString>;
     legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+    provider: z$1.ZodOptional<z$1.ZodString>;
+    email: z$1.ZodOptional<z$1.ZodString>;
+    planType: z$1.ZodOptional<z$1.ZodString>;
 }, z$1.core.$strip>;
 type AgentProfileSummary = z$1.infer<typeof AgentProfileSummarySchema>;
 /** `daemonState.agentProfiles` — also the result of `agent-profile-list`. */
@@ -254,8 +238,19 @@ declare const AgentProfilesStateSchema: z$1.ZodObject<{
         keySource: z$1.ZodOptional<z$1.ZodString>;
         keyRef: z$1.ZodOptional<z$1.ZodString>;
         legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+        provider: z$1.ZodOptional<z$1.ZodString>;
+        email: z$1.ZodOptional<z$1.ZodString>;
+        planType: z$1.ZodOptional<z$1.ZodString>;
     }, z$1.core.$strip>>;
     defaults: z$1.ZodRecord<z$1.ZodString, z$1.ZodString>;
+    kinds: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+    codexProviders: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+        id: z$1.ZodString;
+        name: z$1.ZodOptional<z$1.ZodString>;
+        baseUrl: z$1.ZodOptional<z$1.ZodString>;
+        envKey: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>>>;
+    features: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
 }, z$1.core.$strip>;
 type AgentProfilesState = z$1.infer<typeof AgentProfilesStateSchema>;
 /**
@@ -277,12 +272,16 @@ declare const SessionAgentProfileSchema: z$1.ZodObject<{
 }, z$1.core.$strip>;
 type SessionAgentProfile = z$1.infer<typeof SessionAgentProfileSchema>;
 /**
- * waiting-code → (submit) → exchanging → succeeded | failed.
- * canceled / expired (10 min without a code) are terminal too.
+ * paste-code (Claude):  waiting-code → (submit) → exchanging → succeeded | failed.
+ * device-code (Codex):  waiting-code (the user enters `userCode` at `url`; nothing
+ *                       to submit) → succeeded | failed.
+ * canceled / expired (Claude 10 min without a code, Codex 15 min) are terminal too.
  */
 declare const AgentProfileLoginStatusSchema: z$1.ZodObject<{
     loginId: z$1.ZodString;
     state: z$1.ZodString;
+    flow: z$1.ZodOptional<z$1.ZodString>;
+    userCode: z$1.ZodOptional<z$1.ZodString>;
     url: z$1.ZodOptional<z$1.ZodString>;
     expiresAt: z$1.ZodOptional<z$1.ZodNumber>;
     account: z$1.ZodOptional<z$1.ZodObject<{
@@ -300,6 +299,9 @@ declare const AgentProfileLoginStatusSchema: z$1.ZodObject<{
         keySource: z$1.ZodOptional<z$1.ZodString>;
         keyRef: z$1.ZodOptional<z$1.ZodString>;
         legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+        provider: z$1.ZodOptional<z$1.ZodString>;
+        email: z$1.ZodOptional<z$1.ZodString>;
+        planType: z$1.ZodOptional<z$1.ZodString>;
     }, z$1.core.$strip>>;
     error: z$1.ZodOptional<z$1.ZodString>;
 }, z$1.core.$strip>;
@@ -326,6 +328,25 @@ type AgentProfileBindResult = {
     error?: string;
 };
 
+/**
+ * Runtime context occupancy, never cumulative billing. null after compaction is unknown.
+ *
+ * B-727 (specs/2026-10-pi-context-usage.md): `contextWindow` stays required so
+ * older webs keep rendering; `windowSource` says whether it may be used as a
+ * denominator. Free strings + read whitelist (iron rule 14): an unknown value
+ * must not make the whole agentState fail to parse.
+ */
+declare const ContextUsageSchema: z$1.ZodObject<{
+    source: z$1.ZodLiteral<"pi">;
+    tokens: z$1.ZodNullable<z$1.ZodNumber>;
+    contextWindow: z$1.ZodNumber;
+    updatedAt: z$1.ZodNumber;
+    windowSource: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+    model: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+    compactedAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodNumber>>;
+}, z$1.core.$strip>;
+type ContextUsage = z$1.infer<typeof ContextUsageSchema>;
+
 declare const CLAUDE_AUTH_PROBE_VERSION: 1;
 type ClaudeAuthStatus = 'ok' | 'not-logged-in' | 'unknown' | 'error' | 'claude-missing';
 type ClaudeAuthDiagnosis = 'keychain-empty-item' | 'store-divergence' | 'no-credentials' | 'credentials-rejected' | 'sdk-binary-missing' | 'probe-timeout' | 'probe-crash';
@@ -721,8 +742,19 @@ declare const DaemonStateSchema: z$1.ZodObject<{
             keySource: z$1.ZodOptional<z$1.ZodString>;
             keyRef: z$1.ZodOptional<z$1.ZodString>;
             legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+            provider: z$1.ZodOptional<z$1.ZodString>;
+            email: z$1.ZodOptional<z$1.ZodString>;
+            planType: z$1.ZodOptional<z$1.ZodString>;
         }, z$1.core.$strip>>;
         defaults: z$1.ZodRecord<z$1.ZodString, z$1.ZodString>;
+        kinds: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        codexProviders: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            id: z$1.ZodString;
+            name: z$1.ZodOptional<z$1.ZodString>;
+            baseUrl: z$1.ZodOptional<z$1.ZodString>;
+            envKey: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$strip>>>;
+        features: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
     }, z$1.core.$strip>>;
     rateLimits: z$1.ZodOptional<z$1.ZodObject<{
         v: z$1.ZodLiteral<1>;
@@ -2038,18 +2070,27 @@ type AccountCheck = {
     at: number;
     detail?: string;
 };
+type AccountAgent = 'claude' | 'codex';
+type AccountKind = 'claude-subscription' | 'claude-api' | 'codex-chatgpt' | 'codex-provider';
 type AccountRecord = {
     label: string;
-    agent: 'claude';
-    kind: 'claude-subscription' | 'claude-api';
+    agent: AccountAgent;
+    kind: AccountKind;
     createdAt: number;
-    /** claude-api */
+    /** claude-api, codex-provider (overrides the config.toml provider's base_url) */
     baseUrl?: string;
     models?: string[];
     /** B-794b: model id → real context window. */
     contextWindows?: Record<string, number>;
-    /** claude-api: where the key lives. claude-subscription always uses the stored secret. */
+    /** API kinds: where the key lives. claude-subscription always uses the stored secret. */
     key?: AccountKey;
+    /** codex-provider: the `[model_providers.<id>]` of ~/.codex/config.toml it is based on. */
+    provider?: string;
+    /** codex-provider with an own baseUrl: Codex wire API (default responses). */
+    wireApi?: 'responses' | 'chat';
+    /** codex-chatgpt: from `account/read` after sign-in. */
+    email?: string;
+    planType?: string;
     /** claude-subscription: setup-token expiry (1 year after login). */
     expiresAt?: number;
     check?: AccountCheck;
@@ -2057,6 +2098,14 @@ type AccountRecord = {
     legacy?: true;
 };
 
+type CodexRpc = {
+    request: (method: string, params: unknown, timeoutMs?: number) => Promise<any>;
+    onNotification: (cb: (method: string, params: any) => void) => void;
+    onExit: (cb: (code: number | null) => void) => void;
+    close: () => void;
+};
+type SpawnCodexRpc = (codexHome: string, env: Record<string, string>) => CodexRpc;
+
 /** `stillRunning`: the restart failed and the session's old wrapper is alive (on the old credential). */
 type RestartOutcome = {
     ok: true;
@@ -2072,9 +2121,13 @@ type AccountServiceDeps = {
     now?: () => number;
     daemonPid?: number;
     spawnPty?: SpawnPty;
+    /** B-850b: `codex app-server` for ChatGPT sign-in / checks (test seam). */
+    spawnCodexRpc?: SpawnCodexRpc;
     restartSession?: (sessionId: string) => Promise<RestartOutcome>;
     /** Called after every write so the daemon can republish its state. */
     onChanged?: () => void;
+    /** B-850b: the agent a session runs (from its tracked flavor); unknown → no check. */
+    sessionAgent?: (sessionId: string) => string | null | undefined;
     /** Test seam for the 1-token checks. */
     check?: (record: AccountRecord, secret: string) => Promise<AccountCheck>;
 };
@@ -2084,6 +2137,7 @@ declare class AccountService {
     private readonly env;
     private readonly now;
     private logins;
+    private codexLogins;
     /** loginId → account to (re)write when its token arrives. */
     private readonly loginTargets;
     constructor(deps: AccountServiceDeps);
@@ -2110,6 +2164,7 @@ declare class AccountService {
     setDefault(agent: unknown, accountId: unknown): AgentProfilesState;
     private readSecretFor;
     test(accountId: unknown): Promise<AgentProfileSummary>;
+    private checkCodexProvider;
     private loginManager;
     /** Also the terminal path (`very-happy account login`). */
     storeSubscriptionToken(token: string, target: {
@@ -2117,14 +2172,31 @@ declare class AccountService {
         label?: string;
     }): AgentProfileSummary;
     loginStart(params: unknown): Promise<AgentProfileLoginStatus>;
+    private codexLoginManager;
+    /** loginId → the account a Codex sign-in writes. */
+    private readonly codexLoginTargets;
+    private codexLoginStart;
+    /** A finished ChatGPT sign-in → the account record (new) or its refreshed status (re-login). */
+    storeChatgptAccount(target: {
+        accountId: string;
+        label?: string;
+        isNew: boolean;
+    }, info: {
+        email?: string;
+        planType?: string;
+    }): AgentProfileSummary;
     private loginOp;
     loginSubmit(params: unknown): AgentProfileLoginStatus;
     loginStatus(loginId: unknown): AgentProfileLoginStatus;
     loginCancel(loginId: unknown): AgentProfileLoginStatus;
     dispose(): void;
+    /** B-850d2: waits until finished Codex sign-ins are cleaned up (their app-server gone, a canceled new account's overlay removed). */
+    settleLogins(): Promise<void>;
     /** Validates and writes a session binding (no restart). */
     writeBinding(sessionId: string, accountId: string | null, model?: string): void;
     bind(params: unknown): Promise<AgentProfileBindResult>;
+    /** B-850d: the account a session is bound to (null = machine login, also when unbound). */
+    sessionAccount(sessionId: string): string | null;
     /**
      * Spawn-time choice → the account a NEW session starts on.
      *   undefined → the machine default for this agent (none = machine login)

package/dist/lib.d.mts

@@ -199,25 +199,6 @@ declare const sessionStreamFrameSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     t: z.ZodLiteral<"turn-end">;
 }, z.core.$strip>], "t">;
 type SessionStreamFrame = z.infer<typeof sessionStreamFrameSchema>;
-
-/**
- * Runtime context occupancy, never cumulative billing. null after compaction is unknown.
- *
- * B-727 (specs/2026-10-pi-context-usage.md): `contextWindow` stays required so
- * older webs keep rendering; `windowSource` says whether it may be used as a
- * denominator. Free strings + read whitelist (iron rule 14): an unknown value
- * must not make the whole agentState fail to parse.
- */
-declare const ContextUsageSchema: z$1.ZodObject<{
-    source: z$1.ZodLiteral<"pi">;
-    tokens: z$1.ZodNullable<z$1.ZodNumber>;
-    contextWindow: z$1.ZodNumber;
-    updatedAt: z$1.ZodNumber;
-    windowSource: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
-    model: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
-    compactedAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodNumber>>;
-}, z$1.core.$strip>;
-type ContextUsage = z$1.infer<typeof ContextUsageSchema>;
 declare const AgentProfileSummarySchema: z$1.ZodObject<{
     id: z$1.ZodString;
     label: z$1.ZodString;
@@ -233,6 +214,9 @@ declare const AgentProfileSummarySchema: z$1.ZodObject<{
     keySource: z$1.ZodOptional<z$1.ZodString>;
     keyRef: z$1.ZodOptional<z$1.ZodString>;
     legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+    provider: z$1.ZodOptional<z$1.ZodString>;
+    email: z$1.ZodOptional<z$1.ZodString>;
+    planType: z$1.ZodOptional<z$1.ZodString>;
 }, z$1.core.$strip>;
 type AgentProfileSummary = z$1.infer<typeof AgentProfileSummarySchema>;
 /** `daemonState.agentProfiles` — also the result of `agent-profile-list`. */
@@ -254,8 +238,19 @@ declare const AgentProfilesStateSchema: z$1.ZodObject<{
         keySource: z$1.ZodOptional<z$1.ZodString>;
         keyRef: z$1.ZodOptional<z$1.ZodString>;
         legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+        provider: z$1.ZodOptional<z$1.ZodString>;
+        email: z$1.ZodOptional<z$1.ZodString>;
+        planType: z$1.ZodOptional<z$1.ZodString>;
     }, z$1.core.$strip>>;
     defaults: z$1.ZodRecord<z$1.ZodString, z$1.ZodString>;
+    kinds: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+    codexProviders: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+        id: z$1.ZodString;
+        name: z$1.ZodOptional<z$1.ZodString>;
+        baseUrl: z$1.ZodOptional<z$1.ZodString>;
+        envKey: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>>>;
+    features: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
 }, z$1.core.$strip>;
 type AgentProfilesState = z$1.infer<typeof AgentProfilesStateSchema>;
 /**
@@ -277,12 +272,16 @@ declare const SessionAgentProfileSchema: z$1.ZodObject<{
 }, z$1.core.$strip>;
 type SessionAgentProfile = z$1.infer<typeof SessionAgentProfileSchema>;
 /**
- * waiting-code → (submit) → exchanging → succeeded | failed.
- * canceled / expired (10 min without a code) are terminal too.
+ * paste-code (Claude):  waiting-code → (submit) → exchanging → succeeded | failed.
+ * device-code (Codex):  waiting-code (the user enters `userCode` at `url`; nothing
+ *                       to submit) → succeeded | failed.
+ * canceled / expired (Claude 10 min without a code, Codex 15 min) are terminal too.
  */
 declare const AgentProfileLoginStatusSchema: z$1.ZodObject<{
     loginId: z$1.ZodString;
     state: z$1.ZodString;
+    flow: z$1.ZodOptional<z$1.ZodString>;
+    userCode: z$1.ZodOptional<z$1.ZodString>;
     url: z$1.ZodOptional<z$1.ZodString>;
     expiresAt: z$1.ZodOptional<z$1.ZodNumber>;
     account: z$1.ZodOptional<z$1.ZodObject<{
@@ -300,6 +299,9 @@ declare const AgentProfileLoginStatusSchema: z$1.ZodObject<{
         keySource: z$1.ZodOptional<z$1.ZodString>;
         keyRef: z$1.ZodOptional<z$1.ZodString>;
         legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+        provider: z$1.ZodOptional<z$1.ZodString>;
+        email: z$1.ZodOptional<z$1.ZodString>;
+        planType: z$1.ZodOptional<z$1.ZodString>;
     }, z$1.core.$strip>>;
     error: z$1.ZodOptional<z$1.ZodString>;
 }, z$1.core.$strip>;
@@ -326,6 +328,25 @@ type AgentProfileBindResult = {
     error?: string;
 };
 
+/**
+ * Runtime context occupancy, never cumulative billing. null after compaction is unknown.
+ *
+ * B-727 (specs/2026-10-pi-context-usage.md): `contextWindow` stays required so
+ * older webs keep rendering; `windowSource` says whether it may be used as a
+ * denominator. Free strings + read whitelist (iron rule 14): an unknown value
+ * must not make the whole agentState fail to parse.
+ */
+declare const ContextUsageSchema: z$1.ZodObject<{
+    source: z$1.ZodLiteral<"pi">;
+    tokens: z$1.ZodNullable<z$1.ZodNumber>;
+    contextWindow: z$1.ZodNumber;
+    updatedAt: z$1.ZodNumber;
+    windowSource: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+    model: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+    compactedAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodNumber>>;
+}, z$1.core.$strip>;
+type ContextUsage = z$1.infer<typeof ContextUsageSchema>;
+
 declare const CLAUDE_AUTH_PROBE_VERSION: 1;
 type ClaudeAuthStatus = 'ok' | 'not-logged-in' | 'unknown' | 'error' | 'claude-missing';
 type ClaudeAuthDiagnosis = 'keychain-empty-item' | 'store-divergence' | 'no-credentials' | 'credentials-rejected' | 'sdk-binary-missing' | 'probe-timeout' | 'probe-crash';
@@ -721,8 +742,19 @@ declare const DaemonStateSchema: z$1.ZodObject<{
             keySource: z$1.ZodOptional<z$1.ZodString>;
             keyRef: z$1.ZodOptional<z$1.ZodString>;
             legacy: z$1.ZodOptional<z$1.ZodBoolean>;
+            provider: z$1.ZodOptional<z$1.ZodString>;
+            email: z$1.ZodOptional<z$1.ZodString>;
+            planType: z$1.ZodOptional<z$1.ZodString>;
         }, z$1.core.$strip>>;
         defaults: z$1.ZodRecord<z$1.ZodString, z$1.ZodString>;
+        kinds: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+        codexProviders: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+            id: z$1.ZodString;
+            name: z$1.ZodOptional<z$1.ZodString>;
+            baseUrl: z$1.ZodOptional<z$1.ZodString>;
+            envKey: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$strip>>>;
+        features: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
     }, z$1.core.$strip>>;
     rateLimits: z$1.ZodOptional<z$1.ZodObject<{
         v: z$1.ZodLiteral<1>;
@@ -2038,18 +2070,27 @@ type AccountCheck = {
     at: number;
     detail?: string;
 };
+type AccountAgent = 'claude' | 'codex';
+type AccountKind = 'claude-subscription' | 'claude-api' | 'codex-chatgpt' | 'codex-provider';
 type AccountRecord = {
     label: string;
-    agent: 'claude';
-    kind: 'claude-subscription' | 'claude-api';
+    agent: AccountAgent;
+    kind: AccountKind;
     createdAt: number;
-    /** claude-api */
+    /** claude-api, codex-provider (overrides the config.toml provider's base_url) */
     baseUrl?: string;
     models?: string[];
     /** B-794b: model id → real context window. */
     contextWindows?: Record<string, number>;
-    /** claude-api: where the key lives. claude-subscription always uses the stored secret. */
+    /** API kinds: where the key lives. claude-subscription always uses the stored secret. */
     key?: AccountKey;
+    /** codex-provider: the `[model_providers.<id>]` of ~/.codex/config.toml it is based on. */
+    provider?: string;
+    /** codex-provider with an own baseUrl: Codex wire API (default responses). */
+    wireApi?: 'responses' | 'chat';
+    /** codex-chatgpt: from `account/read` after sign-in. */
+    email?: string;
+    planType?: string;
     /** claude-subscription: setup-token expiry (1 year after login). */
     expiresAt?: number;
     check?: AccountCheck;
@@ -2057,6 +2098,14 @@ type AccountRecord = {
     legacy?: true;
 };
 
+type CodexRpc = {
+    request: (method: string, params: unknown, timeoutMs?: number) => Promise<any>;
+    onNotification: (cb: (method: string, params: any) => void) => void;
+    onExit: (cb: (code: number | null) => void) => void;
+    close: () => void;
+};
+type SpawnCodexRpc = (codexHome: string, env: Record<string, string>) => CodexRpc;
+
 /** `stillRunning`: the restart failed and the session's old wrapper is alive (on the old credential). */
 type RestartOutcome = {
     ok: true;
@@ -2072,9 +2121,13 @@ type AccountServiceDeps = {
     now?: () => number;
     daemonPid?: number;
     spawnPty?: SpawnPty;
+    /** B-850b: `codex app-server` for ChatGPT sign-in / checks (test seam). */
+    spawnCodexRpc?: SpawnCodexRpc;
     restartSession?: (sessionId: string) => Promise<RestartOutcome>;
     /** Called after every write so the daemon can republish its state. */
     onChanged?: () => void;
+    /** B-850b: the agent a session runs (from its tracked flavor); unknown → no check. */
+    sessionAgent?: (sessionId: string) => string | null | undefined;
     /** Test seam for the 1-token checks. */
     check?: (record: AccountRecord, secret: string) => Promise<AccountCheck>;
 };
@@ -2084,6 +2137,7 @@ declare class AccountService {
     private readonly env;
     private readonly now;
     private logins;
+    private codexLogins;
     /** loginId → account to (re)write when its token arrives. */
     private readonly loginTargets;
     constructor(deps: AccountServiceDeps);
@@ -2110,6 +2164,7 @@ declare class AccountService {
     setDefault(agent: unknown, accountId: unknown): AgentProfilesState;
     private readSecretFor;
     test(accountId: unknown): Promise<AgentProfileSummary>;
+    private checkCodexProvider;
     private loginManager;
     /** Also the terminal path (`very-happy account login`). */
     storeSubscriptionToken(token: string, target: {
@@ -2117,14 +2172,31 @@ declare class AccountService {
         label?: string;
     }): AgentProfileSummary;
     loginStart(params: unknown): Promise<AgentProfileLoginStatus>;
+    private codexLoginManager;
+    /** loginId → the account a Codex sign-in writes. */
+    private readonly codexLoginTargets;
+    private codexLoginStart;
+    /** A finished ChatGPT sign-in → the account record (new) or its refreshed status (re-login). */
+    storeChatgptAccount(target: {
+        accountId: string;
+        label?: string;
+        isNew: boolean;
+    }, info: {
+        email?: string;
+        planType?: string;
+    }): AgentProfileSummary;
     private loginOp;
     loginSubmit(params: unknown): AgentProfileLoginStatus;
     loginStatus(loginId: unknown): AgentProfileLoginStatus;
     loginCancel(loginId: unknown): AgentProfileLoginStatus;
     dispose(): void;
+    /** B-850d2: waits until finished Codex sign-ins are cleaned up (their app-server gone, a canceled new account's overlay removed). */
+    settleLogins(): Promise<void>;
     /** Validates and writes a session binding (no restart). */
     writeBinding(sessionId: string, accountId: string | null, model?: string): void;
     bind(params: unknown): Promise<AgentProfileBindResult>;
+    /** B-850d: the account a session is bound to (null = machine login, also when unbound). */
+    sessionAccount(sessionId: string): string | null;
     /**
      * Spawn-time choice → the account a NEW session starts on.
      *   undefined → the machine default for this agent (none = machine login)

package/dist/lib.mjs

@@ -1,9 +1,9 @@
-export { A as ApiClient, a as ApiSessionClient } from './api-_LeBScjg.mjs';
-export { l as logger } from './logger-Fd_rNvgd.mjs';
-export { c as configuration } from './configuration-IhRiLDVe.mjs';
+export { A as ApiClient, a as ApiSessionClient } from './api-DUfunY3x.mjs';
+export { l as logger } from './logger-JV7-4Q_6.mjs';
+export { c as configuration } from './configuration-ThKBP_zY.mjs';
 export { R as RawJSONLinesSchema } from './types-CkqAACXx.mjs';
 import 'axios';
-import './lidState-CZOXXdzv.mjs';
+import './lidState-B6yYKjNK.mjs';
 import './authRelay-DhQhkBvX.mjs';
 import 'node:crypto';
 import 'tweetnacl';
@@ -11,14 +11,14 @@ import 'os';
 import 'child_process';
 import 'node:events';
 import 'socket.io-client';
-import './pushNotifications-DkQ0yvFs.mjs';
+import './pushNotifications-BbE-qV9I.mjs';
 import 'zod';
-import './index-DYD3GM1m.mjs';
+import './index-D1YnIih6.mjs';
 import '@paralleldrive/cuid2';
 import './contentLogMetadata-BlWI0egu.mjs';
 import './limits-DIo7rEBR.mjs';
-import './time-bzmet4s5.mjs';
-import './registerCommonHandlers-yQ7Ru-l0.mjs';
+import './time-Cw0liIqB.mjs';
+import './registerCommonHandlers-Cj3Nl9y-.mjs';
 import 'util';
 import 'fs/promises';
 import 'crypto';
@@ -26,14 +26,14 @@ import 'path';
 import 'cross-spawn';
 import './projectPath-BTBIMB57.mjs';
 import 'url';
-import './sync-JoEZKRo8.mjs';
+import './sync-BP6vnxVP.mjs';
 import './backgroundTaskActivity-8PdPxrvy.mjs';
-import './controlClient-8ILulwjc.mjs';
-import './persistence-DWcHe035.mjs';
+import './controlClient-Ckl8N1MS.mjs';
+import './persistence-Cg4sfjQV.mjs';
 import 'node:fs/promises';
 import 'node:fs';
 import 'chalk';
 import 'node:util';
 import 'node:path';
 import 'node:os';
-import './package-6KkRAops.mjs';
+import './package-Bw3H6VLn.mjs';

package/dist/{lidState-CZOXXdzv.mjs → lidState-B6yYKjNK.mjs}

@@ -1,4 +1,4 @@
-import { l as logger } from './logger-Fd_rNvgd.mjs';
+import { l as logger } from './logger-JV7-4Q_6.mjs';
 import { e as encodeBase64, g as encrypt, h as decrypt, d as decodeBase64 } from './authRelay-DhQhkBvX.mjs';
 import os from 'os';
 import { execSync } from 'child_process';

package/dist/{lidState-DqoN7zH4.cjs → lidState-B_v6qgfE.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var logger = require('./logger-8su64lqR.cjs');
+var logger = require('./logger-CX3x2eI4.cjs');
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
 var os = require('os');
 var child_process = require('child_process');

package/dist/{localHappyAgentAuth-YHxDZ4x4.mjs → localHappyAgentAuth-KRlg_aI0.mjs}

@@ -4,7 +4,7 @@ import { join } from 'node:path';
 import tweetnacl from 'tweetnacl';
 import { z } from 'zod';
 import { c as credentialRelayProblem, d as decodeBase64 } from './authRelay-DhQhkBvX.mjs';
-import { c as configuration } from './configuration-IhRiLDVe.mjs';
+import { c as configuration } from './configuration-ThKBP_zY.mjs';
 
 const AgentCredentialsSchema = z.object({
   token: z.string().min(1),

package/dist/{localHappyAgentAuth-BnGCpHRX.cjs → localHappyAgentAuth-jJH0n67S.cjs}

@@ -6,7 +6,7 @@ var path = require('node:path');
 var tweetnacl = require('tweetnacl');
 var z = require('zod');
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
-var configuration = require('./configuration-CXEVKAyF.cjs');
+var configuration = require('./configuration-BBK0rmmj.cjs');
 
 const AgentCredentialsSchema = z.z.object({
   token: z.z.string().min(1),

package/dist/{logger-8su64lqR.cjs → logger-CX3x2eI4.cjs}

@@ -2,7 +2,7 @@
 
 var chalk = require('chalk');
 var node_util = require('node:util');
-var configuration = require('./configuration-CXEVKAyF.cjs');
+var configuration = require('./configuration-BBK0rmmj.cjs');
 var node_fs = require('node:fs');
 var path = require('node:path');
 
@@ -238,7 +238,7 @@ async function listDaemonLogFiles(limit = 50) {
       return { file, path: fullPath, modified: stats.mtime };
     }).sort((a, b) => b.modified.getTime() - a.modified.getTime());
     try {
-      const { readDaemonState } = await Promise.resolve().then(function () { return require('./persistence-B4ttN-fR.cjs'); }).then(function (n) { return n.persistence; });
+      const { readDaemonState } = await Promise.resolve().then(function () { return require('./persistence-CsmAgN-C.cjs'); }).then(function (n) { return n.persistence; });
       const state = await readDaemonState();
       if (!state) {
         return logs;

package/dist/{logger-Fd_rNvgd.mjs → logger-JV7-4Q_6.mjs}

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import { inspect } from 'node:util';
-import { d as appendPrivateFileSync, c as configuration } from './configuration-IhRiLDVe.mjs';
+import { d as appendPrivateFileSync, c as configuration } from './configuration-ThKBP_zY.mjs';
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join, basename } from 'node:path';
 
@@ -236,7 +236,7 @@ async function listDaemonLogFiles(limit = 50) {
       return { file, path: fullPath, modified: stats.mtime };
     }).sort((a, b) => b.modified.getTime() - a.modified.getTime());
     try {
-      const { readDaemonState } = await import('./persistence-DWcHe035.mjs').then(function (n) { return n.G; });
+      const { readDaemonState } = await import('./persistence-Cg4sfjQV.mjs').then(function (n) { return n.G; });
       const state = await readDaemonState();
       if (!state) {
         return logs;

package/dist/{machineMetadata-1HIIC7Bc.mjs → machineMetadata-D5-SW9kv.mjs}

@@ -1,9 +1,9 @@
 import os from 'node:os';
-import { p as packageJson } from './package-6KkRAops.mjs';
-import { c as configuration } from './configuration-IhRiLDVe.mjs';
+import { p as packageJson } from './package-Bw3H6VLn.mjs';
+import { c as configuration } from './configuration-ThKBP_zY.mjs';
 import { p as projectPath } from './projectPath-BTBIMB57.mjs';
 import { d as detectCLIAvailability } from './detectCLI-CSGMlV51.mjs';
-import { d as detectResumeSupport } from './localHappyAgentAuth-YHxDZ4x4.mjs';
+import { d as detectResumeSupport } from './localHappyAgentAuth-KRlg_aI0.mjs';
 import { F as FS_MKDIR_CAPABILITY_VERSION } from './fsMkdir-DumgLTzR.mjs';
 
 const TEAM_RETRY_CAPABILITY_VERSION = 2;

package/dist/{machineMetadata-DYXt3p6u.cjs → machineMetadata-DhZuM0iB.cjs}

@@ -1,11 +1,11 @@
 'use strict';
 
 var os = require('node:os');
-var _package = require('./package-iuLlSiSF.cjs');
-var configuration = require('./configuration-CXEVKAyF.cjs');
+var _package = require('./package-uzlvxa5S.cjs');
+var configuration = require('./configuration-BBK0rmmj.cjs');
 var projectPath = require('./projectPath-C3ioB4Bu.cjs');
 var detectCLI = require('./detectCLI-BuYR_Qxe.cjs');
-var localHappyAgentAuth = require('./localHappyAgentAuth-BnGCpHRX.cjs');
+var localHappyAgentAuth = require('./localHappyAgentAuth-jJH0n67S.cjs');
 var fsMkdir = require('./fsMkdir-0K3yENml.cjs');
 
 const TEAM_RETRY_CAPABILITY_VERSION = 2;