@desplega.ai/agent-swarm 2.7.4 → 2.7.5

package/dist/{cli-a4btqqft.js → cli-1b7btd38.js}

@@ -1,7 +1,7 @@
 import {
   openAICompatibleKeyVars,
   init_src2
-} from "./cli-4r12t6w6.js";
+} from "./cli-5c4hjzne.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-a2jw6ee5.js → cli-1p89xny0.js}

@@ -1,7 +1,7 @@
 import {
   withRegistryCatalogSections,
   init_src2
-} from "./cli-4r12t6w6.js";
+} from "./cli-5c4hjzne.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-v726afdm.js → cli-2pnswgh8.js}

@@ -1,7 +1,7 @@
 import {
   registerTemplate,
   init_registry3
-} from "./cli-j4kw3rsx.js";
+} from "./cli-cm5yqn35.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-kvtc7aez.js → cli-3h4nhjn8.js}

@@ -6,11 +6,12 @@ import {
   getLatestActiveTaskInThread2,
   getLatestLeadTaskInThread2,
   getMostRecentTaskInThread2,
+  SteeringBlockedError,
   requestSteering,
   init_steering2,
   createLogEntry2,
   init_db4
-} from "./cli-1s1dqn1j.js";
+} from "./cli-1ayk1eas.js";
 import {
   ackSlackMessage,
   init_ack,
@@ -26,7 +27,7 @@ import {
   init_watcher,
   getSlackApp2,
   init_app3
-} from "./cli-1gm8jcyr.js";
+} from "./cli-wvaawacd.js";
 import {
   TaskCreationBlockedError,
   init_errors2,
@@ -36,20 +37,22 @@ import {
   createSlackTaskWithFiles,
   notifySlackFileFailures,
   init_inbound_files,
+  isSlackThreadLeft,
+  init_left_threads,
   extractSlackMessageText,
   init_message_text,
   createAdditiveBuffer,
   init_additive_buffer
-} from "./cli-1yekbyqm.js";
+} from "./cli-1338796d.js";
 import {
   resolveSlackUserId,
   rewriteSlackMentions,
   init_enrich
-} from "./cli-s0exq74r.js";
+} from "./cli-nmbmy64z.js";
 import {
   findUserByExternalId,
   init_users
-} from "./cli-8yy525ad.js";
+} from "./cli-bhjt02p8.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
@@ -57,7 +60,7 @@ import {
 import {
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-a4btqqft.js";
+} from "./cli-1b7btd38.js";
 import {
   __esm,
   __using,
@@ -135,7 +138,9 @@ async function requestSlackThreadSteering(args) {
     onUnsupported: "degrade",
     source: "slack",
     createdByKind: "user",
-    createdByUserId: args.requestedByUserId
+    createdByUserId: args.requestedByUserId,
+    messageTimestamps: args.messageTimestamps,
+    slack: { channelId: args.channelId, threadTs: args.threadTs, userId: args.slackUserId }
   });
   for (const messageTs of args.messageTimestamps ?? []) {
     await createLogEntry2({
@@ -230,6 +235,10 @@ async function slackFlush(items, key, immediate) {
       return;
     }
     const { channelId, threadTs } = split;
+    if (await isSlackThreadLeft(channelId, threadTs)) {
+      console.log(`[Slack] Buffer flush: dropping ${items.length} message(s) in left thread ${key}`);
+      return;
+    }
     const originalRequesterId = items[0].userId;
     const botUserId = items.find((item) => item.botUserId)?.botUserId;
     console.log(`[Slack] Flushing buffer: ${key} (${items.length} messages, immediate=${immediate})`);
@@ -258,15 +267,32 @@ ${combinedText}`;
     }) : (await findUserByExternalId("slack", originalRequesterId))?.id;
     const nextSenderIndex = items.findIndex((item) => item.userId !== originalRequesterId);
     const steeringItems = nextSenderIndex === -1 ? items : items.slice(0, nextSenderIndex);
-    const steering = files.length === 0 ? await requestSlackThreadSteering({
-      channelId,
-      threadTs,
-      message: nextSenderIndex === -1 ? combinedText : await rewriteSlackMentions(steeringItems.map((item) => item.text).join(`
+    let steering;
+    try {
+      steering = files.length === 0 ? await requestSlackThreadSteering({
+        channelId,
+        threadTs,
+        message: nextSenderIndex === -1 ? combinedText : await rewriteSlackMentions(steeringItems.map((item) => item.text).join(`
 ---
 `), botUserId),
-      messageTimestamps: steeringItems.map((item) => item.ts),
-      requestedByUserId
-    }) : null;
+        messageTimestamps: steeringItems.map((item) => item.ts),
+        requestedByUserId,
+        slackUserId: originalRequesterId
+      }) : null;
+    } catch (error) {
+      if (!(error instanceof SteeringBlockedError))
+        throw error;
+      console.info("[Slack] pre.task.steer blocked:", error.extension.name, error.reason);
+      if (app) {
+        for (const item of steeringItems) {
+          await ackSlackMessage(app.client, channelId, item.ts, "no_entry");
+        }
+      }
+      if (nextSenderIndex !== -1) {
+        await slackFlush(items.slice(nextSenderIndex), key, immediate);
+      }
+      return;
+    }
     if (steering) {
       console.log(`[Slack] Buffer flushed → steering ${steering.result.outcome} for task ${steering.task.id}`);
       const agent = steering.task.agentId ? await getAgentById2(steering.task.agentId) : undefined;
@@ -373,6 +399,7 @@ ${description}` : description;
 var BUFFER_TIMEOUT_MS, slackBuffer;
 var init_thread_buffer = __esm(() => {
   init_db4();
+  init_steering2();
   init_users();
   init_additive_buffer();
   init_context_key();
@@ -383,6 +410,7 @@ var init_thread_buffer = __esm(() => {
   init_blocks();
   init_enrich();
   init_inbound_files();
+  init_left_threads();
   init_message_text();
   init_render_v2();
   init_responses();

package/dist/{cli-655xm9ms.js → cli-583frbyr.js}

@@ -2,7 +2,7 @@ import {
   DEFAULT_E2B_API_BASE,
   redactWithEnv,
   init_env2
-} from "./cli-98pke4vk.js";
+} from "./cli-ae7mrdf9.js";
 import {
   __toESM,
   __esm

package/dist/{cli-4r12t6w6.js → cli-5c4hjzne.js}

@@ -2,6 +2,23 @@ import {
   __esm
 } from "./cli-242037k3.js";
 
+// packages/model-catalog/src/chatgpt-subscription.ts
+function chatgptSubscriptionModelId(model) {
+  const trimmed = model?.trim() ?? "";
+  const prefix = `${CHATGPT_SUBSCRIPTION_PROVIDER}/`;
+  if (!trimmed.toLowerCase().startsWith(prefix))
+    return null;
+  const id = trimmed.slice(prefix.length);
+  return id && !id.includes("/") ? id : null;
+}
+function isChatgptSubscriptionModel(model) {
+  return chatgptSubscriptionModelId(model) !== null;
+}
+var CHATGPT_SUBSCRIPTION_PROVIDER = "openai-codex", CHATGPT_SUBSCRIPTION_HARNESSES;
+var init_chatgpt_subscription = __esm(() => {
+  CHATGPT_SUBSCRIPTION_HARNESSES = ["pi"];
+});
+
 // packages/model-catalog/src/display.ts
 var init_display = () => {};
 
@@ -153,7 +170,27 @@ function harnessCatalogSection(harness) {
   return HARNESS_CATALOG_SECTION[harness] ?? null;
 }
 function isHarnessModelJudged(harness) {
-  return !!harness && (harnessCatalogSection(harness) !== null || harness === "grok");
+  return !!harness && (harnessCatalogSection(harness) !== null || harness === "grok" || harness === "fx");
+}
+function fxModelRoute(model) {
+  const id = model.trim();
+  if (!id)
+    return { error: `An empty model has no fx route. ${FX_ROUTES_HINT}` };
+  const slash = id.indexOf("/");
+  if (slash < 0)
+    return { fxProvider: "openai", fxModel: id, keyVar: "OPENAI_API_KEY" };
+  const namespace = id.slice(0, slash).toLowerCase();
+  const rest = id.slice(slash + 1).trim();
+  if (namespace === "openrouter" && rest) {
+    return { fxProvider: "openrouter", fxModel: rest, keyVar: "OPENROUTER_API_KEY" };
+  }
+  if (namespace === "vercel" && rest) {
+    return { fxProvider: "gateway", fxModel: rest, keyVar: "AI_GATEWAY_API_KEY" };
+  }
+  const reason = FX_REJECTED_NAMESPACES[namespace];
+  return {
+    error: `Model "${id}" has no fx route${reason ? `: ${reason}` : ""}. ${FX_ROUTES_HINT}`
+  };
 }
 function normalizeGrokModel(model) {
   return model.trim().replace(XAI_PREFIX_RE, "");
@@ -228,8 +265,14 @@ function buildClaudeShortnameMap(models) {
   return out;
 }
 function harnessModelMismatch(model, harness, sections, context = {}) {
+  const subscriptionId = chatgptSubscriptionModelId(model);
+  if (harness && subscriptionId && !CHATGPT_SUBSCRIPTION_HARNESSES.includes(harness)) {
+    return subscriptionMismatchMessage(model.trim(), subscriptionId, harness, context);
+  }
   if (harness === "grok")
     return grokModelMismatch(model, sections, context);
+  if (harness === "fx")
+    return fxModelMismatch(model, sections, context);
   const section = harness ? harnessCatalogSection(harness) : null;
   if (!harness || !section)
     return null;
@@ -291,6 +334,37 @@ function grokModelMismatch(model, sections, context) {
   }
   return null;
 }
+function fxModelMismatch(model, sections, context) {
+  const id = model.trim();
+  if (!id)
+    return null;
+  const agent = context.agentId ? ` of agent "${context.agentName ?? context.agentId}" (${context.agentId})` : "";
+  const fail = (reason) => `Model "${id}" does not run on the fx harness${agent}. ${reason} Use modelTier (smol, regular, smart, ultra) for portable intent, or omit model and let the assignee resolve it.`;
+  if (isAlias(id)) {
+    const parsed = parseAlias(id);
+    if (!parsed)
+      return null;
+    return parsed.kind === "openrouter" || parsed.kind === "openai" ? null : fail(`A latest:${parsed.kind} alias resolves to an id fx cannot route. ${FX_ROUTES_HINT}`);
+  }
+  const route = fxModelRoute(id);
+  if ("error" in route)
+    return fail(route.error);
+  if (route.fxProvider !== "openai")
+    return null;
+  if (Object.hasOwn(sections.openai?.models ?? {}, id))
+    return null;
+  for (const [name, other] of Object.entries(sections)) {
+    if (name === "openai" || !other?.models)
+      continue;
+    if (Object.hasOwn(other.models, id) || name === "anthropic" && isClaudeShortname(id, other)) {
+      return fail(`A bare id runs on OpenAI (OPENAI_API_KEY), and "${id}" is in the ${name} catalog, not openai. ${FX_ROUTES_HINT}`);
+    }
+  }
+  return null;
+}
+function isClaudeShortname(id, section) {
+  return Object.hasOwn(buildClaudeShortnameMap(section.models), id);
+}
 function grokMismatchMessage(model, sections, context) {
   const agent = context.agentId ? ` of agent "${context.agentName ?? context.agentId}" (${context.agentId})` : "";
   const pool = sections.xai?.models ? [sections.xai.models] : Object.values(sections).map((section) => section?.models ?? {});
@@ -307,6 +381,11 @@ function grokMismatchMessage(model, sections, context) {
   const examples = ids.length ? ` (for example: ${ids.slice(0, MAX_EXAMPLE_IDS).join(", ")}${extra > 0 ? ` and ${extra} more` : ""})` : "";
   return `Model "${model}" does not run on the grok harness${agent}. The grok harness accepts xai catalog models${examples} and openrouter/<vendor>/<id>. Use modelTier (smol, regular, smart, ultra) for portable intent, or omit model and let the assignee resolve it.`;
 }
+function subscriptionMismatchMessage(model, bareId, harness, context) {
+  const agent = context.agentId ? ` of agent "${context.agentName ?? context.agentId}" (${context.agentId})` : "";
+  const codexHint = harness === "codex" ? ` On codex, use "${bareId}": codex runs it on the pool directly.` : "";
+  return `Model "${model}" does not run on the ${harness} harness${agent}. The ChatGPT subscription prefix (openai-codex/) is for the ${CHATGPT_SUBSCRIPTION_HARNESSES.join(" and ")} harness.${codexHint}`;
+}
 function harnessMismatchMessage(model, harness, section, own, context) {
   const agent = context.agentId ? ` of agent "${context.agentName ?? context.agentId}" (${context.agentId})` : "";
   const ids = harnessModelIds(harness, own);
@@ -314,14 +393,20 @@ function harnessMismatchMessage(model, harness, section, own, context) {
   const examples = ids.slice(0, MAX_EXAMPLE_IDS).join(", ") + (extra > 0 ? ` and ${extra} more` : "");
   return `Model "${model}" does not run on the ${harness} harness${agent}. The ${harness} harness accepts ${section} catalog models, for example: ${examples}. Use modelTier (smol, regular, smart, ultra) for portable intent, or omit model and let the assignee resolve it.`;
 }
-var HARNESS_CATALOG_SECTION, XAI_PREFIX_RE, GROK_ID_RE, DATED_ID_RE3, ISO_DATED_ID_RE, CODEX_EXCLUDED_TOKENS, CODEX_MIN_GPT_MAJOR = 5, CONTEXT_SUFFIX_RE, MAX_EXAMPLE_IDS = 8;
+var HARNESS_CATALOG_SECTION, FX_REJECTED_NAMESPACES, FX_ROUTES_HINT = "The fx harness runs openrouter/<vendor>/<id> (OPENROUTER_API_KEY), vercel/<vendor>/<id> (AI_GATEWAY_API_KEY) or a bare OpenAI id (OPENAI_API_KEY).", XAI_PREFIX_RE, GROK_ID_RE, DATED_ID_RE3, ISO_DATED_ID_RE, CODEX_EXCLUDED_TOKENS, CODEX_MIN_GPT_MAJOR = 5, CONTEXT_SUFFIX_RE, MAX_EXAMPLE_IDS = 8;
 var init_harness_models = __esm(() => {
+  init_chatgpt_subscription();
   init_resolve_alias();
   HARNESS_CATALOG_SECTION = {
     claude: "anthropic",
     "claude-managed": "anthropic",
     codex: "openai"
   };
+  FX_REJECTED_NAMESPACES = {
+    nan: "fx rejects NaN's streams (InconsistentFinishReason on its trailing usage chunk, fx 0.0.15)",
+    helmcode: "Helmcode is not verified on fx yet",
+    anthropic: "fx cannot speak the Anthropic Messages API; use openrouter/anthropic/<id> or vercel/anthropic/<id>"
+  };
   XAI_PREFIX_RE = /^xai\//i;
   GROK_ID_RE = /^grok-[^/]+$/i;
   DATED_ID_RE3 = /-\d{8}$/;
@@ -671,6 +756,12 @@ function grokCatalogRef(model) {
   }
   return { providerId: "xai", modelId: id };
 }
+function fxCatalogRef(model) {
+  const route = fxModelRoute(model);
+  if ("error" in route || route.fxProvider !== "gateway")
+    return null;
+  return { providerId: "vercel", modelId: route.fxModel };
+}
 function cursorCatalogRef(model) {
   const id = model.trim().toLowerCase();
   if (/^(gpt-|o\d)/.test(id))
@@ -713,6 +804,9 @@ function applyHarnessOverrides(harness, modelId, facts, levels) {
   } else if (harness !== "codex" && harness !== "cursor" && harness !== "opencode" && harness !== "pi") {
     result = result.filter((l) => l !== "max");
   }
+  if (harness === "fx") {
+    result = result.filter((l) => l !== "off");
+  }
   if (harness === "codex") {
     const isCodexMax = /-codex-max$/.test(modelId);
     const isCodexNonMax = /-codex$/.test(modelId) && !isCodexMax;
@@ -738,6 +832,7 @@ function claudeCatalogModelId(modelId, models) {
 }
 var REASONING_EFFORT_LEVELS, REASONING_HARNESSES, FALLBACK_LEVELS, EFFORT_VALUE_MAP;
 var init_reasoning = __esm(() => {
+  init_chatgpt_subscription();
   init_harness_models();
   REASONING_EFFORT_LEVELS = ["off", "low", "medium", "high", "xhigh", "max"];
   REASONING_HARNESSES = [
@@ -748,7 +843,8 @@ var init_reasoning = __esm(() => {
     "dsh",
     "cursor",
     "amp",
-    "grok"
+    "grok",
+    "fx"
   ];
   FALLBACK_LEVELS = ["low", "medium", "high"];
   EFFORT_VALUE_MAP = {
@@ -763,6 +859,7 @@ var init_reasoning = __esm(() => {
 
 // packages/model-catalog/src/index.ts
 var init_src2 = __esm(() => {
+  init_chatgpt_subscription();
   init_display();
   init_harness_models();
   init_merge();
@@ -773,4 +870,4 @@ var init_src2 = __esm(() => {
   init_resolve_alias();
 });
 
-export { isAlias, parseAlias, resolveAlias, harnessCatalogSection, isHarnessModelJudged, normalizeGrokModel, harnessModelIds, modelFamilyKey, buildClaudeShortnameMap, harnessModelMismatch, openAICompatibleProviders, openAICompatibleProviderIds, providerKeyVars, openAICompatibleKeyVars, baseUrlEnvVar, openAICompatibleBaseUrlVars, baseUrlOverride, ignoredBaseUrlVar, providerBaseUrl, openAICompatibleProvider, providerForModel, providerForKeyVar, providerKeyFromEnv, providerHarnessModels, withAgentChatRegistrySections, registryCatalogSections, withRegistryCatalogSections, dshCatalogRef, grokCatalogRef, cursorCatalogRef, reasoningLevelsFor, claudeCatalogModelId, init_src2 };
+export { CHATGPT_SUBSCRIPTION_PROVIDER, chatgptSubscriptionModelId, isChatgptSubscriptionModel, isAlias, parseAlias, resolveAlias, harnessCatalogSection, isHarnessModelJudged, fxModelRoute, normalizeGrokModel, harnessModelIds, modelFamilyKey, buildClaudeShortnameMap, harnessModelMismatch, openAICompatibleProviders, openAICompatibleProviderIds, providerKeyVars, openAICompatibleKeyVars, baseUrlEnvVar, openAICompatibleBaseUrlVars, baseUrlOverride, ignoredBaseUrlVar, providerBaseUrl, openAICompatibleProvider, providerForModel, providerForKeyVar, providerKeyFromEnv, providerHarnessModels, withAgentChatRegistrySections, registryCatalogSections, withRegistryCatalogSections, dshCatalogRef, grokCatalogRef, fxCatalogRef, cursorCatalogRef, reasoningLevelsFor, claudeCatalogModelId, init_src2 };

package/dist/{cli-az0bpf8p.js → cli-5pag6rmn.js}

@@ -2,7 +2,7 @@ import {
   isGrokOpenRouterModel,
   grokTargetProfile,
   ACPAdapter2
-} from "./cli-avgcz4ra.js";
+} from "./cli-rm6hqj3z.js";
 import {
   getOpenRouterBaseUrl,
   getOpenRouterAttributionHeaders,
@@ -11,11 +11,11 @@ import {
 import {
   registerVolatileSecret,
   init_secret_scrubber
-} from "./cli-a4btqqft.js";
+} from "./cli-1b7btd38.js";
 import {
   normalizeGrokModel,
   init_src2
-} from "./cli-4r12t6w6.js";
+} from "./cli-5c4hjzne.js";
 
 // src/providers/grok-adapter.ts
 init_src2();

package/dist/{cli-36g23z21.js → cli-6s7vdcta.js}

@@ -7,21 +7,21 @@ import {
   tierConfigKey,
   init_model_tier_keys,
   init_db4
-} from "./cli-1s1dqn1j.js";
+} from "./cli-1ayk1eas.js";
 import {
   ensureRbacSeedsSynced2,
   init_rbac_roles
-} from "./cli-bq2pcphn.js";
+} from "./cli-8hs41zy2.js";
 import {
   seedPricingFromModelsDev,
   init_seed_pricing
-} from "./cli-mc97xy2s.js";
+} from "./cli-xtjhfmpc.js";
 import {
   MODEL_TIERS,
   DEFAULT_MODEL_TIER_MAP,
   ProviderNameSchema,
   init_types4
-} from "./cli-41z8xwj0.js";
+} from "./cli-7wspm5gm.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-rtk9g7av.js → cli-73jzwksr.js}

@@ -2,11 +2,12 @@ import {
   runtimeCatalogSection,
   runtimeCatalogModel,
   init_runtime_model_catalog
-} from "./cli-a2jw6ee5.js";
+} from "./cli-1p89xny0.js";
 import {
+  chatgptSubscriptionModelId,
   buildClaudeShortnameMap,
   init_src2
-} from "./cli-4r12t6w6.js";
+} from "./cli-5c4hjzne.js";
 import {
   __esm
 } from "./cli-242037k3.js";
@@ -32,6 +33,9 @@ function getContextWindowSize(model) {
 function getKnownContextWindowSize(model) {
   if (!model)
     return;
+  const subscriptionId = chatgptSubscriptionModelId(model);
+  if (subscriptionId)
+    return catalogContext("openai", subscriptionId);
   const slash = model.indexOf("/");
   if (slash > 0) {
     const scoped = catalogContext(model.slice(0, slash), model.slice(slash + 1));

package/dist/{cli-jg0nfda6.js → cli-75gkpjvw.js}

@@ -5,7 +5,7 @@ import {
 import {
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-a4btqqft.js";
+} from "./cli-1b7btd38.js";
 import {
   __esm
 } from "./cli-242037k3.js";
@@ -116,13 +116,13 @@ async function refreshAccessToken(refreshToken) {
       })
     });
     if (!response.ok) {
-      const text = await response.text().catch(() => "");
+      const text = redactTokens(await response.text().catch(() => ""), [refreshToken]);
       console.error("[codex-oauth] Token refresh failed:", response.status, text);
       return { type: "failed", status: response.status, error: text.slice(0, 300) };
     }
     const json = await response.json();
     if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-      console.error("[codex-oauth] Token refresh response missing fields:", json);
+      console.error("[codex-oauth] Token refresh response missing fields; got keys:", Object.keys(json).join(", "));
       return { type: "failed" };
     }
     return {
@@ -132,10 +132,22 @@ async function refreshAccessToken(refreshToken) {
       expires: Date.now() + json.expires_in * 1000
     };
   } catch (error) {
-    console.error("[codex-oauth] Token refresh error:", error);
+    const message = error instanceof Error ? error.message : String(error);
+    console.error("[codex-oauth] Token refresh error:", redactTokens(message, [refreshToken]));
     return { type: "failed" };
   }
 }
+function redactTokens(text, tokens) {
+  let out = text;
+  for (const token of tokens) {
+    if (!token)
+      continue;
+    const forms = new Set([token, encodeURIComponent(token), JSON.stringify(token).slice(1, -1)]);
+    for (const form of forms)
+      out = out.split(form).join("[REDACTED:codex_oauth_token]");
+  }
+  return scrubSecrets(out);
+}
 function getAccountId(accessToken) {
   const payload = decodeJwt(accessToken);
   const auth = payload?.[JWT_CLAIM_PATH];
@@ -384,6 +396,16 @@ function isStaleByAge(expires, maxAgeMs) {
   const issuedAt = expires - ACCESS_TOKEN_TTL_MS;
   return Date.now() - issuedAt > maxAgeMs;
 }
+function buildPoolRevalidationFailureReason(err, slot) {
+  if (err instanceof CodexOAuthRefreshError) {
+    if (err.reason === "lock_timeout") {
+      return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: timed out waiting for the refresh lock — transient, will retry on next task.`;
+    }
+    return `[auth-error] Codex pool slot ${slot} [...${err.keySuffix}] revalidation failed: refresh rejected (${err.status ?? "unknown status"} ${scrubSecrets(err.body ?? "")}) — credential likely revoked; re-run codex-login for this slot.`;
+  }
+  const message = scrubSecrets(err instanceof Error ? err.message : String(err));
+  return `[auth-error] Codex pool slot ${slot} revalidation failed (not a confirmed auth rejection, transient): ${message}`;
+}
 async function acquireCodexRefreshLock(apiUrl, apiKey, slot) {
   const key = codexOAuthKeyForSlot(slot);
   const res = await fetch(`${apiUrl}/api/oauth/refresh-locks/${encodeURIComponent(key)}`, {
@@ -465,22 +487,29 @@ async function loadAllCodexOAuthSlots(apiUrl, apiKey, options = {}) {
 }
 async function storeCodexOAuth(apiUrl, apiKey, creds, slot = 0) {
   const key = codexOAuthKeyForSlot(slot);
-  const res = await fetch(`${apiUrl}/api/config`, {
-    method: "PUT",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`
-    },
-    body: JSON.stringify({
-      scope: "global",
-      key,
-      value: JSON.stringify(creds),
-      isSecret: true,
-      description: `Codex ChatGPT OAuth credentials slot ${slot} (stored by codex-login)`
-    })
-  });
+  const redact = (text) => redactTokens(text, [creds.access, creds.refresh]);
+  let res;
+  try {
+    res = await fetch(`${apiUrl}/api/config`, {
+      method: "PUT",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({
+        scope: "global",
+        key,
+        value: JSON.stringify(creds),
+        isSecret: true,
+        description: `Codex ChatGPT OAuth credentials slot ${slot} (stored by codex-login)`
+      })
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to store ${key} config: ${redact(message)}`);
+  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    const text = redact(await res.text().catch(() => ""));
     throw new Error(`Failed to store ${key} config: HTTP ${res.status} ${text}`);
   }
 }
@@ -531,7 +560,8 @@ async function persistCodexOAuth(apiUrl, apiKey, creds, slot = 0) {
   try {
     await storeCodexOAuth(apiUrl, apiKey, creds, slot);
   } catch (err) {
-    console.error("[codex-oauth] persistCodexOAuth failed (non-fatal):", err);
+    const message = err instanceof Error ? err.message : String(err);
+    console.error("[codex-oauth] persistCodexOAuth failed (non-fatal):", redactTokens(message, [creds.access, creds.refresh]));
   }
 }
 async function getValidCodexOAuth(apiUrl, apiKey, slot = 0, opts) {
@@ -591,6 +621,7 @@ async function getValidCodexOAuth(apiUrl, apiKey, slot = 0, opts) {
 }
 var CODEX_OAUTH_KEY_LEGACY = "codex_oauth", MAX_CODEX_OAUTH_SLOT = 100, REFRESH_LOCK_TTL_MS, REFRESH_LOCK_WAIT_MS, REFRESH_LOCK_POLL_MS = 250, REFRESH_SKEW_MS, ACCESS_TOKEN_TTL_MS, CodexOAuthRefreshError;
 var init_storage = __esm(() => {
+  init_secret_scrubber();
   init_auth_json();
   init_flow();
   REFRESH_LOCK_TTL_MS = 2 * 60 * 1000;
@@ -615,4 +646,4 @@ var init_storage = __esm(() => {
   };
 });
 
-export { _fetchHolder, CLIENT_ID, decodeJwt, exchangeAuthorizationCode2, getAccountId, extractChatgptPlanType, extractChatgptUserId, loginCodexOAuth, init_flow, deriveCodexKeySuffix, authJsonToCredentialSelection, credentialsToAuthJson, init_auth_json, MAX_CODEX_OAUTH_SLOT, CodexOAuthRefreshError, codexOAuthKeyForSlot, loadAllCodexOAuthSlots, storeCodexOAuth, persistCodexOAuth, getValidCodexOAuth, init_storage };
+export { _fetchHolder, CLIENT_ID, decodeJwt, exchangeAuthorizationCode2, getAccountId, extractChatgptPlanType, extractChatgptUserId, loginCodexOAuth, init_flow, deriveCodexKeySuffix, authJsonToCredentialSelection, credentialsToAuthJson, init_auth_json, MAX_CODEX_OAUTH_SLOT, buildPoolRevalidationFailureReason, codexOAuthKeyForSlot, loadAllCodexOAuthSlots, storeCodexOAuth, persistCodexOAuth, getValidCodexOAuth, init_storage };