@alan-ai-hq/agent-manager-linux-arm64 0.1.135 → 0.1.136

package/alan-holder.cjs

@@ -20376,10 +20376,13 @@ var init_desired_state = __esm({
 function runProviderCredentialPath(runId) {
   return `/public/machines/me/runs/${encodeURIComponent(runId)}/provider-credential`;
 }
+function runCodexCredentialRefreshPath(runId) {
+  return `${runProviderCredentialPath(runId)}/refresh`;
+}
 function runAttachmentPath(runId, attachmentId) {
   return `/public/machines/me/runs/${encodeURIComponent(runId)}/attachments/${encodeURIComponent(attachmentId)}`;
 }
-var machineEndpointsSchema, machineCredentialGrantSchema, MACHINE_PATHS, machinePlatformSchema, machineRegisterRequestSchema, machineEnrollRequestSchema, machineRenewRequestSchema, machineRenewReusedSchema, deviceAuthorizationSchema, machineDeviceAuthorizationRequestSchema, machineDeviceTokenRequestSchema, machineDeviceTokenSchema, DEVICE_TOKEN_ERRORS, machineDeviceTokenErrorSchema, machineMcpCredentialRequestSchema, machineMcpCredentialSchema, runtimeReleaseSchema, machineSiblingSchema, MACHINE_SIBLINGS_LIMIT, machineSiblingsResponseSchema, runProviderCredentialSchema;
+var machineEndpointsSchema, machineCredentialGrantSchema, MACHINE_PATHS, machinePlatformSchema, machineRegisterRequestSchema, machineEnrollRequestSchema, machineRenewRequestSchema, machineRenewReusedSchema, deviceAuthorizationSchema, machineDeviceAuthorizationRequestSchema, machineDeviceTokenRequestSchema, machineDeviceTokenSchema, DEVICE_TOKEN_ERRORS, machineDeviceTokenErrorSchema, machineMcpCredentialRequestSchema, machineMcpCredentialSchema, runtimeReleaseSchema, machineSiblingSchema, MACHINE_SIBLINGS_LIMIT, machineSiblingsResponseSchema, runCodexCredentialSchema, runCodexCredentialRefreshRequestSchema, runProviderCredentialSchema;
 var init_machine_identity = __esm({
   "../shared/dist/runtime-v2/machine-identity.js"() {
     "use strict";
@@ -20494,9 +20497,20 @@ var init_machine_identity = __esm({
     machineSiblingsResponseSchema = external_exports.object({
       machines: external_exports.array(machineSiblingSchema).max(MACHINE_SIBLINGS_LIMIT)
     });
+    runCodexCredentialSchema = external_exports.object({
+      accessToken: external_exports.string().min(1),
+      chatgptAccountId: external_exports.string().min(1),
+      chatgptPlanType: external_exports.string().nullable()
+    });
+    runCodexCredentialRefreshRequestSchema = external_exports.object({
+      /** sha256 hex of the access token Codex was refused with; a newer stored token is returned instead of rotating. */
+      rejectedAccessTokenSha256: external_exports.string().regex(/^[0-9a-f]{64}$/).optional()
+    });
     runProviderCredentialSchema = external_exports.object({
       /** Environment variables for the agent CLI, e.g. ANTHROPIC_API_KEY; empty when the CLI's own login is used. */
-      env: external_exports.record(external_exports.string(), external_exports.string())
+      env: external_exports.record(external_exports.string(), external_exports.string()),
+      /** The team's Codex login for a cloud sandbox; absent where the CLI's own login is used. */
+      codex: runCodexCredentialSchema.optional()
     });
   }
 });
@@ -24102,11 +24116,20 @@ var init_chunk_DALFHI4B = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-R6R6ORR2.js
+// ../agent-core/dist/chunk-54ZRJOQP.js
 function specForErrorKind(errorKind) {
   const spec = ERROR_SPECS[errorKind];
   return { message: spec.message, errorKind, recoveryClass: spec.recoveryClass };
 }
+function withAgentSignIn(classified, harness) {
+  const agent = AGENT_SIGN_IN_BY_HARNESS.get(harness);
+  if (!agent || classified.message !== ERROR_SPECS.not_logged_in.message) return classified;
+  const local = agent.localSignIn ?? "sign in to it";
+  return {
+    ...classified,
+    message: `${agent.name} isn't signed in: for cloud runs connect it in Team settings \u2192 Integrations \u2192 Coding agents; on your computer ${local}; then retry.`
+  };
+}
 function embeddedJson(text2) {
   const start = text2.indexOf("{");
   if (start === -1) return void 0;
@@ -24265,7 +24288,8 @@ function retryOwnerFor(classified, harnessOwnsRetry, safe) {
   if (!safe) return "none";
   return classified.errorKind === "resume_failed" || classified.errorKind === "history_rejected" ? "alan_resume" : "user_confirmed_fresh_run";
 }
-function createCliProblem(classified, options) {
+function createCliProblem(observed, options) {
+  const classified = withAgentSignIn(observed, options.harness);
   const automatic = classified.recoveryClass === "auto_recovering";
   const harnessOwnsRetry = options.finality === "observation" && automatic;
   const safe = options.outcomeCertainty === "no_effect" || harnessOwnsRetry;
@@ -24295,9 +24319,9 @@ function createCliProblem(classified, options) {
     ...classified.resetsAt ? { resetsAt: classified.resetsAt } : {}
   });
 }
-var import_crypto2, ERROR_SPECS, AGENT_ERROR_KINDS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
-var init_chunk_R6R6ORR2 = __esm({
-  "../agent-core/dist/chunk-R6R6ORR2.js"() {
+var import_crypto2, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
+var init_chunk_54ZRJOQP = __esm({
+  "../agent-core/dist/chunk-54ZRJOQP.js"() {
     "use strict";
     init_chunk_YXWJW7I5();
     import_crypto2 = require("crypto");
@@ -24316,7 +24340,7 @@ var init_chunk_R6R6ORR2 = __esm({
         recoveryClass: "user_fixable"
       },
       not_logged_in: {
-        message: "Not logged in to the agent CLI on this computer. Sign in to it there (for Claude Code, run `claude` then `/login`), then retry.",
+        message: "The agent CLI isn't signed in: for cloud runs connect it in Team settings \u2192 Integrations \u2192 Coding agents; on your computer sign in to the CLI; then retry.",
         recoveryClass: "user_fixable"
       },
       not_authenticated: {
@@ -24407,6 +24431,19 @@ var init_chunk_R6R6ORR2 = __esm({
     AGENT_ERROR_KINDS = Object.keys(ERROR_SPECS).filter(
       (key) => key in ERROR_SPECS
     );
+    AGENT_SIGN_IN_BY_HARNESS = /* @__PURE__ */ new Map([
+      ["claude_cli", { name: "Claude Code", localSignIn: "run `claude` then `/login`" }],
+      ["codex_app_server", { name: "Codex", localSignIn: "run `codex login`" }],
+      ["codex_exec", { name: "Codex", localSignIn: "run `codex login`" }],
+      ["cursor_agent_cli", { name: "Cursor Agent", localSignIn: "run `cursor-agent login`" }],
+      ["copilot_cli", { name: "GitHub Copilot CLI", localSignIn: "run `copilot` then `/login`" }],
+      ["opencode_serve", { name: "OpenCode", localSignIn: "run `opencode auth login`" }],
+      ["droid_cli", { name: "Droid" }],
+      ["antigravity_cli", { name: "Antigravity" }],
+      ["grok_cli", { name: "Grok CLI" }],
+      ["kimi_cli", { name: "Kimi CLI" }],
+      ["command_code_cli", { name: "Command Code" }]
+    ]);
     STATUS_PREFIX = /\b(?:api error|status|http)[:\s]+(\d{3})\b/i;
     TEXT_RULES = [
       { kind: "auth_expired", pattern: /\bcodex cli connection expired\b|\breconnect openai codex\b/ },
@@ -24547,7 +24584,7 @@ var init_chunk_R6R6ORR2 = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-W3QH4J4A.js
+// ../agent-core/dist/chunk-YPYC4VBL.js
 function collectStrings(value, out) {
   if (typeof value === "string") out.push(value);
   else if (Array.isArray(value)) for (const item of value) collectStrings(item, out);
@@ -24917,11 +24954,11 @@ function silentStartError(name, timeoutMs) {
   };
 }
 var import_crypto3, import_fs4, import_path3, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
-var init_chunk_W3QH4J4A = __esm({
-  "../agent-core/dist/chunk-W3QH4J4A.js"() {
+var init_chunk_YPYC4VBL = __esm({
+  "../agent-core/dist/chunk-YPYC4VBL.js"() {
     "use strict";
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J4T6L5LX();
     init_chunk_YXWJW7I5();
     import_crypto3 = require("crypto");
@@ -26785,9 +26822,9 @@ var init_claude = __esm({
   "../agent-core/dist/providers/claude.js"() {
     "use strict";
     init_chunk_DALFHI4B();
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
@@ -28553,11 +28590,12 @@ async function withDeadline(work, clock, ms, what) {
     `codex app-server did not answer ${what} within ${ms} ms`
   );
 }
-async function handshake(session, log) {
+async function handshake(session, spec, log) {
+  const experimentalApi = spec.externalAuth !== void 0;
   const init = asRecord(
     await session.rpc.request("initialize", {
       clientInfo: CLIENT_INFO,
-      capabilities: { experimentalApi: false, requestAttestation: false }
+      capabilities: { experimentalApi, requestAttestation: false }
     })
   );
   const userAgent = asString(init?.userAgent);
@@ -28650,7 +28688,7 @@ function createCodexDriver(options = {}) {
       await started;
       try {
         const opening = (async () => {
-          await handshake(session, resolved.log);
+          await handshake(session, spec, resolved.log);
           await preflight(session, spec);
           return openThread(session, spec, resolved.log);
         })();
@@ -28917,9 +28955,9 @@ var init_codex = __esm({
   "../agent-core/dist/providers/codex.js"() {
     "use strict";
     init_chunk_DALFHI4B();
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
@@ -37686,9 +37724,9 @@ var require_dist = __commonJS({
 var init_dist = __esm({
   "../agent-core/dist/index.js"() {
     "use strict";
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J4T6L5LX();
     init_chunk_YXWJW7I5();
   }
@@ -38433,9 +38471,9 @@ var import_promises22, import_path9, import_crypto12, import_promises23, CURSOR_
 var init_acp3 = __esm({
   "../agent-core/dist/providers/acp.js"() {
     "use strict";
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
@@ -39250,7 +39288,7 @@ var init_acp3 = __esm({
 var init_classify = __esm({
   "../agent-core/dist/classify.js"() {
     "use strict";
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_YXWJW7I5();
   }
 });
@@ -39280,38 +39318,31 @@ function toTurnResult(harness, outcome2, spec, providerSessionId, clock, apiKeyS
       return { outcome: "aborted", ...session };
     case "interrupted":
       return { outcome: "interrupted", message: outcome2.reason, ...session };
-    case "failed":
-      return {
-        outcome: "failed",
-        message: outcome2.error.message,
-        problem: createCliProblem(outcome2.error, {
-          harness,
-          phase: "stream",
-          finality: "terminal",
-          outcomeCertainty: "effect_unknown",
-          occurredAt: new Date(clock.now()).toISOString(),
-          scope: { runId: spec.runId, conversationId: spec.conversationId },
-          apiKeySupplied
-        }),
-        ...session
-      };
+    case "failed": {
+      const problem = createCliProblem(outcome2.error, {
+        harness,
+        phase: "stream",
+        finality: "terminal",
+        outcomeCertainty: "effect_unknown",
+        occurredAt: new Date(clock.now()).toISOString(),
+        scope: { runId: spec.runId, conversationId: spec.conversationId },
+        apiKeySupplied
+      });
+      return { outcome: "failed", message: problem.detail, problem, ...session };
+    }
   }
 }
 function refusalResult(harness, refusal2, spec, clock, apiKeySupplied) {
-  const error61 = refusal2.classified ?? specForErrorKind("not_authenticated");
-  return {
-    outcome: "failed",
-    message: error61.message,
-    problem: createCliProblem(error61, {
-      harness,
-      phase: "preflight",
-      finality: "terminal",
-      outcomeCertainty: "no_effect",
-      occurredAt: new Date(clock.now()).toISOString(),
-      scope: { runId: spec.runId, conversationId: spec.conversationId },
-      apiKeySupplied
-    })
-  };
+  const problem = createCliProblem(refusal2.classified ?? specForErrorKind("not_authenticated"), {
+    harness,
+    phase: "preflight",
+    finality: "terminal",
+    outcomeCertainty: "no_effect",
+    occurredAt: new Date(clock.now()).toISOString(),
+    scope: { runId: spec.runId, conversationId: spec.conversationId },
+    apiKeySupplied
+  });
+  return { outcome: "failed", message: problem.detail, problem };
 }
 function createPersistentDriver(provider4, options) {
   const { log, clock } = options;
@@ -40144,9 +40175,9 @@ var import_http4, import_crypto13, import_promises24, import_path10, import_path
 var init_opencode = __esm({
   "../agent-core/dist/providers/opencode.js"() {
     "use strict";
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
@@ -41420,21 +41451,63 @@ var codex_exports = {};
 __export(codex_exports, {
   createCodexHolderDriver: () => createCodexHolderDriver
 });
+function sha2562(value) {
+  return (0, import_node_crypto12.createHash)("sha256").update(value).digest("hex");
+}
+function createCodexLogin(broker) {
+  const state = {};
+  return {
+    forTurn: (runId, tokens2) => {
+      state.runId = runId;
+      state.latest = tokens2;
+    },
+    externalAuth: {
+      current: async () => {
+        if (state.latest === void 0) throw new Error("No Codex sign-in for this turn");
+        state.given = state.latest;
+        return state.given;
+      },
+      refresh: async () => {
+        if (broker === void 0 || state.runId === void 0) {
+          throw new Error("Codex sign-in cannot be refreshed on this machine");
+        }
+        const rejected2 = state.given === void 0 ? void 0 : sha2562(state.given.accessToken);
+        const fresh = await broker.refresh(state.runId, rejected2);
+        state.latest = fresh;
+        state.given = fresh;
+        return fresh;
+      }
+    }
+  };
+}
+function withLogin(planned, externalAuth, accountId) {
+  return {
+    ...planned,
+    spec: { ...planned.spec, externalAuth },
+    key: JSON.stringify([planned.key, accountId])
+  };
+}
 function createCodexHolderDriver(options) {
   const clock = options.clock ?? systemClock2;
   const sessions = options.sessions ?? createCodexDriver({ ...options.timings, clock, log: options.log });
+  const login = createCodexLogin(options.codexCredentials);
   return createPersistentDriver(
     {
       harness: "codex_app_server",
       displayName: "Codex app-server",
-      plan: (spec, inputs, resumeId, managedMcp) => planCodexSession(spec, {
-        command: options.command ?? "codex",
-        cwd: spec.projectPath ?? options.defaultCwd,
-        cliEnv: options.cliEnvironment,
-        providerEnv: inputs.providerEnv,
-        ...managedMcp === void 0 ? {} : { managedMcp },
-        ...resumeId === void 0 ? {} : { resumeThreadId: resumeId }
-      }),
+      plan: (spec, inputs, resumeId, managedMcp) => {
+        const planned = planCodexSession(spec, {
+          command: options.command ?? "codex",
+          cwd: spec.projectPath ?? options.defaultCwd,
+          cliEnv: options.cliEnvironment,
+          providerEnv: inputs.providerEnv,
+          ...managedMcp === void 0 ? {} : { managedMcp },
+          ...resumeId === void 0 ? {} : { resumeThreadId: resumeId }
+        });
+        if (inputs.codex === void 0) return planned;
+        login.forTurn(spec.runId, inputs.codex);
+        return withLogin(planned, login.externalAuth, inputs.codex.chatgptAccountId);
+      },
       canResume: () => true,
       open: async (spec) => {
         const session = await sessions.open(spec);
@@ -41454,9 +41527,11 @@ function createCodexHolderDriver(options) {
     }
   );
 }
+var import_node_crypto12;
 var init_codex2 = __esm({
   "src/holder/drivers/codex.ts"() {
     "use strict";
+    import_node_crypto12 = require("crypto");
     init_dist();
     init_codex();
     init_persistent();
@@ -41908,9 +41983,9 @@ var import_crypto15, import_promises25, FACTORY_API_VERSION, FACTORY_PROTOCOL_VE
 var init_droid = __esm({
   "../agent-core/dist/providers/droid.js"() {
     "use strict";
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
@@ -42381,6 +42456,35 @@ var init_opencode2 = __esm({
 });
 
 // ../agent-core/dist/providers/antigravity.js
+function settingsPath(env) {
+  const home = env.HOME?.trim() || env.USERPROFILE?.trim();
+  return home ? (0, import_path12.resolve)(home, ".gemini", "antigravity-cli", "settings.json") : void 0;
+}
+async function readSettings(path) {
+  let raw;
+  try {
+    raw = (await (0, import_promises26.readFile)(path, "utf8")).trim();
+  } catch {
+    return {};
+  }
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : "malformed";
+  } catch {
+    return "malformed";
+  }
+}
+async function selectAntigravityApiKeyMode(env) {
+  const path = settingsPath(env);
+  if (!env.GEMINI_API_KEY?.trim() || path === void 0) return "no_key";
+  const settings2 = await readSettings(path);
+  if (settings2 === "malformed") return "malformed";
+  if (settings2.modelProvider === "gemini") return "already_selected";
+  await (0, import_promises26.mkdir)((0, import_path12.dirname)(path), { recursive: true });
+  await (0, import_promises26.writeFile)(path, JSON.stringify({ ...settings2, modelProvider: "gemini" }), { mode: 384 });
+  return "selected";
+}
 function readAntigravityCapabilities(version2, help) {
   const text2 = help.toLowerCase().replace(/\s+/g, " ");
   const structured = /\bstream-json\b/.test(text2) || /\bjsonl\b/.test(text2) || /\bjson\b/.test(text2);
@@ -42421,21 +42525,21 @@ function antigravityArgs(input2, capabilities, prompt) {
   ];
 }
 function workspaceRoot(cwd) {
-  for (let current = (0, import_path12.resolve)(cwd); ; current = (0, import_path12.dirname)(current)) {
-    if ((0, import_fs8.existsSync)((0, import_path12.join)(current, ".git"))) return current;
-    if ((0, import_path12.dirname)(current) === current) return (0, import_path12.resolve)(cwd);
+  for (let current = (0, import_path13.resolve)(cwd); ; current = (0, import_path13.dirname)(current)) {
+    if ((0, import_fs8.existsSync)((0, import_path13.join)(current, ".git"))) return current;
+    if ((0, import_path13.dirname)(current) === current) return (0, import_path13.resolve)(cwd);
   }
 }
 function instructionPaths(cwd) {
   const root = workspaceRoot(cwd);
   const paths = [];
-  for (let current = (0, import_path12.resolve)(cwd); ; current = (0, import_path12.dirname)(current)) {
-    const path = (0, import_path12.join)(current, INSTRUCTIONS_FILE);
+  for (let current = (0, import_path13.resolve)(cwd); ; current = (0, import_path13.dirname)(current)) {
+    const path = (0, import_path13.join)(current, INSTRUCTIONS_FILE);
     try {
       if ((0, import_fs8.existsSync)(path) && (0, import_fs8.statSync)(path).isFile()) paths.unshift(path);
     } catch {
     }
-    if (current === root || (0, import_path12.dirname)(current) === current) return paths;
+    if (current === root || (0, import_path13.dirname)(current) === current) return paths;
   }
 }
 function antigravityWorkspaceInstructions(cwd, maxChars = MAX_INSTRUCTION_CHARS) {
@@ -42689,7 +42793,7 @@ function normalizeAntigravityFrame(event) {
 }
 function antigravityBrainRoot(env) {
   const home = env.HOME?.trim() || env.USERPROFILE?.trim();
-  return home ? (0, import_path13.resolve)(home, ".gemini", "antigravity-cli", "brain") : void 0;
+  return home ? (0, import_path14.resolve)(home, ".gemini", "antigravity-cli", "brain") : void 0;
 }
 function parseEntry(text2) {
   try {
@@ -42727,14 +42831,14 @@ function childTranscriptPath(root, frame) {
   try {
     const url2 = new URL(logUri);
     if (url2.protocol !== "file:") return void 0;
-    path = (0, import_path13.resolve)((0, import_url3.fileURLToPath)(url2));
+    path = (0, import_path14.resolve)((0, import_url3.fileURLToPath)(url2));
   } catch {
     return void 0;
   }
-  const fromRoot = (0, import_path13.relative)(root, path);
-  if (!fromRoot || (0, import_path13.isAbsolute)(fromRoot) || fromRoot.split(import_path13.sep).includes("..")) return void 0;
+  const fromRoot = (0, import_path14.relative)(root, path);
+  if (!fromRoot || (0, import_path14.isAbsolute)(fromRoot) || fromRoot.split(import_path14.sep).includes("..")) return void 0;
   const expected = [conversationId, ...LOG_DIRS, TRANSCRIPT_FILE];
-  const segments = fromRoot.split(import_path13.sep);
+  const segments = fromRoot.split(import_path14.sep);
   const matches = segments.length === expected.length && segments.every((segment, index) => segment === expected[index]);
   return matches ? path : void 0;
 }
@@ -42912,11 +43016,15 @@ ${output2.stderr}`).join("\n")
     name: "antigravity_cli",
     capabilities,
     open: async (spec) => {
-      const found = await capabilities(spec.command, spec.env);
+      const [found, apiKeyMode] = await Promise.all([
+        capabilities(spec.command, spec.env),
+        selectAntigravityApiKeyMode(spec.env).catch(() => "unwritable")
+      ]);
       session.log.info("antigravity.opened", {
         version: found.version,
         structured: found.structuredPrint,
-        resumeId: spec.resumeSessionId
+        resumeId: spec.resumeSessionId,
+        apiKeyMode
       });
       return new AntigravitySession(
         provider2(spec, found, options.platform ?? process.platform),
@@ -42973,21 +43081,24 @@ function antigravityTurnInput(run, context) {
   });
   return { turnId: run.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_fs8, import_path12, import_path13, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
+var import_promises26, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
 var init_antigravity = __esm({
   "../agent-core/dist/providers/antigravity.js"() {
     "use strict";
     init_chunk_DALFHI4B();
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
     init_chunk_YXWJW7I5();
-    import_fs8 = require("fs");
+    import_promises26 = require("fs/promises");
     import_path12 = require("path");
-    init_effort();
+    init_type_guards();
+    import_fs8 = require("fs");
     import_path13 = require("path");
+    init_effort();
+    import_path14 = require("path");
     import_url3 = require("url");
     import_crypto16 = require("crypto");
     init_agent2();
@@ -43027,7 +43138,7 @@ var init_antigravity = __esm({
       #full;
       constructor(path) {
         this.#cursor = new TranscriptCursor(path);
-        this.#fullPath = (0, import_path13.resolve)((0, import_path13.dirname)(path), FULL_TRANSCRIPT_FILE);
+        this.#fullPath = (0, import_path14.resolve)((0, import_path14.dirname)(path), FULL_TRANSCRIPT_FILE);
       }
       skipExisting() {
         this.#cursor.read();
@@ -43075,7 +43186,7 @@ var init_antigravity = __esm({
       /** A conversation this turn did not resume was created by it, so it is read whole. */
       trackParent(conversationId) {
         if (this.#parent?.conversationId === conversationId) return;
-        const path = (0, import_path13.resolve)(this.#root, conversationId, ...LOG_DIRS, TRANSCRIPT_FILE);
+        const path = (0, import_path14.resolve)(this.#root, conversationId, ...LOG_DIRS, TRANSCRIPT_FILE);
         this.#parent = { conversationId, transcript: new BrainTranscript(path) };
       }
       /** A launcher keeps the first valid transcript it names; later frames change nothing. */
@@ -43480,8 +43591,8 @@ function parseConfig(raw) {
   }
 }
 async function writeCommandCodeProjectMcp(cwd, mcp) {
-  const path = (0, import_path14.join)(cwd, ".mcp.json");
-  const original = await (0, import_promises26.readFile)(path, "utf8").catch(() => null);
+  const path = (0, import_path15.join)(cwd, ".mcp.json");
+  const original = await (0, import_promises27.readFile)(path, "utf8").catch(() => null);
   const config2 = parseConfig(original);
   const next = {
     ...config2,
@@ -43498,12 +43609,12 @@ async function writeCommandCodeProjectMcp(cwd, mcp) {
       }
     }
   };
-  await (0, import_promises26.mkdir)(cwd, { recursive: true });
-  await (0, import_promises26.writeFile)(path, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises27.mkdir)(cwd, { recursive: true });
+  await (0, import_promises27.writeFile)(path, `${JSON.stringify(next, null, 2)}
 `);
   return async () => {
-    if (original === null) await (0, import_promises26.rm)(path, { force: true });
-    else await (0, import_promises26.writeFile)(path, original);
+    if (original === null) await (0, import_promises27.rm)(path, { force: true });
+    else await (0, import_promises27.writeFile)(path, original);
   };
 }
 function commandCodeString(value) {
@@ -43675,19 +43786,19 @@ function commandCodeTurnInput(run, context) {
   });
   return { turnId: run.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises26, import_path14, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
+var import_promises27, import_path15, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
 var init_command_code = __esm({
   "../agent-core/dist/providers/command-code.js"() {
     "use strict";
-    init_chunk_W3QH4J4A();
+    init_chunk_YPYC4VBL();
     init_chunk_UGRKZTAD();
-    init_chunk_R6R6ORR2();
+    init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_J4T6L5LX();
     init_chunk_6WN2R725();
     init_chunk_YXWJW7I5();
-    import_promises26 = require("fs/promises");
-    import_path14 = require("path");
+    import_promises27 = require("fs/promises");
+    import_path15 = require("path");
     init_agent2();
     init_runtime_v2();
     init_acp();
@@ -44720,6 +44831,13 @@ function createHolderApiClient({
       }
       return runProviderCredentialSchema.parse(jsonBody(response));
     },
+    refreshCodexCredential: async (runId, body, signal) => {
+      const response = await request2("POST", runCodexCredentialRefreshPath(runId), signal, body);
+      if (!isOk(response)) {
+        throw new RuntimeFault("io_failed", `Codex sign-in refresh failed: ${response.status}`);
+      }
+      return runCodexCredentialSchema.parse(jsonBody(response));
+    },
     mintMcpCredential: async (conversationId, signal) => {
       const response = await request2("POST", MACHINE_PATHS.mcpCredential, signal, {
         conversationId
@@ -45952,16 +46070,33 @@ function uint642(value) {
 // src/capabilities/skills/store.ts
 var import_promises19 = require("fs/promises");
 var import_node_path11 = require("path");
+
+// ../shared/dist/node/alan-skill-identity.js
+var import_node_crypto9 = require("crypto");
+var ALAN_SKILL_NAMESPACE = "ec71d99b-d207-4ca2-a9eb-3a7bed4a73fd";
+function uuidV5(name, namespace) {
+  const bytes = (0, import_node_crypto9.createHash)("sha1").update(Buffer.from(namespace.replaceAll("-", ""), "hex")).update(name, "utf8").digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex3 = bytes.toString("hex");
+  return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-${hex3.slice(12, 16)}-${hex3.slice(16, 20)}-${hex3.slice(20)}`;
+}
+function alanSkillId(slug) {
+  return uuidV5(`alan:${slug}`, ALAN_SKILL_NAMESPACE);
+}
+
+// src/capabilities/skills/store.ts
 init_runtime_v2();
 init_zod();
-function skillsLayout(stateDir) {
+function skillsLayout(stateDir, home) {
   const root = (0, import_node_path11.join)(stateDir, "skills");
   return {
     root,
     installedFile: (0, import_node_path11.join)(root, "installed.json"),
     localFile: (0, import_node_path11.join)(root, "local.json"),
     versionsDir: (0, import_node_path11.join)(root, "versions"),
-    tmpDir: (0, import_node_path11.join)(root, "tmp")
+    tmpDir: (0, import_node_path11.join)(root, "tmp"),
+    nativeDir: home === void 0 || home === "" ? null : (0, import_node_path11.join)(home, ".agents", "skills")
   };
 }
 function packageDirectory(layout, versionId) {
@@ -46022,6 +46157,17 @@ async function isIntact(layout, skill) {
     return false;
   }
 }
+async function resolveNativeBuiltIn(layout, invocation) {
+  const slug = invocation.displayName;
+  if (layout.nativeDir === null || invocation.skillId !== alanSkillId(slug)) return null;
+  const directory = (0, import_node_path11.join)(layout.nativeDir, slug);
+  try {
+    await inspectSkillPackage(directory, { expectedName: slug });
+    return { packageDirectory: directory };
+  } catch {
+    return null;
+  }
+}
 async function resolveSkillInvocations(layout, invocations) {
   if (invocations.length === 0) return { kind: "resolved", skills: [] };
   const installed = await readInstalledSkills(layout);
@@ -46040,9 +46186,11 @@ async function resolveSkillInvocations(layout, invocations) {
     );
     if (skill !== void 0 && await isIntact(layout, skill)) {
       resolved.push({ packageDirectory: packageDirectory(layout, skill.versionId) });
-    } else {
-      missing.push(invocation.displayName);
+      continue;
     }
+    const native = await resolveNativeBuiltIn(layout, invocation);
+    if (native === null) missing.push(invocation.displayName);
+    else resolved.push(native);
   }
   return missing.length === 0 ? { kind: "resolved", skills: resolved } : { kind: "missing", names: missing };
 }
@@ -46148,7 +46296,7 @@ async function openApprovedPaths(options) {
 }
 
 // src/capabilities/workspace/locks.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_promises21 = require("fs/promises");
 var import_node_path13 = require("path");
 init_zod();
@@ -46165,7 +46313,7 @@ var ownerSchema = external_exports.object({
   since: external_exports.number().int().nonnegative()
 });
 function repositoryLockKey(commonDir, platform) {
-  return (0, import_node_crypto9.createHash)("sha256").update(comparablePath(commonDir, platform)).digest("hex").slice(0, 32);
+  return (0, import_node_crypto10.createHash)("sha256").update(comparablePath(commonDir, platform)).digest("hex").slice(0, 32);
 }
 async function readOwner(path) {
   let text2;
@@ -46278,7 +46426,7 @@ function openRepositoryLocks(options) {
     },
     tryShared: async (commonDir, runId) => {
       const { key, dir } = await folder(commonDir);
-      const file2 = `${RUN_FILE_PREFIX}${(0, import_node_crypto9.createHash)("sha256").update(runId).digest("hex").slice(0, 32)}.json`;
+      const file2 = `${RUN_FILE_PREFIX}${(0, import_node_crypto10.createHash)("sha256").update(runId).digest("hex").slice(0, 32)}.json`;
       const path = (0, import_node_path13.join)(dir, file2);
       const owner = await self(runId);
       await writeJsonFileAtomic(path, owner);
@@ -46314,13 +46462,13 @@ function defaultInstallDir({ platform, home, env }) {
 }
 
 // src/sessions/index.ts
-var import_node_crypto13 = require("crypto");
-var import_promises34 = require("fs/promises");
+var import_node_crypto15 = require("crypto");
+var import_promises35 = require("fs/promises");
 var import_node_os6 = require("os");
 var import_node_path26 = require("path");
 
 // src/holder/control-client.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_node_net = require("net");
 
 // src/holder/ndjson.ts
@@ -46549,7 +46697,7 @@ function createConversationMcpAuthorization(options) {
 }
 
 // src/holder/run-inputs.ts
-var import_promises27 = require("fs/promises");
+var import_promises28 = require("fs/promises");
 var import_node_path17 = require("path");
 var NO_RUN_INPUTS = {
   attachments: [],
@@ -46565,16 +46713,16 @@ function safeFilename(filename) {
 async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
   const dir = (0, import_node_path17.join)(tmpDir, "runs", spec.runId);
   const cleanup = async () => {
-    await (0, import_promises27.rm)(dir, { recursive: true, force: true });
+    await (0, import_promises28.rm)(dir, { recursive: true, force: true });
   };
   try {
     const credential = await source.fetchProviderCredential(spec.runId, signal);
     const attachments = [];
-    if (spec.attachments?.length) await (0, import_promises27.mkdir)(dir, { recursive: true, mode: 448 });
+    if (spec.attachments?.length) await (0, import_promises28.mkdir)(dir, { recursive: true, mode: 448 });
     for (const [index, attachment] of (spec.attachments ?? []).entries()) {
       const bytes = await source.downloadAttachment(spec.runId, attachment.id, signal);
       const path = (0, import_node_path17.join)(dir, `${index}-${safeFilename(attachment.filename)}`);
-      await (0, import_promises27.writeFile)(path, bytes, { mode: 384 });
+      await (0, import_promises28.writeFile)(path, bytes, { mode: 384 });
       attachments.push({
         id: attachment.id,
         kind: attachment.kind,
@@ -46587,7 +46735,13 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
         ...attachment.height === void 0 ? {} : { height: attachment.height }
       });
     }
-    return { attachments, providerEnv: credential.env, skills, [Symbol.asyncDispose]: cleanup };
+    return {
+      attachments,
+      providerEnv: credential.env,
+      ...credential.codex === void 0 ? {} : { codex: credential.codex },
+      skills,
+      [Symbol.asyncDispose]: cleanup
+    };
   } catch (error61) {
     await cleanup();
     throw error61;
@@ -46595,7 +46749,7 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
 }
 
 // src/holder/serve.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto14 = require("crypto");
 var import_node_fs10 = require("fs");
 var import_node_net2 = require("net");
 var import_node_path25 = require("path");
@@ -46603,7 +46757,7 @@ init_runtime_v2();
 
 // src/holder/admission.ts
 var import_node_fs8 = require("fs");
-var import_promises31 = require("fs/promises");
+var import_promises32 = require("fs/promises");
 var import_node_os5 = require("os");
 var import_node_path22 = require("path");
 init_constants();
@@ -46617,7 +46771,7 @@ function resolveAlanDefaultWorkspacePath(homeDirectory = (0, import_node_os4.hom
 }
 
 // src/holder/admission-relocation.ts
-var import_promises28 = require("fs/promises");
+var import_promises29 = require("fs/promises");
 var import_node_path19 = require("path");
 var MAX_RELOCATION_CANDIDATES = 200;
 var RELOCATION_BUDGET_MS = 2e4;
@@ -46653,7 +46807,7 @@ async function originIdentity(git, path, signal) {
 }
 async function childDirectories(parent, limit) {
   try {
-    const entries = await (0, import_promises28.readdir)(parent, { withFileTypes: true });
+    const entries = await (0, import_promises29.readdir)(parent, { withFileTypes: true });
     return entries.filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path19.join)(parent, entry.name));
   } catch {
     return [];
@@ -46689,8 +46843,8 @@ async function discoverRelocatedWorkspace(search) {
 }
 
 // src/holder/checkout-refresh.ts
-var import_node_crypto11 = require("crypto");
-var import_promises29 = require("fs/promises");
+var import_node_crypto13 = require("crypto");
+var import_promises30 = require("fs/promises");
 var import_node_path20 = require("path");
 function short(sha) {
   return sha.slice(0, 12);
@@ -46703,8 +46857,8 @@ function staleLine(path, snapshot2, tip) {
 }
 async function claimOnce(dir, name) {
   try {
-    await (0, import_promises29.mkdir)(dir, { recursive: true, mode: 448 });
-    await (await (0, import_promises29.open)((0, import_node_path20.join)(dir, name), "wx")).close();
+    await (0, import_promises30.mkdir)(dir, { recursive: true, mode: 448 });
+    await (await (0, import_promises30.open)((0, import_node_path20.join)(dir, name), "wx")).close();
     return true;
   } catch {
     return false;
@@ -46736,7 +46890,7 @@ async function fastForward(freshness, operationId, deps, signal) {
 async function atFirstLease(freshness, spec, deps, signal) {
   const first = await claimOnce(
     (0, import_node_path20.join)(deps.dir, "leased"),
-    (0, import_node_crypto11.createHash)("sha256").update(freshness.path).digest("hex")
+    (0, import_node_crypto13.createHash)("sha256").update(freshness.path).digest("hex")
   );
   switch (freshness.state) {
     case "current":
@@ -46787,7 +46941,7 @@ function createCheckoutRefresh(deps) {
 }
 
 // src/holder/lease.ts
-var import_promises30 = require("fs/promises");
+var import_promises31 = require("fs/promises");
 var import_node_path21 = require("path");
 var LEASE_CHECK_EVERY_MS = 5e3;
 var MAX_TRANSIENT_FAILURES = 3;
@@ -46802,8 +46956,8 @@ function identityFailure(code, workspacePath) {
   return { code, problemCode: "app.workspace.missing", message: MESSAGES[code], workspacePath };
 }
 async function fileIdentity(path) {
-  const canonical = await (0, import_promises30.realpath)(path);
-  const info = await (0, import_promises30.stat)(canonical, { bigint: true });
+  const canonical = await (0, import_promises31.realpath)(path);
+  const info = await (0, import_promises31.stat)(canonical, { bigint: true });
   return `${canonical}:${info.dev}:${info.ino}`;
 }
 async function snapshot(git, path, signal) {
@@ -46822,7 +46976,7 @@ async function snapshot(git, path, signal) {
       workspace: await fileIdentity(path),
       repository: await fileIdentity(commonDir),
       worktree: await fileIdentity(gitDir),
-      commonDir: await (0, import_promises30.realpath)(commonDir)
+      commonDir: await (0, import_promises31.realpath)(commonDir)
     };
   } catch {
     return null;
@@ -46835,7 +46989,7 @@ async function gitValue(git, path, args, signal) {
 }
 async function pathExists(path) {
   try {
-    await (0, import_promises30.stat)(path);
+    await (0, import_promises31.stat)(path);
     return true;
   } catch (error61) {
     return errnoCode(error61) !== "ENOENT" && errnoCode(error61) !== "ENOTDIR";
@@ -46844,13 +46998,13 @@ async function pathExists(path) {
 async function hasGitMarker(path) {
   let directory;
   try {
-    directory = await (0, import_promises30.realpath)(path);
+    directory = await (0, import_promises31.realpath)(path);
   } catch {
     return true;
   }
   for (; ; ) {
     try {
-      await (0, import_promises30.stat)((0, import_node_path21.join)(directory, ".git"));
+      await (0, import_promises31.stat)((0, import_node_path21.join)(directory, ".git"));
       return true;
     } catch (error61) {
       const code = errnoCode(error61);
@@ -47020,7 +47174,7 @@ function volumeRoot(path) {
 }
 async function exists(path) {
   try {
-    await (0, import_promises31.stat)(path);
+    await (0, import_promises32.stat)(path);
     return true;
   } catch {
     return false;
@@ -47028,10 +47182,10 @@ async function exists(path) {
 }
 async function inspectReadiness(path) {
   try {
-    if (!(await (0, import_promises31.stat)(path)).isDirectory()) {
+    if (!(await (0, import_promises32.stat)(path)).isDirectory()) {
       return { ready: false, missing: true, message: MESSAGES2.missing };
     }
-    await (0, import_promises31.access)(path, import_node_fs8.constants.R_OK | import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
+    await (0, import_promises32.access)(path, import_node_fs8.constants.R_OK | import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
     return { ready: true };
   } catch (error61) {
     const code = errnoCode(error61) ?? "";
@@ -47109,8 +47263,8 @@ async function admitDefaultWorkspace(spec, context, skills) {
   const { env } = context;
   const path = resolveAlanDefaultWorkspacePath(env.HOME || env.USERPROFILE || (0, import_node_os5.homedir)());
   try {
-    await (0, import_promises31.mkdir)(path, { recursive: true, mode: 448 });
-    await (0, import_promises31.access)(path, import_node_fs8.constants.R_OK | import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
+    await (0, import_promises32.mkdir)(path, { recursive: true, mode: 448 });
+    await (0, import_promises32.access)(path, import_node_fs8.constants.R_OK | import_node_fs8.constants.W_OK | import_node_fs8.constants.X_OK);
     return {
       kind: "admitted",
       spec: { ...spec, projectPath: path },
@@ -47181,7 +47335,10 @@ function createHolderWorkspace(machine, clock, log) {
       env: machine.env,
       git,
       platform,
-      skills: skillsLayout(machine.stateDir),
+      skills: skillsLayout(
+        machine.stateDir,
+        machine.env.HOME || machine.env.USERPROFILE || (0, import_node_os5.homedir)()
+      ),
       approvedRoots: async () => {
         const approved = await openApprovedPaths({
           file: (0, import_node_path22.join)(machine.stateDir, "workspaces.json"),
@@ -47225,7 +47382,7 @@ async function respondToTurn(runningRunId, gate, driver, request2) {
 }
 
 // src/holder/session-facts.ts
-var import_promises32 = require("fs/promises");
+var import_promises33 = require("fs/promises");
 var CLI_RSS_CACHE_MS = 1e4;
 var LOGIN_PROBLEM_PREFIX = "cli.auth.";
 function isLoginFailure(result) {
@@ -47251,8 +47408,8 @@ function createSessionFacts(options) {
     const path = await resolveCommandOnPath(command, env, platform);
     if (path === null) return null;
     try {
-      const real = await (0, import_promises32.realpath)(path);
-      const info = await (0, import_promises32.stat)(real);
+      const real = await (0, import_promises33.realpath)(path);
+      const info = await (0, import_promises33.stat)(real);
       return { command, key: `${real}:${info.ino}:${info.size}:${info.mtimeMs}` };
     } catch {
       return null;
@@ -47339,7 +47496,7 @@ function createSessionFacts(options) {
 init_acp2();
 
 // src/run-log/directory.ts
-var import_promises33 = require("fs/promises");
+var import_promises34 = require("fs/promises");
 var import_node_path23 = require("path");
 init_runtime_v2();
 init_zod();
@@ -47355,7 +47512,7 @@ function runDirectory(runsDir, runId) {
 }
 async function isRunClaimed(runsDir, runId) {
   try {
-    return (await (0, import_promises33.stat)(runDirectory(runsDir, runId).log)).size > 0;
+    return (await (0, import_promises34.stat)(runDirectory(runsDir, runId).log)).size > 0;
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return false;
     throw error61;
@@ -47703,13 +47860,13 @@ var TASK_UNSUPPORTED = {
   reason: "unsupported",
   message: "This agent cannot stop one background task."
 };
-function sha2562(value) {
-  return (0, import_node_crypto12.createHash)("sha256").update(value).digest("hex");
+function sha2563(value) {
+  return (0, import_node_crypto14.createHash)("sha256").update(value).digest("hex");
 }
 function tokenMatches(expected, presented) {
-  const a = Buffer.from(sha2562(expected), "hex");
-  const b = Buffer.from(sha2562(presented), "hex");
-  return (0, import_node_crypto12.timingSafeEqual)(a, b);
+  const a = Buffer.from(sha2563(expected), "hex");
+  const b = Buffer.from(sha2563(presented), "hex");
+  return (0, import_node_crypto14.timingSafeEqual)(a, b);
 }
 async function runHolder({
   launch,
@@ -47746,7 +47903,7 @@ async function runHolder({
       startedAt: identity.startedAt,
       ...identity.command === void 0 ? {} : { command: identity.command },
       endpoint: launch.endpoint,
-      tokenSha256: sha2562(launch.token),
+      tokenSha256: sha2563(launch.token),
       state: holder.state,
       runId: holder.runId,
       updatedAt: clock.now()
@@ -48210,7 +48367,14 @@ async function machineAccess(paths, log, conversationId, transport) {
       return (await api()).fetchProviderCredential(runId, signal);
     }
   };
-  return { source, managedMcp };
+  const codexCredentials = {
+    refresh: async (runId, rejectedAccessTokenSha256) => (await api()).refreshCodexCredential(
+      runId,
+      rejectedAccessTokenSha256 === void 0 ? {} : { rejectedAccessTokenSha256 },
+      new AbortController().signal
+    )
+  };
+  return { source, managedMcp, codexCredentials };
 }
 async function runHold(argv) {
   var _stack = [];
@@ -48245,6 +48409,7 @@ async function runHold(argv) {
         defaultCwd: process.cwd(),
         timings: config2.sessionTimings,
         log,
+        codexCredentials: access3.codexCredentials,
         ...access3.managedMcp === void 0 ? {} : { managedMcp: access3.managedMcp }
       }),
       clock: systemClock,