@mrciphersmith/keryx 0.3.12 → 0.3.13

package/dist/cli.js

@@ -316,6 +316,26 @@ var init_safe_exec = __esm(() => {
   FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT", "SIGWINCH"];
 });
 
+// src/lib/oauth/openai-token.ts
+function codexTokenMetadata(token) {
+  if (typeof token !== "string" || token.length > 1e5 || token.split(".").length !== 3)
+    return {};
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null)
+      return {};
+    const claims = payload;
+    const auth = claims["https://api.openai.com/auth"];
+    const accountId = typeof auth === "object" && auth !== null ? auth.chatgpt_account_id : undefined;
+    return {
+      ...typeof accountId === "string" && accountId.length > 0 && accountId.trim() === accountId && !/[\r\n]/.test(accountId) ? { accountId } : {},
+      ...typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0 ? { expiresAt: claims.exp * 1000 } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+
 // src/lib/config-dir.ts
 import {
   appendFileSync,
@@ -465,9 +485,258 @@ var init_config_dir = __esm(() => {
   MAX_TURN_FILE_BYTES = MAX_CONTENT_FILE_BYTES;
 });
 
-// src/lib/provider-config.ts
+// src/lib/shell-config.ts
 import { existsSync } from "fs";
 import path3 from "path";
+function noteSavedCredentialEnv(keys) {
+  for (const key of keys)
+    savedCredentialKeys.add(key);
+}
+function savedCredentialEnvKeys() {
+  return savedCredentialKeys;
+}
+function shellConfigPath(dir) {
+  return path3.join(keryxConfigDir(dir), "auth.json");
+}
+function loadShellConfig(dir) {
+  try {
+    const file = shellConfigPath(dir);
+    if (!existsSync(file)) {
+      return {};
+    }
+    const read = readConfigFile(file);
+    if (!read.ok) {
+      return {};
+    }
+    const raw = JSON.parse(read.text);
+    return raw !== null && typeof raw === "object" ? raw : {};
+  } catch {
+    return {};
+  }
+}
+function saveShellConfig(patch, dir) {
+  try {
+    ensureKeryxConfigDir(dir);
+    const next = { ...loadShellConfig(dir), ...patch };
+    writeOwnerOnlyFileAtomic(shellConfigPath(dir), `${JSON.stringify(next, null, 2)}
+`);
+  } catch {}
+}
+function saveApiKey(envKey, value, dir) {
+  const existing = loadShellConfig(dir).apiKeys ?? {};
+  saveShellConfig({ apiKeys: { ...existing, [envKey]: value } }, dir);
+}
+function saveProviderBaseUrl(provider, baseUrl, dir) {
+  const existing = loadShellConfig(dir).baseUrls ?? {};
+  saveShellConfig({ baseUrls: { ...existing, [provider]: baseUrl } }, dir);
+}
+function removeApiKey(envKey, dir) {
+  const existing = loadShellConfig(dir).apiKeys ?? {};
+  if (!(envKey in existing))
+    return;
+  const { [envKey]: _removed, ...rest } = existing;
+  saveShellConfig({ apiKeys: rest }, dir);
+}
+function removeProviderBaseUrl(provider, dir) {
+  const existing = loadShellConfig(dir).baseUrls ?? {};
+  if (!(provider in existing))
+    return;
+  const { [provider]: _removed, ...rest } = existing;
+  saveShellConfig({ baseUrls: rest }, dir);
+}
+function removeProviderModelParams(provider, dir) {
+  const existing = loadShellConfig(dir).modelParams ?? {};
+  if (!(provider in existing))
+    return;
+  const { [provider]: _removed, ...rest } = existing;
+  saveShellConfig({ modelParams: rest }, dir);
+}
+function envWithSavedApiKeys(env = process.env, dir) {
+  const merged = { ...env };
+  try {
+    const cfg = loadShellConfig(dir);
+    const keys = { ...cfg.apiKeys ?? {} };
+    if (typeof cfg.openrouterKey === "string" && cfg.openrouterKey.length > 0 && keys.OPENROUTER_API_KEY === undefined) {
+      keys.OPENROUTER_API_KEY = cfg.openrouterKey;
+    }
+    for (const [envKey, value] of Object.entries(keys)) {
+      if (typeof value !== "string" || value.length === 0) {
+        continue;
+      }
+      const current = merged[envKey];
+      if (current === undefined || current.length === 0) {
+        merged[envKey] = value;
+      }
+    }
+    const grants = cfg.oauthGrants ?? {};
+    const grokAccess = grants.grok?.access;
+    if (typeof grokAccess === "string" && grokAccess.length > 0 && (merged.XAI_API_KEY === undefined || merged.XAI_API_KEY.length === 0)) {
+      merged.XAI_API_KEY = grokAccess;
+    }
+    const copilotAccess = grants["github-copilot"]?.access;
+    if (typeof copilotAccess === "string" && copilotAccess.length > 0 && (merged.GITHUB_COPILOT_TOKEN === undefined || merged.GITHUB_COPILOT_TOKEN.length === 0)) {
+      merged.GITHUB_COPILOT_TOKEN = copilotAccess;
+    }
+  } catch {}
+  return merged;
+}
+function declaredCredentialEnvKeys(dir) {
+  try {
+    return new Set(Object.keys(envWithSavedApiKeys({}, dir)));
+  } catch {
+    return new Set;
+  }
+}
+function applySavedApiKeys(dir) {
+  const applied = [];
+  try {
+    const before = new Set(Object.entries(process.env).filter(([, v]) => typeof v === "string" && v.length > 0).map(([k]) => k));
+    const merged = envWithSavedApiKeys(process.env, dir);
+    for (const [envKey, value] of Object.entries(merged)) {
+      if (typeof value !== "string" || value.length === 0) {
+        continue;
+      }
+      const current = process.env[envKey];
+      if (current === undefined || current.length === 0) {
+        process.env[envKey] = value;
+        if (!before.has(envKey)) {
+          applied.push(envKey);
+        }
+      }
+    }
+  } catch {}
+  noteSavedCredentialEnv(applied);
+  return applied;
+}
+var savedCredentialKeys;
+var init_shell_config = __esm(() => {
+  init_config_dir();
+  savedCredentialKeys = new Set;
+});
+
+// src/lib/oauth/grants.ts
+function loadOAuthGrant(provider, dir) {
+  const grants = loadShellConfig(dir).oauthGrants;
+  if (grants === undefined) {
+    return;
+  }
+  const grant = grants[provider] ?? (provider === "openai-codex" ? grants.openai : undefined);
+  if (grant === undefined || typeof grant.access !== "string" || grant.access.length === 0) {
+    return;
+  }
+  if (grant.method !== "device-code" && grant.method !== "oauth-pkce-loopback") {
+    return;
+  }
+  if (provider === "openai-codex" || provider === "openai") {
+    const metadata = codexTokenMetadata(grant.access);
+    return {
+      ...grant,
+      ...grant.accountId === undefined && metadata.accountId !== undefined ? { accountId: metadata.accountId } : {},
+      ...grant.expires === undefined && metadata.expiresAt !== undefined ? { expires: metadata.expiresAt } : {}
+    };
+  }
+  return grant;
+}
+function saveOAuthGrant(provider, grant, dir) {
+  const existing = loadShellConfig(dir).oauthGrants ?? {};
+  saveShellConfig({ oauthGrants: { ...existing, [provider]: grant } }, dir);
+}
+function deleteOAuthGrant(provider, dir) {
+  const existing = { ...loadShellConfig(dir).oauthGrants ?? {} };
+  if (existing[provider] === undefined && !(provider === "openai-codex" && existing.openai !== undefined)) {
+    return;
+  }
+  delete existing[provider];
+  if (provider === "openai-codex")
+    delete existing.openai;
+  saveShellConfig({ oauthGrants: existing }, dir);
+}
+function listOAuthGrantProviders(dir) {
+  const grants = loadShellConfig(dir).oauthGrants ?? {};
+  return [...new Set(Object.keys(grants).map((name) => name === "openai" ? "openai-codex" : name))].filter((name) => loadOAuthGrant(name, dir) !== undefined).sort();
+}
+function oauthGrantStatus(provider, dir, now = Date.now) {
+  const grant = loadOAuthGrant(provider, dir);
+  if (grant === undefined) {
+    return;
+  }
+  const expired = grant.expires !== undefined && grant.expires - now() <= 0;
+  return {
+    provider,
+    method: grant.method,
+    state: expired ? "expired" : "active",
+    ...grant.expires !== undefined ? { expiresAt: new Date(grant.expires).toISOString() } : {},
+    refreshable: typeof grant.refresh === "string" && grant.refresh.length > 0
+  };
+}
+function oauthAccessToken(provider, dir) {
+  const grant = loadOAuthGrant(provider, dir);
+  return grant?.access;
+}
+function grantNeedsRefresh(grant, now = Date.now) {
+  if (grant.refresh === undefined || grant.refresh.length === 0) {
+    return false;
+  }
+  if (grant.expires === undefined) {
+    return false;
+  }
+  return grant.expires - now() <= ACCESS_TOKEN_REFRESH_SKEW_MS;
+}
+function oauthEnvKeyFor(provider) {
+  return OAUTH_ENV_KEYS.find((entry) => entry.provider === provider)?.envKey;
+}
+function envWithOAuthAccess(env = process.env, dir) {
+  const merged = { ...env };
+  for (const { provider, envKey } of OAUTH_ENV_KEYS) {
+    const current = merged[envKey];
+    if (typeof current === "string" && current.length > 0) {
+      continue;
+    }
+    const access = oauthAccessToken(provider, dir);
+    if (access !== undefined) {
+      merged[envKey] = access;
+    }
+  }
+  return merged;
+}
+function applyOAuthAccessToEnv(dir) {
+  const applied = [];
+  const merged = envWithOAuthAccess(process.env, dir);
+  for (const { envKey } of OAUTH_ENV_KEYS) {
+    const value = merged[envKey];
+    const current = process.env[envKey];
+    if (typeof value === "string" && value.length > 0 && (current === undefined || current.length === 0)) {
+      process.env[envKey] = value;
+      applied.push(envKey);
+    }
+  }
+  noteSavedCredentialEnv(applied);
+  return applied;
+}
+function grantFromTokens(method, tokens, now = Date.now) {
+  const obtainedAt = new Date(now()).toISOString();
+  return {
+    method,
+    access: tokens.accessToken,
+    ...tokens.refreshToken !== undefined ? { refresh: tokens.refreshToken } : {},
+    ...tokens.expiresInSeconds !== undefined ? { expires: now() + tokens.expiresInSeconds * 1000 } : {},
+    ...tokens.accountId !== undefined ? { accountId: tokens.accountId } : {},
+    ...tokens.expiresInSeconds === undefined && tokens.expiresAt !== undefined ? { expires: tokens.expiresAt } : {},
+    obtainedAt
+  };
+}
+var ACCESS_TOKEN_REFRESH_SKEW_MS = 120000, OAUTH_ENV_KEYS;
+var init_grants = __esm(() => {
+  init_shell_config();
+  OAUTH_ENV_KEYS = [
+    { provider: "grok", envKey: "XAI_API_KEY" },
+    { provider: "github-copilot", envKey: "GITHUB_COPILOT_TOKEN" }
+  ];
+});
+
+// src/lib/provider-config.ts
+import { existsSync as existsSync2 } from "fs";
+import path4 from "path";
 function isValidReasoningConfig(value) {
   if (value === undefined)
     return true;
@@ -486,11 +755,11 @@ function isValidReasoningConfig(value) {
   return true;
 }
 function llmProvidersConfigPath(dir) {
-  return path3.join(keryxConfigDir(dir), "llm-providers.json");
+  return path4.join(keryxConfigDir(dir), "llm-providers.json");
 }
 function readJson(file) {
   try {
-    if (!existsSync(file))
+    if (!existsSync2(file))
       return;
     const read = readConfigFile(file);
     return read.ok ? JSON.parse(read.text) : undefined;
@@ -779,7 +1048,7 @@ import {
 } from "fs";
 import { access, chmod, mkdir, readFile, rename, rm, stat, utimes, writeFile } from "fs/promises";
 import { hostname } from "os";
-import path4 from "path";
+import path5 from "path";
 async function pathExists(filePath) {
   try {
     await access(filePath);
@@ -795,13 +1064,13 @@ function toPosix(value) {
   return value.replace(/\\/g, "/");
 }
 function isPathInside(root, candidate) {
-  const relative = path4.relative(path4.resolve(root), path4.resolve(candidate));
-  return relative === "" || relative.length > 0 && !relative.startsWith("..") && !path4.isAbsolute(relative);
+  const relative = path5.relative(path5.resolve(root), path5.resolve(candidate));
+  return relative === "" || relative.length > 0 && !relative.startsWith("..") && !path5.isAbsolute(relative);
 }
 async function writeFileAtomic(filePath, content, options = {}) {
-  const dir = path4.dirname(filePath);
+  const dir = path5.dirname(filePath);
   await mkdir(dir, { recursive: true });
-  const tmp = path4.join(dir, `.${path4.basename(filePath)}.${process.pid}.${Date.now()}.${randomUUID2()}.tmp`);
+  const tmp = path5.join(dir, `.${path5.basename(filePath)}.${process.pid}.${Date.now()}.${randomUUID2()}.tmp`);
   try {
     if (options.mode === undefined) {
       await writeFile(tmp, content, "utf8");
@@ -823,8 +1092,8 @@ async function withFileLock(lockPath, fn, options = {}) {
   const heartbeatMs = options.heartbeatMs ?? Math.max(100, Math.floor(staleMs / 3));
   const startedAt = Date.now();
   const owner = { pid: process.pid, token: randomUUID2() };
-  const ownerPath = path4.join(lockPath, "owner.json");
-  await mkdir(path4.dirname(lockPath), { recursive: true });
+  const ownerPath = path5.join(lockPath, "owner.json");
+  await mkdir(path5.dirname(lockPath), { recursive: true });
   while (true) {
     try {
       await mkdir(lockPath);
@@ -869,7 +1138,7 @@ async function isLockHeld(lockPath, staleMs = DEFAULT_LOCK_STALE_MS) {
     const stats = await stat(lockPath);
     if (Date.now() - stats.mtimeMs <= staleMs)
       return true;
-    const owner = await readLockOwner(path4.join(lockPath, "owner.json"));
+    const owner = await readLockOwner(path5.join(lockPath, "owner.json"));
     return owner !== undefined && processIsAlive(owner.pid);
   } catch {
     return false;
@@ -882,7 +1151,7 @@ async function isSameEmptyOrOwnerlessDir(dir, ino) {
   try {
     if ((await stat(dir)).ino !== ino)
       return false;
-    return await readLockOwner(path4.join(dir, "owner.json")) === undefined;
+    return await readLockOwner(path5.join(dir, "owner.json")) === undefined;
   } catch {
     return false;
   }
@@ -892,7 +1161,7 @@ async function removeStaleLock(lockPath, staleMs, raceHook) {
     const stats = await stat(lockPath);
     if (Date.now() - stats.mtimeMs <= staleMs)
       return;
-    const owner = await readLockOwner(path4.join(lockPath, "owner.json"));
+    const owner = await readLockOwner(path5.join(lockPath, "owner.json"));
     if (owner && processIsAlive(owner.pid))
       return;
     await raceHook?.("stale-judged");
@@ -900,7 +1169,7 @@ async function removeStaleLock(lockPath, staleMs, raceHook) {
     await rename(lockPath, stalePath);
     await raceHook?.("moved-aside");
     const movedIno = (await stat(stalePath)).ino;
-    const moved = await readLockOwner(path4.join(stalePath, "owner.json"));
+    const moved = await readLockOwner(path5.join(stalePath, "owner.json"));
     if (movedIno !== stats.ino || moved?.token !== owner?.token) {
       await rename(stalePath, lockPath).catch(() => {});
       await raceHook?.("restored");
@@ -933,7 +1202,7 @@ function delay(ms) {
 }
 function readLeaseOwnerSync(lockPath) {
   try {
-    const value = JSON.parse(readFileSync2(path4.join(lockPath, LEASE_OWNER_FILE), "utf8"));
+    const value = JSON.parse(readFileSync2(path5.join(lockPath, LEASE_OWNER_FILE), "utf8"));
     if (value === null || typeof value !== "object")
       return;
     const record = value;
@@ -975,7 +1244,7 @@ function reclaimStaleLeaseSync(lockPath, owner, opts) {
 }
 function acquireOrReclaim(lockPath, owner, opts, takeStale) {
   const now = opts.now ?? Date.now;
-  mkdirSync2(path4.dirname(lockPath), { recursive: true, mode: 448 });
+  mkdirSync2(path5.dirname(lockPath), { recursive: true, mode: 448 });
   for (let attempt = 0;attempt < MAX_LEASE_ATTEMPTS; attempt += 1) {
     const createdIno = tryCreateLease(lockPath, owner, opts.raceHook);
     if (createdIno !== undefined) {
@@ -1013,7 +1282,7 @@ function tryCreateLease(lockPath, owner, raceHook) {
     throw error;
   }
   raceHook?.("create");
-  const ownerPath = path4.join(lockPath, LEASE_OWNER_FILE);
+  const ownerPath = path5.join(lockPath, LEASE_OWNER_FILE);
   try {
     chmodSync2(lockPath, 448);
     writeFileSync2(ownerPath, JSON.stringify(owner), { encoding: "utf8", flag: "wx", mode: 384 });
@@ -1063,7 +1332,7 @@ function removeLeaseDirIfUnchanged(lockPath, expectedToken) {
 function createLeaseHandle(lockPath, initial, createdIno, now, raceHook) {
   let current = { ...initial };
   let released = false;
-  const ownerPath = path4.join(lockPath, LEASE_OWNER_FILE);
+  const ownerPath = path5.join(lockPath, LEASE_OWNER_FILE);
   const ownership = () => {
     let ino;
     try {
@@ -1089,7 +1358,7 @@ function createLeaseHandle(lockPath, initial, createdIno, now, raceHook) {
         return false;
       raceHook?.("refresh");
       const next = { ...current, ...patch, token: initial.token, heartbeatAt: new Date(now()).toISOString() };
-      const tmp = path4.join(lockPath, `.${LEASE_OWNER_FILE}.${randomUUID2()}.tmp`);
+      const tmp = path5.join(lockPath, `.${LEASE_OWNER_FILE}.${randomUUID2()}.tmp`);
       try {
         writeFileSync2(tmp, JSON.stringify(next), { encoding: "utf8", flag: "wx", mode: 384 });
         if (!holds()) {
@@ -1124,135 +1393,6 @@ function createLeaseHandle(lockPath, initial, createdIno, now, raceHook) {
 var DEFAULT_LOCK_STALE_MS = 30000, LEASE_OWNER_FILE = "owner.json", MAX_LEASE_ATTEMPTS = 3;
 var init_fs = () => {};
 
-// src/lib/shell-config.ts
-import { existsSync as existsSync2 } from "fs";
-import path5 from "path";
-function noteSavedCredentialEnv(keys) {
-  for (const key of keys)
-    savedCredentialKeys.add(key);
-}
-function savedCredentialEnvKeys() {
-  return savedCredentialKeys;
-}
-function shellConfigPath(dir) {
-  return path5.join(keryxConfigDir(dir), "auth.json");
-}
-function loadShellConfig(dir) {
-  try {
-    const file = shellConfigPath(dir);
-    if (!existsSync2(file)) {
-      return {};
-    }
-    const read = readConfigFile(file);
-    if (!read.ok) {
-      return {};
-    }
-    const raw = JSON.parse(read.text);
-    return raw !== null && typeof raw === "object" ? raw : {};
-  } catch {
-    return {};
-  }
-}
-function saveShellConfig(patch, dir) {
-  try {
-    ensureKeryxConfigDir(dir);
-    const next = { ...loadShellConfig(dir), ...patch };
-    writeOwnerOnlyFileAtomic(shellConfigPath(dir), `${JSON.stringify(next, null, 2)}
-`);
-  } catch {}
-}
-function saveApiKey(envKey, value, dir) {
-  const existing = loadShellConfig(dir).apiKeys ?? {};
-  saveShellConfig({ apiKeys: { ...existing, [envKey]: value } }, dir);
-}
-function saveProviderBaseUrl(provider, baseUrl, dir) {
-  const existing = loadShellConfig(dir).baseUrls ?? {};
-  saveShellConfig({ baseUrls: { ...existing, [provider]: baseUrl } }, dir);
-}
-function removeApiKey(envKey, dir) {
-  const existing = loadShellConfig(dir).apiKeys ?? {};
-  if (!(envKey in existing))
-    return;
-  const { [envKey]: _removed, ...rest } = existing;
-  saveShellConfig({ apiKeys: rest }, dir);
-}
-function removeProviderBaseUrl(provider, dir) {
-  const existing = loadShellConfig(dir).baseUrls ?? {};
-  if (!(provider in existing))
-    return;
-  const { [provider]: _removed, ...rest } = existing;
-  saveShellConfig({ baseUrls: rest }, dir);
-}
-function removeProviderModelParams(provider, dir) {
-  const existing = loadShellConfig(dir).modelParams ?? {};
-  if (!(provider in existing))
-    return;
-  const { [provider]: _removed, ...rest } = existing;
-  saveShellConfig({ modelParams: rest }, dir);
-}
-function envWithSavedApiKeys(env = process.env, dir) {
-  const merged = { ...env };
-  try {
-    const cfg = loadShellConfig(dir);
-    const keys = { ...cfg.apiKeys ?? {} };
-    if (typeof cfg.openrouterKey === "string" && cfg.openrouterKey.length > 0 && keys.OPENROUTER_API_KEY === undefined) {
-      keys.OPENROUTER_API_KEY = cfg.openrouterKey;
-    }
-    for (const [envKey, value] of Object.entries(keys)) {
-      if (typeof value !== "string" || value.length === 0) {
-        continue;
-      }
-      const current = merged[envKey];
-      if (current === undefined || current.length === 0) {
-        merged[envKey] = value;
-      }
-    }
-    const grants = cfg.oauthGrants ?? {};
-    const grokAccess = grants.grok?.access;
-    if (typeof grokAccess === "string" && grokAccess.length > 0 && (merged.XAI_API_KEY === undefined || merged.XAI_API_KEY.length === 0)) {
-      merged.XAI_API_KEY = grokAccess;
-    }
-    const copilotAccess = grants["github-copilot"]?.access;
-    if (typeof copilotAccess === "string" && copilotAccess.length > 0 && (merged.GITHUB_COPILOT_TOKEN === undefined || merged.GITHUB_COPILOT_TOKEN.length === 0)) {
-      merged.GITHUB_COPILOT_TOKEN = copilotAccess;
-    }
-  } catch {}
-  return merged;
-}
-function declaredCredentialEnvKeys(dir) {
-  try {
-    return new Set(Object.keys(envWithSavedApiKeys({}, dir)));
-  } catch {
-    return new Set;
-  }
-}
-function applySavedApiKeys(dir) {
-  const applied = [];
-  try {
-    const before = new Set(Object.entries(process.env).filter(([, v]) => typeof v === "string" && v.length > 0).map(([k]) => k));
-    const merged = envWithSavedApiKeys(process.env, dir);
-    for (const [envKey, value] of Object.entries(merged)) {
-      if (typeof value !== "string" || value.length === 0) {
-        continue;
-      }
-      const current = process.env[envKey];
-      if (current === undefined || current.length === 0) {
-        process.env[envKey] = value;
-        if (!before.has(envKey)) {
-          applied.push(envKey);
-        }
-      }
-    }
-  } catch {}
-  noteSavedCredentialEnv(applied);
-  return applied;
-}
-var savedCredentialKeys;
-var init_shell_config = __esm(() => {
-  init_config_dir();
-  savedCredentialKeys = new Set;
-});
-
 // src/gdskills/model-tier.ts
 function isModelTier(value) {
   return typeof value === "string" && MODEL_TIERS.includes(value);
@@ -1996,146 +2136,6 @@ var init_model_profile = __esm(() => {
   STRENGTH_TIERS = new Set(["light", "standard", "deep"]);
 });
 
-// src/lib/oauth/openai-token.ts
-function codexTokenMetadata(token) {
-  if (typeof token !== "string" || token.length > 1e5 || token.split(".").length !== 3)
-    return {};
-  try {
-    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
-    if (typeof payload !== "object" || payload === null)
-      return {};
-    const claims = payload;
-    const auth = claims["https://api.openai.com/auth"];
-    const accountId = typeof auth === "object" && auth !== null ? auth.chatgpt_account_id : undefined;
-    return {
-      ...typeof accountId === "string" && accountId.length > 0 && accountId.trim() === accountId && !/[\r\n]/.test(accountId) ? { accountId } : {},
-      ...typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0 ? { expiresAt: claims.exp * 1000 } : {}
-    };
-  } catch {
-    return {};
-  }
-}
-
-// src/lib/oauth/grants.ts
-function loadOAuthGrant(provider, dir) {
-  const grants = loadShellConfig(dir).oauthGrants;
-  if (grants === undefined) {
-    return;
-  }
-  const grant = grants[provider] ?? (provider === "openai-codex" ? grants.openai : undefined);
-  if (grant === undefined || typeof grant.access !== "string" || grant.access.length === 0) {
-    return;
-  }
-  if (grant.method !== "device-code" && grant.method !== "oauth-pkce-loopback") {
-    return;
-  }
-  if (provider === "openai-codex" || provider === "openai") {
-    const metadata = codexTokenMetadata(grant.access);
-    return {
-      ...grant,
-      ...grant.accountId === undefined && metadata.accountId !== undefined ? { accountId: metadata.accountId } : {},
-      ...grant.expires === undefined && metadata.expiresAt !== undefined ? { expires: metadata.expiresAt } : {}
-    };
-  }
-  return grant;
-}
-function saveOAuthGrant(provider, grant, dir) {
-  const existing = loadShellConfig(dir).oauthGrants ?? {};
-  saveShellConfig({ oauthGrants: { ...existing, [provider]: grant } }, dir);
-}
-function deleteOAuthGrant(provider, dir) {
-  const existing = { ...loadShellConfig(dir).oauthGrants ?? {} };
-  if (existing[provider] === undefined && !(provider === "openai-codex" && existing.openai !== undefined)) {
-    return;
-  }
-  delete existing[provider];
-  if (provider === "openai-codex")
-    delete existing.openai;
-  saveShellConfig({ oauthGrants: existing }, dir);
-}
-function listOAuthGrantProviders(dir) {
-  const grants = loadShellConfig(dir).oauthGrants ?? {};
-  return [...new Set(Object.keys(grants).map((name) => name === "openai" ? "openai-codex" : name))].filter((name) => loadOAuthGrant(name, dir) !== undefined).sort();
-}
-function oauthGrantStatus(provider, dir, now = Date.now) {
-  const grant = loadOAuthGrant(provider, dir);
-  if (grant === undefined) {
-    return;
-  }
-  const expired = grant.expires !== undefined && grant.expires - now() <= 0;
-  return {
-    provider,
-    method: grant.method,
-    state: expired ? "expired" : "active",
-    ...grant.expires !== undefined ? { expiresAt: new Date(grant.expires).toISOString() } : {},
-    refreshable: typeof grant.refresh === "string" && grant.refresh.length > 0
-  };
-}
-function oauthAccessToken(provider, dir) {
-  const grant = loadOAuthGrant(provider, dir);
-  return grant?.access;
-}
-function grantNeedsRefresh(grant, now = Date.now) {
-  if (grant.refresh === undefined || grant.refresh.length === 0) {
-    return false;
-  }
-  if (grant.expires === undefined) {
-    return false;
-  }
-  return grant.expires - now() <= ACCESS_TOKEN_REFRESH_SKEW_MS;
-}
-function oauthEnvKeyFor(provider) {
-  return OAUTH_ENV_KEYS.find((entry) => entry.provider === provider)?.envKey;
-}
-function envWithOAuthAccess(env = process.env, dir) {
-  const merged = { ...env };
-  for (const { provider, envKey } of OAUTH_ENV_KEYS) {
-    const current = merged[envKey];
-    if (typeof current === "string" && current.length > 0) {
-      continue;
-    }
-    const access = oauthAccessToken(provider, dir);
-    if (access !== undefined) {
-      merged[envKey] = access;
-    }
-  }
-  return merged;
-}
-function applyOAuthAccessToEnv(dir) {
-  const applied = [];
-  const merged = envWithOAuthAccess(process.env, dir);
-  for (const { envKey } of OAUTH_ENV_KEYS) {
-    const value = merged[envKey];
-    const current = process.env[envKey];
-    if (typeof value === "string" && value.length > 0 && (current === undefined || current.length === 0)) {
-      process.env[envKey] = value;
-      applied.push(envKey);
-    }
-  }
-  noteSavedCredentialEnv(applied);
-  return applied;
-}
-function grantFromTokens(method, tokens, now = Date.now) {
-  const obtainedAt = new Date(now()).toISOString();
-  return {
-    method,
-    access: tokens.accessToken,
-    ...tokens.refreshToken !== undefined ? { refresh: tokens.refreshToken } : {},
-    ...tokens.expiresInSeconds !== undefined ? { expires: now() + tokens.expiresInSeconds * 1000 } : {},
-    ...tokens.accountId !== undefined ? { accountId: tokens.accountId } : {},
-    ...tokens.expiresInSeconds === undefined && tokens.expiresAt !== undefined ? { expires: tokens.expiresAt } : {},
-    obtainedAt
-  };
-}
-var ACCESS_TOKEN_REFRESH_SKEW_MS = 120000, OAUTH_ENV_KEYS;
-var init_grants = __esm(() => {
-  init_shell_config();
-  OAUTH_ENV_KEYS = [
-    { provider: "grok", envKey: "XAI_API_KEY" },
-    { provider: "github-copilot", envKey: "GITHUB_COPILOT_TOKEN" }
-  ];
-});
-
 // src/lib/oauth/device-code.ts
 function requestInit(base, signal) {
   return signal === undefined ? base : { ...base, signal };
@@ -17628,7 +17628,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.12",
+    version: "0.3.13",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -31215,7 +31215,10 @@ function defaultModelFor(provider) {
   const compat = providerByName(provider);
   return compat?.models[0] ?? "unknown";
 }
-function hasCredential(provider, env) {
+function hasCredential(provider, env, configDir) {
+  if (provider === "openai-codex") {
+    return loadOAuthGrant(provider, configDir) !== undefined;
+  }
   if (provider === "ollama") {
     return true;
   }
@@ -31338,6 +31341,7 @@ async function runModelTurn(input) {
 }
 var DEFAULT_PROVIDER = "anthropic", DEFAULT_MODELS;
 var init_single_turn = __esm(() => {
+  init_grants();
   init_make_provider();
   init_providers();
   init_shell_config();
@@ -83593,6 +83597,8 @@ async function runSections(args) {
   }
 }
 async function runEnrich(args) {
+  await Promise.resolve().then(() => init_grants());
+  applyOAuthAccessToEnv();
   await Promise.resolve().then(() => init_enrich2());
   const prompt = optionValue(args, "--prompt");
   const provider = optionValue(args, "--provider");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {