@hachej/boring-agent 0.1.109 → 0.1.110

package/dist/front/index.js

@@ -32,13 +32,13 @@ import {
   WORKSPACE_COMMAND_NOTIFY_EVENT,
   extractToolUiMetadata,
   sanitizeToolUiMetadata
-} from "../chunk-MVKXLMH3.js";
+} from "../chunk-KN72XWP7.js";
 import {
   safeRandomUUID
 } from "../chunk-YGRQ4Q5P.js";
 import {
   ErrorCode
-} from "../chunk-3JFPS2O6.js";
+} from "../chunk-KJIEMSQP.js";
 
 // src/front/upload/uploadFile.ts
 function readAsDataUrl(file) {
@@ -1313,7 +1313,7 @@ var ToolHeader = ({
   state,
   icon,
   toolName,
-  statusLabel,
+  statusLabel: statusLabel2,
   ...props
 }) => {
   const derivedName = type === "dynamic-tool" || type === "tool-call" ? toolName : type.split("-").slice(1).join("-");
@@ -1330,7 +1330,7 @@ var ToolHeader = ({
         /* @__PURE__ */ jsxs8("div", { className: "flex min-w-0 flex-1 items-center gap-2", children: [
           icon ?? /* @__PURE__ */ jsx8(WrenchIcon, { className: "size-4 shrink-0 text-muted-foreground" }),
           /* @__PURE__ */ jsx8("span", { "data-boring-agent-part": "tool-title", className: "min-w-0 flex-1 truncate text-sm font-medium", children: title ?? derivedName }),
-          getStatusBadge(state, statusLabel)
+          getStatusBadge(state, statusLabel2)
         ] }),
         /* @__PURE__ */ jsx8(
           ChevronDownIcon,
@@ -3914,7 +3914,7 @@ function piChatReducer(state, action) {
     case "model-confirmed":
       return { ...state, currentModel: action.model };
     case "event":
-      return applySequencedEvent(state, action.event);
+      return reducePiChatEvent(state, action.event).state;
     case "optimistic-user-message":
       return {
         ...state,
@@ -4045,18 +4045,29 @@ function mergeSnapshotMessagesIntoLocal(currentMessages, snapshotMessages) {
   for (const message of snapshotMessages) merged = replaceOrAppendMessage(merged, message);
   return merged;
 }
-function applySequencedEvent(state, event) {
-  if (event.seq <= state.lastSeq) return state;
+function reducePiChatEvent(state, event) {
+  if (event.seq <= state.lastSeq) return { state, accepted: false };
   const expectedSeq = state.lastSeq + 1;
   if (event.seq > expectedSeq) {
     return {
-      ...state,
-      connection: { ...state.connection, state: "reconnecting" },
-      needsResync: { expectedSeq, actualSeq: event.seq, lastSeq: state.lastSeq }
+      state: {
+        ...state,
+        connection: { ...state.connection, state: "reconnecting" },
+        needsResync: { expectedSeq, actualSeq: event.seq, lastSeq: state.lastSeq }
+      },
+      accepted: false
     };
   }
-  const next = reduceEvent({ ...state, lastSeq: event.seq, needsResync: void 0 }, event);
-  return next;
+  const sequencedState = { ...state, lastSeq: event.seq, needsResync: void 0 };
+  if (isRejectedTerminalEvent(sequencedState, event)) {
+    return { state: sequencedState, accepted: false };
+  }
+  return { state: reduceEvent(sequencedState, event), accepted: true };
+}
+function isRejectedTerminalEvent(state, event) {
+  if (event.type === "error") return isStaleTurnScopedEvent(state, event.turnId);
+  if (event.type !== "agent-end") return false;
+  return isStaleTurnScopedEvent(state, event.turnId) || isLateNonErrorAgentEndAfterTerminalError(state, event.status);
 }
 function reduceEvent(state, event) {
   switch (event.type) {
@@ -4065,8 +4076,6 @@ function reduceEvent(state, event) {
     case "agent-start":
       return { ...state, status: "streaming", turnId: event.turnId, error: void 0, streamingPreservedTextPartKeys: void 0 };
     case "agent-end":
-      if (isStaleTurnScopedEvent(state, event.turnId)) return state;
-      if (isLateNonErrorAgentEndAfterTerminalError(state, event.status)) return state;
       return settleTurn({
         ...state,
         status: event.status === "error" ? "error" : "idle",
@@ -4116,7 +4125,6 @@ function reduceEvent(state, event) {
         })
       };
     case "error":
-      if (isStaleTurnScopedEvent(state, event.turnId)) return state;
       return settleTurn({
         ...state,
         status: "error",
@@ -4523,6 +4531,17 @@ function createPiChatStore(initialState, options = {}) {
     if (scheduled !== void 0) return;
     scheduled = scheduleNotify(notifyNow);
   };
+  const publish = (dispatchOptions) => {
+    if (dispatchOptions?.flush) {
+      if (scheduled !== void 0) {
+        cancelNotify(scheduled);
+        scheduled = void 0;
+      }
+      notifyNow();
+      return;
+    }
+    schedule();
+  };
   return {
     getState() {
       return state;
@@ -4530,15 +4549,14 @@ function createPiChatStore(initialState, options = {}) {
     dispatch(action, dispatchOptions) {
       if (disposed) return;
       state = piChatReducer(state, action);
-      if (dispatchOptions?.flush) {
-        if (scheduled !== void 0) {
-          cancelNotify(scheduled);
-          scheduled = void 0;
-        }
-        notifyNow();
-        return;
-      }
-      schedule();
+      publish(dispatchOptions);
+    },
+    dispatchEvent(event, dispatchOptions) {
+      if (disposed) return false;
+      const reduction = reducePiChatEvent(state, event);
+      state = reduction.state;
+      publish(dispatchOptions);
+      return reduction.accepted;
     },
     subscribe(listener) {
       if (disposed) return () => {
@@ -5004,8 +5022,8 @@ var RemotePiSession = class {
             return;
           }
           this.recordEventType(frame.type);
-          this.options.onEvent?.(frame);
-          this.store.dispatch({ type: "event", event: frame });
+          const accepted = this.store.dispatchEvent(frame);
+          if (accepted && this.isStreamActive(generation, runId)) this.options.onEvent?.(frame);
           if (this.store.getState().needsResync && this.isStreamActive(generation, runId)) {
             this.gapCount += 1;
             this.rehydrateAfterStreamReset(generation);
@@ -8197,15 +8215,19 @@ var COLLAPSIBLE_TOOL_NAMES = /* @__PURE__ */ new Set([
 function isCollapsibleTool(part) {
   return part.type === "tool-call" && COLLAPSIBLE_TOOL_NAMES.has(part.toolName);
 }
+var EMPTY_VISIBLE_TOOLS = [];
+function toolNameOf(part) {
+  return part.toolName;
+}
 function PiTimelineMessage(props) {
   return /* @__PURE__ */ jsx24(ChatMessageContributionBoundary, { message: props.message, children: /* @__PURE__ */ jsx24(DefaultPiTimelineMessage, { ...props }) });
 }
-function DefaultPiTimelineMessage({ message, isLast, isStreaming, showThoughts, toolRenderers, mentionCatalog = EMPTY_MENTION_CATALOG, onMentionActivate }) {
+function DefaultPiTimelineMessage({ message, isLast, isStreaming, showThoughts, toolRenderers, mentionCatalog = EMPTY_MENTION_CATALOG, onMentionActivate, renderMode = "full", messagesOnlyVisibleTools = EMPTY_VISIBLE_TOOLS, messagesOnlyHideCopyActions = false }) {
   const role = message.role;
   const isAssistant = role === "assistant";
   const textParts = message.parts.filter((part) => part.type === "text");
   const fileParts = message.parts.filter((part) => part.type === "file");
-  const finalParts = groupRenderableParts(message);
+  const finalParts = groupRenderableParts(message, renderMode, messagesOnlyVisibleTools);
   const attachmentSummaryPaths = role === "user" ? attachmentPathsFromTextParts(textParts) : [];
   const openArtifact = useOpenArtifact();
   const effectiveMentionCatalog = useMemo13(() => ({
@@ -8330,7 +8352,7 @@ function DefaultPiTimelineMessage({ message, isLast, isStreaming, showThoughts,
             return null;
           })
         ] }),
-        isAssistant && (textParts.length > 0 || shouldReserveStreamingActions) ? /* @__PURE__ */ jsx24(
+        isAssistant && !(renderMode === "messages-only" && messagesOnlyHideCopyActions) && (textParts.length > 0 || shouldReserveStreamingActions) ? /* @__PURE__ */ jsx24(
           MessageActionsBar,
           {
             text: textParts.map((part) => part.text).join("\n\n"),
@@ -8392,7 +8414,8 @@ function PlainToolCard({ part, renderers }) {
     }
   );
 }
-function groupRenderableParts(message) {
+function groupRenderableParts(message, renderMode = "full", messagesOnlyVisibleTools = EMPTY_VISIBLE_TOOLS) {
+  const messagesOnly = renderMode === "messages-only";
   const grouped = [];
   let pendingTools = [];
   const flushTools = () => {
@@ -8404,6 +8427,12 @@ function groupRenderableParts(message) {
     const key = partKey(message.id, part, index);
     if (part.type === "file") return;
     if (part.type === "tool-call") {
+      if (messagesOnly) {
+        if (!messagesOnlyVisibleTools.includes(toolNameOf(part))) return;
+        flushTools();
+        grouped.push({ kind: "tool-plain", key, part });
+        return;
+      }
       if (isCollapsibleTool(part)) {
         pendingTools.push({ part, key });
       } else {
@@ -8414,6 +8443,7 @@ function groupRenderableParts(message) {
     }
     flushTools();
     if (part.type === "reasoning") {
+      if (messagesOnly) return;
       const previous = grouped[grouped.length - 1];
       if (previous?.kind === "reasoning") {
         previous.text = `${previous.text}
@@ -8587,11 +8617,16 @@ function PiConversationSurface({
   onScrollToBottomReady,
   onSuggestionSubmit,
   onRestoreDraft,
-  windowResetKey
+  windowResetKey,
+  renderMode = "full",
+  messagesOnlyVisibleTools,
+  messagesOnlyHideCopyActions = false,
+  messagesOnlyHiddenUserPrefixes = []
 }) {
-  const messageItems = buildMessageRenderItems(messages);
+  const visibleMessages = renderMode === "messages-only" && messagesOnlyHiddenUserPrefixes.length > 0 ? messages.filter((message) => !isHiddenHostPrompt(message, messagesOnlyHiddenUserPrefixes)) : messages;
+  const messageItems = buildMessageRenderItems(visibleMessages);
   const total = messageItems.length;
-  const historyEmpty = messages.length === 0;
+  const historyEmpty = visibleMessages.length === 0;
   const terminalError = hasTerminalChatError(runtimeNotices, historyEmpty);
   const [visibleCount, setVisibleCount] = useState17(TRANSCRIPT_WINDOW);
   useEffect16(() => {
@@ -8616,8 +8651,8 @@ function PiConversationSurface({
           chrome ? "max-w-3xl px-6 py-8" : "max-w-[680px] px-4 py-4",
           emptyHero && "py-4 text-center"
         ), children: [
-          messages.length === 0 && emptyStateHydrating && !terminalError ? /* @__PURE__ */ jsx25(ConversationHistoryLoadingState, {}) : null,
-          messages.length === 0 && !emptyStateHydrating && !terminalError ? /* @__PURE__ */ jsx25(
+          historyEmpty && emptyStateHydrating && !terminalError ? /* @__PURE__ */ jsx25(ConversationHistoryLoadingState, {}) : null,
+          historyEmpty && !emptyStateHydrating && !terminalError ? /* @__PURE__ */ jsx25(
             ChatEmptyState,
             {
               eyebrow: emptyState?.eyebrow,
@@ -8645,7 +8680,10 @@ function PiConversationSurface({
               showThoughts,
               toolRenderers,
               mentionCatalog,
-              onMentionActivate
+              onMentionActivate,
+              renderMode,
+              messagesOnlyVisibleTools,
+              messagesOnlyHideCopyActions
             },
             key
           )),
@@ -8730,6 +8768,12 @@ function TranscriptHistoryLoader({ olderCount, onLoadOlder }) {
     }
   ) });
 }
+function isHiddenHostPrompt(message, prefixes) {
+  if (message.role !== "user") return false;
+  return message.parts.some(
+    (part) => part.type === "text" && prefixes.some((prefix) => part.text.startsWith(prefix))
+  );
+}
 function buildMessageRenderItems(messages) {
   const assistantTurnCounts = /* @__PURE__ */ new Map();
   for (const message of messages) {
@@ -10455,6 +10499,7 @@ function PiChatComposerSurface({
   chrome,
   pickerPlacement = "above",
   isStreaming,
+  composerActivity,
   status,
   disabled,
   submitStatus,
@@ -10518,6 +10563,8 @@ function PiChatComposerSurface({
   onStop
 }) {
   const prefersReducedMotion = useReducedMotion();
+  const customActivity = composerActivity !== void 0;
+  const visibleActivity = customActivity ? composerActivity != null : isStreaming;
   const workspaceRequestId = getHeaderValue(requestHeaders, "x-boring-workspace-id");
   const composerContributions = useComposerContributions();
   const uploadAttachment = useCallback17((file) => uploadFile(file, {
@@ -10562,10 +10609,10 @@ function PiChatComposerSurface({
         className: cn(
           "mx-auto w-full overflow-hidden transition-[margin,max-height,opacity] duration-200 ease-[cubic-bezier(0.22,1,0.36,1)]",
           chrome ? "max-w-3xl" : "max-w-[680px]",
-          isStreaming ? "mb-2 max-h-8 opacity-100" : "mb-0 max-h-0 opacity-0"
+          visibleActivity ? "mb-2 max-h-8 opacity-100" : "mb-0 max-h-0 opacity-0"
         ),
-        "aria-hidden": !isStreaming,
-        children: /* @__PURE__ */ jsxs30(
+        "aria-hidden": !visibleActivity,
+        children: customActivity ? composerActivity : /* @__PURE__ */ jsxs30(
           "div",
           {
             "data-testid": isStreaming ? "chat-working" : void 0,
@@ -11014,8 +11061,10 @@ function useExternalRemotePiSession({
   }, [agentTypeId, apiBaseUrl, createRemoteSession, fetch2, remoteSessionOptionsKey, sessionId, stableRequestHeaders, storageScope, workspaceId]);
   useEffect22(() => {
     if (!session) return;
-    if (enabled) session.resumeStream?.();
-    else session.suspendStream?.();
+    if (!enabled) session.suspendStream?.();
+    else if (remoteSessionOptionsRef.current?.autoStart !== false || session.getState().connection.state === "suspended") {
+      session.resumeStream?.();
+    }
   }, [enabled, session]);
   return session;
 }
@@ -11151,6 +11200,10 @@ function PiChatPanel({
   fetch: fetch2,
   className,
   chrome = true,
+  renderMode = "full",
+  messagesOnlyVisibleTools,
+  messagesOnlyHideCopyActions = false,
+  messagesOnlyHiddenUserPrefixes,
   debug = false,
   showSessions,
   hotReloadEnabled = true,
@@ -11158,6 +11211,7 @@ function PiChatPanel({
   emptyState,
   emptyPlacement = "hero",
   composerPlaceholder,
+  composerActivity,
   initialDraft,
   autoSubmitInitialDraft = false,
   onDraftRestored,
@@ -11327,6 +11381,9 @@ function PiChatPanel({
   const [resumeQueuedPendingSessionIds, setResumeQueuedPendingSessionIds] = useState22(() => /* @__PURE__ */ new Set());
   const [resumeQueuedErrorsBySessionId, setResumeQueuedErrorsBySessionId] = useState22(() => /* @__PURE__ */ new Map());
   const resumeQueuedInFlightRef = useRef18(/* @__PURE__ */ new Map());
+  const resumeQueuedOwnerTokenBySessionIdRef = useRef18(/* @__PURE__ */ new Map());
+  const resumeQueuedSessionTokensRef = useRef18(/* @__PURE__ */ new WeakMap());
+  const resumeQueuedSessionTokenSeqRef = useRef18(0);
   const initialDraftGuard = useRef18(new InitialDraftAutoSubmitGuard());
   const pendingAutoSubmitSettleRef = useRef18(void 0);
   const acceptedAutoSubmitSettleRef = useRef18(void 0);
@@ -11407,13 +11464,30 @@ function PiChatPanel({
   const isPolicySessionActive = useCallback19(() => selectedPiSessionRef.current === selectedPiSession && activeChatIdentityRef.current === activeChatIdentity, [activeChatIdentity, selectedPiSession]);
   const resumeQueuedPending = Boolean(activeChatSessionId && resumeQueuedPendingSessionIds.has(activeChatSessionId));
   const resumeQueuedError = activeChatSessionId ? resumeQueuedErrorsBySessionId.get(activeChatSessionId) : void 0;
-  const chatScopeKey = `${externalSessionId ? "external" : "managed"}\0${agentTypeId}\0${storageScope ?? ""}`;
   useEffect23(() => {
+    if (!activeChatSessionId || !selectedPiSession) return;
+    let ownerToken = resumeQueuedSessionTokensRef.current.get(selectedPiSession);
+    if (ownerToken === void 0) {
+      ownerToken = ++resumeQueuedSessionTokenSeqRef.current;
+      resumeQueuedSessionTokensRef.current.set(selectedPiSession, ownerToken);
+    }
+    if (resumeQueuedOwnerTokenBySessionIdRef.current.get(activeChatSessionId) === ownerToken) return;
+    resumeQueuedOwnerTokenBySessionIdRef.current.set(activeChatSessionId, ownerToken);
     setQueueMutationPending(false);
-    setResumeQueuedPendingSessionIds(/* @__PURE__ */ new Set());
-    setResumeQueuedErrorsBySessionId(/* @__PURE__ */ new Map());
-    resumeQueuedInFlightRef.current.clear();
-  }, [chatScopeKey]);
+    setResumeQueuedPendingSessionIds((previous) => {
+      if (!previous.has(activeChatSessionId)) return previous;
+      const next = new Set(previous);
+      next.delete(activeChatSessionId);
+      return next;
+    });
+    setResumeQueuedErrorsBySessionId((previous) => {
+      if (!previous.has(activeChatSessionId)) return previous;
+      const next = new Map(previous);
+      next.delete(activeChatSessionId);
+      return next;
+    });
+    resumeQueuedInFlightRef.current.delete(activeChatSessionId);
+  }, [activeChatSessionId, selectedPiSession]);
   const warmupNotice = composerNoticeForWarmup(workspaceWarmupStatus);
   const runtimeDependenciesNotice = composerNoticeForRuntimeDependencies(workspaceWarmupStatus);
   const workspaceWarmupBlocked = Boolean(warmupNotice);
@@ -11888,6 +11962,7 @@ function PiChatPanel({
     const run = policy.resumeQueued();
     resumeQueuedInFlightRef.current.set(sessionId2, run);
     void run.catch((error) => {
+      if (resumeQueuedInFlightRef.current.get(sessionId2) !== run) return;
       setResumeQueuedErrorsBySessionId((previous) => new Map(previous).set(sessionId2, {
         id: errorNoticeId,
         level: "error",
@@ -12049,6 +12124,7 @@ function PiChatPanel({
       chrome,
       pickerPlacement: emptyHero ? "above-compact" : "above",
       isStreaming,
+      composerActivity,
       status,
       disabled,
       submitStatus,
@@ -12177,7 +12253,11 @@ function PiChatPanel({
                   },
                   onSuggestionSubmit: ({ text, files, source }) => sendComposerMessage({ text, files, source }),
                   onRestoreDraft: setComposerDraft,
-                  windowResetKey: activeSessionId
+                  windowResetKey: activeSessionId,
+                  renderMode,
+                  messagesOnlyVisibleTools,
+                  messagesOnlyHideCopyActions,
+                  messagesOnlyHiddenUserPrefixes
                 }
               ),
               composerSurface,
@@ -12350,6 +12430,385 @@ function scopedHeaders(headers, storageScope) {
   return result;
 }
 
+// src/front/settings/CredentialSettingsSurface.tsx
+import { useCallback as useCallback21, useEffect as useEffect25, useMemo as useMemo19, useRef as useRef19, useState as useState24 } from "react";
+import {
+  Button as Button12,
+  Input as Input2,
+  Label,
+  Notice,
+  SettingsPanel
+} from "@hachej/boring-ui-kit";
+import { ExternalLink, KeyRound } from "lucide-react";
+
+// src/front/settings/credentialSettingsClient.ts
+var STATES = /* @__PURE__ */ new Set([
+  "active",
+  "disabled",
+  "revoked",
+  "needs_reauth",
+  "intentionally_absent",
+  "instance_fallback_enabled",
+  "not_configured"
+]);
+function asRecord3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Credential service returned an invalid response");
+  return value;
+}
+function credentialMetadataFromResponse(value) {
+  const input = asRecord3(value);
+  if (typeof input.providerId !== "string" || typeof input.displayName !== "string" || typeof input.credentialType !== "string" || typeof input.state !== "string" || !STATES.has(input.state)) throw new Error("Credential service returned an invalid response");
+  const rawRevocation = input.oauthRevocation && typeof input.oauthRevocation === "object" ? asRecord3(input.oauthRevocation) : void 0;
+  const oauthRevocation = rawRevocation && rawRevocation.localStatus === "revoked" && ["pending", "confirmed"].includes(String(rawRevocation.upstreamStatus)) && typeof rawRevocation.attemptedAt === "string" ? {
+    localStatus: "revoked",
+    upstreamStatus: rawRevocation.upstreamStatus,
+    attemptedAt: rawRevocation.attemptedAt
+  } : void 0;
+  return {
+    providerId: input.providerId,
+    displayName: input.displayName,
+    credentialType: input.credentialType,
+    state: input.state,
+    ...typeof input.credentialVersion === "number" ? { credentialVersion: input.credentialVersion } : {},
+    ...typeof input.maskedLastFourSuffix === "string" ? { maskedLastFourSuffix: input.maskedLastFourSuffix.slice(-4) } : {},
+    ...typeof input.createdAt === "string" ? { createdAt: input.createdAt } : {},
+    ...typeof input.updatedAt === "string" ? { updatedAt: input.updatedAt } : {},
+    ...oauthRevocation ? { oauthRevocation } : {}
+  };
+}
+function oauthFlowFromResponse(value) {
+  const input = asRecord3(value);
+  if (typeof input.flowId !== "string" || input.providerId !== "openai-codex" || !["pending", "succeeded", "failed", "cancelled"].includes(String(input.status)) || !Array.isArray(input.events)) throw new Error("Credential service returned an invalid sign-in response");
+  const events = [];
+  for (const candidate of input.events) {
+    const event = asRecord3(candidate);
+    if (event.type === "progress") events.push({ type: "progress" });
+    if (event.type === "auth_url" && typeof event.url === "string" && event.url.startsWith("https://")) {
+      events.push({ type: "auth_url", url: event.url });
+    }
+    if (event.type === "device_code" && typeof event.userCode === "string" && typeof event.verificationUri === "string" && event.verificationUri.startsWith("https://")) {
+      events.push({
+        type: "device_code",
+        userCode: event.userCode,
+        verificationUri: event.verificationUri,
+        ...typeof event.expiresInSeconds === "number" ? { expiresInSeconds: event.expiresInSeconds } : {}
+      });
+    }
+  }
+  let prompt;
+  if (input.prompt && typeof input.prompt === "object") {
+    const rawPrompt = asRecord3(input.prompt);
+    if (typeof rawPrompt.type === "string") {
+      prompt = {
+        type: rawPrompt.type,
+        ...Array.isArray(rawPrompt.options) ? {
+          options: rawPrompt.options.flatMap((option) => {
+            const item = asRecord3(option);
+            return typeof item.id === "string" && typeof item.label === "string" ? [{ id: item.id, label: item.label }] : [];
+          })
+        } : {}
+      };
+    }
+  }
+  return {
+    flowId: input.flowId,
+    providerId: "openai-codex",
+    status: input.status,
+    events,
+    ...prompt ? { prompt } : {}
+  };
+}
+function createCredentialSettingsClient(apiBaseUrl = "", fetchImpl = fetch, requestHeaders) {
+  const base = apiBaseUrl.replace(/\/$/, "");
+  const request = async (path, init) => {
+    const response = await fetchImpl(`${base}${path}`, {
+      credentials: "include",
+      ...init,
+      headers: {
+        ...requestHeaders,
+        ...init?.body ? { "Content-Type": "application/json" } : {},
+        ...init?.headers
+      }
+    });
+    if (!response.ok) throw new Error(response.status === 403 ? "Only workspace owners can manage credentials." : "Credential operation failed. Try again.");
+    return response.status === 204 ? void 0 : response.json();
+  };
+  const metadataAction = async (providerId, suffix, method) => credentialMetadataFromResponse(await request(`/api/v1/credentials/${encodeURIComponent(providerId)}${suffix}`, { method }));
+  return {
+    async list() {
+      const payload = asRecord3(await request("/api/v1/credentials"));
+      if (!Array.isArray(payload.credentials)) throw new Error("Credential service returned an invalid response");
+      return payload.credentials.map(credentialMetadataFromResponse);
+    },
+    async putApiKey(providerId, apiKey) {
+      return credentialMetadataFromResponse(await request(`/api/v1/credentials/${encodeURIComponent(providerId)}`, {
+        method: "PUT",
+        body: JSON.stringify({ fields: { "api-key": apiKey } })
+      }));
+    },
+    disable: (providerId) => metadataAction(providerId, "/disable", "POST"),
+    revoke: (providerId) => metadataAction(providerId, "/revoke", "POST"),
+    delete: (providerId) => metadataAction(providerId, "", "DELETE"),
+    async startCodexLogin() {
+      return oauthFlowFromResponse(await request("/api/v1/credentials/openai-codex/oauth", { method: "POST" }));
+    },
+    async getCodexLogin(flowId) {
+      return oauthFlowFromResponse(await request(`/api/v1/credentials/openai-codex/oauth/${encodeURIComponent(flowId)}`));
+    },
+    async respondToCodexLogin(flowId, value) {
+      return oauthFlowFromResponse(await request(`/api/v1/credentials/openai-codex/oauth/${encodeURIComponent(flowId)}/respond`, {
+        method: "POST",
+        body: JSON.stringify({ value })
+      }));
+    },
+    async cancelCodexLogin(flowId) {
+      await request(`/api/v1/credentials/openai-codex/oauth/${encodeURIComponent(flowId)}`, { method: "DELETE" });
+    }
+  };
+}
+
+// src/front/settings/CredentialSettingsSurface.tsx
+import { Fragment as Fragment14, jsx as jsx36, jsxs as jsxs32 } from "react/jsx-runtime";
+function statusLabel(credential) {
+  const labels = {
+    active: "Connected",
+    disabled: "Disabled",
+    revoked: "Revoked",
+    needs_reauth: "Sign-in required",
+    intentionally_absent: "Deleted",
+    instance_fallback_enabled: "Instance fallback",
+    not_configured: "Not connected"
+  };
+  return labels[credential.state] ?? "Unavailable";
+}
+function updatedLabel(value) {
+  if (!value) return void 0;
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? void 0 : date.toLocaleString();
+}
+function CredentialSettingsSurfaceForWorkspace({
+  isWorkspaceOwner,
+  workspaceId,
+  apiBaseUrl = "",
+  client: suppliedClient
+}) {
+  const client = useMemo19(
+    () => suppliedClient ?? createCredentialSettingsClient(
+      apiBaseUrl,
+      fetch,
+      workspaceId ? { "x-boring-workspace-id": workspaceId } : void 0
+    ),
+    [apiBaseUrl, suppliedClient, workspaceId]
+  );
+  const [credentials, setCredentials] = useState24([]);
+  const [loading, setLoading] = useState24(true);
+  const [busyProvider, setBusyProvider] = useState24(null);
+  const [error, setError] = useState24(null);
+  const [success, setSuccess] = useState24(null);
+  const [confirmDelete, setConfirmDelete] = useState24(null);
+  const [oauthFlow, setOauthFlow] = useState24(null);
+  const oauthRequestEpoch = useRef19(0);
+  const load = useCallback21(async () => {
+    setError(null);
+    try {
+      setCredentials(await client.list());
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : "Could not load workspace credentials.");
+    } finally {
+      setLoading(false);
+    }
+  }, [client]);
+  useEffect25(() => {
+    if (!isWorkspaceOwner) return;
+    void load();
+  }, [isWorkspaceOwner, load]);
+  useEffect25(() => {
+    if (!oauthFlow || oauthFlow.status !== "pending") return;
+    const epoch = ++oauthRequestEpoch.current;
+    const timer = window.setTimeout(() => {
+      void client.getCodexLogin(oauthFlow.flowId).then((flow) => {
+        if (oauthRequestEpoch.current !== epoch) return;
+        setOauthFlow(flow);
+        if (flow.status === "succeeded") {
+          setSuccess("OpenAI Codex is connected for this workspace. New sessions can use it.");
+          void load();
+        } else if (flow.status === "failed") {
+          setError("OpenAI Codex sign-in did not complete. Try again.");
+        }
+      }).catch(() => {
+        if (oauthRequestEpoch.current === epoch) setError("Could not refresh OpenAI Codex sign-in.");
+      });
+    }, 750);
+    return () => {
+      window.clearTimeout(timer);
+      if (oauthRequestEpoch.current === epoch) oauthRequestEpoch.current += 1;
+    };
+  }, [client, load, oauthFlow]);
+  if (!isWorkspaceOwner) return null;
+  const updateCredential = (next) => {
+    setCredentials((current) => current.map((item) => item.providerId === next.providerId ? next : item));
+  };
+  const submitApiKey = async (event, credential) => {
+    event.preventDefault();
+    if (credential.providerId === "openai-codex" && oauthFlow?.status === "pending") return;
+    const form = event.currentTarget;
+    const apiKey = String(new FormData(form).get("api-key") ?? "");
+    form.reset();
+    if (!apiKey) {
+      setError("Enter an API key before saving.");
+      return;
+    }
+    setError(null);
+    setSuccess(null);
+    setBusyProvider(credential.providerId);
+    try {
+      updateCredential(await client.putApiKey(credential.providerId, apiKey));
+      setSuccess(`${credential.displayName} API key saved. New sessions use this workspace credential.`);
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : "Could not save the API key.");
+    } finally {
+      setBusyProvider(null);
+    }
+  };
+  const lifecycle = async (credential, action) => {
+    if (credential.providerId === "openai-codex" && oauthFlow?.status === "pending") return;
+    setError(null);
+    setSuccess(null);
+    setBusyProvider(credential.providerId);
+    try {
+      updateCredential(await client[action](credential.providerId));
+      setSuccess(`${credential.displayName} ${action === "delete" ? "deleted" : `${action}d`}.`);
+      setConfirmDelete(null);
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : "Credential operation failed.");
+    } finally {
+      setBusyProvider(null);
+    }
+  };
+  const startCodex = async () => {
+    oauthRequestEpoch.current += 1;
+    setError(null);
+    setSuccess(null);
+    setBusyProvider("openai-codex");
+    try {
+      setOauthFlow(await client.startCodexLogin());
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : "Could not start OpenAI Codex sign-in.");
+    } finally {
+      setBusyProvider(null);
+    }
+  };
+  const respondToPrompt = async (event) => {
+    event.preventDefault();
+    if (!oauthFlow) return;
+    const form = event.currentTarget;
+    const value = String(new FormData(form).get("oauth-response") ?? "");
+    form.reset();
+    if (!value) return;
+    try {
+      setOauthFlow(await client.respondToCodexLogin(oauthFlow.flowId, value));
+    } catch {
+      setError("OpenAI Codex could not accept that response. Try again.");
+    }
+  };
+  const cancelCodex = async () => {
+    if (!oauthFlow) return;
+    oauthRequestEpoch.current += 1;
+    setBusyProvider("openai-codex");
+    try {
+      await client.cancelCodexLogin(oauthFlow.flowId);
+      setOauthFlow(null);
+    } catch {
+      setError("Could not cancel OpenAI Codex sign-in. The flow is still pending.");
+      setOauthFlow((flow) => flow ? { ...flow } : flow);
+    } finally {
+      setBusyProvider(null);
+    }
+  };
+  return /* @__PURE__ */ jsx36(
+    SettingsPanel,
+    {
+      id: "credentials",
+      icon: /* @__PURE__ */ jsx36(KeyRound, { className: "h-3.5 w-3.5", "aria-hidden": "true" }),
+      title: "AI provider credentials",
+      description: "Choose how this workspace funds AI sessions. Keys and tokens are write-only and are never shown again.",
+      children: /* @__PURE__ */ jsxs32("div", { className: "space-y-4", children: [
+        error && /* @__PURE__ */ jsx36(Notice, { role: "alert", tone: "error", description: error }),
+        success && /* @__PURE__ */ jsx36(Notice, { role: "status", tone: "success", description: success }),
+        loading && /* @__PURE__ */ jsx36("p", { className: "text-[13px] text-muted-foreground", children: "Loading providers\u2026" }),
+        !loading && credentials.length === 0 && !error && /* @__PURE__ */ jsx36("p", { className: "text-[13px] text-muted-foreground", children: "No credential providers are available in this deployment." }),
+        /* @__PURE__ */ jsx36("div", { className: "divide-y divide-border/50 rounded-md border border-border/60", children: credentials.map((credential) => {
+          const connected = credential.state === "active";
+          const busy = busyProvider === credential.providerId;
+          const isCodex = credential.providerId === "openai-codex";
+          const codexPending = isCodex && oauthFlow?.status === "pending";
+          return /* @__PURE__ */ jsxs32("section", { "aria-labelledby": `credential-${credential.providerId}`, className: "space-y-3 p-4", children: [
+            /* @__PURE__ */ jsxs32("div", { className: "flex flex-wrap items-start justify-between gap-2", children: [
+              /* @__PURE__ */ jsxs32("div", { children: [
+                /* @__PURE__ */ jsx36("h3", { id: `credential-${credential.providerId}`, className: "text-[13px] font-medium text-foreground", children: credential.displayName }),
+                /* @__PURE__ */ jsxs32("p", { className: "text-[12px] text-muted-foreground", children: [
+                  statusLabel(credential),
+                  credential.maskedLastFourSuffix ? ` \xB7 ends in ${credential.maskedLastFourSuffix}` : "",
+                  credential.credentialVersion ? ` \xB7 v${credential.credentialVersion}` : ""
+                ] }),
+                updatedLabel(credential.updatedAt) && /* @__PURE__ */ jsxs32("p", { className: "text-[11px] text-muted-foreground", children: [
+                  "Updated ",
+                  updatedLabel(credential.updatedAt)
+                ] })
+              ] }),
+              connected && /* @__PURE__ */ jsx36("span", { className: "rounded-full bg-emerald-500/10 px-2 py-0.5 text-[11px] font-medium text-emerald-700 dark:text-emerald-300", children: "Workspace funded" })
+            ] }),
+            !isCodex ? /* @__PURE__ */ jsxs32("form", { className: "flex flex-col gap-2 sm:flex-row sm:items-end", onSubmit: (event) => void submitApiKey(event, credential), children: [
+              /* @__PURE__ */ jsxs32("div", { className: "min-w-0 flex-1 space-y-1.5", children: [
+                /* @__PURE__ */ jsx36(Label, { htmlFor: `api-key-${credential.providerId}`, className: "text-[12px]", children: "API key" }),
+                /* @__PURE__ */ jsx36(Input2, { id: `api-key-${credential.providerId}`, name: "api-key", type: "password", autoComplete: "new-password", className: "h-8 text-[13px]", placeholder: connected ? "Enter a replacement key" : "Paste API key" })
+              ] }),
+              /* @__PURE__ */ jsx36(Button12, { type: "submit", size: "sm", disabled: busy || codexPending, children: busy ? "Saving\u2026" : connected ? "Replace key" : "Connect" })
+            ] }) : /* @__PURE__ */ jsxs32("div", { className: "space-y-1.5", children: [
+              /* @__PURE__ */ jsx36("p", { className: "text-[12px] font-medium text-foreground", children: "Workspace funding method: OpenAI Codex sign-in" }),
+              /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", onClick: () => void startCodex(), disabled: busy || codexPending, children: oauthFlow?.status === "pending" ? "Sign-in pending\u2026" : connected ? "Sign in again" : "Sign in with OpenAI Codex" })
+            ] }),
+            isCodex && oauthFlow && /* @__PURE__ */ jsxs32("div", { className: "space-y-3 rounded-md bg-muted/40 p-3", "aria-live": "polite", children: [
+              /* @__PURE__ */ jsxs32("p", { className: "text-[12px] font-medium", children: [
+                "OpenAI Codex sign-in: ",
+                oauthFlow.status
+              ] }),
+              oauthFlow.events.map((event, index) => event.type === "auth_url" ? /* @__PURE__ */ jsxs32("a", { href: event.url, target: "_blank", rel: "noreferrer", className: "inline-flex items-center gap-1 text-[12px] underline", children: [
+                "Open authorization page ",
+                /* @__PURE__ */ jsx36(ExternalLink, { className: "h-3 w-3", "aria-hidden": "true" })
+              ] }, `${event.type}-${index}`) : event.type === "device_code" ? /* @__PURE__ */ jsxs32("div", { className: "text-[12px]", children: [
+                /* @__PURE__ */ jsxs32("p", { children: [
+                  "Enter code ",
+                  /* @__PURE__ */ jsx36("strong", { className: "font-mono", children: event.userCode })
+                ] }),
+                /* @__PURE__ */ jsx36("a", { href: event.verificationUri, target: "_blank", rel: "noreferrer", className: "underline", children: "Open device verification" })
+              ] }, `${event.type}-${index}`) : null),
+              oauthFlow.prompt?.options ? /* @__PURE__ */ jsx36("div", { className: "flex flex-wrap gap-2", children: oauthFlow.prompt.options.map((option) => /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "outline", onClick: () => void client.respondToCodexLogin(oauthFlow.flowId, option.id).then(setOauthFlow), children: option.label }, option.id)) }) : oauthFlow.prompt ? /* @__PURE__ */ jsxs32("form", { onSubmit: (event) => void respondToPrompt(event), className: "flex gap-2", children: [
+                /* @__PURE__ */ jsx36(Label, { htmlFor: "oauth-response", className: "sr-only", children: "Authorization response" }),
+                /* @__PURE__ */ jsx36(Input2, { id: "oauth-response", name: "oauth-response", type: oauthFlow.prompt.type === "password" ? "password" : "text", autoComplete: "off", className: "h-8 text-[13px]", placeholder: "Paste the authorization response" }),
+                /* @__PURE__ */ jsx36(Button12, { type: "submit", size: "sm", children: "Continue" })
+              ] }) : null,
+              oauthFlow.status === "pending" && /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "outline", disabled: busy, onClick: () => void cancelCodex(), children: "Cancel sign-in" })
+            ] }),
+            credential.state !== "not_configured" && credential.state !== "intentionally_absent" && /* @__PURE__ */ jsxs32("div", { className: "flex flex-wrap gap-2 border-t border-border/40 pt-3", children: [
+              /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "outline", disabled: busy || codexPending || credential.state === "disabled", onClick: () => void lifecycle(credential, "disable"), children: "Disable" }),
+              /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "outline", disabled: busy || codexPending || credential.state === "revoked", onClick: () => void lifecycle(credential, "revoke"), children: "Revoke" }),
+              confirmDelete === credential.providerId ? /* @__PURE__ */ jsxs32(Fragment14, { children: [
+                /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "destructive", disabled: busy || codexPending, onClick: () => void lifecycle(credential, "delete"), children: "Confirm delete" }),
+                /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "outline", onClick: () => setConfirmDelete(null), children: "Cancel" })
+              ] }) : /* @__PURE__ */ jsx36(Button12, { type: "button", size: "sm", variant: "destructive", disabled: busy || codexPending, onClick: () => setConfirmDelete(credential.providerId), children: "Delete" })
+            ] })
+          ] }, credential.providerId);
+        }) }),
+        /* @__PURE__ */ jsx36("p", { className: "text-[12px] leading-5 text-muted-foreground", children: "Changes apply to new sessions. Existing sessions keep the credential they started with." })
+      ] })
+    }
+  );
+}
+function CredentialSettingsSurface(props) {
+  return /* @__PURE__ */ jsx36(CredentialSettingsSurfaceForWorkspace, { ...props }, props.workspaceId ?? "unscoped");
+}
+
 // src/front/commands.ts
 var AGENT_COMMAND_SOURCE = "agent";
 function getAgentCommands(options = {}) {
@@ -12400,6 +12859,7 @@ export {
   Conversation,
   ConversationContent,
   ConversationScrollButton,
+  CredentialSettingsSurface,
   DebugDrawer,
   GatewayResponseError,
   Message,
@@ -12429,6 +12889,7 @@ export {
   builtinCommands,
   cn,
   createCommandRegistry,
+  createCredentialSettingsClient,
   defaultChatSuggestions,
   defaultToolRenderers,
   errorResponseCode,