@jameslovespancakes/pi-plus 1.0.12 → 1.0.14

package/src/domains/workflows/runtime/agent-workspace.ts

@@ -1,11 +1,9 @@
 import type { AgentExecutionOptions, AgentProgress } from "./agent-runner-types.ts";
-import { unknownErrorMessage } from "./unknown-error.ts";
 import type { WorktreeRegistry } from "./worktree.ts";
 
 interface AgentWorkspaceBase {
   readonly cwd: string;
   wrapResult(result: unknown): Promise<unknown>;
-  dispose(): Promise<void>;
 }
 
 export interface SharedAgentWorkspace extends AgentWorkspaceBase {
@@ -39,7 +37,6 @@ export async function createAgentWorkspace(
       async wrapResult(result) {
         return result;
       },
-      async dispose() {},
     };
   }
 
@@ -78,26 +75,5 @@ export async function createAgentWorkspace(
       if ("error" in patch) throw new Error(`Failed to capture isolated worktree patch: ${patch.error}`);
       return { result, patch: patch.patch, changed: patch.changed, baselineOid: added.baselineOid };
     },
-    async dispose() {
-      const removed = await rc.worktrees.remove(worktreePath);
-      if (!removed.ok) {
-        rc.progress.log(
-          `${label}: failed to remove isolated worktree (${removed.error ?? (removed.stderr.trim() || "unknown error")})`,
-        );
-      }
-    },
   };
 }
-
-export async function disposeAgentWorkspace(
-  rc: Pick<AgentWorkspaceContext, "progress">,
-  label: string,
-  workspace: AgentWorkspace | undefined,
-): Promise<void> {
-  if (!workspace) return;
-  try {
-    await workspace.dispose();
-  } catch (error) {
-    rc.progress.log(`${label}: failed to dispose isolated workspace (${unknownErrorMessage(error)})`);
-  }
-}

package/src/domains/workflows/runtime/engine.ts

@@ -210,6 +210,16 @@ export async function runResolvedWorkflow(
     );
   });
 
+  const workflowPause = workflowOutcome.ok
+    ? undefined
+    : backgroundPauseError(workflowOutcome.error, ctx.signal, resolvedOptions.signal);
+  const willPauseWorkflow = workflowPause !== undefined
+    && (!(workflowPause instanceof WorkflowProviderUsageLimitError) || resolvedOptions.background !== undefined);
+  const preserveFailedWorktrees = !workflowOutcome.ok
+    && !willPauseWorkflow
+    && !ctx.signal?.aborted
+    && !resolvedOptions.signal?.aborted;
+  if (preserveFailedWorktrees) worktrees.preserveRecoverable();
   const finalizationOutcome = await captureOutcome(() =>
     finalizeWorkflowRun({
       cwd: ctx.cwd,
@@ -219,9 +229,14 @@ export async function runResolvedWorkflow(
       progress,
       runStore,
       worktrees,
+      preserveWorktrees: preserveFailedWorktrees,
       unlinkSignals: [unlinkContextAbortSignal, unlinkOptionAbortSignal],
     }),
   );
+  const retainedPaths = preserveFailedWorktrees ? worktrees.preservedPaths : [];
+  const terminalWorkflowError = workflowOutcome.ok
+    ? undefined
+    : withRetainedWorktrees(workflowOutcome.error, retainedPaths);
 
   if (workflowOutcome.ok && finalizationOutcome.ok) {
     durableRun.transition({
@@ -232,16 +247,16 @@ export async function runResolvedWorkflow(
     });
   } else if (!workflowOutcome.ok) {
     const error = finalizationOutcome.ok
-      ? workflowOutcome.error
-      : combinedWorkflowError(workflowOutcome.error, finalizationOutcome.error);
-    persistTerminalWorkflowError(error);
+      ? terminalWorkflowError!
+      : combinedWorkflowError(terminalWorkflowError!, finalizationOutcome.error);
+    persistTerminalWorkflowError(error, workflowOutcome.error);
   } else if (!finalizationOutcome.ok) {
     persistTerminalWorkflowError(finalizationOutcome.error);
   }
   await durableRun.flush().catch(() => undefined);
 
-  function persistTerminalWorkflowError(error: unknown): void {
-    const pauseError = backgroundPauseError(error, ctx.signal, resolvedOptions.signal);
+  function persistTerminalWorkflowError(error: unknown, pauseCandidate: unknown = error): void {
+    const pauseError = backgroundPauseError(pauseCandidate, ctx.signal, resolvedOptions.signal);
     if (pauseError) {
       if (pauseError instanceof WorkflowProviderUsageLimitError) {
         if (resolvedOptions.background === undefined) {
@@ -284,8 +299,8 @@ export async function runResolvedWorkflow(
     if (finalizationOutcome.ok) return workflowOutcome.value;
     throw finalizationOutcome.error;
   }
-  if (finalizationOutcome.ok) throw workflowOutcome.error;
-  throw combinedWorkflowError(workflowOutcome.error, finalizationOutcome.error);
+  if (finalizationOutcome.ok) throw terminalWorkflowError;
+  throw combinedWorkflowError(terminalWorkflowError, finalizationOutcome.error);
 }
 
 function backgroundPauseError(error: unknown, ...signals: Array<AbortSignal | undefined>): unknown {
@@ -314,6 +329,7 @@ interface WorkflowFinalizationInput {
   readonly progress: ProgressTracker;
   readonly runStore: WorkflowRunStore;
   readonly worktrees: WorktreeRegistry;
+  readonly preserveWorktrees: boolean;
   readonly unlinkSignals: readonly (() => void)[];
 }
 
@@ -340,11 +356,22 @@ async function finalizeWorkflowRun(input: WorkflowFinalizationInput): Promise<vo
         criticality: "required" as const,
         run,
       })),
-      {
-        name: "worktree cleanup",
-        criticality: "required",
-        run: () => input.worktrees.removeAll(),
-      },
+      input.preserveWorktrees
+        ? {
+            name: "worktree cleanup and retention",
+            criticality: "required",
+            run: async () => {
+              await input.worktrees.removeUnpreserved();
+              for (const path of input.worktrees.preservedPaths) {
+                input.progress.log(`retained failed workflow worktree: ${path}`);
+              }
+            },
+          }
+        : {
+            name: "worktree cleanup",
+            criticality: "required",
+            run: () => input.worktrees.removeAll(),
+          },
       { name: "journal pruning", criticality: "best-effort", run: () => pruneWorkflowJournals(input.cwd) },
       { name: "run record pruning", criticality: "best-effort", run: () => input.runStore.prune() },
       { name: "progress completion", criticality: "best-effort", run: () => input.progress.done() },
@@ -371,6 +398,15 @@ async function finalizeWorkflowRun(input: WorkflowFinalizationInput): Promise<vo
   );
 }
 
+function withRetainedWorktrees(error: unknown, paths: readonly string[]): unknown {
+  if (paths.length === 0) return error;
+  const locations = paths.map((path) => `- ${path}`).join("\n");
+  return new Error(
+    `${unknownErrorMessage(error)}\n\nFailed workflow worktree${paths.length === 1 ? "" : "s"} retained for recovery:\n${locations}`,
+    { cause: error },
+  );
+}
+
 function combinedWorkflowError(workflowError: unknown, finalizationError: unknown): AggregateError {
   return new AggregateError(
     [workflowError, finalizationError],

package/src/domains/workflows/runtime/progress.ts

@@ -4,7 +4,7 @@ import type { AgentChatMessage, AgentChatRole, AgentRowStatus, WorkflowLaneItemS
 import { formatWorkflowUsageLine, type WorkflowUsageSnapshot } from "./usage.ts";
 import { unknownErrorMessage } from "./unknown-error.ts";
 import { statusTextFromCounts, type WorkflowStatusCounts } from "./ui/workflow-format.ts";
-import { toDisplayLine } from "./ui/display-text.ts";
+import { toDisplayLine, toDisplayText } from "./ui/display-text.ts";
 import { renderWorkflowWidgetLines } from "./ui/workflow-widget.ts";
 
 export type {
@@ -304,7 +304,7 @@ export class ProgressTracker {
   }
 
   private appendAgentChat(id: number, role: AgentChatRole, text: string): void {
-    const value = toDisplayLine(text, AGENT_CHAT_TEXT_LIMIT);
+    const value = toDisplayText(text, AGENT_CHAT_TEXT_LIMIT);
     if (!value) return;
     const messages = this.agentChats.get(id) ?? [];
     messages.push({ role, text: value, createdAt: Date.now() });

package/src/domains/workflows/runtime/types.ts

@@ -143,7 +143,7 @@ export interface AgentOptions<S extends TSchema = TSchema> {
   /**
    * Resume policy for this call. Shared-workspace agents run live unless they
    * explicitly declare themselves read-only. Those calls bind replay to the full
-   * Git-visible workspace; isolated agents bind to their disposable baseline.
+   * Git-visible workspace; isolated agents bind to their isolated baseline.
    * Use "off" to disable both journal reads and writes.
    */
   resume?: AgentResumePolicy;
@@ -154,7 +154,7 @@ export interface AgentOptions<S extends TSchema = TSchema> {
    * `resume: "off"` when their bounded contents cannot be captured.
    */
   resumeInputs?: readonly string[];
-  /** Run this agent in a disposable git worktree and return its patch with the result. */
+  /** Run in an isolated git worktree. Successful runs clean it up; failed runs retain it for recovery. */
   isolation?: "worktree";
   /** Apply a captured candidate to a fresh isolated baseline before evaluation. */
   candidatePatch?: { readonly baselineOid: string; readonly patch: string };
@@ -187,12 +187,12 @@ export interface AgentOptions<S extends TSchema = TSchema> {
  * exports `meta` plus a default `async (api: WorkflowApi) => result`.
  */
 export interface WorkflowApi {
-  /** Run a schema subagent in a disposable worktree and return its structured result plus patch. */
+  /** Run a schema subagent in an isolated worktree and return its structured result plus patch. */
   agent<S extends TSchema>(
     prompt: string,
     opts: AgentOptions<S> & { schema: S; isolation: "worktree" },
   ): Promise<IsolatedAgentResult<Static<S>>>;
-  /** Run a text subagent in a disposable worktree and return its final text plus patch. */
+  /** Run a text subagent in an isolated worktree and return its final text plus patch. */
   agent(prompt: string, opts: AgentOptions & { isolation: "worktree" }): Promise<IsolatedAgentResult<string>>;
   /** Run a subagent and return validated structured output; rejects with a recoverable typed error on repair exhaustion. */
   agent<S extends TSchema>(prompt: string, opts: AgentOptions<S> & { schema: S }): Promise<Static<S>>;

package/src/domains/workflows/runtime/ui/display-text.ts

@@ -1,5 +1,6 @@
 const ANSI_PATTERN = /\u001B\[[0-9;?]*[ -/]*[@-~]/g;
 const CONTROL_PATTERN = /[\u0000-\u001F\u007F]/g;
+const MULTILINE_CONTROL_PATTERN = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g;
 
 /** Flattens arbitrary text into one stable, printable row. */
 export function toDisplayLine(text: string, maxLength = 120): string {
@@ -11,3 +12,17 @@ export function toDisplayLine(text: string, maxLength = 120): string {
   if (maxLength <= 0 || flat.length <= maxLength) return flat;
   return `${flat.slice(0, Math.max(1, maxLength - 1)).trimEnd()}…`;
 }
+
+/** Sanitizes chat content while preserving the line breaks and Markdown shown by Pi. */
+export function toDisplayText(text: string, maxLength = 2_000): string {
+  const value = text
+    .replace(ANSI_PATTERN, "")
+    .replace(/\r\n?/g, "\n")
+    .replace(MULTILINE_CONTROL_PATTERN, " ")
+    .split("\n")
+    .map((line) => line.replace(/\t/g, "  ").trimEnd())
+    .join("\n")
+    .trim();
+  if (maxLength <= 0 || value.length <= maxLength) return value;
+  return `${value.slice(0, Math.max(1, maxLength - 1)).trimEnd()}…`;
+}

package/src/domains/workflows/runtime/ui/workflow-inspector.ts

@@ -1,8 +1,12 @@
 import type { Theme } from "@earendil-works/pi-coding-agent";
 import {
+  Box,
   Input,
+  Markdown,
   matchesKey,
+  Text,
   type Focusable,
+  type MarkdownTheme,
   type TUI,
   type TuiMouseEvent,
   type TuiMouseEventResult,
@@ -71,7 +75,7 @@ export class WorkflowInspector implements Focusable {
     this.outcome = outcome;
     this.live = live;
     this.input = new Input({
-      prompt: "› ",
+      prompt: this.theme.fg("accent", "› "),
       placeholder: "Send a follow-up to this agent…",
       placeholderStyle: (text) => this.theme.fg("dim", text),
     });
@@ -321,11 +325,52 @@ export class WorkflowInspector implements Focusable {
   }
 
   private chatMessageRows(message: AgentChatMessage, width: number): string[] {
-    const label = chatLabel(message);
-    const timestamp = new Date(message.createdAt).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", hour12: false });
-    const color = message.role === "status" ? "error" : message.role === "user" ? "accent" : message.role === "tool" ? "muted" : "text";
-    const prefix = `${this.theme.fg("dim", timestamp)}  ${this.theme.fg(color, label.padEnd(6))} `;
-    return wrapTextWithAnsi(`${prefix}${message.text}`, Math.max(1, width - 1)).map((line) => ` ${line}`);
+    if (message.role === "task" || message.role === "user") {
+      const box = new Box(1, 1, (text) => this.theme.bg("userMessageBg", text));
+      box.addChild(new Markdown(
+        message.text,
+        0,
+        0,
+        this.markdownTheme(),
+        { color: (text) => this.theme.fg("userMessageText", text) },
+        { preserveOrderedListMarkers: true, preserveBackslashEscapes: true },
+      ));
+      return box.render(width);
+    }
+
+    if (message.role === "assistant") {
+      return ["", ...new Markdown(message.text, 1, 0, this.markdownTheme()).render(width)];
+    }
+
+    if (message.role === "tool") {
+      const box = new Box(1, 0, (text) => this.theme.bg("toolPendingBg", text));
+      box.addChild(new Text(this.theme.fg("toolTitle", this.theme.bold(message.text)), 0, 0));
+      return box.render(width);
+    }
+
+    return [
+      "",
+      ...new Text(this.theme.fg("error", message.text), 1, 0).render(width),
+    ];
+  }
+
+  private markdownTheme(): MarkdownTheme {
+    return {
+      heading: (text) => this.theme.fg("mdHeading", text),
+      link: (text) => this.theme.fg("mdLink", text),
+      linkUrl: (text) => this.theme.fg("mdLinkUrl", text),
+      code: (text) => this.theme.fg("mdCode", text),
+      codeBlock: (text) => this.theme.fg("mdCodeBlock", text),
+      codeBlockBorder: (text) => this.theme.fg("mdCodeBlockBorder", text),
+      quote: (text) => this.theme.fg("mdQuote", text),
+      quoteBorder: (text) => this.theme.fg("mdQuoteBorder", text),
+      hr: (text) => this.theme.fg("mdHr", text),
+      listBullet: (text) => this.theme.fg("mdListBullet", text),
+      bold: (text) => this.theme.bold(text),
+      italic: (text) => this.theme.italic(text),
+      strikethrough: (text) => this.theme.strikethrough(text),
+      underline: (text) => this.theme.underline(text),
+    };
   }
 
   private agentRow(entry: BoardAgent, index: number, width: number): string {
@@ -375,14 +420,6 @@ export class WorkflowInspector implements Focusable {
   }
 }
 
-function chatLabel(message: AgentChatMessage): string {
-  if (message.role === "task") return "Task";
-  if (message.role === "user") return "You";
-  if (message.role === "assistant") return "Agent";
-  if (message.role === "tool") return "Tool";
-  return "Status";
-}
-
 function shortModel(model: string): string {
   return model.replace(/^openai-codex\//, "codex/").replace(/^anthropic\//, "");
 }

package/src/domains/workflows/runtime/ui/workflow-viewer-layout.ts

@@ -1,16 +1,16 @@
 import { truncateToWidth } from "@earendil-works/pi-tui";
 
-const VIEWPORT_HEIGHT_RATIO = 0.8;
-const VIEWPORT_MARGIN_ROWS = 2;
+const VIEWPORT_HEIGHT_RATIO = 0.7;
+const VIEWPORT_MARGIN_ROWS = 4;
 
 export const WORKFLOW_VIEWER_OVERLAY_OPTIONS = {
   overlay: true,
   overlayOptions: {
     anchor: "center",
-    width: "80%",
-    minWidth: 40,
-    maxHeight: "80%",
-    margin: 1,
+    width: "70%",
+    minWidth: 48,
+    maxHeight: "70%",
+    margin: 2,
   },
 } as const;
 

package/src/domains/workflows/runtime/workflow-run-history.ts

@@ -100,7 +100,9 @@ export function formatWorkflowRunDetails(
   now = Date.now(),
 ): string {
   const agents = record.progress.phases.flatMap((phase) =>
-    phase.agents.map((agent) => `${phase.title} / ${agent.label}: ${agent.status}`)
+    phase.agents.map((agent) =>
+      `${phase.title} / ${agent.label}: ${agent.status}${agent.error ? ` — ${agent.error}` : ""}`
+    )
   );
   const shownAgents = agents.slice(0, WORKFLOW_RUN_DETAIL_AGENT_LIMIT);
   const usage = formatWorkflowUsageLine(record.usage);

package/src/domains/workflows/runtime/workflow-run-record.ts

@@ -279,6 +279,7 @@ function compactWorkflowProgress(snapshot: WorkflowProgressSnapshot): WorkflowPr
         doneAt: agent.doneAt,
         toolUses: agent.toolUses,
         lastTool: agent.lastTool === undefined ? undefined : boundedText(agent.lastTool),
+        error: agent.error === undefined ? undefined : boundedText(agent.error),
       }));
       remainingAgents -= agents.length;
       return { title: boundedText(phase.title), agents };

package/src/domains/workflows/runtime/worktree.ts

@@ -106,6 +106,8 @@ let pathCounter = 0;
 export class WorktreeRegistry {
   private readonly paths = new Set<string>();
   private readonly snapshots = new Set<string>();
+  private readonly recoverable = new Set<string>();
+  private readonly preserved = new Set<string>();
   private readonly removals = new Map<string, Promise<WorktreeGitCommandResult>>();
   private readonly repoCwd: string;
   private readonly runner: WorktreeGitRunner;
@@ -123,10 +125,31 @@ export class WorktreeRegistry {
     return this.paths.size;
   }
 
+  /** Failed worktrees retained for manual recovery. */
+  get preservedPaths(): readonly string[] {
+    return [...this.preserved].filter((path) => this.paths.has(path)).sort();
+  }
+
   register(path: string): void {
     this.paths.add(path);
   }
 
+  /** Marks a worktree where a live agent could have produced useful edits. */
+  markRecoverable(path: string): void {
+    if (this.paths.has(path)) this.recoverable.add(path);
+  }
+
+  preserve(path: string): void {
+    if (this.paths.has(path)) this.preserved.add(path);
+  }
+
+  /** Retain only worktrees that reached a live agent, not empty setup/replay worktrees. */
+  preserveRecoverable(): void {
+    for (const path of this.recoverable) {
+      if (this.paths.has(path)) this.preserved.add(path);
+    }
+  }
+
   async probe(signal?: AbortSignal): Promise<GitWorktreeProbe> {
     return await isGitWorktree({ repoCwd: this.repoCwd, runner: this.runner, signal, timeoutMs: this.timeoutMs });
   }
@@ -183,8 +206,17 @@ export class WorktreeRegistry {
   }
 
   async removeAll(): Promise<readonly WorktreeRemovalOutcome[]> {
+    return await this.removePaths([...this.paths]);
+  }
+
+  /** Remove disposable worktrees while leaving failed ones available for recovery. */
+  async removeUnpreserved(): Promise<readonly WorktreeRemovalOutcome[]> {
+    return await this.removePaths([...this.paths].filter((path) => !this.preserved.has(path)));
+  }
+
+  private async removePaths(paths: readonly string[]): Promise<readonly WorktreeRemovalOutcome[]> {
     const outcomes = await Promise.all(
-      [...this.paths].map(async (path) => ({
+      paths.map(async (path) => ({
         path,
         ...(await this.remove(path)),
       })),
@@ -209,6 +241,8 @@ export class WorktreeRegistry {
     if (result.ok) {
       this.paths.delete(path);
       this.snapshots.delete(path);
+      this.recoverable.delete(path);
+      this.preserved.delete(path);
     }
     return result;
   }

package/src/ui/usage-bars.ts

@@ -120,8 +120,7 @@ export function renderUsageLines(state: UsageState, theme: any, width: number, m
   const status = availability.ready
     ? `${availability.ready}/${availability.total} ready`
     : availability.unknown ? "unknown/stale" : "exhausted";
-  const partial = claude.some((cell) => cell.partial);
-  const claudeTitle = `Claude Σ${state.accounts} · ${status}${partial ? " · partial" : ""}`;
+  const claudeTitle = `Claude Σ${state.accounts} · ${status}`;
   const codexTitle = state.codexPlan ? `Codex · ${state.codexPlan}` : "Codex";
   const lines = [`  ${theme.fg("accent", claudeTitle.padEnd(cellWidth))}${" ".repeat(gap)}${theme.fg("accent", codexTitle)}`];
 

package/src/core/codex/oauth.ts

@@ -1,129 +0,0 @@
-import { generatePkce, generateState, parseCallback } from "../oauth/pkce.ts";
-
-/**
- * Codex OAuth (ChatGPT account login).
- *
- * The client id is the public one the Codex CLI itself uses; it is not a
- * secret and the flow is PKCE precisely so that no secret is required. The
- * redirect is a loopback URL, which is what lets a CLI complete the flow.
- */
-
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-const TOKEN_URL = "https://auth.openai.com/oauth/token";
-const REDIRECT_URI = "http://localhost:1455/auth/callback";
-const SCOPE = "openid profile email offline_access";
-
-export interface CodexAuthStart {
-  url: string;
-  verifier: string;
-  state: string;
-  redirectUri: string;
-}
-
-export interface CodexTokens {
-  access: string;
-  refresh: string;
-  expires: number;
-}
-
-/** Builds the authorization URL and the PKCE material needed to finish. */
-export async function authorizeCodex(): Promise<CodexAuthStart> {
-  const pkce = await generatePkce();
-  const state = generateState();
-
-  const url = new URL(AUTHORIZE_URL);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID);
-  url.searchParams.set("redirect_uri", REDIRECT_URI);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", pkce.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  // Forces the account chooser, which is the entire point when adding a
-  // SECOND account: without it the browser silently reuses the existing
-  // session and you get a duplicate of the account you already have.
-  url.searchParams.set("prompt", "login");
-
-  return { url: url.toString(), verifier: pkce.verifier, state, redirectUri: REDIRECT_URI };
-}
-
-/** Exchanges the callback URL (or a bare code) for tokens. */
-export async function exchangeCodex(
-  callback: string,
-  verifier: string,
-  redirectUri: string,
-  expectedState?: string,
-): Promise<CodexTokens> {
-  const parsed = parseCallback(callback);
-  const code = parsed?.code ?? callback.trim();
-  if (!code) throw new Error("No authorization code found in the callback.");
-  if (expectedState && parsed?.state && parsed.state !== expectedState) {
-    throw new Error("OAuth state mismatch; the callback does not belong to this login attempt.");
-  }
-
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      redirect_uri: redirectUri,
-      code_verifier: verifier,
-    }),
-  });
-
-  if (!response.ok) {
-    throw new Error(`Codex token exchange failed (${response.status}): ${(await response.text()).slice(0, 200)}`);
-  }
-
-  const body: any = await response.json();
-  if (!body?.access_token) throw new Error("Codex token exchange returned no access token.");
-  return {
-    access: body.access_token,
-    refresh: body.refresh_token,
-    expires: Date.now() + Number(body.expires_in ?? 3600) * 1000,
-  };
-}
-
-/** Refreshes an expiring token. */
-export async function refreshCodexToken(refresh: string): Promise<CodexTokens> {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID,
-      refresh_token: refresh,
-      scope: SCOPE,
-    }),
-  });
-
-  if (!response.ok) {
-    throw new Error(`Codex token refresh failed (${response.status}).`);
-  }
-
-  const body: any = await response.json();
-  if (!body?.access_token) throw new Error("Codex token refresh returned no access token.");
-  return {
-    // OpenAI may omit a rotated refresh token; keeping the old one is correct.
-    access: body.access_token,
-    refresh: body.refresh_token ?? refresh,
-    expires: Date.now() + Number(body.expires_in ?? 3600) * 1000,
-  };
-}
-
-/** A token good for at least a minute, refreshing and persisting if needed. */
-export async function ensureCodexToken(
-  account: { access?: string; refresh?: string; expires?: number },
-  persist: (tokens: CodexTokens) => void,
-): Promise<string | undefined> {
-  if (account.access && typeof account.expires === "number" && Date.now() + 60_000 < account.expires) {
-    return account.access;
-  }
-  if (!account.refresh) return account.access;
-  const tokens = await refreshCodexToken(account.refresh);
-  persist(tokens);
-  return tokens.access;
-}