@mrciphersmith/keryx 0.3.3 → 0.3.6

package/dist/cli.js

@@ -690,7 +690,7 @@ function deviceCodeMethodLabel(provider) {
     return "SuperGrok Subscription";
   if (provider === "github-copilot")
     return "Login with GitHub Copilot";
-  if (provider === "openai")
+  if (provider === "openai-codex")
     return "ChatGPT Plus/Pro (headless)";
   return "Device authorization";
 }
@@ -728,8 +728,13 @@ var init_catalog = __esm(() => {
     },
     {
       provider: "openai",
-      label: "OpenAI",
-      methods: ["oauth-pkce-loopback", "device-code", "api-key"]
+      label: "OpenAI API",
+      methods: ["api-key"]
+    },
+    {
+      provider: "openai-codex",
+      label: "ChatGPT / Codex subscription",
+      methods: ["device-code"]
     },
     {
       provider: "github-copilot",
@@ -1991,19 +1996,47 @@ var init_model_profile = __esm(() => {
   STRENGTH_TIERS = new Set(["light", "standard", "deep"]);
 });
 
+// src/lib/oauth/openai-token.ts
+function codexTokenMetadata(token) {
+  if (typeof token !== "string" || token.length > 1e5 || token.split(".").length !== 3)
+    return {};
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null)
+      return {};
+    const claims = payload;
+    const auth = claims["https://api.openai.com/auth"];
+    const accountId = typeof auth === "object" && auth !== null ? auth.chatgpt_account_id : undefined;
+    return {
+      ...typeof accountId === "string" && accountId.length > 0 && accountId.trim() === accountId && !/[\r\n]/.test(accountId) ? { accountId } : {},
+      ...typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0 ? { expiresAt: claims.exp * 1000 } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+
 // src/lib/oauth/grants.ts
 function loadOAuthGrant(provider, dir) {
   const grants = loadShellConfig(dir).oauthGrants;
   if (grants === undefined) {
     return;
   }
-  const grant = grants[provider];
+  const grant = grants[provider] ?? (provider === "openai-codex" ? grants.openai : undefined);
   if (grant === undefined || typeof grant.access !== "string" || grant.access.length === 0) {
     return;
   }
   if (grant.method !== "device-code" && grant.method !== "oauth-pkce-loopback") {
     return;
   }
+  if (provider === "openai-codex" || provider === "openai") {
+    const metadata = codexTokenMetadata(grant.access);
+    return {
+      ...grant,
+      ...grant.accountId === undefined && metadata.accountId !== undefined ? { accountId: metadata.accountId } : {},
+      ...grant.expires === undefined && metadata.expiresAt !== undefined ? { expires: metadata.expiresAt } : {}
+    };
+  }
   return grant;
 }
 function saveOAuthGrant(provider, grant, dir) {
@@ -2012,15 +2045,17 @@ function saveOAuthGrant(provider, grant, dir) {
 }
 function deleteOAuthGrant(provider, dir) {
   const existing = { ...loadShellConfig(dir).oauthGrants ?? {} };
-  if (existing[provider] === undefined) {
+  if (existing[provider] === undefined && !(provider === "openai-codex" && existing.openai !== undefined)) {
     return;
   }
   delete existing[provider];
+  if (provider === "openai-codex")
+    delete existing.openai;
   saveShellConfig({ oauthGrants: existing }, dir);
 }
 function listOAuthGrantProviders(dir) {
   const grants = loadShellConfig(dir).oauthGrants ?? {};
-  return Object.keys(grants).filter((name) => loadOAuthGrant(name, dir) !== undefined).sort();
+  return [...new Set(Object.keys(grants).map((name) => name === "openai" ? "openai-codex" : name))].filter((name) => loadOAuthGrant(name, dir) !== undefined).sort();
 }
 function oauthGrantStatus(provider, dir, now = Date.now) {
   const grant = loadOAuthGrant(provider, dir);
@@ -2087,6 +2122,8 @@ function grantFromTokens(method, tokens, now = Date.now) {
     access: tokens.accessToken,
     ...tokens.refreshToken !== undefined ? { refresh: tokens.refreshToken } : {},
     ...tokens.expiresInSeconds !== undefined ? { expires: now() + tokens.expiresInSeconds * 1000 } : {},
+    ...tokens.accountId !== undefined ? { accountId: tokens.accountId } : {},
+    ...tokens.expiresInSeconds === undefined && tokens.expiresAt !== undefined ? { expires: tokens.expiresAt } : {},
     obtainedAt
   };
 }
@@ -2265,6 +2302,315 @@ var init_device_code = __esm(() => {
   };
 });
 
+// src/lib/oauth/openai-codex.ts
+function withSignal(base, signal) {
+  if (signal?.aborted === true)
+    throw new DeviceCodeError("cancelled", "device authorization was cancelled");
+  const timeout = AbortSignal.timeout(30000);
+  return { ...base, signal: signal === undefined ? timeout : AbortSignal.any([signal, timeout]) };
+}
+async function requestCodexDeviceCode(http) {
+  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/usercode`, withSignal({
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
+    body: JSON.stringify({ client_id: OPENAI_CODEX_CLIENT_ID })
+  }, http.signal));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok || typeof json !== "object" || json === null) {
+    throw new DeviceCodeError("failed", `ChatGPT device authorization failed (HTTP ${response.status})`);
+  }
+  const rec = json;
+  rec.user_code ??= rec.usercode;
+  if (typeof rec.device_auth_id !== "string" || rec.device_auth_id.length === 0 || typeof rec.user_code !== "string" || rec.user_code.length === 0 || [...rec.user_code].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)) {
+    throw new DeviceCodeError("failed", "ChatGPT device authorization is missing device_auth_id / user_code");
+  }
+  const intervalSeconds = Number(rec.interval);
+  return {
+    deviceAuthId: rec.device_auth_id,
+    userCode: rec.user_code,
+    verificationUri: `${OPENAI_CODEX_ISSUER}/codex/device`,
+    intervalMs: Number.isFinite(intervalSeconds) && intervalSeconds > 0 ? intervalSeconds * 1000 : 5000
+  };
+}
+async function pollCodexDeviceToken(challenge, http) {
+  const sleep = http.sleep;
+  const now = http.now ?? Date.now;
+  const deadline = now() + DEVICE_LOGIN_TIMEOUT_MS;
+  while (now() < deadline) {
+    if (http.signal?.aborted === true) {
+      throw new DeviceCodeError("cancelled", "device authorization was cancelled");
+    }
+    const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/token`, withSignal({
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
+      body: JSON.stringify({ device_auth_id: challenge.deviceAuthId, user_code: challenge.userCode })
+    }, http.signal));
+    if (response.ok) {
+      const data = await response.json();
+      if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
+        throw new DeviceCodeError("failed", "ChatGPT device token is missing authorization_code");
+      }
+      return exchangeCodexAuthorizationCode(data.authorization_code, data.code_verifier, http);
+    }
+    if (response.status !== 403 && response.status !== 404) {
+      throw new DeviceCodeError("failed", `ChatGPT device token poll failed (HTTP ${response.status})`);
+    }
+    await abortableSleep(Math.min(challenge.intervalMs, Math.max(0, deadline - now())), sleep, http.signal);
+  }
+  throw new DeviceCodeError("timeout", "ChatGPT device authorization timed out");
+}
+async function exchangeCodexAuthorizationCode(code, codeVerifier, http) {
+  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/oauth/token`, withSignal({
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: `${OPENAI_CODEX_ISSUER}/deviceauth/callback`,
+      client_id: OPENAI_CODEX_CLIENT_ID,
+      code_verifier: codeVerifier
+    }).toString()
+  }, http.signal));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok || typeof json !== "object" || json === null || typeof json.access_token !== "string") {
+    throw new DeviceCodeError("failed", `ChatGPT token exchange failed (HTTP ${response.status})`);
+  }
+  const rec = json;
+  const access = codexTokenMetadata(rec.access_token);
+  const accountId = codexTokenMetadata(rec.id_token).accountId ?? access.accountId;
+  return {
+    accessToken: rec.access_token,
+    ...accountId !== undefined ? { accountId } : {},
+    ...access.expiresAt !== undefined ? { expiresAt: access.expiresAt } : {},
+    ...typeof rec.refresh_token === "string" ? { refreshToken: rec.refresh_token } : {},
+    ...typeof rec.expires_in === "number" && Number.isFinite(rec.expires_in) && rec.expires_in > 0 ? { expiresInSeconds: rec.expires_in } : {}
+  };
+}
+async function abortableSleep(ms, sleep, signal) {
+  if (signal?.aborted === true)
+    throw new DeviceCodeError("cancelled", "device authorization was cancelled");
+  await new Promise((resolve, reject) => {
+    let timer;
+    const cleanup = () => {
+      if (timer !== undefined)
+        clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+    };
+    const onAbort = () => {
+      cleanup();
+      reject(new DeviceCodeError("cancelled", "device authorization was cancelled"));
+    };
+    const done = () => {
+      cleanup();
+      resolve();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (sleep === undefined)
+      timer = setTimeout(done, ms);
+    else
+      sleep(ms).then(done, () => {
+        cleanup();
+        reject(new DeviceCodeError("failed", "device authorization wait failed"));
+      });
+  });
+}
+var OPENAI_CODEX_ISSUER = "https://auth.openai.com", OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", DEVICE_LOGIN_TIMEOUT_MS;
+var init_openai_codex = __esm(() => {
+  init_device_code();
+  DEVICE_LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
+});
+
+// src/lib/oauth/openai-subscription.ts
+import { resolve, join } from "path";
+function failure(detail) {
+  return new SubscriptionAuthError(`ChatGPT subscription: ${detail}. ${LOGIN}`);
+}
+function enrich(grant) {
+  const metadata = codexTokenMetadata(grant.access);
+  return {
+    ...grant,
+    ...grant.accountId === undefined && metadata.accountId !== undefined ? { accountId: metadata.accountId } : {},
+    ...grant.expires === undefined && metadata.expiresAt !== undefined ? { expires: metadata.expiresAt } : {}
+  };
+}
+function cancelled(signal) {
+  if (signal?.aborted)
+    throw failure("authorization cancelled");
+}
+async function refreshOpenAiCodexGrant(input) {
+  cancelled(input.signal);
+  const loaded = loadOAuthGrant("openai-codex", input.configDir);
+  if (loaded === undefined)
+    throw failure("not signed in");
+  const grant = enrich(loaded);
+  const now = input.now ?? Date.now;
+  if (!input.forceRefresh && grant.expires !== undefined && grant.expires > now() + 120000)
+    return grant;
+  if (!grant.refresh) {
+    if (input.forceRefresh || grant.expires !== undefined && grant.expires <= now())
+      throw failure("login expired and cannot be refreshed");
+    return grant;
+  }
+  const key = resolve(input.configDir ?? keryxConfigDir());
+  let pending = refreshes.get(key);
+  if (pending === undefined) {
+    pending = refreshWithLock(grant, input, key);
+    refreshes.set(key, pending);
+    pending.finally(() => {
+      if (refreshes.get(key) === pending)
+        refreshes.delete(key);
+    }).catch(() => {});
+  }
+  if (input.signal === undefined)
+    return pending;
+  return new Promise((resolveGrant, reject) => {
+    const abort = () => {
+      cleanup();
+      reject(failure("authorization cancelled"));
+    };
+    const cleanup = () => input.signal?.removeEventListener("abort", abort);
+    input.signal?.addEventListener("abort", abort, { once: true });
+    if (input.signal?.aborted) {
+      abort();
+      return;
+    }
+    pending.then((result) => {
+      cleanup();
+      resolveGrant(result);
+    }, (error) => {
+      cleanup();
+      reject(error);
+    });
+  });
+}
+async function refreshWithLock(initial, input, configDir) {
+  try {
+    return await withFileLock(join(configDir, ".openai-codex-refresh.lock"), async () => {
+      const current = loadOAuthGrant("openai-codex", input.configDir);
+      if (current === undefined || current.obtainedAt !== initial.obtainedAt || initial.accountId !== undefined && current.accountId !== initial.accountId) {
+        throw failure("login changed while waiting for token refresh");
+      }
+      if (current.access !== initial.access || current.refresh !== initial.refresh)
+        return enrich(current);
+      return refreshGrant(current, input);
+    }, { timeoutMs: 35000, retryMs: 50, staleMs: 30000, heartbeatMs: 1000 });
+  } catch (error) {
+    if (error instanceof SubscriptionAuthError)
+      throw error;
+    throw failure("could not acquire or release the token refresh lock");
+  }
+}
+async function refreshGrant(grant, input) {
+  const now = input.now ?? Date.now;
+  try {
+    const response = await input.fetch(`${OPENAI_CODEX_ISSUER}/oauth/token`, {
+      method: "POST",
+      signal: AbortSignal.timeout(30000),
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ grant_type: "refresh_token", client_id: OPENAI_CODEX_CLIENT_ID, refresh_token: grant.refresh })
+    });
+    if (!response.ok)
+      throw failure(`token refresh failed (HTTP ${response.status})`);
+    const json = await response.json();
+    if (typeof json !== "object" || json === null)
+      throw failure("invalid token refresh response");
+    const rec = json;
+    if (typeof rec.access_token !== "string" || rec.access_token.length === 0)
+      throw failure("token refresh returned no access token");
+    const id = codexTokenMetadata(rec.id_token);
+    const access = codexTokenMetadata(rec.access_token);
+    const expires = typeof rec.expires_in === "number" && Number.isFinite(rec.expires_in) && rec.expires_in > 0 ? now() + rec.expires_in * 1000 : access.expiresAt;
+    const accountId = id.accountId ?? access.accountId ?? grant.accountId;
+    if (grant.accountId !== undefined && accountId !== grant.accountId)
+      throw failure("refreshed account does not match saved login");
+    const next = {
+      ...grant,
+      access: rec.access_token,
+      ...typeof rec.refresh_token === "string" && rec.refresh_token.length > 0 ? { refresh: rec.refresh_token } : {},
+      ...accountId !== undefined ? { accountId } : {},
+      lastRefreshedAt: new Date(now()).toISOString()
+    };
+    if (expires !== undefined)
+      next.expires = expires;
+    else
+      delete next.expires;
+    const current = loadOAuthGrant("openai-codex", input.configDir);
+    if (current?.access !== grant.access || current.refresh !== grant.refresh)
+      throw failure("login changed during token refresh");
+    saveOAuthGrant("openai-codex", next, input.configDir);
+    const persisted = loadOAuthGrant("openai-codex", input.configDir);
+    if (persisted?.access !== next.access || persisted.refresh !== next.refresh)
+      throw failure("could not save refreshed login");
+    return next;
+  } catch (error) {
+    if (error instanceof SubscriptionAuthError)
+      throw error;
+    throw failure("token refresh failed");
+  }
+}
+async function ensureOpenAiCodexGrant(input) {
+  const grant = await refreshOpenAiCodexGrant(input);
+  cancelled(input.signal);
+  if (grant.accountId === undefined || grant.accountId.length === 0 || /[\r\n]/.test(grant.accountId))
+    throw failure("saved login has no account identity");
+  if (grant.expires !== undefined && grant.expires <= (input.now ?? Date.now)())
+    throw failure("login has expired");
+  return { ...grant, accountId: grant.accountId };
+}
+var refreshes, LOGIN = "Run `keryx auth login openai-codex`.", SubscriptionAuthError;
+var init_openai_subscription = __esm(() => {
+  init_config_dir();
+  init_fs();
+  init_grants();
+  init_openai_codex();
+  refreshes = new Map;
+  SubscriptionAuthError = class SubscriptionAuthError extends Error {
+  };
+});
+
+// src/commands/subscription-models.ts
+async function fetchOpenAiCodexModels(fetchFn, opts = {}) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 8000);
+  let authenticated = false;
+  try {
+    const grant = await ensureOpenAiCodexGrant({ fetch: fetchFn, signal: controller.signal, ...opts.configDir !== undefined ? { configDir: opts.configDir } : {} });
+    authenticated = true;
+    const response = await fetchFn(`${OPENAI_CODEX_PICKER.baseUrl}/models?client_version=${CODEX_CATALOG_CLIENT_VERSION}`, {
+      headers: { Authorization: `Bearer ${grant.access}`, "ChatGPT-Account-ID": grant.accountId, originator: "keryx", Accept: "application/json" },
+      signal: controller.signal,
+      redirect: "error"
+    });
+    if (!response.ok) {
+      return { models: [], source: "fallback", failure: { kind: response.status === 401 || response.status === 403 ? "rejected" : "http", status: response.status } };
+    }
+    const body = await response.json();
+    const entries = typeof body === "object" && body !== null && "models" in body && Array.isArray(body.models) ? body.models : [];
+    const models = [...new Set(entries.flatMap((entry) => {
+      if (typeof entry !== "object" || entry === null || !("slug" in entry) || typeof entry.slug !== "string" || entry.slug.length === 0)
+        return [];
+      if (!("visibility" in entry) || entry.visibility !== "list")
+        return [];
+      return [entry.slug];
+    }))];
+    return models.length > 0 ? { models, source: "live" } : { models: [], source: "fallback", failure: { kind: "empty" } };
+  } catch {
+    return { models: [], source: "fallback", failure: controller.signal.aborted || authenticated ? { kind: "unreachable", detail: controller.signal.aborted ? "model listing timed out" : "subscription model listing failed" } : { kind: "rejected", status: 401, detail: "Run `keryx auth login openai-codex` to connect your ChatGPT subscription." } };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var OPENAI_CODEX_PICKER, CODEX_CATALOG_CLIENT_VERSION = "0.157.0";
+var init_subscription_models = __esm(() => {
+  init_openai_subscription();
+  OPENAI_CODEX_PICKER = {
+    name: "openai-codex",
+    label: "ChatGPT / Codex",
+    baseUrl: "https://chatgpt.com/backend-api/codex",
+    models: ["gpt-5.3-codex"]
+  };
+});
+
 // src/lib/oauth/copilot.ts
 function copilotApiBaseFromExchange(raw) {
   if (typeof raw !== "string" || raw.length === 0) {
@@ -2357,87 +2703,6 @@ var init_copilot = __esm(() => {
   init_device_code();
 });
 
-// src/lib/oauth/openai-codex.ts
-function withSignal(base, signal) {
-  return signal === undefined ? base : { ...base, signal };
-}
-async function requestCodexDeviceCode(http) {
-  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/usercode`, withSignal({
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
-    body: JSON.stringify({ client_id: OPENAI_CODEX_CLIENT_ID })
-  }, http.signal));
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok || typeof json !== "object" || json === null) {
-    throw new DeviceCodeError("failed", `ChatGPT device authorization failed (HTTP ${response.status})`);
-  }
-  const rec = json;
-  if (typeof rec.device_auth_id !== "string" || typeof rec.user_code !== "string") {
-    throw new DeviceCodeError("failed", "ChatGPT device authorization is missing device_auth_id / user_code");
-  }
-  const intervalSeconds = Number(rec.interval);
-  return {
-    deviceAuthId: rec.device_auth_id,
-    userCode: rec.user_code,
-    verificationUri: `${OPENAI_CODEX_ISSUER}/codex/device`,
-    intervalMs: Number.isFinite(intervalSeconds) && intervalSeconds > 0 ? intervalSeconds * 1000 : 5000
-  };
-}
-async function pollCodexDeviceToken(challenge, http) {
-  const sleep = http.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const now = http.now ?? Date.now;
-  const deadline = now() + 5 * 60 * 1000;
-  while (now() < deadline) {
-    if (http.signal?.aborted === true) {
-      throw new DeviceCodeError("cancelled", "device authorization was cancelled");
-    }
-    const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/token`, withSignal({
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
-      body: JSON.stringify({ device_auth_id: challenge.deviceAuthId, user_code: challenge.userCode })
-    }, http.signal));
-    if (response.ok) {
-      const data = await response.json();
-      if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
-        throw new DeviceCodeError("failed", "ChatGPT device token is missing authorization_code");
-      }
-      return exchangeCodexAuthorizationCode(data.authorization_code, data.code_verifier, http);
-    }
-    if (response.status !== 403 && response.status !== 404) {
-      throw new DeviceCodeError("failed", `ChatGPT device token poll failed (HTTP ${response.status})`);
-    }
-    await sleep(challenge.intervalMs + POLL_SAFETY_MARGIN_MS2);
-  }
-  throw new DeviceCodeError("timeout", "ChatGPT device authorization timed out");
-}
-async function exchangeCodexAuthorizationCode(code, codeVerifier, http) {
-  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/oauth/token`, withSignal({
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: `${OPENAI_CODEX_ISSUER}/deviceauth/callback`,
-      client_id: OPENAI_CODEX_CLIENT_ID,
-      code_verifier: codeVerifier
-    }).toString()
-  }, http.signal));
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok || typeof json !== "object" || json === null || typeof json.access_token !== "string") {
-    throw new DeviceCodeError("failed", `ChatGPT token exchange failed (HTTP ${response.status})`);
-  }
-  const rec = json;
-  return {
-    accessToken: rec.access_token,
-    ...typeof rec.refresh_token === "string" ? { refreshToken: rec.refresh_token } : {},
-    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {}
-  };
-}
-var OPENAI_CODEX_ISSUER = "https://auth.openai.com", OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", POLL_SAFETY_MARGIN_MS2 = 3000;
-var init_openai_codex = __esm(() => {
-  init_device_code();
-});
-
 // src/lib/oauth/login.ts
 function httpOf(input) {
   return {
@@ -2452,7 +2717,7 @@ function present(challenge, provider) {
     userCode: challenge.userCode,
     verificationUri: challenge.verificationUri,
     ...challenge.verificationUriComplete !== undefined ? { verificationUriComplete: challenge.verificationUriComplete } : {},
-    instructions: `Open ${challenge.verificationUri} and enter code: ${challenge.userCode} (${deviceCodeMethodLabel(provider)})`
+    instructions: `Open ${challenge.verificationUri} and enter code: ${challenge.userCode} (${deviceCodeMethodLabel(provider)}).` + (provider === "openai-codex" ? " Enable device code login in ChatGPT Settings > Security if required. Cancel with Ctrl+C." : "")
   };
 }
 async function loginRfc8628(input) {
@@ -2497,24 +2762,37 @@ async function loginDeviceCode(input) {
     return { ok: false, error: `${input.provider} does not support device authorization` };
   }
   try {
-    const tokens = input.provider === "openai" ? await loginCodex(input) : await loginRfc8628(input);
+    const tokens = input.provider === "openai-codex" ? await loginCodex(input) : await loginRfc8628(input);
     saveOAuthGrant(input.provider, grantFromTokens("device-code", tokens, input.now), input.dir);
+    if (input.provider === "openai-codex" && loadOAuthGrant(input.provider, input.dir)?.access !== tokens.accessToken) {
+      throw new DeviceCodeError("failed", "Could not save ChatGPT login securely. Check the Keryx config directory permissions.");
+    }
     return { ok: true, provider: input.provider };
   } catch (err) {
-    const message = err instanceof DeviceCodeError ? err.message : err instanceof Error ? err.message : "device authorization failed";
+    const message = input.signal?.aborted === true ? "Device authorization was cancelled." : input.provider === "openai-codex" && !(err instanceof DeviceCodeError) ? "ChatGPT device authorization failed. Run `keryx auth login openai-codex` to retry." : err instanceof DeviceCodeError ? err.message : err instanceof Error ? err.message : "device authorization failed";
     return { ok: false, error: message };
   }
 }
 async function loginCodex(input) {
-  const http = httpOf(input);
+  const timeout = AbortSignal.timeout(15 * 60 * 1000);
+  const http = { ...httpOf(input), signal: input.signal === undefined ? timeout : AbortSignal.any([input.signal, timeout]) };
   const challenge = await requestCodexDeviceCode(http);
   input.onChallenge(present({
     userCode: challenge.userCode,
     verificationUri: challenge.verificationUri
-  }, "openai"));
-  return pollCodexDeviceToken(challenge, http);
+  }, "openai-codex"));
+  const tokens = await pollCodexDeviceToken(challenge, http);
+  if (tokens.accountId === undefined) {
+    throw new DeviceCodeError("failed", "ChatGPT login returned no account identity. Run `keryx auth login openai-codex` to retry.");
+  }
+  return tokens;
 }
 async function refreshProviderGrant(provider, http, dir) {
+  if (provider === "openai-codex" || provider === "openai") {
+    if (loadOAuthGrant("openai-codex", dir) === undefined)
+      return;
+    return refreshOpenAiCodexGrant({ ...http, ...dir !== undefined ? { configDir: dir } : {} });
+  }
   const grant = loadOAuthGrant(provider, dir);
   if (grant === undefined || !grantNeedsRefresh(grant, http.now)) {
     return grant;
@@ -2537,9 +2815,6 @@ async function refreshProviderGrant(provider, http, dir) {
     saveOAuthGrant(provider, next, dir);
     return next;
   }
-  if (provider === "openai") {
-    return grant;
-  }
   const tokens = await refreshAccessToken({
     tokenEndpoint: endpoints.tokenEndpoint,
     clientId: endpoints.clientId,
@@ -2566,7 +2841,7 @@ async function refreshSavedGrants(http, dir, providers = SESSION_REFRESHED_GRANT
       }
       continue;
     }
-    if (!grantNeedsRefresh(grant, http.now))
+    if (!grantNeedsRefresh(grant, http.now) && !(provider === "openai-codex" && grant.expires === undefined))
       continue;
     try {
       await refreshProviderGrant(provider, http, dir);
@@ -2578,7 +2853,7 @@ async function refreshSavedGrants(http, dir, providers = SESSION_REFRESHED_GRANT
   return warnings;
 }
 function logoutProvider(provider, dir) {
-  deleteOAuthGrant(provider, dir);
+  deleteOAuthGrant(provider === "openai" ? "openai-codex" : provider, dir);
 }
 var SESSION_REFRESHED_GRANTS;
 var init_login = __esm(() => {
@@ -2588,7 +2863,8 @@ var init_login = __esm(() => {
   init_device_code();
   init_grants();
   init_openai_codex();
-  SESSION_REFRESHED_GRANTS = ["grok", "github-copilot"];
+  init_openai_subscription();
+  SESSION_REFRESHED_GRANTS = ["grok", "github-copilot", "openai-codex"];
 });
 
 // src/lib/caller-session.ts
@@ -3635,6 +3911,40 @@ var init_provider_catalog_cache = __esm(() => {
   CATALOG_CACHE_TTL_MS = 5 * 60 * 1000;
 });
 
+// src/lib/oauth/open-url.ts
+import { spawn } from "child_process";
+function browserOpenPlan(url, platform = process.platform, env = process.env) {
+  if (url.length === 0) {
+    return;
+  }
+  if (platform === "darwin") {
+    return { cmd: "open", args: [url] };
+  }
+  if (platform === "win32") {
+    return { cmd: "cmd", args: ["/c", "start", "", url] };
+  }
+  if (typeof env.DISPLAY === "string" && env.DISPLAY.length > 0) {
+    return { cmd: "xdg-open", args: [url] };
+  }
+  if (typeof env.WAYLAND_DISPLAY === "string" && env.WAYLAND_DISPLAY.length > 0) {
+    return { cmd: "xdg-open", args: [url] };
+  }
+  return;
+}
+function openVerificationUrl(url, deps = {}) {
+  const plan = browserOpenPlan(url, deps.platform ?? process.platform, deps.env ?? process.env);
+  if (plan === undefined) {
+    return;
+  }
+  const spawnFn = deps.spawn ?? spawn;
+  try {
+    const child = spawnFn(plan.cmd, plan.args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+var init_open_url = () => {};
+
 // src/harness/policy/engine.ts
 import path8 from "path";
 function baseOutcomeFor(risk, defaults) {
@@ -4151,15 +4461,12 @@ async function detectProviders(deps) {
   if (typeof anthropicKey === "string" && anthropicKey.length > 0) {
     detected.push({ name: "anthropic", models: [...ANTHROPIC_MODELS] });
   }
-  const openaiKey = deps.env.OPENAI_API_KEY;
-  if (typeof openaiKey === "string" && openaiKey.length > 0) {
-    detected.push({ name: "openai", models: [...OPENAI_MODELS] });
-  }
+  detected.push({ name: OPENAI_CODEX_PICKER.name, label: OPENAI_CODEX_PICKER.label, models: [...OPENAI_CODEX_PICKER.models], note: "ChatGPT subscription \xB7 browser device login" });
   const geminiKey = deps.env.GEMINI_API_KEY ?? deps.env.GOOGLE_API_KEY;
   if (typeof geminiKey === "string" && geminiKey.length > 0) {
     detected.push({ name: "gemini", models: [...GEMINI_MODELS] });
   }
-  for (const p of allOpenAiCompatProviders()) {
+  for (const p of allOpenAiCompatProviders(deps.configDir)) {
     if (!isProviderPlatformSupported(p, platform)) {
       continue;
     }
@@ -4219,6 +4526,31 @@ function parseChoice(line, count) {
 function toSelection(provider, model) {
   return provider.baseUrl === undefined ? { provider: provider.name, model } : { provider: provider.name, model, baseUrl: provider.baseUrl };
 }
+async function loginSubscriptionInReadline(io, deps, fetchFn) {
+  const controller = new AbortController;
+  const cancel = () => controller.abort();
+  const signal = deps.signal === undefined ? controller.signal : AbortSignal.any([controller.signal, deps.signal]);
+  process.on("SIGINT", cancel);
+  try {
+    io.write(`Connect your ChatGPT subscription (Ctrl+C to cancel).
+`);
+    const result = await loginDeviceCode({
+      provider: "openai-codex",
+      fetch: (url, init) => fetchFn(url, init),
+      signal,
+      ...deps.configDir === undefined ? {} : { dir: deps.configDir },
+      onChallenge: (challenge) => {
+        io.write(`${challenge.instructions}
+`);
+        (deps.openVerificationUrl ?? openVerificationUrl)(challenge.verificationUriComplete ?? challenge.verificationUri);
+      }
+    });
+    if (!result.ok)
+      throw new SubscriptionSelectionError(signal.aborted ? "ChatGPT subscription login cancelled" : result.error);
+  } finally {
+    process.removeListener("SIGINT", cancel);
+  }
+}
 async function pickProviderModel(io, detected, deps = {}) {
   const fetchFn = deps.fetch ?? globalThis.fetch;
   const env = deps.env ?? process.env;
@@ -4266,9 +4598,20 @@ async function pickProviderModel(io, detected, deps = {}) {
     chosenProvider = provider;
     break;
   }
+  if (chosenProvider.name === "openai-codex" && loadOAuthGrant("openai-codex", deps.configDir) === undefined) {
+    await loginSubscriptionInReadline(io, deps, fetchFn);
+  }
   io.write(`Fetching models for ${chosenProvider.name}\u2026
 `);
-  const resolved = await resolveModelsForPicker(fetchFn, chosenProvider, env);
+  const modelOptions = deps.configDir === undefined ? {} : { configDir: deps.configDir };
+  let resolved = await resolveModelsForPicker(fetchFn, chosenProvider, env, modelOptions);
+  if (chosenProvider.name === "openai-codex" && resolved.failure?.kind === "rejected") {
+    await loginSubscriptionInReadline(io, deps, fetchFn);
+    resolved = await resolveModelsForPicker(fetchFn, chosenProvider, env, modelOptions);
+  }
+  if (chosenProvider.name === "openai-codex" && (resolved.source !== "live" || resolved.models.length === 0)) {
+    throw new SubscriptionSelectionError("ChatGPT subscription models are unavailable. Try again or run `keryx auth login openai-codex`.");
+  }
   const models = resolved.models.length > 0 ? resolved.models : chosenProvider.models;
   if (resolved.source === "live") {
     io.write(`  (${models.length} model(s) from API)
@@ -4303,12 +4646,18 @@ async function pickProviderModel(io, detected, deps = {}) {
     return toSelection(chosenProvider, model);
   }
 }
-var DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434", FAKE_MODELS;
+var DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434", FAKE_MODELS, SubscriptionSelectionError;
 var init_select = __esm(() => {
+  init_subscription_models();
+  init_grants();
+  init_login();
+  init_open_url();
   init_guard();
   init_providers();
   init_curated_model_lists();
   FAKE_MODELS = ["fake-echo"];
+  SubscriptionSelectionError = class SubscriptionSelectionError extends Error {
+  };
 });
 
 // src/harness/provider-catalog.ts
@@ -4326,6 +4675,12 @@ async function buildCatalogEntry(detected, deps, fetchedAt) {
       ...detected.label !== undefined ? { label: detected.label } : {}
     };
   }
+  if (detected.name === "openai-codex") {
+    if (loadOAuthGrant("openai-codex", deps.dir) === undefined)
+      return;
+    const result = await fetchOpenAiCodexModels(deps.fetch, { ...deps.dir !== undefined ? { configDir: deps.dir } : {}, timeoutMs: deps.timeoutMs ?? CATALOG_FETCH_TIMEOUT_MS });
+    return { name: detected.name, status: classifyModelsStatus(result), models: result.models, fallbackModels: [...detected.models], fetchedAt, label: detected.label ?? "ChatGPT / Codex" };
+  }
   const registry = providerByName(detected.name, deps.dir);
   if (registry === undefined) {
     return {
@@ -4338,7 +4693,7 @@ async function buildCatalogEntry(detected, deps, fetchedAt) {
     };
   }
   const requiresApiKey = registry.requiresApiKey ?? true;
-  const apiKey = providerApiKey(registry, deps.env) ?? registry.apiKey;
+  const apiKey = providerApiKey(registry, envWithSavedApiKeys(deps.env, deps.dir)) ?? registry.apiKey;
   if (requiresApiKey && (apiKey === undefined || apiKey.length === 0)) {
     return;
   }
@@ -4375,6 +4730,7 @@ async function refreshProviderCatalog(deps) {
   const detectDeps = {
     fetch: deps.fetch,
     env: deps.env,
+    ...deps.dir !== undefined ? { configDir: deps.dir } : {},
     ...deps.baseUrl !== undefined ? { baseUrl: deps.baseUrl } : {},
     ...deps.platform !== undefined ? { platform: deps.platform } : {}
   };
@@ -4446,6 +4802,9 @@ function describeCatalogStatus(status) {
 }
 var CATALOG_FETCH_TIMEOUT_MS = 8000;
 var init_provider_catalog = __esm(() => {
+  init_grants();
+  init_shell_config();
+  init_subscription_models();
   init_select();
   init_providers();
   init_provider_catalog_cache();
@@ -4511,8 +4870,11 @@ function resolveProviderModelParamsByName(name, shellConfig = loadShellConfig(),
 function providerByName(name, dir) {
   return allOpenAiCompatProviders(dir).find((p) => p.name === name);
 }
+function connectionProviderByName(name, dir) {
+  return name === "openai-codex" ? OPENAI_CODEX_PICKER : providerByName(name, dir);
+}
 function customCompatProviders(dir) {
-  const builtinNames = new Set(OPENAI_COMPAT_PROVIDERS.map((p) => p.name));
+  const builtinNames = new Set([...OPENAI_COMPAT_PROVIDERS.map((p) => p.name), "openai-codex"]);
   return loadCustomCompatProviders(dir).filter((p) => !builtinNames.has(p.name)).map((p) => ({
     name: p.name,
     label: p.label ?? p.name,
@@ -4690,12 +5052,14 @@ async function fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, opts)
   }
 }
 async function resolveModelsForPicker(fetchFn, provider, env = process.env, opts) {
-  const compat = providerByName(provider.name);
+  if (provider.name === "openai-codex")
+    return fetchOpenAiCodexModels(fetchFn, opts);
+  const compat = providerByName(provider.name, opts?.configDir);
   if (compat === undefined) {
     return { models: [...provider.models], source: "fallback" };
   }
   const envKey = provider.envKey ?? compat.envKey;
-  const raw = envKey === undefined ? undefined : env[envKey];
+  const raw = envKey === undefined ? undefined : envWithSavedApiKeys(env, opts?.configDir)[envKey];
   const apiKey = typeof raw === "string" && raw.length > 0 ? raw : compat.apiKey;
   return fetchOpenAiCompatModelsDetailed(fetchFn, { ...compat, ...provider.baseUrl !== undefined ? { baseUrl: provider.baseUrl } : {} }, apiKey, opts);
 }
@@ -4819,7 +5183,9 @@ function providerApiKey(provider, env = process.env) {
   return typeof raw === "string" && raw.length > 0 ? raw : undefined;
 }
 async function testProviderConnection(provider, fetchFn = globalThis.fetch, env = process.env, profiles) {
-  const apiKey = providerApiKey(provider, env) ?? provider.apiKey;
+  if (provider.name === "openai-codex")
+    return fetchOpenAiCodexModels(fetchFn, { ...profiles?.dir !== undefined ? { configDir: profiles.dir } : {} });
+  const apiKey = providerApiKey(provider, envWithSavedApiKeys(env, profiles?.dir)) ?? provider.apiKey;
   return fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, {
     timeoutMs: MODELS_FETCH_TIMEOUT_MS,
     ...profiles !== undefined ? { refreshProfiles: profiles } : {}
@@ -4837,7 +5203,7 @@ function classifyProviderConnection(name, env = process.env, dir) {
   if (customCompatProviders(dir).some((p) => p.name === name)) {
     return { kind: "custom", sharedWith: [] };
   }
-  if (loadShellConfig(dir).oauthGrants?.[name] !== undefined) {
+  if (name !== "openai" && loadOAuthGrant(name, dir) !== undefined) {
     const envKey = oauthEnvKeyFor(name);
     const sharedWith = envKey === undefined ? [] : providersSharingEnvKey(envKey, name, allOpenAiCompatProviders(dir));
     return { kind: "oauth-grant", ...envKey !== undefined ? { envKey } : {}, sharedWith };
@@ -4905,7 +5271,7 @@ function configuredProviders(env = process.env, dir) {
     if (provider.requiresApiKey === false)
       return true;
     return providerApiKey(provider, env) !== undefined || provider.apiKey !== undefined;
-  }).filter((provider) => isProviderPlatformSupported(provider)).map((provider) => ({ name: provider.name, models: provider.models }));
+  }).filter((provider) => isProviderPlatformSupported(provider)).map((provider) => ({ name: provider.name, models: provider.models })).concat(loadOAuthGrant("openai-codex", dir) === undefined ? [] : [{ name: "openai-codex", models: [...OPENAI_CODEX_PICKER.models] }]);
 }
 async function providersCommand(args, deps = {}) {
   const command = args[0];
@@ -4945,7 +5311,7 @@ async function runProvidersTest(args, deps) {
     return;
   }
   const dir = deps.dir;
-  const provider = providerByName(name, dir);
+  const provider = connectionProviderByName(name, dir);
   if (provider === undefined) {
     console.error(`Unknown provider: ${name}`);
     process.exitCode = 1;
@@ -5017,7 +5383,7 @@ async function runProvidersRemove(args, deps) {
   const dir = deps.dir;
   const env = deps.env ?? process.env;
   const json = args.includes("--json");
-  if (providerByName(name, dir) === undefined) {
+  if (connectionProviderByName(name, dir) === undefined) {
     if (json) {
       console.log(JSON.stringify({ provider: name, ok: false, reason: "unknown provider" }, null, 2));
     } else {
@@ -5218,6 +5584,8 @@ var init_providers = __esm(() => {
   init_provider_config();
   init_catalog();
   init_model_profile();
+  init_subscription_models();
+  init_curated_model_lists();
   init_grants();
   init_login();
   init_caller_session();
@@ -5228,6 +5596,7 @@ var init_providers = __esm(() => {
   MINIMAX_REASONING_PRESET_HOSTS = new Set(["api.minimax.io", "api.minimaxi.com"]);
   DEEPSEEK_REASONING_PRESET_HOSTS = new Set(["api.deepseek.com"]);
   OPENAI_COMPAT_PROVIDERS = [
+    { name: "openai", label: "OpenAI API", baseUrl: "https://api.openai.com", envKey: "OPENAI_API_KEY", models: [...OPENAI_MODELS], note: "Platform API key \xB7 separate API billing" },
     {
       name: "openrouter",
       label: "OpenRouter",
@@ -8796,7 +9165,7 @@ var init_redact = __esm(() => {
 });
 
 // src/security/output-validation.ts
-function failure(reason) {
+function failure2(reason) {
   return {
     ok: false,
     text: FORMAT_UNSAFE_OUTPUT_TEXT,
@@ -9057,12 +9426,12 @@ function validateOutputForTransport(input) {
   try {
     if (input.format === "text") {
       if (typeof input.value !== "string") {
-        return failure("non-text-value");
+        return failure2("non-text-value");
       }
       const safe = redactString(input.value, undefined, input.exemptExfil);
       const schemaReason = schemaFailure(safe.value, input.schema);
       if (schemaReason !== undefined)
-        return failure(schemaReason);
+        return failure2(schemaReason);
       const reasons = uniqueSorted(safe.reasons);
       return {
         ok: true,
@@ -9076,10 +9445,10 @@ function validateOutputForTransport(input) {
     }
     const safe = sanitizeJsonValue(input.value, undefined, new WeakSet, input.exemptExfil);
     if (!safe.ok)
-      return failure(safe.reason);
+      return failure2(safe.reason);
     const schemaReason = schemaFailure(safe.value, input.schema);
     if (schemaReason !== undefined)
-      return failure(schemaReason);
+      return failure2(schemaReason);
     const reasons = uniqueSorted(safe.reasons);
     return {
       ok: true,
@@ -9091,7 +9460,7 @@ function validateOutputForTransport(input) {
       }
     };
   } catch {
-    return failure("validation.error");
+    return failure2("validation.error");
   }
 }
 function skipWhitespace(scanner) {
@@ -17259,7 +17628,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.3",
+    version: "0.3.6",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -21823,14 +22192,14 @@ var init_config2 = __esm(() => {
 // src/sync/provenance.ts
 import { mkdir as mkdir9, readFile as readFile20, writeFile as writeFile7 } from "fs/promises";
 import path52 from "path";
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 function provenancePath(cwd, module) {
   return path52.join(cwd, ".metaproject", "data", module, ".provenance.json");
 }
 function gitCmdResult(cwd, args) {
   return new Promise((resolve) => {
     try {
-      const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn2("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
       let out = "";
       let err = "";
       child.stdout?.on("data", (chunk) => {
@@ -21940,13 +22309,13 @@ var init_provenance = __esm(() => {
 });
 
 // src/gdgraph/staleness.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { stat as stat8 } from "fs/promises";
 import path53 from "path";
 function gitStatusPorcelain(cwd) {
   return new Promise((resolve) => {
     try {
-      const child = spawn2("git", ["status", "--porcelain=v1", "-z"], { cwd, stdio: ["ignore", "pipe", "ignore"] });
+      const child = spawn3("git", ["status", "--porcelain=v1", "-z"], { cwd, stdio: ["ignore", "pipe", "ignore"] });
       let out = "";
       child.stdout?.on("data", (chunk) => {
         out += String(chunk);
@@ -30016,14 +30385,14 @@ function asNumber5(value) {
 function clampOpenAiReasoningEffort(effort) {
   return effort === "xhigh" || effort === "max" ? "high" : effort;
 }
-function ownedReasoningItems(reasoning) {
+function ownedReasoningItems(reasoning, providerId) {
   const replay = reasoning?.replay;
   if (replay === undefined) {
     return [];
   }
   const items = [];
   for (const item of replay) {
-    if (item.providerId !== PROVIDER_ID2 || item.kind !== "reasoning_item") {
+    if (item.providerId !== providerId || item.kind !== "reasoning_item") {
       continue;
     }
     if (isPlainObject7(item.data)) {
@@ -30032,7 +30401,7 @@ function ownedReasoningItems(reasoning) {
   }
   return items;
 }
-function toResponsesInput(messages) {
+function toResponsesInput(messages, providerId) {
   const out = [];
   for (const linked of linkToolCalls(messages)) {
     const message = linked.message;
@@ -30048,7 +30417,7 @@ function toResponsesInput(messages) {
       continue;
     }
     if (message.role === "assistant") {
-      for (const item of ownedReasoningItems(message.reasoning)) {
+      for (const item of ownedReasoningItems(message.reasoning, providerId)) {
         out.push(item);
       }
     }
@@ -30136,14 +30505,23 @@ function classifyHttpError3(status, headers, code) {
   }
   return { kind: "unknown", retryable: retryableFor4("unknown", false), message: "" };
 }
-async function raceReadAgainstDeadline4(reader, ms) {
+async function raceReadAgainstDeadline4(reader, ms, signal) {
+  if (signal?.aborted === true)
+    return READ_CANCELLED;
   let timer;
   const deadline = new Promise((resolve) => {
     timer = setTimeout(() => resolve(READ_TIMED_OUT4), ms);
   });
+  let onAbort;
+  const aborted = new Promise((resolve) => {
+    onAbort = () => resolve(READ_CANCELLED);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
   try {
-    return await Promise.race([reader.read(), deadline]);
+    return await Promise.race([reader.read(), deadline, aborted]);
   } finally {
+    if (onAbort !== undefined)
+      signal?.removeEventListener("abort", onAbort);
     if (timer !== undefined) {
       clearTimeout(timer);
     }
@@ -30165,6 +30543,9 @@ async function* drainAndCheckAbort4(queue, signal, stamp) {
 
 class OpenAiProvider {
   deps;
+  get providerId() {
+    return this.deps.codex === undefined ? PROVIDER_ID2 : "openai-codex";
+  }
   constructor(deps) {
     this.deps = deps;
   }
@@ -30182,15 +30563,15 @@ class OpenAiProvider {
     };
     return {
       capabilities,
-      descriptor: { providerId: PROVIDER_ID2, providerRevision: PROVIDER_REVISION4 }
+      descriptor: { providerId: this.providerId, providerRevision: PROVIDER_REVISION4 }
     };
   }
   descriptorDocument() {
     return {
       schemaVersion: 1,
-      providerId: PROVIDER_ID2,
+      providerId: this.providerId,
       providerRevision: PROVIDER_REVISION4,
-      models: [{ modelId: DEFAULT_MODEL4.modelId, revision: DEFAULT_MODEL4.revision }],
+      models: [{ modelId: this.deps.codex === undefined ? DEFAULT_MODEL4.modelId : "gpt-5.4", revision: DEFAULT_MODEL4.revision }],
       capabilities: {
         streaming: true,
         tools: true,
@@ -30215,7 +30596,8 @@ class OpenAiProvider {
       });
       return;
     }
-    const baseUrl = grant.baseUrl ?? DEFAULT_BASE_URL4;
+    const codex = this.deps.codex;
+    const baseUrl = codex === undefined ? grant.baseUrl ?? DEFAULT_BASE_URL4 : "https://chatgpt.com/backend-api/codex";
     let host;
     try {
       host = new URL(baseUrl).hostname;
@@ -30230,10 +30612,16 @@ class OpenAiProvider {
       });
       return;
     }
-    const url = `${baseUrl.replace(/\/+$/, "")}/v1/responses`;
+    const url = `${baseUrl.replace(/\/+$/, "")}${codex === undefined ? "/v1/responses" : "/responses"}`;
     const headers = {
       authorization: `Bearer ${grant.apiKey}`,
-      "content-type": "application/json"
+      "content-type": "application/json",
+      ...codex === undefined ? {} : {
+        "ChatGPT-Account-ID": codex.accountId,
+        originator: "keryx",
+        "User-Agent": "keryx",
+        accept: "text/event-stream"
+      }
     };
     const requestedReasoningEffort = request.options?.reasoning;
     const reasoningRequested = typeof requestedReasoningEffort === "string" && requestedReasoningEffort.length > 0 && requestedReasoningEffort !== "off";
@@ -30241,10 +30629,10 @@ class OpenAiProvider {
     const payload = {
       model: request.modelId,
       instructions: request.systemInstruction,
-      input: toResponsesInput(request.messages),
+      input: toResponsesInput(request.messages, this.providerId),
       stream: true,
-      max_output_tokens: request.budget.maxOutputTokens,
-      ...request.options?.temperature !== undefined && !reasoningRequested ? { temperature: request.options.temperature } : {},
+      ...codex === undefined ? { max_output_tokens: request.budget.maxOutputTokens } : { store: false, tool_choice: "auto", parallel_tool_calls: true, tools: [] },
+      ...codex === undefined && request.options?.temperature !== undefined && !reasoningRequested ? { temperature: request.options.temperature } : {},
       ...reasoningRequested ? {
         reasoning: { effort: reasoningEffort, summary: "auto" },
         include: ["reasoning.encrypted_content"],
@@ -30328,7 +30716,7 @@ class OpenAiProvider {
         const timeoutMs = receivedAnyChunk ? idleTimeoutMs : firstByteTimeoutMs;
         let readResult;
         try {
-          readResult = await raceReadAgainstDeadline4(reader, timeoutMs);
+          readResult = await raceReadAgainstDeadline4(reader, timeoutMs, opts.signal);
         } catch (cause) {
           cancelReader();
           const aborted = opts.signal?.aborted === true || typeof cause === "object" && cause !== null && cause.name === "AbortError";
@@ -30343,6 +30731,11 @@ class OpenAiProvider {
           });
           return;
         }
+        if (readResult === READ_CANCELLED) {
+          cancelReader();
+          yield errorEvent({ kind: "cancelled", retryable: retryableFor4("cancelled", false), message: "attempt cancelled" });
+          return;
+        }
         if (readResult === READ_TIMED_OUT4) {
           cancelReader();
           yield errorEvent({
@@ -30471,7 +30864,7 @@ class OpenAiProvider {
                 }
                 bodies.push({
                   kind: "reasoning_replay",
-                  replay: { providerId: PROVIDER_ID2, kind: "reasoning_item", data: item }
+                  replay: { providerId: this.providerId, kind: "reasoning_item", data: item }
                 });
               }
               break;
@@ -30591,7 +30984,7 @@ class OpenAiProvider {
     }
   }
 }
-var DEFAULT_BASE_URL4 = "https://api.openai.com", PROVIDER_ID2 = "openai", PROVIDER_REVISION4 = "openai-responses-2026-08", DEFAULT_MODEL4, DEFAULT_STREAM_TIMEOUT_MS4 = 120000, READ_TIMED_OUT4;
+var DEFAULT_BASE_URL4 = "https://api.openai.com", PROVIDER_ID2 = "openai", PROVIDER_REVISION4 = "openai-responses-2026-08", DEFAULT_MODEL4, DEFAULT_STREAM_TIMEOUT_MS4 = 120000, READ_TIMED_OUT4, READ_CANCELLED;
 var init_openai_provider = __esm(() => {
   init_guard();
   init_provider_port();
@@ -30600,11 +30993,94 @@ var init_openai_provider = __esm(() => {
     revision: "2026-08"
   };
   READ_TIMED_OUT4 = Symbol("openai-read-timed-out");
+  READ_CANCELLED = Symbol("openai-read-cancelled");
+});
+
+// src/harness/provider/openai-codex/openai-codex-provider.ts
+class OpenAiCodexProvider {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  describe() {
+    return new OpenAiProvider({ fetch: this.deps.fetch, codex: { accountId: "" } }).describe();
+  }
+  async* stream(request, opts) {
+    const failure = (cancelled) => ({
+      kind: "provider_error",
+      sequence: 0,
+      attemptId: opts.attemptId,
+      error: {
+        kind: cancelled ? "cancelled" : "authentication",
+        retryable: false,
+        message: cancelled ? "attempt cancelled" : `ChatGPT subscription authorization is unavailable. ${LOGIN_HINT}`
+      }
+    });
+    if (isCancelled(opts.signal)) {
+      yield failure(true);
+      return;
+    }
+    if (this.deps.authorize === undefined) {
+      yield failure(false);
+      return;
+    }
+    for (let attempt = 0;attempt < 2; attempt++) {
+      let grant;
+      try {
+        grant = await this.deps.authorize(opts.signal, attempt > 0);
+      } catch {
+        yield failure(isCancelled(opts.signal));
+        return;
+      }
+      if (isCancelled(opts.signal)) {
+        yield failure(true);
+        return;
+      }
+      if (grant.access.length === 0 || grant.accountId.length === 0) {
+        yield failure(false);
+        return;
+      }
+      const provider = new OpenAiProvider({
+        fetch: this.deps.fetch,
+        grant: { network: true, apiKey: grant.access },
+        codex: { accountId: grant.accountId }
+      });
+      let emitted = false;
+      let retry = false;
+      for await (const event of provider.stream(request, opts)) {
+        if (event.error?.kind === "authentication") {
+          if (attempt === 0 && !emitted) {
+            retry = true;
+            break;
+          }
+          yield { ...event, error: { ...event.error, message: `ChatGPT subscription authorization was rejected. ${LOGIN_HINT}` } };
+          return;
+        }
+        emitted = true;
+        yield event;
+      }
+      if (!retry)
+        return;
+    }
+  }
+}
+var LOGIN_HINT = "Run `keryx auth login openai-codex`.", isCancelled = (signal) => signal?.aborted === true;
+var init_openai_codex_provider = __esm(() => {
+  init_openai_provider();
 });
 
 // src/harness/provider/make-provider.ts
 function makeProvider(name, _model, opts) {
   const env = opts.credentials ?? opts.env ?? process.env;
+  if (name === "openai-codex") {
+    const authorize = opts.openAiCodexGrant ?? (opts.credentials === undefined ? (signal, forceRefresh) => ensureOpenAiCodexGrant({
+      fetch: (url, init) => opts.fetch(url, init),
+      ...opts.configDir === undefined ? {} : { configDir: opts.configDir },
+      ...signal === undefined ? {} : { signal },
+      ...forceRefresh === undefined ? {} : { forceRefresh }
+    }) : undefined);
+    return new OpenAiCodexProvider({ fetch: opts.fetch, ...authorize === undefined ? {} : { authorize } });
+  }
   if (name === "anthropic") {
     const apiKey = env.ANTHROPIC_API_KEY;
     if (apiKey === undefined || apiKey.length === 0) {
@@ -30661,12 +31137,14 @@ var OLLAMA_COMPAT_IDENTITY;
 var init_make_provider = __esm(() => {
   init_providers();
   init_catalog();
+  init_openai_subscription();
   init_anthropic_provider();
   init_openai_compat_provider();
   init_fake_provider();
   init_gemini_provider();
   init_ollama_provider();
   init_openai_provider();
+  init_openai_codex_provider();
   OLLAMA_COMPAT_IDENTITY = {
     defaultBaseUrl: "http://localhost:11434",
     providerRevision: "ollama-2024-10-22",
@@ -36841,7 +37319,7 @@ var init_template_structure = __esm(() => {
 });
 
 // src/wiki/service.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { createHash as createHash22 } from "crypto";
 import { mkdir as mkdir22, readFile as readFile55, readdir as readdir15, rm as rm8, writeFile as writeFile21 } from "fs/promises";
 import path118 from "path";
@@ -37836,7 +38314,7 @@ async function changedModules(cwd, since) {
 }
 function gitDiffNames(cwd, base) {
   return new Promise((resolve) => {
-    const child = spawn3("git", ["diff", "--name-only", base], { cwd });
+    const child = spawn4("git", ["diff", "--name-only", base], { cwd });
     let out = "";
     child.stdout.on("data", (chunk) => {
       out += String(chunk);
@@ -39623,7 +40101,7 @@ var init_metaproject_state = __esm(() => {
 
 // src/ctx/orient.ts
 import path124 from "path";
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { readFile as readFile58 } from "fs/promises";
 function metaPath(cwd, parts) {
   return path124.join(cwd, ".metaproject", ...parts);
@@ -39701,7 +40179,7 @@ async function metaprojectIndexContext(cwd) {
 function gitOutput(cwd, args) {
   return new Promise((resolve) => {
     try {
-      const child = spawn4("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn5("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
       let out = "";
       child.stdout?.on("data", (chunk) => {
         out += String(chunk);
@@ -39864,7 +40342,7 @@ var init_orient = __esm(() => {
 });
 
 // src/commands/gdgraph.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { existsSync as existsSync19 } from "fs";
 import path125 from "path";
 async function gdgraphCommand(args) {
@@ -40506,7 +40984,7 @@ function collectSeeds(args) {
 async function changedFiles() {
   return new Promise((resolve) => {
     try {
-      const child = spawn5("git", ["diff", "--name-only", "HEAD"], {
+      const child = spawn6("git", ["diff", "--name-only", "HEAD"], {
         cwd: process.cwd(),
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -40536,7 +41014,7 @@ async function delegateToLocalRunner(args) {
     return { delegated: false };
   }
   const exitCode = await new Promise((resolve, reject) => {
-    const child = spawn5(process.execPath, [...SAFE_BUN_SPAWN_ARGS, localRunner, ...args], {
+    const child = spawn6(process.execPath, [...SAFE_BUN_SPAWN_ARGS, localRunner, ...args], {
       cwd: process.cwd(),
       stdio: "inherit",
       env: {
@@ -42464,7 +42942,7 @@ var init_profile = __esm(() => {
 });
 
 // src/harness/hooks/runner.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 import path135 from "path";
 function buildHookEnv(opts) {
   const env = {};
@@ -42503,7 +42981,7 @@ function spawnAndCollect(cmdPath, args, opts) {
     const isPosix = process.platform !== "win32";
     let child;
     try {
-      child = spawn6(cmdPath, args, {
+      child = spawn7(cmdPath, args, {
         cwd: opts.cwd,
         env: opts.env,
         stdio: ["pipe", "pipe", "pipe"],
@@ -59309,7 +59787,7 @@ var init_wiki_freshness = () => {};
 
 // src/harness/tool/builtin/interactive-tools.ts
 import { readdir as readdir28 } from "fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "path";
+import { basename, dirname, isAbsolute, join as join2, relative, resolve as resolve2, sep } from "path";
 import { lstatSync as lstatSync4, realpathSync as realpathSync7 } from "fs";
 async function readFromLine(file, startLine, cap) {
   const reader = file.stream().getReader();
@@ -59367,7 +59845,7 @@ async function readFromLine(file, startLine, cap) {
 }
 function confineToRoot(root, candidate) {
   const rootReal = realpathOr(root);
-  const target = resolve(rootReal, candidate ?? ".");
+  const target = resolve2(rootReal, candidate ?? ".");
   const effective = realpathThroughAncestors(target);
   if (effective === undefined) {
     return null;
@@ -59385,7 +59863,7 @@ function realpathOr(candidate) {
   try {
     return realpathSync7(candidate);
   } catch {
-    return resolve(candidate);
+    return resolve2(candidate);
   }
 }
 function realpathThroughAncestors(absolute) {
@@ -59394,7 +59872,7 @@ function realpathThroughAncestors(absolute) {
   for (;; ) {
     try {
       const real = realpathSync7(current);
-      return missing.length === 0 ? real : join(real, ...missing.reverse());
+      return missing.length === 0 ? real : join2(real, ...missing.reverse());
     } catch {
       try {
         lstatSync4(current);
@@ -59402,7 +59880,7 @@ function realpathThroughAncestors(absolute) {
       } catch {}
       const parent = dirname(current);
       if (parent === current) {
-        return resolve(absolute);
+        return resolve2(absolute);
       }
       missing.push(basename(current));
       current = parent;
@@ -65712,7 +66190,7 @@ var init_github = __esm(() => {
 
 // src/harness/tool/metaproject-adapter.ts
 import { lstat as lstat13, readdir as readdir33, readFile as readFile101, realpath as realpath15, stat as stat19 } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2 } from "path";
+import { isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve3 } from "path";
 function isMissingExecutable(cause) {
   const message = cause instanceof Error ? cause.message : String(cause);
   return /Executable not found|\bENOENT\b|not found in \$?PATH/i.test(message);
@@ -65753,8 +66231,8 @@ function portableMemoryPath(candidate) {
   return !isAbsolute2(normalized) && normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../") ? normalized : null;
 }
 function confineToWiki(cwd, candidate) {
-  const wikiRoot = join2(cwd, ".metaproject", "wiki");
-  const target = resolve2(wikiRoot, candidate);
+  const wikiRoot = join3(cwd, ".metaproject", "wiki");
+  const target = resolve3(wikiRoot, candidate);
   const rel = relative2(wikiRoot, target);
   if (rel === "") {
     return null;
@@ -65796,7 +66274,7 @@ async function projectRemovalTrail(cwd, query) {
 async function detectMemoryStoreUnreadable(cwd) {
   const root = memoryRoot(cwd);
   for (const { folder } of MEMORY_TYPES) {
-    const dir = join2(root, folder);
+    const dir = join3(root, folder);
     try {
       await readdir33(dir);
     } catch (error) {
@@ -65810,8 +66288,8 @@ async function detectMemoryStoreUnreadable(cwd) {
   return null;
 }
 function confineToSkills(cwd, candidate) {
-  const skillsRoot = join2(cwd, ".metaproject", "skills", "gdskills");
-  const target = resolve2(cwd, candidate);
+  const skillsRoot = join3(cwd, ".metaproject", "skills", "gdskills");
+  const target = resolve3(cwd, candidate);
   const rel = relative2(skillsRoot, target);
   if (rel === "") {
     return null;
@@ -65825,7 +66303,7 @@ async function parseCatalogSummaries(cwd) {
   const summaries = new Map;
   let content;
   try {
-    const bytes = await readContainedFile(join2(cwd, ".metaproject", "skills"), join2(cwd, ".metaproject", "skills", "catalog.md"), { maxBytes: 512 * 1024, requireRegularFile: true });
+    const bytes = await readContainedFile(join3(cwd, ".metaproject", "skills"), join3(cwd, ".metaproject", "skills", "catalog.md"), { maxBytes: 512 * 1024, requireRegularFile: true });
     content = bytes.toString("utf8");
   } catch {
     return summaries;
@@ -65846,7 +66324,7 @@ async function parseCatalogSummaries(cwd) {
   return summaries;
 }
 async function walkSkillCatalog(cwd) {
-  const root = join2(cwd, ".metaproject", "skills", "gdskills");
+  const root = join3(cwd, ".metaproject", "skills", "gdskills");
   const entries = [];
   const rootInfo = await lstat13(root).catch(() => null);
   if (!rootInfo || !rootInfo.isDirectory() || rootInfo.isSymbolicLink())
@@ -65864,7 +66342,7 @@ async function walkSkillCatalog(cwd) {
   for (const categoryDir of categoryDirs) {
     if (!categoryDir.isDirectory() && !categoryDir.isSymbolicLink())
       continue;
-    const categoryPath = join2(root, categoryDir.name);
+    const categoryPath = join3(root, categoryDir.name);
     const categoryReal = await realpath15(categoryPath).catch(() => null);
     const categoryInfo = await stat19(categoryPath).catch(() => null);
     if (!categoryReal || !categoryInfo?.isDirectory() || !isPathInside(rootReal, categoryReal))
@@ -65876,12 +66354,12 @@ async function walkSkillCatalog(cwd) {
       continue;
     }
     for (const skillDir of skillDirs) {
-      const skillPath = join2(categoryPath, skillDir.name);
+      const skillPath = join3(categoryPath, skillDir.name);
       const skillReal = await realpath15(skillPath).catch(() => null);
       const skillInfo = await stat19(skillPath).catch(() => null);
       if (!skillReal || !skillInfo?.isDirectory() || !isPathInside(rootReal, skillReal))
         continue;
-      const skillMdPath = join2(skillPath, "SKILL.md");
+      const skillMdPath = join3(skillPath, "SKILL.md");
       let content;
       try {
         const bytes = await readContainedFile(root, skillMdPath, { maxBytes: 512 * 1024, requireRegularFile: true });
@@ -66147,7 +66625,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
         exists = false;
       }
       if (!exists) {
-        const relativePath = toPosix(relative2(join2(cwd, ".metaproject", "wiki"), target));
+        const relativePath = toPosix(relative2(join3(cwd, ".metaproject", "wiki"), target));
         const registry = await readSectionRegistryState(cwd);
         if (registry.state === "unreadable") {
           return {
@@ -66188,7 +66666,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
         };
       }
       try {
-        const content = (await readContainedFile(join2(cwd, ".metaproject", "wiki"), target, {
+        const content = (await readContainedFile(join3(cwd, ".metaproject", "wiki"), target, {
           maxBytes: 8 * 1024 * 1024,
           requireRegularFile: true
         })).toString("utf8");
@@ -66232,7 +66710,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       }
       let hasWikiIndex;
       try {
-        await readFile101(join2(cwd, ".metaproject", "wiki", "index.md"), "utf8");
+        await readFile101(join3(cwd, ".metaproject", "wiki", "index.md"), "utf8");
         hasWikiIndex = true;
       } catch {
         hasWikiIndex = false;
@@ -66507,7 +66985,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       const byName = catalog.find((entry) => entry.name === input.name);
       if (byName !== undefined) {
         try {
-          const content = (await readContainedFile(join2(cwd, ".metaproject", "skills", "gdskills"), join2(cwd, byName.path), {
+          const content = (await readContainedFile(join3(cwd, ".metaproject", "skills", "gdskills"), join3(cwd, byName.path), {
             maxBytes: 512 * 1024,
             requireRegularFile: true
           })).toString("utf8");
@@ -66520,12 +66998,12 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       if (confined === null) {
         return { name: input.name, path: "", content: "", found: false };
       }
-      const byPath = catalog.find((entry) => join2(cwd, entry.path) === confined);
+      const byPath = catalog.find((entry) => join3(cwd, entry.path) === confined);
       if (byPath === undefined) {
         return { name: input.name, path: "", content: "", found: false };
       }
       try {
-        const content = (await readContainedFile(join2(cwd, ".metaproject", "skills", "gdskills"), confined, {
+        const content = (await readContainedFile(join3(cwd, ".metaproject", "skills", "gdskills"), confined, {
           maxBytes: 512 * 1024,
           requireRegularFile: true
         })).toString("utf8");
@@ -69660,7 +70138,7 @@ var init_narrate = __esm(() => {
 // src/commands/memory.ts
 import { randomUUID as randomUUID16 } from "crypto";
 import { readdir as readdir34 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function getService() {
   service3 ??= createMemoryService();
   return service3;
@@ -69767,7 +70245,7 @@ async function runIndex2(args) {
 async function detectMemoryStoreUnreadable2(cwd) {
   const root = memoryRoot(cwd);
   for (const { folder } of MEMORY_TYPES) {
-    const dir = join3(root, folder);
+    const dir = join4(root, folder);
     try {
       await readdir34(dir);
     } catch (error) {
@@ -90455,6 +90933,31 @@ var JEV_MODEL_1_13 = "jev-1.13";
 var DEFAULT_JEV_MODEL = JEV_MODEL_1_13;
 var JEV_TOKEN_BUDGET = 64000;
 var DEFAULT_JEV_TIMEOUT_MS = 30000;
+var JEV_MAX_ATTEMPTS = 3;
+var JEV_RETRY_BACKOFF_MS = [500, 1500];
+var JEV_RETRY_AFTER_CAP_MS = 5000;
+var JEV_RETRYABLE_STATUSES = new Set([429, 500, 502, 503, 504]);
+function defaultJevSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function jevBackoffMs(attemptJustFailed) {
+  return JEV_RETRY_BACKOFF_MS[attemptJustFailed - 1] ?? JEV_RETRY_BACKOFF_MS[JEV_RETRY_BACKOFF_MS.length - 1] ?? 500;
+}
+function retryAfterMsFromHeader(headerValue) {
+  if (headerValue === null || headerValue.trim().length === 0)
+    return;
+  const seconds = Number(headerValue);
+  if (Number.isFinite(seconds)) {
+    return seconds > 0 ? Math.min(seconds * 1000, JEV_RETRY_AFTER_CAP_MS) : undefined;
+  }
+  const dateMs = Date.parse(headerValue);
+  if (!Number.isNaN(dateMs)) {
+    const deltaMs = dateMs - Date.now();
+    if (deltaMs > 0)
+      return Math.min(deltaMs, JEV_RETRY_AFTER_CAP_MS);
+  }
+  return;
+}
 
 class JevCredentialError extends Error {
   constructor(message = "OPENROUTER_API_KEY is not set, and no openrouterKey is saved in the keryx shell config: " + "Jev needs an OpenRouter credential and refuses to send an unauthenticated request.") {
@@ -90478,13 +90981,28 @@ class JevBudgetError extends Error {
 
 class JevRequestError extends Error {
   status;
-  constructor(status, body) {
+  attempts;
+  constructor(status, body, attempts = 1) {
     const redactedBody = redactSensitiveText(body);
-    super(`Jev request to ${JEV_ENDPOINT} failed: HTTP ${status}${redactedBody.length > 0 ? ` \u2014 ${redactedBody.slice(0, 500)}` : ""}`);
+    const attemptsNote = attempts > 1 ? ` after ${attempts} attempts` : "";
+    super(`Jev request to ${JEV_ENDPOINT} failed: HTTP ${status}${attemptsNote}${redactedBody.length > 0 ? ` \u2014 ${redactedBody.slice(0, 500)}` : ""}`);
     this.status = status;
+    this.attempts = attempts;
     this.name = "JevRequestError";
   }
 }
+
+class JevNetworkError extends Error {
+  attempts;
+  cause;
+  constructor(attempts, cause) {
+    const causeMessage = cause instanceof Error ? cause.message : String(cause);
+    super(`Jev request to ${JEV_ENDPOINT} failed after ${attempts} attempt(s): ${causeMessage}`);
+    this.attempts = attempts;
+    this.cause = cause;
+    this.name = "JevNetworkError";
+  }
+}
 function sourceLabel(source) {
   if (source === "env")
     return "the OPENROUTER_API_KEY environment variable";
@@ -90591,22 +91109,9 @@ function validatedAnswer(key, question, raw) {
   }
   return { type: "choice", choice };
 }
-async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
-  const keyResolution = resolveJevApiKeyResolution(opts?.env ?? process.env, opts?.dir);
-  const apiKey = keyResolution.key;
-  if (apiKey === undefined || apiKey.length === 0) {
-    throw new JevCredentialError;
-  }
-  preflightBudget(input.state, input.questions);
-  const body = {
-    model: input.model ?? DEFAULT_JEV_MODEL,
-    state: input.state,
-    questions: input.questions
-  };
-  const timeoutMs = opts?.timeoutMs ?? DEFAULT_JEV_TIMEOUT_MS;
+async function attemptJevRequest(fetchFn, apiKey, body, timeoutMs, external) {
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const external = opts?.signal;
   let onExternalAbort;
   if (external !== undefined) {
     if (external.aborted) {
@@ -90616,9 +91121,6 @@ async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
       external.addEventListener("abort", onExternalAbort);
     }
   }
-  let text;
-  let status;
-  let ok;
   try {
     const res = await fetchFn(JEV_ENDPOINT, {
       method: "POST",
@@ -90626,25 +91128,65 @@ async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
       body: JSON.stringify(body),
       signal: controller.signal
     });
-    status = res.status;
-    ok = res.ok;
-    text = await res.text();
+    const text = await res.text();
+    return { kind: "response", status: res.status, ok: res.ok, text, retryAfterHeader: res.headers.get("retry-after") };
   } catch (cause) {
     if (controller.signal.aborted) {
-      throw new JevTimeoutError(timeoutMs);
+      return { kind: "timeout" };
     }
-    throw cause;
+    return { kind: "network-error", cause };
   } finally {
     clearTimeout(timer);
     if (onExternalAbort !== undefined) {
       external?.removeEventListener("abort", onExternalAbort);
     }
   }
-  if (!ok) {
+}
+async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
+  const keyResolution = resolveJevApiKeyResolution(opts?.env ?? process.env, opts?.dir);
+  const apiKey = keyResolution.key;
+  if (apiKey === undefined || apiKey.length === 0) {
+    throw new JevCredentialError;
+  }
+  preflightBudget(input.state, input.questions);
+  const body = {
+    model: input.model ?? DEFAULT_JEV_MODEL,
+    state: input.state,
+    questions: input.questions
+  };
+  const timeoutMs = opts?.timeoutMs ?? DEFAULT_JEV_TIMEOUT_MS;
+  const external = opts?.signal;
+  const sleepFn = opts?.sleepFn ?? defaultJevSleep;
+  let text;
+  let attempt = 0;
+  for (;; ) {
+    attempt += 1;
+    const outcome = await attemptJevRequest(fetchFn, apiKey, body, timeoutMs, external);
+    if (outcome.kind === "timeout") {
+      throw new JevTimeoutError(timeoutMs);
+    }
+    if (outcome.kind === "network-error") {
+      if (attempt >= JEV_MAX_ATTEMPTS) {
+        throw new JevNetworkError(attempt, outcome.cause);
+      }
+      await sleepFn(jevBackoffMs(attempt));
+      continue;
+    }
+    if (outcome.ok) {
+      text = outcome.text;
+      break;
+    }
+    const status = outcome.status;
+    text = outcome.text;
+    if (JEV_RETRYABLE_STATUSES.has(status) && attempt < JEV_MAX_ATTEMPTS) {
+      const retryAfterMs = retryAfterMsFromHeader(outcome.retryAfterHeader);
+      await sleepFn(retryAfterMs ?? jevBackoffMs(attempt));
+      continue;
+    }
     if (status === 401) {
       throw new JevAuthRejectedError(keyResolution.source, status, text, looksLikeOpenRouterKey(apiKey));
     }
-    throw new JevRequestError(status, text);
+    throw new JevRequestError(status, text, attempt);
   }
   let parsed;
   try {
@@ -92435,7 +92977,7 @@ init_service4();
 init_learn();
 init_service9();
 import { mkdir as mkdir51, readdir as readdir47, readFile as readFile133 } from "fs/promises";
-import path238, { join as join8 } from "path";
+import path238, { join as join9 } from "path";
 init_review_learning();
 
 // src/review/managed.ts
@@ -95480,7 +96022,7 @@ directly.
 // src/commands/review-jev-rules.ts
 init_args();
 import { readFile as readFile118, readdir as readdir44, stat as stat22 } from "fs/promises";
-import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, join as join4, relative as relative3 } from "path";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, join as join5, relative as relative3 } from "path";
 
 // src/review/conform-state.ts
 init_redact();
@@ -96156,6 +96698,28 @@ function clauseFileKindApplicability(sourceCategory, clauseText, changedFileKind
   }
   return { applicable: true, reason: "hunk is a code file; rule source is not categorised docs" };
 }
+var API_SCOPE_TERMS = ["api", "endpoint", "rest", "http", "openapi"];
+function isApiScopedRuleSource(source) {
+  const haystack = `${(source.declaredPaths ?? []).join(" ")} ${ruleSourceTitle(source.text)} ${source.path}`.toLowerCase();
+  return API_SCOPE_TERMS.some((term) => new RegExp(`\\b${term}\\b`).test(haystack));
+}
+var API_SURFACE_DIR_RE = /(^|\/)(api|routes|controllers|handlers|server)\//i;
+var HTTP_FRAMEWORK_IMPORT_RE = /\bfrom\s*["'](?:express|fastify|koa|hono|@hono\/[\w-]+|hapi|@nestjs\/(?:common|core)|next\/server|h3)["']/;
+function looksLikeApiSurfaceHunk(region) {
+  return API_SURFACE_DIR_RE.test(region.path) || HTTP_FRAMEWORK_IMPORT_RE.test(region.text);
+}
+function clauseApiScopeApplicability(source, region) {
+  if (!isApiScopedRuleSource(source)) {
+    return { applicable: true, reason: "rule source is not API/endpoint-scoped \u2014 this gate does not apply" };
+  }
+  if (looksLikeApiSurfaceHunk(region)) {
+    return { applicable: true, reason: `rule source is API/endpoint-scoped and ${region.path} looks like an API surface` };
+  }
+  return {
+    applicable: false,
+    reason: `rule source is API/endpoint-scoped (its declared paths/description/title name one of: ${API_SCOPE_TERMS.join(", ")}) but ${region.path} ` + "does not look like an API surface (no api/routes/controllers/handlers/server path segment, and this hunk imports no known HTTP framework)"
+  };
+}
 var DEFAULT_MAX_JEV_RULE_CALLS = 150;
 function isHunkCheckableClause(clause) {
   return clause.state_kind === "hunk" && clause.checkable;
@@ -96199,6 +96763,11 @@ function selectRuleHunkPairs(regions, taggedSources, detectedStack, maxCalls = D
         notApplicable.push({ region, ruleId: source.path, reason: decision.reason });
         continue;
       }
+      const apiScopeDecision = clauseApiScopeApplicability(source, region);
+      if (!apiScopeDecision.applicable) {
+        notApplicable.push({ region, ruleId: source.path, reason: apiScopeDecision.reason });
+        continue;
+      }
       let sawHunkCheckable = false;
       let anyFileKindApplicable = false;
       for (const clause of clauses) {
@@ -96620,7 +97189,7 @@ async function walkMatching(root, suffixes) {
       return;
     }
     for (const entry of entries) {
-      const full = join4(dir, entry.name);
+      const full = join5(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
@@ -96645,7 +97214,7 @@ function classify2(file) {
 }
 async function discoverRuleSources(cwd, explicitPaths) {
   const discovered = [];
-  for (const root of [join4(cwd, ".metaproject", "rules"), join4(cwd, "rules")]) {
+  for (const root of [join5(cwd, ".metaproject", "rules"), join5(cwd, "rules")]) {
     for (const file of await walkMatching(root, [".md", ".mdc"])) {
       const text = await readIfExists(file);
       if (text === undefined)
@@ -96654,8 +97223,8 @@ async function discoverRuleSources(cwd, explicitPaths) {
     }
   }
   const skillRoots = [
-    [join4(cwd, ".metaproject", "project-skills"), "project-skill"],
-    [join4(cwd, ".metaproject", "skills", "gdskills"), "gdskill"]
+    [join5(cwd, ".metaproject", "project-skills"), "project-skill"],
+    [join5(cwd, ".metaproject", "skills", "gdskills"), "gdskill"]
   ];
   for (const [root, kind] of skillRoots) {
     for (const skillMd of await walkMatching(root, ["SKILL.md"])) {
@@ -96680,7 +97249,7 @@ async function discoverRuleSources(cwd, explicitPaths) {
   const explicitFiles = [];
   const explicitDirSources = [];
   for (const raw of explicitPaths) {
-    const resolved = isAbsolute3(raw) ? raw : join4(cwd, raw);
+    const resolved = isAbsolute3(raw) ? raw : join5(cwd, raw);
     const stats = await stat22(resolved).catch(() => {
       return;
     });
@@ -96723,11 +97292,11 @@ async function discoverRuleSources(cwd, explicitPaths) {
   return { sources: [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path)), excluded: excluded.sort((a, b) => a.path.localeCompare(b.path)) };
 }
 async function fixturePrPort(dir) {
-  const raw = await readFile118(join4(dir, "pr.json"), "utf8");
+  const raw = await readFile118(join5(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureJevFetch(dir) {
-  const raw = await readFile118(join4(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile118(join5(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -97042,6 +97611,10 @@ function touchedExportedSymbols(regionText) {
   return [...symbols];
 }
 var TEST_INFIX_RE = /\.(test|spec)\./;
+var TEST_DIR_RE = /(^|\/)(__tests__|tests?)\//;
+function isTestFilePath(path) {
+  return TEST_INFIX_RE.test(path) || TEST_DIR_RE.test(path);
+}
 function stemOf(filePath) {
   const base = filePath.split("/").at(-1) ?? filePath;
   return base.replace(/\.(test|spec)\.[jt]sx?$/, "").replace(/\.[jt]sx?$/, "");
@@ -97056,7 +97629,7 @@ function testFilesTouchedNearby(regionPath, allChangedFiles) {
   return allChangedFiles.filter((file) => {
     if (file === regionPath)
       return false;
-    if (!TEST_INFIX_RE.test(file) && !/(^|\/)(__tests__|tests?)\//.test(file))
+    if (!isTestFilePath(file))
       return false;
     return stemOf(file) === stem || dirOf(file) === dir;
   });
@@ -97163,7 +97736,10 @@ function batchRiskQuestionsForHunk(facts) {
   return batches;
 }
 var NON_CODE_HUNK_RE = /\.(md|txt)$/i;
+var GENERATED_METADATA_PATH_RE = /(^|\/)\.metaproject\/(flows|data|reviews)\//;
 function isNonCodeHunk(path) {
+  if (GENERATED_METADATA_PATH_RE.test(path))
+    return true;
   if (/(^|\/)(__fixtures__|fixtures|testdata|__snapshots__|snapshots)\//.test(path))
     return false;
   return NON_CODE_HUNK_RE.test(path);
@@ -97237,6 +97813,8 @@ function synthesizeRiskFindings(scored, threshold = DEFAULT_JEV_RISK_THRESHOLD)
   for (const hunk of rankHunksByRisk(scored)) {
     if (hunk.combinedRisk < threshold || hunk.facts.hasNearbyTest)
       continue;
+    if (isTestFilePath(hunk.facts.region.path))
+      continue;
     const { region } = hunk.facts;
     const key = `jev-risk::${region.path}:${region.startLine}-${region.endLine}`;
     const severity = hunk.combinedRisk >= 0.85 ? "minor" : "info";
@@ -97267,6 +97845,8 @@ function riskFindingStats(findings) {
 function computeRiskRoutingHints(scored, threshold = DEFAULT_JEV_RISK_THRESHOLD) {
   const hints = [];
   for (const hunk of rankHunksByRisk(scored)) {
+    if (isTestFilePath(hunk.facts.region.path))
+      continue;
     const { region } = hunk.facts;
     if (hunk.probabilities.security >= threshold) {
       hints.push({ file: region.path, startLine: region.startLine, endLine: region.endLine, dimension: "security", probability: hunk.probabilities.security, suggestedReviewer: "review-security-code" });
@@ -97420,7 +98000,7 @@ async function computeJevRiskResult(options) {
     topDimension: hunk.topDimension
   }));
   const status = findings.length > 0 ? "DONE_WITH_CONCERNS" : "DONE";
-  const summary = `Scored ${scored.length} hunk(s) (of ${selection.selected.length + selection.skipped.length} retained) across 5 risk dimensions against ${targetLabel}; ` + `${findings.length} finding(s) at/above threshold ${threshold} with no nearby test. ` + `${selection.skipped.length} hunk(s) skipped by --max-calls ${selection.maxCalls} (${selection.pairsSkipped} pair(s)); ` + `${selection.notCode.length} hunk(s) skipped as not a code hunk (docs/.md/.txt).`;
+  const summary = `Scored ${scored.length} hunk(s) (of ${selection.selected.length + selection.skipped.length} retained) across 5 risk dimensions against ${targetLabel}; ` + `${findings.length} finding(s) at/above threshold ${threshold} with no nearby test. ` + `${selection.skipped.length} hunk(s) skipped by --max-calls ${selection.maxCalls} (${selection.pairsSkipped} pair(s)); ` + `${selection.notCode.length} hunk(s) skipped as not a code hunk (docs/.md/.txt, or .metaproject/{flows,data,reviews} bookkeeping).`;
   return {
     status,
     reviewer: "review-jev-risk",
@@ -97519,7 +98099,7 @@ async function runJevRisk(args) {
 // src/commands/review-jev-scenarios.ts
 init_args();
 import { readFile as readFile122, readdir as readdir45 } from "fs/promises";
-import { join as join5, relative as relative4 } from "path";
+import { join as join6, relative as relative4 } from "path";
 
 // src/review/jev-scenarios-config.ts
 init_review_gate();
@@ -97862,7 +98442,7 @@ async function walkMarkdown2(root) {
       return;
     }
     for (const entry of entries) {
-      const full = join5(dir, entry.name);
+      const full = join6(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
@@ -97876,19 +98456,19 @@ async function walkMarkdown2(root) {
 }
 async function discoverScenarioSources(cwd) {
   const scenarios = [];
-  for (const file of await walkMarkdown2(join5(cwd, ".metaproject", "wiki", "user-scenarios"))) {
+  for (const file of await walkMarkdown2(join6(cwd, ".metaproject", "wiki", "user-scenarios"))) {
     const text = await readIfExists2(file);
     if (text === undefined)
       continue;
     scenarios.push(scenarioFromWikiPage(relative4(cwd, file), text));
   }
-  for (const file of await walkMarkdown2(join5(cwd, "docs", "requirements"))) {
+  for (const file of await walkMarkdown2(join6(cwd, "docs", "requirements"))) {
     const text = await readIfExists2(file);
     if (text === undefined)
       continue;
     scenarios.push(...scenariosFromPrd(relative4(cwd, file), text));
   }
-  const readmeLikeFiles = [join5(cwd, "README.md"), ...await walkMarkdown2(join5(cwd, "docs", "docs"))];
+  const readmeLikeFiles = [join6(cwd, "README.md"), ...await walkMarkdown2(join6(cwd, "docs", "docs"))];
   for (const file of readmeLikeFiles) {
     const text = await readIfExists2(file);
     if (text === undefined)
@@ -97898,11 +98478,11 @@ async function discoverScenarioSources(cwd) {
   return scenarios;
 }
 async function fixturePrPort3(dir) {
-  const raw = await readFile122(join5(dir, "pr.json"), "utf8");
+  const raw = await readFile122(join6(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureJevFetch3(dir) {
-  const raw = await readFile122(join5(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile122(join6(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -98058,7 +98638,7 @@ async function gitDiffForJevScenarios(ref) {
 // src/commands/review-jev-docs.ts
 init_args();
 import { readFile as readFile124, readdir as readdir46 } from "fs/promises";
-import { join as join6, relative as relative5 } from "path";
+import { join as join7, relative as relative5 } from "path";
 
 // src/review/jev-docs-config.ts
 init_review_gate();
@@ -98266,7 +98846,6 @@ function boundLinkedSections(linked, maxCalls = DEFAULT_MAX_JEV_DOCS_CALLS, maxP
   };
 }
 var JEV_DOCS_TOKEN_BUDGET = 64000;
-var QUESTIONS_BUDGET_FRACTION4 = 0.5;
 var HUNK_TEXT_CHARS = 2000;
 var SECTION_TEXT_CHARS = 4000;
 function docsQuestionKey(linked) {
@@ -98300,19 +98879,25 @@ ${bounded}`;
   ].join(`
 `);
 }
+function buildDocsBatch(items) {
+  return {
+    items,
+    state: items.map(renderSectionFacts).join(`
+
+`),
+    questions: Object.fromEntries(items.map((item) => [docsQuestionKey(item), questionFor4(item)]))
+  };
+}
+var DOCS_BATCH_BUDGET_FRACTION = 0.4;
+var MAX_SECTIONS_PER_BATCH = 3;
 function batchDocsSections(items) {
   const batches = [];
   let current = [];
+  const effectiveBudget = JEV_DOCS_TOKEN_BUDGET * DOCS_BATCH_BUDGET_FRACTION;
   const flush = () => {
     if (current.length === 0)
       return;
-    batches.push({
-      items: current,
-      state: current.map(renderSectionFacts).join(`
-
-`),
-      questions: Object.fromEntries(current.map((item) => [docsQuestionKey(item), questionFor4(item)]))
-    });
+    batches.push(buildDocsBatch(current));
     current = [];
   };
   for (const item of items) {
@@ -98322,8 +98907,7 @@ function batchDocsSections(items) {
 `));
     const questionsTokens = estimateTokens2(attempt.map((linked) => `${docsQuestionKey(linked)}:noul:${questionFor4(linked).instructions}`).join(`
 `));
-    const withinQuestionsShare = questionsTokens <= JEV_DOCS_TOKEN_BUDGET * QUESTIONS_BUDGET_FRACTION4;
-    if (current.length > 0 && (stateTokens + questionsTokens > JEV_DOCS_TOKEN_BUDGET || !withinQuestionsShare)) {
+    if (current.length > 0 && (attempt.length > MAX_SECTIONS_PER_BATCH || stateTokens + questionsTokens > effectiveBudget)) {
       flush();
       current = [item];
     } else {
@@ -98472,6 +99056,12 @@ function renderJevDocsMarkdown(result) {
 }
 
 // src/commands/review-jev-docs.ts
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isMaxTokensExceededError(error) {
+  return error instanceof JevRequestError && error.status === 400 && /max_tokens/i.test(error.message);
+}
 var JEV_DOCS_FLAGS = ["--diff", "--pr", "--max-calls", "--threshold", "--model", "--repo", "--fixtures", "--include", "--json"];
 function rejectUnknownJevDocsFlags(args) {
   const unknown = args.filter((arg) => arg.startsWith("--") && !JEV_DOCS_FLAGS.includes(arg.split("=")[0]));
@@ -98528,7 +99118,7 @@ async function walkMatching2(root, suffixes) {
       return;
     }
     for (const entry of entries) {
-      const full = join6(dir, entry.name);
+      const full = join7(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
@@ -98589,7 +99179,7 @@ async function walkAllDocFiles(dir) {
     return out;
   }
   for (const entry of entries) {
-    const full = join6(dir, entry.name);
+    const full = join7(dir, entry.name);
     if (entry.isDirectory()) {
       if (INCLUDE_WALK_PRUNE_DIRS.has(entry.name))
         continue;
@@ -98603,19 +99193,19 @@ async function walkAllDocFiles(dir) {
 async function resolveIncludeGlob(cwd, glob) {
   const rootDir = includeGlobRootDir(glob);
   const regex = includeGlobToRegExp(glob);
-  const candidates = await walkAllDocFiles(join6(cwd, rootDir));
+  const candidates = await walkAllDocFiles(join7(cwd, rootDir));
   return candidates.filter((file) => regex.test(relative5(cwd, file)));
 }
 async function discoverDocFiles(cwd, includeGlobs = []) {
   const files = new Set;
-  for (const file of await walkMatching2(join6(cwd, "docs"), [".md"]))
+  for (const file of await walkMatching2(join7(cwd, "docs"), [".md"]))
     files.add(file);
   for (const name of await matchingFileNames(cwd, /^readme/i)) {
     if (/^changelog/i.test(name))
       continue;
-    files.add(join6(cwd, name));
+    files.add(join7(cwd, name));
   }
-  for (const file of await walkMatching2(join6(cwd, ".metaproject", "wiki"), [".md"]))
+  for (const file of await walkMatching2(join7(cwd, ".metaproject", "wiki"), [".md"]))
     files.add(file);
   for (const glob of includeGlobs) {
     for (const file of await resolveIncludeGlob(cwd, glob))
@@ -98643,11 +99233,11 @@ function changedCommandNamesFromRegions(regions) {
   return names;
 }
 async function fixturePrPort4(dir) {
-  const raw = await readFile124(join6(dir, "pr.json"), "utf8");
+  const raw = await readFile124(join7(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureJevFetch4(dir) {
-  const raw = await readFile124(join6(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile124(join7(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -98681,29 +99271,54 @@ async function computeJevDocsResult(options) {
   let outputTokens = 0;
   let costUsd = 0;
   let sawUsage = false;
-  for (const batch of batches) {
-    const result = await callJevSystemOne(fetchFn, { model, state: batch.state, questions: batch.questions }, { env: process.env });
-    jevCalls += 1;
-    if (result.usage.input_tokens !== undefined) {
-      inputTokens += result.usage.input_tokens;
-      sawUsage = true;
-    }
-    if (result.usage.output_tokens !== undefined) {
-      outputTokens += result.usage.output_tokens;
-      sawUsage = true;
+  let jevError;
+  const attemptBatch = async (batch) => {
+    try {
+      const result = await callJevSystemOne(fetchFn, { model, state: batch.state, questions: batch.questions }, { env: options.env ?? process.env });
+      jevCalls += 1;
+      if (result.usage.input_tokens !== undefined) {
+        inputTokens += result.usage.input_tokens;
+        sawUsage = true;
+      }
+      if (result.usage.output_tokens !== undefined) {
+        outputTokens += result.usage.output_tokens;
+        sawUsage = true;
+      }
+      if (result.usage.cost !== undefined) {
+        costUsd += result.usage.cost;
+        sawUsage = true;
+      }
+      for (const item of batch.items) {
+        const key = `${item.section.file}::${item.section.line}`;
+        const answer = result.answers[key];
+        if (answer === undefined || answer.type !== "noul")
+          continue;
+        const finding = synthesizeDocsFinding(item, answer.noul, threshold);
+        if (finding !== undefined)
+          jevFindings.push(finding);
+      }
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, error };
     }
-    if (result.usage.cost !== undefined) {
-      costUsd += result.usage.cost;
-      sawUsage = true;
+  };
+  for (const batch of batches) {
+    const attempt = await attemptBatch(batch);
+    if (attempt.ok)
+      continue;
+    if (isMaxTokensExceededError(attempt.error) && batch.items.length > 1) {
+      const mid = Math.ceil(batch.items.length / 2);
+      const halves = [buildDocsBatch(batch.items.slice(0, mid)), buildDocsBatch(batch.items.slice(mid))];
+      for (const half of halves) {
+        const halfAttempt = await attemptBatch(half);
+        if (!halfAttempt.ok && jevError === undefined) {
+          jevError = messageOf(halfAttempt.error);
+        }
+      }
+      continue;
     }
-    for (const item of batch.items) {
-      const key = `${item.section.file}::${item.section.line}`;
-      const answer = result.answers[key];
-      if (answer === undefined || answer.type !== "noul")
-        continue;
-      const finding = synthesizeDocsFinding(item, answer.noul, threshold);
-      if (finding !== undefined)
-        jevFindings.push(finding);
+    if (jevError === undefined) {
+      jevError = messageOf(attempt.error);
     }
   }
   const findings = [...flagFindings, ...jevFindings].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
@@ -98717,6 +99332,7 @@ async function computeJevDocsResult(options) {
     findings,
     stats,
     tokens: sawUsage ? { jevCalls, inputTokens, outputTokens, costUsd } : { jevCalls },
+    ...jevError !== undefined ? { jevError } : {},
     selection: {
       maxCalls,
       maxPerFile,
@@ -98795,7 +99411,7 @@ async function runJevDocs(args) {
 init_args();
 init_fs();
 import { readFile as readFile126 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 init_pr_comments();
 
 // src/review/jev-comments-config.ts
@@ -98838,7 +99454,7 @@ function commentFactLines(facts) {
   ];
 }
 var COMMENT_TOKEN_BUDGET = 64000;
-var QUESTIONS_BUDGET_FRACTION5 = 0.5;
+var QUESTIONS_BUDGET_FRACTION4 = 0.5;
 var REPLY_BODY_CHARS = 500;
 var HUNK_TEXT_CHARS2 = 1500;
 var COMMENT_BODY_CHARS = 1500;
@@ -98904,7 +99520,7 @@ function batchOpenComments(items) {
 `));
     const questionsTokens = estimateTokens2(attempt.map((f) => `${commentQuestionKey(f)}:choice`).join(`
 `));
-    const withinQuestionsShare = questionsTokens <= COMMENT_TOKEN_BUDGET * QUESTIONS_BUDGET_FRACTION5;
+    const withinQuestionsShare = questionsTokens <= COMMENT_TOKEN_BUDGET * QUESTIONS_BUDGET_FRACTION4;
     if (current.length > 0 && (stateTokens + questionsTokens > COMMENT_TOKEN_BUDGET || !withinQuestionsShare)) {
       flush();
       current = [item];
@@ -99089,15 +99705,15 @@ function createFixtureJevCommentsFactsPort(facts) {
   };
 }
 async function fixturePrPort5(dir) {
-  const raw = await readFile126(join7(dir, "pr.json"), "utf8");
+  const raw = await readFile126(join8(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureFactsPort(dir) {
-  const raw = await readFile126(join7(dir, "git-facts.json"), "utf8").catch(() => "{}");
+  const raw = await readFile126(join8(dir, "git-facts.json"), "utf8").catch(() => "{}");
   return createFixtureJevCommentsFactsPort(JSON.parse(raw));
 }
 async function fixtureJevFetch5(dir) {
-  const raw = await readFile126(join7(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile126(join8(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -99111,7 +99727,7 @@ async function fixtureJevFetch5(dir) {
   return fn;
 }
 function advisoryLabelsPath(cwd, repo, number) {
-  return join7(cwd, ".metaproject", "data", "review-jev-comments", `labels__${repo.replace(/\//g, "__")}__${number}.json`);
+  return join8(cwd, ".metaproject", "data", "review-jev-comments", `labels__${repo.replace(/\//g, "__")}__${number}.json`);
 }
 async function readCommentAdvisoryLabels(cwd, repo, number) {
   const file = advisoryLabelsPath(cwd, repo, number);
@@ -99651,10 +100267,10 @@ function parseThreshold5(raw) {
   }
   return value;
 }
-function messageOf(error) {
+function messageOf2(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function isMaxTokensExceededError(error) {
+function isMaxTokensExceededError2(error) {
   return error instanceof JevRequestError && error.status === 400 && /max_tokens/i.test(error.message);
 }
 async function fixturePrPort6(dir) {
@@ -99725,19 +100341,19 @@ async function computeJevContractResult(options) {
       const attempt = await attemptBatch(batch);
       if (attempt.ok)
         continue;
-      if (isMaxTokensExceededError(attempt.error) && batch.items.length > 1) {
+      if (isMaxTokensExceededError2(attempt.error) && batch.items.length > 1) {
         const mid = Math.ceil(batch.items.length / 2);
         const halves = [buildContractClaimBatch(batch.items.slice(0, mid)), buildContractClaimBatch(batch.items.slice(mid))];
         for (const half of halves) {
           const halfAttempt = await attemptBatch(half);
           if (!halfAttempt.ok && jevError === undefined) {
-            jevError = messageOf(halfAttempt.error);
+            jevError = messageOf2(halfAttempt.error);
           }
         }
         continue;
       }
       if (jevError === undefined) {
-        jevError = messageOf(attempt.error);
+        jevError = messageOf2(attempt.error);
       }
     }
     for (const item of items) {
@@ -100149,10 +100765,10 @@ function parseThreshold6(raw) {
   return value;
 }
 var LIKELY_DUPLICATE_THRESHOLD = 0.5;
-function messageOf2(error) {
+function messageOf3(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function isMaxTokensExceededError2(error) {
+function isMaxTokensExceededError3(error) {
   return error instanceof JevRequestError && error.status === 400 && /max_tokens/i.test(error.message);
 }
 async function loadReportRaw(reportPath) {
@@ -100226,19 +100842,19 @@ async function computeJevTriageResult(options) {
       const attempt = await attemptBatch(batch);
       if (attempt.ok)
         continue;
-      if (isMaxTokensExceededError2(attempt.error) && batch.items.length > 1) {
+      if (isMaxTokensExceededError3(attempt.error) && batch.items.length > 1) {
         const mid = Math.ceil(batch.items.length / 2);
         const halves = [buildTriageBatch(batch.items.slice(0, mid)), buildTriageBatch(batch.items.slice(mid))];
         for (const half of halves) {
           const halfAttempt = await attemptBatch(half);
           if (!halfAttempt.ok && jevError === undefined) {
-            jevError = messageOf2(halfAttempt.error);
+            jevError = messageOf3(halfAttempt.error);
           }
         }
         continue;
       }
       if (jevError === undefined) {
-        jevError = messageOf2(attempt.error);
+        jevError = messageOf3(attempt.error);
       }
     }
   }
@@ -101421,7 +102037,7 @@ function applyDeterministicOverride(verdict, signals) {
 // src/review/conform-jev.ts
 init_service4();
 var CONFORM_TOKEN_BUDGET = 64000;
-var QUESTIONS_BUDGET_FRACTION6 = 0.5;
+var QUESTIONS_BUDGET_FRACTION5 = 0.5;
 function questionFor6(clause) {
   return {
     type: "noul",
@@ -101461,7 +102077,7 @@ function batchConformItems(items, sharedRedactedText) {
     const factsTokens = estimateTokens2(renderFacts(attempt));
     const questionsTokens = estimateQuestionsTokens(attempt);
     const total = sharedTokens + factsTokens + questionsTokens;
-    const withinQuestionsShare = questionsTokens <= CONFORM_TOKEN_BUDGET * QUESTIONS_BUDGET_FRACTION6;
+    const withinQuestionsShare = questionsTokens <= CONFORM_TOKEN_BUDGET * QUESTIONS_BUDGET_FRACTION5;
     if (current.length > 0 && (total > CONFORM_TOKEN_BUDGET || !withinQuestionsShare)) {
       flush();
       current = [item];
@@ -102505,7 +103121,7 @@ async function resolvePort(args) {
   }
   const files = {};
   for (const key of ["pull", "pull-comments", "pull-reviews", "issue-comments"]) {
-    const file = join8(fixtures, `${key}.json`);
+    const file = join9(fixtures, `${key}.json`);
     try {
       files[key] = JSON.parse(await readFile133(file, "utf8"));
     } catch {
@@ -102515,13 +103131,13 @@ async function resolvePort(args) {
   return createFixturePort(files);
 }
 async function fixtureCiPort(dir) {
-  const runInfo = JSON.parse(await readFile133(join8(dir, "ci-run-info.json"), "utf8"));
-  const log = await readFile133(join8(dir, "ci-failed-log.txt"), "utf8").catch(() => "");
-  const history = await readFile133(join8(dir, "ci-history.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const attempts = await readFile133(join8(dir, "ci-attempts.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const changedFiles = await readFile133(join8(dir, "ci-changed-files.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const runsByHeadSha = await readFile133(join8(dir, "ci-runs-by-head-sha.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const related = await readFile133(join8(dir, "ci-related-runs.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const runInfo = JSON.parse(await readFile133(join9(dir, "ci-run-info.json"), "utf8"));
+  const log = await readFile133(join9(dir, "ci-failed-log.txt"), "utf8").catch(() => "");
+  const history = await readFile133(join9(dir, "ci-history.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const attempts = await readFile133(join9(dir, "ci-attempts.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const changedFiles = await readFile133(join9(dir, "ci-changed-files.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const runsByHeadSha = await readFile133(join9(dir, "ci-runs-by-head-sha.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const related = await readFile133(join9(dir, "ci-related-runs.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
   return createFixtureCiPort({
     runs: { [runInfo.runId]: runInfo, ...related.runs },
     logs: { [runInfo.runId]: log, ...related.logs },
@@ -102532,7 +103148,7 @@ async function fixtureCiPort(dir) {
   });
 }
 async function fixtureJevFetch8(dir) {
-  const body = await readFile133(join8(dir, "jev-response.json"), "utf8");
+  const body = await readFile133(join9(dir, "jev-response.json"), "utf8");
   const fn = async () => new Response(body, { status: 200, headers: { "content-type": "application/json" } });
   return fn;
 }
@@ -102698,12 +103314,12 @@ async function runCiTriageEval(cwd, args, evalFile) {
   }
 }
 async function fixtureConformJevFetch(dir) {
-  const body = await readFile133(join8(dir, "jev-response.json"), "utf8");
+  const body = await readFile133(join9(dir, "jev-response.json"), "utf8");
   const fn = async () => new Response(body, { status: 200, headers: { "content-type": "application/json" } });
   return fn;
 }
 async function fixtureConformPrPortFrom(dir) {
-  const pr = JSON.parse(await readFile133(join8(dir, "pr.json"), "utf8"));
+  const pr = JSON.parse(await readFile133(join9(dir, "pr.json"), "utf8"));
   return createFixtureConformPrPort({ pr });
 }
 function accumulateJevUsage(acc, usage) {
@@ -102784,7 +103400,7 @@ async function explainConformVerdicts(cwd, refPath, verdicts, threshold, fixture
     return {};
   if (fixturesDir !== undefined) {
     try {
-      return JSON.parse(await readFile133(join8(fixturesDir, "explain-response.json"), "utf8"));
+      return JSON.parse(await readFile133(join9(fixturesDir, "explain-response.json"), "utf8"));
     } catch {
       return {};
     }
@@ -102832,7 +103448,7 @@ function parsePositiveIntFlag(args, flag, fallback) {
 }
 async function readReportFindings(reportDir) {
   try {
-    const raw = JSON.parse(await readFile133(join8(reportDir, "findings.json"), "utf8"));
+    const raw = JSON.parse(await readFile133(join9(reportDir, "findings.json"), "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -102904,7 +103520,7 @@ async function runConform(args) {
   const fetchFn = fixturesDir === undefined ? globalThis.fetch : await fixtureConformJevFetch(fixturesDir);
   const acc = { jevCalls: 0, inputTokens: 0, outputTokens: 0, costUsd: 0, sawUsage: false };
   const clauses = await resolveConformClauseTags(cwd, refPath, docText, rawClauses, fetchFn, model, acc);
-  await writeFileAtomic(join8(cwd, CONFORM_RECENTS_PATH), `${JSON.stringify(withRecentDoc(await readRecentConformDocs(cwd), refPath), null, 2)}
+  await writeFileAtomic(join9(cwd, CONFORM_RECENTS_PATH), `${JSON.stringify(withRecentDoc(await readRecentConformDocs(cwd), refPath), null, 2)}
 `, { mode: 384 }).catch(() => {});
   const notCheckable = clauses.filter((c) => !c.checkable);
   const checkable = clauses.filter((c) => c.checkable);
@@ -102936,7 +103552,7 @@ async function runConform(args) {
     hunkTotalRegions = hunkResult.totalRegions;
   } else if (reportDir !== undefined) {
     target = { kind: "report", label: reportDir };
-    const reportMarkdown = await readFile133(join8(reportDir, "report.md"), "utf8").catch(() => "");
+    const reportMarkdown = await readFile133(join9(reportDir, "report.md"), "utf8").catch(() => "");
     const findings = await readReportFindings(reportDir);
     const facts = computeReportConformFacts(reportMarkdown, findings);
     const redacted = reportRedactedStateText(reportMarkdown);
@@ -102977,7 +103593,7 @@ async function runConform(args) {
 }
 async function readRecentConformDocs(cwd) {
   try {
-    const raw = JSON.parse(await readFile133(join8(cwd, CONFORM_RECENTS_PATH), "utf8"));
+    const raw = JSON.parse(await readFile133(join9(cwd, CONFORM_RECENTS_PATH), "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -103223,7 +103839,7 @@ async function runStack(args) {
   console.log(renderStackScopingMarkdown(detected, decisions));
 }
 async function stackScopingForInstalledReviewers(cwd, detected) {
-  const reviewRoot = join8(cwd, ".metaproject", "skills", "gdskills", "review");
+  const reviewRoot = join9(cwd, ".metaproject", "skills", "gdskills", "review");
   let entries;
   try {
     entries = await readdir47(reviewRoot, { withFileTypes: true });
@@ -103235,7 +103851,7 @@ async function stackScopingForInstalledReviewers(cwd, detected) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const skillMdPath = join8(reviewRoot, entry.name, "SKILL.md");
+    const skillMdPath = join9(reviewRoot, entry.name, "SKILL.md");
     let content;
     try {
       content = await readFile133(skillMdPath, "utf8");
@@ -110205,7 +110821,7 @@ async function diagnose(server, options) {
       skipped: catalog.skipped
     };
   } catch (error) {
-    return { ...base, status: "failed", toolCount: 0, skipped: [], detail: messageOf3(error) };
+    return { ...base, status: "failed", toolCount: 0, skipped: [], detail: messageOf4(error) };
   } finally {
     try {
       await connection.close();
@@ -110227,7 +110843,7 @@ function oauthErrorCodeOf(error) {
   return typeof code === "string" ? code : "";
 }
 function explainConnectFailure(transport, server, error) {
-  const message = sanitiseForDisplay(messageOf3(error));
+  const message = sanitiseForDisplay(messageOf4(error));
   if (transport !== "http")
     return message;
   const url = displayUrl(server.raw.url);
@@ -110300,7 +110916,7 @@ function syscallCodeOf(error) {
   }
   return;
 }
-function messageOf3(error) {
+function messageOf4(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function withTimeout(work, ms, name) {
@@ -110350,38 +110966,8 @@ function formatDoctorReport(report) {
 `);
 }
 
-// src/lib/oauth/open-url.ts
-import { spawn as spawn7 } from "child_process";
-function browserOpenPlan(url, platform = process.platform, env = process.env) {
-  if (url.length === 0) {
-    return;
-  }
-  if (platform === "darwin") {
-    return { cmd: "open", args: [url] };
-  }
-  if (platform === "win32") {
-    return { cmd: "cmd", args: ["/c", "start", "", url] };
-  }
-  if (typeof env.DISPLAY === "string" && env.DISPLAY.length > 0) {
-    return { cmd: "xdg-open", args: [url] };
-  }
-  if (typeof env.WAYLAND_DISPLAY === "string" && env.WAYLAND_DISPLAY.length > 0) {
-    return { cmd: "xdg-open", args: [url] };
-  }
-  return;
-}
-function openVerificationUrl(url, deps = {}) {
-  const plan = browserOpenPlan(url, deps.platform ?? process.platform, deps.env ?? process.env);
-  if (plan === undefined) {
-    return;
-  }
-  const spawnFn = deps.spawn ?? spawn7;
-  try {
-    const child = spawnFn(plan.cmd, plan.args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
+// src/commands/mcp-servers.ts
+init_open_url();
 
 // src/mcp-servers/oauth-callback.ts
 import { randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -126604,7 +127190,7 @@ init_safe_exec();
 init_metaproject_operations();
 init_interactive_tools();
 import { existsSync as existsSync43 } from "fs";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 var MAX_OUTPUT_BYTES3 = 20000;
 var RG_UNAVAILABLE_SIGNATURE = /ripgrep \(rg\) is not installed|Executable not found[^\n]*\brg\b|\brg\b[^\n]*\bENOENT\b|\bENOENT\b[^\n]*\brg\b/i;
 var SEARCH_CODE_RG_UNAVAILABLE_MESSAGE = "ripgrep (rg) is not installed or not on PATH, and search_code needs it. Install it " + "(`brew install ripgrep` / `apt install ripgrep`), or use read_file and list_dir to " + "inspect files directly instead of retrying search_code.";
@@ -126615,11 +127201,11 @@ function normalizeSearchResult(result) {
   return result;
 }
 var KERYX_ENTRIES = [
-  resolve3(import.meta.dir, "..", "..", "..", "cli.ts"),
-  resolve3(import.meta.dir, "cli.js")
+  resolve4(import.meta.dir, "..", "..", "..", "cli.ts"),
+  resolve4(import.meta.dir, "cli.js")
 ];
 function keryxSelfCommand(main = Bun.main, execPath = process.execPath, exists = existsSync43, entries = KERYX_ENTRIES) {
-  if (entries.includes(resolve3(main)) && exists(main)) {
+  if (entries.includes(resolve4(main)) && exists(main)) {
     return [execPath, ...SAFE_BUN_SPAWN_ARGS, main];
   }
   if (isCompiledBinaryEntry(main)) {
@@ -132751,6 +133337,7 @@ ${lines.join(`
 }
 
 // src/tui/tui-shell.ts
+init_subscription_models();
 init_agent();
 init_single_turn();
 
@@ -146411,6 +146998,7 @@ init_patch_risk();
 init_catalog();
 init_grants();
 init_login();
+init_open_url();
 init_shell_config();
 init_provider_config();
 
@@ -151780,14 +152368,22 @@ async function filterConnectedDetectedProviders(detected, options = {}) {
   const env = options.env ?? process.env;
   const connected = [];
   for (const prov of detected) {
-    const registry = providerByName(prov.name);
+    if (prov.name === "openai-codex") {
+      if (oauthAccessToken(prov.name, options.configDir) === undefined)
+        continue;
+      const result = await fetchOpenAiCodexModels(fetchFn, { ...options.configDir !== undefined ? { configDir: options.configDir } : {} });
+      if (result.source === "live" && result.models.length > 0)
+        connected.push({ ...prov, models: result.models });
+      continue;
+    }
+    const registry = providerByName(prov.name, options.configDir);
     if (registry === undefined) {
       connected.push(prov);
       continue;
     }
     const requiresApiKey = registry.requiresApiKey ?? true;
     const envKey = prov.envKey ?? registry.envKey;
-    const raw = envKey !== undefined ? env[envKey] : undefined;
+    const raw = envKey !== undefined ? env[envKey] ?? loadShellConfig(options.configDir).apiKeys?.[envKey] : undefined;
     if (requiresApiKey && (raw === undefined || raw.length === 0)) {
       continue;
     }
@@ -152872,7 +153468,7 @@ function pickAuthMethodStep(otui, target, providerLabel, methods) {
     });
   });
 }
-function runDeviceLoginInTui(otui, target, provider, dir) {
+function runDeviceLoginInTui(otui, target, provider, dir, fetchFn = globalThis.fetch) {
   const r = stepRenderer(target);
   return new Promise((resolve) => {
     const controller = new AbortController;
@@ -152895,7 +153491,7 @@ function runDeviceLoginInTui(otui, target, provider, dir) {
     };
     loginDeviceCode({
       provider,
-      fetch: (input, init) => globalThis.fetch(input, init),
+      fetch: (input, init) => fetchFn(input, init),
       signal: controller.signal,
       ...dir !== undefined ? { dir } : {},
       onChallenge: (challenge) => {
@@ -152908,7 +153504,7 @@ function runDeviceLoginInTui(otui, target, provider, dir) {
       }
       if (result.ok) {
         cleanup();
-        applyOAuthAccessToEnv();
+        applyOAuthAccessToEnv(dir);
         resolve(true);
         return;
       }
@@ -152923,7 +153519,7 @@ function runDeviceLoginInTui(otui, target, provider, dir) {
   });
 }
 async function modelsForPicker(prov, deps = {}) {
-  return await resolveModelsForPicker(deps.fetch ?? globalThis.fetch, prov, deps.env ?? process.env);
+  return await resolveModelsForPicker(deps.fetch ?? globalThis.fetch, prov, deps.env ?? process.env, { ...deps.configDir !== undefined ? { configDir: deps.configDir } : {} });
 }
 function endpointMayBeAtFault(failure) {
   return failure?.kind === "unreachable" || failure?.kind === "http";
@@ -153067,7 +153663,7 @@ function pickConnectedProviderStep(otui, target, detected, opts) {
     }
     async function runTest(name) {
       const block = rowBlocks.find((b) => b.name === name);
-      const provider = providerByName(name, opts.configDir);
+      const provider = connectionProviderByName(name, opts.configDir);
       if (block === undefined)
         return;
       if (provider === undefined) {
@@ -153231,7 +153827,8 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
     }
     const candidatesPromise = options.onlyConnected ? filterConnectedDetectedProviders(detected, {
       ...options.fetch !== undefined ? { fetch: options.fetch } : {},
-      ...options.env !== undefined ? { env: options.env } : {}
+      ...options.env !== undefined ? { env: options.env } : {},
+      ...options.configDir !== undefined ? { configDir: options.configDir } : {}
     }) : Promise.resolve(detected);
     (async () => {
       const candidates = await candidatesPromise;
@@ -153275,7 +153872,7 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
           }
           continue;
         }
-        const lockDiscoveredHost = prov.name === "github-copilot";
+        const lockDiscoveredHost = ["github-copilot", "openai", "openai-codex"].includes(prov.name);
         let selectedBaseUrl = options.onlyConnected || prov.baseUrl === undefined || lockDiscoveredHost ? prov.baseUrl : await promptBaseUrlStep(otui, rOrChrome, prov.label ?? prov.name, prov.baseUrl);
         if (!options.onlyConnected && !lockDiscoveredHost && prov.baseUrl !== undefined && selectedBaseUrl === undefined) {
           continue;
@@ -153287,12 +153884,12 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
         const envKey = prov.envKey;
         const label = prov.label ?? prov.name;
         const collectCredential = async (notice) => {
-          if (options.onlyConnected || envKey === undefined) {
+          if (options.onlyConnected || envKey === undefined && !catalogAllows(prov.name, "device-code")) {
             return "ok";
           }
           if (notice === undefined) {
-            const existingKey = (options.env ?? process.env)[envKey];
-            const hasOauth = oauthAccessToken(prov.name, options.configDir) !== undefined;
+            const existingKey = envKey === undefined ? undefined : (options.env ?? process.env)[envKey] ?? loadShellConfig(options.configDir).apiKeys?.[envKey];
+            const hasOauth = prov.name !== "openai" && oauthAccessToken(prov.name, options.configDir) !== undefined;
             if (existingKey !== undefined && existingKey.length > 0 || hasOauth) {
               return "ok";
             }
@@ -153310,7 +153907,7 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
             }
           }
           if (method === "device-code") {
-            if (!await runDeviceLoginInTui(otui, rOrChrome, prov.name, options.configDir)) {
+            if (!await runDeviceLoginInTui(otui, rOrChrome, prov.name, options.configDir, options.fetch)) {
               return "back";
             }
             const saved = loadShellConfig(options.configDir).baseUrls?.[prov.name];
@@ -153320,8 +153917,10 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
             }
             return "ok";
           }
+          if (envKey === undefined)
+            return "back";
           const kr = await promptApiKeyStep(otui, rOrChrome, {
-            label,
+            label: prov.name === "openai" ? "OpenAI" : label,
             envKey,
             ...notice === undefined ? {} : { notice }
           });
@@ -153340,7 +153939,8 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
         }
         const modelDeps = {
           ...options.fetch === undefined ? {} : { fetch: options.fetch },
-          ...options.env === undefined ? {} : { env: options.env }
+          ...options.env === undefined ? {} : { env: options.env },
+          ...options.configDir === undefined ? {} : { configDir: options.configDir }
         };
         let models = await modelsForPicker(selectedProvider, modelDeps);
         if (models.failure?.kind === "rejected") {
@@ -153349,7 +153949,7 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
           }
           models = await modelsForPicker(selectedProvider, modelDeps);
         }
-        if (!options.onlyConnected && selectedProvider.baseUrl !== undefined && endpointMayBeAtFault(models.failure)) {
+        if (!options.onlyConnected && !lockDiscoveredHost && selectedProvider.baseUrl !== undefined && endpointMayBeAtFault(models.failure)) {
           const corrected = await promptBaseUrlStep(otui, rOrChrome, label, selectedProvider.baseUrl, modelsFailureLine(label, models.failure));
           if (corrected === undefined) {
             continue;
@@ -156474,7 +157074,7 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
             io.onSystem?.(`Reasoning effort: ${wanted}
 `);
             const compatProvider = providerByName(currentSel.provider);
-            if (compatProvider !== undefined && compatProvider.reasoning === undefined) {
+            if (currentSel.provider !== "openai" && compatProvider !== undefined && compatProvider.reasoning === undefined) {
               io.onSystem?.(`Note: ${currentSel.provider} is OpenAI-compatible with no "reasoning" entry \u2014 its reasoning ` + `is configured per-provider in llm-providers.json (reasoning.requestParams); this setting has no effect for it.
 `);
             }
@@ -156537,7 +157137,8 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
 `);
                 }
                 if (name === currentSel.provider) {
-                  io.onSystem?.(`\u25C7 ${name} disconnected \u2014 this session keeps its already-loaded credential until you /connect another provider or restart.
+                  io.onSystem?.(name === "openai-codex" ? `\u25C7 ${name} disconnected \u2014 it stays selected, but the next turn requires a new login. Use /provider to reconnect or /connect to switch.
+` : `\u25C7 ${name} disconnected \u2014 this session keeps its already-loaded credential until you /connect another provider or restart.
 `);
                 }
               }
@@ -157880,6 +158481,17 @@ Starting a new session.
     modelParams = picked.modelParams ?? {};
     provider = makeActive();
   };
+  const selectAndApply = async (options) => {
+    if (deps.selectProviderModel === undefined)
+      return;
+    try {
+      applySelection(await deps.selectProviderModel(io, options));
+    } catch (cause) {
+      system(`${cause instanceof Error ? cause.message : "Provider selection failed"}
+Kept the current session.
+`);
+    }
+  };
   for await (const line of io.lines) {
     io.onSafeBoundary?.();
     if (line.startsWith("/")) {
@@ -158017,12 +158629,19 @@ Kept the current session.
 `);
           continue;
         }
-        const picked = await deps.selectProviderModel(io, { onlyProvider: providerName });
-        applySelection(picked);
+        await selectAndApply({ onlyProvider: providerName });
         continue;
       }
       if (command === "/provider") {
         if (argument.length > 0) {
+          if (argument === "openai-codex") {
+            if (deps.selectProviderModel === undefined) {
+              system("Interactive subscription selection is not available. Run `keryx auth login openai-codex` and select an authorized model.\n");
+            } else {
+              await selectAndApply({ onlyProvider: "openai-codex" });
+            }
+            continue;
+          }
           providerName = argument;
           provider = makeActive();
           continue;
@@ -158032,8 +158651,7 @@ Kept the current session.
 `);
           continue;
         }
-        const picked = await deps.selectProviderModel(io, {});
-        applySelection(picked);
+        await selectAndApply({});
         continue;
       }
       if (command === "/connect") {
@@ -158041,8 +158659,7 @@ Kept the current session.
           system(CONNECT_GUIDANCE);
           continue;
         }
-        const picked = await deps.selectProviderModel(io, { onlyConnected: true });
-        applySelection(picked);
+        await selectAndApply({ onlyConnected: true });
         continue;
       }
       const wrongMode = describeUnavailableCommand(command, "chat");
@@ -158150,6 +158767,8 @@ function realMakeProvider(write) {
   };
 }
 function oauthCredentialsFor(name) {
+  if (name === "openai" || name === "openai-codex")
+    return {};
   const definition = providerByName(name);
   const envKey = definition?.envKey;
   if (envKey === undefined)
@@ -169437,6 +170056,7 @@ async function routingCommand(args, deps = {}) {
 init_catalog();
 init_grants();
 init_login();
+init_open_url();
 function printAuthHelp() {
   console.log(`Usage:
   keryx auth list [--json]
@@ -169444,7 +170064,7 @@ function printAuthHelp() {
   keryx auth logout <provider>
   keryx auth status <provider> [--json]
 
-Providers with a sanctioned subscription login: grok (SuperGrok), openai (ChatGPT Plus/Pro), github-copilot.
+Providers with a sanctioned subscription login: grok (SuperGrok), openai-codex (ChatGPT Plus/Pro), github-copilot.
 Claude Pro/Max, Gemini Google-account login, and DeepSeek OAuth are not offered.
 `);
 }
@@ -169500,7 +170120,9 @@ function runAuthList(args) {
   }
 }
 async function runAuthLogin(args) {
-  const provider = args[0];
+  const provider = args[0] === "openai" ? "openai-codex" : args[0];
+  if (args[0] === "openai")
+    console.error("The OpenAI subscription login is now openai-codex; openai is API-key only.");
   if (provider === undefined || provider.length === 0) {
     console.error("Usage: keryx auth login <provider>");
     process.exitCode = 1;
@@ -169512,14 +170134,18 @@ async function runAuthLogin(args) {
     process.exitCode = 1;
     return;
   }
+  const controller = new AbortController;
+  const cancel = () => controller.abort();
+  process.on("SIGINT", cancel);
   const result = await loginDeviceCode({
     provider,
+    signal: controller.signal,
     fetch: (input, init) => globalThis.fetch(input, init),
     onChallenge: (challenge) => {
       console.log(challenge.instructions);
       openVerificationUrl(challenge.verificationUriComplete ?? challenge.verificationUri);
     }
-  });
+  }).finally(() => process.removeListener("SIGINT", cancel));
   if (!result.ok) {
     console.error(result.error);
     process.exitCode = 1;
@@ -169529,7 +170155,9 @@ async function runAuthLogin(args) {
   console.log(`Authorized ${provider} via ${deviceCodeMethodLabel(provider)}.`);
 }
 function runAuthLogout(args) {
-  const provider = args[0];
+  const provider = args[0] === "openai" ? "openai-codex" : args[0];
+  if (args[0] === "openai")
+    console.error("The OpenAI subscription login is now openai-codex; openai is API-key only.");
   if (provider === undefined || provider.length === 0) {
     console.error("Usage: keryx auth logout <provider>");
     process.exitCode = 1;
@@ -169539,7 +170167,9 @@ function runAuthLogout(args) {
   console.log(`Logged out ${provider}.`);
 }
 function runAuthStatus(args) {
-  const provider = args[0];
+  const provider = args[0] === "openai" ? "openai-codex" : args[0];
+  if (args[0] === "openai")
+    console.error("The OpenAI subscription login is now openai-codex; openai is API-key only.");
   if (provider === undefined || provider.length === 0) {
     console.error("Usage: keryx auth status <provider>");
     process.exitCode = 1;