@codeworksh/cli 0.0.1-dev.20260922135856 → 0.0.1-dev.20260922184805

package/{entries-DBdy6ahj.mjs → entries-Gfsq7U4P.mjs}

@@ -1,4 +1,4 @@
-import { F as anchor, G as probe$1, M as load, P as projectRoot, W as parse, gt as resolve } from "./error-DTXBm1nO.mjs";
+import { I as projectRoot, K as parse, L as anchor, P as load, bt as resolve, q as probe$1 } from "./error-BrbT9_4g.mjs";
 import { Effect, Option, Path } from "effect";
 //#region src/cli/cmd/handlers/plugin/entries.ts
 /** Only a string entry loads a module; `{ package }` is configuration for one already selected. */
@@ -45,4 +45,4 @@ const fetchable = (target) => target === void 0 || target.kind === "local" ? voi
 //#endregion
 export { probe as n, read as r, fetchable as t };
 
-//# sourceMappingURL=entries-DBdy6ahj.mjs.map
+//# sourceMappingURL=entries-Gfsq7U4P.mjs.map

package/{entries-DBdy6ahj.mjs.map → entries-Gfsq7U4P.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"entries-DBdy6ahj.mjs","names":["Global.resolve","Settings.projectRoot","Settings.load","Plugin.parse","Plugin.anchor","Plugin.probe"],"sources":["../../src/cli/cmd/handlers/plugin/entries.ts"],"sourcesContent":["import { Global, Plugin, Settings } from \"@codeworksh/harness/effect\";\nimport { Effect, Option, Path } from \"effect\";\nimport type { Shared } from \"./settings.ts\";\n\n/**\n * Every plugin entry the settings files name, across every layer, in the order they accumulate.\n *\n * This is what `install`, `list`, `check` and `update` all operate on: unlike `add` and `remove`,\n * none of them writes an entry. They read what is already there and act on the store -- each one\n * under the `.npmrc` context of the file that declared it, which is what keys the artifact.\n */\nexport interface Entry {\n\t/** The reference as the settings file spells it: the string a person will search for. */\n\treadonly written: string;\n\t/** The same reference, anchored to the file that declared it. This is what resolves. */\n\treadonly reference: string;\n\t/** Which settings file declared it. */\n\treadonly file: string;\n\t/**\n\t * The `.npmrc` anchor for the entry's store identity: the project that declared it, so the\n\t * registry context is the same wherever this command happens to run.\n\t */\n\treadonly from: string;\n\t/** Absent for an unparseable entry and for a local path. */\n\treadonly target: Plugin.Target | undefined;\n}\n\n/** Only a string entry loads a module; `{ package }` is configuration for one already selected. */\nconst moduleOf = (entry: unknown): string | undefined => (typeof entry === \"string\" ? entry : undefined);\n\nexport const read = Effect.fn(\"CLI.plugin.entries\")(function* (shared: Shared) {\n\tconst nodePath = yield* Path.Path;\n\tconst cwd = nodePath.resolve(\".\");\n\tconst paths = yield* Global.resolve(Option.isNone(shared.home) ? {} : { home: shared.home.value });\n\tconst root = yield* Settings.projectRoot(cwd, paths.home);\n\tconst config = yield* Settings.load({\n\t\thome: paths.home,\n\t\t...(root === undefined ? {} : { hostDir: root }),\n\t\t...(Option.isNone(shared.userConfigDir) ? {} : { userConfigDir: shared.userConfigDir.value }),\n\t});\n\n\tconst seen = new Set<string>();\n\tconst entries: Entry[] = [];\n\tfor (const one of config.declared) {\n\t\tconst reference = moduleOf(one.entry);\n\t\t// Loading is keyed by the module, so the same one named twice is one entry here too.\n\t\tif (reference === undefined || seen.has(reference)) continue;\n\t\tseen.add(reference);\n\t\t// Already anchored to the file that declared it, so `cwd` here only affects a reference\n\t\t// no settings file produced.\n\t\tconst target = yield* Plugin.parse(reference, cwd).pipe(Effect.option);\n\t\tentries.push({\n\t\t\twritten: moduleOf(one.written) ?? reference,\n\t\t\treference,\n\t\t\tfile: one.file,\n\t\t\tfrom: Plugin.anchor(one.file, cwd),\n\t\t\ttarget: Option.getOrUndefined(target),\n\t\t});\n\t}\n\treturn { entries: entries as ReadonlyArray<Entry>, cache: paths.cache };\n});\n\n/**\n * The network half, handed to the store so the store itself never opens a socket.\n *\n * `probe` bypasses pacote's own metadata cache, because a staleness check that reads a cache is\n * not a staleness check. `from` is the host directory: a probe that read a different `.npmrc`\n * chain than the install would answer about a registry nothing is ever fetched from.\n */\nexport const probe =\n\t(cache: string, from: string): Plugin.Probe =>\n\t(target) =>\n\t\tPlugin.probe(target, cache, from);\n\n/** Only a fetched target has a store entry; a local one is loaded where it lies. */\nexport const fetchable = (target: Plugin.Target | undefined): Plugin.Fetchable | undefined =>\n\ttarget === undefined || target.kind === \"local\" ? undefined : target;\n"],"mappings":";;;;AA4BA,MAAM,YAAY,UAAwC,OAAO,UAAU,WAAW,QAAQ,KAAA;AAE9F,MAAa,OAAO,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,QAAgB;CAE9E,MAAM,OAAM,OADY,KAAK,KAAA,CACR,QAAQ,GAAG;CAChC,MAAM,QAAQ,OAAOA,QAAe,OAAO,OAAO,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK,MAAM,CAAC;CACjG,MAAM,OAAO,OAAOC,YAAqB,KAAK,MAAM,IAAI;CACxD,MAAM,SAAS,OAAOC,KAAc;EACnC,MAAM,MAAM;EACZ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK;EAC9C,GAAI,OAAO,OAAO,OAAO,aAAa,IAAI,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc,MAAM;CAC5F,CAAC;CAED,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,UAAmB,CAAC;CAC1B,KAAK,MAAM,OAAO,OAAO,UAAU;EAClC,MAAM,YAAY,SAAS,IAAI,KAAK;EAEpC,IAAI,cAAc,KAAA,KAAa,KAAK,IAAI,SAAS,GAAG;EACpD,KAAK,IAAI,SAAS;EAGlB,MAAM,SAAS,OAAOC,MAAa,WAAW,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM;EACrE,QAAQ,KAAK;GACZ,SAAS,SAAS,IAAI,OAAO,KAAK;GAClC;GACA,MAAM,IAAI;GACV,MAAMC,OAAc,IAAI,MAAM,GAAG;GACjC,QAAQ,OAAO,eAAe,MAAM;EACrC,CAAC;CACF;CACA,OAAO;EAAW;EAAiC,OAAO,MAAM;CAAM;AACvE,CAAC;;;;;;;;AASD,MAAa,SACX,OAAe,UACf,WACAC,QAAa,QAAQ,OAAO,IAAI;;AAGlC,MAAa,aAAa,WACzB,WAAW,KAAA,KAAa,OAAO,SAAS,UAAU,KAAA,IAAY"}
+{"version":3,"file":"entries-Gfsq7U4P.mjs","names":["Global.resolve","Settings.projectRoot","Settings.load","Plugin.parse","Plugin.anchor","Plugin.probe"],"sources":["../../src/cli/cmd/handlers/plugin/entries.ts"],"sourcesContent":["import { Global, Plugin, Settings } from \"@codeworksh/harness/effect\";\nimport { Effect, Option, Path } from \"effect\";\nimport type { Shared } from \"./settings.ts\";\n\n/**\n * Every plugin entry the settings files name, across every layer, in the order they accumulate.\n *\n * This is what `install`, `list`, `check` and `update` all operate on: unlike `add` and `remove`,\n * none of them writes an entry. They read what is already there and act on the store -- each one\n * under the `.npmrc` context of the file that declared it, which is what keys the artifact.\n */\nexport interface Entry {\n\t/** The reference as the settings file spells it: the string a person will search for. */\n\treadonly written: string;\n\t/** The same reference, anchored to the file that declared it. This is what resolves. */\n\treadonly reference: string;\n\t/** Which settings file declared it. */\n\treadonly file: string;\n\t/**\n\t * The `.npmrc` anchor for the entry's store identity: the project that declared it, so the\n\t * registry context is the same wherever this command happens to run.\n\t */\n\treadonly from: string;\n\t/** Absent for an unparseable entry and for a local path. */\n\treadonly target: Plugin.Target | undefined;\n}\n\n/** Only a string entry loads a module; `{ package }` is configuration for one already selected. */\nconst moduleOf = (entry: unknown): string | undefined => (typeof entry === \"string\" ? entry : undefined);\n\nexport const read = Effect.fn(\"CLI.plugin.entries\")(function* (shared: Shared) {\n\tconst nodePath = yield* Path.Path;\n\tconst cwd = nodePath.resolve(\".\");\n\tconst paths = yield* Global.resolve(Option.isNone(shared.home) ? {} : { home: shared.home.value });\n\tconst root = yield* Settings.projectRoot(cwd, paths.home);\n\tconst config = yield* Settings.load({\n\t\thome: paths.home,\n\t\t...(root === undefined ? {} : { hostDir: root }),\n\t\t...(Option.isNone(shared.userConfigDir) ? {} : { userConfigDir: shared.userConfigDir.value }),\n\t});\n\n\tconst seen = new Set<string>();\n\tconst entries: Entry[] = [];\n\tfor (const one of config.declared) {\n\t\tconst reference = moduleOf(one.entry);\n\t\t// Loading is keyed by the module, so the same one named twice is one entry here too.\n\t\tif (reference === undefined || seen.has(reference)) continue;\n\t\tseen.add(reference);\n\t\t// Already anchored to the file that declared it, so `cwd` here only affects a reference\n\t\t// no settings file produced.\n\t\tconst target = yield* Plugin.parse(reference, cwd).pipe(Effect.option);\n\t\tentries.push({\n\t\t\twritten: moduleOf(one.written) ?? reference,\n\t\t\treference,\n\t\t\tfile: one.file,\n\t\t\tfrom: Plugin.anchor(one.file, cwd),\n\t\t\ttarget: Option.getOrUndefined(target),\n\t\t});\n\t}\n\treturn { entries: entries as ReadonlyArray<Entry>, cache: paths.cache };\n});\n\n/**\n * The network half, handed to the store so the store itself never opens a socket.\n *\n * `probe` bypasses pacote's own metadata cache, because a staleness check that reads a cache is\n * not a staleness check. `from` is the host directory: a probe that read a different `.npmrc`\n * chain than the install would answer about a registry nothing is ever fetched from.\n */\nexport const probe =\n\t(cache: string, from: string): Plugin.Probe =>\n\t(target) =>\n\t\tPlugin.probe(target, cache, from);\n\n/** Only a fetched target has a store entry; a local one is loaded where it lies. */\nexport const fetchable = (target: Plugin.Target | undefined): Plugin.Fetchable | undefined =>\n\ttarget === undefined || target.kind === \"local\" ? undefined : target;\n"],"mappings":";;;;AA4BA,MAAM,YAAY,UAAwC,OAAO,UAAU,WAAW,QAAQ,KAAA;AAE9F,MAAa,OAAO,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,QAAgB;CAE9E,MAAM,OAAM,OADY,KAAK,KAAA,CACR,QAAQ,GAAG;CAChC,MAAM,QAAQ,OAAOA,QAAe,OAAO,OAAO,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK,MAAM,CAAC;CACjG,MAAM,OAAO,OAAOC,YAAqB,KAAK,MAAM,IAAI;CACxD,MAAM,SAAS,OAAOC,KAAc;EACnC,MAAM,MAAM;EACZ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,KAAK;EAC9C,GAAI,OAAO,OAAO,OAAO,aAAa,IAAI,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc,MAAM;CAC5F,CAAC;CAED,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,UAAmB,CAAC;CAC1B,KAAK,MAAM,OAAO,OAAO,UAAU;EAClC,MAAM,YAAY,SAAS,IAAI,KAAK;EAEpC,IAAI,cAAc,KAAA,KAAa,KAAK,IAAI,SAAS,GAAG;EACpD,KAAK,IAAI,SAAS;EAGlB,MAAM,SAAS,OAAOC,MAAa,WAAW,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM;EACrE,QAAQ,KAAK;GACZ,SAAS,SAAS,IAAI,OAAO,KAAK;GAClC;GACA,MAAM,IAAI;GACV,MAAMC,OAAc,IAAI,MAAM,GAAG;GACjC,QAAQ,OAAO,eAAe,MAAM;EACrC,CAAC;CACF;CACA,OAAO;EAAW;EAAiC,OAAO,MAAM;CAAM;AACvE,CAAC;;;;;;;;AASD,MAAa,SACX,OAAe,UACf,WACAC,QAAa,QAAQ,OAAO,IAAI;;AAGlC,MAAa,aAAa,WACzB,WAAW,KAAA,KAAa,OAAO,SAAS,UAAU,KAAA,IAAY"}

package/{error-DTXBm1nO.mjs → error-BrbT9_4g.mjs}

@@ -22,6 +22,8 @@ import { SandboxDriver as SandboxDriver$3, SandboxProvider } from "@codeworksh/p
 import { DirectoryNotFoundError, DirectoryNotFoundError as DirectoryNotFoundError$1, Info, NotDirectoryError, NotDirectoryError as NotDirectoryError$1, Service, Service as Service$8 } from "@codeworksh/plugin/location";
 import { Script, constants } from "node:vm";
 import * as AikitFailure from "@codeworksh/aikit/failure";
+import { JsonGitHubCopilotAuthStorage, getGitHubCopilotApiKey } from "@codeworksh/aikit/oauth/github/copilot";
+import { JsonOpenAICodexAuthStorage, getOpenAICodexApiKey } from "@codeworksh/aikit/oauth/openai/codex";
 import "@codeworksh/plugin/tool/error";
 import { parse, printParseErrorCode } from "jsonc-parser";
 import { Rpc, RpcClient, RpcGroup, RpcSerialization } from "effect/unstable/rpc";
@@ -137,6 +139,16 @@ function make$23(input = {}) {
 		log: input.log ?? posix.join(home, "log")
 	};
 }
+/**
+* Where a Codework home keeps its OAuth credentials, or undefined to let aikit
+* resolve them (`CODEWORK_CREDENTIALS`, then the default home).
+*
+* Callers pass a home only when the user actually chose one, so an explicit
+* `--home` pins the file and everything else defers to aikit. The harness and
+* the RPC server both go through here: if they disagreed, a login stored by one
+* would be invisible to the other.
+*/
+const authFile = (home) => home === void 0 ? void 0 : posix.join(home, "aikit", "auth.json");
 const resolve$3 = Effect.fn("Global.resolve")(function* (input = {}) {
 	const home = input.home === void 0 ? yield* homeConfig : expandHome(input.home);
 	return make$23({
@@ -5733,8 +5745,8 @@ const options = (dir, cache) => Effect.suspend(() => {
 });
 const npmOptions = (dir, cache) => Effect.gen(function* () {
 	const config = yield* Effect.tryPromise(async () => {
-		const { default: Config } = await import("./lib-HXZBVLKt.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
-		const { definitions, flatten, nerfDarts, shorthands } = (await import("./definitions-ClJIBYEm.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1))).default;
+		const { default: Config } = await import("./lib-CyynPpjH.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
+		const { definitions, flatten, nerfDarts, shorthands } = (await import("./definitions-Dfwyyv_K.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1))).default;
 		const created = new Config({
 			npmPath: fileURLToPath(new URL("..", import.meta.url)),
 			cwd: dir,
@@ -5850,7 +5862,7 @@ const entrypoint = (directory, name) => Effect.gen(function* () {
 });
 const reify = Effect.fn("PluginNpm.reify")(function* ({ target, into, cache, from }) {
 	const flat = yield* options(from, cache);
-	const { Arborist } = yield* Effect.promise(() => import("./lib-5d-Jmuz2.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1)));
+	const { Arborist } = yield* Effect.promise(() => import("./lib-Dw7R2suc.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1)));
 	const settings = {
 		...flat,
 		...target.mutable ? {
@@ -5944,7 +5956,7 @@ const probe = Effect.fn("PluginNpm.probe")(function* (target, cache, from) {
 		noGitRevCache: true,
 		_isRoot: true
 	};
-	const { default: pacote } = yield* Effect.promise(() => import("./lib-CVW4jqJ3.mjs").then((n) => /* @__PURE__ */ __toESM(n.t(), 1)));
+	const { default: pacote } = yield* Effect.promise(() => import("./lib-BkWR53Bz.mjs").then((n) => /* @__PURE__ */ __toESM(n.t(), 1)));
 	return yield* Effect.tryPromise({
 		try: async () => target.kind === "registry" ? (await pacote.manifest(target.spec, opts)).version : commitIn(await pacote.resolve(target.spec, opts)),
 		catch: (cause) => new InstallError({
@@ -7949,14 +7961,50 @@ const resolve$1 = Effect.fn("LLM.resolve")(function* (input) {
 	});
 	return model;
 });
+/**
+* Fill in what an OAuth provider needs and the model catalog cannot carry: the
+* stored access token, and for Copilot the plan-specific inference host chosen
+* at login. Anything the request already pins is left alone, and a provider
+* with no stored login resolves to `{}` so aikit reports the missing key.
+*/
+const oauthCredentials = async (protocol, options) => {
+	const storage = options.authFile === void 0 ? {} : { path: options.authFile };
+	if (protocol === "openai-codex") {
+		const apiKey = await getOpenAICodexApiKey({ storage: new JsonOpenAICodexAuthStorage(storage) });
+		return apiKey === void 0 ? {} : { apiKey };
+	}
+	if (protocol === "github-copilot") {
+		const store = new JsonGitHubCopilotAuthStorage(storage);
+		const stored = await store.get();
+		const apiKey = await getGitHubCopilotApiKey({ storage: store });
+		if (apiKey === void 0) return {};
+		const apiEndpoint = apiKey === stored?.access ? stored.apiEndpoint : void 0;
+		return {
+			apiKey,
+			...apiEndpoint === void 0 ? {} : { baseURL: apiEndpoint }
+		};
+	}
+	return {};
+};
 /** Start a provider stream using the model pinned by State. */
-const open = Effect.fn("LLM.open")(function* (input, signal) {
+const openWith = (options = {}) => Effect.fn("LLM.open")(function* (input, signal) {
 	const model = input.resolvedModel;
+	const configured = runtimeOptions(input, model, signal);
+	const resolved = configured.apiKey === void 0 ? yield* Effect.tryPromise({
+		try: () => oauthCredentials(model.protocol, options),
+		catch: (cause) => providerErrorFromUnknown(input, cause)
+	}) : {};
+	const request = {
+		...configured,
+		...resolved,
+		...configured.baseURL === void 0 ? {} : { baseURL: configured.baseURL }
+	};
 	return yield* Effect.try({
-		try: () => stream(model, input.context, runtimeOptions(input, model, signal)),
+		try: () => stream(model, input.context, request),
 		catch: (cause) => providerErrorFromUnknown(input, cause)
 	});
 });
+const open = openWith();
 /**
 * Build a provider request from an opener. Tests use this with deterministic
 * aikit event streams; production uses `open` above.
@@ -9317,7 +9365,9 @@ const layer$1 = (options = {}) => Layer.unwrap(Effect.gen(function* () {
 	const configured = yield* loadAll(options.sandboxes ?? [], { hostCwd });
 	const drivers = layer$19(driver_exports.SandboxDriver.withSource(make$16().driver, "core"), driver_exports.SandboxDriver.withSource(make$14().driver, "core"), ...configured);
 	const sandboxes = layer$17({ hostCwd }).pipe(Layer.provideMerge(drivers), Layer.provideMerge(database));
-	const loop = options.llm === void 0 ? layer$4() : layer$4({ request: make$6(options.llm) });
+	const authFile$1 = authFile(options.home === void 0 ? void 0 : paths.home);
+	const open = options.llm ?? openWith(authFile$1 === void 0 ? {} : { authFile: authFile$1 });
+	const loop = layer$4({ request: make$6(open) });
 	return layer$10.pipe(Layer.provideMerge(layer$8.pipe(Layer.provide(loop))), Layer.provideMerge(layer$5({}, pool, references, followStore, rebuild)), Layer.provideMerge(layer$6(settingsOptions)), Layer.provideMerge(layer$7), Layer.provideMerge(sandboxes), Layer.provideMerge(layer$22), Layer.provideMerge(layer$2), Layer.provideMerge(layer$25), Layer.provideMerge(layer$9(definitions)), Layer.provideMerge(database), Layer.provideMerge(global));
 }));
 //#endregion
@@ -9661,6 +9711,38 @@ const RuntimeConfig = Schema.Struct({
 	thinkingLevel: (0, schema_exports$8.optional)(Schema.Enum(Model.ThinkingLevelEnum))
 });
 const SandboxRef = Selection;
+var OAuthError$1 = class extends Schema.TaggedError()("Server.OAuthError", { message: Schema.String }) {};
+/** OAuth providers whose credentials this server stores. */
+const OAuthProvider = Schema.Literals(["openai-codex", "github-copilot"]);
+/**
+* Credentials as the provider's aikit module persists them. The union is
+* discriminated by `provider` so one set of RPCs serves every login.
+*/
+const OAuthCredentials = Schema.Union([Schema.Struct({
+	provider: Schema.Literal("openai-codex"),
+	access: Schema.String,
+	refresh: Schema.String,
+	expires: Schema.Finite,
+	accountId: Schema.String
+}), Schema.Struct({
+	provider: Schema.Literal("github-copilot"),
+	access: Schema.String,
+	refresh: Schema.String,
+	expires: Schema.Finite,
+	enterpriseUrl: (0, schema_exports$8.optional)(Schema.String),
+	apiEndpoint: (0, schema_exports$8.optional)(Schema.String),
+	availableModelIds: (0, schema_exports$8.optional)(Schema.Array(Schema.String))
+})]);
+/** What a login looks like from the outside: never the tokens themselves. */
+const OAuthInfo = Schema.Struct({
+	provider: OAuthProvider,
+	/** Epoch millis, or 0 for a credential that does not expire. */
+	expires: Schema.Finite,
+	accountId: (0, schema_exports$8.optional)(Schema.String),
+	apiEndpoint: (0, schema_exports$8.optional)(Schema.String),
+	enterpriseUrl: (0, schema_exports$8.optional)(Schema.String),
+	availableModels: (0, schema_exports$8.optional)(Schema.Int)
+});
 const SessionErrors = Schema.Union([
 	SessionNotFoundError,
 	SessionLinkedSpaceNotFoundError,
@@ -9679,6 +9761,26 @@ const SandboxErrors = Schema.Union([
 ]);
 const LocationErrors = Schema.Union([DirectoryNotFoundError, NotDirectoryError]);
 const Api = RpcGroup.make(
+	Rpc.make("auth.save", {
+		payload: { credentials: OAuthCredentials },
+		success: OAuthInfo,
+		error: OAuthError$1
+	}),
+	Rpc.make("auth.status", {
+		payload: { provider: OAuthProvider },
+		success: Schema.NullOr(OAuthInfo),
+		error: OAuthError$1
+	}),
+	Rpc.make("auth.refresh", {
+		payload: { provider: OAuthProvider },
+		success: Schema.NullOr(OAuthInfo),
+		error: OAuthError$1
+	}),
+	Rpc.make("auth.logout", {
+		payload: { provider: OAuthProvider },
+		success: Schema.Void,
+		error: OAuthError$1
+	}),
 	Rpc.make("session.create", {
 		payload: {
 			title: (0, schema_exports$8.optional)(Schema.String),
@@ -9966,8 +10068,13 @@ const terminalColumns = () => process.stderr.isTTY ? process.stderr.columns ?? 7
 /** Bad flag or argument combinations the parser cannot express on its own. */
 var InvalidInputError = class extends Schema.TaggedError()("CLI.InvalidInputError", { message: Schema.String }) {};
 var ModelgenError = class extends Schema.TaggedError()("CLI.ModelgenError", { cause: Schema.Defect() }) {};
+var OAuthError = class extends Schema.TaggedError()("CLI.OAuthError", {
+	message: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
 const isInvalidInputError = Schema.is(InvalidInputError);
 const isModelgenError = Schema.is(ModelgenError);
+const isOAuthError = Schema.is(OAuthError);
 const isProviderError = Schema.is(ProviderError);
 const isModelCatalogError = Schema.is(ModelCatalogError);
 const isModelNotFoundError = Schema.is(ModelNotFoundError);
@@ -10003,6 +10110,8 @@ const credentialHint = (provider) => {
 	switch (provider) {
 		case "openrouter": return "set OPENROUTER_API_KEY and retry";
 		case "openai": return "set OPENAI_API_KEY and retry";
+		case "openai-codex": return "run `codework auth login --openai-codex` and retry";
+		case "github-copilot": return "run `codework auth login --github-copilot` and retry";
 		case "anthropic": return "set ANTHROPIC_API_KEY and retry";
 		case "google": return "set GOOGLE_GENERATIVE_AI_API_KEY and retry";
 		case "xai": return "set XAI_API_KEY and retry";
@@ -10066,6 +10175,7 @@ const renderError = (error) => {
 	if (isSandboxDriverRegistrationError(error)) return `error: ${error.reason}\n`;
 	if (isInvalidInputError(error)) return `error: ${error.message}\n`;
 	if (isModelgenError(error)) return ["error[model-catalog]: failed to generate the model catalog", "hint: check the output path and retry"].join("\n") + "\n";
+	if (isOAuthError(error)) return [`error[oauth]: ${error.message}`, ...error.cause === void 0 ? [] : [`detail: ${unknownMessage(error.cause)}`]].join("\n") + "\n";
 	if (isSandboxProviderError(error)) return [
 		`error: SandboxProviderError - ${error.sanitized.message}`,
 		`driver: ${error.driver}`,
@@ -10111,6 +10221,6 @@ const reportFailure = (error) => writeError(renderError(error)).pipe(Effect.andT
 	process.exitCode = 1;
 })));
 //#endregion
-export { sandbox as $, layer$1 as A, required as B, relink as C, __toCommonJS as Ct, register as D, list as E, anchor$1 as F, probe as G, update as H, canonical as I, SourceError as J, InstallError as K, definition$1 as L, load$1 as M, paths as N, resolve as O, projectRoot as P, ModelCatalogError as Q, inspect as R, link as S, __require as St, drivers as T, lock as U, resolve$2 as V, parse$2 as W, Service$4 as X, StoreError as Y, Service$5 as Z, Core as _, ID$1 as _t, addUsage as a, Service$16 as at, create$1 as b, __esmMin as bt, terminalColumns as c, LLMEnded as ct, writeOut as d, Prompt as dt, sandbox$1 as et, layer as f, instance_exports as ft, Connected as g, resolve$3 as gt, Api as h, path$1 as ht, reportFailure as i, layer$23 as it, Service$1 as j, stop as k, usage as l, LLMTextDelta as lt, run as m, layer$26 as mt, ModelgenError as n, SessionNotFoundError as nt, emptyUsage as o, SubscriptionOverflowError as ot, make as p, schema_exports$6 as pt, LoadError as q, renderError as r, SessionNotLinkedError as rt, header as s, layer$25 as st, InvalidInputError as t, Service$14 as tt, writeError as u, TurnEnded as ut, encode as v, schema_exports$8 as vt, create$2 as w, __toESM as wt, get as x, __exportAll as xt, attach as y, __commonJSMin as yt, check as z };
+export { Service$5 as $, resolve as A, inspect as B, get as C, __commonJSMin as Ct, drivers as D, __toCommonJS as Dt, create$2 as E, __require as Et, paths as F, lock as G, required as H, projectRoot as I, InstallError as J, parse$2 as K, anchor$1 as L, layer$1 as M, Service$1 as N, list as O, __toESM as Ot, load$1 as P, Service$4 as Q, canonical as R, create$1 as S, schema_exports$8 as St, relink as T, __exportAll as Tt, resolve$2 as U, check as V, update as W, SourceError as X, LoadError as Y, StoreError as Z, OAuthError$1 as _, path$1 as _t, reportFailure as a, SessionNotLinkedError as at, encode as b, resolve$3 as bt, header as c, SubscriptionOverflowError as ct, writeError as d, LLMTextDelta as dt, ModelCatalogError as et, writeOut as f, TurnEnded as ft, Api as g, layer$26 as gt, run as h, schema_exports$6 as ht, renderError as i, SessionNotFoundError as it, stop as j, register as k, terminalColumns as l, layer$25 as lt, make as m, instance_exports as mt, ModelgenError as n, sandbox$1 as nt, addUsage as o, layer$23 as ot, layer as p, Prompt as pt, probe as q, OAuthError as r, Service$14 as rt, emptyUsage as s, Service$16 as st, InvalidInputError as t, sandbox as tt, usage as u, LLMEnded as ut, Connected as v, Service$17 as vt, link as w, __esmMin as wt, attach as x, ID$1 as xt, Core as y, authFile as yt, definition$1 as z };
 
-//# sourceMappingURL=error-DTXBm1nO.mjs.map
+//# sourceMappingURL=error-BrbT9_4g.mjs.map