@desplega.ai/agent-swarm 2.7.4 → 2.7.5

package/src/providers/acp-targets.ts

@@ -1,13 +1,24 @@
-import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import type {
+  ContentBlock,
+  InitializeResponse,
+  PromptRequest,
+  PromptResponse,
+  SessionUpdate,
+} from "@agentclientprotocol/sdk/unstable";
 import {
   baseUrlOverride,
   normalizeGrokModel,
   providerBaseUrl,
   providerForModel,
 } from "@desplega/model-catalog";
+import { resolveTemplateAsync, resolveTemplateFromCode } from "../prompts/resolver";
+import "../prompts/session-templates";
 import { clampContextPercent, getContextWindowSize } from "../utils/context-window";
+import { requireFxRoute } from "../utils/fx-models";
+import { scrubSecrets } from "../utils/secret-scrubber";
 import {
   ACP_TARGET_IDS,
   type AcpTarget,
@@ -20,11 +31,44 @@ import {
   type OpencodeConfig,
 } from "./opencode-adapter";
 import { applyReasoningEffort } from "./reasoning-effort";
-import type { CostData, CostModelUsage, ProviderEvent, ProviderSessionConfig } from "./types";
+import type {
+  CostData,
+  CostModelUsage,
+  ProviderEvent,
+  ProviderSessionConfig,
+  SteerDelivery,
+  SteerDeliveryResult,
+} from "./types";
+
+/** What a target's `sessionSystemPrompt` hook sends as `session/new` `systemPrompt`. */
+export interface AcpSessionSystemPrompt {
+  /** Text content blocks, sent as the `systemPrompt` array (append mode). */
+  blocks: ContentBlock[];
+  /** Set when the blocks carry only part of the prompt and the whole of it is in this file. */
+  artifactPath?: string;
+}
+
+/** What the adapter hands a target's `steer` hook for one steering message. */
+export interface AcpSteerContext {
+  sessionId: string;
+  delivery: SteerDelivery;
+  /** The `initialize` result, for capability gating. */
+  initResult: InitializeResponse;
+  /** Sends `session/prompt` on the session's ACP connection. */
+  prompt(params: PromptRequest): Promise<PromptResponse>;
+  /** Observes raw session updates until the returned function is called. */
+  onUpdate(listener: (update: SessionUpdate) => void): () => void;
+}
+
+/** Native session resume over `session/resume`. */
+export interface AcpResumeHook {
+  readonly method: "session/resume";
+  canResume(sessionId: string): Promise<boolean>;
+}
 
 export interface AcpTargetProfile {
   /** An operator-selectable ACP target, or a first-class harness built on the ACP client. */
-  readonly target: AcpTarget | "grok";
+  readonly target: AcpTarget | "grok" | "fx";
   command(config: ProviderSessionConfig): string[];
   env(config: ProviderSessionConfig): Record<string, string>;
   configuredOptions(config: ProviderSessionConfig): Record<string, string | boolean>;
@@ -35,8 +79,11 @@ export interface AcpTargetProfile {
   sessionMeta?(config: ProviderSessionConfig): Record<string, unknown> | undefined;
   /** A clearer message for a target error whose own text misleads, else undefined. */
   describeError?(message: string): string | undefined;
-  /** Rewrites a translated event for display, e.g. unwrapping a tool proxy. */
-  rewriteEvent?(event: ProviderEvent): ProviderEvent;
+  /**
+   * Rewrites a translated event for display, e.g. unwrapping a tool proxy.
+   * `update` is the ACP session update the event was translated from.
+   */
+  rewriteEvent?(event: ProviderEvent, update?: SessionUpdate): ProviderEvent;
   /** Usage, cost and the model that ran, from the `session/prompt` response `_meta`. */
   promptCost?(
     meta: Record<string, unknown> | null | undefined,
@@ -47,6 +94,23 @@ export interface AcpTargetProfile {
     meta: Record<string, unknown> | null | undefined,
     model: string,
   ): Extract<ProviderEvent, { type: "context_usage" }> | undefined;
+  // Opt-in hooks. A target without them behaves exactly as before they existed.
+  /**
+   * The standard `systemPrompt` for `session/new`. Sent only when the agent
+   * advertises `sessionCapabilities.systemPrompt`.
+   */
+  sessionSystemPrompt?(config: ProviderSessionConfig): Promise<AcpSessionSystemPrompt | undefined>;
+  /**
+   * The target accepts MCP URLs only over HTTPS or explicit loopback HTTP. A
+   * plain-HTTP, non-loopback server URL (the swarm API at `http://api:3013`)
+   * goes through a per-session 127.0.0.1 forwarder, and SSE servers are dropped
+   * unless the agent advertises `mcpCapabilities.sse`.
+   */
+  readonly requiresSecureMcpUrl?: boolean;
+  /** Live steering. Absent means the session has no `deliverSteering`. */
+  steer?(context: AcpSteerContext): Promise<SteerDeliveryResult>;
+  /** Native resume: `config.resumeSessionId` is resumed instead of creating a session. */
+  readonly resume?: AcpResumeHook;
 }
 
 export class AcpTargetResolutionError extends Error {
@@ -359,7 +423,7 @@ const copilotTargetProfile: AcpTargetProfile = {
   },
 };
 
-/** Qwen Code's `--auth-type` choices (0.26.3). `qwen-oauth` needs a browser, so it is left out. */
+/** Qwen Code's `--auth-type` choices (0.26.4). `qwen-oauth` needs a browser, so it is left out. */
 const QWEN_AUTH_TYPES = ["openai", "openai-responses", "anthropic", "gemini", "vertex-ai"] as const;
 
 // Qwen Code is a Gemini CLI fork: QWEN_SYSTEM_MD replaces its built-in prompt
@@ -696,6 +760,242 @@ export const grokTargetProfile: AcpTargetProfile = {
   },
 };
 
+// ---------------------------------------------------------------------------
+// fx (Vercel Labs' `fx acp`), measured against fx 0.0.15 on 2026-10-29.
+// ---------------------------------------------------------------------------
+
+/** Above this many UTF-8 bytes the prompt goes to a file; fx caps `systemPrompt` at 64 KiB. */
+export const FX_SYSTEM_PROMPT_INLINE_MAX_BYTES = 60 * 1024;
+/** How much of an oversized prompt is still sent inline, ahead of the pointer line. */
+export const FX_SYSTEM_PROMPT_HEAD_BYTES = 56 * 1024;
+const FX_SYSTEM_PROMPT_FILE_TEMPLATE = "system.agent.fx.system_prompt_file";
+/** fx streams this notice as an assistant message chunk; it is not model output. */
+const FX_CONTEXT_NOTICE_PREFIX = "[context] ";
+const FX_AUTH_ERROR_RE =
+  /authentication is unavailable|credential is unavailable|MissingApiKey|unauthorized|\b401\b/i;
+
+/**
+ * Per-task scratch dir for fx: `acp.log` (`--log-file`) and, for an oversized
+ * prompt, `SYSTEM.md`. Outside the task cwd, removed when the session ends.
+ */
+export function fxRunDir(config: Pick<ProviderSessionConfig, "taskId">): string {
+  const safe = config.taskId.replace(/[^A-Za-z0-9._-]/g, "_") || "session";
+  return join(tmpdir(), `fx-${safe}`);
+}
+
+/** The first `max` bytes of `bytes` as text, never ending inside a UTF-8 sequence. */
+function utf8Head(bytes: Uint8Array, max: number): string {
+  let end = Math.min(max, bytes.length);
+  // Back off continuation bytes (10xxxxxx) so a multi-byte character is not split.
+  while (end > 0 && end < bytes.length && ((bytes[end] ?? 0) & 0xc0) === 0x80) end -= 1;
+  return new TextDecoder().decode(bytes.subarray(0, end));
+}
+
+async function fxSystemPromptPointer(path: string): Promise<string> {
+  try {
+    const result = await resolveTemplateAsync(FX_SYSTEM_PROMPT_FILE_TEMPLATE, { path });
+    if (!result.skipped && result.text.trim()) return result.text;
+  } catch {
+    // Fall through to the code default.
+  }
+  // A skipped or blank override must not drop the pointer to the full prompt.
+  return resolveTemplateFromCode(FX_SYSTEM_PROMPT_FILE_TEMPLATE, { path }).text;
+}
+
+/**
+ * The `systemPrompt` fx gets. Up to 60 KiB it is the prompt itself. A larger
+ * one is written whole to `<dir>/SYSTEM.md`; fx then gets its first 56 KiB plus
+ * a line telling the model to read that file first (fx returns `-32602
+ * systemPrompt exceeds the 64 KiB limit` above 65,536 bytes).
+ */
+export async function fxSystemPrompt(
+  systemPrompt: string,
+  dir: string,
+): Promise<AcpSessionSystemPrompt | undefined> {
+  if (!systemPrompt.trim()) return undefined;
+  const bytes = new TextEncoder().encode(systemPrompt);
+  if (bytes.length <= FX_SYSTEM_PROMPT_INLINE_MAX_BYTES) {
+    return { blocks: [{ type: "text", text: systemPrompt }] };
+  }
+  const artifactPath = join(dir, "SYSTEM.md");
+  await mkdir(dir, { recursive: true });
+  await Bun.write(artifactPath, systemPrompt);
+  await chmod(artifactPath, 0o600);
+  const head = utf8Head(bytes, FX_SYSTEM_PROMPT_HEAD_BYTES);
+  const pointer = await fxSystemPromptPointer(artifactPath);
+  return { blocks: [{ type: "text", text: `${head}\n\n${pointer}` }], artifactPath };
+}
+
+/** `~/.fx/sessions/v2/<id>/log.jsonl`: where fx 0.0.15 keeps a saved session. */
+export async function fxSessionExists(
+  sessionId: string,
+  home: string | undefined,
+): Promise<boolean> {
+  if (!home || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return false;
+  return Bun.file(join(home, ".fx", "sessions", "v2", sessionId, "log.jsonl")).exists();
+}
+
+type FxToolCallMeta = { fx?: { toolCall?: { mcp?: { server?: unknown; tool?: unknown } } } };
+
+/**
+ * fx's display adjustments:
+ * - The `[context] … capability_search` notice arrives as its own assistant
+ *   chunk. It becomes an `fx_context_notice` custom event, so it never reaches
+ *   the task output.
+ * - A `tool_call` titles the action ("Running", "Get the agent swarm") and
+ *   names the tool in a non-standard `name` field (`shell`, `skill`,
+ *   `mcp_swarm_get-swarm`), with the MCP server and tool in
+ *   `_meta.fx.toolCall.mcp`. The tool start carries that name, MCP calls as
+ *   `mcp__<server>__<tool>` like every other harness.
+ */
+export function rewriteFxEvent(event: ProviderEvent, update?: SessionUpdate): ProviderEvent {
+  if (
+    event.type === "message" &&
+    event.role === "assistant" &&
+    event.content.startsWith(FX_CONTEXT_NOTICE_PREFIX)
+  ) {
+    return {
+      type: "custom",
+      name: "fx_context_notice",
+      data: { text: event.content, messageId: event.messageId ?? null },
+    };
+  }
+  if (event.type === "tool_start" && update?.sessionUpdate === "tool_call") {
+    const mcp = (update._meta as FxToolCallMeta | null | undefined)?.fx?.toolCall?.mcp;
+    if (typeof mcp?.server === "string" && typeof mcp.tool === "string" && mcp.server && mcp.tool) {
+      return { ...event, toolName: `mcp__${mcp.server}__${mcp.tool}` };
+    }
+    const name = (update as { name?: unknown }).name;
+    if (typeof name === "string" && name.trim()) return { ...event, toolName: name.trim() };
+  }
+  return event;
+}
+
+/**
+ * fx's native steer: a second `session/prompt` with `_meta.fx.steer` during the
+ * running turn. fx applies it at the next tool boundary without cancelling and
+ * echoes it as a `user_message_chunk` carrying `_meta.fx.steering`; the steer
+ * request itself resolves with the turn, `_meta.fx.steering: "absorbed"`.
+ * Either one counts as delivered. The echo arrives first, so the row is
+ * `delivered` while the turn still runs and `accept-steer` can mark it handled.
+ * Any other answer is undeliverable and the runner promotes the message.
+ */
+export async function steerFx({
+  sessionId,
+  delivery,
+  initResult,
+  prompt,
+  onUpdate,
+}: AcpSteerContext): Promise<SteerDeliveryResult> {
+  if (delivery.mode !== "steer") {
+    return { delivered: false, reason: `fx supports steer only, not ${delivery.mode}` };
+  }
+  const meta = initResult.agentCapabilities?._meta as { fx?: { steering?: unknown } } | undefined;
+  if (meta?.fx?.steering !== true) {
+    return { delivered: false, reason: "fx did not advertise _meta.fx.steering" };
+  }
+  return new Promise<SteerDeliveryResult>((resolve) => {
+    let settled = false;
+    let stopListening = () => {};
+    const settle = (result: SteerDeliveryResult) => {
+      if (settled) return;
+      settled = true;
+      stopListening();
+      resolve(result);
+    };
+    stopListening = onUpdate((update) => {
+      if (update.sessionUpdate !== "user_message_chunk") return;
+      const steering = (update._meta as { fx?: { steering?: unknown } } | null | undefined)?.fx
+        ?.steering;
+      if (!steering || update.content.type !== "text" || update.content.text !== delivery.text) {
+        return;
+      }
+      settle({ delivered: true, mode: "steer" });
+    });
+    prompt({
+      sessionId,
+      prompt: [{ type: "text", text: delivery.text }],
+      _meta: { fx: { steer: true } },
+    }).then(
+      (response) => {
+        const state = (response._meta as { fx?: { steering?: unknown } } | null | undefined)?.fx
+          ?.steering;
+        settle(
+          state === "absorbed"
+            ? { delivered: true, mode: "steer" }
+            : {
+                delivered: false,
+                reason: `fx did not absorb the steer (stopReason ${response.stopReason}, steering ${JSON.stringify(state ?? null)})`,
+              },
+        );
+      },
+      (err: unknown) => {
+        const message = err instanceof Error ? err.message : String(err);
+        settle({ delivered: false, reason: scrubSecrets(`fx steer failed: ${message}`) });
+      },
+    );
+  });
+}
+
+export const fxTargetProfile: AcpTargetProfile = {
+  target: "fx",
+  command(config) {
+    const binary = readEnv(config, "FX_BINARY")?.trim() || "fx";
+    const route = requireFxRoute(config.model);
+    return [
+      binary,
+      "acp",
+      "--model",
+      route.fxModel,
+      "--log-file",
+      join(fxRunDir(config), "acp.log"),
+    ];
+  },
+  env(config) {
+    const route = requireFxRoute(config.model);
+    const env = baseTargetEnv(config);
+    // Only the route's own key: an OpenRouter session never sees OPENAI_API_KEY.
+    copyEnvKeys(config, env, [route.keyVar]);
+    // Process-local selection and permissions. `session/set_mode` and the
+    // `mode` / `provider` config options persist into ~/.fx/settings.json, so
+    // the adapter never sends them. Auto mode's reviewer holds swarm MCP calls
+    // headless, so the session runs full-access.
+    env.FX_PROVIDER = route.fxProvider;
+    env.FX_PERMISSION_MODE = "full-access";
+    env.FX_AUTO_UPGRADE = "0";
+    env.FX_NO_OPEN_BROWSER = "1";
+    return env;
+  },
+  // The model rides on `--model`. Only fx's AI Gateway provider has an
+  // `effort` option; custom connections send no reasoning control.
+  configuredOptions(config): Record<string, string | boolean> {
+    if (!config.reasoningEffort) return {};
+    const effort = applyReasoningEffort("fx", config.model.trim(), config.reasoningEffort);
+    return effort.kind === "fx-effort" ? { effort: effort.reasoningEffort } : {};
+  },
+  async writeSystemPromptArtifact(config) {
+    // acp.log can hold session/new params, including the ephemeral MCP bearer.
+    await mkdir(fxRunDir(config), { recursive: true, mode: 0o700 });
+  },
+  async cleanupSystemPromptArtifact(config) {
+    await rm(fxRunDir(config), { recursive: true, force: true });
+  },
+  sessionSystemPrompt(config) {
+    return fxSystemPrompt(config.systemPrompt ?? "", fxRunDir(config));
+  },
+  requiresSecureMcpUrl: true,
+  steer: steerFx,
+  resume: {
+    method: "session/resume",
+    canResume: (sessionId) => fxSessionExists(sessionId, process.env.HOME),
+  },
+  rewriteEvent: rewriteFxEvent,
+  describeError(message) {
+    if (!FX_AUTH_ERROR_RE.test(message)) return undefined;
+    return `fx could not authenticate the model route (OPENROUTER_API_KEY, OPENAI_API_KEY or AI_GATEWAY_API_KEY invalid or missing): ${message}`;
+  },
+};
+
 export function resolveAcpTarget(config: ProviderSessionConfig): AcpTargetProfile {
   const target = readEnv(config, "ACP_TARGET") ?? "custom";
   if (!isAcpTarget(target)) {

package/src/providers/amp-adapter.ts

@@ -45,7 +45,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1793246451-g9e5ffe";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1793275344-g17bf52";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";

package/src/providers/codex-adapter.ts

@@ -40,6 +40,7 @@ import {
 import { buildRatingsFromLlm, fetchRetrievalsForTask, postRatings } from "../be/memory/raters/llm";
 import { contextBoundNoteThreshold, createContextBoundNote } from "../hooks/context-bound-note";
 import { getApiKey } from "../utils/api-key";
+import { isCodexRejectedAccessError } from "../utils/codex-auth-failure";
 import {
   CONTEXT_FORMULA,
   clampContextPercent,
@@ -67,7 +68,7 @@ import { computeCodexCostUsd, getCodexContextWindow, resolveCodexModel } from ".
 import { credentialsToAuthJson } from "./codex-oauth/auth-json.js";
 import { hasCodexOAuthPoolSlots } from "./codex-oauth/env-keys.js";
 import { codexUserHome } from "./codex-oauth/home.js";
-import { CodexOAuthRefreshError, getValidCodexOAuth } from "./codex-oauth/storage.js";
+import { buildPoolRevalidationFailureReason, getValidCodexOAuth } from "./codex-oauth/storage.js";
 import { pruneCodexRollouts } from "./codex-rollouts";
 import { resolveCodexPrompt } from "./codex-skill-resolver";
 import { createCodexSwarmEventHandler } from "./codex-swarm-events";
@@ -89,6 +90,8 @@ import type {
   SteerDeliveryResult,
 } from "./types";
 
+export { buildPoolRevalidationFailureReason } from "./codex-oauth/storage.js";
+
 type CodexConfig = Record<string, CodexConfigValue | undefined>;
 
 /** `model_provider` id of the generated gateway block. */
@@ -442,29 +445,6 @@ export async function resolveCodexAuthMode(
   return currentMode;
 }
 
-/**
- * Build the `failureReason` for a pool-slot OAuth revalidation failure
- * (see `resolveCodexAuthMode` above).
- *
- * Wording matters: every variant carries `[auth-error]`, but the runner's
- * `isCodexAuthFailureReason` counts only a confirmed refresh rejection toward
- * the auth-failure bench (2 in a row). A lock-wait timeout ("waiting for the
- * refresh lock") and any other thrown error (refresh-lock HTTP or network
- * failure, config-store persistence failure: "not a confirmed auth
- * rejection") are excluded as transient, so an outage does NOT bench a
- * healthy login.
- */
-export function buildPoolRevalidationFailureReason(err: unknown, slot: number): string {
-  if (err instanceof CodexOAuthRefreshError) {
-    if (err.reason === "lock_timeout") {
-      return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: timed out waiting for the refresh lock — transient, will retry on next task.`;
-    }
-    return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: refresh rejected (${err.status ?? "unknown status"} ${err.body ?? ""}) — credential likely revoked; re-run codex-login for this slot.`;
-  }
-  const message = err instanceof Error ? err.message : String(err);
-  return `[auth-error] Codex pool slot ${slot} revalidation failed (not a confirmed auth rejection, transient): ${message}`;
-}
-
 /**
  * Build the configuration supplied through the `thread/start` request.
  * It overrides the baseline `~/.codex/config.toml` in the worker image.
@@ -1594,26 +1574,11 @@ export class CodexSession implements ProviderSession {
       };
     }
 
-    // Bad / missing / invalid API key — codexErrorInfo: "Unauthorized".
-    // Also catches the "revoked-while-valid" OAuth pool failure mode: a
-    // credential revoked server-side while its access token is still
-    // unexpired never enters `getValidCodexOAuth` (the token looks fresh, it
-    // fast-returns) — the ONLY artifact of that death mode is the spawned
-    // Codex CLI self-refreshing straight from the blanked-refresh-token
-    // auth.json and surfacing this turn-level error.
-    const authPatterns = [
-      "unauthorized",
-      "http 401",
-      " 401 ",
-      "invalid api key",
-      "invalid_api_key",
-      "missing api key",
-      "no api key",
-      "authentication failed",
-      "failed to refresh token",
-      "invalid 'refresh_token'",
-    ];
-    if (authPatterns.some((p) => normalized.includes(p))) {
+    // Bad / missing / invalid API key — codexErrorInfo: "Unauthorized" — or
+    // a pool login revoked while its access token is unexpired: the spawned
+    // Codex CLI self-refreshes from the blanked-refresh-token auth.json and
+    // surfaces this turn-level error.
+    if (isCodexRejectedAccessError(normalized)) {
       const slot = this.config.codexSlot;
       const guidance =
         slot === undefined

package/src/providers/codex-oauth/flow.ts

@@ -150,14 +150,19 @@ export async function refreshAccessToken(refreshToken: string): Promise<TokenRes
     });
 
     if (!response.ok) {
-      const text = await response.text().catch(() => "");
+      // The endpoint may echo the submitted refresh token: redact before the
+      // text reaches a log, the thrown error or a task's failure reason.
+      const text = redactTokens(await response.text().catch(() => ""), [refreshToken]);
       console.error("[codex-oauth] Token refresh failed:", response.status, text);
       return { type: "failed", status: response.status, error: text.slice(0, 300) };
     }
 
     const json = (await response.json()) as Record<string, unknown>;
     if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-      console.error("[codex-oauth] Token refresh response missing fields:", json);
+      console.error(
+        "[codex-oauth] Token refresh response missing fields; got keys:",
+        Object.keys(json).join(", "),
+      );
       return { type: "failed" };
     }
 
@@ -168,11 +173,27 @@ export async function refreshAccessToken(refreshToken: string): Promise<TokenRes
       expires: Date.now() + (json.expires_in as number) * 1000,
     };
   } catch (error) {
-    console.error("[codex-oauth] Token refresh error:", error);
+    const message = error instanceof Error ? error.message : String(error);
+    console.error("[codex-oauth] Token refresh error:", redactTokens(message, [refreshToken]));
     return { type: "failed" };
   }
 }
 
+/**
+ * `text` with every given token, raw or URL/JSON-encoded, replaced by a
+ * marker, then run through `scrubSecrets`. For error text from an endpoint
+ * that was sent those tokens and may echo them back.
+ */
+export function redactTokens(text: string, tokens: readonly (string | undefined)[]): string {
+  let out = text;
+  for (const token of tokens) {
+    if (!token) continue;
+    const forms = new Set([token, encodeURIComponent(token), JSON.stringify(token).slice(1, -1)]);
+    for (const form of forms) out = out.split(form).join("[REDACTED:codex_oauth_token]");
+  }
+  return scrubSecrets(out);
+}
+
 export function getAccountId(accessToken: string): string | null {
   const payload = decodeJwt(accessToken);
   const auth = payload?.[JWT_CLAIM_PATH] as Record<string, unknown> | undefined;

package/src/providers/codex-oauth/storage.ts

@@ -9,8 +9,9 @@
  * until the 071 migration renames it.
  */
 
+import { scrubSecrets } from "../../utils/secret-scrubber.js";
 import { deriveCodexKeySuffix } from "./auth-json.js";
-import { refreshAccessToken } from "./flow.js";
+import { redactTokens, refreshAccessToken } from "./flow.js";
 import type { CodexOAuthCredentials } from "./types.js";
 
 /** Legacy single-credential key — kept for backwards-compat fallback reads. */
@@ -102,6 +103,30 @@ export class CodexOAuthRefreshError extends Error {
   }
 }
 
+/**
+ * Build the `failureReason` for a pool-slot OAuth revalidation failure
+ * (`resolveCodexAuthMode` in codex-adapter.ts, and the pi ChatGPT
+ * subscription path in `subscription.ts`).
+ *
+ * Wording matters: every variant carries `[auth-error]`, but the runner's
+ * `isCodexAuthFailureReason` counts only a confirmed refresh rejection toward
+ * the auth-failure bench (2 in a row). A lock-wait timeout ("waiting for the
+ * refresh lock") and any other thrown error (refresh-lock HTTP or network
+ * failure, config-store persistence failure: "not a confirmed auth
+ * rejection") are excluded as transient, so an outage does NOT bench a
+ * healthy login.
+ */
+export function buildPoolRevalidationFailureReason(err: unknown, slot: number): string {
+  if (err instanceof CodexOAuthRefreshError) {
+    if (err.reason === "lock_timeout") {
+      return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: timed out waiting for the refresh lock — transient, will retry on next task.`;
+    }
+    return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: refresh rejected (${err.status ?? "unknown status"} ${scrubSecrets(err.body ?? "")}) — credential likely revoked; re-run codex-login for this slot.`;
+  }
+  const message = scrubSecrets(err instanceof Error ? err.message : String(err));
+  return `[auth-error] Codex pool slot ${slot} revalidation failed (not a confirmed auth rejection, transient): ${message}`;
+}
+
 /**
  * Acquire the cross-process refresh lock for a Codex OAuth slot via the API
  * server's `oauth_refresh_locks` table (migration 077). Worker-side code
@@ -246,23 +271,33 @@ export async function storeCodexOAuth(
   slot = 0,
 ): Promise<void> {
   const key = codexOAuthKeyForSlot(slot);
-  const res = await fetch(`${apiUrl}/api/config`, {
-    method: "PUT",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
-    },
-    body: JSON.stringify({
-      scope: "global",
-      key,
-      value: JSON.stringify(creds),
-      isSecret: true,
-      description: `Codex ChatGPT OAuth credentials slot ${slot} (stored by codex-login)`,
-    }),
-  });
+  // The request carries the tokens, so a transport error or the store's reply
+  // may echo them. Every error leaving here is rebuilt from redacted text,
+  // with no `cause` pointing back at the raw one.
+  const redact = (text: string) => redactTokens(text, [creds.access, creds.refresh]);
+  let res: Response;
+  try {
+    res = await fetch(`${apiUrl}/api/config`, {
+      method: "PUT",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify({
+        scope: "global",
+        key,
+        value: JSON.stringify(creds),
+        isSecret: true,
+        description: `Codex ChatGPT OAuth credentials slot ${slot} (stored by codex-login)`,
+      }),
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to store ${key} config: ${redact(message)}`);
+  }
 
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    const text = redact(await res.text().catch(() => ""));
     throw new Error(`Failed to store ${key} config: HTTP ${res.status} ${text}`);
   }
 }
@@ -343,7 +378,11 @@ export async function persistCodexOAuth(
   try {
     await storeCodexOAuth(apiUrl, apiKey, creds, slot);
   } catch (err) {
-    console.error("[codex-oauth] persistCodexOAuth failed (non-fatal):", err);
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      "[codex-oauth] persistCodexOAuth failed (non-fatal):",
+      redactTokens(message, [creds.access, creds.refresh]),
+    );
   }
 }