@markusylisiurunen/tau 0.1.63 → 0.2.0-alpha.1

package/README.md

@@ -2,7 +2,7 @@
 
 a terminal-based AI chat client for working with code. tau gives you access to Claude, GPT, and Gemini models, each equipped with tools to explore, write, and edit files in your project, plus optional sub-agents for deeper codebase investigation and web research.
 
-![tau](./assets/tau.png)
+![tau](https://raw.githubusercontent.com/markusylisiurunen/tau/main/assets/tau.png)
 
 ## installation
 
@@ -34,15 +34,37 @@ environment variables take precedence over the config file.
 
 `parallel` is only needed for the web sub-agent tools (`web_search`/`web_fetch`).
 
+### OpenAI Codex subscription (ChatGPT Plus/Pro)
+
+to use the OpenAI Codex subscription provider (`openai-codex`), run:
+
+```sh
+tau login openai-codex
+```
+
+this prints a login URL and starts a local callback server on `127.0.0.1:1455`. complete the
+login in your browser and tau will store tokens in `~/.config/tau/auth.json`. if port `1455`
+is already in use, or the browser callback fails, tau will prompt you to paste the redirect
+URL/code. if you see token refresh errors later, run the login command again to re-authenticate.
+
+to remove stored credentials:
+
+```sh
+tau logout openai-codex
+```
+
+`openai-codex` does **not** use `OPENAI_API_KEY` or `apiKeys.openai`; it relies on the OAuth
+tokens in `~/.config/tau/auth.json`.
+
 ## security notice
 
 **the risk level system is a UX guardrail, not a hard security boundary.** it helps prevent accidental writes and guides model behavior, but it has significant limitations:
 
 - **model trust**: the bash tool relies on the model honestly declaring whether a command is a read or write. there's no runtime validation that the command actually matches the declared intent. a model could declare `safetyLevel="read"` while running `rm -rf /`.
 - **no command analysis**: the system doesn't inspect command content. it trusts the declared safety level without verifying what the command actually does.
-- **full system access**: there is no sandboxing or directory restriction. the model can access any file on your system that your user account can read or write, not just the current working directory.
+- **full system access (by default)**: without sandboxing, the model can access any file on your system that your user account can read or write, not just the current working directory. use `--sandbox` to run tool calls inside a docker container with the project mounted.
 - **no tty / non-interactive tools**: tool commands run with stdin ignored and no TTY. anything that prompts for input or opens an editor can hang or fail (for example `sudo`, `ssh` password prompts, `git` credential prompts). tau also forces git into non-interactive mode (no prompt/editor/pager, batch-mode ssh).
-- **user bypasses**: the `!` prefix executes shell commands directly, completely bypassing risk level checks. this is intentional for direct use, but means risk levels only constrain the model, not the user.
+- **user bypasses**: the `!` prefix executes shell commands directly and completely bypasses risk level checks. this is intentional for direct use, but means risk levels only constrain the model, not the user. when `--sandbox` is enabled, these commands still run inside the sandbox.
 
 note that there is no confirmation step before tool execution. the model runs commands immediately, and you can only observe the results after the fact.
 
@@ -58,22 +80,48 @@ npm run build
 npm start
 ```
 
-## theme preview
+`npm start` launches the interactive TUI and expects a real terminal.
 
-run a model-free UI preview for theme iteration:
+## themes
 
-```sh
-tau --theme-preview
+tau can load custom palette overrides from theme files. create a theme at:
+
+- `.tau/themes/<id>.json` (project)
+- `~/.config/tau/themes/<id>.json` (global)
+
+then set `"defaultTheme": "<id>"` in config. any palette token not defined in the file renders as plain text.
+theme values accept `#rgb`, `#rrggbb`, `rgb(r, g, b)`, or `hsl(h, s%, l%)`. hex without `#` is ignored.
+
+available palette tokens (theme keys):
+
+- core: `brandAccent`, `textMuted`, `textDim`, `linkText`, `thinkingText`, `codeInlineText`, `codeBlockText`
+- status: `statusWarn`, `statusError`, `modeMemory`, `modeBash`
+- action: `actionRunning`, `actionSuccess`, `actionError`, `actionOutput`
+- diff: `diffAdd`, `diffRemove`
+- toasts: `toastSuccess`, `toastWarn`, `toastError`, `toastSuccessBg`, `toastWarnBg`, `toastErrorBg`, `toastMutedBg`
+- user: `userSurface`, `userMemorySurface`, `userMemoryText`
+- risk: `riskReadOnlyText`, `riskReadWriteText`
+
+example theme file (`.tau/themes/solarized.json`):
+
+```json
+{
+  "brandAccent": "#b58900",
+  "textMuted": "#586e75",
+  "textDim": "#657b83"
+}
 ```
 
-theme preview renders a fixed set of UI fixtures and disables model calls so you can tweak colors and spacing
-without asking the model for visible content.
+and in config (`.tau/config.json` or `~/.config/tau/config.json`):
+
+```json
+{ "defaultTheme": "solarized" }
+```
 
 ## risk levels
 
 tau uses risk levels to control what the model can do. this lets you stay in control while working alongside AI.
 
-- **restricted**: model can only use safe inspection tools (`read`, `grep`, `list`)
 - **read-only** (default): model can run read-only tools (no file modifications)
 - **read-write**: model can create, edit, and delete files
 
@@ -83,18 +131,42 @@ start with a specific risk level:
 tau --risk read-write
 ```
 
-or change it during a session with `/risk:restricted`, `/risk:read-only`, or `/risk:read-write`.
+or change it during a session with `/risk:read-only` or `/risk:read-write`.
 
 the default is read-only because it lets the model investigate your code and answer questions without risk of unintended changes. bump it to read-write when you're ready to let the model make edits.
 
-custom personas (loaded from disk) only allow `read-only` and `read-write` risk levels. if you try to use `restricted` with a custom persona, tau will keep the risk level at `read-only`.
+## sandboxing
+
+when started with `--sandbox`, tau runs all tool calls inside a session-scoped docker container. the project root (git root or cwd) is mounted into the container, and the working directory matches your current subdirectory. only `/workspace` is bound to the host; absolute paths outside `/workspace` refer to the container filesystem.
+
+requirements:
+- docker must be available on the host
+- config must include `sandbox.image`
+- sandboxing is only enabled at startup with `--sandbox` (no runtime toggle)
+
+example config:
+
+```json
+{
+  "sandbox": {
+    "image": "ghcr.io/your-org/tau-sandbox:latest",
+    "mountPath": "/workspace",
+    "pruneAfterHours": 72,
+    "extraDockerArgs": ["--network=none"],
+    "environmentInfo": "tools run inside a container. project mounted at /workspace."
+  }
+}
+```
+
+note: when `--sandbox` is enabled, `!` commands also run inside the container.
 
 ## personas
 
 tau comes with several built-in personas across different models:
 
 - **Claude Opus 4.5** and **Haiku 4.5** (Anthropic)
-- **GPT-5.2** and **GPT-5.2 Codex** (OpenAI)
+- **GPT-5.2** and **GPT-5.2 flex** (OpenAI)
+- **GPT-5.2 Codex** (OpenAI Codex subscription)
 - **Gemini 3 Pro** and **Gemini 3 Flash** (Google)
 
 each model has two variants: a chat variant for general-purpose assistance, and a coder variant optimized for software engineering. GPT-5.2 Codex is a single coder persona. both variants include the `web` sub-agent for web research, and coder variants also include the `explore` sub-agent for multi-turn codebase investigation.
@@ -112,9 +184,9 @@ some personas can run isolated sub-agents via the internal `task` tool.
 tau also supports an internal `fork` tool, which runs an autonomous fork of the current session using the full conversation history and returns the fork's final answer.
 
 - `explore`: read-only, multi-turn codebase investigation
-- `web`: high-threshold web research using Parallel Search/Extract (`web_search`/`web_fetch`)
+- `web`: high-threshold web research using Parallel Search/Extract (`web_search`/`web_fetch`) plus read-only bash for curl/filtering
 
-to use the web sub-agent, set `apiKeys.parallel` in `~/.config/tau/config.json` (see above). tau will only make web calls when needed or when you explicitly ask for web research.
+to use the web sub-agent, set `apiKeys.parallel` in `~/.config/tau/config.json` (see above). tau will only make web calls when you explicitly ask for web research.
 
 ## trigger sensitivity
 
@@ -145,18 +217,18 @@ reference skills by typing `$` followed by the skill name (for example, `$skill-
 you can also pipe content directly:
 
 ```sh
-cat src/app.ts | tau --persona opus-4.5-chat
+cat src/tui/app.ts | tau --persona opus-4.5-chat
 ```
 
-for project-aware sessions, use `--with-context` to inject your AGENTS.md into the system prompt. tau searches for this file in the current directory and parent directories up to your home folder.
+by default, tau injects your AGENTS.md into the system prompt. use `--no-agent-context-files` to disable this behavior. tau searches for AGENTS.md in the current directory and parent directories up to your home folder (or filesystem root if cwd is outside home).
 
-you can also include additional `AGENTS.md` files via `.tau/config.json` (when that config is in scope for the current working directory):
+you can also include additional `AGENTS.md` files via config (when that config is in scope for the current working directory):
 
 ```json
-{ "agents": ["packages/pkg1/AGENTS.md"] }
+{ "agentContextFiles": ["packages/pkg1/AGENTS.md"] }
 ```
 
-paths are resolved relative to the directory containing `.tau/`.
+paths are resolved relative to the directory containing `.tau/` (or relative to home for the global config when it is in scope). entries are only included when their directory is an ancestor or descendant of the current working directory (sibling paths are ignored).
 
 run `tau --help` to see all available options, or `tau --debug` to inspect loaded personas, prompts, skills, and the full system prompt for debugging configuration issues.
 
@@ -168,7 +240,7 @@ prefix a message with `#` to update your project's AGENTS.md file. this is usefu
 # prefer explicit error messages with context about what operation failed
 ```
 
-tau will create or update AGENTS.md at your project root, integrating the new information into the existing structure. over time, this builds a knowledge base about your project. combine it with `--with-context` so future sessions understand your conventions without re-explaining them.
+tau will create or update AGENTS.md at your project root, integrating the new information into the existing structure. over time, this builds a knowledge base about your project. this file is loaded automatically in future sessions unless you pass `--no-agent-context-files`.
 
 ## commands
 
@@ -181,14 +253,15 @@ tau supports slash commands for common actions:
 | `/copy`                   | copy the last assistant message                |
 | `/copy:code`              | copy just the code blocks                      |
 | `/export:html`            | export chat history to html                    |
-| `/reload`                 | reload personas, prompts, and skills from disk |
+| `/reload`                 | reload personas, prompts, skills, and themes from disk |
 | `/compact:only-summary`   | compress history and continue with a summary   |
 | `/compact:with-last-turn` | compress history but keep the last exchange    |
 | `/persona:<id>`           | switch to a different persona                  |
 | `/prompt:<id>`            | insert a saved prompt template                 |
+| `/theme:<id>`             | switch to a loaded theme                       |
 | `/bash:<id>`              | run a saved shell command                      |
 | `/risk:<level>`           | change the risk level                          |
-| `!<cmd>`                  | run a shell command directly                   |
+| `!<cmd>`                  | run a shell command directly (bypasses risk checks; uses sandbox if enabled) |
 
 the compact commands are useful when conversations get long. they compress everything into a summary so the model retains context without the overhead of a full history.
 
@@ -211,7 +284,10 @@ the compact commands are useful when conversations get long. they compress every
 
 ### global config
 
-store settings in `~/.config/tau/config.json`:
+tau loads config from `~/.config/tau/config.json` only when the current working directory is
+inside your home directory. it also loads any `.tau/config.json` found by walking up from the
+current working directory to home (or to the filesystem root when cwd is outside home).
+settings merge from least-specific to most-specific.
 
 ```json
 {
@@ -223,29 +299,27 @@ store settings in `~/.config/tau/config.json`:
   },
   "defaultPersona": "gpt-5.2-chat",
   "defaultRisk": "read-write",
-  "toolDisplayMode": "compact",
   "disableBuiltinPersonas": false,
-  "userPreferences": "prefer concise responses. use TypeScript for examples."
+  "disableBuiltinPrompts": false,
+  "defaultTheme": "solarized"
 }
 ```
 
 the `defaultPersona` field specifies which persona to use when starting the app. the `--persona` flag overrides this setting.
 
-the `defaultRisk` field sets the initial risk level (`restricted`, `read-only`, or `read-write`). the `--risk` flag overrides this setting. if not specified, defaults to `read-only`.
-
-the `userPreferences` field lets you set guidance that applies to every conversation: preferred languages, response style, or domain context.
+the `defaultRisk` field sets the initial risk level (`read-only` or `read-write`). the `--risk` flag overrides this setting. if not specified, defaults to `read-only`.
 
-`toolDisplayMode` controls how tool calls appear: `"compact"` (default) shows one-line summaries, `"full"` shows detailed blocks.
+if `disableBuiltinPersonas` is set to `true`, tau will not load built-in personas. if `disableBuiltinPrompts` is set to `true`, tau will not load built-in prompts. only entries from `~/.config/tau/` and `.tau/` will be available for those categories. you can also set these flags in any `.tau/config.json`; the most specific value wins.
 
-if `disableBuiltinPersonas` is set to `true`, tau will not load any built-in personas. only personas from `~/.config/tau/personas/` and `.tau/personas/` will be available. you can also set `disableBuiltinPersonas` in `.tau/config.json` at the repo root to disable built-ins for that project (overrides the global value).
+the `sandbox` field configures docker sandboxing. `sandbox.image` is required when you start tau with `--sandbox`. `sandbox.mountPath` defaults to `/workspace`. `sandbox.pruneAfterHours` controls when old containers are auto-pruned (default `72`). `sandbox.extraDockerArgs` lets you pass additional `docker run` flags. `sandbox.environmentInfo` (optional) is injected into the system prompt to describe the container environment to the model.
 
 ### project bash commands
 
-define shortcuts for common shell commands in `.tau/config.json` at your project root (or `~/.tau/config.json` globally). tau resolves the project root via git, so you can run tau from subdirectories and it will still pick up `.tau/config.json`:
+define shortcuts for common shell commands in any in-scope config file (`~/.config/tau/config.json` when cwd is under home, or `.tau/config.json` in the cwd ancestry). entries merge by `id` with the most specific level winning:
 
 ```json
 {
-  "bash": [
+  "bashCommands": [
     { "id": "check", "description": "lint + typecheck", "cmd": "npm run check" },
     { "id": "test", "cmd": "npm test" }
   ]
@@ -254,19 +328,22 @@ define shortcuts for common shell commands in `.tau/config.json` at your project
 
 run them with `/bash:check` or `/bash:test`.
 
+commands run with cwd set to the config level root (directory containing `.tau`, or home for the global config).
+
 ### additional agents context
 
-if you use `--with-context`, you can tell tau to always include extra `AGENTS.md` files by adding an `agents` list to `.tau/config.json`:
+you can tell tau to always include extra `AGENTS.md` files by adding an `agentContextFiles` list to a config file in scope:
 
 ```json
-{ "agents": ["packages/pkg1/AGENTS.md"] }
+{ "agentContextFiles": ["packages/pkg1/AGENTS.md"] }
 ```
 
-paths are resolved relative to the directory containing `.tau/`.
+paths are resolved relative to the directory containing `.tau/` (or relative to home for the global config when it is in scope). entries must point at `AGENTS.md`.
+entries are only included when their directory is an ancestor or descendant of the current working directory (sibling paths are ignored).
 
 ### custom personas
 
-create your own personas by adding markdown files to `~/.config/tau/personas/` (user-level) or `.tau/personas/` (project-level). project-level `.tau/` directories are discovered by walking up from the current working directory to the git repo root:
+create your own personas by adding markdown files to `~/.config/tau/personas/` (global, only when cwd is under home) or `.tau/personas/` (project). `.tau/` directories are discovered by walking up from the current working directory to home (or filesystem root if cwd is outside home):
 
 ```markdown
 ---
@@ -285,6 +362,8 @@ the frontmatter defines the persona. required fields:
 - `provider`: model provider id (for example `openai`, `anthropic`, `google`)
 - `model`: model id for the provider (for example `gpt-5.2`, `claude-opus-4-5`)
 
+the persona file name (without the `.md` extension) must match the `id`.
+
 optional frontmatter fields:
 
 - `label`: display name shown in the ui (defaults to the base persona label if `extends` is used)
@@ -301,7 +380,7 @@ optional frontmatter fields:
       model: claude-haiku-4-5
       reasoning: medium
   ```
-- `tools`: list of tool names to enable for this persona. allowed: `bash`, `write`, `edit`, `read`, `list`, `grep`, `task`, `fork`. if omitted, defaults to `bash`, `write`, `edit` (and `task` when subagents are enabled). risk levels still apply.
+- `tools`: list of tool names to enable for this persona. allowed: `bash`, `write`, `edit`, `task`, `fork`. if omitted, defaults to `bash`, `write`, `edit` (and `task` when subagents are enabled). risk levels still apply.
 
 the markdown body becomes the system prompt.
 
@@ -319,11 +398,11 @@ model: claude-haiku-4-5
 
 ```
 
-by default, user-level personas can’t use built-in persona ids. if you set `disableBuiltinPersonas: true`, those ids become available for custom personas.
+when persona ids collide across levels, the most specific level wins (for example, a `.tau/personas/` entry overrides a global or built-in persona).
 
 ### custom prompts
 
-save reusable prompt templates in `~/.config/tau/prompts/` (user-level) or `.tau/prompts/` (project-level). project-level `.tau/` directories are discovered by walking up from the current working directory to the git repo root:
+save reusable prompt templates in `~/.config/tau/prompts/` (global, only when cwd is under home) or `.tau/prompts/` (project). `.tau/` directories are discovered by walking up from the current working directory to home (or filesystem root if cwd is outside home):
 
 ```markdown
 ---
@@ -334,11 +413,13 @@ review this code for bugs, edge cases, and style issues.
 suggest specific improvements with code examples.
 ```
 
-insert them with `/prompt:review`. if a project prompt id conflicts with a user or built-in prompt, the project prompt wins.
+insert them with `/prompt:review`. if a prompt id conflicts across levels (including built-ins), the most specific level wins.
+
+the prompt file name (without the `.md` extension) must match the `id`.
 
 ### skills
 
-skills are optional directories discovered at `$XDG_CONFIG_HOME/tau/skills/` (defaults to `~/.config/tau/skills/`) and `.tau/skills/`. project-level `.tau/` directories are discovered by walking up from the current working directory to the git repo root. each skill is a directory containing `SKILL.md`. tau follows the [agent skills spec](https://agentskills.io/home).
+skills are optional directories discovered at `~/.config/tau/skills/` (only when cwd is under home) and `.tau/skills/` in the cwd ancestry (up to home, or filesystem root if cwd is outside home). each skill is a directory containing `SKILL.md`. tau follows the [agent skills spec](https://agentskills.io/home).
 
 `SKILL.md` must start with yaml frontmatter:
 
@@ -349,7 +430,7 @@ optional fields: `license`, `compatibility` (<=500 chars), `metadata` (string ma
 
 enable skills per persona with the `skills` frontmatter field. you can list specific skill names (matched by `name` in skill frontmatter), or use `"*"` to enable all discovered skills. all built-in personas have `skills: "*"` by default. if a project skill conflicts with a user skill by name, the project skill wins. tau injects an index of enabled skills into the system prompt containing only each skill's `name`, `description`, and absolute file path.
 
-use `/reload` to pick up changes to personas, prompts, and skills without restarting.
+use `/reload` to pick up changes to personas, prompts, skills, and themes without restarting.
 
 ## how it works
 
@@ -390,3 +471,14 @@ git push --follow-tags
 ```sh
 gh release create v$(node -p "require('./package.json').version") --generate-notes
 ```
+
+alpha prereleases are published under the npm `alpha` tag (not `latest`):
+
+```sh
+if node -p "require('./package.json').version.includes('-alpha.')"; then
+  npm version prerelease --preid alpha
+else
+  npm version preminor --preid alpha
+fi
+gh release create v$(node -p "require('./package.json').version") --generate-notes --prerelease
+```

package/dist/core/auth/auth_messages.js

@@ -0,0 +1,6 @@
+export function formatCodexAuthError(authPath, detail) {
+    const base = "OpenAI Codex credentials are missing or expired.";
+    const hint = `run "tau login openai-codex" to authenticate and store tokens in ${authPath}.`;
+    return detail ? `${base} ${detail} ${hint}` : `${base} ${hint}`;
+}
+//# sourceMappingURL=auth_messages.js.map

package/dist/core/auth/auth_messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_messages.js","sourceRoot":"","sources":["../../../src/core/auth/auth_messages.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,MAAe;IACpE,MAAM,IAAI,GAAG,kDAAkD,CAAC;IAChE,MAAM,IAAI,GAAG,oEAAoE,QAAQ,GAAG,CAAC;IAC7F,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC"}

package/dist/core/auth/auth_paths.js

@@ -0,0 +1,7 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function getAuthPath(homeDir) {
+    const home = homeDir ?? homedir();
+    return join(home, ".config", "tau", "auth.json");
+}
+//# sourceMappingURL=auth_paths.js.map

package/dist/core/auth/auth_paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_paths.js","sourceRoot":"","sources":["../../../src/core/auth/auth_paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC"}

package/dist/core/auth/auth_storage.js

@@ -0,0 +1,91 @@
+import { randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { getOAuthApiKey } from "@mariozechner/pi-ai";
+export class AuthStorage {
+    authPath;
+    data = {};
+    static refreshLocks = new Map();
+    constructor(authPath) {
+        this.authPath = authPath;
+        this.reload();
+    }
+    reload() {
+        if (!existsSync(this.authPath)) {
+            this.data = {};
+            return;
+        }
+        try {
+            const parsed = JSON.parse(readFileSync(this.authPath, "utf-8"));
+            this.data = parsed ?? {};
+        }
+        catch {
+            this.data = {};
+        }
+    }
+    save() {
+        const dir = dirname(this.authPath);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        const tmpPath = `${this.authPath}.${randomUUID()}.tmp`;
+        writeFileSync(tmpPath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 0o600 });
+        renameSync(tmpPath, this.authPath);
+        chmodSync(this.authPath, 0o600);
+    }
+    get(provider) {
+        return this.data[provider] ?? undefined;
+    }
+    set(provider, credential) {
+        this.data[provider] = credential;
+        this.save();
+    }
+    remove(provider) {
+        delete this.data[provider];
+        this.save();
+    }
+    list() {
+        return Object.keys(this.data);
+    }
+    hasAuth(provider) {
+        return provider in this.data;
+    }
+    async getApiKey(provider) {
+        return this.withRefreshLock(provider, async () => {
+            this.reload();
+            const credential = this.data[provider];
+            if (!credential) {
+                return undefined;
+            }
+            if (credential.type === "api_key") {
+                return credential.key;
+            }
+            const oauthCredentials = {};
+            for (const [key, value] of Object.entries(this.data)) {
+                if (value.type === "oauth") {
+                    oauthCredentials[key] = value;
+                }
+            }
+            const result = await getOAuthApiKey(provider, oauthCredentials);
+            if (!result) {
+                return undefined;
+            }
+            this.data[provider] = { type: "oauth", ...result.newCredentials };
+            this.save();
+            return result.apiKey;
+        });
+    }
+    async withRefreshLock(provider, action) {
+        const lockKey = `${this.authPath}:${provider}`;
+        const existing = AuthStorage.refreshLocks.get(lockKey);
+        if (existing) {
+            return existing;
+        }
+        const inFlight = action().finally(() => {
+            AuthStorage.refreshLocks.delete(lockKey);
+        });
+        AuthStorage.refreshLocks.set(lockKey, inFlight);
+        return inFlight;
+    }
+}
+//# sourceMappingURL=auth_storage.js.map

package/dist/core/auth/auth_storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_storage.js","sourceRoot":"","sources":["../../../src/core/auth/auth_storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAA6C,MAAM,qBAAqB,CAAC;AAehG,MAAM,OAAO,WAAW;IAIO;IAHrB,IAAI,GAAoB,EAAE,CAAC;IAC3B,MAAM,CAAC,YAAY,GAAG,IAAI,GAAG,EAAuC,CAAC;IAE7E,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAoB,CAAC;YACnF,IAAI,CAAC,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,IAAI;QACV,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC;QACvD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC1C,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,UAA0B;QAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YAEd,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC,GAAG,CAAC;YACxB,CAAC;YAED,MAAM,gBAAgB,GAAqC,EAAE,CAAC;YAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC3B,gBAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAChC,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAyB,EAAE,gBAAgB,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YAEZ,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,QAAgB,EAChB,MAAyC;QAEzC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC;IAClB,CAAC"}

package/dist/core/auth/cli.js

@@ -0,0 +1,88 @@
+import { loginOpenAICodex } from "@mariozechner/pi-ai";
+export const SUPPORTED_OAUTH_PROVIDERS = [
+    { id: "openai-codex", label: "OpenAI Codex (ChatGPT Plus/Pro)" },
+];
+const DEFAULT_LOGIN_HANDLERS = {
+    "openai-codex": (callbacks) => loginOpenAICodex({
+        onAuth: callbacks.onAuth,
+        onPrompt: callbacks.onPrompt,
+        onProgress: callbacks.onProgress,
+    }),
+};
+function normalizeProvider(value) {
+    return value.trim().toLowerCase();
+}
+function formatProviderList(providers) {
+    return providers.map((provider, index) => `  ${index + 1}. ${provider.label}`).join("\n");
+}
+async function promptForProvider(prompt, log, providers) {
+    log("select a provider:\n");
+    log(formatProviderList(providers));
+    log("");
+    const selection = await prompt({ message: `enter number (1-${providers.length}):` });
+    const index = Number.parseInt(selection, 10) - 1;
+    if (!Number.isFinite(index) || index < 0 || index >= providers.length) {
+        throw new Error("invalid selection.");
+    }
+    return providers[index].id;
+}
+function resolveProvider(providerArg, providers) {
+    if (!providerArg)
+        return undefined;
+    const normalized = normalizeProvider(providerArg);
+    const resolved = providers.find((provider) => provider.id === normalized)?.id;
+    if (!resolved) {
+        const available = providers.map((entry) => entry.id).join(", ");
+        throw new Error(`unknown provider "${providerArg}". available: ${available}`);
+    }
+    return resolved;
+}
+export async function runLoginCommand(options) {
+    const log = options.log ?? console.log;
+    const providers = options.providers ?? SUPPORTED_OAUTH_PROVIDERS;
+    let provider = resolveProvider(options.providerArg, providers);
+    if (!provider) {
+        provider = await promptForProvider(options.prompt, log, providers);
+    }
+    const handlers = { ...DEFAULT_LOGIN_HANDLERS, ...options.loginHandlers };
+    const handler = handlers[provider];
+    if (!handler) {
+        const available = providers.map((entry) => entry.id).join(", ");
+        throw new Error(`unknown provider "${provider}". available: ${available}`);
+    }
+    log(`logging in to ${provider}...`);
+    const credentials = await handler({
+        onAuth: (info) => {
+            log("");
+            if (provider === "openai-codex") {
+                log("copy this url into your browser to complete login:");
+            }
+            else {
+                log("open this url in your browser:");
+            }
+            log(info.url);
+            if (info.instructions) {
+                log(info.instructions);
+            }
+            if (provider === "openai-codex") {
+                log("if the browser callback fails, you'll be prompted to paste the redirect url/code.");
+            }
+            log("");
+        },
+        onPrompt: async (prompt) => options.prompt(prompt),
+        onProgress: (message) => log(message),
+    });
+    options.authStorage.set(provider, { type: "oauth", ...credentials });
+    log(`credentials saved to ${options.authPath}`);
+}
+export async function runLogoutCommand(options) {
+    const log = options.log ?? console.log;
+    const providers = options.providers ?? SUPPORTED_OAUTH_PROVIDERS;
+    let provider = resolveProvider(options.providerArg, providers);
+    if (!provider) {
+        provider = await promptForProvider(options.prompt, log, providers);
+    }
+    options.authStorage.remove(provider);
+    log(`removed credentials for ${provider} from ${options.authPath}`);
+}
+//# sourceMappingURL=cli.js.map

package/dist/core/auth/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/core/auth/cli.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAiBvD,MAAM,CAAC,MAAM,yBAAyB,GAAwB;IAC5D,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,iCAAiC,EAAE;CACjE,CAAC;AAEF,MAAM,sBAAsB,GAAqD;IAC/E,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAC5B,gBAAgB,CAAC;QACf,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC;CACL,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CAAC,SAA8B;IACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAoB,EACpB,GAAY,EACZ,SAA8B;IAE9B,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5B,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,WAA+B,EAC/B,SAA8B;IAE9B,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,EAAE,CAAC;IAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAQrC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAC;IAEjE,IAAI,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,OAAO,CAAC,aAAa,EAErE,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,GAAG,CAAC,iBAAiB,QAAQ,KAAK,CAAC,CAAC;IAEpC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC;QAChC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,GAAG,CAAC,EAAE,CAAC,CAAC;YACR,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACxC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,GAAG,CAAC,mFAAmF,CAAC,CAAC;YAC3F,CAAC;YACD,GAAG,CAAC,EAAE,CAAC,CAAC;QACV,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAClD,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;KACtC,CAAC,CAAC;IAEH,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;IACrE,GAAG,CAAC,wBAAwB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAOtC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAC;IAEjE,IAAI,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,GAAG,CAAC,2BAA2B,QAAQ,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/core/auth/codex_prompt.js

@@ -0,0 +1,13 @@
+import { PI_STATIC_INSTRUCTIONS } from "@mariozechner/pi-ai";
+const STATIC_PREFIX = PI_STATIC_INSTRUCTIONS.trim();
+export function ensureCodexSystemPrompt(systemPrompt) {
+    const trimmedStart = systemPrompt.trimStart();
+    if (trimmedStart.startsWith(STATIC_PREFIX)) {
+        return STATIC_PREFIX + trimmedStart.slice(STATIC_PREFIX.length);
+    }
+    if (!systemPrompt.trim()) {
+        return STATIC_PREFIX;
+    }
+    return `${STATIC_PREFIX}\n\n${systemPrompt.trim()}`;
+}
+//# sourceMappingURL=codex_prompt.js.map

package/dist/core/auth/codex_prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex_prompt.js","sourceRoot":"","sources":["../../../src/core/auth/codex_prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC;AAEpD,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC;IAC9C,IAAI,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,GAAG,aAAa,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC"}

package/dist/core/auth/credential_resolver.js

@@ -0,0 +1,18 @@
+import { getEnvApiKey } from "@mariozechner/pi-ai";
+import { getApiKeyForProvider } from "../config/schema.js";
+export function createCredentialResolver(options) {
+    return {
+        getApiKey: async (provider) => {
+            const authKey = await options.authStorage.getApiKey(provider);
+            if (authKey) {
+                return authKey;
+            }
+            const configKey = getApiKeyForProvider(options.getConfig(), provider);
+            if (configKey) {
+                return configKey;
+            }
+            return getEnvApiKey(provider);
+        },
+    };
+}
+//# sourceMappingURL=credential_resolver.js.map

package/dist/core/auth/credential_resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential_resolver.js","sourceRoot":"","sources":["../../../src/core/auth/credential_resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAO3D,MAAM,UAAU,wBAAwB,CAAC,OAGxC;IACC,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/auth/index.js

@@ -0,0 +1,7 @@
+export { formatCodexAuthError } from "./auth_messages.js";
+export { getAuthPath } from "./auth_paths.js";
+export { AuthStorage } from "./auth_storage.js";
+export { runLoginCommand, runLogoutCommand, SUPPORTED_OAUTH_PROVIDERS, } from "./cli.js";
+export { ensureCodexSystemPrompt } from "./codex_prompt.js";
+export { createCredentialResolver } from "./credential_resolver.js";
+//# sourceMappingURL=index.js.map

package/dist/core/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC"}