@evalops/maestro 0.10.46 → 0.10.47

package/dist/cli.js

@@ -18551,6 +18551,8 @@ import { join as join2, resolve } from "node:path";
 import { join as join3, resolve as resolve2 } from "node:path";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { dirname, join as join4 } from "node:path";
+import { spawn as spawnChild } from "node:child_process";
+import { createInterface } from "node:readline";
 import { readFileSync, statSync as statSync2 } from "node:fs";
 import {
   chmodSync,
@@ -18713,8 +18715,6 @@ import { parse as partialParse } from "partial-json";
 import OpenAI from "openai";
 import crypto2 from "node:crypto";
 import { arch, platform, release } from "node:os";
-import { spawn as spawnChild } from "node:child_process";
-import { createInterface } from "node:readline";
 
 // node_modules/@google/genai/dist/node/index.mjs
 var import_p_retry = __toESM(require_p_retry(), 1);
@@ -38863,6 +38863,445 @@ var init_downstream_http = __esm2(() => {
     }
   };
 });
+var CodexAppServerRpcClient = class _CodexAppServerRpcClient {
+  transport;
+  options;
+  pending = /* @__PURE__ */ new Map();
+  notificationListeners = /* @__PURE__ */ new Set();
+  notificationHistory = [];
+  notificationWaiters = /* @__PURE__ */ new Set();
+  requestHandlers = /* @__PURE__ */ new Set();
+  stderrTail = [];
+  rl;
+  nextId = 1;
+  closed = false;
+  constructor(transport, options = {}) {
+    this.transport = transport;
+    this.options = options;
+    this.rl = createInterface({ input: transport.stdout });
+    this.rl.on("line", (line) => this.handleLine(line));
+    this.rl.on("close", () => this.rejectAll("Codex app-server closed stdout"));
+    transport.stderr?.on("data", (chunk) => this.captureStderr(chunk));
+    transport.once?.("exit", (code, signal) => {
+      const suffix = code === null || code === void 0 ? `signal ${String(signal)}` : `code ${String(code)}`;
+      this.rejectAll(`Codex app-server exited with ${suffix}`);
+    });
+    transport.once?.("error", (error) => {
+      const message = error instanceof Error ? error.message : `Process error: ${String(error)}`;
+      this.rejectAll(message);
+    });
+  }
+  static spawn(options = {}) {
+    const command = options.command ?? "codex";
+    const args = options.args ?? ["app-server", "--listen", "stdio://"];
+    const child = spawnChild(command, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: "pipe"
+    });
+    return new _CodexAppServerRpcClient(child, {
+      requestTimeoutMs: options.requestTimeoutMs
+    });
+  }
+  async initialize(options = {}) {
+    const capabilities = options.experimentalApi || options.optOutNotificationMethods?.length ? {
+      experimentalApi: options.experimentalApi || void 0,
+      optOutNotificationMethods: options.optOutNotificationMethods ?? void 0
+    } : void 0;
+    const result2 = await this.request("initialize", {
+      clientInfo: options.clientInfo ?? DEFAULT_CLIENT_INFO,
+      capabilities
+    }, { timeoutMs: options.timeoutMs });
+    this.notify("initialized");
+    return result2;
+  }
+  request(method, params, options = {}) {
+    if (this.closed) {
+      return Promise.reject(new Error("Codex app-server client is closed"));
+    }
+    const id = this.nextId++;
+    const timeoutMs = options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    return new Promise((resolve310, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`Codex app-server request timed out: ${method}`));
+      }, timeoutMs);
+      this.pending.set(id, {
+        resolve: (value) => resolve310(value),
+        reject,
+        timer
+      });
+      try {
+        this.writeMessage({ id, method, params });
+      } catch (error) {
+        clearTimeout(timer);
+        this.pending.delete(id);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+  }
+  notify(method, params) {
+    this.writeMessage({ method, params });
+  }
+  onNotification(listener) {
+    this.notificationListeners.add(listener);
+    return () => {
+      this.notificationListeners.delete(listener);
+    };
+  }
+  onRequest(listener) {
+    this.requestHandlers.add(listener);
+    return () => {
+      this.requestHandlers.delete(listener);
+    };
+  }
+  waitForNotification(predicate, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
+    const buffered = this.notificationHistory.find(predicate);
+    if (buffered) {
+      return Promise.resolve(buffered);
+    }
+    if (this.closed) {
+      return Promise.reject(new Error("Codex app-server client is closed"));
+    }
+    return new Promise((resolve310, reject) => {
+      let unsubscribe = () => {
+      };
+      const waiter = {
+        reject: (error) => {
+          clearTimeout(waiter.timer);
+          unsubscribe();
+          this.notificationWaiters.delete(waiter);
+          reject(error);
+        },
+        timer: setTimeout(() => {
+          waiter.reject(new Error("Timed out waiting for Codex app-server notification"));
+        }, timeoutMs),
+        unsubscribe: () => unsubscribe()
+      };
+      unsubscribe = this.onNotification((notification) => {
+        if (!predicate(notification)) {
+          return;
+        }
+        clearTimeout(waiter.timer);
+        waiter.unsubscribe();
+        this.notificationWaiters.delete(waiter);
+        resolve310(notification);
+      });
+      this.notificationWaiters.add(waiter);
+    });
+  }
+  readAccount(refreshToken2 = false) {
+    return this.request("account/read", { refreshToken: refreshToken2 });
+  }
+  startChatGptLogin(flow = "browser", options = {}) {
+    const params = flow === "device" ? { type: "chatgptDeviceCode" } : {
+      type: "chatgpt",
+      codexStreamlinedLogin: options.codexStreamlinedLogin || void 0
+    };
+    return this.request("account/login/start", params);
+  }
+  async waitForLoginCompletion(loginId, timeoutMs = DEFAULT_LOGIN_TIMEOUT_MS) {
+    const notification = await this.waitForNotification((candidate) => candidate.method === "account/login/completed" && isRecord(candidate.params) && candidate.params.loginId === loginId, timeoutMs);
+    const params = notification.params;
+    if (!params?.success) {
+      throw new Error(params?.error || "ChatGPT sign-in did not complete");
+    }
+    return params;
+  }
+  async logout() {
+    await this.request("account/logout", void 0);
+  }
+  close() {
+    if (this.closed) {
+      return;
+    }
+    this.closed = true;
+    this.rejectAll("Codex app-server client closed");
+    this.rl.close();
+    try {
+      this.transport.stdin.end();
+    } catch {
+    }
+    this.transport.kill?.("SIGTERM");
+  }
+  handleLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      return;
+    }
+    let message;
+    try {
+      message = JSON.parse(trimmed);
+    } catch {
+      return;
+    }
+    if (!isRecord(message)) {
+      return;
+    }
+    if ("id" in message && ("result" in message || "error" in message)) {
+      this.handleResponse(message);
+      return;
+    }
+    if (typeof message.method === "string" && "id" in message) {
+      this.handleServerRequest(message);
+      return;
+    }
+    if (typeof message.method === "string") {
+      this.emitNotification({
+        method: message.method,
+        params: message.params
+      });
+    }
+  }
+  handleResponse(response) {
+    if (response.id === void 0) {
+      return;
+    }
+    const pending = this.pending.get(response.id);
+    if (!pending) {
+      return;
+    }
+    this.pending.delete(response.id);
+    clearTimeout(pending.timer);
+    if (response.error) {
+      const message = response.error.message ?? "Codex app-server request failed";
+      pending.reject(new Error(message));
+      return;
+    }
+    pending.resolve(response.result);
+  }
+  async handleServerRequest(request) {
+    this.emitNotification({
+      method: request.method,
+      params: request.params
+    });
+    if (request.method === "account/chatgptAuthTokens/refresh") {
+      this.writeMessage({
+        id: request.id,
+        error: {
+          code: -32601,
+          message: "Maestro does not manage Codex ChatGPT auth tokens directly. Run `maestro codex login` or `codex login` so Codex app-server owns ChatGPT auth refresh."
+        }
+      });
+      return;
+    }
+    for (const handler of Array.from(this.requestHandlers)) {
+      try {
+        const handled = await handler(request);
+        if (!handled.handled) {
+          continue;
+        }
+        if ("error" in handled) {
+          this.writeMessage({
+            id: request.id,
+            error: {
+              code: handled.error.code ?? -32e3,
+              message: handled.error.message,
+              data: handled.error.data
+            }
+          });
+          return;
+        }
+        this.writeMessage({ id: request.id, result: handled.result });
+        return;
+      } catch (error) {
+        this.writeMessage({
+          id: request.id,
+          error: {
+            code: -32e3,
+            message: error instanceof Error ? error.message : String(error)
+          }
+        });
+        return;
+      }
+    }
+    const fallback = defaultServerRequestResponse(request.method);
+    if (fallback.ok) {
+      this.writeMessage({ id: request.id, result: fallback.result });
+      return;
+    }
+    this.writeMessage({
+      id: request.id,
+      error: {
+        code: -32601,
+        message: `Unsupported Codex app-server request: ${request.method}`
+      }
+    });
+  }
+  emitNotification(notification) {
+    this.notificationHistory.push(notification);
+    if (this.notificationHistory.length > MAX_NOTIFICATION_HISTORY) {
+      this.notificationHistory.shift();
+    }
+    for (const listener of this.notificationListeners) {
+      listener(notification);
+    }
+  }
+  writeMessage(message) {
+    const compact = Object.fromEntries(Object.entries(message).filter(([, value]) => value !== void 0));
+    const line = `${JSON.stringify(compact)}
+`;
+    if (!this.transport.stdin.write(line)) {
+    }
+  }
+  captureStderr(chunk) {
+    const text2 = Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
+    for (const line of text2.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed) {
+        continue;
+      }
+      this.stderrTail.push(trimmed);
+      if (this.stderrTail.length > 20) {
+        this.stderrTail.shift();
+      }
+    }
+  }
+  rejectAll(message) {
+    this.closed = true;
+    const stderr = this.stderrTail.length ? `
+${this.stderrTail.slice(-5).join(`
+`)}` : "";
+    const error = new Error(`${message}${stderr}`);
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    this.pending.clear();
+    for (const waiter of Array.from(this.notificationWaiters)) {
+      waiter.reject(error);
+    }
+    this.notificationWaiters.clear();
+  }
+};
+function createCodexAppServerClient(options = {}) {
+  return CodexAppServerRpcClient.spawn(options);
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function defaultServerRequestResponse(method) {
+  switch (method) {
+    case "item/commandExecution/requestApproval":
+      return { ok: true, result: { decision: "decline" } };
+    case "item/fileChange/requestApproval":
+      return { ok: true, result: { decision: "decline" } };
+    case "item/permissions/requestApproval":
+      return { ok: true, result: { permissions: {}, scope: "turn" } };
+    case "item/tool/requestUserInput":
+      return { ok: true, result: { answers: {} } };
+    case "mcpServer/elicitation/request":
+      return {
+        ok: true,
+        result: { action: "decline", content: null, _meta: null }
+      };
+    case "applyPatchApproval":
+    case "execCommandApproval":
+      return { ok: true, result: { decision: "denied" } };
+    default:
+      return { ok: false };
+  }
+}
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var DEFAULT_LOGIN_TIMEOUT_MS;
+var MAX_NOTIFICATION_HISTORY = 100;
+var DEFAULT_CLIENT_INFO;
+var init_app_server_client = __esm2(() => {
+  init_package_version();
+  DEFAULT_LOGIN_TIMEOUT_MS = 5 * 6e4;
+  DEFAULT_CLIENT_INFO = {
+    name: "maestro",
+    title: "Maestro",
+    version: readPackageVersion()
+  };
+});
+function accountLabel(state2) {
+  const account = state2.account;
+  if (!account) {
+    return "missing";
+  }
+  if (account.type === "chatgpt") {
+    const plan = typeof account.planType === "string" && account.planType.length > 0 ? `, ${account.planType}` : "";
+    return `${account.email}${plan}`;
+  }
+  if (account.type === "apiKey") {
+    return "API key";
+  }
+  return account.type;
+}
+function isBrowserLogin(value) {
+  return value.type === "chatgpt" && typeof value.loginId === "string" && typeof value.authUrl === "string";
+}
+function isDeviceCodeLogin(value) {
+  return value.type === "chatgptDeviceCode" && typeof value.loginId === "string" && typeof value.verificationUrl === "string" && typeof value.userCode === "string";
+}
+async function loginOpenAICodexAppServer(onAuthUrl, _onPromptCode, onStatus) {
+  const client = createCodexAppServerClient();
+  try {
+    await client.initialize({ experimentalApi: true });
+    let currentAccount = null;
+    try {
+      currentAccount = await client.readAccount(true);
+    } catch {
+      onStatus?.("Codex app-server account refresh failed; starting sign-in to repair authentication.");
+    }
+    if (currentAccount?.account) {
+      onStatus?.(`Codex app-server is already authenticated: ${accountLabel(currentAccount)}.`);
+      return;
+    }
+    const login2 = await client.startChatGptLogin("browser", {
+      codexStreamlinedLogin: true
+    });
+    if (isBrowserLogin(login2)) {
+      onAuthUrl(login2.authUrl);
+      onStatus?.("Complete Codex ChatGPT sign-in in the browser.");
+      await client.waitForLoginCompletion(login2.loginId);
+    } else if (isDeviceCodeLogin(login2)) {
+      onAuthUrl(login2.verificationUrl);
+      onStatus?.(`Complete Codex device sign-in with code ${login2.userCode}.`);
+      await client.waitForLoginCompletion(login2.loginId);
+    } else if (login2.type === "apiKey") {
+      onStatus?.("Codex app-server is configured with an API key.");
+      return;
+    } else if (login2.type === "chatgptAuthTokens") {
+      onStatus?.("Codex app-server is using externally managed ChatGPT auth.");
+      return;
+    } else {
+      throw new Error(`Unsupported Codex login response: ${login2.type}`);
+    }
+    const account = await client.readAccount(true);
+    if (!account.account) {
+      throw new Error("Codex app-server did not report a signed-in account.");
+    }
+    onStatus?.(`Codex ChatGPT sign-in complete: ${accountLabel(account)}.`);
+  } finally {
+    client.close();
+  }
+}
+async function logoutOpenAICodexAppServer() {
+  const client = createCodexAppServerClient();
+  try {
+    await client.initialize({ experimentalApi: true });
+    await client.logout();
+  } finally {
+    client.close();
+  }
+}
+async function hasOpenAICodexAppServerAccount() {
+  const client = createCodexAppServerClient();
+  try {
+    await client.initialize({ experimentalApi: true });
+    const account = await client.readAccount(false);
+    return account.account !== null;
+  } catch {
+    return false;
+  } finally {
+    client.close();
+  }
+}
+var init_auth = __esm2(() => {
+  init_app_server_client();
+});
 function getFeatureFlagsPath(env = process.env) {
   const configured2 = env.EVALOPS_FEATURE_FLAGS_PATH?.trim();
   return configured2 ? configured2 : void 0;
@@ -40667,7 +41106,7 @@ function normalizeConnectorSourceOfTruthArea(area) {
   }
   return null;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function getMetadataString(metadata, key) {
@@ -40684,7 +41123,7 @@ function getMetadataStringArray(metadata, key) {
 }
 function getMetadataStringMap(metadata, key) {
   const value = metadata?.[key];
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     return;
   }
   const entries = Object.entries(value).map(([entryKey2, entryValue]) => [
@@ -41165,7 +41604,7 @@ function parseScopesPayload(value) {
   }
   return value.filter((entry2) => typeof entry2 === "string").map((entry2) => entry2.trim()).filter((entry2) => entry2.length > 0);
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function getMetadataString2(metadata, key) {
@@ -41181,7 +41620,7 @@ function getMetadataScopes(metadata) {
 }
 function resolveProviderRef(metadata) {
   const fallback = getProviderRef();
-  const providerRef = isRecord2(metadata?.providerRef) ? metadata.providerRef : void 0;
+  const providerRef = isRecord3(metadata?.providerRef) ? metadata.providerRef : void 0;
   return {
     provider: getMetadataString2(providerRef, "provider") ?? fallback.provider,
     environment: getMetadataString2(providerRef, "environment") ?? fallback.environment,
@@ -42924,6 +43363,7 @@ __export2(exports_oauth, {
   logout: () => logout,
   login: () => login,
   listOAuthProviders: () => listOAuthProviders2,
+  listOAuthLogoutProvidersWithCodexAppServer: () => listOAuthLogoutProvidersWithCodexAppServer,
   listOAuthLogoutProviders: () => listOAuthLogoutProviders,
   issueEvalOpsDelegationToken: () => issueEvalOpsDelegationToken,
   hasOAuthCredentials: () => hasOAuthCredentials,
@@ -42984,6 +43424,13 @@ function listOAuthProviders2() {
 function listOAuthLogoutProviders() {
   return listOAuthProviders().filter((provider) => isSupportedOAuthProvider(provider) || isLegacyLogoutOnlyOAuthProvider(provider));
 }
+async function listOAuthLogoutProvidersWithCodexAppServer() {
+  const providers = listOAuthLogoutProviders();
+  if (!providers.includes("openai-codex") && await hasOpenAICodexAppServerAccount()) {
+    return [...providers, "openai-codex"];
+  }
+  return providers;
+}
 function getOAuthLogoutProviders() {
   const loggedInProviders = new Set(listOAuthLogoutProviders());
   const supported = getOAuthProviders().filter((provider) => loggedInProviders.has(provider.id));
@@ -43012,8 +43459,12 @@ async function login(provider, options) {
       shouldSyncConnectorConnection = true;
       break;
     case "openai-codex":
-      await loginOpenAICodex(options.onAuthUrl, options.onPromptCode, options.onStatus);
-      shouldSyncConnectorConnection = true;
+      if (options.mode === "responses" || options.mode === "legacy-responses") {
+        await loginOpenAICodex(options.onAuthUrl, options.onPromptCode, options.onStatus);
+        shouldSyncConnectorConnection = true;
+      } else {
+        await loginOpenAICodexAppServer(options.onAuthUrl, options.onPromptCode, options.onStatus);
+      }
       break;
     case "evalops":
       assertEvalOpsManagedGatewayEnabled();
@@ -43043,6 +43494,7 @@ async function login(provider, options) {
 }
 async function logout(provider) {
   const credentials = loadOAuthCredentials(provider);
+  let codexAppServerLogoutError;
   if (isLegacyLogoutOnlyOAuthProvider(provider)) {
     await revokeOAuthProviderConnection(provider, credentials);
     removeOAuthCredentials(provider);
@@ -43058,10 +43510,32 @@ async function logout(provider) {
       });
     }
   }
+  if (provider === "openai-codex") {
+    const shouldLogoutAppServer = !credentials || await hasOpenAICodexAppServerAccount();
+    if (shouldLogoutAppServer) {
+      try {
+        await logoutOpenAICodexAppServer();
+      } catch (error) {
+        if (!credentials) {
+          const message = error instanceof Error ? error.message : String(error);
+          throw new Error(`Failed to sign out of Codex app-server: ${message}`);
+        }
+        codexAppServerLogoutError = error;
+      }
+    }
+  }
   if (provider !== "evalops") {
     await revokeOAuthProviderConnection(provider, credentials);
   }
   removeOAuthCredentials(provider);
+  if (codexAppServerLogoutError) {
+    const message = codexAppServerLogoutError instanceof Error ? codexAppServerLogoutError.message : String(codexAppServerLogoutError);
+    logger15.warn("Failed to sign out of Codex app-server", {
+      error: message,
+      provider
+    });
+    throw new Error(`Failed to sign out of Codex app-server; legacy OAuth credentials were removed: ${message}`);
+  }
 }
 async function refreshToken(provider) {
   const credentials = loadOAuthCredentials(provider);
@@ -43130,6 +43604,7 @@ var logger15;
 var SUPPORTED_OAUTH_PROVIDERS;
 var LEGACY_LOGOUT_ONLY_OAUTH_PROVIDERS;
 var init_oauth = __esm2(() => {
+  init_auth();
   init_evalops_managed();
   init_logger();
   init_connectors();
@@ -43832,7 +44307,7 @@ function resolveA2AAgentCardUrl(input) {
   return normalizePairingUrl(parsed.toString(), "agentCardUrl");
 }
 function normalizeDecodedPayload(input, options = {}) {
-  if (!isRecord3(input)) {
+  if (!isRecord4(input)) {
     throw new Error("A2A pairing code payload must be an object");
   }
   if (input.version !== PAIRING_CODE_VERSION) {
@@ -43848,14 +44323,14 @@ function normalizeDecodedPayload(input, options = {}) {
     issuedAt: toDate(input.issuedAt, "issuedAt").toISOString(),
     expiresAt: toDate(input.expiresAt, "expiresAt").toISOString(),
     ...typeof input.peerId === "string" ? { peerId: requireNonEmptyString(input.peerId, "peerId") } : {},
-    ...isRecord3(input.provider) ? { provider: normalizeProvider(input.provider) } : {},
-    ...isRecord3(input.capabilities) ? { capabilities: normalizeCapabilities(input.capabilities) } : {},
+    ...isRecord4(input.provider) ? { provider: normalizeProvider(input.provider) } : {},
+    ...isRecord4(input.capabilities) ? { capabilities: normalizeCapabilities(input.capabilities) } : {},
     ...Array.isArray(input.skills) ? { skills: normalizeSkills(input.skills) } : {},
     ...typeof input.keyFingerprint === "string" ? {
       keyFingerprint: requireNonEmptyString(input.keyFingerprint, "keyFingerprint")
     } : {},
-    ...isRecord3(input.relayHints) ? { relayHints: normalizeRelayHints(input.relayHints) } : {},
-    ...isRecord3(input.metadata) ? { metadata: normalizeMetadata(input.metadata) } : {}
+    ...isRecord4(input.relayHints) ? { relayHints: normalizeRelayHints(input.relayHints) } : {},
+    ...isRecord4(input.metadata) ? { metadata: normalizeMetadata(input.metadata) } : {}
   };
   validateA2APeerPairingPayload(payload, options);
   return payload;
@@ -43928,7 +44403,7 @@ function normalizeCapabilities(input) {
 }
 function normalizeSkills(input) {
   return input.slice(0, MAX_SKILLS_IN_PAIRING_CODE).map((skill, index2) => {
-    if (!isRecord3(skill)) {
+    if (!isRecord4(skill)) {
       throw new Error(`skills[${index2}] must be an object`);
     }
     return {
@@ -43965,7 +44440,7 @@ function copyStringList(input, key, limit = Number.POSITIVE_INFINITY) {
 }
 function copyStringRecord(input, key) {
   const value = input[key];
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return {};
   }
   const entries = Object.entries(value).map(([entryKey2, entryValue]) => [
@@ -43976,7 +44451,7 @@ function copyStringRecord(input, key) {
 }
 function copyPrimitiveRecord(input, key) {
   const value = input[key];
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return {};
   }
   const output = {};
@@ -44018,7 +44493,7 @@ function rejectSecretBearingFields(value, path3 = "$") {
     }
     return;
   }
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return;
   }
   for (const [key, child] of Object.entries(value)) {
@@ -44065,7 +44540,7 @@ ${payload.agentCardUrl}
 ${payload.transportUrl}`).digest("base64url").slice(0, 16);
   return `a2a-peer-${hash}`;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage(error) {
@@ -44101,10 +44576,10 @@ async function loadA2APeerRegistry(options = {}) {
     throw error;
   }
   const parsed = JSON.parse(raw);
-  if (!isRecord4(parsed)) {
+  if (!isRecord5(parsed)) {
     throw new Error(`A2A peer registry at ${path3} must be a JSON object`);
   }
-  const peers = isRecord4(parsed.peers) ? parsed.peers : {};
+  const peers = isRecord5(parsed.peers) ? parsed.peers : {};
   const registry2 = {
     peers: Object.fromEntries(Object.entries(peers).map(([name, value]) => [
       name,
@@ -44239,7 +44714,7 @@ function resolveUpsertTokenFields(input) {
   };
 }
 function normalizeRegistryEntry(input, label) {
-  if (!isRecord4(input)) {
+  if (!isRecord5(input)) {
     throw new Error(`${label} must be an object`);
   }
   const url = typeof input.url === "string" ? input.url.trim() : "";
@@ -44261,7 +44736,7 @@ function normalizeRegistryEntry(input, label) {
     ...copyString(input, "actorId"),
     ...typeof input.timeoutMs === "number" && input.timeoutMs > 0 ? { timeoutMs: input.timeoutMs } : {},
     ...typeof input.maxAttempts === "number" && input.maxAttempts > 0 ? { maxAttempts: input.maxAttempts } : {},
-    ...isRecord4(input.capabilities) ? {
+    ...isRecord5(input.capabilities) ? {
       capabilities: {
         ...typeof input.capabilities.streaming === "boolean" ? { streaming: input.capabilities.streaming } : {},
         ...typeof input.capabilities.pushNotifications === "boolean" ? { pushNotifications: input.capabilities.pushNotifications } : {},
@@ -44270,7 +44745,7 @@ function normalizeRegistryEntry(input, label) {
     } : {},
     ...Array.isArray(input.skills) ? { skills: normalizeRegistrySkills(input.skills) } : {},
     ...copyString(input, "keyFingerprint"),
-    ...isRecord4(input.metadata) ? {
+    ...isRecord5(input.metadata) ? {
       metadata: input.metadata
     } : {},
     ...copyString(input, "createdAt"),
@@ -44278,7 +44753,7 @@ function normalizeRegistryEntry(input, label) {
   };
 }
 function normalizeRegistrySkills(input) {
-  return input.filter(isRecord4).map((skill) => ({
+  return input.filter(isRecord5).map((skill) => ({
     id: typeof skill.id === "string" ? skill.id : "",
     name: typeof skill.name === "string" ? skill.name : "",
     ...copyString(skill, "description"),
@@ -44307,7 +44782,7 @@ function copyStringList2(input, key) {
 }
 function copyStringRecord2(input, key) {
   const value = input[key];
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return {};
   }
   const entries = Object.entries(value).map(([entryKey2, entryValue]) => [
@@ -44318,7 +44793,7 @@ function copyStringRecord2(input, key) {
 }
 function copyPrimitiveRecord2(input, key) {
   const value = input[key];
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return {};
   }
   const output = {};
@@ -44346,7 +44821,7 @@ function expandHome(path3) {
   }
   return resolve4(path3);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasNodeCode(error, code) {
@@ -44363,7 +44838,7 @@ function extractA2AWorkGraphMetadata(task) {
   return normalizeA2AWorkGraphMetadata(task?.metadata?.workGraph);
 }
 function normalizeA2AWorkGraphMetadata(input) {
-  if (!isRecord5(input)) {
+  if (!isRecord6(input)) {
     return;
   }
   const codexSubagents = normalizeCodexSubagents(input.codexSubagents);
@@ -44425,7 +44900,7 @@ function formatA2AWorkGraphCodexSubagents(graph) {
   return `Codex subagents: ${parts.join(" | ")}`;
 }
 function normalizeCodexSubagents(input) {
-  if (!isRecord5(input)) {
+  if (!isRecord6(input)) {
     return;
   }
   const edges = normalizeCodexSubagentEdges(input.edges);
@@ -44444,7 +44919,7 @@ function normalizeCodexSubagentEdges(input) {
   }
   const edges = [];
   for (const value of input) {
-    if (!isRecord5(value)) {
+    if (!isRecord6(value)) {
       continue;
     }
     const edge = {};
@@ -44498,7 +44973,7 @@ function normalizeCodexSubagentEdges(input) {
   return edges;
 }
 function normalizeNumberRecord(input) {
-  if (!isRecord5(input)) {
+  if (!isRecord6(input)) {
     return;
   }
   const entries = Object.entries(input).map(([key, value]) => [key, numberValue(value)]).filter((entry2) => entry2[1] !== void 0);
@@ -44567,7 +45042,7 @@ function numberValue(input) {
   const parsed = Number(input);
   return Number.isFinite(parsed) ? parsed : void 0;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function getA2ATaskLedgerPath(path3) {
@@ -44589,7 +45064,7 @@ async function loadA2ATaskLedger(options = {}) {
     throw error;
   }
   const parsed = JSON.parse(raw);
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     throw new Error(`A2A task ledger at ${path3} must be a JSON object`);
   }
   const tasks = Array.isArray(parsed.tasks) ? parsed.tasks : [];
@@ -44980,7 +45455,7 @@ function latestAgentMessageInHistory(history) {
   return;
 }
 function normalizeLedgerEntry(input, path3) {
-  if (!isRecord6(input)) {
+  if (!isRecord7(input)) {
     throw new Error(`A2A task ledger ${path3} must be a JSON object`);
   }
   const id = requiredString(input.id, `${path3}.id`);
@@ -45016,7 +45491,7 @@ function normalizeLedgerEntry(input, path3) {
       entry2[key] = value;
     }
   }
-  if (isRecord6(input.metadata)) {
+  if (isRecord7(input.metadata)) {
     entry2.metadata = cleanMetadata(input.metadata);
   }
   const workGraph = normalizeA2AWorkGraphMetadata(input.workGraph);
@@ -45026,7 +45501,7 @@ function normalizeLedgerEntry(input, path3) {
   return entry2;
 }
 function normalizeTranscriptEntry(input, path3) {
-  if (!isRecord6(input)) {
+  if (!isRecord7(input)) {
     throw new Error(`A2A task ledger ${path3} must be a JSON object`);
   }
   const role = input.role === "agent" ? "agent" : "user";
@@ -45051,7 +45526,7 @@ function cleanMetadata(input) {
   return entries.length > 0 ? Object.fromEntries(entries) : void 0;
 }
 function extractA2ATaskLedgerMetadata(task) {
-  if (!isRecord6(task.metadata)) {
+  if (!isRecord7(task.metadata)) {
     return;
   }
   return cleanMetadata(Object.fromEntries(Object.entries(task.metadata).filter(([key]) => !isSecretLikeKey2(key))));
@@ -45078,12 +45553,12 @@ function expandHome2(path3) {
   return path3 === "~" || path3.startsWith("~/") ? join9(homedir3(), path3.slice(2)) : path3;
 }
 function hasNodeCode2(error, code) {
-  return isRecord6(error) && error.code === code;
+  return isRecord7(error) && error.code === code;
 }
 function sleep3(ms) {
   return new Promise((resolve510) => setTimeout(resolve510, ms));
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function fail(message) {
@@ -48330,16 +48805,16 @@ async function handleA2ATelemetry(parsed) {
 }
 async function loadA2ATelemetryEvents(path3) {
   const parsed = JSON.parse(await readFile3(path3, "utf8"));
-  const events = Array.isArray(parsed) ? parsed : isRecord7(parsed) && Array.isArray(parsed.events) ? parsed.events : void 0;
+  const events = Array.isArray(parsed) ? parsed : isRecord8(parsed) && Array.isArray(parsed.events) ? parsed.events : void 0;
   if (!events) {
     throw new Error("A2A telemetry events file must be an array or { events }");
   }
   return events.filter(isA2ATelemetryCloudEventLike);
 }
 function isA2ATelemetryCloudEventLike(value) {
-  return isRecord7(value) && typeof value.type === "string" && (value.data === void 0 || isRecord7(value.data));
+  return isRecord8(value) && typeof value.type === "string" && (value.data === void 0 || isRecord8(value.data));
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 async function handleA2ATasks(parsed) {
@@ -55682,13 +56157,13 @@ function getAvailableThemes(workspaceDir = process.cwd()) {
   }
   return Array.from(themes).sort();
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function normalizeThemeJson(raw) {
-  if (!isRecord8(raw))
+  if (!isRecord9(raw))
     return raw;
-  if (!isRecord8(raw.colors))
+  if (!isRecord9(raw.colors))
     return raw;
   const {
     bashMode: _bashMode,
@@ -60763,7 +61238,7 @@ function getEffectiveUserPolicyPath() {
   const candidates = getUserPolicyPathCandidates();
   return candidates.find(isPolicyFile) ?? null;
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function getPolicySources() {
@@ -60856,20 +61331,20 @@ function readOptionalRecord(source, key) {
   if (!(key in source))
     return;
   const value = source[key];
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     throw new Error(`Workspace policy key "${key}" must be a table`);
   }
   return value;
 }
 function selectWorkspacePolicyRoot(parsed) {
-  if (!isRecord9(parsed)) {
+  if (!isRecord10(parsed)) {
     throw new Error("Workspace policy must be a TOML table");
   }
   const nestedPolicy = parsed.policy;
   if (nestedPolicy === void 0) {
     return parsed;
   }
-  if (!isRecord9(nestedPolicy)) {
+  if (!isRecord10(nestedPolicy)) {
     throw new Error('Workspace policy key "policy" must be a table');
   }
   return nestedPolicy;
@@ -65150,11 +65625,11 @@ __export2(exports_scripted, {
   SCRIPTED_REPLAY_PROVIDER: () => SCRIPTED_REPLAY_PROVIDER,
   SCRIPTED_REPLAY_MODEL_ID: () => SCRIPTED_REPLAY_MODEL_ID
 });
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseScriptedScenario(value, label) {
-  if (!isRecord10(value) || value.schemaVersion !== MAESTRO_SCRIPTED_SCENARIO_SCHEMA) {
+  if (!isRecord11(value) || value.schemaVersion !== MAESTRO_SCRIPTED_SCENARIO_SCHEMA) {
     throw new Error(`Replay scenario ${label} must use schemaVersion ${MAESTRO_SCRIPTED_SCENARIO_SCHEMA}`);
   }
   if (typeof value.id !== "string" || value.id.trim().length === 0) {
@@ -65169,7 +65644,7 @@ function parseScriptedScenario(value, label) {
   if (!Array.isArray(value.frames)) {
     throw new Error(`Replay scenario ${label} must contain frames`);
   }
-  if (!isRecord10(value.metadata)) {
+  if (!isRecord11(value.metadata)) {
     throw new Error(`Replay scenario ${label} must contain metadata`);
   }
   if (typeof value.metadata.recordedAt !== "string" || value.metadata.recordedAt.trim().length === 0) {
@@ -65195,7 +65670,7 @@ function parseScriptedScenario(value, label) {
     throw new Error(`Replay scenario ${label} assertions must be an array`);
   }
   for (const [assertionOffset, assertion2] of (value.assertions ?? []).entries()) {
-    if (!isRecord10(assertion2) || typeof assertion2.id !== "string" || typeof assertion2.kind !== "string") {
+    if (!isRecord11(assertion2) || typeof assertion2.id !== "string" || typeof assertion2.kind !== "string") {
       throw new Error(`Replay scenario ${label} assertion ${assertionOffset} must contain id and kind`);
     }
     if (![
@@ -65209,14 +65684,14 @@ function parseScriptedScenario(value, label) {
     }
   }
   for (const [frameOffset, frame] of value.frames.entries()) {
-    if (!isRecord10(frame) || !Number.isInteger(frame.index) || !Array.isArray(frame.statements)) {
+    if (!isRecord11(frame) || !Number.isInteger(frame.index) || !Array.isArray(frame.statements)) {
       throw new Error(`Replay scenario ${label} frame ${frameOffset} must contain index and statements`);
     }
     if (frame.index !== frameOffset) {
       throw new Error(`Replay scenario ${label} frame indexes must be contiguous, unique, and start at 0; frame ${frameOffset} has index ${frame.index}`);
     }
     for (const [statementOffset, statement] of frame.statements.entries()) {
-      if (!isRecord10(statement) || typeof statement.kind !== "string") {
+      if (!isRecord11(statement) || typeof statement.kind !== "string") {
         throw new Error(`Replay scenario ${label} frame ${frame.index} statement ${statementOffset} must contain kind`);
       }
       if (statement.kind === "text" && typeof statement.text !== "string") {
@@ -65304,7 +65779,7 @@ function replayFrameIndex(context2) {
   return context2.messages.filter((message) => message.role === "assistant" && message.provider === SCRIPTED_REPLAY_PROVIDER).length;
 }
 function isToolResultMessage2(value) {
-  return isRecord10(value) && value.role === "toolResult";
+  return isRecord11(value) && value.role === "toolResult";
 }
 function expectedToolResultError(scenario, frameIndex, context2) {
   if (frameIndex <= 0)
@@ -65339,7 +65814,7 @@ function expectedToolResultError(scenario, frameIndex, context2) {
   return;
 }
 function normalizeToolInput(input) {
-  return isRecord10(input) ? input : {};
+  return isRecord11(input) ? input : {};
 }
 function toolCallId(scenario, frameIndex, statementIndex, statement) {
   return statement.id ?? `replay_${scenario.id}_${String(frameIndex).padStart(3, "0")}_${String(statementIndex).padStart(3, "0")}`;
@@ -65571,7 +66046,7 @@ function parseStreamingJson(partialJson) {
 }
 var init_json_parse = () => {
 };
-function isRecord11(value) {
+function isRecord12(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function describeValueType(value) {
@@ -65601,7 +66076,7 @@ function createToolArgumentNormalizer(options) {
   }
   function parseFromString(raw, context2, parseOptions2) {
     const parsed = parseStreamingJson(raw);
-    if (isRecord11(parsed)) {
+    if (isRecord12(parsed)) {
       return parsed;
     }
     if (parseOptions2?.logInvalid ?? true) {
@@ -65616,7 +66091,7 @@ function createToolArgumentNormalizer(options) {
         logInvalid: normalizeOptions?.logInvalid
       });
     }
-    if (isRecord11(raw)) {
+    if (isRecord12(raw)) {
       if (normalizeOptions?.expectString) {
         warnOnce("raw:object", `${options.providerLabel} tool call arguments were object, expected string`, buildWarningDetails(context2));
       }
@@ -65639,7 +66114,7 @@ function createToolArgumentNormalizer(options) {
         partialJson: raw
       };
     }
-    if (isRecord11(raw)) {
+    if (isRecord12(raw)) {
       if (normalizeOptions?.expectString) {
         warnOnce("raw:object", `${options.providerLabel} tool call arguments were object, expected string`, buildWarningDetails(context2));
       }
@@ -66037,7 +66512,7 @@ async function* streamAnthropic(model, context2, options) {
               const idx = partial.content.length;
               let initialArguments = {};
               if ("input" in block && block.input !== void 0) {
-                if (isRecord11(block.input)) {
+                if (isRecord12(block.input)) {
                   initialArguments = block.input;
                   toolArgOverrides.set(idx, block.input);
                 } else if (typeof block.input === "string") {
@@ -66131,7 +66606,7 @@ async function* streamAnthropic(model, context2, options) {
                 if (buf.length > 0) {
                   block.arguments = toolArgumentNormalizer.parseFromString(buf, { toolId: block.id, name: block.name, stage: "done" }, { logInvalid: true });
                 } else {
-                  block.arguments = isRecord11(block.arguments) ? block.arguments : {};
+                  block.arguments = isRecord12(block.arguments) ? block.arguments : {};
                 }
               }
               toolArgBuffers.delete(idx);
@@ -66431,7 +66906,7 @@ function canonicalizeSchema(value) {
   if (Array.isArray(value)) {
     return value.map((entry2) => canonicalizeSchema(entry2));
   }
-  if (!isRecord11(value)) {
+  if (!isRecord12(value)) {
     return value;
   }
   return Object.fromEntries(Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey)).map(([entryKey2, entryValue]) => [
@@ -66517,14 +66992,14 @@ function mergeSharedObjectSchemaConstraints(left, right, enumValues) {
   return merged;
 }
 function mergeObjectVariants(variants, requiredMode) {
-  if (variants.length === 0 || !variants.every(isRecord11))
+  if (variants.length === 0 || !variants.every(isRecord12))
     return;
   if (!variants.every((variant) => variant.type === "object"))
     return;
   const mergedProperties = {};
   const requiredCounts = /* @__PURE__ */ new Map();
   for (const variant of variants) {
-    const properties = isRecord11(variant.properties) ? variant.properties : {};
+    const properties = isRecord12(variant.properties) ? variant.properties : {};
     for (const [propertyName, propertySchema] of Object.entries(properties)) {
       const current = mergedProperties[propertyName];
       if (current === void 0) {
@@ -66534,7 +67009,7 @@ function mergeObjectVariants(variants, requiredMode) {
       if (schemasAreEqual(current, propertySchema)) {
         continue;
       }
-      if (isRecord11(current) && isRecord11(propertySchema)) {
+      if (isRecord12(current) && isRecord12(propertySchema)) {
         const currentValues = enumLikeValues(current);
         const incomingValues = enumLikeValues(propertySchema);
         if (currentValues && incomingValues) {
@@ -66560,7 +67035,7 @@ function mergeObjectVariants(variants, requiredMode) {
           continue;
         }
       }
-      if (requiredMode === "union" && isRecord11(current) && isRecord11(propertySchema)) {
+      if (requiredMode === "union" && isRecord12(current) && isRecord12(propertySchema)) {
         mergedProperties[propertyName] = mergeCompatibleObjectSchemas(current, propertySchema) ?? {};
         continue;
       }
@@ -66591,8 +67066,8 @@ function mergeObjectVariants(variants, requiredMode) {
 function mergeRootObjectConstraints(schema, merged) {
   if (schema.type !== "object")
     return merged;
-  const rootProperties = isRecord11(schema.properties) ? schema.properties : {};
-  const mergedProperties = isRecord11(merged.properties) ? merged.properties : {};
+  const rootProperties = isRecord12(schema.properties) ? schema.properties : {};
+  const mergedProperties = isRecord12(merged.properties) ? merged.properties : {};
   const properties = { ...rootProperties };
   for (const [propertyName, propertySchema] of Object.entries(mergedProperties)) {
     const rootPropertySchema = properties[propertyName];
@@ -66603,7 +67078,7 @@ function mergeRootObjectConstraints(schema, merged) {
     if (schemasAreEqual(rootPropertySchema, propertySchema)) {
       continue;
     }
-    if (isRecord11(rootPropertySchema) && isRecord11(propertySchema)) {
+    if (isRecord12(rootPropertySchema) && isRecord12(propertySchema)) {
       const compatible = mergeCompatibleObjectSchemas(rootPropertySchema, propertySchema);
       if (!compatible)
         return;
@@ -66626,7 +67101,7 @@ function mergeRootObjectConstraints(schema, merged) {
   };
 }
 function hasBranchOnlyRequiredFields(variants) {
-  if (variants.length === 0 || !variants.every(isRecord11))
+  if (variants.length === 0 || !variants.every(isRecord12))
     return false;
   const requiredCounts = /* @__PURE__ */ new Map();
   for (const variant of variants) {
@@ -66663,7 +67138,7 @@ function normalizeOpenAIToolParameters(parameters) {
 }
 function filterResponsesApiTools(tools) {
   const hasUnsupportedTopLevelUnion = (params) => {
-    if (!isRecord11(params))
+    if (!isRecord12(params))
       return false;
     const topLevelUnionKey = TOP_LEVEL_UNION_KEYS.find((key) => Array.isArray(params[key]));
     if (!topLevelUnionKey)
@@ -66680,7 +67155,7 @@ function filterResponsesApiTools(tools) {
     return !!(p.oneOf || p.anyOf || p.allOf || p.enum || p.not);
   };
   const hasUnsupportedTopLevelKeyword = (params) => {
-    if (!isRecord11(params))
+    if (!isRecord12(params))
       return false;
     return params.enum !== void 0 || params.not !== void 0;
   };
@@ -66968,7 +67443,7 @@ async function* streamResponsesApiSdk(model, context2, options) {
             callId: item.call_id,
             name: item.name,
             stage: "done"
-          }, { logInvalid: true }) : isRecord11(item.arguments) ? item.arguments : {};
+          }, { logInvalid: true }) : isRecord12(item.arguments) ? item.arguments : {};
           const toolCall = {
             type: "toolCall",
             id: `${item.call_id}|${item.id}`,
@@ -67843,7 +68318,7 @@ ${thinkingText}
                     delta: argsDelta,
                     partial
                   };
-                } else if (isRecord11(argsDelta)) {
+                } else if (isRecord12(argsDelta)) {
                   toolArgumentNormalizer3.warnOnce("delta:object", "OpenAI tool call arguments delta was object", {
                     callId: block.id,
                     name: block.name
@@ -67883,7 +68358,7 @@ ${thinkingText}
                   if (partialArgs !== void 0) {
                     block.arguments = toolArgumentNormalizer3.parseFromString(partialArgs, { callId: block.id, name: block.name, stage: "done" }, { logInvalid: true });
                   } else {
-                    block.arguments = isRecord11(block.arguments) ? block.arguments : {};
+                    block.arguments = isRecord12(block.arguments) ? block.arguments : {};
                   }
                 }
                 toolArgBuffers.delete(i2);
@@ -67973,7 +68448,7 @@ function resolveOpenAICodexAccountId(token, headers) {
   }
   const accountId = process.env.OPENAI_CODEX_ACCOUNT_ID?.trim() ?? process.env.CHATGPT_ACCOUNT_ID?.trim() ?? extractOpenAICodexAccountId(token);
   if (!accountId) {
-    throw new Error("OpenAI Codex account id is required. Log in with /login openai-codex or set OPENAI_CODEX_ACCOUNT_ID.");
+    throw new Error("OpenAI Codex account id is required for legacy Codex Responses models. Log in with /login openai-codex:responses or set OPENAI_CODEX_ACCOUNT_ID.");
   }
   return accountId;
 }
@@ -68534,7 +69009,7 @@ function stringValue4(value) {
 function getMessageText(item) {
   const content = Array.isArray(item.content) ? item.content : [];
   return content.map((part) => {
-    if (!isRecord11(part))
+    if (!isRecord12(part))
       return "";
     if (part.type === "output_text" && typeof part.text === "string") {
       return sanitizeSurrogates(part.text);
@@ -68547,14 +69022,14 @@ function getMessageText(item) {
 }
 function getReasoningSummaryText(item) {
   const summary2 = Array.isArray(item.summary) ? item.summary : [];
-  return summary2.map((part) => isRecord11(part) && typeof part.text === "string" ? part.text : "").filter(Boolean).join(`
+  return summary2.map((part) => isRecord12(part) && typeof part.text === "string" ? part.text : "").filter(Boolean).join(`
 
 `);
 }
 function safeJsonRecord(value) {
   try {
     const parsed = JSON.parse(value);
-    return isRecord11(parsed) ? parsed : null;
+    return isRecord12(parsed) ? parsed : null;
   } catch {
     return null;
   }
@@ -68596,346 +69071,6 @@ var init_openai_codex_responses = __esm2(() => {
     providerLabel: "OpenAI Codex"
   });
 });
-var CodexAppServerRpcClient = class _CodexAppServerRpcClient {
-  transport;
-  options;
-  pending = /* @__PURE__ */ new Map();
-  notificationListeners = /* @__PURE__ */ new Set();
-  notificationHistory = [];
-  notificationWaiters = /* @__PURE__ */ new Set();
-  requestHandlers = /* @__PURE__ */ new Set();
-  stderrTail = [];
-  rl;
-  nextId = 1;
-  closed = false;
-  constructor(transport, options = {}) {
-    this.transport = transport;
-    this.options = options;
-    this.rl = createInterface({ input: transport.stdout });
-    this.rl.on("line", (line) => this.handleLine(line));
-    this.rl.on("close", () => this.rejectAll("Codex app-server closed stdout"));
-    transport.stderr?.on("data", (chunk) => this.captureStderr(chunk));
-    transport.once?.("exit", (code, signal) => {
-      const suffix = code === null || code === void 0 ? `signal ${String(signal)}` : `code ${String(code)}`;
-      this.rejectAll(`Codex app-server exited with ${suffix}`);
-    });
-    transport.once?.("error", (error) => {
-      const message = error instanceof Error ? error.message : `Process error: ${String(error)}`;
-      this.rejectAll(message);
-    });
-  }
-  static spawn(options = {}) {
-    const command = options.command ?? "codex";
-    const args = options.args ?? ["app-server", "--listen", "stdio://"];
-    const child = spawnChild(command, args, {
-      cwd: options.cwd,
-      env: options.env ?? process.env,
-      stdio: "pipe"
-    });
-    return new _CodexAppServerRpcClient(child, {
-      requestTimeoutMs: options.requestTimeoutMs
-    });
-  }
-  async initialize(options = {}) {
-    const capabilities = options.experimentalApi || options.optOutNotificationMethods?.length ? {
-      experimentalApi: options.experimentalApi || void 0,
-      optOutNotificationMethods: options.optOutNotificationMethods ?? void 0
-    } : void 0;
-    const result2 = await this.request("initialize", {
-      clientInfo: options.clientInfo ?? DEFAULT_CLIENT_INFO,
-      capabilities
-    }, { timeoutMs: options.timeoutMs });
-    this.notify("initialized");
-    return result2;
-  }
-  request(method, params, options = {}) {
-    if (this.closed) {
-      return Promise.reject(new Error("Codex app-server client is closed"));
-    }
-    const id = this.nextId++;
-    const timeoutMs = options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-    return new Promise((resolve192, reject) => {
-      const timer = setTimeout(() => {
-        this.pending.delete(id);
-        reject(new Error(`Codex app-server request timed out: ${method}`));
-      }, timeoutMs);
-      this.pending.set(id, {
-        resolve: (value) => resolve192(value),
-        reject,
-        timer
-      });
-      try {
-        this.writeMessage({ id, method, params });
-      } catch (error) {
-        clearTimeout(timer);
-        this.pending.delete(id);
-        reject(error instanceof Error ? error : new Error(String(error)));
-      }
-    });
-  }
-  notify(method, params) {
-    this.writeMessage({ method, params });
-  }
-  onNotification(listener) {
-    this.notificationListeners.add(listener);
-    return () => {
-      this.notificationListeners.delete(listener);
-    };
-  }
-  onRequest(listener) {
-    this.requestHandlers.add(listener);
-    return () => {
-      this.requestHandlers.delete(listener);
-    };
-  }
-  waitForNotification(predicate, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
-    const buffered = this.notificationHistory.find(predicate);
-    if (buffered) {
-      return Promise.resolve(buffered);
-    }
-    if (this.closed) {
-      return Promise.reject(new Error("Codex app-server client is closed"));
-    }
-    return new Promise((resolve192, reject) => {
-      let unsubscribe = () => {
-      };
-      const waiter = {
-        reject: (error) => {
-          clearTimeout(waiter.timer);
-          unsubscribe();
-          this.notificationWaiters.delete(waiter);
-          reject(error);
-        },
-        timer: setTimeout(() => {
-          waiter.reject(new Error("Timed out waiting for Codex app-server notification"));
-        }, timeoutMs),
-        unsubscribe: () => unsubscribe()
-      };
-      unsubscribe = this.onNotification((notification) => {
-        if (!predicate(notification)) {
-          return;
-        }
-        clearTimeout(waiter.timer);
-        waiter.unsubscribe();
-        this.notificationWaiters.delete(waiter);
-        resolve192(notification);
-      });
-      this.notificationWaiters.add(waiter);
-    });
-  }
-  readAccount(refreshToken2 = false) {
-    return this.request("account/read", { refreshToken: refreshToken2 });
-  }
-  startChatGptLogin(flow = "browser") {
-    return this.request("account/login/start", {
-      type: flow === "device" ? "chatgptDeviceCode" : "chatgpt"
-    });
-  }
-  async waitForLoginCompletion(loginId, timeoutMs = DEFAULT_LOGIN_TIMEOUT_MS) {
-    const notification = await this.waitForNotification((candidate) => candidate.method === "account/login/completed" && isRecord12(candidate.params) && candidate.params.loginId === loginId, timeoutMs);
-    const params = notification.params;
-    if (!params?.success) {
-      throw new Error(params?.error || "ChatGPT sign-in did not complete");
-    }
-    return params;
-  }
-  async logout() {
-    await this.request("account/logout", void 0);
-  }
-  close() {
-    if (this.closed) {
-      return;
-    }
-    this.closed = true;
-    this.rejectAll("Codex app-server client closed");
-    this.rl.close();
-    try {
-      this.transport.stdin.end();
-    } catch {
-    }
-    this.transport.kill?.("SIGTERM");
-  }
-  handleLine(line) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      return;
-    }
-    let message;
-    try {
-      message = JSON.parse(trimmed);
-    } catch {
-      return;
-    }
-    if (!isRecord12(message)) {
-      return;
-    }
-    if ("id" in message && ("result" in message || "error" in message)) {
-      this.handleResponse(message);
-      return;
-    }
-    if (typeof message.method === "string" && "id" in message) {
-      this.handleServerRequest(message);
-      return;
-    }
-    if (typeof message.method === "string") {
-      this.emitNotification({
-        method: message.method,
-        params: message.params
-      });
-    }
-  }
-  handleResponse(response) {
-    if (response.id === void 0) {
-      return;
-    }
-    const pending = this.pending.get(response.id);
-    if (!pending) {
-      return;
-    }
-    this.pending.delete(response.id);
-    clearTimeout(pending.timer);
-    if (response.error) {
-      const message = response.error.message ?? "Codex app-server request failed";
-      pending.reject(new Error(message));
-      return;
-    }
-    pending.resolve(response.result);
-  }
-  async handleServerRequest(request) {
-    this.emitNotification({
-      method: request.method,
-      params: request.params
-    });
-    for (const handler of Array.from(this.requestHandlers)) {
-      try {
-        const handled = await handler(request);
-        if (!handled.handled) {
-          continue;
-        }
-        if ("error" in handled) {
-          this.writeMessage({
-            id: request.id,
-            error: {
-              code: handled.error.code ?? -32e3,
-              message: handled.error.message,
-              data: handled.error.data
-            }
-          });
-          return;
-        }
-        this.writeMessage({ id: request.id, result: handled.result });
-        return;
-      } catch (error) {
-        this.writeMessage({
-          id: request.id,
-          error: {
-            code: -32e3,
-            message: error instanceof Error ? error.message : String(error)
-          }
-        });
-        return;
-      }
-    }
-    const fallback = defaultServerRequestResponse(request.method);
-    if (fallback.ok) {
-      this.writeMessage({ id: request.id, result: fallback.result });
-      return;
-    }
-    this.writeMessage({
-      id: request.id,
-      error: {
-        code: -32601,
-        message: `Unsupported Codex app-server request: ${request.method}`
-      }
-    });
-  }
-  emitNotification(notification) {
-    this.notificationHistory.push(notification);
-    if (this.notificationHistory.length > MAX_NOTIFICATION_HISTORY) {
-      this.notificationHistory.shift();
-    }
-    for (const listener of this.notificationListeners) {
-      listener(notification);
-    }
-  }
-  writeMessage(message) {
-    const compact = Object.fromEntries(Object.entries(message).filter(([, value]) => value !== void 0));
-    const line = `${JSON.stringify(compact)}
-`;
-    if (!this.transport.stdin.write(line)) {
-    }
-  }
-  captureStderr(chunk) {
-    const text2 = Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
-    for (const line of text2.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (!trimmed) {
-        continue;
-      }
-      this.stderrTail.push(trimmed);
-      if (this.stderrTail.length > 20) {
-        this.stderrTail.shift();
-      }
-    }
-  }
-  rejectAll(message) {
-    this.closed = true;
-    const stderr = this.stderrTail.length ? `
-${this.stderrTail.slice(-5).join(`
-`)}` : "";
-    const error = new Error(`${message}${stderr}`);
-    for (const pending of this.pending.values()) {
-      clearTimeout(pending.timer);
-      pending.reject(error);
-    }
-    this.pending.clear();
-    for (const waiter of Array.from(this.notificationWaiters)) {
-      waiter.reject(error);
-    }
-    this.notificationWaiters.clear();
-  }
-};
-function createCodexAppServerClient(options = {}) {
-  return CodexAppServerRpcClient.spawn(options);
-}
-function isRecord12(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function defaultServerRequestResponse(method) {
-  switch (method) {
-    case "item/commandExecution/requestApproval":
-      return { ok: true, result: { decision: "decline" } };
-    case "item/fileChange/requestApproval":
-      return { ok: true, result: { decision: "decline" } };
-    case "item/permissions/requestApproval":
-      return { ok: true, result: { permissions: {}, scope: "turn" } };
-    case "item/tool/requestUserInput":
-      return { ok: true, result: { answers: {} } };
-    case "mcpServer/elicitation/request":
-      return {
-        ok: true,
-        result: { action: "decline", content: null, _meta: null }
-      };
-    case "applyPatchApproval":
-    case "execCommandApproval":
-      return { ok: true, result: { decision: "denied" } };
-    default:
-      return { ok: false };
-  }
-}
-var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
-var DEFAULT_LOGIN_TIMEOUT_MS;
-var MAX_NOTIFICATION_HISTORY = 100;
-var DEFAULT_CLIENT_INFO;
-var init_app_server_client = __esm2(() => {
-  init_package_version();
-  DEFAULT_LOGIN_TIMEOUT_MS = 5 * 6e4;
-  DEFAULT_CLIENT_INFO = {
-    name: "maestro",
-    title: "Maestro",
-    version: readPackageVersion()
-  };
-});
 function isCodexAppServerApi(api) {
   return api === "openai-codex-app-server";
 }
@@ -71526,7 +71661,7 @@ async function* streamBedrock(model, context2, options) {
               delta: input2,
               partial
             };
-          } else if (isRecord11(input2)) {
+          } else if (isRecord12(input2)) {
             toolArgumentNormalizer7.warnOnce("delta:object", "Bedrock tool_use input delta was object", { toolId: block.id, name: block.name });
             toolArgOverrides.set(idx, input2);
             toolArgBuffers.delete(idx);
@@ -71585,7 +71720,7 @@ async function* streamBedrock(model, context2, options) {
             if (buf !== void 0) {
               block.arguments = toolArgumentNormalizer7.parseFromString(buf, { toolId: block.id, name: block.name, stage: "done" }, { logInvalid: true });
             } else {
-              block.arguments = isRecord11(block.arguments) ? block.arguments : {};
+              block.arguments = isRecord12(block.arguments) ? block.arguments : {};
             }
           }
           toolArgBuffers.delete(idx);
@@ -92409,7 +92544,7 @@ var BackgroundTaskRuntime = class {
     };
     attach(child.stdout);
     attach(child.stderr);
-    child.once("exit", closeStream);
+    child.once("close", closeStream);
     child.once("error", closeStream);
   }
 };
@@ -98067,7 +98202,7 @@ function createAuthResolver(options) {
     return;
   };
 }
-var init_auth = __esm2(() => {
+var init_auth2 = __esm2(() => {
   init_env_aliases();
   init_oauth();
   init_storage();
@@ -98154,7 +98289,7 @@ function createAuthSetup(params) {
 var init_auth_setup = __esm2(() => {
   init_registry();
   init_api_keys();
-  init_auth();
+  init_auth2();
   init_evalops_managed();
 });
 var DEFAULT_CHECKPOINT_CONFIG;
@@ -99610,12 +99745,12 @@ async function bootstrapEvalOpsAgent(options = {}, dependencies = {}) {
     });
   }
   try {
-    deps.onStatus({ message: "Loading EvalOps control-plane proof" });
+    deps.onStatus({ message: "Loading EvalOps control-plane status" });
     controlPlaneSummary = await loadControlPlaneSummary(client);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     deps.onStatus({
-      message: `EvalOps control-plane proof unavailable; continuing bootstrap (${reason})`
+      message: `EvalOps control-plane status unavailable; continuing bootstrap (${reason})`
     });
   } finally {
     await client.close().catch(() => {
@@ -107278,6 +107413,47 @@ ${chalk7.dim("No turns recorded yet.")}`;
 var MAX_SAMPLES = 1e3;
 var init_session_perf = () => {
 };
+async function getTuiAuthState(currentProvider) {
+  const providers = listOAuthProviders();
+  let hasCodexAppServerAccount;
+  const maybeHasCodexAppServerAccount = async () => {
+    hasCodexAppServerAccount ??= await hasOpenAICodexAppServerAccount();
+    return hasCodexAppServerAccount;
+  };
+  if (providers.length === 0) {
+    if (await maybeHasCodexAppServerAccount()) {
+      return {
+        authenticated: true,
+        provider: "openai-codex",
+        mode: "app-server"
+      };
+    }
+    return { authenticated: false };
+  }
+  let activeProvider = providers[0];
+  if (currentProvider === "openai-codex") {
+    if (providers.includes("openai-codex") || await maybeHasCodexAppServerAccount()) {
+      activeProvider = "openai-codex";
+    }
+  } else if (currentProvider && providers.includes(currentProvider)) {
+    activeProvider = currentProvider;
+  }
+  if (!activeProvider) {
+    return { authenticated: false, provider: void 0, mode: void 0 };
+  }
+  const credentials = loadOAuthCredentials(activeProvider);
+  const storedMode = credentials?.metadata?.mode;
+  const mode = storedMode ?? (activeProvider === "openai-codex" && await maybeHasCodexAppServerAccount() ? "app-server" : void 0);
+  return {
+    authenticated: true,
+    provider: activeProvider,
+    mode
+  };
+}
+var init_auth_state = __esm2(() => {
+  init_auth();
+  init_storage();
+});
 function extractRetryDelayMs(errorMessage32) {
   if (!errorMessage32)
     return;
@@ -127382,8 +127558,8 @@ function createAuthCommandHandler(deps) {
     }
   });
 }
-function showAuthStatus(ctx, deps) {
-  const state2 = deps.getAuthState();
+async function showAuthStatus(ctx, deps) {
+  const state2 = await deps.getAuthState();
   if (state2.authenticated) {
     ctx.showInfo(`Authentication Status:
   Authenticated: yes
@@ -129184,7 +129360,12 @@ var init_command_catalog = __esm2(() => {
           description: "OAuth provider (openai-codex by default)"
         }
       ],
-      examples: ["/login", "/login openai-codex", "/login openai"]
+      examples: [
+        "/login",
+        "/login openai-codex",
+        "/login openai-codex:responses",
+        "/login openai"
+      ]
     }),
     withArgs("logout", "logout", {
       description: "Remove stored OAuth credentials",
@@ -139553,20 +139734,42 @@ var init_mcp_events_setup = __esm2(() => {
   init_composers();
   init_mcp();
 });
+function resolveLogoutProviderInfo(providerId) {
+  const provider = getOAuthProviders().find((candidate) => candidate.id === providerId);
+  if (provider) {
+    return provider;
+  }
+  if (providerId === "anthropic") {
+    return {
+      id: "anthropic",
+      name: "Anthropic OAuth",
+      description: "Legacy Anthropic OAuth credentials (logout only)",
+      available: true
+    };
+  }
+  return {
+    id: providerId,
+    name: providerId,
+    description: "OAuth credentials",
+    available: true
+  };
+}
 var OAuthSelectorComponent;
 var init_oauth_selector = __esm2(() => {
   init_oauth();
   OAuthSelectorComponent = class OAuthSelectorComponent extends Container11 {
     onSelectCallback;
     onCancelCallback;
+    providerIds;
     listContainer;
     allProviders = [];
     selectedIndex = 0;
     mode;
-    constructor(mode, onSelectCallback, onCancelCallback) {
+    constructor(mode, onSelectCallback, onCancelCallback, providerIds) {
       super();
       this.onSelectCallback = onSelectCallback;
       this.onCancelCallback = onCancelCallback;
+      this.providerIds = providerIds;
       this.mode = mode;
       this.loadProviders();
       this.addChild(new Spacer34(1));
@@ -139580,7 +139783,7 @@ var init_oauth_selector = __esm2(() => {
     }
     loadProviders() {
       if (this.mode === "logout") {
-        this.allProviders = getOAuthLogoutProviders();
+        this.allProviders = this.providerIds ? this.providerIds.map((providerId) => resolveLogoutProviderInfo(providerId)) : getOAuthLogoutProviders();
       } else {
         this.allProviders = getOAuthProviders().filter((p) => p.available);
       }
@@ -139646,7 +139849,7 @@ var OAuthSelectorView = class {
     }, () => {
       this.options.onCancel();
       this.hide();
-    });
+    }, this.options.providers);
     this.options.modalManager.push(this.selector);
   }
   hide() {
@@ -139693,15 +139896,20 @@ var OAuthFlowController = class {
     this.isOAuthFlowActive = true;
     const args = argumentText.trim().toLowerCase();
     let requestedProvider;
+    let requestedMode;
     if (args) {
       if (args.includes(":")) {
         const parts = args.split(":").map((s2) => s2.trim());
         requestedProvider = parts[0];
         const mode = parts[1];
         if (mode) {
-          this.isOAuthFlowActive = false;
-          showError("Provider login modes are no longer supported. Use /login openai-codex for Codex auth or /login openai for OpenAI Platform auth.");
-          return;
+          if (requestedProvider === "openai-codex" && mode === "responses") {
+            requestedMode = mode;
+          } else {
+            this.isOAuthFlowActive = false;
+            showError("Provider login modes are no longer supported, except /login openai-codex:responses for legacy Codex Responses credentials.");
+            return;
+          }
         }
       } else {
         requestedProvider = args;
@@ -139717,7 +139925,7 @@ var OAuthFlowController = class {
     }
     const defaultProvider = providers.find((provider) => provider.id === "openai-codex");
     if (!requestedProvider && defaultProvider) {
-      await this.performOAuthLogin(defaultProvider.id, void 0, showError);
+      await this.performOAuthLogin(defaultProvider.id, requestedMode, showError);
       return;
     }
     if (providers.length === 1 || requestedProvider) {
@@ -139727,7 +139935,7 @@ var OAuthFlowController = class {
         showError(`Unknown provider: ${requestedProvider}`);
         return;
       }
-      await this.performOAuthLogin(provider.id, void 0, showError);
+      await this.performOAuthLogin(provider.id, requestedMode, showError);
       return;
     }
     this.oauthLoginView = new OAuthSelectorView({
@@ -139756,8 +139964,8 @@ var OAuthFlowController = class {
     this.isOAuthFlowActive = true;
     const args = argumentText.trim().toLowerCase();
     const requestedProvider = args || null;
-    const { listOAuthLogoutProviders: listOAuthLogoutProviders2 } = await Promise.resolve().then(() => (init_oauth(), exports_oauth));
-    const loggedInProviders = listOAuthLogoutProviders2();
+    const { listOAuthLogoutProvidersWithCodexAppServer: listOAuthLogoutProvidersWithCodexAppServer2 } = await Promise.resolve().then(() => (init_oauth(), exports_oauth));
+    const loggedInProviders = await listOAuthLogoutProvidersWithCodexAppServer2();
     if (loggedInProviders.length === 0) {
       this.isOAuthFlowActive = false;
       showInfo("No OAuth providers logged in. Use /login first.");
@@ -139778,6 +139986,7 @@ var OAuthFlowController = class {
       modalManager: this.modalManager,
       ui: this.renderContext.ui,
       mode: "logout",
+      providers: loggedInProviders,
       onProviderSelected: async (providerId) => {
         try {
           await this.performOAuthLogout(providerId, showError);
@@ -139936,8 +140145,9 @@ Areas: analytics, billing, crm, hris, support`;
         }
       });
       this.notificationView.showToast(`Successfully authenticated with ${providerId}!`, "success");
+      const completionMessage = providerId === "openai-codex" && mode !== "responses" ? "Authentication complete. Codex app-server sign-in is ready." : `Authentication complete. ${providerId} OAuth credentials saved.`;
       chatContainer.addChild(new Spacer35(1));
-      chatContainer.addChild(new Text38(`Authentication complete. ${providerId} OAuth credentials saved.`, 1, 0));
+      chatContainer.addChild(new Text38(completionMessage, 1, 0));
       requestRender();
     } catch (error) {
       const message = error instanceof Error ? error.message : "Login failed";
@@ -139962,9 +140172,10 @@ Areas: analytics, billing, crm, hris, support`;
     try {
       const { logout: logout2 } = await Promise.resolve().then(() => (init_oauth(), exports_oauth));
       await logout2(providerId);
-      this.notificationView.showToast(`${providerId} OAuth credentials removed`, "success");
+      const message = providerId === "openai-codex" ? "Signed out from openai-codex" : `${providerId} OAuth credentials removed`;
+      this.notificationView.showToast(message, "success");
       chatContainer.addChild(new Spacer35(1));
-      chatContainer.addChild(new Text38(`Logged out from ${providerId}. OAuth credentials removed.`, 1, 0));
+      chatContainer.addChild(new Text38(message, 1, 0));
       requestRender();
     } catch (error) {
       const message = error instanceof Error ? error.message : "Logout failed";
@@ -146593,26 +146804,8 @@ ${hints}`, 1, 0));
     this.footer.dispose();
     process.stdout.off("resize", this.resizeHandler);
   }
-  getActualAuthState() {
-    const providers = listOAuthProviders();
-    if (providers.length === 0) {
-      return { authenticated: false };
-    }
-    const currentProvider = this.agent.state.model?.provider;
-    let activeProvider = providers[0];
-    if (currentProvider && providers.includes(currentProvider)) {
-      activeProvider = currentProvider;
-    }
-    if (!activeProvider) {
-      return { authenticated: false, provider: void 0, mode: void 0 };
-    }
-    const credentials = loadOAuthCredentials(activeProvider);
-    const mode = credentials?.metadata?.mode;
-    return {
-      authenticated: true,
-      provider: activeProvider,
-      mode
-    };
+  async getActualAuthState() {
+    return getTuiAuthState(this.agent.state.model?.provider);
   }
   async detectAndApplyTerminalTheme() {
     const auto = process.env.MAESTRO_TUI_AUTO_THEME;
@@ -146717,13 +146910,13 @@ var init_tui_renderer = __esm2(() => {
   init_mcp();
   init_prompt_recovery2();
   init_registry();
-  init_storage();
   init_opentelemetry();
   init_manager3();
   init_telemetry();
   init_session_perf();
   init_theme();
   init_training();
+  init_auth_state();
   init_auto_compaction();
   init_auto_retry();
   init_compaction_restoration();
@@ -146985,7 +147178,7 @@ function parseArgs(args) {
         i2++;
       }
     } else if (arg && (Array.from(DEPRECATED_FLAGS_WITH_VALUES).some((flag) => arg.startsWith(`${flag}=`)) || DEPRECATED_FLAG_PREFIXES.some((flag) => arg.startsWith(flag)))) {
-    } else if (result2.command === "codex" && result2.subcommand === "login" && (arg === "--device" || arg === "--device-code")) {
+    } else if (result2.command === "codex" && result2.subcommand === "login" && (arg === "--device" || arg === "--device-code" || arg === "--device-auth")) {
       if (!result2.commandArgs) {
         result2.commandArgs = [];
       }
@@ -163206,18 +163399,32 @@ async function handleCodexCommand(subcommand, params = []) {
   }
 }
 async function handleLogin(params = []) {
-  const deviceFlow = params.includes("--device") || params.includes("--device-code");
+  const deviceFlow = params.includes("--device") || params.includes("--device-code") || params.includes("--device-auth");
+  const forceLogin = params.includes("--force") || params.includes("--refresh");
   console.log(chalk63.bold("Maestro OpenAI Codex Login"));
   const client = createCodexAppServerClient();
   try {
-    await client.initialize();
-    const login2 = await client.startChatGptLogin(deviceFlow ? "device" : "browser");
-    if (isBrowserLogin(login2)) {
+    await client.initialize({ experimentalApi: true });
+    if (!forceLogin) {
+      let account2 = null;
+      try {
+        account2 = await client.readAccount(true);
+      } catch {
+        console.log(chalk63.yellow("Codex app-server account refresh failed; starting a new sign-in flow."));
+      }
+      if (account2?.account) {
+        console.log(chalk63.green(`OpenAI Codex is already signed in${accountLabel2(account2)}.`));
+        console.log(chalk63.dim('Run "maestro codex login --force" to start a new sign-in flow.'));
+        return;
+      }
+    }
+    const login2 = await client.startChatGptLogin(deviceFlow ? "device" : "browser", { codexStreamlinedLogin: true });
+    if (isBrowserLogin2(login2)) {
       console.log(chalk63.yellow("Open this URL in your browser to sign in with ChatGPT:"));
       console.log(chalk63.underline(login2.authUrl));
       console.log(chalk63.dim("Waiting for ChatGPT sign-in to complete..."));
       await client.waitForLoginCompletion(login2.loginId);
-    } else if (isDeviceCodeLogin(login2)) {
+    } else if (isDeviceCodeLogin2(login2)) {
       console.log(chalk63.yellow("Open this URL and enter the code:"));
       console.log(chalk63.underline(login2.verificationUrl));
       console.log(chalk63.bold(login2.userCode));
@@ -163227,11 +163434,16 @@ async function handleLogin(params = []) {
       console.log(chalk63.green("OpenAI Codex is already configured with an API key."));
       console.log(chalk63.dim('Select provider "openai-codex" or a model like "openai-codex/gpt-5.5".'));
       return;
+    } else if (isAuthTokensLogin(login2)) {
+      const account2 = await client.readAccount(true);
+      console.log(chalk63.green(`OpenAI Codex is using externally managed ChatGPT auth${accountLabel2(account2)}.`));
+      console.log(chalk63.dim('Select provider "openai-codex" or a model like "openai-codex/gpt-5.5".'));
+      return;
     } else {
       throw new Error(`Unsupported Codex login response: ${login2.type}`);
     }
     const account = await client.readAccount(true);
-    console.log(chalk63.green(`Signed in with ChatGPT${accountLabel(account)}.`));
+    console.log(chalk63.green(`Signed in with ChatGPT${accountLabel2(account)}.`));
     console.log(chalk63.dim('Select provider "openai-codex" or a model like "openai-codex/gpt-5.5".'));
   } finally {
     client.close();
@@ -163257,7 +163469,7 @@ async function handleStatus() {
       console.log(chalk63.dim('Run "maestro codex login" to sign in with ChatGPT.'));
       return;
     }
-    console.log(chalk63.green(`OpenAI Codex is signed in${accountLabel(account)}.`));
+    console.log(chalk63.green(`OpenAI Codex is signed in${accountLabel2(account)}.`));
   } finally {
     client.close();
   }
@@ -163294,7 +163506,7 @@ async function handleDoctor() {
     client.close();
   }
 }
-function accountLabel(state2) {
+function accountLabel2(state2) {
   const account = state2.account;
   if (!account || account.type !== "chatgpt") {
     return "";
@@ -163316,13 +163528,16 @@ function accountDoctorLabel(state2) {
   }
   return account.type;
 }
-function isBrowserLogin(value) {
+function isBrowserLogin2(value) {
   return Boolean(value && typeof value === "object") && value.type === "chatgpt" && typeof value.loginId === "string" && typeof value.authUrl === "string";
 }
 function isApiKeyLogin(value) {
   return Boolean(value && typeof value === "object") && value.type === "apiKey";
 }
-function isDeviceCodeLogin(value) {
+function isAuthTokensLogin(value) {
+  return Boolean(value && typeof value === "object") && value.type === "chatgptAuthTokens";
+}
+function isDeviceCodeLogin2(value) {
   return Boolean(value && typeof value === "object") && value.type === "chatgptDeviceCode" && typeof value.loginId === "string" && typeof value.verificationUrl === "string" && typeof value.userCode === "string";
 }
 var init_codex = __esm2(() => {
@@ -171280,6 +171495,7 @@ function platformA2APushSnapshot(payload, req) {
     return withPlatformA2APushContext({
       kind: "statusUpdate",
       taskId,
+      ...messageIdFields(payload, payload.statusUpdate),
       contextId: stringField2(payload.statusUpdate, "contextId"),
       ...ownershipFields(payload, payload.statusUpdate),
       state: statusState(payload.statusUpdate),
@@ -171297,6 +171513,7 @@ function platformA2APushSnapshot(payload, req) {
     return withPlatformA2APushContext({
       kind: "task",
       taskId,
+      ...messageIdFields(payload, payload.task),
       contextId: stringField2(payload.task, "contextId"),
       ...ownershipFields(payload, payload.task),
       state: statusState(payload.task),
@@ -171311,6 +171528,7 @@ function platformA2APushSnapshot(payload, req) {
     return withPlatformA2APushContext({
       kind: "artifactUpdate",
       taskId,
+      ...messageIdFields(payload, payload.artifactUpdate),
       contextId: stringField2(payload.artifactUpdate, "contextId"),
       ...ownershipFields(payload, payload.artifactUpdate),
       receivedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -171318,12 +171536,14 @@ function platformA2APushSnapshot(payload, req) {
   }
   if (isJsonObject(payload.message)) {
     const taskId = stringField2(payload.message, "taskId");
-    if (!taskId) {
+    const messageFields = messageIdFields(payload, payload.message);
+    if (!messageFields.messageId) {
       return null;
     }
     return withPlatformA2APushContext({
       kind: "message",
-      taskId,
+      ...optionalField("taskId", taskId),
+      ...messageFields,
       contextId: stringField2(payload.message, "contextId"),
       ...ownershipFields(payload, payload.message),
       receivedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -171372,6 +171592,12 @@ function assertHostedRunnerA2APushBoundary(hostedRunner, snapshot) {
   if (hostedRunner?.a2aTaskId && snapshot.taskId && hostedRunner.a2aTaskId !== snapshot.taskId) {
     throw new ApiError2(404, "A2A task not found");
   }
+  if (hostedRunner?.a2aMessageId && snapshotHasBoundaryMessageIdEvidence(snapshot) && !snapshotIncludesMessageId(snapshot, hostedRunner.a2aMessageId)) {
+    throw new ApiError2(404, "A2A message not found");
+  }
+  if (hostedRunner && snapshot.kind === "message" && !hostedRunner.a2aMessageId && !snapshotHasMessageBindingCorrelation(snapshot)) {
+    throw new ApiError2(403, "A2A message push is missing correlation metadata");
+  }
   if (!hostedRunner?.workspaceId) {
     return;
   }
@@ -171391,6 +171617,9 @@ function recordHostedRunnerA2APush(hostedRunner, snapshot) {
   if (snapshot.taskId && !hostedRunner.a2aTaskId) {
     hostedRunner.a2aTaskId = snapshot.taskId;
   }
+  if (snapshot.messageId && !hostedRunner.a2aMessageId && snapshot.kind === "message" && snapshotHasMessageBindingCorrelation(snapshot)) {
+    hostedRunner.a2aMessageId = snapshot.messageId;
+  }
 }
 function statusState(value) {
   const status = isJsonObject(value.status) ? value.status : void 0;
@@ -171412,6 +171641,84 @@ function ownershipFields(payload, value) {
     ...optionalField("tenantId", ownershipString(payload, value, ["tenantId", "tenant_id", "tenant"]))
   };
 }
+function messageIdFields(payload, value) {
+  const messageIds = messageIdsFromSources(payload, value);
+  return {
+    ...optionalField("messageId", messageIds[0]),
+    ...messageIds.length > 0 ? { messageIds } : {}
+  };
+}
+function messageIdsFromSources(payload, value) {
+  const result2 = [];
+  for (const source of messageIdSources(payload, value)) {
+    pushIdentifierStrings(result2, source, [
+      "messageId",
+      "message_id",
+      "a2aMessageId",
+      "a2a_message_id"
+    ]);
+    pushIdentifierArrayStrings(result2, source, ["messageIds", "message_ids"]);
+  }
+  const payloadMessage = isJsonObject(payload.message) ? payload.message : void 0;
+  if (payloadMessage) {
+    pushMessageObjectIdentifier(result2, payloadMessage);
+  }
+  return result2;
+}
+function messageIdSources(payload, value) {
+  const sources = [value, payload];
+  if (isJsonObject(value.artifact)) {
+    sources.push(value.artifact);
+  }
+  return sources;
+}
+function pushMessageObjectIdentifier(target, message) {
+  pushUniqueIdentifier(target, stringField2(message, "id"));
+  pushIdentifierStrings(target, message, [
+    "messageId",
+    "message_id",
+    "a2aMessageId",
+    "a2a_message_id"
+  ]);
+}
+function pushIdentifierStrings(target, value, keys) {
+  for (const key of keys) {
+    pushUniqueIdentifier(target, stringField2(value, key));
+    const metadata = metadataString3(value, key);
+    pushUniqueIdentifier(target, metadata);
+  }
+}
+function pushIdentifierArrayStrings(target, value, keys) {
+  for (const key of keys) {
+    const direct = value[key];
+    if (Array.isArray(direct)) {
+      for (const entry2 of direct) {
+        pushUniqueIdentifier(target, typeof entry2 === "string" ? entry2.trim() : void 0);
+      }
+    }
+    const metadata = isJsonObject(value.metadata) ? value.metadata[key] : void 0;
+    if (Array.isArray(metadata)) {
+      for (const entry2 of metadata) {
+        pushUniqueIdentifier(target, typeof entry2 === "string" ? entry2.trim() : void 0);
+      }
+    }
+  }
+}
+function pushUniqueIdentifier(target, value) {
+  if (!value || target.some((entry2) => sameMessageIdentifier(entry2, value))) {
+    return;
+  }
+  target.push(value);
+}
+function snapshotHasBoundaryMessageIdEvidence(snapshot) {
+  return snapshot.kind === "message" || snapshot.kind === "task" && Boolean(snapshot.messageIds?.length);
+}
+function snapshotHasMessageBindingCorrelation(snapshot) {
+  return Boolean(snapshot.taskId || snapshot.workspaceId);
+}
+function snapshotIncludesMessageId(snapshot, messageId) {
+  return (snapshot.messageId ? sameMessageIdentifier(snapshot.messageId, messageId) : false) || (snapshot.messageIds ?? []).some((candidate) => sameMessageIdentifier(candidate, messageId));
+}
 function ownershipString(payload, value, keys) {
   for (const source of ownershipSources(payload, value)) {
     for (const key of keys) {
@@ -171447,6 +171754,9 @@ function optionalField(key, value) {
 function sameIdentifier(left, right) {
   return left.trim().toLowerCase() === right.trim().toLowerCase();
 }
+function sameMessageIdentifier(left, right) {
+  return left.trim() === right.trim();
+}
 function stringField2(value, key) {
   const field = value[key];
   return typeof field === "string" && field.trim().length > 0 ? field.trim() : void 0;
@@ -176180,6 +176490,11 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
     assertHeadlessRuntimeSnapshot(snapshot, "headless runtime snapshot");
     return snapshot;
   }
+  assertRuntimeReady(action) {
+    if (!this.state.is_ready) {
+      throw new HeadlessRuntimeNotReadyError(action, this.state);
+    }
+  }
   getSessionFile() {
     return this.sessionManager.getSessionFile();
   }
@@ -176469,6 +176784,9 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
   createSubscription(options) {
     const role = options?.role ?? "controller";
     const explicit = options?.explicit ?? true;
+    if (explicit) {
+      this.assertRuntimeReady("new attachments");
+    }
     const announceConnectionInfo = options?.announceConnectionInfo ?? true;
     const reusableControllerConnectionId = !options?.connectionId && role === "controller" && this.controllerConnectionId && this.connections.get(this.controllerConnectionId)?.subscriptionIds.size === 0 ? this.controllerConnectionId : void 0;
     const requestedConnectionId = options?.connectionId ?? reusableControllerConnectionId;
@@ -176588,10 +176906,13 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
     this.syncSubscriptionState(publish && subscriber.explicit);
     return true;
   }
-  assertCanSend(role, subscriptionId, connectionId) {
+  assertCanSend(role, subscriptionId, connectionId, options) {
     if (role === "viewer") {
       throw new Error("Viewer headless connections cannot send messages");
     }
+    if (!options?.allowNotReady) {
+      this.assertRuntimeReady("controller messages");
+    }
     const subscriber = subscriptionId ? this.subscribers.get(subscriptionId) : void 0;
     const connection = subscriber ? this.connections.get(subscriber.connectionId) : this.getConnectionById(connectionId);
     if (!subscriptionId && !connection) {
@@ -176703,6 +177024,7 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
     };
   }
   registerConnection(metadata) {
+    this.assertRuntimeReady("new attachments");
     const role = metadata.role ?? "controller";
     const connection = this.ensureConnection({
       connectionId: metadata.connectionId,
@@ -176748,6 +177070,9 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
     if (this.disposed) {
       throw new Error("Headless runtime is no longer available");
     }
+    if (msg.type !== "shutdown") {
+      this.assertRuntimeReady("controller messages");
+    }
     this.updatedAt = Date.now();
     switch (msg.type) {
       case "hello": {
@@ -177249,9 +177574,16 @@ var HeadlessRuntimeService = class {
     }, 60 * 1e3).unref();
   }
   async ensureRuntime(options) {
+    const shouldRegisterConnection = options.registerConnection !== false && (options.clientProtocolVersion || options.clientInfo || options.capabilities || options.optOutNotifications || options.role);
     if (options.sessionId) {
       const existing = this.getRuntime(options.scope_key, options.sessionId);
       if (existing) {
+        if (shouldRegisterConnection) {
+          const snapshot = existing.getSnapshot();
+          if (!snapshot.state.is_ready) {
+            throw new HeadlessRuntimeNotReadyError("new attachments", snapshot.state);
+          }
+        }
         return existing;
       }
     }
@@ -177278,16 +177610,23 @@ var HeadlessRuntimeService = class {
       context: options.context,
       sessionManager: options.sessionManager
     });
-    if (options.registerConnection !== false && (options.clientProtocolVersion || options.clientInfo || options.capabilities || options.optOutNotifications || options.role)) {
-      runtime.registerConnection({
-        clientProtocolVersion: options.clientProtocolVersion,
-        clientInfo: options.clientInfo,
-        capabilities: options.capabilities,
-        optOutNotifications: options.optOutNotifications,
-        role: options.role
-      });
-    }
     this.runtimes.set(runtime.key(), runtime);
+    if (shouldRegisterConnection) {
+      try {
+        runtime.registerConnection({
+          clientProtocolVersion: options.clientProtocolVersion,
+          clientInfo: options.clientInfo,
+          capabilities: options.capabilities,
+          optOutNotifications: options.optOutNotifications,
+          role: options.role
+        });
+      } catch (error) {
+        if (!(error instanceof HeadlessRuntimeNotReadyError)) {
+          this.runtimes.delete(runtime.key());
+        }
+        throw error;
+      }
+    }
     return runtime;
   }
   getRuntime(scopeKey, sessionId) {
@@ -177379,6 +177718,7 @@ var MAX_IDLE_MS;
 var MAX_RUNTIME_CLEANUP_FAILURES;
 var AMBIENT_ROUTING_SUBJECT = "maestro.ambient_agent.routing.selected";
 var HOSTED_RUNNER_SNAPSHOT_MANIFEST_VERSION2 = "evalops.remote-runner.snapshot-manifest.v1";
+var HeadlessRuntimeNotReadyError;
 var init_headless_runtime_service = __esm2(() => {
   init_prompt_recovery();
   init_runtime_events();
@@ -177408,6 +177748,15 @@ var init_headless_runtime_service = __esm2(() => {
   MAX_CONNECTION_IDLE_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_CONNECTION_IDLE_MS || "", 10) || CONNECTION_HEARTBEAT_INTERVAL_MS * 3;
   MAX_IDLE_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_RUNTIME_IDLE_MS || "", 10) || 30 * 60 * 1e3;
   MAX_RUNTIME_CLEANUP_FAILURES = Number.parseInt(process.env.MAESTRO_HEADLESS_RUNTIME_MAX_CLEANUP_FAILURES || "", 10) || 3;
+  HeadlessRuntimeNotReadyError = class HeadlessRuntimeNotReadyError extends Error {
+    code = "runtime_not_ready";
+    constructor(action, state2) {
+      const status = state2.last_status ? `: ${state2.last_status}` : "";
+      const error = state2.last_error ? ` (${state2.last_error})` : "";
+      super(`Headless runtime is not ready for ${action}${status}${error}`);
+      this.name = "HeadlessRuntimeNotReadyError";
+    }
+  };
 });
 function compose(middlewares) {
   return async (req, res, next) => {
@@ -183638,6 +183987,20 @@ function rethrowHeadlessMessageError(error) {
   if (!(error instanceof Error)) {
     throw error;
   }
+  if (error instanceof HeadlessRuntimeNotReadyError) {
+    throw new ApiError2(
+      503,
+      error.message,
+      [
+        {
+          reason: "runtime_not_ready",
+          domain: HOSTED_RUNNER_ERROR_DOMAIN
+        }
+      ],
+      "runtime_not_ready"
+      /* RuntimeNotReady */
+    );
+  }
   if (error.message === "Viewer headless connections cannot send messages") {
     throw new ApiError2(403, error.message);
   }
@@ -183656,6 +184019,20 @@ function rethrowHeadlessConnectionLifecycleError(error) {
   if (!(error instanceof Error)) {
     throw error;
   }
+  if (error instanceof HeadlessRuntimeNotReadyError) {
+    throw new ApiError2(
+      503,
+      error.message,
+      [
+        {
+          reason: "runtime_not_ready",
+          domain: HOSTED_RUNNER_ERROR_DOMAIN
+        }
+      ],
+      "runtime_not_ready"
+      /* RuntimeNotReady */
+    );
+  }
   if (error.message === "Headless connection not found") {
     throw new ApiError2(404, error.message);
   }
@@ -183832,7 +184209,15 @@ function getRuntime(req, context2, sessionId) {
 }
 async function handleHeadlessSessionCreate(req, res, context2) {
   const input = await parseAndValidateJson(req, HeadlessSessionCreateSchema);
-  const runtime = await ensureRuntime(req, context2, input);
+  let runtime;
+  try {
+    runtime = await ensureRuntime(req, context2, input);
+  } catch (error) {
+    if (error instanceof HeadlessRuntimeNotReadyError) {
+      rethrowHeadlessConnectionLifecycleError(error);
+    }
+    throw error;
+  }
   sendJson(res, 200, runtime.getSnapshot(), context2.corsHeaders, req);
 }
 async function handleHeadlessConnectionCreate(req, res, context2) {
@@ -183873,6 +184258,9 @@ async function handleHeadlessSessionSubscribe(req, res, context2, params) {
       optOutNotifications: input.optOutNotifications
     }), context2.corsHeaders, req);
   } catch (error) {
+    if (error instanceof HeadlessRuntimeNotReadyError) {
+      rethrowHeadlessConnectionLifecycleError(error);
+    }
     if (error instanceof Error && error.message === "Controller lease is already held by another connection") {
       throw new ApiError2(409, error.message);
     }
@@ -183922,11 +184310,16 @@ function handleHeadlessSessionEvents(req, res, context2, params) {
   const cursorParam = url.searchParams.get("cursor");
   const cursor = cursorParam ? Number.parseInt(cursorParam, 10) : null;
   const subscriptionId = url.searchParams.get("subscriptionId") || getHeadlessSubscriberId(req);
-  const stream = subscriptionId ? runtime.attachSubscription(subscriptionId) : runtime.createImplicitStream({
-    cursor,
-    role: getHeadlessRole(req),
-    optOutNotifications: parseOptOutNotifications(req)
-  });
+  let stream;
+  try {
+    stream = subscriptionId ? runtime.attachSubscription(subscriptionId) : runtime.createImplicitStream({
+      cursor,
+      role: getHeadlessRole(req),
+      optOutNotifications: parseOptOutNotifications(req)
+    });
+  } catch (error) {
+    rethrowHeadlessConnectionLifecycleError(error);
+  }
   if (!stream) {
     throw new ApiError2(404, "Headless subscriber not found");
   }
@@ -183980,7 +184373,7 @@ async function handleHeadlessSessionMessage(req, res, context2, params) {
   const runtime = getRuntime(req, context2, params?.id);
   const input = await parseHeadlessMessage(req);
   try {
-    runtime.assertCanSend(getHeadlessRole(req), getHeadlessSubscriberId(req), getHeadlessConnectionId(req));
+    runtime.assertCanSend(getHeadlessRole(req), getHeadlessSubscriberId(req), getHeadlessConnectionId(req), { allowNotReady: input.type === "shutdown" });
   } catch (error) {
     rethrowHeadlessMessageError(error);
   }
@@ -184282,6 +184675,8 @@ async function buildHostedRunnerIdentity(hostedRunner) {
       last_platform_a2a_push: {
         kind: hostedRunner.lastPlatformA2APush.kind,
         task_id: hostedRunner.lastPlatformA2APush.taskId,
+        message_id: hostedRunner.lastPlatformA2APush.messageId,
+        message_ids: hostedRunner.lastPlatformA2APush.messageIds,
         context_id: hostedRunner.lastPlatformA2APush.contextId,
         workspace_id: hostedRunner.lastPlatformA2APush.workspaceId,
         organization_id: hostedRunner.lastPlatformA2APush.organizationId,
@@ -193377,7 +193772,7 @@ var init_web_server = __esm2(() => {
   init_opentelemetry();
   init_system_prompt2();
   init_api_keys();
-  init_auth();
+  init_auth2();
   init_background_task_hooks();
   init_safe_mode();
   init_hosted_runner_drain();
@@ -203017,7 +203412,11 @@ async function main(args) {
   }
   if (parsed.command === "codex") {
     const { handleCodexCommand: handleCodexCommand2 } = await Promise.resolve().then(() => (init_codex(), exports_codex));
-    await handleCodexCommand2(parsed.subcommand, parsed.commandArgs ?? []);
+    const commandArgs = [...parsed.commandArgs ?? []];
+    if (parsed.subcommand === "login" && parsed.force) {
+      commandArgs.push("--force");
+    }
+    await handleCodexCommand2(parsed.subcommand, commandArgs);
     await waitForStartupTelemetryForImmediateExit(startupTelemetry);
     return;
   }