very-happy-cli 0.2.192 → 0.2.193

package/dist/{accountService-Bddy0zwL.cjs → accountService-CuUSJDhP.cjs}

@@ -3,10 +3,12 @@
 var node_crypto = require('node:crypto');
 var node_fs = require('node:fs');
 var path = require('node:path');
-var index = require('./index-BzAYnYct.cjs');
+var index = require('./index-BUFrKZeQ.cjs');
 var node_child_process = require('node:child_process');
-var claudeAccountEnv = require('./claudeAccountEnv-BOBpJ3k8.cjs');
-var store = require('./store-DV__wCvP.cjs');
+var claudeAccountEnv = require('./claudeAccountEnv-CEX_EMZr.cjs');
+var codexAccount = require('./codexAccount-BDQjRbtI.cjs');
+var node_readline = require('node:readline');
+var store = require('./store-CkNa6oj4.cjs');
 
 const CHECK_TIMEOUT_MS = 2e4;
 const DEFAULT_CHECK_MODEL = "claude-haiku-4-5";
@@ -28,7 +30,7 @@ function lastLine(text) {
   return text.trim().split("\n").filter(Boolean).pop() ?? "";
 }
 function sanitizeDetail(text) {
-  return text.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-\u2026").replace(/\s+/g, " ").trim().slice(0, 200);
+  return text.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-\u2026").replace(/\b(sk|rk)-[A-Za-z0-9_-]{16,}/g, "$1-\u2026").replace(/\s+/g, " ").trim().slice(0, 200);
 }
 async function checkApiAccount(record, key, now = Date.now) {
   const controller = new AbortController();
@@ -92,7 +94,7 @@ async function checkSubscriptionAccount(token, scratchDir, now = Date.now) {
 const LOGIN_CODE_TIMEOUT_MS = 10 * 6e4;
 const LOGIN_URL_TIMEOUT_MS = 2e4;
 const LOGIN_EXCHANGE_TIMEOUT_MS = 6e4;
-const LOGIN_RETAIN_MS = 10 * 6e4;
+const LOGIN_RETAIN_MS$1 = 10 * 6e4;
 function stripAnsi(text) {
   return text.replace(/\x1b\][^\x07\x1b]*(\x07|\x1b\\)/g, "").replace(/\x1b\[[0-9;?<>=]*[ -/]*[@-~]/g, " ").replace(/\x1b[()][A-Za-z0-9]/g, "").replace(/\x1b[=>78]/g, "");
 }
@@ -235,11 +237,244 @@ class SetupTokenLoginManager {
     }
     entry.output = "";
     const loginId_ = loginId;
-    const t = setTimeout(() => this.logins.delete(loginId_), LOGIN_RETAIN_MS);
+    const t = setTimeout(() => this.logins.delete(loginId_), LOGIN_RETAIN_MS$1);
     t.unref?.();
   }
 }
 
+const DEVICE_LOGIN_TIMEOUT_MS = 15 * 6e4;
+const DEVICE_LOGIN_START_TIMEOUT_MS = 2e4;
+const LOGIN_RETAIN_MS = 10 * 6e4;
+const END_AFTER_CLOSE_MS = 5e3;
+function codexLoginEnv(base, codexHome) {
+  const env = {};
+  for (const [k, v] of Object.entries(base)) if (typeof v === "string") env[k] = v;
+  for (const key of codexAccount.CODEX_ALWAYS_STRIPPED_ENV_KEYS) delete env[key];
+  env.CODEX_HOME = codexHome;
+  env.RUST_LOG = "warn";
+  return env;
+}
+const spawnCodexRpc = (codexHome, env) => {
+  const child = node_child_process.spawn("codex", ["app-server", "--listen", "stdio://"], { env, cwd: codexHome, stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = [];
+  let nextId = 1;
+  node_readline.createInterface({ input: child.stdout }).on("line", (line) => {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (msg.id != null && pending.has(msg.id)) {
+      const p = pending.get(msg.id);
+      pending.delete(msg.id);
+      if (msg.error) p.reject(new Error(msg.error.message ?? "codex app-server error"));
+      else p.resolve(msg.result);
+    } else if (msg.method && msg.id == null) {
+      for (const cb of listeners) cb(msg.method, msg.params);
+    }
+  });
+  const send = (obj) => child.stdin?.writable && child.stdin.write(JSON.stringify(obj) + "\n");
+  const request = (method, params, timeoutMs = 15e3) => new Promise((resolve, reject) => {
+    const id = nextId++;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(`${method} timed out`));
+    }, timeoutMs);
+    pending.set(id, { resolve: (v) => {
+      clearTimeout(timer);
+      resolve(v);
+    }, reject: (e) => {
+      clearTimeout(timer);
+      reject(e);
+    } });
+    send({ jsonrpc: "2.0", id, method, params });
+  });
+  child.on("error", () => {
+  });
+  const initialized = request("initialize", { clientInfo: { name: "very-happy-accounts", version: "1" } }).then(() => send({ jsonrpc: "2.0", method: "initialized" }));
+  return {
+    request: async (method, params, timeoutMs) => {
+      await initialized;
+      return request(method, params, timeoutMs);
+    },
+    onNotification: (cb) => {
+      listeners.push(cb);
+    },
+    onExit: (cb) => {
+      child.on("exit", (code) => cb(code));
+    },
+    close: () => {
+      child.kill();
+    }
+  };
+};
+class CodexDeviceLoginManager {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  logins = /* @__PURE__ */ new Map();
+  now;
+  activeLoginId() {
+    for (const [id, e] of this.logins) if (e.status.state === "starting" || e.status.state === "waiting-code") return id;
+    return null;
+  }
+  has(loginId) {
+    return this.logins.has(loginId);
+  }
+  async start(codexHome) {
+    const busy = this.activeLoginId();
+    if (busy) throw Object.assign(new Error("another Codex sign-in is in progress"), { code: "login-busy", loginId: busy });
+    const loginId = this.deps.newId();
+    const entry = { status: { loginId, state: "starting", flow: "device-code" }, rpc: null, timers: [] };
+    this.logins.set(loginId, entry);
+    let rpc;
+    try {
+      rpc = this.deps.spawnRpc(codexHome, codexLoginEnv(this.deps.env, codexHome));
+    } catch (error) {
+      this.finish(entry, "failed", `could not start codex: ${error instanceof Error ? error.message : String(error)}`);
+      return { ...entry.status };
+    }
+    entry.rpc = rpc;
+    rpc.onExit(() => {
+      entry.rpc = null;
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code") this.finish(entry, "failed", "codex app-server exited");
+    });
+    rpc.onNotification((method, params) => {
+      if (method !== "account/login/completed") return;
+      if (entry.status.state !== "starting" && entry.status.state !== "waiting-code") return;
+      if (params?.loginId && entry.codexLoginId && params.loginId !== entry.codexLoginId) return;
+      if (params?.success) void this.complete(entry);
+      else this.finish(entry, "failed", sanitizeDetail(String(params?.error ?? "sign-in failed")));
+    });
+    try {
+      const result = await rpc.request("account/login/start", { type: "chatgptDeviceCode" }, DEVICE_LOGIN_START_TIMEOUT_MS);
+      if (typeof result?.verificationUrl !== "string" || typeof result?.userCode !== "string") throw new Error("codex returned no device code");
+      entry.codexLoginId = typeof result.loginId === "string" ? result.loginId : void 0;
+      if (entry.status.state === "starting") {
+        entry.status = { ...entry.status, state: "waiting-code", url: result.verificationUrl, userCode: result.userCode, expiresAt: this.now() + DEVICE_LOGIN_TIMEOUT_MS };
+        entry.timers.push(setTimeout(() => {
+          if (entry.status.state === "waiting-code") this.finish(entry, "expired");
+        }, DEVICE_LOGIN_TIMEOUT_MS));
+      }
+    } catch (error) {
+      this.finish(entry, "failed", sanitizeDetail(error instanceof Error ? error.message : String(error)));
+    }
+    return { ...entry.status };
+  }
+  async complete(entry) {
+    if (entry.status.state !== "waiting-code" && entry.status.state !== "starting") return;
+    let account = {};
+    try {
+      const read = await entry.rpc?.request("account/read", { refreshToken: false });
+      const a = read?.account;
+      if (a?.type === "chatgpt") account = { ...a.email ? { email: String(a.email) } : {}, ...a.planType ? { planType: String(a.planType) } : {} };
+    } catch {
+    }
+    try {
+      const summary = await this.deps.onSuccess(entry.status.loginId, account);
+      entry.status = { ...entry.status, account: summary };
+      this.finish(entry, "succeeded");
+    } catch (error) {
+      this.finish(entry, "failed", error instanceof Error ? error.message : String(error));
+    }
+  }
+  status(loginId) {
+    return { ...this.get(loginId).status };
+  }
+  cancel(loginId) {
+    const entry = this.get(loginId);
+    if (entry.status.state === "starting" || entry.status.state === "waiting-code") {
+      if (entry.codexLoginId) void entry.rpc?.request("account/login/cancel", { loginId: entry.codexLoginId }, 5e3).catch(() => {
+      });
+      this.finish(entry, "canceled");
+    }
+    return { ...entry.status };
+  }
+  dispose() {
+    for (const entry of this.logins.values()) {
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code") this.finish(entry, "canceled");
+      for (const t of entry.timers) clearTimeout(t);
+    }
+    this.logins.clear();
+    for (const end of [...this.pendingEnds]) end(true);
+  }
+  /** finish() → onEnd still waiting for its app-server to exit; dispose() runs them at once. */
+  pendingEnds = /* @__PURE__ */ new Set();
+  settleWaiters = [];
+  /** Resolves once every finished login's onEnd has run (a CLI exiting right after Ctrl-C waits for the cleanup). */
+  settle() {
+    if (this.pendingEnds.size === 0) return Promise.resolve();
+    return new Promise((resolve) => this.settleWaiters.push(resolve));
+  }
+  get(loginId) {
+    const entry = this.logins.get(loginId);
+    if (!entry) throw Object.assign(new Error(`no login "${loginId}"`), { code: "login-not-found" });
+    return entry;
+  }
+  finish(entry, state, error) {
+    entry.status = { ...entry.status, state, ...error ? { error } : {} };
+    for (const t2 of entry.timers) clearTimeout(t2);
+    entry.timers = [];
+    const rpc = entry.rpc;
+    entry.rpc = null;
+    const loginId = entry.status.loginId;
+    if (!rpc) this.deps.onEnd?.(loginId, state);
+    else {
+      let ended = false;
+      const end = (closeNow) => {
+        if (ended) return;
+        ended = true;
+        this.pendingEnds.delete(end);
+        if (closeNow) rpc.close();
+        this.deps.onEnd?.(loginId, state);
+        if (this.pendingEnds.size === 0) for (const resolve of this.settleWaiters.splice(0)) resolve();
+      };
+      this.pendingEnds.add(end);
+      rpc.onExit(() => end());
+      setTimeout(() => rpc.close(), state === "canceled" ? 500 : 0).unref?.();
+      setTimeout(() => end(), END_AFTER_CLOSE_MS).unref?.();
+    }
+    const t = setTimeout(() => this.logins.delete(entry.status.loginId), LOGIN_RETAIN_MS);
+    t.unref?.();
+  }
+}
+function classifyChatgptRead(read, now) {
+  const account = read?.account;
+  if (account && account.type === "chatgpt") return { status: "ok", at: now };
+  return { status: "expired", at: now, detail: "not signed in" };
+}
+async function checkCodexChatgptAccount(codexHome, env, spawnRpc = spawnCodexRpc, now = Date.now) {
+  let rpc = null;
+  try {
+    rpc = spawnRpc(codexHome, codexLoginEnv(env, codexHome));
+    const read = await rpc.request("account/read", { refreshToken: true }, CHECK_TIMEOUT_MS);
+    return classifyChatgptRead(read, now());
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/refresh token|401|unauthori[sz]ed|sign in again|log in again/i.test(message)) return { status: "expired", at: now(), detail: sanitizeDetail(message) };
+    return { status: "unverified", at: now(), detail: sanitizeDetail(message) };
+  } finally {
+    rpc?.close();
+  }
+}
+async function checkCodexProviderAccount(baseUrl, key, headers = {}, now = Date.now) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/models`, { signal: controller.signal, headers: { ...headers, authorization: `Bearer ${key}` } });
+    const body = res.ok ? "" : (await res.text().catch(() => "")).slice(0, 300);
+    return classifyHttpCheck("codex-provider", res.status, body, now());
+  } catch (error) {
+    return { status: "unverified", at: now(), detail: sanitizeDetail(error instanceof Error ? error.message : String(error)) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+const ACCOUNT_AGENTS = ["claude", "codex"];
 class AccountError extends Error {
   constructor(code, message, sessions) {
     super(message);
@@ -271,10 +506,14 @@ class AccountService {
   env;
   now;
   logins = null;
+  codexLogins = null;
   /** loginId → account to (re)write when its token arrives. */
   loginTargets = /* @__PURE__ */ new Map();
   state() {
-    return store.buildAgentProfilesState(this.home, store.readAccounts(this.home), store.defaultSecretProbe(this.env), this.now(), this.deps.daemonPid ?? process.pid);
+    const state = store.buildAgentProfilesState(this.home, store.readAccounts(this.home), store.defaultSecretProbe(this.env), this.now(), this.deps.daemonPid ?? process.pid);
+    const codexProviders = codexAccount.readCodexProviders(this.env).map((p) => ({ id: p.id, ...p.name ? { name: p.name } : {}, ...p.baseUrl ? { baseUrl: p.baseUrl } : {}, ...p.envKey ? { envKey: p.envKey } : {} }));
+    const withFeatures = { ...state, features: [index.AGENT_PROFILE_FEATURE_LAUNCH] };
+    return codexProviders.length > 0 ? { ...withFeatures, codexProviders } : withFeatures;
   }
   summary(id) {
     const record = store.readAccounts(this.home).accounts[id];
@@ -301,8 +540,11 @@ class AccountService {
     const parsed = index.AgentProfileAddRequestSchema.safeParse(params);
     if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
     const req = parsed.data;
+    if (req.agent === "codex" && req.provider && !codexAccount.readCodexProviders(this.env).some((p) => p.id === req.provider)) {
+      throw new AccountError("not-found", `no [model_providers.${req.provider}] in the machine's Codex config.toml`);
+    }
     const file = store.readAccountsFileV2(this.home);
-    const id = store.newAccountId(req.label, "claude-api", Object.keys(store.readAccounts(this.home).accounts));
+    const id = store.newAccountId(req.label, req.kind, Object.keys(store.readAccounts(this.home).accounts));
     const models = [];
     const contextWindows = {};
     for (const m of req.models ?? []) {
@@ -314,10 +556,12 @@ class AccountService {
     }
     const record = {
       label: req.label,
-      agent: "claude",
-      kind: "claude-api",
+      agent: req.agent,
+      kind: req.kind,
       createdAt: this.now(),
-      baseUrl: req.baseUrl.replace(/\/+$/, ""),
+      ...req.baseUrl ? { baseUrl: req.baseUrl.replace(/\/+$/, "") } : {},
+      ...req.agent === "codex" && req.provider ? { provider: req.provider } : {},
+      ...req.agent === "codex" && req.wireApi ? { wireApi: req.wireApi } : {},
       key: req.key.source === "paste" ? { source: "stored" } : req.key.source === "file" ? { source: "file", path: req.key.path } : { source: "env", name: req.key.name },
       ...models.length > 0 ? { models } : {},
       ...Object.keys(contextWindows).length > 0 ? { contextWindows } : {}
@@ -375,7 +619,7 @@ class AccountService {
     return outcome.notRunning ? "skipped" : "failed";
   }
   setDefault(agent, accountId) {
-    if (agent !== "claude") throw new AccountError("invalid-params", 'agent must be "claude"');
+    if (!ACCOUNT_AGENTS.includes(agent)) throw new AccountError("invalid-params", 'agent must be "claude" or "codex"');
     if (accountId !== null && typeof accountId !== "string") throw new AccountError("invalid-params", "accountId must be a string or null");
     if (typeof accountId === "string") {
       const record = store.readAccounts(this.home).accounts[accountId];
@@ -404,9 +648,17 @@ class AccountService {
     if (typeof accountId !== "string") throw new AccountError("invalid-params", "accountId is required");
     const record = store.readAccounts(this.home).accounts[accountId];
     if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
-    const secret = this.readSecretFor(accountId, record);
-    if (!secret) return this.summary(accountId);
-    const check = this.deps.check ? await this.deps.check(record, secret) : record.kind === "claude-subscription" ? await checkSubscriptionAccount(secret, path.join(this.home, "tmp", "account-check"), this.now) : await checkApiAccount(record, secret, this.now);
+    let check;
+    if (record.kind === "codex-chatgpt") {
+      if (this.summary(accountId).status === "missing-secret") return this.summary(accountId);
+      const codexHome = store.accountCodexHomePath(this.home, accountId);
+      codexAccount.syncCodexOverlay(codexHome, codexAccount.baseCodexHome(this.env), this.now());
+      check = this.deps.check ? await this.deps.check(record, "") : await checkCodexChatgptAccount(codexHome, this.env, this.deps.spawnCodexRpc ?? spawnCodexRpc, this.now);
+    } else {
+      const secret = this.readSecretFor(accountId, record);
+      if (!secret) return this.summary(accountId);
+      check = this.deps.check ? await this.deps.check(record, secret) : record.kind === "claude-subscription" ? await checkSubscriptionAccount(secret, path.join(this.home, "tmp", "account-check"), this.now) : record.kind === "codex-provider" ? await this.checkCodexProvider(record, secret) : await checkApiAccount(record, secret, this.now);
+    }
     if (!record.legacy) {
       const file = store.readAccountsFileV2(this.home);
       if (file.accounts[accountId]) {
@@ -418,6 +670,17 @@ class AccountService {
     }
     return { ...this.summary(accountId), status: check.status, checkedAt: check.at, ...check.detail ? { statusDetail: check.detail } : {} };
   }
+  async checkCodexProvider(record, secret) {
+    const base = record.provider ? codexAccount.readCodexProviders(this.env).find((p) => p.id === record.provider) : void 0;
+    const baseUrl = record.baseUrl ?? base?.baseUrl;
+    if (!baseUrl) return { status: "unverified", at: this.now(), detail: `provider "${record.provider}" is not in the machine's Codex config.toml` };
+    const headers = {};
+    const raw = base?.table.http_headers;
+    if (raw && typeof raw === "object") {
+      for (const [k, v] of Object.entries(raw)) if (typeof v === "string") headers[k] = v;
+    }
+    return checkCodexProviderAccount(baseUrl, secret, headers, this.now);
+  }
   // ---- remote login (claude setup-token) -------------------------------------
   loginManager() {
     if (this.logins) return this.logins;
@@ -459,6 +722,7 @@ class AccountService {
   async loginStart(params) {
     const parsed = index.AgentProfileLoginStartRequestSchema.safeParse(params);
     if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    if (parsed.data.agent === "codex") return this.codexLoginStart(parsed.data.accountId, parsed.data.label);
     const { accountId, label } = parsed.data;
     if (accountId) {
       const record = store.readAccounts(this.home).accounts[accountId];
@@ -474,10 +738,84 @@ class AccountService {
       throw new AccountError(code, error instanceof Error ? error.message : String(error));
     }
     this.loginTargets.set(status.loginId, { accountId, label });
+    return { ...status, flow: "paste-code" };
+  }
+  // ---- remote login (Codex ChatGPT device code) — B-850b ----------------------
+  codexLoginManager() {
+    if (this.codexLogins) return this.codexLogins;
+    this.codexLogins = new CodexDeviceLoginManager({
+      spawnRpc: this.deps.spawnCodexRpc ?? spawnCodexRpc,
+      env: this.env,
+      newId: () => node_crypto.randomUUID(),
+      now: this.now,
+      onSuccess: async (loginId, info) => {
+        const target = this.codexLoginTargets.get(loginId);
+        this.codexLoginTargets.delete(loginId);
+        if (!target) throw new AccountError("internal", "sign-in target lost");
+        return this.storeChatgptAccount(target, info);
+      },
+      onEnd: (loginId, state) => {
+        const target = this.codexLoginTargets.get(loginId);
+        if (state === "succeeded" || !target) return;
+        this.codexLoginTargets.delete(loginId);
+        if (target.isNew) store.removeAccountSecret(this.home, target.accountId);
+      }
+    });
+    return this.codexLogins;
+  }
+  /** loginId → the account a Codex sign-in writes. */
+  codexLoginTargets = /* @__PURE__ */ new Map();
+  async codexLoginStart(accountId, label) {
+    const accounts = store.readAccounts(this.home).accounts;
+    let target;
+    if (accountId) {
+      const record = accounts[accountId];
+      if (!record || record.kind !== "codex-chatgpt") throw new AccountError("not-found", `no ChatGPT account "${accountId}"`);
+      target = { accountId, isNew: false };
+    } else {
+      const taken = [...Object.keys(accounts), ...[...this.codexLoginTargets.values()].map((t) => t.accountId)];
+      target = { accountId: store.newAccountId(label ?? "", "codex-chatgpt", taken), ...label ? { label } : {}, isNew: true };
+    }
+    const manager = this.codexLoginManager();
+    const busy = manager.activeLoginId();
+    if (busy) throw new AccountError("login-busy", "another Codex sign-in is in progress");
+    const codexHome = store.accountCodexHomePath(this.home, target.accountId);
+    codexAccount.syncCodexOverlay(codexHome, codexAccount.baseCodexHome(this.env), this.now());
+    const status = await manager.start(codexHome);
+    if (status.state === "failed" || status.state === "canceled" || status.state === "expired") {
+      if (target.isNew) store.removeAccountSecret(this.home, target.accountId);
+      return status;
+    }
+    this.codexLoginTargets.set(status.loginId, target);
     return status;
   }
-  loginOp(fn) {
+  /** A finished ChatGPT sign-in → the account record (new) or its refreshed status (re-login). */
+  storeChatgptAccount(target, info) {
+    const file = store.readAccountsFileV2(this.home);
+    const now = this.now();
+    const existing = file.accounts[target.accountId];
+    if (existing && existing.kind === "codex-chatgpt") {
+      existing.check = { status: "ok", at: now };
+      if (info.email) existing.email = info.email;
+      if (info.planType) existing.planType = info.planType;
+    } else {
+      file.accounts[target.accountId] = {
+        label: target.label?.trim() || info.email || "ChatGPT",
+        agent: "codex",
+        kind: "codex-chatgpt",
+        createdAt: now,
+        check: { status: "ok", at: now },
+        ...info.email ? { email: info.email } : {},
+        ...info.planType ? { planType: info.planType } : {}
+      };
+    }
+    store.writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(target.accountId);
+  }
+  loginOp(fn, loginId, codex) {
     try {
+      if (codex && typeof loginId === "string" && this.codexLogins?.has(loginId)) return codex(this.codexLogins);
       return fn(this.loginManager());
     } catch (error) {
       const code = error.code ?? "internal";
@@ -487,20 +825,26 @@ class AccountService {
   loginSubmit(params) {
     const parsed = index.AgentProfileLoginSubmitRequestSchema.safeParse(params);
     if (!parsed.success) throw new AccountError("invalid-params", "loginId and code are required");
+    if (this.codexLogins?.has(parsed.data.loginId)) throw new AccountError("invalid-params", "a Codex device-code sign-in has nothing to submit: enter the code on the sign-in page");
     return this.loginOp((m) => m.submit(parsed.data.loginId, parsed.data.code));
   }
   loginStatus(loginId) {
     if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
-    return this.loginOp((m) => m.status(loginId));
+    return this.loginOp((m) => m.status(loginId), loginId, (m) => m.status(loginId));
   }
   loginCancel(loginId) {
     if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
-    const status = this.loginOp((m) => m.cancel(loginId));
+    const status = this.loginOp((m) => m.cancel(loginId), loginId, (m) => m.cancel(loginId));
     this.loginTargets.delete(loginId);
     return status;
   }
   dispose() {
     this.logins?.dispose();
+    this.codexLogins?.dispose();
+  }
+  /** B-850d2: waits until finished Codex sign-ins are cleaned up (their app-server gone, a canceled new account's overlay removed). */
+  settleLogins() {
+    return this.codexLogins?.settle() ?? Promise.resolve();
   }
   // ---- sessions --------------------------------------------------------------
   /** Validates and writes a session binding (no restart). */
@@ -508,8 +852,10 @@ class AccountService {
     if (accountId !== null) {
       const record = store.readAccounts(this.home).accounts[accountId];
       if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+      const agent = this.deps.sessionAgent?.(sessionId);
+      if (agent && agent !== record.agent) throw new AccountError("invalid-params", `"${accountId}" is a ${record.agent} account; this session runs ${agent}`);
       if (model !== void 0) {
-        if (record.kind !== "claude-api") throw new AccountError("invalid-params", "model applies to API accounts only");
+        if (record.kind === "claude-subscription") throw new AccountError("invalid-params", "model applies to API and Codex accounts only");
         if (record.models && record.models.length > 0 && !record.models.includes(model)) {
           throw new AccountError("invalid-params", `model "${model}" is not in ${accountId}'s models (${record.models.join(", ")})`);
         }
@@ -541,6 +887,10 @@ class AccountService {
     if (outcome.notRunning) return { bound: true, restart: "skipped", error: outcome.error };
     return { bound: true, restart: "failed", error: outcome.error };
   }
+  /** B-850d: the account a session is bound to (null = machine login, also when unbound). */
+  sessionAccount(sessionId) {
+    return store.readSessionBindings(this.home)[sessionId]?.account ?? null;
+  }
   /**
    * Spawn-time choice → the account a NEW session starts on.
    *   undefined → the machine default for this agent (none = machine login)

package/dist/{acpSessionResume-BnHDk5eD.cjs → acpSessionResume-Bk9mjXZ9.cjs}

@@ -2,7 +2,7 @@
 
 var node_fs = require('node:fs');
 var path = require('node:path');
-var configuration = require('./configuration-CXEVKAyF.cjs');
+var configuration = require('./configuration-BBK0rmmj.cjs');
 
 const SESSION_MODE_DIR = "session-modes";
 const ACP_PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];

package/dist/{acpSessionResume-BWEUxNtC.mjs → acpSessionResume-TQwN9ZZE.mjs}

@@ -1,6 +1,6 @@
 import { mkdirSync, renameSync, existsSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
-import { w as writePrivateFileSync, c as configuration } from './configuration-IhRiLDVe.mjs';
+import { w as writePrivateFileSync, c as configuration } from './configuration-ThKBP_zY.mjs';
 
 const SESSION_MODE_DIR = "session-modes";
 const ACP_PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];

package/dist/{agentHome-B0VnjkZW.mjs → agentHome-Bep8semY.mjs}

@@ -1,13 +1,13 @@
 import chalk from 'chalk';
 import { homedir } from 'node:os';
-import { r as readSettings, u as updateSettings } from './persistence-DWcHe035.mjs';
+import { r as readSettings, u as updateSettings } from './persistence-Cg4sfjQV.mjs';
 import 'node:fs';
-import './logger-Fd_rNvgd.mjs';
+import './logger-JV7-4Q_6.mjs';
 import { d as describeAgentHome, p as probeLoginShellEnv, r as resolveAgentHomes, e as expandHomePath, A as AGENT_HOME_ENV_NAMES } from './loginShellEnv-Dw8M7tkI.mjs';
 import 'node:fs/promises';
-import './configuration-IhRiLDVe.mjs';
+import './configuration-ThKBP_zY.mjs';
 import 'node:path';
-import './package-6KkRAops.mjs';
+import './package-Bw3H6VLn.mjs';
 import 'zod';
 import './authRelay-DhQhkBvX.mjs';
 import 'node:crypto';

package/dist/{agentHome-CqQ29YY7.cjs → agentHome-c2dlgcw1.cjs}

@@ -2,14 +2,14 @@
 
 var chalk = require('chalk');
 var os = require('node:os');
-var persistence = require('./persistence-B4ttN-fR.cjs');
+var persistence = require('./persistence-CsmAgN-C.cjs');
 require('node:fs');
-require('./logger-8su64lqR.cjs');
+require('./logger-CX3x2eI4.cjs');
 var loginShellEnv = require('./loginShellEnv-BkuYtExZ.cjs');
 require('node:fs/promises');
-require('./configuration-CXEVKAyF.cjs');
+require('./configuration-BBK0rmmj.cjs');
 require('node:path');
-require('./package-iuLlSiSF.cjs');
+require('./package-uzlvxa5S.cjs');
 require('zod');
 require('./authRelay-Dy1qU9td.cjs');
 require('node:crypto');

package/dist/{api-hMDsC6Wg.cjs → api-CBE_a88I.cjs}

@@ -1,22 +1,22 @@
 'use strict';
 
 var axios = require('axios');
-var logger = require('./logger-8su64lqR.cjs');
-var lidState = require('./lidState-DqoN7zH4.cjs');
+var logger = require('./logger-CX3x2eI4.cjs');
+var lidState = require('./lidState-B_v6qgfE.cjs');
 var node_events = require('node:events');
 var socket_ioClient = require('socket.io-client');
-var pushNotifications = require('./pushNotifications-BqFoLye2.cjs');
+var pushNotifications = require('./pushNotifications-BCg7YAiu.cjs');
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
 var limits = require('./limits-C-a7gr04.cjs');
-var time = require('./time-CaUlWSNJ.cjs');
-var configuration = require('./configuration-CXEVKAyF.cjs');
+var time = require('./time-BTLcO8jp.cjs');
+var configuration = require('./configuration-BBK0rmmj.cjs');
 var node_crypto = require('node:crypto');
-var index = require('./index-BzAYnYct.cjs');
-var registerCommonHandlers = require('./registerCommonHandlers-m6pxxf2J.cjs');
+var index = require('./index-BUFrKZeQ.cjs');
+var registerCommonHandlers = require('./registerCommonHandlers-CZGmrPbT.cjs');
 var cuid2 = require('@paralleldrive/cuid2');
-var sync = require('./sync-_2lsZ1U2.cjs');
+var sync = require('./sync-WYBwkJvG.cjs');
 var backgroundTaskActivity = require('./backgroundTaskActivity-CBvUdj39.cjs');
-var controlClient = require('./controlClient-j7p5p3_7.cjs');
+var controlClient = require('./controlClient-DwWTns3A.cjs');
 var chalk = require('chalk');
 
 async function hmac_sha512(key, data) {
@@ -3075,7 +3075,7 @@ class ApiClient {
     return new ApiSessionClient(this.credential.token, session, opts);
   }
   async machineSyncClient(machine) {
-    const { ApiMachineClient } = await Promise.resolve().then(function () { return require('./apiMachine-CqW2m6Zr.cjs'); });
+    const { ApiMachineClient } = await Promise.resolve().then(function () { return require('./apiMachine-BqtG0IWm.cjs'); });
     return new ApiMachineClient(this.credential.token, machine);
   }
   push() {

package/dist/{api-_LeBScjg.mjs → api-DUfunY3x.mjs}

@@ -1,20 +1,20 @@
 import axios from 'axios';
-import { l as logger, r as redactLogValue } from './logger-Fd_rNvgd.mjs';
-import { R as RpcHandlerManager, a as answerSocketRequest, c as connectGuarded, s as socketConnectGuard, d as describeSocketAckDrop, b as safeAck, i as isRateQuotaCode, p as pauseForRateQuota, e as shouldReconnect } from './lidState-CZOXXdzv.mjs';
+import { l as logger, r as redactLogValue } from './logger-JV7-4Q_6.mjs';
+import { R as RpcHandlerManager, a as answerSocketRequest, c as connectGuarded, s as socketConnectGuard, d as describeSocketAckDrop, b as safeAck, i as isRateQuotaCode, p as pauseForRateQuota, e as shouldReconnect } from './lidState-B6yYKjNK.mjs';
 import { EventEmitter } from 'node:events';
 import { io } from 'socket.io-client';
-import { A as AsyncLock, a as MAX_CHAT_ATTACHMENT_ENCRYPTED_BYTES, U as UserMessageSchema, F as FileEventMessageSchema, P as PushNotificationClient } from './pushNotifications-DkQ0yvFs.mjs';
+import { A as AsyncLock, a as MAX_CHAT_ATTACHMENT_ENCRYPTED_BYTES, U as UserMessageSchema, F as FileEventMessageSchema, P as PushNotificationClient } from './pushNotifications-BbE-qV9I.mjs';
 import { h as decrypt, d as decodeBase64, i as decryptBlob, e as encodeBase64, g as encrypt, l as libsodiumEncryptForPublicKey, j as libsodiumPublicKeyFromSecretKey, k as getRandomBytes } from './authRelay-DhQhkBvX.mjs';
 import { p as prepareClipboardText, d as prepareClipboardHistoryText } from './limits-DIo7rEBR.mjs';
-import { b as backoff, d as delay, e as exponentialBackoffDelay } from './time-bzmet4s5.mjs';
-import { c as configuration } from './configuration-IhRiLDVe.mjs';
+import { b as backoff, d as delay, e as exponentialBackoffDelay } from './time-Cw0liIqB.mjs';
+import { c as configuration } from './configuration-ThKBP_zY.mjs';
 import { createHmac, randomUUID } from 'node:crypto';
-import { k as createEnvelope, s as streamKeyOf, a0 as ReleaseDrainNoticeSchema, a1 as RelayAssignmentResponseSchema } from './index-DYD3GM1m.mjs';
-import { r as registerCommonHandlers } from './registerCommonHandlers-yQ7Ru-l0.mjs';
+import { k as createEnvelope, s as streamKeyOf, a3 as ReleaseDrainNoticeSchema, a4 as RelayAssignmentResponseSchema } from './index-D1YnIih6.mjs';
+import { r as registerCommonHandlers } from './registerCommonHandlers-Cj3Nl9y-.mjs';
 import { createId } from '@paralleldrive/cuid2';
-import { I as InvalidateSync } from './sync-JoEZKRo8.mjs';
+import { I as InvalidateSync } from './sync-BP6vnxVP.mjs';
 import { B as BackgroundTaskReporter } from './backgroundTaskActivity-8PdPxrvy.mjs';
-import { q as notifyDaemonTurnEvent, t as notifyDaemonBackgroundTasks } from './controlClient-8ILulwjc.mjs';
+import { q as notifyDaemonTurnEvent, t as notifyDaemonBackgroundTasks } from './controlClient-Ckl8N1MS.mjs';
 import chalk from 'chalk';
 
 async function hmac_sha512(key, data) {
@@ -3073,7 +3073,7 @@ class ApiClient {
     return new ApiSessionClient(this.credential.token, session, opts);
   }
   async machineSyncClient(machine) {
-    const { ApiMachineClient } = await import('./apiMachine-CgRldeJ6.mjs');
+    const { ApiMachineClient } = await import('./apiMachine-CU_bw5nV.mjs');
     return new ApiMachineClient(this.credential.token, machine);
   }
   push() {