@factiii/runner 0.7.0 → 0.8.0

package/dist/cli.js

@@ -8173,7 +8173,7 @@ function installLatest() {
 // src/supervisor.ts
 var import_node_child_process2 = require("node:child_process");
 
-// ../../shared/all/helpers/board-agent-core/claude.ts
+// ../../shared/all/helpers/board-agent-core/agent.ts
 var import_child_process5 = require("child_process");
 
 // ../../shared/all/helpers/board-agent-core/claude-stream.ts
@@ -8475,6 +8475,145 @@ ${trimmed}` : trimmed;
   };
 }
 
+// ../../shared/all/helpers/board-agent-core/codex-stream.ts
+function truncate2(s, max) {
+  return s.length > max ? s.slice(0, max) + "..." : s;
+}
+var CHANGE_VERBS = {
+  add: "Write",
+  update: "Edit",
+  delete: "Delete"
+};
+function processEvent(e, state, cb) {
+  state.sawValid = true;
+  if (e.type === "thread.started") {
+    if (e.thread_id) state.sessionId = e.thread_id;
+    return;
+  }
+  if (e.type === "turn.failed") {
+    state.failed = true;
+    const message = e.error?.message || "Codex turn failed";
+    state.fullText = message;
+    cb.onLog?.({ type: "error", content: message });
+    return;
+  }
+  if (e.type === "error") {
+    if (e.message) cb.onLog?.({ type: "error", content: e.message });
+    return;
+  }
+  const item = e.item;
+  if (!item?.type) return;
+  if (item.type === "todo_list" && item.items) {
+    const todos = item.items.map((t) => ({
+      content: String(t.text || ""),
+      status: t.completed ? "completed" : "pending"
+    }));
+    cb.onTodos?.(todos);
+    return;
+  }
+  if (e.type === "item.started" && item.type === "command_execution") {
+    if (item.command) {
+      cb.onToolUse?.({
+        id: item.id,
+        name: "Bash",
+        input: { command: item.command }
+      });
+      cb.onLog?.({ type: "tool", content: `$ ${item.command}` });
+    }
+    return;
+  }
+  if (e.type !== "item.completed") return;
+  switch (item.type) {
+    case "agent_message":
+      if (item.text) {
+        state.fullText += state.fullText ? `
+${item.text}` : item.text;
+        cb.onLog?.({ type: "text", content: item.text });
+      }
+      return;
+    case "reasoning":
+      if (item.text) cb.onLog?.({ type: "thinking", content: item.text });
+      return;
+    case "command_execution": {
+      const output = item.aggregated_output || "";
+      const isError = item.status === "failed" || (item.exit_code ?? 0) !== 0;
+      cb.onToolResult?.({ toolUseId: item.id, content: output, isError });
+      if (output) {
+        cb.onLog?.({
+          type: isError ? "tool" : "text",
+          content: isError ? truncate2(`Tool error: ${output}`, 2e3) : truncate2(output, 2e3)
+        });
+      }
+      return;
+    }
+    case "file_change":
+      for (const change of item.changes ?? []) {
+        if (!change.path) continue;
+        const verb = CHANGE_VERBS[change.kind ?? ""] ?? "Edit";
+        cb.onLog?.({ type: "tool", content: `${verb} ${change.path}` });
+      }
+      return;
+    case "web_search":
+      if (item.query) {
+        cb.onLog?.({ type: "tool", content: `WebSearch "${item.query}"` });
+      }
+      return;
+    case "mcp_tool_call":
+      cb.onLog?.({
+        type: "tool",
+        content: `MCP ${[item.server, item.tool].filter(Boolean).join(".")}`
+      });
+      return;
+    case "error":
+      if (item.message) cb.onLog?.({ type: "error", content: item.message });
+      return;
+  }
+}
+function pipeCodexStream(proc, callbacks) {
+  const state = {
+    fullText: "",
+    sessionId: "",
+    failed: false,
+    sawValid: false,
+    junk: ""
+  };
+  let buffer = "";
+  const drain = (flush) => {
+    const lines = buffer.split("\n");
+    buffer = flush ? "" : lines.pop() || "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      if (trimmed[0] !== "{") {
+        state.junk = state.junk ? `${state.junk}
+${trimmed}` : trimmed;
+        continue;
+      }
+      try {
+        processEvent(JSON.parse(trimmed), state, callbacks);
+      } catch (err) {
+        console.error(
+          "[codex-stream] Failed to process line:",
+          err,
+          trimmed.slice(0, 200)
+        );
+      }
+    }
+  };
+  proc.stdout?.on("data", (chunk) => {
+    buffer += chunk.toString();
+    drain(false);
+  });
+  proc.stdout?.on("end", () => {
+    if (buffer.trim()) drain(true);
+  });
+  return {
+    fullText: () => state.fullText || state.junk,
+    sessionId: () => state.sessionId,
+    isError: () => state.failed || Boolean(state.junk) && !state.sawValid
+  };
+}
+
 // ../../shared/all/helpers/board-agent-core/docker.ts
 var import_child_process3 = require("child_process");
 var import_crypto2 = __toESM(require("crypto"));
@@ -8485,6 +8624,35 @@ var import_net = __toESM(require("net"));
 var import_os2 = __toESM(require("os"));
 var import_path3 = __toESM(require("path"));
 var import_util = require("util");
+
+// ../../shared/all/helpers/board-agent-core/providers.ts
+var PROVIDERS = {
+  claude: {
+    label: "Claude Code",
+    bin: "claude",
+    hostStateSubdir: "claude",
+    containerStateDir: "/home/claude/.claude",
+    stateEnvVar: "CLAUDE_CONFIG_DIR",
+    credentialsFile: ".credentials.json"
+  },
+  codex: {
+    label: "Codex",
+    bin: "codex",
+    hostStateSubdir: "codex",
+    containerStateDir: "/home/claude/.codex",
+    stateEnvVar: "CODEX_HOME",
+    credentialsFile: "auth.json"
+  }
+};
+function resolveProvider(value2) {
+  return value2 === "codex" ? "codex" : "claude";
+}
+function containerCredentialsPath(provider) {
+  const info = PROVIDERS[provider];
+  return `${info.containerStateDir}/${info.credentialsFile}`;
+}
+
+// ../../shared/all/helpers/board-agent-core/docker.ts
 var execFileAsync = (0, import_util.promisify)(import_child_process3.execFile);
 function resolveDocker() {
   if (process.env.DOCKER_HOST) return new import_dockerode.default();
@@ -8727,18 +8895,25 @@ async function spawnContainer(containerName, opts) {
     // Persistent agent filesystem for backups (DB dumps etc), surviving the
     // container. Lives next to the host's config JSONs; not configurable.
     ...opts?.backupsHostDir ? ["-v", `${opts.backupsHostDir}:/home/claude/backups`] : [],
-    // The space's claude state (credentials.json etc) lives on the HOST and
-    // is bind-mounted over its usual cache-volume path, so the one-click
+    // Each provider's state (credentials etc) lives on the HOST and is
+    // bind-mounted over its usual cache-volume path, so the one-click
     // sign-in serves container sessions AND host deploy sessions from the
     // same file (copies would diverge on OAuth refresh-token rotation).
-    ...opts?.claudeHostDir ? ["-v", `${opts.claudeHostDir}:${claudeStateDir(opts.spaceSlug)}`] : [],
+    ...Object.entries(opts?.providerHostDirs ?? {}).flatMap(
+      ([provider, hostDir]) => [
+        "-v",
+        `${hostDir}:${providerStateDir(provider, opts.spaceSlug)}`
+      ]
+    ),
     "-e",
     "HOME=/home/claude",
-    // Redirect the otherwise-`~/.claude.json` config file into the .claude
-    // dir, which is symlinked to this space's dir on the cache volume. Keeps
-    // all claude state inside one path the CLI already understands.
+    // Redirect each CLI's config into its ~ state dir, which is symlinked to
+    // this space's dir on the cache volume (see setupContainerCache). Keeps
+    // all agent state inside one path per provider the CLIs already understand.
     "-e",
-    "CLAUDE_CONFIG_DIR=/home/claude/.claude",
+    `CLAUDE_CONFIG_DIR=${PROVIDERS.claude.containerStateDir}`,
+    "-e",
+    `CODEX_HOME=${PROVIDERS.codex.containerStateDir}`,
     "-e",
     "NODE_OPTIONS=--max-old-space-size=4096",
     "-e",
@@ -8765,10 +8940,10 @@ async function spawnContainer(containerName, opts) {
     "-f",
     "/dev/null"
   ]);
-  await setupContainerCache(containerName, claudeStateDir(opts.spaceSlug));
+  await setupContainerCache(containerName, opts.spaceSlug);
 }
-function claudeStateDir(spaceSlug) {
-  return `/cache/claude/${spaceSlug.replace(/[^a-zA-Z0-9._-]/g, "_")}`;
+function providerStateDir(provider, spaceSlug) {
+  return `/cache/${provider}/${spaceSlug.replace(/[^a-zA-Z0-9._-]/g, "_")}`;
 }
 async function execInContainer(containerName, cmd) {
   const { stdout } = await execFileAsync(
@@ -8844,15 +9019,20 @@ async function execInContainerAsRoot(containerName, cmd) {
   );
   return stdout;
 }
-async function setupContainerCache(containerName, claudeDir) {
-  await execInContainer(
-    containerName,
-    `mkdir -p /cache/repos ${claudeDir} /cache/pnpm-store /cache/pnpm-vstore /cache/pip-cache /cache/npm-cache /cache/apt /cache/xdg-cache`
+async function setupContainerCache(containerName, spaceSlug) {
+  const stateDirs = Object.keys(PROVIDERS).map(
+    (p) => providerStateDir(p, spaceSlug)
   );
   await execInContainer(
     containerName,
-    `ln -sfn ${claudeDir} /home/claude/.claude`
+    `mkdir -p /cache/repos ${stateDirs.join(" ")} /cache/pnpm-store /cache/pnpm-vstore /cache/pip-cache /cache/npm-cache /cache/apt /cache/xdg-cache`
   );
+  for (const [provider, info] of Object.entries(PROVIDERS)) {
+    await execInContainer(
+      containerName,
+      `ln -sfn ${providerStateDir(provider, spaceSlug)} ${info.containerStateDir}`
+    );
+  }
   await execInContainer(
     containerName,
     "printf 'set -g mouse on\\nset -g history-limit 50000\\nset -g set-clipboard on\\nset -ga terminal-features ,*:clipboard\\nbind -T copy-mode MouseDragEnd1Pane send -X copy-selection-and-cancel\\nbind -T copy-mode-vi MouseDragEnd1Pane send -X copy-selection-and-cancel\\n' > /home/claude/.tmux.conf"
@@ -8955,7 +9135,7 @@ var prompts_default = {
     "After Review, the developer may request an optional **Preview** where you set up a live dev environment on demand.",
     "",
     "## Task Tracking",
-    "Use the TodoWrite tool to track your progress. Create todos at the start of each phase with your planned steps,",
+    "Use your todo/plan tool to track your progress. Create todos at the start of each phase with your planned steps,",
     "and update their status as you complete them. This is visible to the user in real time \u2014 it's how they know what you're doing.",
     "",
     "## openui-lang",
@@ -8986,7 +9166,7 @@ var prompts_default = {
     "## Environment",
     "- Working directory: /home/claude/workspace",
     "- Full clone with complete git history available.",
-    "- Persistent memory at ~/.claude that survives across sessions.",
+    "- Persistent agent memory in your state dir (~/.claude or ~/.codex) that survives across sessions.",
     "- Package caches are shared: pnpm store, npm cache, pip cache are pre-warmed from previous runs."
   ],
   research: [
@@ -9031,17 +9211,17 @@ var prompts_default = {
     "You have sudo access (sudo apk add, sudo service, etc.).",
     "",
     "## Cache & Memory",
-    "Your ~/.claude directory persists across sessions. If you've set up this project before,",
+    "Your agent state directory (~/.claude or ~/.codex) persists across sessions. If you've set up this project before,",
     "check your memory for the setup steps \u2014 you can skip re-discovering them.",
     "Package manager caches (pnpm, npm, pip) are shared across containers, so installs will be faster.",
-    "After successfully setting up the preview, save the setup steps to your Claude memory.",
+    "After successfully setting up the preview, save the setup steps to your agent memory.",
     "",
     "## Rules",
     "- Always set up the FULL stack (frontend, backend, database, etc.) even if the task only touched one layer.",
     "- Never skip any setup process (seeding, migrations, installs, service setup, etc.).",
     "",
     "## Steps",
-    "1. Check your Claude memory for previous setup steps for this project",
+    "1. Check your agent memory for previous setup steps for this project",
     "2. If no memory: read the project README, package.json, docker-compose.yml, or any setup docs",
     "3. Install any system-level services needed (e.g. sudo apk add postgresql, redis, etc.)",
     "4. Start those services (e.g. sudo pg_ctl start, redis-server --daemonize yes, etc.)",
@@ -9050,7 +9230,7 @@ var prompts_default = {
     "7. Build and serve the app \u2014 for web frameworks (React, Next.js, Vite, etc.) ALWAYS run `build` then `start` (e.g. `pnpm build && pnpm start`). Only fall back to a dev server if the build fails.",
     "8. Run the server in the background: nohup <start-command> > /tmp/dev-server.log 2>&1 &",
     "9. Wait a few seconds, then verify the server is running (curl -s http://localhost:<port> or check the log)",
-    "10. Save the working setup steps to your Claude memory for next time",
+    "10. Save the working setup steps to your agent memory for next time",
     "",
     "## Ports (CRITICAL)",
     "You are inside a Docker container. Only these ports are published to the host (1:1 mapping \u2014 internal port X is exposed as host port X):",
@@ -9164,12 +9344,12 @@ var prompts_default = {
     "Reference paths ONLY via these variables or relative to the working directory. NEVER hardcode absolute machine paths (like /Users/...) anywhere in the skill - it must run unchanged on any runner. Secrets live in an encrypted store you never touch: their values reach commands only via runner-side injection of the keys declared in required-variables.json.",
     "",
     "## Produce exactly three files",
-    "1. .claude/skills/deploy/SKILL.md - the runbook, written for a competent operator: named steps in ship order, the exact commands, what success looks like per step, and explicit stop-and-ask points wherever human judgment or confirmation belongs (e.g. 'confirm before the production cutover'). Plain language; no secret values or key material anywhere in the file - reference secrets ONLY as $KEY env names.",
-    `2. .claude/skills/deploy/required-variables.json - a JSON array covering EVERY env key the skill's commands will need throughout, inferred from the description and the repo: [{ "key": string (exact env name), "title": string (short human label), "description": string (one plain sentence: what it is, where the owner finds it), "category": string (what the key serves, grouped how it makes sense for THIS repo - e.g. "server", "client", "database", "deploy access"; pick the categories yourself and reuse them across related keys), "sensitive": boolean }]. Never declare a key the skill doesn't use, never use a key you don't declare.`,
-    "3. .claude/skills/deploy/check-environment.sh - a plain bash script that verifies THIS machine can run the whole flow: every binary the skill invokes (with version checks where a minimum matters), daemons that must be up (e.g. the docker engine), platform toolchains (e.g. Xcode selected via xcode-select when iOS builds are in the flow), auth states checkable WITHOUT secrets (e.g. `gh auth status`), and free disk space if builds are heavy. STRICTLY read-only, no secret values needed or touched, finishes in under ~30 seconds. Output protocol, one line per check: `OK: <label>` or `FAIL: <label> - <how to fix it>`; exit 0 only when everything passed. Reference paths only via the environment variables.",
+    "1. .agents/skills/deploy/SKILL.md - the runbook, written for a competent operator. It MUST start with YAML frontmatter (--- name: deploy / description: one line saying this is the repository's release runbook and when to run it ---) so agent CLIs discover it as a skill, followed by: named steps in ship order, the exact commands, what success looks like per step, and explicit stop-and-ask points wherever human judgment or confirmation belongs (e.g. 'confirm before the production cutover'). Plain language; no secret values or key material anywhere in the file - reference secrets ONLY as $KEY env names.",
+    `2. .agents/skills/deploy/required-variables.json - a JSON array covering EVERY env key the skill's commands will need throughout, inferred from the description and the repo: [{ "key": string (exact env name), "title": string (short human label), "description": string (one plain sentence: what it is, where the owner finds it), "category": string (what the key serves, grouped how it makes sense for THIS repo - e.g. "server", "client", "database", "deploy access"; pick the categories yourself and reuse them across related keys), "sensitive": boolean }]. Never declare a key the skill doesn't use, never use a key you don't declare.`,
+    "3. .agents/skills/deploy/check-environment.sh - a plain bash script that verifies THIS machine can run the whole flow: every binary the skill invokes (with version checks where a minimum matters), daemons that must be up (e.g. the docker engine), platform toolchains (e.g. Xcode selected via xcode-select when iOS builds are in the flow), auth states checkable WITHOUT secrets (e.g. `gh auth status`), and free disk space if builds are heavy. STRICTLY read-only, no secret values needed or touched, finishes in under ~30 seconds. Output protocol, one line per check: `OK: <label>` or `FAIL: <label> - <how to fix it>`; exit 0 only when everything passed. Reference paths only via the environment variables.",
     "",
     "## Absolute rules",
-    "- Write ONLY those three files under .claude/skills/deploy/.",
+    "- Write ONLY those three files under .agents/skills/deploy/.",
     "- Do NOT git commit or git push; the harness pushes for review.",
     "- Cloud CLIs on this machine (aws, vercel, wrangler, gh...) may already be signed in. You may use them READ-ONLY to verify what exists (project names, repo names, regions) so the skill is accurate - but NEVER create, modify, deploy, or delete anything, and never echo a credential or token value.",
     "- The harness injects required variables per-command at execution time (the owner authorizes each secret-bearing command individually). Write the skill accordingly: commands simply reference the variables; NEVER include steps that check whether variables are set in the environment, and never instruct anyone to export them or put them in a .env/shell/CI config.",
@@ -9180,7 +9360,7 @@ var prompts_default = {
     "",
     "{{FEEDBACK}}",
     "",
-    "Apply them by editing .claude/skills/deploy/SKILL.md, .claude/skills/deploy/required-variables.json, and/or .claude/skills/deploy/check-environment.sh in your working directory - the same contract as before: only those three files, keys declared exactly when used, no secret values anywhere, no git commit/push, and paths referenced ONLY via $WORKSPACE / $BACKUPS_DIR / $BUILDS_DIR or relative to the working directory (never absolute machine paths). Keep everything the owner did NOT ask to change untouched."
+    "Apply them by editing .agents/skills/deploy/SKILL.md, .agents/skills/deploy/required-variables.json, and/or .agents/skills/deploy/check-environment.sh in your working directory - the same contract as before: only those three files, keys declared exactly when used, no secret values anywhere, no git commit/push, and paths referenced ONLY via $WORKSPACE / $BACKUPS_DIR / $BUILDS_DIR or relative to the working directory (never absolute machine paths). Keep everything the owner did NOT ask to change untouched."
   ],
   deployRun: [
     "## Deploy run protocol",
@@ -9193,7 +9373,7 @@ var prompts_default = {
     "- If the skill has a step that verifies variables are set, SKIP it - it predates this protocol.",
     '- To run a command that needs any declared variable, print as the LAST line of your message exactly: NEED_SECRETS: <the complete command>  - then END your turn. Write the variables unexpanded in that command (e.g. "$DATABASE_URL"). The owner inspects and authorizes it with their password; the runner executes it with every declared variable injected, and your next message contains its redacted output. One command per request.',
     "",
-    "- Track the release with TodoWrite: one todo per step in ship order, updated as you go. This is the owner's live timeline.",
+    "- Track the release with your todo/plan tool: one todo per step in ship order, updated as you go. This is the owner's live timeline.",
     "- HUMAN GATES: wherever the skill says to stop and ask (and before anything irreversible the skill flags), print as the LAST line: AWAITING_INPUT: <the question>  - then END your turn. The owner's answer arrives as your next message.",
     "- Background execution is fine for parallelism (start a long build, work on other steps meanwhile) - but background tasks only live as long as your turn. Ending your turn KILLS them, and no completion notification can ever reach you. Before ending ANY turn, wait for or reap every background task you started (check its output in-turn). Never end a turn to 'wait for' a task.",
     "- Environment problems (missing tool, PATH) may be fixed and retried; a step's intent must never change. Never print or echo secret values - if output contains one, do not repeat it.",
@@ -9219,23 +9399,23 @@ var prompts_default = {
   ]
 };
 
-// ../../shared/all/helpers/board-agent-core/claude.ts
-async function assertClaudeSignedIn(containerName) {
+// ../../shared/all/helpers/board-agent-core/agent.ts
+async function assertAgentSignedIn(provider, containerName) {
+  const info = PROVIDERS[provider];
   try {
     await execInContainer(
       containerName,
-      "test -f /home/claude/.claude/.credentials.json"
+      `test -f ${containerCredentialsPath(provider)}`
     );
   } catch {
     throw new Error(
-      'Not signed in to Claude. Use "Sign in with Claude" in Board AI settings, then retry.'
+      `Not signed in to ${info.label}. Use "Sign in with ${info.label}" in Board AI settings, then retry.`
     );
   }
 }
-function runClaudeProc(proc, prompt2, callbacks, errorPrefix) {
+function runAgentProc(proc, prompt2, stream, label, errorPrefix) {
   return new Promise((resolve, reject) => {
     let errorOutput = "";
-    const stream = pipeClaudeStream(proc, callbacks);
     proc.stderr?.on("data", (chunk) => {
       errorOutput += chunk.toString();
     });
@@ -9244,10 +9424,10 @@ function runClaudeProc(proc, prompt2, callbacks, errorPrefix) {
       const sessionId = stream.sessionId();
       if (stream.isError()) {
         reject(
-          new Error(text || errorOutput || `Claude exited with code ${code}`)
+          new Error(text || errorOutput || `${label} exited with code ${code}`)
         );
       } else if (code !== 0 && !text) {
-        reject(new Error(errorOutput || `Claude exited with code ${code}`));
+        reject(new Error(errorOutput || `${label} exited with code ${code}`));
       } else {
         resolve({ text, sessionId });
       }
@@ -9255,10 +9435,26 @@ function runClaudeProc(proc, prompt2, callbacks, errorPrefix) {
     proc.on("error", (err) => {
       reject(new Error(`${errorPrefix}: ${err.message}`));
     });
+    proc.stdin?.on("error", () => {
+    });
     proc.stdin?.write(prompt2);
     proc.stdin?.end();
   });
 }
+function dockerExecArgs(containerName, env) {
+  return [
+    "exec",
+    "-i",
+    "--user",
+    "claude",
+    "-w",
+    "/home/claude/workspace",
+    "-e",
+    "HOME=/home/claude",
+    ...Object.entries(env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]),
+    containerName
+  ];
+}
 function claudeArgs(opts) {
   const args = [
     "-p",
@@ -9280,69 +9476,71 @@ function claudeArgs(opts) {
   if (opts.resumeSessionId) args.push("--resume", opts.resumeSessionId);
   return args;
 }
-async function spawnClaudeHost(opts) {
-  const proc = (0, import_child_process5.spawn)("claude", claudeArgs(opts), {
-    cwd: opts.cwd,
-    env: { ...await hostEnv(), ...opts.env }
-  });
+var CODEX_EFFORT = {
+  low: "low",
+  medium: "medium",
+  high: "high",
+  max: "high"
+};
+function codexArgs(opts, host) {
+  const args = ["exec"];
+  if (opts.resumeSessionId) args.push("resume", opts.resumeSessionId);
+  args.push("--json", "--skip-git-repo-check");
+  if (host) {
+    if (opts.permissionMode === "plan") {
+      args.push("--sandbox", "read-only");
+    } else if (opts.permissionMode === "auto") {
+      args.push("--sandbox", "workspace-write");
+    } else {
+      args.push("--dangerously-bypass-approvals-and-sandbox");
+    }
+  } else {
+    args.push("--dangerously-bypass-approvals-and-sandbox");
+  }
+  const effort = opts.effort ? CODEX_EFFORT[opts.effort] : void 0;
+  if (effort) args.push("-c", `model_reasoning_effort="${effort}"`);
+  args.push("-");
+  return args;
+}
+function codexPrompt(opts) {
+  return opts.appendSystemPrompt ? `${opts.appendSystemPrompt}
+
+---
+
+${opts.prompt}` : opts.prompt;
+}
+function spawnAgent(provider, opts) {
+  const base = dockerExecArgs(opts.containerName, opts.env);
+  const info = PROVIDERS[provider];
+  const proc = provider === "codex" ? (0, import_child_process5.spawn)("docker", [...base, info.bin, ...codexArgs(opts, false)]) : (0, import_child_process5.spawn)("docker", [...base, info.bin, ...claudeArgs(opts)]);
+  const stream = provider === "codex" ? pipeCodexStream(proc, opts.callbacks) : pipeClaudeStream(proc, opts.callbacks);
   return {
     proc,
-    result: runClaudeProc(
+    result: runAgentProc(
       proc,
-      opts.prompt,
-      opts.callbacks,
-      "Failed to run Claude on the host (is the claude CLI installed?)"
+      provider === "codex" ? codexPrompt(opts) : opts.prompt,
+      stream,
+      info.label,
+      `Failed to run ${info.label} in container`
     )
   };
 }
-function spawnClaude(opts) {
-  const args = [
-    "exec",
-    "-i",
-    "--user",
-    "claude",
-    "-w",
-    "/home/claude/workspace",
-    "-e",
-    "HOME=/home/claude",
-    ...Object.entries(opts.env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]),
-    opts.containerName,
-    "claude",
-    "-p",
-    "--output-format",
-    "stream-json",
-    "--verbose",
-    "--allowedTools",
-    opts.allowedTools,
-    "--permission-mode",
-    opts.permissionMode || "bypassPermissions"
-  ];
-  if (opts.disallowedTools) {
-    args.push("--disallowedTools", opts.disallowedTools);
-  }
-  if (opts.appendSystemPrompt) {
-    args.push("--append-system-prompt", opts.appendSystemPrompt);
-  }
-  if (opts.model) {
-    args.push("--model", opts.model);
-  }
-  if (opts.includePartialMessages) {
-    args.push("--include-partial-messages");
-  }
-  if (opts.effort) {
-    args.push("--effort", opts.effort);
-  }
-  if (opts.resumeSessionId) {
-    args.push("--resume", opts.resumeSessionId);
-  }
-  const proc = (0, import_child_process5.spawn)("docker", args);
+async function spawnAgentHost(provider, opts) {
+  const info = PROVIDERS[provider];
+  const proc = (0, import_child_process5.spawn)(
+    info.bin,
+    provider === "codex" ? codexArgs(opts, true) : claudeArgs(opts),
+    { cwd: opts.cwd, env: { ...await hostEnv(), ...opts.env } }
+  );
+  const stream = provider === "codex" ? pipeCodexStream(proc, opts.callbacks) : pipeClaudeStream(proc, opts.callbacks);
   return {
     proc,
-    result: runClaudeProc(
+    result: runAgentProc(
       proc,
-      opts.prompt,
-      opts.callbacks,
-      "Failed to run Claude in container"
+      provider === "codex" ? codexPrompt(opts) : opts.prompt,
+      stream,
+      info.label,
+      `Failed to run ${info.label} on the host (is the ${info.bin} CLI installed?)`
     )
   };
 }
@@ -9350,37 +9548,23 @@ function sanitizeBranchName(raw) {
   const cleaned = raw.trim().split("\n")[0].toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9/_.-]/g, "").replace(/-{2,}/g, "-").replace(/\.{2,}/g, ".").replace(/(^|\/)\./g, "$1").replace(/\.lock(\/|$)/g, "$1").replace(/^[-/.]+|[-/.]+$/g, "").slice(0, 60);
   return cleaned || "board-ai-changes";
 }
-function claudeOneShot(containerName, prompt2, fallback, finish) {
-  return new Promise((resolve) => {
-    const proc = (0, import_child_process5.spawn)("docker", [
-      "exec",
-      "-i",
-      "--user",
-      "claude",
-      "-w",
-      "/home/claude/workspace",
-      "-e",
-      "HOME=/home/claude",
+async function agentOneShot(provider, containerName, prompt2, fallback, finish) {
+  try {
+    const { result } = spawnAgent(provider, {
       containerName,
-      "claude",
-      "-p",
-      "--output-format",
-      "text"
-    ]);
-    let output = "";
-    proc.stdout?.on("data", (chunk) => {
-      output += chunk.toString();
-    });
-    proc.on("close", () => resolve(finish(output) || fallback));
-    proc.on("error", () => resolve(fallback));
-    proc.stdin?.on("error", () => {
+      prompt: prompt2,
+      allowedTools: "",
+      callbacks: {}
     });
-    proc.stdin?.write(prompt2);
-    proc.stdin?.end();
-  });
+    const { text } = await result;
+    return finish(text) || fallback;
+  } catch {
+    return fallback;
+  }
 }
-function generateBranchName(containerName, diff, taskTitle) {
-  return claudeOneShot(
+function generateBranchName(provider, containerName, diff, taskTitle) {
+  return agentOneShot(
+    provider,
     containerName,
     `${prompts_default.branchName}
 
@@ -9391,8 +9575,9 @@ ${diff.slice(0, 8e3)}`,
     sanitizeBranchName
   );
 }
-function generateCommitMessage(containerName, diff) {
-  return claudeOneShot(
+function generateCommitMessage(provider, containerName, diff) {
+  return agentOneShot(
+    provider,
     containerName,
     `${prompts_default.commitMessage}
 
@@ -9862,9 +10047,9 @@ var ContainerCore = class {
     this.containerName = null;
     this.lastConfigKey = "";
     this.setupPromise = null;
-    // Positive-only cache: true sticks until sign-out, false is re-probed
-    // (an in-terminal `claude /login` can flip it).
-    this.claudeLoggedIn = false;
+    // Positive-only cache per provider: true sticks until sign-out, false is
+    // re-probed (an in-terminal login can flip it).
+    this.loggedIn = {};
     this.spaceSlug = options.spaceSlug;
     this.spaceId = options.spaceId ?? null;
     this.emitter = options.emitter;
@@ -9873,8 +10058,8 @@ var ContainerCore = class {
     this.runnerToken = options.runnerToken;
     this.instancePrefix = computeInstancePrefix(options.instanceId);
   }
-  setClaudeLoggedIn(value2) {
-    this.claudeLoggedIn = value2;
+  setLoggedIn(provider, value2) {
+    this.loggedIn[provider] = value2;
   }
   /** The space segment used in container names: the stable id when we have it,
    *  else the slug (legacy / id-less callers). */
@@ -9925,24 +10110,37 @@ var ContainerCore = class {
     }
   }
   // ── Config ──
-  async getConfig() {
-    const config = this.configProvider.readConfig(this.spaceSlug);
-    if (!this.claudeLoggedIn && this.containerName) {
+  /** The CLI agent this space runs (per-space config, default claude). */
+  agentProvider() {
+    return resolveProvider(
+      this.configProvider.readConfig(this.spaceSlug).provider
+    );
+  }
+  /** The space's persisted creds for one provider, probed through the running
+   *  container's ~ symlink; false until the env is initialized. */
+  async probeLoggedIn(provider) {
+    if (!this.loggedIn[provider] && this.containerName) {
       try {
         await execInContainer(
           this.containerName,
-          "test -f /home/claude/.claude/.credentials.json"
+          `test -f ${containerCredentialsPath(provider)}`
         );
-        this.claudeLoggedIn = true;
+        this.loggedIn[provider] = true;
       } catch {
       }
     }
+    return this.loggedIn[provider] ?? false;
+  }
+  async getConfig() {
+    const config = this.configProvider.readConfig(this.spaceSlug);
     return {
       repoUrl: config.repoUrl,
       mainBranch: config.mainBranch,
       gitName: config.gitName,
       gitEmail: config.gitEmail,
-      claudeLoggedIn: this.claudeLoggedIn,
+      provider: resolveProvider(config.provider),
+      claudeLoggedIn: await this.probeLoggedIn("claude"),
+      codexLoggedIn: await this.probeLoggedIn("codex"),
       hasGithubToken: Boolean(config.githubToken),
       githubTokenHint: config.githubToken ? `\xB7\xB7\xB7\xB7${config.githubToken.slice(-4)}` : "",
       storageBackend: config.storageBackend ?? "github",
@@ -9959,7 +10157,8 @@ var ContainerCore = class {
       gitName: partial.gitName ?? existing.gitName,
       gitEmail: partial.gitEmail ?? existing.gitEmail,
       githubToken: partial.githubToken?.replace(/\s/g, "") || existing.githubToken,
-      storageBackend: partial.storageBackend ?? existing.storageBackend
+      storageBackend: partial.storageBackend ?? existing.storageBackend,
+      provider: partial.provider ?? existing.provider
     };
     this.configProvider.writeConfig(this.spaceSlug, updated);
     return { success: true };
@@ -9970,11 +10169,19 @@ var ContainerCore = class {
   backupsDir() {
     return `${this.spaceDir()}/backups`;
   }
-  /** Host home of the space's claude state; bind-mounted into the container
-   *  and used as CLAUDE_CONFIG_DIR by host deploy sessions. One login, both
-   *  worlds. */
-  claudeDir() {
-    return `${this.spaceDir()}/claude`;
+  /** Host home of one provider's state; bind-mounted into the container and
+   *  used as the CLI's state env var by host deploy sessions. One login,
+   *  both worlds. */
+  providerDir(provider) {
+    return `${this.spaceDir()}/${PROVIDERS[provider].hostStateSubdir}`;
+  }
+  /** Every provider's host state dir, for container mounts - both CLIs are
+   *  usable in-terminal regardless of the configured pipeline provider. */
+  providerHostDirs() {
+    return {
+      claude: this.providerDir("claude"),
+      codex: this.providerDir("codex")
+    };
   }
   clearToken(key) {
     const existing = this.configProvider.readConfig(this.spaceSlug);
@@ -10034,7 +10241,7 @@ var ContainerCore = class {
           spawnContainer(name, {
             spaceSlug: this.spaceSlug,
             backupsHostDir: this.backupsDir(),
-            claudeHostDir: this.claudeDir()
+            providerHostDirs: this.providerHostDirs()
           }),
           9e4,
           "Starting container"
@@ -14214,7 +14421,8 @@ function toSummary(session) {
     startedAt: session.startedAt,
     targetBranch: session.targetBranch,
     taskTitle: session.taskTitle,
-    todos: session.todos
+    todos: session.todos,
+    agentSessionId: session.agentSessionId
   };
 }
 function createEventSink(send, spaceSlug, notify) {
@@ -14257,7 +14465,8 @@ function createEventSink(send, spaceSlug, notify) {
         startedAt: 0,
         targetBranch: "",
         taskTitle: "",
-        todos: []
+        todos: [],
+        agentSessionId: ""
       });
     },
     emitLog(session, entry) {
@@ -14296,6 +14505,12 @@ function createEventSink(send, spaceSlug, notify) {
     emitClaudeAuth(payload) {
       send(channel("claude-auth"), payload);
     },
+    emitCodexAuth(payload) {
+      send(channel("codex-auth"), payload);
+    },
+    emitGithubAuth(payload) {
+      send(channel("github-auth"), payload);
+    },
     emitDeployCreator(payload) {
       send(channel("deploy-creator"), payload);
     },
@@ -14474,8 +14689,9 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
       );
     }
     const containerName = this.core.containerName;
+    const provider = this.core.agentProvider();
     await execInContainer(containerName, "mkdir -p /home/claude/workspace");
-    await assertClaudeSignedIn(containerName);
+    await assertAgentSignedIn(provider, containerName);
     this.board.messages.push({ role: "user", content: params.question });
     let prompt2;
     if (this.board.sessionId) {
@@ -14486,7 +14702,7 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
       prompt2 = parts2.join("\n");
     }
     const systemPrompt = [params.componentSchema, buildPrompt(prompts_default.boardAI)].filter(Boolean).join("\n\n");
-    const { proc, result } = spawnClaude({
+    const { proc, result } = spawnAgent(provider, {
       containerName,
       prompt: prompt2,
       allowedTools: "Read,Grep,Glob,Agent",
@@ -14521,14 +14737,15 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     }
     this.board = { sessionId: null, process: null, messages: [] };
   }
-  // ── Claude runner ──
+  // ── Pipeline runner ──
   /** Strip git mentions from an agent prompt on OneDrive spaces; pass-through otherwise. */
   agentPrompt(text) {
     return this.core.isOneDrive(this.core.readConfig()) ? gitFree(text) : text;
   }
-  async runClaudeInContainer(session, prompt2, tools, resumeSessionId, options) {
-    await assertClaudeSignedIn(session.containerName);
-    const { proc, result } = spawnClaude({
+  async runAgentInContainer(session, prompt2, tools, resumeSessionId, options) {
+    const provider = this.core.agentProvider();
+    await assertAgentSignedIn(provider, session.containerName);
+    const { proc, result } = spawnAgent(provider, {
       containerName: session.containerName,
       prompt: prompt2,
       allowedTools: tools,
@@ -14565,14 +14782,14 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
   // ── Research with Q&A ──
   async runResearch(session, prompt2, resumeSessionId) {
     if (!this.sessions.has(session.postId)) return;
-    const { text, sessionId } = await this.runClaudeInContainer(
+    const { text, sessionId } = await this.runAgentInContainer(
       session,
       prompt2,
       "Read,Grep,Glob,Agent,TodoWrite",
       resumeSessionId,
       { permissionMode: "plan", disallowedTools: "AskUserQuestion" }
     );
-    session.claudeSessionId = sessionId;
+    session.agentSessionId = sessionId;
     if (!this.sessions.has(session.postId)) return;
     const markerIdx = text.lastIndexOf(_ClaudeModeEngine.QUESTION_MARKER);
     if (markerIdx === -1) return;
@@ -14582,7 +14799,7 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     this.emitter.addLog(
       session,
       "system",
-      "Claude has a question - waiting for your input."
+      "The agent has a question - waiting for your input."
     );
     const answer = await new Promise((resolve) => {
       session.answerResolver = resolve;
@@ -14598,8 +14815,8 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
   // ── Pipeline ──
   /**
    * Fresh session container + sign-in gate (card + merge pipelines). The
-   * claude host-dir bind is required: one-click sign-in writes credentials
-   * there, not to the cache volume.
+   * provider host-dir binds are required: one-click sign-in writes
+   * credentials there, not to the cache volume.
    */
   async startSessionContainer(session, fuse) {
     this.emitter.addLog(session, "system", "Starting container...");
@@ -14607,9 +14824,9 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     await spawnContainer(session.containerName, {
       spaceSlug: this.core.spaceSlug,
       fuse,
-      claudeHostDir: this.core.claudeDir()
+      providerHostDirs: this.core.providerHostDirs()
     });
-    await assertClaudeSignedIn(session.containerName);
+    await assertAgentSignedIn(this.core.agentProvider(), session.containerName);
   }
   /** Clone (cache-aware) + git identity, shared by the card and merge pipelines. */
   async cloneWorkspace(session, config, baseBranch) {
@@ -14683,25 +14900,25 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     session.step = 2;
     this.emitter.emitSessionUpdate(session);
     this.emitter.addLog(session, "system", `${logPrefix} 2: Implement \u2500\u2500`);
-    const implResult = await this.runClaudeInContainer(
+    const implResult = await this.runAgentInContainer(
       session,
       implementPrompt,
       tools,
-      session.claudeSessionId
+      session.agentSessionId
     );
-    session.claudeSessionId = implResult.sessionId || session.claudeSessionId;
+    session.agentSessionId = implResult.sessionId || session.agentSessionId;
     if (!this.sessions.has(session.postId)) return;
     session.phase = "review";
     session.step = 3;
     this.emitter.emitSessionUpdate(session);
     this.emitter.addLog(session, "system", `${logPrefix} 3: Review \u2500\u2500`);
-    const reviewResult = await this.runClaudeInContainer(
+    const reviewResult = await this.runAgentInContainer(
       session,
       this.agentPrompt(buildPrompt(prompts_default.review)),
       tools,
-      session.claudeSessionId
+      session.agentSessionId
     );
-    session.claudeSessionId = reviewResult.sessionId || session.claudeSessionId;
+    session.agentSessionId = reviewResult.sessionId || session.agentSessionId;
     if (!this.sessions.has(session.postId)) return;
     session.reproSteps = reviewResult.text.trim();
     await this.extractAndComplete(session);
@@ -14722,16 +14939,16 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
         runnerToken: this.core.runnerToken
       });
     }
-    const previewResult = await this.runClaudeInContainer(
+    const previewResult = await this.runAgentInContainer(
       session,
       buildPrompt(prompts_default.preview, {
         ports: portsEnv,
         publicPreviewBlock: publicPreviewEnabled ? prompts_default.previewPublic.join("\n") : ""
       }),
       tools,
-      session.claudeSessionId
+      session.agentSessionId
     );
-    session.claudeSessionId = previewResult.sessionId || session.claudeSessionId;
+    session.agentSessionId = previewResult.sessionId || session.agentSessionId;
     if (!this.sessions.has(session.postId)) return;
     const portMatch = previewResult.text.match(/PREVIEW_PORT:\s*(\d+)/);
     const previewPort = portMatch ? portMatch[1] : "3000";
@@ -14786,12 +15003,15 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
         `${changedFiles.length} file${changedFiles.length !== 1 ? "s" : ""} changed.`
       );
       this.emitter.addLog(session, "system", "Generating commit message...");
+      const provider = this.core.agentProvider();
       session.commitMessage = await generateCommitMessage(
+        provider,
         session.containerName,
         diff
       );
       if (!session.targetBranch) {
         session.targetBranch = await generateBranchName(
+          provider,
           session.containerName,
           diff,
           session.taskTitle
@@ -14812,7 +15032,7 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
   start(base, args) {
     const session = {
       ...base,
-      claudeSessionId: "",
+      agentSessionId: "",
       answerResolver: null,
       proc: null
     };
@@ -14840,7 +15060,7 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
   startMerge(base, args) {
     const session = {
       ...base,
-      claudeSessionId: "",
+      agentSessionId: "",
       answerResolver: null,
       proc: null
     };
@@ -14899,8 +15119,8 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     if (!session) throw new Error("No active session for this card.");
     if (session.phase !== "complete")
       throw new Error("Preview is only available once changes are ready.");
-    if (!session.claudeSessionId)
-      throw new Error("No Claude session to resume for preview.");
+    if (!session.agentSessionId)
+      throw new Error("No agent session to resume for preview.");
     if (session.previewRunning || session.proc)
       return { previewUrl: session.previewUrl };
     try {
@@ -14912,9 +15132,9 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     return { previewUrl: session.previewUrl };
   }
   /**
-   * Push-failure recovery: let Claude repair the workspace (fetch + rebase,
-   * conflict resolution, leftover markers) so the engine can retry the
-   * commit + push. Ends with all changes uncommitted in the working tree.
+   * Push-failure recovery: let the agent repair the workspace (fetch +
+   * rebase, conflict resolution, leftover markers) so the engine can retry
+   * the commit + push. Ends with all changes uncommitted in the working tree.
    */
   async resolvePushIssue(postId, branchName, errorMessage) {
     const session = this.sessions.get(String(postId));
@@ -14922,18 +15142,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     this.emitter.addLog(
       session,
       "system",
-      "Asking Claude to resolve the push issue..."
+      "Asking the agent to resolve the push issue..."
     );
-    const { text, sessionId } = await this.runClaudeInContainer(
+    const { text, sessionId } = await this.runAgentInContainer(
       session,
       buildPrompt(prompts_default.pushRecovery, {
         branch: branchName,
         error: errorMessage
       }),
       _ClaudeModeEngine.FULL_TOOLS,
-      session.claudeSessionId
+      session.agentSessionId
     );
-    session.claudeSessionId = sessionId || session.claudeSessionId;
+    session.agentSessionId = sessionId || session.agentSessionId;
     if (text.trim()) {
       this.emitter.addLog(session, "system", text.trim());
     }
@@ -14955,7 +15175,7 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     const postId = String(rawPostId);
     const session = this.sessions.get(postId);
     if (!session || session.phase !== "complete") return;
-    if (!session.claudeSessionId) return;
+    if (!session.agentSessionId) return;
     session.diff = "";
     session.changedFiles = [];
     session.commitMessage = "";
@@ -15137,11 +15357,16 @@ var TerminalModeEngine = class {
     }
     this.sessions.clear();
   }
-  /** Active container for a card, or null when none / terminated. */
+  /**
+   * Container for a card this engine owns, or null when there's no session.
+   * The terminal bridge uses BoardAgentEngine.getCardContainerName instead —
+   * that one resolves cross-mode. Kept in step with it: errored and pushed
+   * sessions still resolve, because neither phase kills the container and a
+   * crashed run is exactly when a shell is worth the most.
+   */
   getCardContainerName(postId) {
     const session = this.sessions.get(String(postId));
     if (!session) return null;
-    if (session.phase === "error" || session.phase === "done") return null;
     return session.containerName;
   }
   // ── container + Claude CLI, user drives ──
@@ -15158,7 +15383,7 @@ var TerminalModeEngine = class {
     await spawnContainer(session.containerName, {
       spaceSlug: this.core.spaceSlug,
       fuse: onedrive,
-      claudeHostDir: this.core.claudeDir()
+      providerHostDirs: this.core.providerHostDirs()
     });
     if (onedrive) {
       const rotated = await writeRcloneMountConfig(
@@ -15420,6 +15645,7 @@ var TerminalModeEngine = class {
       this.emitter.addLog(session, "system", "Generating commit message...");
       try {
         session.commitMessage = await generateCommitMessage(
+          this.core.agentProvider(),
           session.containerName,
           diff
         );
@@ -15455,21 +15681,22 @@ var TerminalModeEngine = class {
     }
     return await extractDiff(session.containerName);
   }
-  async bareListTerminals({
-    postId: rawPostId
-  }) {
+  /**
+   * `containerOverride` carries the cross-mode container lookup from
+   * BoardAgentEngine so tabs also resolve for cards this engine doesn't own
+   * (a claude session, including a crashed one). Without it we'd report "no
+   * tabs" for the containers users most need to inspect.
+   */
+  async bareListTerminals({ postId: rawPostId }, containerOverride) {
     const postId = String(rawPostId);
     const session = this.sessions.get(postId);
-    if (!session) return [];
-    if (session.mode !== "bare") return [];
-    if (session.phase !== "bare-active" && session.phase !== "bare-review") {
-      return [];
-    }
+    const containerName = session?.containerName ?? containerOverride;
+    if (!containerName) return [];
     const sanitizedPostId = postId.replace(/[^a-zA-Z0-9._-]/g, "_");
     const prefix = `terminal-${sanitizedPostId}-`;
     try {
       const stdout = await execInContainer(
-        session.containerName,
+        containerName,
         `tmux list-panes -a -F '#{session_name}|#{pane_current_command}' 2>/dev/null || true`
       );
       const byId = /* @__PURE__ */ new Map();
@@ -15543,10 +15770,74 @@ var TerminalModeEngine = class {
   }
 };
 
-// ../../shared/all/helpers/board-agent-core/claude-login.ts
+// ../../shared/all/helpers/board-agent-core/login-exec.ts
 var import_child_process8 = require("child_process");
 var import_util7 = require("util");
 var execFileAsync4 = (0, import_util7.promisify)(import_child_process8.execFile);
+async function startLoginExec(opts) {
+  const info = PROVIDERS[opts.provider];
+  const stateDir = providerStateDir(opts.provider, opts.spaceSlug);
+  const seg = opts.spaceSlug.replace(/[^a-zA-Z0-9._-]/g, "_");
+  const containerName = `factiii-${opts.instancePrefix}-login-${opts.provider}-${seg}`;
+  await killContainer(containerName);
+  await execFileAsync4("docker", [
+    "run",
+    "-d",
+    "--name",
+    containerName,
+    "--user",
+    "claude",
+    "-e",
+    "HOME=/home/claude",
+    "-e",
+    `${info.stateEnvVar}=${stateDir}`,
+    "-v",
+    "factiii-card-cache:/cache",
+    "-v",
+    `${opts.hostStateDir}:${stateDir}`,
+    "factiii-claude",
+    "tail",
+    "-f",
+    "/dev/null"
+  ]);
+  await execInContainer(containerName, `mkdir -p ${stateDir}`);
+  const docker2 = resolveDocker();
+  const container = docker2.getContainer(containerName);
+  const exec = await container.exec({
+    Cmd: opts.cmd,
+    User: "claude",
+    Env: [
+      "HOME=/home/claude",
+      `${info.stateEnvVar}=${stateDir}`,
+      "TERM=xterm-256color"
+    ],
+    AttachStdin: true,
+    AttachStdout: true,
+    AttachStderr: true,
+    Tty: true
+  });
+  const stream = await exec.start({
+    hijack: true,
+    stdin: true,
+    Tty: true
+  });
+  await exec.resize({ w: 500, h: 50 }).catch(() => {
+  });
+  return { containerName, stream };
+}
+async function loginCredentialsExist(provider, containerName, spaceSlug) {
+  try {
+    await execInContainer(
+      containerName,
+      `test -f ${providerStateDir(provider, spaceSlug)}/${PROVIDERS[provider].credentialsFile}`
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ../../shared/all/helpers/board-agent-core/claude-login.ts
 var ANSI_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*(\x07|\x1b\\)|\x1b[=>]/g;
 var ClaudeLoginFlow = class {
   constructor(spaceSlug, instancePrefix, claudeHostDir, onDone) {
@@ -15554,7 +15845,6 @@ var ClaudeLoginFlow = class {
     this.instancePrefix = instancePrefix;
     this.claudeHostDir = claudeHostDir;
     this.onDone = onDone;
-    this.docker = null;
     this.stream = null;
     this.containerName = null;
     this.output = "";
@@ -15584,54 +15874,15 @@ var ClaudeLoginFlow = class {
     urlPromise.catch(() => {
     });
     try {
-      const seg = this.spaceSlug.replace(/[^a-zA-Z0-9._-]/g, "_");
-      const name = `factiii-${this.instancePrefix}-login-${seg}`;
-      this.containerName = name;
-      await killContainer(name);
-      await execFileAsync4("docker", [
-        "run",
-        "-d",
-        "--name",
-        name,
-        "--user",
-        "claude",
-        "-e",
-        "HOME=/home/claude",
-        "-e",
-        `CLAUDE_CONFIG_DIR=${claudeStateDir(this.spaceSlug)}`,
-        "-v",
-        "factiii-card-cache:/cache",
-        "-v",
-        `${this.claudeHostDir}:${claudeStateDir(this.spaceSlug)}`,
-        "factiii-claude",
-        "tail",
-        "-f",
-        "/dev/null"
-      ]);
-      await execInContainer(name, `mkdir -p ${claudeStateDir(this.spaceSlug)}`);
-      this.docker = resolveDocker();
-      const container = this.docker.getContainer(name);
-      const exec = await container.exec({
-        Cmd: ["claude", "auth", "login", "--claudeai"],
-        User: "claude",
-        Env: [
-          "HOME=/home/claude",
-          `CLAUDE_CONFIG_DIR=${claudeStateDir(this.spaceSlug)}`,
-          "TERM=xterm-256color"
-        ],
-        AttachStdin: true,
-        AttachStdout: true,
-        AttachStderr: true,
-        Tty: true
-      });
-      const stream = await exec.start({
-        hijack: true,
-        stdin: true,
-        Tty: true
+      const { containerName, stream } = await startLoginExec({
+        provider: "claude",
+        spaceSlug: this.spaceSlug,
+        instancePrefix: this.instancePrefix,
+        hostStateDir: this.claudeHostDir,
+        cmd: ["claude", "auth", "login", "--claudeai"]
       });
+      this.containerName = containerName;
       this.stream = stream;
-      await exec.resize({ w: 500, h: 50 }).catch(() => {
-      });
       stream.on("data", (chunk) => this.onData(chunk));
       stream.on("error", () => this.fail("Claude sign-in connection dropped."));
       stream.on("close", () => void this.onClose());
@@ -15697,15 +15948,11 @@ var ClaudeLoginFlow = class {
   // Process ended (or success was printed): the credentials file on the cache
   // volume is the ground truth for whether the sign-in worked.
   async verifyAndComplete(failTail) {
-    let ok = false;
-    try {
-      await execInContainer(
-        this.containerName,
-        `test -f ${claudeStateDir(this.spaceSlug)}/.credentials.json`
-      );
-      ok = true;
-    } catch {
-    }
+    const ok = await loginCredentialsExist(
+      "claude",
+      this.containerName,
+      this.spaceSlug
+    );
     if (ok) {
       try {
         await this.markOnboardingComplete();
@@ -15723,7 +15970,7 @@ var ClaudeLoginFlow = class {
   // The CLI's own wizard-completion marker; without it a fresh space replays
   // onboarding even when signed in.
   async markOnboardingComplete() {
-    const configFile = `${claudeStateDir(this.spaceSlug)}/.claude.json`;
+    const configFile = `${providerStateDir("claude", this.spaceSlug)}/.claude.json`;
     const script = [
       `const fs = require('fs')`,
       `let config = {}`,
@@ -15772,15 +16019,295 @@ var ClaudeLoginFlow = class {
   }
 };
 
+// ../../shared/all/helpers/board-agent-core/codex-login.ts
+var ANSI_RE2 = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*(\x07|\x1b\\)|\x1b[=>]/g;
+var CODE_LINE_RE = /code[^\n]*\n\s*([A-Z0-9]{4,10}(?:-[A-Z0-9]{4,10})+)/i;
+var CODE_TOKEN_RE = /\b([A-Z0-9]{4,10}-[A-Z0-9]{4,10})\b/;
+var CodexLoginFlow = class {
+  constructor(spaceSlug, instancePrefix, codexHostDir, onDone) {
+    this.spaceSlug = spaceSlug;
+    this.instancePrefix = instancePrefix;
+    this.codexHostDir = codexHostDir;
+    this.onDone = onDone;
+    this.stream = null;
+    this.containerName = null;
+    this.output = "";
+    this.startResolver = null;
+    this.startRejecter = null;
+    this.settled = false;
+    // Set before start()'s first await so overlapping starts can't race.
+    this.inFlight = false;
+  }
+  get active() {
+    return this.inFlight && !this.settled;
+  }
+  /**
+   * Spawn the login container + PTY and resolve with the verification URL and
+   * one-time code to show the user. Completion (auth.json written / failure)
+   * arrives later via onDone once the CLI's polling settles.
+   */
+  async start() {
+    if (this.active) throw new Error("A Codex sign-in is already running.");
+    this.reset();
+    this.inFlight = true;
+    const startPromise = new Promise(
+      (resolve, reject) => {
+        this.startResolver = resolve;
+        this.startRejecter = reject;
+      }
+    );
+    startPromise.catch(() => {
+    });
+    try {
+      const { containerName, stream } = await startLoginExec({
+        provider: "codex",
+        spaceSlug: this.spaceSlug,
+        instancePrefix: this.instancePrefix,
+        hostStateDir: this.codexHostDir,
+        cmd: ["codex", "login", "--device-auth"]
+      });
+      this.containerName = containerName;
+      this.stream = stream;
+      stream.on("data", (chunk) => this.onData(chunk));
+      stream.on("error", () => this.fail("Codex sign-in connection dropped."));
+      stream.on("close", () => void this.onClose());
+    } catch (err) {
+      if (this.settled) throw new Error("Codex sign-in cancelled.");
+      this.settled = true;
+      this.startResolver = null;
+      this.startRejecter = null;
+      await this.cleanup();
+      throw err;
+    }
+    return startPromise;
+  }
+  async cancel() {
+    if (this.settled) return;
+    this.settled = true;
+    if (this.startRejecter) {
+      const reject = this.startRejecter;
+      this.startResolver = null;
+      this.startRejecter = null;
+      reject(new Error("Codex sign-in cancelled."));
+    }
+    await this.cleanup();
+  }
+  onData(chunk) {
+    this.output += chunk.toString("utf-8").replace(ANSI_RE2, "");
+    if (this.output.length > 2e5) {
+      this.output = this.output.slice(-1e5);
+    }
+    if (this.startResolver) {
+      const url2 = this.output.match(/https:\/\/\S+/)?.[0];
+      const code = this.output.match(CODE_LINE_RE)?.[1] ?? this.output.match(CODE_TOKEN_RE)?.[1];
+      if (url2 && code) {
+        const resolve = this.startResolver;
+        this.startResolver = null;
+        this.startRejecter = null;
+        resolve({ url: url2.replace(/[.,;)\]]+$/, ""), code });
+      }
+      return;
+    }
+    if (this.settled) return;
+    if (/success|logged in/i.test(this.output)) {
+      this.settled = true;
+      void this.verifyAndComplete("");
+    }
+  }
+  // Process ended (or success was printed): the auth.json on the cache volume
+  // is the ground truth for whether the sign-in worked.
+  async verifyAndComplete(failTail) {
+    const ok = await loginCredentialsExist(
+      "codex",
+      this.containerName,
+      this.spaceSlug
+    );
+    await this.cleanup();
+    this.onDone(
+      ok ? { status: "complete" } : {
+        status: "error",
+        message: failTail || "Codex sign-in ended without signing in."
+      }
+    );
+  }
+  async onClose() {
+    if (this.settled) return;
+    const tail2 = this.output.trim().slice(-300);
+    if (this.startRejecter) {
+      this.fail(tail2 || "Codex sign-in ended unexpectedly.");
+      return;
+    }
+    this.settled = true;
+    await this.verifyAndComplete(tail2);
+  }
+  fail(message) {
+    if (this.settled) return;
+    this.settled = true;
+    if (this.startRejecter) {
+      const reject = this.startRejecter;
+      this.startResolver = null;
+      this.startRejecter = null;
+      reject(new Error(message));
+      void this.cleanup();
+      return;
+    }
+    void this.cleanup();
+    this.onDone({ status: "error", message });
+  }
+  async cleanup() {
+    this.stream?.destroy();
+    this.stream = null;
+    if (this.containerName) await killContainer(this.containerName);
+  }
+  reset() {
+    this.output = "";
+    this.settled = false;
+    this.startResolver = null;
+    this.startRejecter = null;
+  }
+};
+
+// ../../shared/all/helpers/board-agent-core/github-auth.ts
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var TOKEN_URL2 = "https://github.com/login/oauth/access_token";
+var API_BASE = "https://api.github.com";
+var GITHUB_SCOPES = "repo read:user user:email";
+var DEVICE_CODE_GRANT2 = "urn:ietf:params:oauth:grant-type:device_code";
+async function startGithubDeviceCode(clientId) {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({ client_id: clientId, scope: GITHUB_SCOPES })
+  });
+  if (!res.ok) {
+    throw new Error(`GitHub device-code start failed: ${await res.text()}`);
+  }
+  const data = await res.json();
+  if (data.error || !data.device_code || !data.user_code) {
+    throw new Error(
+      data.error_description || data.error || "GitHub returned no device code. Is device flow enabled on the OAuth App?"
+    );
+  }
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: data.verification_uri || "https://github.com/login/device",
+    expiresIn: data.expires_in ?? 900,
+    interval: data.interval ?? 5
+  };
+}
+async function pollGithubDeviceCode(clientId, deviceCode) {
+  const res = await fetch(TOKEN_URL2, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({
+      client_id: clientId,
+      device_code: deviceCode,
+      grant_type: DEVICE_CODE_GRANT2
+    })
+  });
+  const data = await res.json();
+  if (data.access_token) {
+    return { status: "complete", accessToken: data.access_token };
+  }
+  switch (data.error) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "expired_token":
+      return { status: "expired" };
+    case "access_denied":
+      return { status: "declined" };
+    default:
+      return {
+        status: "error",
+        message: data.error_description || data.error || "GitHub sign-in failed."
+      };
+  }
+}
+async function githubApi(token, path11) {
+  const res = await fetch(`${API_BASE}${path11}`, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  if (!res.ok) {
+    throw new Error(
+      `GitHub ${path11} failed (${res.status}): ${await res.text()}`
+    );
+  }
+  return await res.json();
+}
+async function fetchGithubIdentity(token) {
+  const user = await githubApi(token, "/user");
+  let email = user.email ?? "";
+  if (!email) {
+    try {
+      const emails = await githubApi(token, "/user/emails");
+      email = emails.find((e) => e.primary && e.verified)?.email ?? emails.find((e) => e.verified)?.email ?? "";
+    } catch {
+    }
+  }
+  if (!email) email = `${user.id}+${user.login}@users.noreply.github.com`;
+  return { login: user.login, name: user.name || user.login, email };
+}
+async function listGithubRepos(token) {
+  const out = [];
+  for (let page = 1; page <= 3; page++) {
+    const batch = await githubApi(token, `/user/repos?per_page=100&sort=pushed&page=${page}`);
+    for (const r of batch) {
+      if (r.permissions && !r.permissions.push) continue;
+      out.push({
+        fullName: r.full_name,
+        // Strip any embedded credentials; buildCloneUrl adds the token.
+        cloneUrl: r.clone_url.replace(/\/\/[^@/]*@/, "//"),
+        defaultBranch: r.default_branch,
+        private: r.private
+      });
+    }
+    if (batch.length < 100) break;
+  }
+  return out;
+}
+async function listGithubBranches(token, fullName) {
+  const branches = await githubApi(
+    token,
+    `/repos/${fullName}/branches?per_page=100`
+  );
+  return branches.map((b) => b.name);
+}
+
 // ../../shared/all/helpers/board-agent-core/host-deploy.ts
 var import_child_process9 = require("child_process");
 var import_promises2 = __toESM(require("fs/promises"));
 var import_path5 = __toESM(require("path"));
 var import_util8 = require("util");
 var execFileAsync5 = (0, import_util8.promisify)(import_child_process9.execFile);
-var SKILL_PATH = ".claude/skills/deploy/SKILL.md";
-var VARIABLES_PATH = ".claude/skills/deploy/required-variables.json";
-var CHECKER_PATH = ".claude/skills/deploy/check-environment.sh";
+var SKILL_DIR = ".agents/skills/deploy";
+var SKILL_PATH = `${SKILL_DIR}/SKILL.md`;
+var VARIABLES_PATH = `${SKILL_DIR}/required-variables.json`;
+var CHECKER_PATH = `${SKILL_DIR}/check-environment.sh`;
+var CLAUDE_SKILLS_DIR = ".claude/skills";
+var CLAUDE_LINK = `${CLAUDE_SKILLS_DIR}/deploy`;
+async function ensureClaudeSkillLink(workspace) {
+  const linkPath = import_path5.default.join(workspace, CLAUDE_LINK);
+  try {
+    await import_promises2.default.lstat(linkPath);
+    return;
+  } catch {
+  }
+  await import_promises2.default.mkdir(import_path5.default.join(workspace, CLAUDE_SKILLS_DIR), { recursive: true });
+  await import_promises2.default.symlink("../../.agents/skills/deploy", linkPath, "dir");
+}
 var GIT_NO_HELPER = ["-c", "credential.helper="];
 var GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
 async function hostGit(cwd, ...args) {
@@ -15872,11 +16399,12 @@ var requiredVariableSchema = external_exports.object({
   category: external_exports.string().catch("general"),
   sensitive: external_exports.boolean().catch(true)
 });
-function hostClaudeEnv(spaceDir) {
-  return {
-    ...spaceEnv(spaceDir),
-    CLAUDE_CONFIG_DIR: import_path5.default.join(spaceDir, "claude")
-  };
+function hostAgentEnv(spaceDir) {
+  const env = spaceEnv(spaceDir);
+  for (const info of Object.values(PROVIDERS)) {
+    env[info.stateEnvVar] = import_path5.default.join(spaceDir, info.hostStateSubdir);
+  }
+  return env;
 }
 function spaceEnv(spaceDir) {
   return {
@@ -15935,7 +16463,7 @@ async function generateDeploySkill(opts) {
     type: "system",
     content: "Analyzing the repo and writing the deploy skill..."
   });
-  const { result } = await spawnClaudeHost({
+  const { result } = await spawnAgentHost(opts.provider, {
     cwd: workspace,
     prompt: buildPrompt(prompts_default.deployCreate, {
       INSTRUCTIONS: instructions
@@ -15943,11 +16471,12 @@ async function generateDeploySkill(opts) {
     allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
     // auto: the per-action classifier blocks escalations/unrecognized-infra
     // actions - a host session with no human reviewing each command should
-    // not run bypassPermissions.
+    // not run bypassPermissions. (Codex maps this to a workspace-write
+    // sandbox; see agent.ts.)
     permissionMode: "auto",
     model: "claude-opus-4-6",
     includePartialMessages: true,
-    env: hostClaudeEnv(opts.spaceDir),
+    env: hostAgentEnv(opts.spaceDir),
     callbacks: { onLog: (entry) => sendLog(entry) }
   });
   const { sessionId } = await result;
@@ -15959,7 +16488,7 @@ async function reviseDeploySkill(opts) {
   if (!feedback.trim()) throw new Error("Corrections are empty.");
   const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   sendLog({ type: "system", content: "Applying your corrections..." });
-  const { result } = await spawnClaudeHost({
+  const { result } = await spawnAgentHost(opts.provider, {
     cwd: workspace,
     prompt: buildPrompt(prompts_default.deployCreateRevise, {
       FEEDBACK: feedback
@@ -15969,7 +16498,7 @@ async function reviseDeploySkill(opts) {
     model: "claude-opus-4-6",
     includePartialMessages: true,
     resumeSessionId: opts.resumeSessionId || void 0,
-    env: hostClaudeEnv(opts.spaceDir),
+    env: hostAgentEnv(opts.spaceDir),
     callbacks: { onLog: (entry) => sendLog(entry) }
   });
   const { sessionId } = await result;
@@ -15996,6 +16525,7 @@ async function loadSkillDraft(opts) {
 async function approveDeploySkill(opts) {
   const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   await readContract(workspace);
+  await ensureClaudeSkillLink(workspace);
   if (opts.gitName)
     await hostGit(workspace, "config", "user.name", opts.gitName);
   if (opts.gitEmail)
@@ -16091,7 +16621,7 @@ async function fixEnvironment(opts) {
     type: "system",
     content: "Setting this machine up to pass the environment check..."
   });
-  const { result } = await spawnClaudeHost({
+  const { result } = await spawnAgentHost(opts.provider, {
     cwd: workspace,
     prompt: buildPrompt(prompts_default.deployEnvFix, {
       CHECKS: failed || before.output.slice(-2e3),
@@ -16103,7 +16633,7 @@ async function fixEnvironment(opts) {
     permissionMode: "auto",
     model: "claude-opus-4-6",
     includePartialMessages: true,
-    env: hostClaudeEnv(opts.spaceDir),
+    env: hostAgentEnv(opts.spaceDir),
     callbacks: { onLog: (entry) => sendLog(entry) }
   });
   await result;
@@ -16375,14 +16905,20 @@ async function startDeployRun(opts) {
     `origin/${status.branch}`
   );
   await hostGit(workspace, "clean", "-fd");
+  await ensureClaudeSkillLink(workspace);
   const contract = prompts_default.deployRun.join("\n");
-  let prompt2 = "/deploy\n\nReminder: every declared deploy variable is intentionally unset in your shell. Never check for them or abort over them - route any command that needs one through NEED_SECRETS and the runner injects the values.";
+  const reminder = "Reminder: every declared deploy variable is intentionally unset in your shell. Never check for them or abort over them - route any command that needs one through NEED_SECRETS and the runner injects the values.";
+  let prompt2 = opts.provider === "codex" ? `Use the "deploy" skill: load it and execute it step by step.
+
+${reminder}` : `/deploy
+
+${reminder}`;
   let sessionId = "";
   let markerless = 0;
   let todos = [];
   for (; ; ) {
     if (hooks.isCancelled()) throw new Error("Cancelled by user.");
-    const { proc, result } = await spawnClaudeHost({
+    const { proc, result } = await spawnAgentHost(opts.provider, {
       cwd: workspace,
       prompt: prompt2,
       allowedTools: "Bash,Read,Grep,Glob,TodoWrite,WebSearch,WebFetch",
@@ -16394,7 +16930,7 @@ async function startDeployRun(opts) {
       includePartialMessages: true,
       resumeSessionId: sessionId || void 0,
       appendSystemPrompt: sessionId ? void 0 : contract,
-      env: hostClaudeEnv(opts.spaceDir),
+      env: hostAgentEnv(opts.spaceDir),
       callbacks: {
         initialTodos: todos,
         onLog: (entry) => hooks.sendLog(entry),
@@ -16532,8 +17068,9 @@ var BoardAgentEngine = class _BoardAgentEngine {
     this.runResolvers = {};
     this.runProc = null;
     this.runCancelled = false;
-    // ── One-click Claude sign-in (see claude-login.ts) ──
+    // ── One-click sign-in (see claude-login.ts / codex-login.ts) ──
     this.claudeLogin = null;
+    this.codexLogin = null;
     this.core = new ContainerCore(options);
     this.emitter = options.emitter;
     this.claude = new ClaudeModeEngine(this.core, this.emitter);
@@ -16679,6 +17216,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       repoUrl: opts.repoUrl,
       mainBranch: opts.mainBranch,
       githubToken: opts.githubToken,
+      provider: opts.provider,
       hooks: {
         sendLog: bufferLog,
         onTodos: (todos) => this.setRun({ todos }),
@@ -16868,6 +17406,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       repoUrl: config.repoUrl,
       mainBranch: config.mainBranch,
       githubToken: config.githubToken,
+      provider: this.core.agentProvider(),
       sendLog
     };
   }
@@ -17017,6 +17556,104 @@ var BoardAgentEngine = class _BoardAgentEngine {
     this.core.clearOneDriveConnection();
     return { success: true };
   }
+  // ── GitHub device-code auth (see github-auth.ts) ──
+  // The resulting access token lands in the space config's `githubToken`, the
+  // same field a hand-pasted PAT used, so buildCloneUrl and everything
+  // downstream is unchanged.
+  async githubStartDeviceCode(p) {
+    const start = await startGithubDeviceCode(p.clientId);
+    console.log(
+      `[github] device-code started: userCode=${start.userCode} expiresIn=${start.expiresIn}s interval=${start.interval}s`
+    );
+    void this.pollGithubUntilDone(
+      p.clientId,
+      start.deviceCode,
+      start.interval,
+      start.expiresIn
+    );
+    return {
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      expiresIn: start.expiresIn
+    };
+  }
+  async pollGithubUntilDone(clientId, deviceCode, interval, expiresIn) {
+    const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    const deadline = Date.now() + expiresIn * 1e3;
+    let wait = Math.max(interval, 5);
+    while (Date.now() < deadline) {
+      await sleep(wait * 1e3);
+      let res;
+      try {
+        res = await pollGithubDeviceCode(clientId, deviceCode);
+      } catch (err) {
+        console.log(`[github] poll threw (will retry): ${String(err)}`);
+        continue;
+      }
+      if (res.status === "pending") continue;
+      if (res.status === "slow_down") {
+        wait += 5;
+        continue;
+      }
+      if (res.status === "complete") {
+        try {
+          let login = "";
+          const patch = {
+            githubToken: res.accessToken
+          };
+          try {
+            const id = await fetchGithubIdentity(res.accessToken);
+            login = id.login;
+            const existing = this.core.readConfig();
+            if (!existing.gitName) patch.gitName = id.name;
+            if (!existing.gitEmail) patch.gitEmail = id.email;
+          } catch (err) {
+            console.log(`[github] identity lookup failed: ${String(err)}`);
+          }
+          this.core.setConfig(patch);
+          console.log("[github] token saved locally");
+          this.emitter.emitGithubAuth({ status: "complete", login });
+        } catch (err) {
+          console.log(`[github] saving the token failed: ${String(err)}`);
+          this.emitter.emitGithubAuth({
+            status: "error",
+            message: "Failed to store the GitHub token on the host."
+          });
+        }
+        return;
+      }
+      this.emitter.emitGithubAuth({
+        status: res.status,
+        message: res.status === "error" ? res.message : void 0
+      });
+      return;
+    }
+    console.log("[github] device code reached deadline without completion");
+    this.emitter.emitGithubAuth({ status: "expired" });
+  }
+  githubDisconnect() {
+    this.core.clearToken("githubToken");
+    return { success: true };
+  }
+  async githubIdentity() {
+    const { githubToken } = this.core.readConfig();
+    if (!githubToken) return null;
+    try {
+      return await fetchGithubIdentity(githubToken);
+    } catch {
+      return null;
+    }
+  }
+  async githubListRepos() {
+    const { githubToken } = this.core.readConfig();
+    if (!githubToken) throw new Error("Connect GitHub first.");
+    return listGithubRepos(githubToken);
+  }
+  async githubListBranches(p) {
+    const { githubToken } = this.core.readConfig();
+    if (!githubToken) throw new Error("Connect GitHub first.");
+    return listGithubBranches(githubToken, p.fullName);
+  }
   async claudeLoginStart() {
     if (!this.core.isReady()) {
       throw new Error("Initialize the environment first, then sign in.");
@@ -17024,12 +17661,15 @@ var BoardAgentEngine = class _BoardAgentEngine {
     this.claudeLogin ??= new ClaudeLoginFlow(
       this.core.spaceSlug,
       this.core.instancePrefix,
-      this.core.claudeDir(),
+      this.core.providerDir("claude"),
       (result) => {
-        if (result.status === "complete") this.core.setClaudeLoggedIn(true);
+        if (result.status === "complete") {
+          this.core.setLoggedIn("claude", true);
+        }
         this.emitter.emitClaudeAuth(result);
       }
     );
+    if (this.claudeLogin.active) await this.claudeLogin.cancel();
     return this.claudeLogin.start();
   }
   claudeLoginCode(p) {
@@ -17040,15 +17680,49 @@ var BoardAgentEngine = class _BoardAgentEngine {
     await this.claudeLogin?.cancel();
     return { success: true };
   }
+  async codexLoginStart() {
+    if (!this.core.isReady()) {
+      throw new Error("Initialize the environment first, then sign in.");
+    }
+    this.codexLogin ??= new CodexLoginFlow(
+      this.core.spaceSlug,
+      this.core.instancePrefix,
+      this.core.providerDir("codex"),
+      (result) => {
+        if (result.status === "complete") {
+          this.core.setLoggedIn("codex", true);
+        }
+        this.emitter.emitCodexAuth(result);
+      }
+    );
+    if (this.codexLogin.active) await this.codexLogin.cancel();
+    return this.codexLogin.start();
+  }
+  async codexLoginCancel() {
+    await this.codexLogin?.cancel();
+    return { success: true };
+  }
+  // The ~ dirs symlink to the space's state dirs on the cache volume.
   async claudeLogout() {
     if (!this.core.isReady()) {
       throw new Error("Initialize the environment first.");
     }
     await execInContainer(
       this.core.containerName,
-      "rm -f /home/claude/.claude/.credentials.json"
+      `rm -f ${containerCredentialsPath("claude")}`
+    );
+    this.core.setLoggedIn("claude", false);
+    return { success: true };
+  }
+  async codexLogout() {
+    if (!this.core.isReady()) {
+      throw new Error("Initialize the environment first.");
+    }
+    await execInContainer(
+      this.core.containerName,
+      `rm -f ${containerCredentialsPath("codex")}`
     );
-    this.core.setClaudeLoggedIn(false);
+    this.core.setLoggedIn("codex", false);
     return { success: true };
   }
   // Unmount the workspace (flushing writes) and persist the rotated refresh
@@ -17128,7 +17802,10 @@ var BoardAgentEngine = class _BoardAgentEngine {
     return this.terminal.bareGitStatus(p);
   }
   bareListTerminals(p) {
-    return this.terminal.bareListTerminals(p);
+    return this.terminal.bareListTerminals(
+      p,
+      this.getCardContainerName(String(p.postId)) ?? void 0
+    );
   }
   bareEditorState(p) {
     return this.terminal.bareEditorState(p);
@@ -17194,6 +17871,8 @@ var BoardAgentEngine = class _BoardAgentEngine {
       targetBranch: targetBranch || "",
       effort: effort || "high",
       todos: [],
+      // Claude mode overwrites this once the CLI reports its conversation id.
+      agentSessionId: "",
       // Name by stable spaceId when we have it; fall back to the id-less legacy
       // form for old callers that only send the slug.
       containerName: this.core.spaceId != null ? `factiii-${this.core.instancePrefix}-card-${this.core.spaceId}-${taskId}` : `factiii-${this.core.instancePrefix}-card-${taskId}`
@@ -17213,7 +17892,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
     return { taskId, postId };
   }
   /**
-   * One-shot claude call on the runner host: combine the selected cards'
+   * One-shot agent call on the runner host: combine the selected cards'
    * text into the merged card. The server never talks to a model.
    */
   async cardMergeContent(payload) {
@@ -17222,12 +17901,12 @@ var BoardAgentEngine = class _BoardAgentEngine {
       (c) => `### ${c.title.trim() || "(untitled)"}
 ${c.content.trim() || "(no description)"}`
     ).join("\n\n");
-    const { result } = await spawnClaudeHost({
+    const { result } = await spawnAgentHost(this.core.agentProvider(), {
       cwd: spaceDir,
       prompt: buildPrompt(prompts_default.mergeCards, { cards }),
       allowedTools: "",
       model: "claude-sonnet-4-6",
-      env: hostClaudeEnv(spaceDir),
+      env: hostAgentEnv(spaceDir),
       callbacks: {}
     });
     const { text } = await result;
@@ -17294,6 +17973,9 @@ ${c.content.trim() || "(no description)"}`
         targetBranch,
         effort: "high",
         todos: [],
+        // The merge starts a brand-new thread; the sources' ids died with
+        // their sessions above.
+        agentSessionId: "",
         containerName: this.core.spaceId != null ? `factiii-${this.core.instancePrefix}-card-${this.core.spaceId}-${taskId}` : `factiii-${this.core.instancePrefix}-card-${taskId}`
       },
       { sources: sources.map(({ title, diff }) => ({ title, diff })) }
@@ -17303,11 +17985,16 @@ ${c.content.trim() || "(no description)"}`
   /**
    * Look up the active container for a card. Used by the terminal bridge to
    * map postId to the docker container it should attach a shell to.
+   *
+   * Errored and pushed ('done') sessions still resolve on purpose: neither
+   * phase tears the container down (only cardKill/cardDismiss/destroy call
+   * killContainer), and a crashed run is exactly when a shell is worth the
+   * most. If the container really is gone, the `docker exec` behind this
+   * fails and terminal.ts reports that instead of silently refusing.
    */
   getCardContainerName(postId) {
     const session = this.claude.get(String(postId)) ?? this.terminal.get(String(postId));
     if (!session) return null;
-    if (session.phase === "error" || session.phase === "done") return null;
     return session.containerName;
   }
   cardSessions() {
@@ -17466,6 +18153,7 @@ ${c.content.trim() || "(no description)"}`
   // ── Lifecycle ──
   destroy() {
     void this.claudeLogin?.cancel();
+    void this.codexLogin?.cancel();
     this.claude.destroy();
     this.terminal.destroy();
     this.core.destroy();
@@ -17609,6 +18297,20 @@ ${c.content.trim() || "(no description)"}`
         );
       case "onedriveDisconnect":
         return this.onedriveDisconnect();
+      case "githubStartDeviceCode":
+        return await this.githubStartDeviceCode(
+          payload
+        );
+      case "githubDisconnect":
+        return this.githubDisconnect();
+      case "githubIdentity":
+        return await this.githubIdentity();
+      case "githubListRepos":
+        return await this.githubListRepos();
+      case "githubListBranches":
+        return await this.githubListBranches(
+          payload
+        );
       case "claudeLoginStart":
         return await this.claudeLoginStart();
       case "claudeLoginCode":
@@ -17619,6 +18321,12 @@ ${c.content.trim() || "(no description)"}`
         return await this.claudeLoginCancel();
       case "claudeLogout":
         return await this.claudeLogout();
+      case "codexLoginStart":
+        return await this.codexLoginStart();
+      case "codexLoginCancel":
+        return await this.codexLoginCancel();
+      case "codexLogout":
+        return await this.codexLogout();
       case "onedriveTeardown":
         return await this.onedriveTeardown(
           payload
@@ -21273,10 +21981,52 @@ Object.assign(lookup, {
 
 // ../../shared/all/helpers/terminal-ai/terminal.ts
 var docker = resolveDocker();
-var TERMINAL_INIT_SCRIPT = [
-  `export PS1='\\[\\e[1;32m\\]user@bare\\[\\e[0m\\]:\\w\\$ '`,
-  `exec bash --norc -i`
+var REPO_ROOT = "/home/claude/workspace";
+var TERMINAL_PRELUDE = [
+  // cd here rather than via the exec's WorkingDir: a session that died before
+  // cloneRepo has no workspace dir, and docker refuses to start an exec whose
+  // cwd is missing ("chdir to cwd ... no such file or directory"). That would
+  // lock a shell out of exactly the containers worth inspecting, so fall back
+  // to $HOME and let the user look around.
+  //
+  // The cwd also has to match the agent's (`-w /home/claude/workspace`, see
+  // agent.ts) or a --resume can't find the thread: the provider CLIs key
+  // their transcripts by working directory.
+  `cd ${REPO_ROOT} 2>/dev/null || cd "$HOME" 2>/dev/null || cd /`,
+  `export PS1='\\[\\e[1;32m\\]user@bare\\[\\e[0m\\]:\\w\\$ '`
 ].join("; ");
+var SAFE_SESSION_ID = /^[a-zA-Z0-9_-]{1,128}$/;
+var CARD_CONTEXT_PATH = "/tmp/factiii-card.md";
+var CARD_CONTEXT_PROMPT = `Read ${CARD_CONTEXT_PATH} - it is the Factiii card this session was opened from. Use it as the context for the work, then wait for instructions.`;
+function terminalInitScript(resumeAgentSessionId, provider, hasCardContext = false) {
+  const shell = `exec bash --norc -i`;
+  if (!resumeAgentSessionId || !SAFE_SESSION_ID.test(resumeAgentSessionId)) {
+    if (!hasCardContext) return `${TERMINAL_PRELUDE}; ${shell}`;
+    const start = provider === "codex" ? `codex '${CARD_CONTEXT_PROMPT}'` : `claude '${CARD_CONTEXT_PROMPT}'`;
+    return `${TERMINAL_PRELUDE}; ${start}; ${shell}`;
+  }
+  const resume = provider === "codex" ? `codex resume ${resumeAgentSessionId}` : `claude --resume ${resumeAgentSessionId}`;
+  return `${TERMINAL_PRELUDE}; ${resume}; ${shell}`;
+}
+async function writeCardContext(containerName, cardContext) {
+  try {
+    const b64 = Buffer.from(cardContext, "utf-8").toString("base64");
+    const exec = await docker.getContainer(containerName).exec({
+      Cmd: ["bash", "-c", `echo '${b64}' | base64 -d > ${CARD_CONTEXT_PATH}`],
+      AttachStdout: true,
+      AttachStderr: true
+    });
+    const stream = await exec.start({});
+    await new Promise((resolve) => {
+      stream.on("end", resolve);
+      stream.on("error", resolve);
+      stream.resume();
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function tmuxName(terminalKey) {
   const safe = terminalKey.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
   return `terminal-${safe}`;
@@ -21327,6 +22077,8 @@ var TerminalManager = class {
       return;
     }
     const tmuxSession = tmuxName(msg.terminalKey);
+    const wantsCardContext = !msg.resumeAgentSessionId && !!msg.cardContext;
+    const hasCardContext = wantsCardContext && await writeCardContext(containerName, msg.cardContext);
     try {
       const exec = await docker.getContainer(containerName).exec({
         Cmd: [
@@ -21342,14 +22094,19 @@ var TerminalManager = class {
           "--",
           "bash",
           "-c",
-          TERMINAL_INIT_SCRIPT
+          terminalInitScript(
+            msg.resumeAgentSessionId,
+            msg.resumeProvider,
+            hasCardContext
+          )
         ],
         AttachStdin: true,
         AttachStdout: true,
         AttachStderr: true,
         Tty: true,
-        // Drop the user into the cloned repo so claude/git/etc. just work.
-        WorkingDir: "/home/claude/workspace",
+        // No WorkingDir on purpose — docker validates it before the process
+        // starts, so a missing workspace kills the exec outright. The init
+        // script cds into the repo instead, with a fallback.
         Env: ["TERM=xterm-256color"],
         // The client follows up with a resize op carrying real dimensions.
         ConsoleSize: [msg.rows, msg.cols]
@@ -21488,7 +22245,8 @@ var CONFIG_FIELDS = [
   "gitName",
   "gitEmail",
   "githubToken",
-  "storageBackend"
+  "storageBackend",
+  "provider"
 ];
 function fillDefaults(config) {
   return {
@@ -21497,7 +22255,8 @@ function fillDefaults(config) {
     gitName: config.gitName || "",
     gitEmail: config.gitEmail || "",
     githubToken: config.githubToken || "",
-    storageBackend: config.storageBackend || "github"
+    storageBackend: config.storageBackend || "github",
+    provider: config.provider || "claude"
   };
 }
 function migrateLegacyConfigs() {
@@ -21537,6 +22296,21 @@ function readRunnerConfig2() {
     return migrateLegacyConfigs();
   }
 }
+function getConfiguredConnections() {
+  const kinds = /* @__PURE__ */ new Set();
+  const file = readRunnerConfig2();
+  const configs = [file.default ?? {}, ...Object.values(file.boards ?? {})];
+  for (const c of configs) {
+    if (c.claudeToken) kinds.add("claude");
+    if (c.githubToken) kinds.add("git");
+  }
+  try {
+    const hasOneDrive = import_fs5.default.readdirSync(CONFIG_DIR2).some((f) => f.endsWith(".onedrive.json"));
+    if (hasOneDrive) kinds.add("onedrive");
+  } catch {
+  }
+  return [...kinds];
+}
 var localConfigProvider = {
   readConfig(spaceSlug) {
     const file = readRunnerConfig2();
@@ -21548,7 +22322,8 @@ var localConfigProvider = {
       gitName: over.gitName || base.gitName,
       gitEmail: over.gitEmail || base.gitEmail,
       githubToken: over.githubToken || base.githubToken,
-      storageBackend: over.storageBackend || base.storageBackend
+      storageBackend: over.storageBackend || base.storageBackend,
+      provider: over.provider || base.provider
     });
   },
   writeConfig(spaceSlug, config) {
@@ -21593,7 +22368,14 @@ var localConfigProvider = {
   // layout every deploy skill is written against. See .specs/deploy.md.
   spaceDir(spaceSlug) {
     const dir = import_path9.default.join(CONFIG_DIR2, safeSlug(spaceSlug));
-    for (const sub of ["workspace", "backups", "builds", "secrets", "claude"]) {
+    for (const sub of [
+      "workspace",
+      "backups",
+      "builds",
+      "secrets",
+      "claude",
+      "codex"
+    ]) {
       import_fs5.default.mkdirSync(import_path9.default.join(dir, sub), { recursive: true });
     }
     return dir;
@@ -21668,7 +22450,19 @@ async function startDaemon(config) {
         // falls back to the slug when absent.
         spaceId,
         emitter: createEventSink(send, spaceSlug),
-        configProvider: localConfigProvider,
+        // Re-report connection facts after any config/OneDrive write so the
+        // UI badges update when a token is added or cleared.
+        configProvider: {
+          ...localConfigProvider,
+          writeConfig(slug, cfg) {
+            localConfigProvider.writeConfig(slug, cfg);
+            reportConnections();
+          },
+          writeOneDriveConnection(slug, connection) {
+            localConfigProvider.writeOneDriveConnection(slug, connection);
+            reportConnections();
+          }
+        },
         dockerfilePath: getDockerfilePath(),
         runnerToken: config.authToken,
         // Namespace containers per runner so multiple runners (or a desktop
@@ -21681,9 +22475,18 @@ async function startDaemon(config) {
     return engine;
   }
   const instancePrefix = computeInstancePrefix(`runner-${config.runnerName}`);
+  const reportConnections = () => {
+    try {
+      socket.emit("runnerConnections", {
+        connections: getConfiguredConnections()
+      });
+    } catch {
+    }
+  };
   socket.on("connect", () => {
     console.log(`Connected. Runner "${config.runnerName}" is online.`);
     console.log("Waiting for connections from UI clients...\n");
+    reportConnections();
   });
   socket.on("disconnect", (reason) => {
     console.log(`Disconnected: ${reason}. Reconnecting...`);