Add isolated Codex and Claude accounts with safe session handoff

[slashdevcorpse]

Related issue

Closes #432

Problem / pressure

Codex and Claude sessions share the machine's default provider authentication. Users need independent additional accounts and a manual account handoff inside an existing Lody session without changing its workspace, worktree, transcript, or other running sessions.

Summary

• Add machine-local Codex and Claude profiles with isolated native authentication homes, status/login controls, process-lifetime account leases, and backward-compatible System Default behavior.
• Persist authoritative machine-local account/native-session bindings and implement an idle-only, checkpointed handoff with target validation, native resume when supported, history continuation otherwise, and rollback on failure. Synced account metadata is a display mirror.
• Add capability-gated settings controls, local session switching, account-scoped usage, and English/Chinese labels. Account management, switching, and explicit profile sign-in require trusted local IPC; remote Machine RPC fails closed because it cannot authenticate the requester. Preserve upstream's saved-config-only legacy authentication and encrypted replies.
• Reject concurrent reuse of login request IDs; cancellation reaches queued and preparing starts, and code/input/cancel continuations retain bounded capacity while starts wait for human input.
• Record fork recovery intent before saving the target binding or placeholder. Keep preparing sessions blocked, recover account/native metadata from local authority, and flush repaired state before releasing recovery markers. Require operation ownership before cleanup.
• Repair Windows safety defects exposed by regression testing: malformed shutdown responses, upload symlink/replacement validation, SQLite recovery handles, hidden worktree metadata rewrites, and unfinished Git probes during non-Git scans. Correct portable path, signal, line-ending, and temporary-home fixtures without changing macOS updater behavior.

Before / after

Before	After
Provider sessions use the default machine login.	Existing sessions retain System Default; additional profiles have isolated native homes.
Switching accounts requires an external global login change.	An idle session can switch manually with a durable binding and failure recovery.
Cross-account native resume is provider-dependent.	Known resume rejection can continue from the same Lody history; generic startup errors roll back.

Electron screenshots

Actual built Electron and bundled CLI with synthetic accounts and provider responses. The session controls below compare 45800a5 with 2aa39b8, using the same session and usage snapshot: context 24K/200K (12%), weekly 41%, five-hour 24%. Images are focused crops of the running app. No live provider credentials were used.

The account switcher is now a 28px chip with a keyboard-accessible menu, selected-account indicator, identity, and sign-in status. Usage is a 320px, viewport-bounded panel with separate Context and Account limits sections, larger labels, and readable reset details. Existing theme tokens and quota behavior are preserved.

Controls before refinement	Account menu after

Usage before refinement	Usage after

Light theme and 390px viewport

Account menu, light	Usage, light

Account menu, 390px	Usage, 390px

Provider settings before and after account support

Provider settings comparison: 12f919b before; b07e7a2 after. This surface is unchanged by the final session-control refinement.

Provider settings before	Provider settings after

Test plan

• Full CLI suite at 4bd670e: 2,751 passed / 13 skipped. After merging upstream 3f18d66 into bbeecde, 155 focused CLI tests and 114 component tests passed. CLI/component typechecks, repository static/i18n/boundary checks, formatting, CLI bundle/import validation, and embedded CLI synchronization passed.
• Real SQLite/Loro recovery: 30 cases passed, including ten new new-worktree cases covering missing native metadata, initializing placeholders, stale account/usage mirrors, and failed-save retry. Recovery restores account/native identity from the local binding, preserves history, and flushes before removing its marker. Root fork-operation map clearing is idempotent and reads as absent after reopen. Combined fork/binding/marker suites: 103 passed / 1 platform skip.
• Authentication: 76 focused profile/probe tests passed. System Default accepts supported environment authentication discovered in the actual merged launch environment; managed accounts and unexplained unknown status remain rejected. Other regressions cover queued cancellation, launch preparation, active login, duplicate request IDs, saturated continuation queues, local-source authorization, and cleanup. Managed Claude settings tests exercise the real SDK settings cascade in an isolated process.
• Real Electron UI at 2aa39b8: keyboard navigation and dark/light/390px captures passed; measured account menu 304px and usage panel 320px with no horizontal overflow. Selecting Account 1 through the new menu preserved the same session, transcript, and context, cleared previous-account limits, and displayed fresh current-account limits after continuation. Later changes preserve these controls; merged-head component tests verify their behavior.
• Previously completed full suites: components 3,223 passed; shared 1,037 passed / 5 skipped; RPC 101 passed / 3 skipped; Electron 98 passed. Relevant later targeted tests also passed.
• Actual built Electron, bundled CLI, and SQLite with a synthetic provider passed three concurrent sessions, switching only the middle session while preserving the other processes/homes/native threads/transcripts, then restarting and continuing all three. Separate edit/resend and shared-workspace fork runs preserved the selected account and native identity across restart.
• Continuation acknowledgement: 114 execution-service tests passed, including eight real-binding continuation cases. Local acknowledgement precedes display writes; a fresh service with stale display metadata does not replay consumed context after display-write/flush failure. Binding-write failure preserves retry. Reverting the ordering fails all three new regressions.
• Native-resume rejection: 138 focused classification, actual AgentClient load/resume-wrapper, and execution-service tests passed. Account fallback requires definitive unsupported/missing-session evidence; timeout, disconnect, crash, cancellation, and ambiguous resource errors restore the source binding. Ordinary resume recovery is preserved.
• Final 4bd670e validation: Linux static checks and tests passed, macOS desktop smoke passed, and fresh Codex review found no major issues. All findings from the previous reviews are fixed with regression coverage and their threads are resolved. The upstream document-size failure was repaired by routing explanation into the existing guide while preserving the binding rules.
• Current Claude maps both missing conversations and transient query closure to the same resource-not-found response. Account switching fails closed on that ambiguous response and retains the original binding; explicit unsupported or definitive missing-session responses can still continue. Pinned adapters are unchanged.
• Live provider login and cross-account native resume were not exercised with credentials. SQLite crash cases simulate durable interruption checkpoints rather than killing the daemon. The shared-workspace Electron fork fixture did not materialize a Git worktree.

Context handoff

Instructions for reviewing agents

• Review focus: Review account-profiles.ts isolation/leases, session-account-handoff.ts persistence and rollback, and start-only account selection across the saved-config authentication protocol.
• Decisions to challenge: Known native resume rejection falls back to a history continuation in the same Lody session; other startup failures preserve the old binding.
• Plausible failures / evidence gaps: Live provider authentication and cross-account native resume remain unverified; process-global leases coordinate one CLI host, not arbitrary external provider processes.

Authoring context

• User goal / directives: Implement independent Codex/Claude accounts, preserve normal session behavior, test unhappy paths, repair unsafe failures, and submit the change to LodyAI/Lody.
• Constraints / non-goals: Preserve System Default authentication, workspace identity, transcript, worktrees, and concurrent sessions; no automatic account rotation or credential copying.
• Risk-bearing decisions: Additional profiles use provider-native isolated homes. Handoff requires trusted local authorization, validates first, checkpoints intent, stops the old process, and commits the machine-local profile/native-session pair. Synced fields mirror that authority. Remote account operations are denied until a server-verified requester capability exists.
• Destructive or irreversible behavior: A handoff stops the selected idle provider process; failed candidates are stopped and metadata is rolled back. No account migration, default logout, deployment, or merge is included.
• Deliberately not done or tested: No live credential-based authentication or cross-account provider resume test. Synthetic processes validate isolation and recovery contracts; the existing custom ACP authentication fixture uses a real local child process.
• Unknowns / confidence: Local regression tests, upstream Linux CI, and macOS desktop smoke tests pass. Live native provider authentication and independent external processes remain unverified integration boundaries.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f63fa08d3d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4916673233

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: b07e7a2440

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c34861809e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9c24b31b4b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a106047990

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 10ae671dd1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e181f529c8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5dfd7585ef

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 45800a588e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1962dbf46e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbeecde896

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 075eede2a3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[slashdevcorpse]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 4bd670e76f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Leeeon233]

Hi @slashdevcorpse Thanks for the contribution! Since this is a fairly large PR, we’d prefer discussing the scope and approach in an issue first before moving forward.

For larger changes, please open an issue beforehand so we can align early and avoid unnecessary rework, time, and token usage.

[github-actions]

@slashdevcorpse, this pull request was closed because it did not meet Lody's contribution requirements for 7 days.

Open a new pull request using the current template to continue contributing this change. This pull request will not be reopened.