feat: add Codex access token accounts

AGENTS.md

@@ -0,0 +1,45 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+Codex Switcher is a Tauri v2 desktop app with a React/TypeScript frontend and Rust backend.
+
+- `src/` contains the Vite/React UI. Key areas include `components/`, `hooks/`, `lib/`, and `types/`.
+- `src-tauri/src/` contains Rust backend code. Commands live in `commands/`, account persistence and switching in `auth/`, API calls in `api/`, and tray/app menu logic in `tray.rs` and `app_menu.rs`.
+- `src-tauri/icons/` stores app icons. Built frontend output goes to `dist/`.
+- `scripts/` contains versioning, release, and Tauri wrapper scripts.
+- Rust tests are colocated in `#[cfg(test)]` modules inside `src-tauri/src/**`.
+
+## Build, Test, and Development Commands
+
+- `pnpm install` installs frontend dependencies.
+- `pnpm tauri dev` runs the desktop app in development mode.
+- `pnpm build` runs TypeScript checking and builds the Vite frontend.
+- `cargo test --manifest-path src-tauri/Cargo.toml` runs Rust unit tests.
+- `pnpm lan` builds the frontend and serves the LAN dashboard through the `codex-web` binary.
+- `pnpm tauri build` builds production bundles/installers.
+
+On Windows, use `pnpm tauri:win` instead of the POSIX wrapper.
+
+## Coding Style & Naming Conventions
+
+Use idiomatic Rust and TypeScript. Keep Rust modules focused by domain, and keep React components small enough to scan. Use `cargo fmt --manifest-path src-tauri/Cargo.toml` for Rust formatting. Frontend formatting follows the existing TypeScript/React style: 2-space indentation, PascalCase components, camelCase variables/functions, and explicit shared types in `src/types/`.
+
+## Testing Guidelines
+
+Prefer focused Rust unit tests near the code being changed. For storage, auth, token handling, and process logic, add regression tests for the exact failure mode. There is no frontend test runner configured; use `pnpm build` as the required frontend verification. For risky UI or app-flow changes, manually run `pnpm tauri dev`.
+
+## Commit & Pull Request Guidelines
+
+Git history uses short conventional-style messages, for example `fix: write auth files atomically` or `feat: add Codex access token accounts`. Keep commits scoped and descriptive.
+
+Pull requests should include:
+
+- Summary of behavior changed.
+- Test plan with commands run.
+- Screenshots for visible UI changes.
+- Notes for auth, storage, updater, or release-impacting changes.
+
+## Security & Configuration Tips
+
+Never commit real tokens, account exports, `CODEX_ACCESS_TOKEN` values, or local credential files. `~/.codex-switcher/accounts.json` and `~/.codex/auth.json` contain secrets. When changing account persistence, preserve atomic writes and restrictive file permissions.

docs/superpowers/plans/2026-07-05-codex-access-token.md

@@ -0,0 +1,65 @@
+# Codex Access Token Account Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add accounts from a pasted `CODEX_ACCESS_TOKEN`, switch to them using `codex login --with-access-token`, and fetch K12/Codex usage/metadata in the same shape Codex CLI uses.
+
+**Architecture:** Store access-token accounts as a dedicated auth mode so existing OAuth and `auth.json` behavior stays unchanged. Parse JWT claims for display metadata, delegate actual login materialization to the Codex CLI via stdin during account switch, and use Codex's AgentIdentity request signing for access-token usage reads.
+
+**Tech Stack:** Rust/Tauri backend, React/TypeScript frontend, existing account store and modal patterns.
+
+---
+
+### Task 1: Backend Auth Model
+
+**Files:**
+- Modify: `src-tauri/src/types.rs`
+- Modify: `src-tauri/src/auth/switcher.rs`
+
+- [x] Add a failing Rust test for `StoredAccount::new_codex_access_token`.
+- [x] Add `AuthMode::CodexAccessToken` and `AuthData::CodexAccessToken`.
+- [x] Parse JWT payload claims `email`, `plan_type`, and `account_id` for display metadata.
+- [x] Keep existing API key and ChatGPT OAuth serialization unchanged.
+
+### Task 2: Backend Commands and Switch Flow
+
+**Files:**
+- Modify: `src-tauri/src/commands/account.rs`
+- Modify: `src-tauri/src/lib.rs`
+- Modify: `src-tauri/src/web.rs`
+
+- [x] Add `add_account_from_access_token(name, access_token)`.
+- [x] Validate non-empty token input.
+- [x] Switch access-token accounts by spawning `codex login --with-access-token` and writing the token to stdin.
+- [x] Register the command for desktop Tauri and LAN web invocation.
+
+### Task 3: Frontend UI
+
+**Files:**
+- Modify: `src/hooks/useAccounts.ts`
+- Modify: `src/components/AddAccountModal.tsx`
+- Modify: `src/App.tsx`
+
+- [x] Add hook method `addFromAccessToken`.
+- [x] Add an `Access Token` tab with a password textarea.
+- [x] Submit to backend, reload accounts, and refresh usage as existing add-account paths do.
+
+### Task 4: K12/Codex Usage and Metadata
+
+**Files:**
+- Modify: `src-tauri/src/api/usage.rs`
+- Modify: `src-tauri/src/commands/usage.rs`
+- Modify: `src-tauri/src/types.rs`
+
+- [x] Fetch access-token usage from `https://chatgpt.com/backend-api/wham/usage`.
+- [x] Register/decrypt AgentIdentity task IDs when needed and send `AgentAssertion` auth headers.
+- [x] Send `ChatGPT-Account-Id` from the access-token claims when available.
+- [x] Accept Codex usage payload aliases such as `primary`, `secondary`, `window_duration_mins`, and `resets_at`.
+- [x] Refresh stored email/plan metadata for access-token accounts from JWT claims.
+
+### Task 5: Verification
+
+- [x] Run targeted Rust tests for token parsing and Codex endpoint parsing.
+- [x] Run `cargo test --manifest-path src-tauri/Cargo.toml`.
+- [x] Run `pnpm build`.
+- [x] Smoke-test `k12_at` through the local web endpoint: metadata returns `k12`, usage returns `error: null` with 5-hour and weekly windows.

src-tauri/Cargo.toml

@@ -39,6 +39,8 @@ url = "2"
 flate2 = "1"
 chacha20poly1305 = "0.10"
 pbkdf2 = "0.12"
+ed25519-dalek = { version = "2.2", features = ["pkcs8"] }
+crypto_box = { version = "0.9", features = ["seal"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 plist = "1"