@claudexor/cli 3.0.3 → 3.1.0

package/dist/setup-login-inline.js

@@ -0,0 +1,206 @@
+/**
+ * D-17: inline CLI presentation of a durable codex device-code login job.
+ *
+ * Both `claudexor auth login codex` and `claudexor profiles login codex <id>`
+ * ride the SAME daemon-owned setup job; this helper polls the job snapshot,
+ * shows the one-time code + verification URL as soon as the runner discloses
+ * them (transient, from the snapshot overlay — never journaled), and follows
+ * the job to its typed terminal outcome. Ctrl-C detaches the CLI; the daemon
+ * runner keeps the login alive.
+ */
+import { createInterface } from "node:readline/promises";
+import { ControlSetupJob, ControlSetupJobSnapshot, isTerminalControlSetupJobState, } from "@claudexor/schema";
+import { print, printJson } from "./cli-io.js";
+import { controlApiFetch } from "./live.js";
+const POLL_MS = 1_000;
+const NEGATIVE_TERMINAL_STATES = ["failed", "cancelled", "timed_out", "not_supported"];
+/** The typed next action for a terminal job, or null for an ordinary outcome. */
+export function terminalLoginFallback(job) {
+    if (job.state === "not_supported" && job.nativeCommand?.errorCode === "device_auth_unsupported") {
+        return {
+            kind: "terminal_login_fallback",
+            reason: "device_auth_unsupported",
+            loginFlow: "browser_redirect",
+        };
+    }
+    return null;
+}
+/**
+ * D-17 audit point 8: the terminal report for a durable codex login. The
+ * `not_supported` state is actionable, not a dead-end message: when the daemon
+ * carries the consistent typed code `device_auth_unsupported` on the
+ * native-command receipt (the SAME code the runner result, journal, control
+ * DTO, and Swift surface use), the CLI names the code AND the exact next step
+ * (the legacy Terminal sign-in), and exits non-zero. Used for the non-TTY /
+ * declined path; a TTY OFFERS the transition directly (see below).
+ */
+export function terminalLoginReport(job, label, target = {}) {
+    if (terminalLoginFallback(job)) {
+        return {
+            lines: [
+                `${label} login not_supported (device_auth_unsupported): this codex build has no in-app device-code sign-in.`,
+                target.profileId
+                    ? "Next: retry this profile with the legacy Terminal sign-in (the browser-redirect flow)."
+                    : "Next: run `claudexor auth login codex --browser-redirect` for the Terminal sign-in.",
+            ],
+            exitCode: 1,
+        };
+    }
+    return {
+        lines: [`${label} login ${job.state}: ${job.message}`],
+        exitCode: job.state === "succeeded" ? 0 : 1,
+    };
+}
+/** Default TTY yes/no prompt. Declines (false) when stdin is not a TTY so a
+ * non-interactive pipe never blocks waiting for an answer. */
+async function defaultPromptYesNo(question) {
+    if (!process.stdin.isTTY)
+        return false;
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer === "y" || answer === "yes";
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Create the legacy Terminal (browser_redirect) login for the same target. This
+ * rides the daemon's existing duplicate-create / 409 semantics: the prior
+ * device-code job is already terminal (not_supported), so no conflict blocks
+ * it, and a real conflict surfaces the daemon's reason rather than silently
+ * starting a duplicate.
+ */
+async function createTerminalFallbackJob(fetchImpl, target, label) {
+    const response = await fetchImpl("/setup/jobs", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            harness: target.harness,
+            action: "login",
+            authRequest: "subscription",
+            loginFlow: "browser_redirect",
+            ...(target.profileId ? { profileId: target.profileId } : {}),
+        }),
+    });
+    if (!response.ok) {
+        print(`could not start the Terminal ${label} sign-in (${response.status}): ${await response.text()}`);
+        return 1;
+    }
+    const job = ControlSetupJob.parse(await response.json());
+    const accepted = !NEGATIVE_TERMINAL_STATES.includes(job.state);
+    print(accepted
+        ? `Opening the Terminal ${label} sign-in (managed by claudexord as ${job.jobId}). Complete it in the Terminal window that opens.`
+        : `Terminal ${label} sign-in was not started: ${job.message}`);
+    return accepted ? 0 : 1;
+}
+/**
+ * Poll a device-code login job. In TTY mode it prints the one-time code once
+ * and follows the job to its terminal outcome; on a device_auth_unsupported
+ * miss it OFFERS the legacy Terminal sign-in (a y/N prompt that, on yes, starts
+ * the browser_redirect job in one action). In `--json` mode it emits one JSON
+ * object: the transient disclosure (so a caller can complete the sign-in), the
+ * terminal outcome (with a typed `nextAction` on the fallback), or a
+ * detached/error envelope. Returns the process exit code (0 on success).
+ */
+export async function streamDurableCodexLogin(addr, jobId, opts = { label: "codex" }) {
+    const { label } = opts;
+    const json = opts.json ?? false;
+    const pollMs = opts.pollMs ?? POLL_MS;
+    const sleep = opts.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+    const fetchImpl = opts.fetchImpl ?? ((path, init) => controlApiFetch(addr, path, init));
+    const promptYesNo = opts.promptYesNo ?? defaultPromptYesNo;
+    let disclosed = false;
+    let detached = false;
+    const onSigint = () => {
+        detached = true;
+    };
+    process.once("SIGINT", onSigint);
+    try {
+        for (;;) {
+            if (detached) {
+                if (json) {
+                    printJson({ ok: true, detached: true, jobId });
+                    return 0;
+                }
+                print(`Detached. ${label} login keeps running as ${jobId}; ` +
+                    `re-attach with \`claudexor auth status\` or finish it in the browser.`);
+                return 0;
+            }
+            const response = await fetchImpl(`/setup/jobs/${encodeURIComponent(jobId)}/snapshot`);
+            if (!response.ok) {
+                if (json) {
+                    printJson({ ok: false, error: "snapshot_unavailable", status: response.status, jobId });
+                    return 1;
+                }
+                print(`could not read ${label} login status (${response.status}); it keeps running as ${jobId}`);
+                return 1;
+            }
+            const snapshot = ControlSetupJobSnapshot.parse(await response.json());
+            const job = snapshot.job;
+            const terminal = isTerminalControlSetupJobState(job.state);
+            if (json) {
+                // Return promptly once we know the flow's shape: a disclosure means the
+                // app-server supports device-code (hand the caller the code/URL); a
+                // terminal state (e.g. the fast device_auth_unsupported miss) carries
+                // the typed nextAction. This keeps `--json` bounded — it never blocks
+                // waiting for a human to finish the browser step.
+                if (!terminal && snapshot.deviceCode) {
+                    printJson({
+                        ok: true,
+                        job,
+                        deviceCode: {
+                            flow: snapshot.deviceCode.flow,
+                            verificationUrl: snapshot.deviceCode.verificationUrl,
+                            userCode: snapshot.deviceCode.userCode,
+                        },
+                    });
+                    return 0;
+                }
+                if (terminal) {
+                    const nextAction = terminalLoginFallback(job);
+                    printJson({ ok: job.state === "succeeded", job, ...(nextAction ? { nextAction } : {}) });
+                    return job.state === "succeeded" ? 0 : 1;
+                }
+                await sleep(pollMs);
+                continue;
+            }
+            // TTY mode.
+            if (snapshot.deviceCode && !disclosed) {
+                disclosed = true;
+                print("");
+                print(`Open:    ${snapshot.deviceCode.verificationUrl}`);
+                if (snapshot.deviceCode.userCode)
+                    print(`Code:    ${snapshot.deviceCode.userCode}`);
+                print(`Waiting for OpenAI… (Ctrl-C detaches; the login keeps running)`);
+                print("");
+            }
+            if (terminal) {
+                // device_auth_unsupported is a real fork, not a dead end: OFFER to start
+                // the legacy Terminal sign-in in one action (explicit y/N — never a
+                // silent fallback). Declining, or a non-TTY, falls back to the typed
+                // report that names the exact next command.
+                if (opts.fallback && terminalLoginFallback(job)) {
+                    print(`${label} login not_supported (device_auth_unsupported): this codex build has no in-app device-code sign-in.`);
+                    const yes = await promptYesNo("Start the legacy Terminal (browser-redirect) sign-in now? [y/N] ");
+                    if (yes)
+                        return await createTerminalFallbackJob(fetchImpl, opts.fallback, label);
+                    print(opts.fallback.profileId
+                        ? "You can retry this profile with the legacy Terminal (browser-redirect) sign-in later."
+                        : "You can start it later with `claudexor auth login codex --browser-redirect`.");
+                    return 1;
+                }
+                const report = terminalLoginReport(job, label, { profileId: opts.fallback?.profileId });
+                for (const line of report.lines)
+                    print(line);
+                return report.exitCode;
+            }
+            await sleep(pollMs);
+        }
+    }
+    finally {
+        process.removeListener("SIGINT", onSigint);
+    }
+}
+//# sourceMappingURL=setup-login-inline.js.map

package/dist/setup-login-inline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login-inline.js","sourceRoot":"","sources":["../src/setup-login-inline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,8BAA8B,GAE/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,eAAe,EAA0B,MAAM,WAAW,CAAC;AAEpE,MAAM,OAAO,GAAG,KAAK,CAAC;AAEtB,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AA0BvF,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CACnC,GAAqD;IAErD,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,IAAI,GAAG,CAAC,aAAa,EAAE,SAAS,KAAK,yBAAyB,EAAE,CAAC;QAChG,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAiE,EACjE,KAAa,EACb,SAAiC,EAAE;IAEnC,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE;gBACL,GAAG,KAAK,qGAAqG;gBAC7G,MAAM,CAAC,SAAS;oBACd,CAAC,CAAC,wFAAwF;oBAC1F,CAAC,CAAC,qFAAqF;aAC1F;YACD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,UAAU,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;QACtD,QAAQ,EAAE,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAC;AACJ,CAAC;AASD;8DAC8D;AAC9D,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CACtC,SAAoB,EACpB,MAAmC,EACnC,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,cAAc;YAC3B,SAAS,EAAE,kBAAkB;YAC7B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,KAAK,CACH,gCAAgC,KAAK,aAAa,QAAQ,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAC/F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,KAAK,CACH,QAAQ;QACN,CAAC,CAAC,wBAAwB,KAAK,sCAAsC,GAAG,CAAC,KAAK,mDAAmD;QACjI,CAAC,CAAC,YAAY,KAAK,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAChE,CAAC;IACF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAuB,EACvB,KAAa,EACb,OAAuC,EAAE,KAAK,EAAE,OAAO,EAAE;IAEzD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,IAAI,EAAE,CAAC;oBACT,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC/C,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,KAAK,CACH,aAAa,KAAK,2BAA2B,KAAK,IAAI;oBACpD,uEAAuE,CAC1E,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACtF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,EAAE,CAAC;oBACT,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBACxF,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,KAAK,CACH,kBAAkB,KAAK,kBAAkB,QAAQ,CAAC,MAAM,0BAA0B,KAAK,EAAE,CAC1F,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;YACzB,MAAM,QAAQ,GAAG,8BAA8B,CAAC,GAAG,CAAC,KAA6B,CAAC,CAAC;YAEnF,IAAI,IAAI,EAAE,CAAC;gBACT,wEAAwE;gBACxE,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,kDAAkD;gBAClD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACrC,SAAS,CAAC;wBACR,EAAE,EAAE,IAAI;wBACR,GAAG;wBACH,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;4BAC9B,eAAe,EAAE,QAAQ,CAAC,UAAU,CAAC,eAAe;4BACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ;yBACvC;qBACF,CAAC,CAAC;oBACH,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;oBAC9C,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;oBACzF,OAAO,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,YAAY;YACZ,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,SAAS,GAAG,IAAI,CAAC;gBACjB,KAAK,CAAC,EAAE,CAAC,CAAC;gBACV,KAAK,CAAC,YAAY,QAAQ,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;gBACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ;oBAAE,KAAK,CAAC,YAAY,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpF,KAAK,CAAC,gEAAgE,CAAC,CAAC;gBACxE,KAAK,CAAC,EAAE,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,yEAAyE;gBACzE,oEAAoE;gBACpE,qEAAqE;gBACrE,4CAA4C;gBAC5C,IAAI,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChD,KAAK,CACH,GAAG,KAAK,qGAAqG,CAC9G,CAAC;oBACF,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,kEAAkE,CACnE,CAAC;oBACF,IAAI,GAAG;wBAAE,OAAO,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACjF,KAAK,CACH,IAAI,CAAC,QAAQ,CAAC,SAAS;wBACrB,CAAC,CAAC,uFAAuF;wBACzF,CAAC,CAAC,8EAA8E,CACnF,CAAC;oBACF,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC;YACzB,CAAC;YACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/setup-login-protocol.d.ts

@@ -1,5 +1,5 @@
-import { type SetupLoginManifest, type SetupLoginPermit, type SetupLoginRunnerResult, type SetupLoginRunnerState, type SetupExecutableEvidence, type SetupProcessGroupHandle } from "@claudexor/schema";
-export type { SetupLoginManifest, SetupLoginPermit, SetupLoginRunnerResult, SetupLoginRunnerState, SetupProcessGroupHandle, SetupExecutableEvidence, };
+import { type SetupLoginDeviceCode, type SetupLoginManifest, type SetupLoginPermit, type SetupLoginRunnerResult, type SetupLoginRunnerState, type SetupExecutableEvidence, type SetupProcessGroupHandle } from "@claudexor/schema";
+export type { SetupLoginDeviceCode, SetupLoginManifest, SetupLoginPermit, SetupLoginRunnerResult, SetupLoginRunnerState, SetupProcessGroupHandle, SetupExecutableEvidence, };
 export declare const SETUP_LOGIN_PROTOCOL_VERSION: 2;
 export declare function readLoginManifest(path: string): SetupLoginManifest;
 export declare function captureExecutableEvidence(path: string): SetupExecutableEvidence;
@@ -9,5 +9,6 @@ export declare function verifyExecutableEvidence(expected: SetupExecutableEviden
 export declare function readRunnerState(path: string): SetupLoginRunnerState | null;
 export declare function readRunnerResult(path: string): SetupLoginRunnerResult | null;
 export declare function readRunnerPermit(path: string): SetupLoginPermit | null;
+export declare function readRunnerDeviceCode(path: string): SetupLoginDeviceCode | null;
 export declare function atomicPrivateJson(path: string, value: unknown): void;
 //# sourceMappingURL=setup-login-protocol.d.ts.map

package/dist/setup-login-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-login-protocol.d.ts","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAiBA,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAG,CAAU,CAAC;AAGvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAiClE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAqB/E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAIR;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAChD,kBAAkB,CAGpB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAQnF;AAiBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAM5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAMtE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CA+BpE"}
+{"version":3,"file":"setup-login-protocol.d.ts","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAG,CAAU,CAAC;AAGvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA4ClE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAqB/E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,uBAAuB,EACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAIR;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAChD,kBAAkB,CAGpB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAQnF;AAiBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAM5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAMtE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAM9E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CA+BpE"}

package/dist/setup-login-protocol.js

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeSync, } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { withExecutableInspection, isBoundedRegularExecutable } from "@claudexor/core";
-import { SetupLoginManifest as SetupLoginManifestSchema, SetupLoginPermit as SetupLoginPermitSchema, SetupLoginRunnerResult as SetupLoginRunnerResultSchema, SetupLoginRunnerState as SetupLoginRunnerStateSchema, } from "@claudexor/schema";
+import { SetupLoginDeviceCode as SetupLoginDeviceCodeSchema, SetupLoginManifest as SetupLoginManifestSchema, SetupLoginPermit as SetupLoginPermitSchema, SetupLoginRunnerResult as SetupLoginRunnerResultSchema, SetupLoginRunnerState as SetupLoginRunnerStateSchema, } from "@claudexor/schema";
 export const SETUP_LOGIN_PROTOCOL_VERSION = 2;
 const MAX_SIDECAR_BYTES = 1024 * 1024;
 export function readLoginManifest(path) {
@@ -32,6 +32,13 @@ export function readLoginManifest(path) {
         basename(manifest.permitPath) !== "runner-permit.json") {
         throw new Error("setup-login sidecar path escapes or relocates its daemon-owned job directory");
     }
+    if (manifest.deviceCodePath !== undefined) {
+        const deviceCodeParent = realpathSync(dirname(resolve(manifest.deviceCodePath)));
+        if (deviceCodeParent !== jobDir ||
+            basename(manifest.deviceCodePath) !== "runner-devicecode.json") {
+            throw new Error("setup-login device-code sidecar escapes or relocates its daemon-owned job directory");
+        }
+    }
     const cwd = realpathSync(manifest.cwd);
     if (cwd !== jobDir && !cwd.startsWith(jobDir + sep))
         throw new Error("setup-login cwd escapes its job directory");
@@ -113,6 +120,14 @@ export function readRunnerPermit(path) {
         return null;
     }
 }
+export function readRunnerDeviceCode(path) {
+    try {
+        return SetupLoginDeviceCodeSchema.parse(readPrivateJson(path));
+    }
+    catch {
+        return null;
+    }
+}
 export function atomicPrivateJson(path, value) {
     const absolute = resolve(path);
     const parent = dirname(absolute);

package/dist/setup-login-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-login-protocol.js","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EACL,kBAAkB,IAAI,wBAAwB,EAC9C,gBAAgB,IAAI,sBAAsB,EAC1C,sBAAsB,IAAI,4BAA4B,EACtD,qBAAqB,IAAI,2BAA2B,GAOrD,MAAM,mBAAmB,CAAC;AAW3B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AACvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,IACE,WAAW,KAAK,MAAM;QACtB,YAAY,KAAK,MAAM;QACvB,YAAY,KAAK,MAAM;QACvB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,mBAAmB;QACpD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB;QACtD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,wBAAwB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAmC,EACnC,IAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAiD;IAEjD,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,wBAAwB,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiC;IACxE,IAAI,CAAC;QACH,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,cAAc;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,QAAQ;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChG,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,GAAG,EACH,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAChF,KAAK,CACN,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3F,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAChG,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,GAAG,SAAS,CAAC;QACf,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1B,cAAc,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IACE,KAAK,CAAC,cAAc,EAAE;YACtB,CAAC,KAAK,CAAC,MAAM,EAAE;YACf,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"setup-login-protocol.js","sourceRoot":"","sources":["../src/setup-login-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EACL,oBAAoB,IAAI,0BAA0B,EAClD,kBAAkB,IAAI,wBAAwB,EAC9C,gBAAgB,IAAI,sBAAsB,EAC1C,sBAAsB,IAAI,4BAA4B,EACtD,qBAAqB,IAAI,2BAA2B,GAQrD,MAAM,mBAAmB,CAAC;AAY3B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AACvD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,IACE,WAAW,KAAK,MAAM;QACtB,YAAY,KAAK,MAAM;QACvB,YAAY,KAAK,MAAM;QACvB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,mBAAmB;QACpD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB;QACtD,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,oBAAoB,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACjF,IACE,gBAAgB,KAAK,MAAM;YAC3B,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,wBAAwB,EAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,wBAAwB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAmC,EACnC,IAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAiD;IAEjD,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,wBAAwB,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiC;IACxE,IAAI,CAAC;QACH,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA4B;IACzD,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,cAAc;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,QAAQ;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChG,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,GAAG,EACH,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAChF,KAAK,CACN,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3F,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAChG,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,GAAG,SAAS,CAAC;QACf,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1B,cAAc,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IACE,KAAK,CAAC,cAAc,EAAE;YACtB,CAAC,KAAK,CAAC,MAAM,EAAE;YACf,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/setup-login-runner.d.ts

@@ -17,4 +17,13 @@ export interface SetupLoginRunnerOptions {
 export declare function runSetupLogin(manifestPath: string, options?: SetupLoginRunnerOptions): Promise<number>;
 /** Worker entrypoint. Exported so the permit ordering can be fault-injected. */
 export declare function runSetupLoginWorker(manifestPath: string, options?: SetupLoginRunnerOptions): Promise<number>;
+/** Ring buffer of the last OUTPUT_TAIL_BYTES of tee'd vendor output. */
+export declare function createTailBuffer(): {
+    push(chunk: Buffer): void;
+    text(): string;
+};
+/** Strip terminal escapes (CSI, OSC, bare ESC, C0 controls except newline),
+ * redact secret-like tokens, and clamp - diagnostic evidence entering a
+ * durable journal/API surface, never a raw vendor log copy (INV-062). */
+export declare function boundedTail(text: string, truncated?: boolean): string;
 //# sourceMappingURL=setup-login-runner.d.ts.map

package/dist/setup-login-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-login-runner.d.ts","sourceRoot":"","sources":["../src/setup-login-runner.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAI9D,OAAO,EACL,mBAAmB,EAGpB,MAAM,iBAAiB,CAAC;AAgBzB,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAyJjB"}
+{"version":3,"file":"setup-login-runner.d.ts","sourceRoot":"","sources":["../src/setup-login-runner.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AAKjF,OAAO,EACL,mBAAmB,EAGpB,MAAM,iBAAiB,CAAC;AAsBzB,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,KAAK,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAiKjB;AA4KD,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,IAAI,MAAM,CAAA;CAAE,CAuBhF;AAED;;yEAEyE;AACzE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,MAAM,CAiBnE"}

package/dist/setup-login-runner.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
 import { realpathSync } from "node:fs";
+import { createInterface } from "node:readline";
 import { dirname, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { defaultProcessGroupService, } from "@claudexor/core";
 import { redactSecrets } from "@claudexor/util";
+import { startCodexDeviceLogin, } from "./codex-device-login.js";
 import { nativeLoginEnv } from "./native-login.js";
 import { SETUP_LOGIN_PROTOCOL_VERSION, atomicPrivateJson, readLoginManifest, readRunnerPermit, verifyExecutableEvidence, } from "./setup-login-protocol.js";
 const PERMIT_POLL_MS = 50;
@@ -73,6 +75,13 @@ export async function runSetupLoginWorker(manifestPath, options = {}) {
         return 1;
     }
     atomicPrivateJson(manifest.statePath, { ...awaitingPermit, stage: "running" });
+    // D-17 primary flow: host the codex app-server and drive typed device-code
+    // auth (no Terminal). The app-server child shares this detached worker's
+    // process group, so every restart/permit/termination evidence semantic is
+    // unchanged from the Terminal path.
+    if (manifest.loginMode === "device_code") {
+        return runDeviceCodeLogin(manifest, permit, { now, spawnProcess });
+    }
     // Device-auth capability gate (v3.0.3 S6): `--device-auth` exists only
     // since codex 0.46.0. Probe the vendor's own `login --help` BEFORE spawning
     // so an old CLI yields a typed unsupported outcome instead of an opaque
@@ -172,16 +181,190 @@ export async function runSetupLoginWorker(manifestPath, options = {}) {
     });
     return result.code === 0 && result.signal === null ? 0 : 1;
 }
+/**
+ * D-17 device-code login: host `codex app-server --stdio`, drive the typed
+ * device-code handshake, and write the transient disclosure sidecar (the
+ * one-time code lives ONLY there and is never persisted to the result receipt).
+ * Completion → exit 0 (the daemon then runs the unchanged native verification);
+ * a capability probe miss → `device_auth_unsupported` (the daemon demotes to
+ * the typed Terminal fallback, no stdout regex).
+ */
+async function runDeviceCodeLogin(manifest, permit, deps) {
+    const { now, spawnProcess } = deps;
+    if (!manifest.deviceCodePath || !manifest.appServerFlow) {
+        persistResult(manifest, {
+            permitIssuedAt: permit.issuedAt,
+            commandStarted: false,
+            errorCode: "spawn_failed",
+            exitCode: null,
+            signal: null,
+            finishedAt: now().toISOString(),
+        });
+        return 1;
+    }
+    let child;
+    try {
+        child = spawnProcess(manifest.binary, manifest.args, {
+            cwd: manifest.cwd,
+            env: nativeLoginEnv(manifest.harness, process.env, manifest.profileConfigDir),
+            detached: false,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    catch {
+        persistResult(manifest, {
+            permitIssuedAt: permit.issuedAt,
+            commandStarted: false,
+            errorCode: "spawn_failed",
+            exitCode: null,
+            signal: null,
+            finishedAt: now().toISOString(),
+        });
+        return 1;
+    }
+    child.stderr?.resume();
+    const connection = appServerConnection(child);
+    const abort = new AbortController();
+    const onSignal = () => abort.abort();
+    process.on("SIGTERM", onSignal);
+    process.on("SIGINT", onSignal);
+    const killChild = () => {
+        try {
+            child.kill("SIGTERM");
+        }
+        catch {
+            /* best-effort */
+        }
+    };
+    try {
+        const start = await startCodexDeviceLogin(connection, {
+            flow: manifest.appServerFlow,
+            signal: abort.signal,
+        });
+        if (start.kind === "not_supported") {
+            killChild();
+            // Typed capability-probe miss: reuse the existing not_supported outcome
+            // so the daemon offers the legacy Terminal fallback (no stdout regex).
+            persistResult(manifest, {
+                permitIssuedAt: permit.issuedAt,
+                commandStarted: false,
+                errorCode: "device_auth_unsupported",
+                exitCode: null,
+                signal: null,
+                finishedAt: now().toISOString(),
+            });
+            return 1;
+        }
+        // Transient disclosure sidecar. The userCode rides ONLY this file (read-time
+        // snapshot projection); it never enters the result receipt or the journal.
+        atomicPrivateJson(manifest.deviceCodePath, {
+            version: SETUP_LOGIN_PROTOCOL_VERSION,
+            jobId: manifest.jobId,
+            executionId: manifest.executionId,
+            flow: manifest.appServerFlow,
+            verificationUrl: start.disclosure.verificationUrl,
+            userCode: start.disclosure.userCode,
+            disclosedAt: now().toISOString(),
+        });
+        const outcome = await start.awaitCompletion();
+        killChild();
+        if (outcome.kind === "completed") {
+            persistResult(manifest, {
+                permitIssuedAt: permit.issuedAt,
+                commandStarted: true,
+                exitCode: 0,
+                signal: null,
+                finishedAt: now().toISOString(),
+            });
+            return 0;
+        }
+        persistResult(manifest, {
+            permitIssuedAt: permit.issuedAt,
+            commandStarted: true,
+            exitCode: 1,
+            signal: null,
+            finishedAt: now().toISOString(),
+            ...(outcome.kind === "failed" ? { outputTail: boundedTail(outcome.detail) } : {}),
+        });
+        return 1;
+    }
+    catch (error) {
+        killChild();
+        persistResult(manifest, {
+            permitIssuedAt: permit.issuedAt,
+            commandStarted: true,
+            exitCode: 1,
+            signal: null,
+            finishedAt: now().toISOString(),
+            outputTail: boundedTail(error instanceof Error ? error.message : String(error)),
+        });
+        return 1;
+    }
+    finally {
+        process.off("SIGTERM", onSignal);
+        process.off("SIGINT", onSignal);
+    }
+}
+/** Adapt a `codex app-server --stdio` child to the device-login transport seam
+ * (line-delimited JSON-RPC over the child's stdio). */
+function appServerConnection(child) {
+    const lines = createInterface({ input: child.stdout });
+    let frameHandler = null;
+    const closeHandlers = [];
+    lines.on("line", (line) => {
+        let frame;
+        try {
+            frame = JSON.parse(line);
+        }
+        catch {
+            return; // Vendor diagnostics are not protocol authority.
+        }
+        frameHandler?.(frame);
+    });
+    const closeWith = (error) => {
+        for (const handler of closeHandlers)
+            handler(error);
+    };
+    child.once("exit", (code, signal) => closeWith(new Error(`codex app-server exited: code=${String(code)} signal=${String(signal)}`)));
+    child.once("error", (error) => closeWith(error));
+    child.stdin?.on("error", () => undefined);
+    return {
+        send(frame) {
+            child.stdin?.write(`${JSON.stringify(frame)}\n`);
+        },
+        onFrame(handler) {
+            frameHandler = handler;
+        },
+        onClose(handler) {
+            closeHandlers.push(handler);
+        },
+        close() {
+            try {
+                child.stdin?.end();
+            }
+            catch {
+                /* best-effort */
+            }
+        },
+    };
+}
 const OUTPUT_TAIL_BYTES = 4096;
 /** Ring buffer of the last OUTPUT_TAIL_BYTES of tee'd vendor output. */
-function createTailBuffer() {
+export function createTailBuffer() {
     // Byte-accurate ring: keep the final OUTPUT_TAIL_BYTES RAW bytes and decode
     // ONCE in text() — a per-chunk String() decode splits multibyte UTF-8 into
     // replacement chars and a UTF-16 .slice miscounts the byte bound.
     let tail = Buffer.alloc(0);
+    // Whether the stream ever exceeded the ring — the truncation signal cannot
+    // be recovered from the decoded string's length (already <= the byte cap),
+    // so track it HERE and hand it to boundedTail (X224 ring-path fix).
+    let overflowed = false;
     return {
         push(chunk) {
-            tail = Buffer.concat([tail, chunk]).subarray(-OUTPUT_TAIL_BYTES);
+            const combined = Buffer.concat([tail, chunk]);
+            if (combined.length > OUTPUT_TAIL_BYTES)
+                overflowed = true;
+            tail = combined.subarray(-OUTPUT_TAIL_BYTES);
         },
         text() {
             // The ring can start mid-codepoint: drop leading continuation bytes
@@ -189,20 +372,31 @@ function createTailBuffer() {
             let start = 0;
             while (start < tail.length && (tail[start] & 0b1100_0000) === 0b1000_0000)
                 start += 1;
-            return boundedTail(tail.subarray(start).toString("utf8"));
+            return boundedTail(tail.subarray(start).toString("utf8"), overflowed || start > 0);
         },
     };
 }
 /** Strip terminal escapes (CSI, OSC, bare ESC, C0 controls except newline),
  * redact secret-like tokens, and clamp - diagnostic evidence entering a
  * durable journal/API surface, never a raw vendor log copy (INV-062). */
-function boundedTail(text) {
+export function boundedTail(text, truncated = false) {
     const plain = text
         // eslint-disable-next-line no-control-regex
         .replace(/\u001b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?)/g, "")
         // eslint-disable-next-line no-control-regex
         .replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, "");
-    return redactSecrets(plain.slice(-OUTPUT_TAIL_BYTES).trim().slice(0, 4000));
+    // When the source was truncated at the front (ring overflow, or a
+    // direct-string caller over the byte budget), a secret split by that
+    // boundary could leave a prefix-less fragment redactSecrets cannot anchor.
+    // Drop the leading partial token in that case; untruncated output is whole.
+    // The caller's flag is authoritative (a ring string is already <= the cap,
+    // so a length check here cannot see the cut); direct callers OR in their
+    // own over-budget check.
+    const cut = truncated || Buffer.byteLength(plain, "utf8") > OUTPUT_TAIL_BYTES;
+    let bounded = plain.slice(-OUTPUT_TAIL_BYTES);
+    if (cut)
+        bounded = bounded.replace(/^\S+/, "");
+    return redactSecrets(bounded.trim().slice(0, 4000));
 }
 /** Run `<binary> login --help` captured, bounded to 10s. Fails OPEN: only a
  * COMPLETED probe whose help text lacks the flag reports unsupported. */
@@ -320,6 +514,19 @@ function runnerBootstrapEnv(source = process.env) {
         "LOGNAME",
         "CLAUDEXOR_CODEX_NATIVE_HOME",
         "CLAUDEXOR_CLAUDE_NATIVE_DIR",
+        // Network reachability for the DETACHED worker: without the proxy/CA
+        // family a corporate-proxy machine cannot reach the vendor at all and
+        // the device-code login dies opaquely. Pass-through only — never set.
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "NO_PROXY",
+        "ALL_PROXY",
+        "http_proxy",
+        "https_proxy",
+        "no_proxy",
+        "SSL_CERT_FILE",
+        "SSL_CERT_DIR",
+        "NODE_EXTRA_CA_CERTS",
     ]) {
         if (source[key] !== undefined)
             env[key] = source[key];