very-happy-cli 0.2.192 → 0.2.193

package/dist/{accountService-Dd9uqde2.mjs → accountService-Cd7bnkfd.mjs}

@@ -1,10 +1,12 @@
 import { randomUUID } from 'node:crypto';
 import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { u as AgentProfileAddRequestSchema, v as AgentProfileLoginStartRequestSchema, w as AgentProfileLoginSubmitRequestSchema, x as AgentProfileBindRequestSchema } from './index-DYD3GM1m.mjs';
+import { G as AGENT_PROFILE_FEATURE_LAUNCH, H as AgentProfileAddRequestSchema, I as AgentProfileLoginStartRequestSchema, J as AgentProfileLoginSubmitRequestSchema, K as AgentProfileBindRequestSchema } from './index-D1YnIih6.mjs';
 import { spawn } from 'node:child_process';
-import { A as ACCOUNT_STRIPPED_ENV_KEYS } from './claudeAccountEnv-ON24i0qv.mjs';
-import { h as buildAgentProfilesState, d as defaultSecretProbe, a as readAccounts, s as summarizeAccount, c as readAccountsFileV2, n as newAccountId, i as writeAccountSecret, f as writeAccountsFile, j as sessionsBoundTo, r as readSessionBindings, k as removeAccountSecret, b as accountSecretPath, e as expandHome, l as SUBSCRIPTION_TOKEN_TTL_MS, w as writeSessionBinding, m as readSessionBindingV2 } from './store--XN-7MS0.mjs';
+import { A as ACCOUNT_STRIPPED_ENV_KEYS } from './claudeAccountEnv-BL1pR_37.mjs';
+import { C as CODEX_ALWAYS_STRIPPED_ENV_KEYS, r as readCodexProviders, s as syncCodexOverlay, b as baseCodexHome } from './codexAccount-NOX5pmQf.mjs';
+import { createInterface } from 'node:readline';
+import { h as buildAgentProfilesState, d as defaultSecretProbe, a as readAccounts, s as summarizeAccount, c as readAccountsFileV2, n as newAccountId, i as writeAccountSecret, f as writeAccountsFile, j as sessionsBoundTo, r as readSessionBindings, k as removeAccountSecret, b as accountSecretPath, e as expandHome, l as accountCodexHomePath, m as SUBSCRIPTION_TOKEN_TTL_MS, w as writeSessionBinding, o as readSessionBindingV2 } from './store-Vej_738f.mjs';
 
 const CHECK_TIMEOUT_MS = 2e4;
 const DEFAULT_CHECK_MODEL = "claude-haiku-4-5";
@@ -26,7 +28,7 @@ function lastLine(text) {
   return text.trim().split("\n").filter(Boolean).pop() ?? "";
 }
 function sanitizeDetail(text) {
-  return text.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-\u2026").replace(/\s+/g, " ").trim().slice(0, 200);
+  return text.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-\u2026").replace(/\b(sk|rk)-[A-Za-z0-9_-]{16,}/g, "$1-\u2026").replace(/\s+/g, " ").trim().slice(0, 200);
 }
 async function checkApiAccount(record, key, now = Date.now) {
   const controller = new AbortController();
@@ -90,7 +92,7 @@ async function checkSubscriptionAccount(token, scratchDir, now = Date.now) {
 const LOGIN_CODE_TIMEOUT_MS = 10 * 6e4;
 const LOGIN_URL_TIMEOUT_MS = 2e4;
 const LOGIN_EXCHANGE_TIMEOUT_MS = 6e4;
-const LOGIN_RETAIN_MS = 10 * 6e4;
+const LOGIN_RETAIN_MS$1 = 10 * 6e4;
 function stripAnsi(text) {
   return text.replace(/\x1b\][^\x07\x1b]*(\x07|\x1b\\)/g, "").replace(/\x1b\[[0-9;?<>=]*[ -/]*[@-~]/g, " ").replace(/\x1b[()][A-Za-z0-9]/g, "").replace(/\x1b[=>78]/g, "");
 }
@@ -233,11 +235,244 @@ class SetupTokenLoginManager {
     }
     entry.output = "";
     const loginId_ = loginId;
-    const t = setTimeout(() => this.logins.delete(loginId_), LOGIN_RETAIN_MS);
+    const t = setTimeout(() => this.logins.delete(loginId_), LOGIN_RETAIN_MS$1);
     t.unref?.();
   }
 }
 
+const DEVICE_LOGIN_TIMEOUT_MS = 15 * 6e4;
+const DEVICE_LOGIN_START_TIMEOUT_MS = 2e4;
+const LOGIN_RETAIN_MS = 10 * 6e4;
+const END_AFTER_CLOSE_MS = 5e3;
+function codexLoginEnv(base, codexHome) {
+  const env = {};
+  for (const [k, v] of Object.entries(base)) if (typeof v === "string") env[k] = v;
+  for (const key of CODEX_ALWAYS_STRIPPED_ENV_KEYS) delete env[key];
+  env.CODEX_HOME = codexHome;
+  env.RUST_LOG = "warn";
+  return env;
+}
+const spawnCodexRpc = (codexHome, env) => {
+  const child = spawn("codex", ["app-server", "--listen", "stdio://"], { env, cwd: codexHome, stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = [];
+  let nextId = 1;
+  createInterface({ input: child.stdout }).on("line", (line) => {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (msg.id != null && pending.has(msg.id)) {
+      const p = pending.get(msg.id);
+      pending.delete(msg.id);
+      if (msg.error) p.reject(new Error(msg.error.message ?? "codex app-server error"));
+      else p.resolve(msg.result);
+    } else if (msg.method && msg.id == null) {
+      for (const cb of listeners) cb(msg.method, msg.params);
+    }
+  });
+  const send = (obj) => child.stdin?.writable && child.stdin.write(JSON.stringify(obj) + "\n");
+  const request = (method, params, timeoutMs = 15e3) => new Promise((resolve, reject) => {
+    const id = nextId++;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(`${method} timed out`));
+    }, timeoutMs);
+    pending.set(id, { resolve: (v) => {
+      clearTimeout(timer);
+      resolve(v);
+    }, reject: (e) => {
+      clearTimeout(timer);
+      reject(e);
+    } });
+    send({ jsonrpc: "2.0", id, method, params });
+  });
+  child.on("error", () => {
+  });
+  const initialized = request("initialize", { clientInfo: { name: "very-happy-accounts", version: "1" } }).then(() => send({ jsonrpc: "2.0", method: "initialized" }));
+  return {
+    request: async (method, params, timeoutMs) => {
+      await initialized;
+      return request(method, params, timeoutMs);
+    },
+    onNotification: (cb) => {
+      listeners.push(cb);
+    },
+    onExit: (cb) => {
+      child.on("exit", (code) => cb(code));
+    },
+    close: () => {
+      child.kill();
+    }
+  };
+};
+class CodexDeviceLoginManager {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  logins = /* @__PURE__ */ new Map();
+  now;
+  activeLoginId() {
+    for (const [id, e] of this.logins) if (e.status.state === "starting" || e.status.state === "waiting-code") return id;
+    return null;
+  }
+  has(loginId) {
+    return this.logins.has(loginId);
+  }
+  async start(codexHome) {
+    const busy = this.activeLoginId();
+    if (busy) throw Object.assign(new Error("another Codex sign-in is in progress"), { code: "login-busy", loginId: busy });
+    const loginId = this.deps.newId();
+    const entry = { status: { loginId, state: "starting", flow: "device-code" }, rpc: null, timers: [] };
+    this.logins.set(loginId, entry);
+    let rpc;
+    try {
+      rpc = this.deps.spawnRpc(codexHome, codexLoginEnv(this.deps.env, codexHome));
+    } catch (error) {
+      this.finish(entry, "failed", `could not start codex: ${error instanceof Error ? error.message : String(error)}`);
+      return { ...entry.status };
+    }
+    entry.rpc = rpc;
+    rpc.onExit(() => {
+      entry.rpc = null;
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code") this.finish(entry, "failed", "codex app-server exited");
+    });
+    rpc.onNotification((method, params) => {
+      if (method !== "account/login/completed") return;
+      if (entry.status.state !== "starting" && entry.status.state !== "waiting-code") return;
+      if (params?.loginId && entry.codexLoginId && params.loginId !== entry.codexLoginId) return;
+      if (params?.success) void this.complete(entry);
+      else this.finish(entry, "failed", sanitizeDetail(String(params?.error ?? "sign-in failed")));
+    });
+    try {
+      const result = await rpc.request("account/login/start", { type: "chatgptDeviceCode" }, DEVICE_LOGIN_START_TIMEOUT_MS);
+      if (typeof result?.verificationUrl !== "string" || typeof result?.userCode !== "string") throw new Error("codex returned no device code");
+      entry.codexLoginId = typeof result.loginId === "string" ? result.loginId : void 0;
+      if (entry.status.state === "starting") {
+        entry.status = { ...entry.status, state: "waiting-code", url: result.verificationUrl, userCode: result.userCode, expiresAt: this.now() + DEVICE_LOGIN_TIMEOUT_MS };
+        entry.timers.push(setTimeout(() => {
+          if (entry.status.state === "waiting-code") this.finish(entry, "expired");
+        }, DEVICE_LOGIN_TIMEOUT_MS));
+      }
+    } catch (error) {
+      this.finish(entry, "failed", sanitizeDetail(error instanceof Error ? error.message : String(error)));
+    }
+    return { ...entry.status };
+  }
+  async complete(entry) {
+    if (entry.status.state !== "waiting-code" && entry.status.state !== "starting") return;
+    let account = {};
+    try {
+      const read = await entry.rpc?.request("account/read", { refreshToken: false });
+      const a = read?.account;
+      if (a?.type === "chatgpt") account = { ...a.email ? { email: String(a.email) } : {}, ...a.planType ? { planType: String(a.planType) } : {} };
+    } catch {
+    }
+    try {
+      const summary = await this.deps.onSuccess(entry.status.loginId, account);
+      entry.status = { ...entry.status, account: summary };
+      this.finish(entry, "succeeded");
+    } catch (error) {
+      this.finish(entry, "failed", error instanceof Error ? error.message : String(error));
+    }
+  }
+  status(loginId) {
+    return { ...this.get(loginId).status };
+  }
+  cancel(loginId) {
+    const entry = this.get(loginId);
+    if (entry.status.state === "starting" || entry.status.state === "waiting-code") {
+      if (entry.codexLoginId) void entry.rpc?.request("account/login/cancel", { loginId: entry.codexLoginId }, 5e3).catch(() => {
+      });
+      this.finish(entry, "canceled");
+    }
+    return { ...entry.status };
+  }
+  dispose() {
+    for (const entry of this.logins.values()) {
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code") this.finish(entry, "canceled");
+      for (const t of entry.timers) clearTimeout(t);
+    }
+    this.logins.clear();
+    for (const end of [...this.pendingEnds]) end(true);
+  }
+  /** finish() → onEnd still waiting for its app-server to exit; dispose() runs them at once. */
+  pendingEnds = /* @__PURE__ */ new Set();
+  settleWaiters = [];
+  /** Resolves once every finished login's onEnd has run (a CLI exiting right after Ctrl-C waits for the cleanup). */
+  settle() {
+    if (this.pendingEnds.size === 0) return Promise.resolve();
+    return new Promise((resolve) => this.settleWaiters.push(resolve));
+  }
+  get(loginId) {
+    const entry = this.logins.get(loginId);
+    if (!entry) throw Object.assign(new Error(`no login "${loginId}"`), { code: "login-not-found" });
+    return entry;
+  }
+  finish(entry, state, error) {
+    entry.status = { ...entry.status, state, ...error ? { error } : {} };
+    for (const t2 of entry.timers) clearTimeout(t2);
+    entry.timers = [];
+    const rpc = entry.rpc;
+    entry.rpc = null;
+    const loginId = entry.status.loginId;
+    if (!rpc) this.deps.onEnd?.(loginId, state);
+    else {
+      let ended = false;
+      const end = (closeNow) => {
+        if (ended) return;
+        ended = true;
+        this.pendingEnds.delete(end);
+        if (closeNow) rpc.close();
+        this.deps.onEnd?.(loginId, state);
+        if (this.pendingEnds.size === 0) for (const resolve of this.settleWaiters.splice(0)) resolve();
+      };
+      this.pendingEnds.add(end);
+      rpc.onExit(() => end());
+      setTimeout(() => rpc.close(), state === "canceled" ? 500 : 0).unref?.();
+      setTimeout(() => end(), END_AFTER_CLOSE_MS).unref?.();
+    }
+    const t = setTimeout(() => this.logins.delete(entry.status.loginId), LOGIN_RETAIN_MS);
+    t.unref?.();
+  }
+}
+function classifyChatgptRead(read, now) {
+  const account = read?.account;
+  if (account && account.type === "chatgpt") return { status: "ok", at: now };
+  return { status: "expired", at: now, detail: "not signed in" };
+}
+async function checkCodexChatgptAccount(codexHome, env, spawnRpc = spawnCodexRpc, now = Date.now) {
+  let rpc = null;
+  try {
+    rpc = spawnRpc(codexHome, codexLoginEnv(env, codexHome));
+    const read = await rpc.request("account/read", { refreshToken: true }, CHECK_TIMEOUT_MS);
+    return classifyChatgptRead(read, now());
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/refresh token|401|unauthori[sz]ed|sign in again|log in again/i.test(message)) return { status: "expired", at: now(), detail: sanitizeDetail(message) };
+    return { status: "unverified", at: now(), detail: sanitizeDetail(message) };
+  } finally {
+    rpc?.close();
+  }
+}
+async function checkCodexProviderAccount(baseUrl, key, headers = {}, now = Date.now) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/models`, { signal: controller.signal, headers: { ...headers, authorization: `Bearer ${key}` } });
+    const body = res.ok ? "" : (await res.text().catch(() => "")).slice(0, 300);
+    return classifyHttpCheck("codex-provider", res.status, body, now());
+  } catch (error) {
+    return { status: "unverified", at: now(), detail: sanitizeDetail(error instanceof Error ? error.message : String(error)) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+const ACCOUNT_AGENTS = ["claude", "codex"];
 class AccountError extends Error {
   constructor(code, message, sessions) {
     super(message);
@@ -269,10 +504,14 @@ class AccountService {
   env;
   now;
   logins = null;
+  codexLogins = null;
   /** loginId → account to (re)write when its token arrives. */
   loginTargets = /* @__PURE__ */ new Map();
   state() {
-    return buildAgentProfilesState(this.home, readAccounts(this.home), defaultSecretProbe(this.env), this.now(), this.deps.daemonPid ?? process.pid);
+    const state = buildAgentProfilesState(this.home, readAccounts(this.home), defaultSecretProbe(this.env), this.now(), this.deps.daemonPid ?? process.pid);
+    const codexProviders = readCodexProviders(this.env).map((p) => ({ id: p.id, ...p.name ? { name: p.name } : {}, ...p.baseUrl ? { baseUrl: p.baseUrl } : {}, ...p.envKey ? { envKey: p.envKey } : {} }));
+    const withFeatures = { ...state, features: [AGENT_PROFILE_FEATURE_LAUNCH] };
+    return codexProviders.length > 0 ? { ...withFeatures, codexProviders } : withFeatures;
   }
   summary(id) {
     const record = readAccounts(this.home).accounts[id];
@@ -299,8 +538,11 @@ class AccountService {
     const parsed = AgentProfileAddRequestSchema.safeParse(params);
     if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
     const req = parsed.data;
+    if (req.agent === "codex" && req.provider && !readCodexProviders(this.env).some((p) => p.id === req.provider)) {
+      throw new AccountError("not-found", `no [model_providers.${req.provider}] in the machine's Codex config.toml`);
+    }
     const file = readAccountsFileV2(this.home);
-    const id = newAccountId(req.label, "claude-api", Object.keys(readAccounts(this.home).accounts));
+    const id = newAccountId(req.label, req.kind, Object.keys(readAccounts(this.home).accounts));
     const models = [];
     const contextWindows = {};
     for (const m of req.models ?? []) {
@@ -312,10 +554,12 @@ class AccountService {
     }
     const record = {
       label: req.label,
-      agent: "claude",
-      kind: "claude-api",
+      agent: req.agent,
+      kind: req.kind,
       createdAt: this.now(),
-      baseUrl: req.baseUrl.replace(/\/+$/, ""),
+      ...req.baseUrl ? { baseUrl: req.baseUrl.replace(/\/+$/, "") } : {},
+      ...req.agent === "codex" && req.provider ? { provider: req.provider } : {},
+      ...req.agent === "codex" && req.wireApi ? { wireApi: req.wireApi } : {},
       key: req.key.source === "paste" ? { source: "stored" } : req.key.source === "file" ? { source: "file", path: req.key.path } : { source: "env", name: req.key.name },
       ...models.length > 0 ? { models } : {},
       ...Object.keys(contextWindows).length > 0 ? { contextWindows } : {}
@@ -373,7 +617,7 @@ class AccountService {
     return outcome.notRunning ? "skipped" : "failed";
   }
   setDefault(agent, accountId) {
-    if (agent !== "claude") throw new AccountError("invalid-params", 'agent must be "claude"');
+    if (!ACCOUNT_AGENTS.includes(agent)) throw new AccountError("invalid-params", 'agent must be "claude" or "codex"');
     if (accountId !== null && typeof accountId !== "string") throw new AccountError("invalid-params", "accountId must be a string or null");
     if (typeof accountId === "string") {
       const record = readAccounts(this.home).accounts[accountId];
@@ -402,9 +646,17 @@ class AccountService {
     if (typeof accountId !== "string") throw new AccountError("invalid-params", "accountId is required");
     const record = readAccounts(this.home).accounts[accountId];
     if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
-    const secret = this.readSecretFor(accountId, record);
-    if (!secret) return this.summary(accountId);
-    const check = this.deps.check ? await this.deps.check(record, secret) : record.kind === "claude-subscription" ? await checkSubscriptionAccount(secret, join(this.home, "tmp", "account-check"), this.now) : await checkApiAccount(record, secret, this.now);
+    let check;
+    if (record.kind === "codex-chatgpt") {
+      if (this.summary(accountId).status === "missing-secret") return this.summary(accountId);
+      const codexHome = accountCodexHomePath(this.home, accountId);
+      syncCodexOverlay(codexHome, baseCodexHome(this.env), this.now());
+      check = this.deps.check ? await this.deps.check(record, "") : await checkCodexChatgptAccount(codexHome, this.env, this.deps.spawnCodexRpc ?? spawnCodexRpc, this.now);
+    } else {
+      const secret = this.readSecretFor(accountId, record);
+      if (!secret) return this.summary(accountId);
+      check = this.deps.check ? await this.deps.check(record, secret) : record.kind === "claude-subscription" ? await checkSubscriptionAccount(secret, join(this.home, "tmp", "account-check"), this.now) : record.kind === "codex-provider" ? await this.checkCodexProvider(record, secret) : await checkApiAccount(record, secret, this.now);
+    }
     if (!record.legacy) {
       const file = readAccountsFileV2(this.home);
       if (file.accounts[accountId]) {
@@ -416,6 +668,17 @@ class AccountService {
     }
     return { ...this.summary(accountId), status: check.status, checkedAt: check.at, ...check.detail ? { statusDetail: check.detail } : {} };
   }
+  async checkCodexProvider(record, secret) {
+    const base = record.provider ? readCodexProviders(this.env).find((p) => p.id === record.provider) : void 0;
+    const baseUrl = record.baseUrl ?? base?.baseUrl;
+    if (!baseUrl) return { status: "unverified", at: this.now(), detail: `provider "${record.provider}" is not in the machine's Codex config.toml` };
+    const headers = {};
+    const raw = base?.table.http_headers;
+    if (raw && typeof raw === "object") {
+      for (const [k, v] of Object.entries(raw)) if (typeof v === "string") headers[k] = v;
+    }
+    return checkCodexProviderAccount(baseUrl, secret, headers, this.now);
+  }
   // ---- remote login (claude setup-token) -------------------------------------
   loginManager() {
     if (this.logins) return this.logins;
@@ -457,6 +720,7 @@ class AccountService {
   async loginStart(params) {
     const parsed = AgentProfileLoginStartRequestSchema.safeParse(params);
     if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    if (parsed.data.agent === "codex") return this.codexLoginStart(parsed.data.accountId, parsed.data.label);
     const { accountId, label } = parsed.data;
     if (accountId) {
       const record = readAccounts(this.home).accounts[accountId];
@@ -472,10 +736,84 @@ class AccountService {
       throw new AccountError(code, error instanceof Error ? error.message : String(error));
     }
     this.loginTargets.set(status.loginId, { accountId, label });
+    return { ...status, flow: "paste-code" };
+  }
+  // ---- remote login (Codex ChatGPT device code) — B-850b ----------------------
+  codexLoginManager() {
+    if (this.codexLogins) return this.codexLogins;
+    this.codexLogins = new CodexDeviceLoginManager({
+      spawnRpc: this.deps.spawnCodexRpc ?? spawnCodexRpc,
+      env: this.env,
+      newId: () => randomUUID(),
+      now: this.now,
+      onSuccess: async (loginId, info) => {
+        const target = this.codexLoginTargets.get(loginId);
+        this.codexLoginTargets.delete(loginId);
+        if (!target) throw new AccountError("internal", "sign-in target lost");
+        return this.storeChatgptAccount(target, info);
+      },
+      onEnd: (loginId, state) => {
+        const target = this.codexLoginTargets.get(loginId);
+        if (state === "succeeded" || !target) return;
+        this.codexLoginTargets.delete(loginId);
+        if (target.isNew) removeAccountSecret(this.home, target.accountId);
+      }
+    });
+    return this.codexLogins;
+  }
+  /** loginId → the account a Codex sign-in writes. */
+  codexLoginTargets = /* @__PURE__ */ new Map();
+  async codexLoginStart(accountId, label) {
+    const accounts = readAccounts(this.home).accounts;
+    let target;
+    if (accountId) {
+      const record = accounts[accountId];
+      if (!record || record.kind !== "codex-chatgpt") throw new AccountError("not-found", `no ChatGPT account "${accountId}"`);
+      target = { accountId, isNew: false };
+    } else {
+      const taken = [...Object.keys(accounts), ...[...this.codexLoginTargets.values()].map((t) => t.accountId)];
+      target = { accountId: newAccountId(label ?? "", "codex-chatgpt", taken), ...label ? { label } : {}, isNew: true };
+    }
+    const manager = this.codexLoginManager();
+    const busy = manager.activeLoginId();
+    if (busy) throw new AccountError("login-busy", "another Codex sign-in is in progress");
+    const codexHome = accountCodexHomePath(this.home, target.accountId);
+    syncCodexOverlay(codexHome, baseCodexHome(this.env), this.now());
+    const status = await manager.start(codexHome);
+    if (status.state === "failed" || status.state === "canceled" || status.state === "expired") {
+      if (target.isNew) removeAccountSecret(this.home, target.accountId);
+      return status;
+    }
+    this.codexLoginTargets.set(status.loginId, target);
     return status;
   }
-  loginOp(fn) {
+  /** A finished ChatGPT sign-in → the account record (new) or its refreshed status (re-login). */
+  storeChatgptAccount(target, info) {
+    const file = readAccountsFileV2(this.home);
+    const now = this.now();
+    const existing = file.accounts[target.accountId];
+    if (existing && existing.kind === "codex-chatgpt") {
+      existing.check = { status: "ok", at: now };
+      if (info.email) existing.email = info.email;
+      if (info.planType) existing.planType = info.planType;
+    } else {
+      file.accounts[target.accountId] = {
+        label: target.label?.trim() || info.email || "ChatGPT",
+        agent: "codex",
+        kind: "codex-chatgpt",
+        createdAt: now,
+        check: { status: "ok", at: now },
+        ...info.email ? { email: info.email } : {},
+        ...info.planType ? { planType: info.planType } : {}
+      };
+    }
+    writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(target.accountId);
+  }
+  loginOp(fn, loginId, codex) {
     try {
+      if (codex && typeof loginId === "string" && this.codexLogins?.has(loginId)) return codex(this.codexLogins);
       return fn(this.loginManager());
     } catch (error) {
       const code = error.code ?? "internal";
@@ -485,20 +823,26 @@ class AccountService {
   loginSubmit(params) {
     const parsed = AgentProfileLoginSubmitRequestSchema.safeParse(params);
     if (!parsed.success) throw new AccountError("invalid-params", "loginId and code are required");
+    if (this.codexLogins?.has(parsed.data.loginId)) throw new AccountError("invalid-params", "a Codex device-code sign-in has nothing to submit: enter the code on the sign-in page");
     return this.loginOp((m) => m.submit(parsed.data.loginId, parsed.data.code));
   }
   loginStatus(loginId) {
     if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
-    return this.loginOp((m) => m.status(loginId));
+    return this.loginOp((m) => m.status(loginId), loginId, (m) => m.status(loginId));
   }
   loginCancel(loginId) {
     if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
-    const status = this.loginOp((m) => m.cancel(loginId));
+    const status = this.loginOp((m) => m.cancel(loginId), loginId, (m) => m.cancel(loginId));
     this.loginTargets.delete(loginId);
     return status;
   }
   dispose() {
     this.logins?.dispose();
+    this.codexLogins?.dispose();
+  }
+  /** B-850d2: waits until finished Codex sign-ins are cleaned up (their app-server gone, a canceled new account's overlay removed). */
+  settleLogins() {
+    return this.codexLogins?.settle() ?? Promise.resolve();
   }
   // ---- sessions --------------------------------------------------------------
   /** Validates and writes a session binding (no restart). */
@@ -506,8 +850,10 @@ class AccountService {
     if (accountId !== null) {
       const record = readAccounts(this.home).accounts[accountId];
       if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+      const agent = this.deps.sessionAgent?.(sessionId);
+      if (agent && agent !== record.agent) throw new AccountError("invalid-params", `"${accountId}" is a ${record.agent} account; this session runs ${agent}`);
       if (model !== void 0) {
-        if (record.kind !== "claude-api") throw new AccountError("invalid-params", "model applies to API accounts only");
+        if (record.kind === "claude-subscription") throw new AccountError("invalid-params", "model applies to API and Codex accounts only");
         if (record.models && record.models.length > 0 && !record.models.includes(model)) {
           throw new AccountError("invalid-params", `model "${model}" is not in ${accountId}'s models (${record.models.join(", ")})`);
         }
@@ -539,6 +885,10 @@ class AccountService {
     if (outcome.notRunning) return { bound: true, restart: "skipped", error: outcome.error };
     return { bound: true, restart: "failed", error: outcome.error };
   }
+  /** B-850d: the account a session is bound to (null = machine login, also when unbound). */
+  sessionAccount(sessionId) {
+    return readSessionBindings(this.home)[sessionId]?.account ?? null;
+  }
   /**
    * Spawn-time choice → the account a NEW session starts on.
    *   undefined → the machine default for this agent (none = machine login)