@mrpatronz/nexusflow 2.0.0 → 2.2.0

package/dist/agent/cliAvailability.d.ts

@@ -7,29 +7,52 @@
  * when it cannot run, so a chat opens, the first turn fails, and the message the
  * user sees is whatever the CLI happened to print.
  *
- * The case worth naming: the Claude Code desktop app keeps OAuth tokens in memory
- * and injects them into the sessions it spawns itself, so `~/.claude/.credentials.json`
- * can exist with scopes but **empty tokens**. An interactive `claude` under the
- * desktop app then works while an independently spawned `claude -p` cannot
- * authenticate at all — the tokens simply are not on disk for it to find.
+ * Provider-owned status commands are the source of truth. In particular,
+ * NexusFlow must not infer Claude login from private credential-file shapes:
+ * newer installations may use a keychain or host-managed subscription login.
  *
- * Checks are synchronous because `ProviderAdapter.isConfigured()` is, and they are
- * deliberately conservative: a provider is only reported unusable when there is
- * positive evidence it cannot work, never merely because something is unfamiliar.
+ * Checks are synchronous because `ProviderAdapter.isConfigured()` is. Probe output
+ * is reduced to a closed setup state so account and credential details never cross
+ * the server boundary.
  */
 export interface CliStatus {
     /** Whether a turn stands a chance of succeeding. */
     usable: boolean;
     /** User-facing explanation. Present whenever `usable` is false. */
     message?: string;
+    setupIssue?: 'missing-cli' | 'signed-out' | 'probe-failed';
+    recoveryCommand?: string;
+    recoveryLabel?: string;
 }
 export interface DetectOptions {
     /** Overrides for tests. */
     env?: NodeJS.ProcessEnv;
-    homeDir?: string;
     /** Skips the PATH scan when availability is already known. */
     hasBinary?: boolean;
 }
+export interface CodexDetectOptions extends DetectOptions {
+    /** Injected command outcome for deterministic tests. */
+    loginStatus?: {
+        exitCode: number | null;
+        error?: string;
+    };
+}
+export interface ClaudeDetectOptions extends DetectOptions {
+    /** Injected command outcome for deterministic tests. */
+    authStatus?: {
+        exitCode: number | null;
+        stdout?: string;
+        error?: string;
+    };
+}
+export interface CopilotDetectOptions extends DetectOptions {
+    /** Injected command outcome for deterministic tests. */
+    helpStatus?: {
+        exitCode: number | null;
+        output?: string;
+        error?: string;
+    };
+}
 /**
  * Resolves an executable on PATH the way a shell would, honouring PATHEXT on
  * Windows so `claude.cmd` and `claude.exe` both count.
@@ -38,11 +61,26 @@ export declare function findExecutable(name: string, env?: NodeJS.ProcessEnv): s
 /**
  * Whether `claude` can be driven in print mode.
  *
- * Order matters: an API key makes the credential store irrelevant, and an absent
- * store is treated as unknown rather than broken so an installation that keeps
- * tokens elsewhere is never wrongly disabled.
+ * `claude auth status --json` is the provider-owned authority. NexusFlow only
+ * inspects the boolean `loggedIn` field and never reads or returns credential,
+ * account, auth-method, or provider values.
  */
-export declare function detectClaudeCliStatus(options?: DetectOptions): CliStatus;
+export declare function detectClaudeCliStatus(options?: ClaudeDetectOptions): CliStatus;
 /** Whether the Antigravity CLI is present. It manages its own auth. */
 export declare function detectAntigravityCliStatus(options?: DetectOptions): CliStatus;
+/**
+ * Whether Codex can run non-interactively with the user's existing CLI login.
+ * `codex login status` is the supported auth probe and does not expose or copy
+ * the credential store. A ChatGPT subscription login is sufficient; no API key
+ * is required.
+ */
+export declare function detectCodexCliStatus(options?: CodexDetectOptions): CliStatus;
+/**
+ * Whether the installed Copilot CLI exposes its supported ACP server.
+ *
+ * Copilot has no documented non-interactive login-status command. Session
+ * creation is therefore the authentication authority; this probe only avoids
+ * advertising older installations that cannot speak ACP at all.
+ */
+export declare function detectCopilotCliStatus(options?: CopilotDetectOptions): CliStatus;
 //# sourceMappingURL=cliAvailability.d.ts.map

package/dist/agent/cliAvailability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliAvailability.d.ts","sourceRoot":"","sources":["../../src/agent/cliAvailability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAsBhG;AAoBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,aAAkB,GAAG,SAAS,CAkC5E;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,aAAkB,GAAG,SAAS,CAUjF"}
+{"version":3,"file":"cliAvailability.d.ts","sourceRoot":"","sources":["../../src/agent/cliAvailability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,cAAc,CAAC;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,wDAAwD;IACxD,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,wDAAwD;IACxD,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,wDAAwD;IACxD,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAsBhG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,mBAAwB,GAAG,SAAS,CAgElF;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,aAAkB,GAAG,SAAS,CAUjF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,kBAAuB,GAAG,SAAS,CAiDhF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,oBAAyB,GAAG,SAAS,CAgDpF"}

package/dist/agent/cliAvailability.js

@@ -7,19 +7,17 @@
  * when it cannot run, so a chat opens, the first turn fails, and the message the
  * user sees is whatever the CLI happened to print.
  *
- * The case worth naming: the Claude Code desktop app keeps OAuth tokens in memory
- * and injects them into the sessions it spawns itself, so `~/.claude/.credentials.json`
- * can exist with scopes but **empty tokens**. An interactive `claude` under the
- * desktop app then works while an independently spawned `claude -p` cannot
- * authenticate at all — the tokens simply are not on disk for it to find.
+ * Provider-owned status commands are the source of truth. In particular,
+ * NexusFlow must not infer Claude login from private credential-file shapes:
+ * newer installations may use a keychain or host-managed subscription login.
  *
- * Checks are synchronous because `ProviderAdapter.isConfigured()` is, and they are
- * deliberately conservative: a provider is only reported unusable when there is
- * positive evidence it cannot work, never merely because something is unfamiliar.
+ * Checks are synchronous because `ProviderAdapter.isConfigured()` is. Probe output
+ * is reduced to a closed setup state so account and credential details never cross
+ * the server boundary.
  */
 import * as fsSync from 'node:fs';
-import * as os from 'node:os';
 import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
 /**
  * Resolves an executable on PATH the way a shell would, honouring PATHEXT on
  * Windows so `claude.cmd` and `claude.exe` both count.
@@ -47,55 +45,73 @@ export function findExecutable(name, env = process.env) {
     }
     return null;
 }
-/** Reads the on-disk Claude credential store. Null when absent or unreadable. */
-function readStoredOauth(homeDir) {
-    const file = path.join(homeDir, '.claude', '.credentials.json');
-    try {
-        const parsed = JSON.parse(fsSync.readFileSync(file, 'utf-8'));
-        return parsed.claudeAiOauth ?? null;
-    }
-    catch {
-        // Missing, malformed, or stored somewhere else entirely — all "unknown".
-        return null;
-    }
-}
 /**
  * Whether `claude` can be driven in print mode.
  *
- * Order matters: an API key makes the credential store irrelevant, and an absent
- * store is treated as unknown rather than broken so an installation that keeps
- * tokens elsewhere is never wrongly disabled.
+ * `claude auth status --json` is the provider-owned authority. NexusFlow only
+ * inspects the boolean `loggedIn` field and never reads or returns credential,
+ * account, auth-method, or provider values.
  */
 export function detectClaudeCliStatus(options = {}) {
     const env = options.env ?? process.env;
-    const homeDir = options.homeDir ?? os.homedir();
-    const hasBinary = options.hasBinary ?? findExecutable('claude', env) !== null;
+    const executable = options.hasBinary === false ? null : findExecutable('claude', env);
+    const hasBinary = options.hasBinary ?? executable !== null;
     if (!hasBinary) {
         return {
             usable: false,
-            message: 'The claude CLI was not found on PATH. Install Claude Code, or pick a provider that uses an API key.',
+            message: 'The Claude Code CLI was not found on PATH.',
+            setupIssue: 'missing-cli',
+            recoveryCommand: 'npm install -g @anthropic-ai/claude-code',
+            recoveryLabel: 'Copy install command',
         };
     }
-    if (env.ANTHROPIC_API_KEY)
+    if (env.ANTHROPIC_API_KEY
+        || env.ANTHROPIC_AUTH_TOKEN
+        || env.CLAUDE_CODE_USE_BEDROCK === '1'
+        || env.CLAUDE_CODE_USE_VERTEX === '1'
+        || env.CLAUDE_CODE_USE_FOUNDRY === '1')
         return { usable: true };
-    const oauth = readStoredOauth(homeDir);
-    if (!oauth)
-        return { usable: true };
-    const hasToken = Boolean(oauth.accessToken) || Boolean(oauth.refreshToken);
-    if (hasToken)
-        return { usable: true };
-    // Tokens are absent, so nothing spawned from here can authenticate or renew.
-    const hostManaged = Boolean(env.CLAUDE_CODE_ENTRYPOINT)
-        || env.CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH === '1'
-        || env.CLAUDECODE === '1';
+    let authStatus = options.authStatus;
+    if (!authStatus) {
+        const result = spawnSync(executable ?? 'claude', ['auth', 'status', '--json'], {
+            env,
+            encoding: 'utf-8',
+            timeout: 5_000,
+            windowsHide: true,
+            shell: process.platform === 'win32' && /\.(cmd|bat)$/i.test(executable ?? ''),
+        });
+        authStatus = {
+            exitCode: result.status,
+            stdout: result.stdout ?? '',
+            error: result.error?.message,
+        };
+    }
+    if (!authStatus.error && typeof authStatus.stdout === 'string') {
+        try {
+            const parsed = JSON.parse(authStatus.stdout);
+            if (parsed.loggedIn === true)
+                return { usable: true };
+            if (parsed.loggedIn === false) {
+                return {
+                    usable: false,
+                    message: 'Claude Code is installed but not signed in. Use your Claude subscription; no API key is required.',
+                    setupIssue: 'signed-out',
+                    recoveryCommand: 'claude auth login',
+                    recoveryLabel: 'Copy sign-in command',
+                };
+            }
+        }
+        catch {
+            // A changed or malformed provider response is a compatibility failure,
+            // not evidence that the user is signed out.
+        }
+    }
     return {
         usable: false,
-        message: hostManaged
-            ? 'The claude CLI is installed but its stored credentials are empty, so a headless turn cannot authenticate. '
-                + 'This happens when the Claude Code app holds your tokens in memory for its own sessions instead of writing them to disk. '
-                + 'Run `claude` in a normal terminal and sign in, or set ANTHROPIC_API_KEY and use the Claude (API) provider.'
-            : 'The claude CLI is installed but not signed in — its stored credentials are empty. '
-                + 'Run `claude` in a terminal and sign in, or set ANTHROPIC_API_KEY and use the Claude (API) provider.',
+        message: 'NexusFlow could not verify Claude Code login. Check it in a terminal, then recheck.',
+        setupIssue: 'probe-failed',
+        recoveryCommand: 'claude auth status --json',
+        recoveryLabel: 'Copy status command',
     };
 }
 /** Whether the Antigravity CLI is present. It manages its own auth. */
@@ -109,4 +125,107 @@ export function detectAntigravityCliStatus(options = {}) {
             message: 'The Antigravity CLI (`agy`) was not found on PATH.',
         };
 }
+/**
+ * Whether Codex can run non-interactively with the user's existing CLI login.
+ * `codex login status` is the supported auth probe and does not expose or copy
+ * the credential store. A ChatGPT subscription login is sufficient; no API key
+ * is required.
+ */
+export function detectCodexCliStatus(options = {}) {
+    const env = options.env ?? process.env;
+    const executable = options.hasBinary === false ? null : findExecutable('codex', env);
+    const hasBinary = options.hasBinary ?? executable !== null;
+    if (!hasBinary) {
+        return {
+            usable: false,
+            message: 'The Codex CLI was not found on PATH.',
+            setupIssue: 'missing-cli',
+            recoveryCommand: 'npm install -g @openai/codex',
+            recoveryLabel: 'Copy install command',
+        };
+    }
+    let loginStatus = options.loginStatus;
+    if (!loginStatus) {
+        const result = spawnSync(executable ?? 'codex', ['login', 'status'], {
+            env,
+            encoding: 'utf-8',
+            timeout: 5_000,
+            windowsHide: true,
+            shell: process.platform === 'win32' && /\.(cmd|bat)$/i.test(executable ?? ''),
+        });
+        loginStatus = {
+            exitCode: result.status,
+            error: result.error?.message,
+        };
+    }
+    if (!loginStatus.error && loginStatus.exitCode === 0)
+        return { usable: true };
+    if (!loginStatus.error && loginStatus.exitCode === 1) {
+        return {
+            usable: false,
+            message: 'Codex is installed but not signed in. Use your ChatGPT account; no API key is required.',
+            setupIssue: 'signed-out',
+            recoveryCommand: 'codex login',
+            recoveryLabel: 'Copy sign-in command',
+        };
+    }
+    return {
+        usable: false,
+        message: 'NexusFlow could not verify Codex login. Check it in a terminal, then recheck.',
+        setupIssue: 'probe-failed',
+        recoveryCommand: 'codex login status',
+        recoveryLabel: 'Copy status command',
+    };
+}
+/**
+ * Whether the installed Copilot CLI exposes its supported ACP server.
+ *
+ * Copilot has no documented non-interactive login-status command. Session
+ * creation is therefore the authentication authority; this probe only avoids
+ * advertising older installations that cannot speak ACP at all.
+ */
+export function detectCopilotCliStatus(options = {}) {
+    const env = options.env ?? process.env;
+    const executable = options.hasBinary === false ? null : findExecutable('copilot', env);
+    const hasBinary = options.hasBinary ?? executable !== null;
+    if (!hasBinary) {
+        return {
+            usable: false,
+            message: 'The GitHub Copilot CLI was not found on PATH. Install it, then run `copilot login`.',
+        };
+    }
+    // A classic PAT takes precedence over saved OAuth but is unsupported by the
+    // Copilot CLI, so this is one credential failure we can identify safely.
+    const token = env.COPILOT_GITHUB_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN;
+    if (token?.startsWith('ghp_')) {
+        return {
+            usable: false,
+            message: 'GitHub Copilot CLI does not support classic `ghp_` tokens. Remove the overriding token and run `copilot login`.',
+        };
+    }
+    let helpStatus = options.helpStatus;
+    if (!helpStatus) {
+        const result = spawnSync(executable ?? 'copilot', ['help'], {
+            env,
+            encoding: 'utf-8',
+            timeout: 5_000,
+            windowsHide: true,
+            shell: process.platform === 'win32' && /\.(cmd|bat)$/i.test(executable ?? ''),
+        });
+        helpStatus = {
+            exitCode: result.status,
+            output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`,
+            error: result.error?.message,
+        };
+    }
+    if (helpStatus.exitCode === 0 && /--acp\b/.test(helpStatus.output ?? '')) {
+        return { usable: true };
+    }
+    return {
+        usable: false,
+        message: helpStatus.error
+            ? `NexusFlow could not inspect GitHub Copilot CLI ACP support (${helpStatus.error}). Update Copilot CLI and try again.`
+            : 'The installed GitHub Copilot CLI does not expose ACP. Update it, then run `copilot login`.',
+    };
+}
 //# sourceMappingURL=cliAvailability.js.map

package/dist/agent/cliAvailability.js.map

@@ -1 +1 @@
-{"version":3,"file":"cliAvailability.js","sourceRoot":"","sources":["../../src/agent/cliAvailability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAiBlC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC7C,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACnE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAET,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,SAAS,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAoC,CAAC;QACjG,OAAO,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAyB,EAAE;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAEhD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,qGAAqG;SAC/G,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEtC,6EAA6E;IAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;WAClD,GAAG,CAAC,qCAAqC,KAAK,GAAG;WACjD,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC;IAE5B,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,WAAW;YAClB,CAAC,CAAC,4GAA4G;kBAC1G,0HAA0H;kBAC1H,4GAA4G;YAChH,CAAC,CAAC,oFAAoF;kBAClF,qGAAqG;KAC5G,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CAAC,UAAyB,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;IAE3E,OAAO,SAAS;QACd,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QAClB,CAAC,CAAC;YACA,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,oDAAoD;SAC9D,CAAC;AACN,CAAC"}
+{"version":3,"file":"cliAvailability.js","sourceRoot":"","sources":["../../src/agent/cliAvailability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAkC/C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC7C,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACnE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAET,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,SAAS,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA+B,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,4CAA4C;YACrD,UAAU,EAAE,aAAa;YACzB,eAAe,EAAE,0CAA0C;YAC3D,aAAa,EAAE,sBAAsB;SACtC,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,iBAAiB;WAClB,GAAG,CAAC,oBAAoB;WACxB,GAAG,CAAC,uBAAuB,KAAK,GAAG;WACnC,GAAG,CAAC,sBAAsB,KAAK,GAAG;WAClC,GAAG,CAAC,uBAAuB,KAAK,GAAG;QACtC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE1B,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YAC7E,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,UAAU,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAA2B,CAAC;YACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,mGAAmG;oBAC5G,UAAU,EAAE,YAAY;oBACxB,eAAe,EAAE,mBAAmB;oBACpC,aAAa,EAAE,sBAAsB;iBACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,qFAAqF;QAC9F,UAAU,EAAE,cAAc;QAC1B,eAAe,EAAE,2BAA2B;QAC5C,aAAa,EAAE,qBAAqB;KACrC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CAAC,UAAyB,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;IAE3E,OAAO,SAAS;QACd,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QAClB,CAAC,CAAC;YACA,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,oDAAoD;SAC9D,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA8B,EAAE;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC;IAE3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,sCAAsC;YAC/C,UAAU,EAAE,aAAa;YACzB,eAAe,EAAE,8BAA8B;YAC/C,aAAa,EAAE,sBAAsB;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;YACnE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,WAAW,GAAG;YACZ,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE9E,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,yFAAyF;YAClG,UAAU,EAAE,YAAY;YACxB,eAAe,EAAE,aAAa;YAC9B,aAAa,EAAE,sBAAsB;SACtC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,+EAA+E;QACxF,UAAU,EAAE,cAAc;QAC1B,eAAe,EAAE,oBAAoB;QACrC,aAAa,EAAE,qBAAqB;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAgC,EAAE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC;IAE3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,qFAAqF;SAC/F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC;IAC3E,IAAI,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,iHAAiH;SAC3H,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE;YAC1D,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,UAAU,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE;YACxD,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,UAAU,CAAC,KAAK;YACvB,CAAC,CAAC,+DAA+D,UAAU,CAAC,KAAK,sCAAsC;YACvH,CAAC,CAAC,4FAA4F;KACjG,CAAC;AACJ,CAAC"}

package/dist/agent/cliAvailability.test.js

@@ -2,7 +2,7 @@ import * as fs from 'node:fs/promises';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { detectAntigravityCliStatus, detectClaudeCliStatus, findExecutable, } from './cliAvailability.js';
+import { detectAntigravityCliStatus, detectClaudeCliStatus, detectCodexCliStatus, detectCopilotCliStatus, findExecutable, } from './cliAvailability.js';
 let home = '';
 beforeEach(async () => {
     home = await fs.mkdtemp(path.join(os.tmpdir(), 'nexusflow-cliavail-'));
@@ -10,19 +10,6 @@ beforeEach(async () => {
 afterEach(async () => {
     await fs.rm(home, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
 });
-/** Writes a credential store with the given oauth block. */
-async function writeCredentials(oauth) {
-    await fs.mkdir(path.join(home, '.claude'), { recursive: true });
-    await fs.writeFile(path.join(home, '.claude', '.credentials.json'), JSON.stringify({ claudeAiOauth: oauth }), 'utf-8');
-}
-/** The observed real-world shape: scopes present, every token empty. */
-const HOLLOW = {
-    accessToken: '',
-    refreshToken: '',
-    expiresAt: 0,
-    scopes: ['user:inference'],
-    subscriptionType: 'team',
-};
 describe('findExecutable', () => {
     it('finds a file on PATH', async () => {
         const name = process.platform === 'win32' ? 'thing.cmd' : 'thing';
@@ -38,58 +25,72 @@ describe('findExecutable', () => {
 });
 describe('detectClaudeCliStatus', () => {
     it('is unusable when the binary is missing, and says so', () => {
-        const status = detectClaudeCliStatus({ hasBinary: false, env: {}, homeDir: home });
+        const status = detectClaudeCliStatus({ hasBinary: false, env: {} });
         expect(status.usable).toBe(false);
         expect(status.message).toMatch(/not found on PATH/);
+        expect(status).toMatchObject({
+            setupIssue: 'missing-cli',
+            recoveryCommand: 'npm install -g @anthropic-ai/claude-code',
+        });
     });
-    it('is usable when an API key is set, regardless of the credential store', async () => {
-        await writeCredentials(HOLLOW);
+    it('is usable when an API key is set without inspecting auth status', () => {
         const status = detectClaudeCliStatus({
             hasBinary: true,
             env: { ANTHROPIC_API_KEY: 'sk-test' },
-            homeDir: home,
+            authStatus: { exitCode: 1, stdout: '{not json', error: 'must not leak' },
         });
-        expect(status.usable).toBe(true);
-        expect(status.message).toBeUndefined();
-    });
-    it('reports unusable when the credential store has no tokens at all', async () => {
-        // The real failure: an interactive claude works because its host injects
-        // tokens, but a spawned `claude -p` finds nothing on disk to use.
-        await writeCredentials(HOLLOW);
-        const status = detectClaudeCliStatus({ hasBinary: true, env: {}, homeDir: home });
-        expect(status.usable).toBe(false);
-        expect(status.message).toMatch(/not signed in|credentials are empty/i);
+        expect(status).toEqual({ usable: true });
+    });
+    it.each([
+        { ANTHROPIC_AUTH_TOKEN: 'gateway-token' },
+        { CLAUDE_CODE_USE_BEDROCK: '1' },
+        { CLAUDE_CODE_USE_VERTEX: '1' },
+        { CLAUDE_CODE_USE_FOUNDRY: '1' },
+    ])('accepts a declared provider-owned external auth mode', (externalEnv) => {
+        expect(detectClaudeCliStatus({
+            hasBinary: true,
+            env: externalEnv,
+            authStatus: { exitCode: 1, stdout: JSON.stringify({ loggedIn: false }) },
+        })).toEqual({ usable: true });
     });
-    it('names the host-managed case when the app is providing auth', async () => {
-        await writeCredentials(HOLLOW);
+    it('accepts provider-owned subscription login without returning account metadata', () => {
         const status = detectClaudeCliStatus({
             hasBinary: true,
-            env: { CLAUDE_CODE_ENTRYPOINT: 'claude-desktop' },
-            homeDir: home,
+            env: {},
+            authStatus: {
+                exitCode: 0,
+                stdout: JSON.stringify({ loggedIn: true, authMethod: 'claude.ai', apiProvider: 'firstParty', email: 'private@example.test' }),
+            },
         });
-        expect(status.usable).toBe(false);
-        expect(status.message).toMatch(/holds your tokens in memory/i);
-        // The message must be actionable, not just descriptive.
-        expect(status.message).toMatch(/ANTHROPIC_API_KEY/);
-    });
-    it('is usable with an access token present', async () => {
-        await writeCredentials({ ...HOLLOW, accessToken: 'tok' });
-        expect(detectClaudeCliStatus({ hasBinary: true, env: {}, homeDir: home }).usable).toBe(true);
+        expect(status).toEqual({ usable: true });
     });
-    it('is usable with only a refresh token, which can mint a new one', async () => {
-        await writeCredentials({ ...HOLLOW, refreshToken: 'refresh' });
-        expect(detectClaudeCliStatus({ hasBinary: true, env: {}, homeDir: home }).usable).toBe(true);
-    });
-    it('assumes usable when there is no credential file to judge', () => {
-        // Conservative on purpose: an install that stores tokens elsewhere must not
-        // be disabled just because this particular file is absent.
-        const status = detectClaudeCliStatus({ hasBinary: true, env: {}, homeDir: home });
-        expect(status.usable).toBe(true);
+    it('maps a parsed signed-out response to keyless Claude login recovery', () => {
+        const status = detectClaudeCliStatus({
+            hasBinary: true,
+            env: {},
+            authStatus: { exitCode: 1, stdout: JSON.stringify({ loggedIn: false }) },
+        });
+        expect(status).toMatchObject({
+            usable: false,
+            setupIssue: 'signed-out',
+            recoveryCommand: 'claude auth login',
+            recoveryLabel: 'Copy sign-in command',
+        });
+        expect(status.message).toMatch(/no API key is required/i);
     });
-    it('assumes usable when the credential file is malformed', async () => {
-        await fs.mkdir(path.join(home, '.claude'), { recursive: true });
-        await fs.writeFile(path.join(home, '.claude', '.credentials.json'), '{ not json', 'utf-8');
-        expect(detectClaudeCliStatus({ hasBinary: true, env: {}, homeDir: home }).usable).toBe(true);
+    it.each([
+        { name: 'malformed output', authStatus: { exitCode: 0, stdout: '{ not json' } },
+        { name: 'unknown schema', authStatus: { exitCode: 0, stdout: '{"authenticated":true}' } },
+        { name: 'timeout', authStatus: { exitCode: null, stdout: '', error: 'timed out at C:\\private\\path' } },
+    ])('sanitizes a $name auth probe failure', ({ authStatus }) => {
+        const status = detectClaudeCliStatus({ hasBinary: true, env: {}, authStatus });
+        expect(status).toMatchObject({
+            usable: false,
+            setupIssue: 'probe-failed',
+            recoveryCommand: 'claude auth status --json',
+        });
+        expect(status.message).not.toContain('private');
+        expect(status).not.toHaveProperty('stdout');
     });
 });
 describe('detectAntigravityCliStatus', () => {
@@ -102,4 +103,90 @@ describe('detectAntigravityCliStatus', () => {
         expect(status.message).toMatch(/agy/);
     });
 });
+describe('detectCodexCliStatus', () => {
+    it('is unusable when the binary is missing', () => {
+        const status = detectCodexCliStatus({ hasBinary: false, env: {} });
+        expect(status.usable).toBe(false);
+        expect(status.message).toMatch(/not found on PATH/i);
+        expect(status).toMatchObject({
+            setupIssue: 'missing-cli',
+            recoveryCommand: 'npm install -g @openai/codex',
+        });
+    });
+    it('accepts a saved ChatGPT or API login reported by the CLI', () => {
+        const status = detectCodexCliStatus({
+            hasBinary: true,
+            env: {},
+            loginStatus: { exitCode: 0 },
+        });
+        expect(status).toEqual({ usable: true });
+    });
+    it('directs signed-out users to ChatGPT login without demanding an API key', () => {
+        const status = detectCodexCliStatus({
+            hasBinary: true,
+            env: {},
+            loginStatus: { exitCode: 1 },
+        });
+        expect(status.usable).toBe(false);
+        expect(status.message).toMatch(/no API key is required/i);
+        expect(status).toMatchObject({
+            setupIssue: 'signed-out',
+            recoveryCommand: 'codex login',
+        });
+    });
+    it('reports a timed-out or failed auth probe actionably', () => {
+        const status = detectCodexCliStatus({
+            hasBinary: true,
+            env: {},
+            loginStatus: { exitCode: null, error: 'timed out' },
+        });
+        expect(status.usable).toBe(false);
+        expect(status).toMatchObject({
+            setupIssue: 'probe-failed',
+            recoveryCommand: 'codex login status',
+        });
+        expect(status.message).not.toMatch(/timed out/);
+    });
+});
+describe('detectCopilotCliStatus', () => {
+    it('is unusable when the binary is missing', () => {
+        const status = detectCopilotCliStatus({ hasBinary: false, env: {} });
+        expect(status.usable).toBe(false);
+        expect(status.message).toMatch(/not found on PATH/i);
+    });
+    it('accepts an installation whose help advertises ACP', () => {
+        expect(detectCopilotCliStatus({
+            hasBinary: true,
+            env: {},
+            helpStatus: { exitCode: 0, output: '  --acp  Start Agent Client Protocol server' },
+        })).toEqual({ usable: true });
+    });
+    it('asks users with an older CLI to update it', () => {
+        const status = detectCopilotCliStatus({
+            hasBinary: true,
+            env: {},
+            helpStatus: { exitCode: 0, output: 'Usage: copilot' },
+        });
+        expect(status.usable).toBe(false);
+        expect(status.message).toMatch(/does not expose ACP/i);
+    });
+    it('reports a failed or timed-out capability probe', () => {
+        const status = detectCopilotCliStatus({
+            hasBinary: true,
+            env: {},
+            helpStatus: { exitCode: null, error: 'timed out' },
+        });
+        expect(status.usable).toBe(false);
+        expect(status.message).toMatch(/timed out/);
+    });
+    it('rejects an overriding classic PAT that Copilot cannot use', () => {
+        const status = detectCopilotCliStatus({
+            hasBinary: true,
+            env: { COPILOT_GITHUB_TOKEN: 'ghp_classic' },
+            helpStatus: { exitCode: 0, output: '--acp' },
+        });
+        expect(status.usable).toBe(false);
+        expect(status.message).toMatch(/classic/i);
+    });
+});
 //# sourceMappingURL=cliAvailability.test.js.map