@nairon-ai/aegis 0.4.9 → 0.5.0

package/.flue/app.ts

@@ -1,4 +1,5 @@
-import { flue } from "@flue/sdk/app";
+import { configureProvider, flue } from "@flue/sdk/app";
+import { refreshOpenAICodexToken } from "@mariozechner/pi-ai/oauth";
 import { createAegisApp, scheduledPickup } from "../src/server/app.js";
 import type { Bindings } from "../src/shared/types.js";
 
@@ -6,11 +7,42 @@ const app = createAegisApp();
 const flueApp = flue();
 
 export default {
-	fetch(request: Request, env?: Bindings, ctx?: ExecutionContext) {
+	async fetch(request: Request, env?: Bindings, ctx?: ExecutionContext) {
+		await configureAgentProviders(env);
 		if (new URL(request.url).pathname.startsWith("/agents/")) {
 			return flueApp.fetch(request, env, ctx);
 		}
 		return app.fetch(request, env, ctx);
 	},
-	scheduled: scheduledPickup,
+	async scheduled(controller: ScheduledController, env: Bindings, ctx: ExecutionContext) {
+		await configureAgentProviders(env);
+		return scheduledPickup(controller, env, ctx);
+	},
 };
+
+async function configureAgentProviders(env?: Bindings): Promise<void> {
+	if (env?.AGENT_AUTH_METHOD !== "codex-account" || !env.CODEX_OAUTH_CREDENTIALS_B64) return;
+	const credentials = decodeCodexCredentials(env.CODEX_OAUTH_CREDENTIALS_B64);
+	const refreshed =
+		typeof credentials.expires === "number" && credentials.expires < Date.now() + 5 * 60_000
+			? await refreshOpenAICodexToken(credentials.refresh)
+			: credentials;
+	configureProvider("openai-codex", { apiKey: refreshed.access });
+}
+
+function decodeCodexCredentials(value: string): {
+	access: string;
+	refresh: string;
+	expires: number;
+} {
+	const json = new TextDecoder().decode(Uint8Array.from(atob(value), (char) => char.charCodeAt(0)));
+	const parsed = JSON.parse(json) as { access?: string; refresh?: string; expires?: number };
+	if (!parsed.access || !parsed.refresh || typeof parsed.expires !== "number") {
+		throw new Error("Invalid Codex account credentials. Rerun `aegis setup`.");
+	}
+	return {
+		access: parsed.access,
+		refresh: parsed.refresh,
+		expires: parsed.expires,
+	};
+}

package/README.md

@@ -51,10 +51,11 @@ No Cloudflare required for this part.
 2. Run `npx --yes @nairon-ai/aegis@latest init`.
 3. Run `npx --yes @nairon-ai/aegis@latest setup`.
 4. Choose `One-click GitHub App` unless you already know how to create a GitHub token.
-5. Choose `plan-first` and `minimal` for the first test.
-6. Add `bug` and `ready to implement` labels to the monitored GitHub repo.
-7. Create a test bug issue with both labels.
-8. Run `npx --yes @nairon-ai/aegis@latest pickup --dry-run`.
+5. Choose `Codex account / ChatGPT login` or `OpenAI API key`, then choose the model.
+6. Choose `plan-first` and `minimal` for the first test.
+7. Add `bug` and `ready to implement` labels to the monitored GitHub repo.
+8. Create a test bug issue with both labels.
+9. Run `npx --yes @nairon-ai/aegis@latest pickup --dry-run`.
 
 Good first result:
 
@@ -78,6 +79,10 @@ GitHub App credentials are saved in `.aegis/.env` and backed up for your Mac use
 
 If you connect Linear, Aegis fetches your Linear teams after you paste the API key and lets you choose by name, for example `Engineering (ENG)`. You do not need to hunt for Linear UUIDs manually.
 
+For model auth, Aegis asks account first, then model. `Codex account / ChatGPT login` uses `openai-codex/...` models and stores OAuth credentials for your self-hosted Worker. `OpenAI API key` uses `openai/...` models and normal API billing.
+
+Setup reruns check each completed step first. Existing Codex credentials, API keys, webhook secrets, Linear team, Telegram config, production context, model choice, and Worker URL are reused unless you choose to reconfigure that step.
+
 ### Deployed AFK Mode
 
 Deploy only after the local dry-run works.
@@ -134,7 +139,7 @@ Cloudflare Sandbox is currently available on Workers Paid and uses Docker during
 - Docker running locally for Cloudflare Sandbox image deploy
 - Cloudflare account and Workers Paid for deployed mode
 - GitHub App or GitHub token with Contents, Issues, and Pull Requests read/write access
-- OpenAI API key for the default `openai/gpt-5.5` model, or another Flue-supported model provider key
+- Codex account login for the default `openai-codex/gpt-5.5` model, or an OpenAI API key for `openai/...` models
 - Optional: Linear API key
 - Optional: Telegram bot
 - Optional: read-only production database URL
@@ -180,11 +185,12 @@ npx --yes @nairon-ai/aegis@latest disconnect
 To fully stop using Aegis:
 
 1. Delete the Cloudflare Worker if deployed: `npx wrangler delete aegis-worker`.
-2. Uninstall the Aegis GitHub App from the repo, or revoke the GitHub token.
-3. Delete Aegis webhooks from GitHub, Linear, and Telegram if configured.
-4. Remove local config: `rm -rf .aegis`.
-5. Remove cached GitHub App credentials if you used the app flow: `rm -f ~/.aegis/github-apps/YOUR-ORG-YOUR-REPO.env`.
-6. Optionally remove Aegis-only labels: `aegis:in-progress`, `aegis:needs-info`, `aegis:blocked`, `aegis:pr-opened`.
+2. Revoke Codex account OAuth access or revoke the OpenAI API key, depending on model auth.
+3. Uninstall the Aegis GitHub App from the repo, or revoke the GitHub token.
+4. Delete Aegis webhooks from GitHub, Linear, and Telegram if configured.
+5. Remove local config: `rm -rf .aegis`.
+6. Remove cached GitHub App credentials if you used the app flow: `rm -f ~/.aegis/github-apps/YOUR-ORG-YOUR-REPO.env`.
+7. Optionally remove Aegis-only labels: `aegis:in-progress`, `aegis:needs-info`, `aegis:blocked`, `aegis:pr-opened`.
 
 ## How Pickup Works
 

package/dist-node/cli/commands/deploy.js

@@ -87,8 +87,10 @@ function toSecrets(config) {
         VERCEL_TOKEN: config.vercelToken,
         VERCEL_PROJECT_ID: config.vercelProjectId,
         VERCEL_TEAM_ID: config.vercelTeamId,
+        AGENT_AUTH_METHOD: config.agentAuthMethod,
         AGENT_MODEL: config.agentModel,
         OPENAI_API_KEY: config.openaiApiKey,
+        CODEX_OAUTH_CREDENTIALS_B64: config.codexOauthCredentials,
     };
 }
 //# sourceMappingURL=deploy.js.map

package/dist-node/cli/commands/deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../../src/cli/commands/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;IAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;IAC1E,KAAK,CAAC,GAAG;QACR,MAAM,SAAS,EAAE,CAAC;IACnB,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC9B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;IAEvE,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,YAAY,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE;QAC1D,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,SAAS;KAChB,CAAC,CAAC;IAEH,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAEzD,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAC1B,WAAW,EACX,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,EACnE;QACC,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KACjB,CACD,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,WAAW,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,qBAAqB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrC,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CACnB,OAA2C,EAC3C,WAAmB,EACnB,WAAmB;IAEnB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE;YACzF,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,QAAQ,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,MAAqC;IACvD,OAAO;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,eAAe,EAAE,MAAM,CAAC,cAAc;QACtC,eAAe,EAAE,MAAM,CAAC,cAAc;QACtC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,WAAW;QACjC,sBAAsB,EAAE,MAAM,CAAC,mBAAmB;QAClD,sBAAsB,EAAE,MAAM,CAAC,oBAAoB;QACnD,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;QACjD,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;QACjD,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB;QAC7C,yBAAyB,EAAE,MAAM,CAAC,sBAAsB;QACxD,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;QACtD,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;QACjD,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB;QACrD,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC;AACH,CAAC"}
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../../src/cli/commands/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;IAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;IAC1E,KAAK,CAAC,GAAG;QACR,MAAM,SAAS,EAAE,CAAC;IACnB,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC9B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;IAEvE,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,YAAY,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE;QAC1D,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,SAAS;KAChB,CAAC,CAAC;IAEH,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAEzD,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAC1B,WAAW,EACX,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC,EACnE;QACC,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO;KACjB,CACD,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,WAAW,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,qBAAqB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrC,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CACnB,OAA2C,EAC3C,WAAmB,EACnB,WAAmB;IAEnB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE;YACzF,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,QAAQ,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,MAAqC;IACvD,OAAO;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,eAAe,EAAE,MAAM,CAAC,cAAc;QACtC,eAAe,EAAE,MAAM,CAAC,cAAc;QACtC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,WAAW;QACjC,sBAAsB,EAAE,MAAM,CAAC,mBAAmB;QAClD,sBAAsB,EAAE,MAAM,CAAC,oBAAoB;QACnD,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;QACjD,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;QACjD,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB;QAC7C,yBAAyB,EAAE,MAAM,CAAC,sBAAsB;QACxD,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;QACtD,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;QACjD,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB;QACrD,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,iBAAiB,EAAE,MAAM,CAAC,eAAe;QACzC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,YAAY;QACnC,2BAA2B,EAAE,MAAM,CAAC,qBAAqB;KACzD,CAAC;AACH,CAAC"}

package/dist-node/cli/commands/disconnect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"disconnect.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/disconnect.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB,qDAQ5B,CAAC;AAEH,wBAAgB,kBAAkB,IAAI,IAAI,CA2DzC"}
+{"version":3,"file":"disconnect.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/disconnect.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB,qDAQ5B,CAAC;AAEH,wBAAgB,kBAAkB,IAAI,IAAI,CAwEzC"}

package/dist-node/cli/commands/disconnect.js

@@ -21,7 +21,21 @@ export function runDisconnectGuide() {
     consola.log("   If you deployed Aegis, delete the Cloudflare Worker:");
     consola.log(`   npx wrangler delete ${workerName}`);
     consola.log("   Also remove any Cloudflare secrets for Aegis if they remain.\n");
-    consola.log("2. Remove GitHub access");
+    consola.log("2. Remove model access");
+    if (config.agentAuthMethod === "codex-account") {
+        consola.log("   You connected a Codex account.");
+        consola.log("   Open OpenAI/ChatGPT settings and revoke Codex/Aegis OAuth access.");
+        consola.log("   Also delete the CODEX_OAUTH_CREDENTIALS_B64 Cloudflare secret.");
+    }
+    else if (config.openaiApiKey) {
+        consola.log("   You used an OpenAI API key.");
+        consola.log("   Revoke the key in the OpenAI API dashboard if it was created only for Aegis.");
+    }
+    else {
+        consola.log("   No model credential is saved in local config.");
+    }
+    consola.log("");
+    consola.log("3. Remove GitHub access");
     if (config.githubAppId) {
         consola.log("   You used a GitHub App.");
         consola.log(`   Open GitHub -> ${repo} -> Settings -> GitHub Apps, then uninstall the Aegis app.`);
@@ -36,7 +50,7 @@ export function runDisconnectGuide() {
         consola.log("   No GitHub token/app is saved in local config.");
     }
     consola.log("");
-    consola.log("3. Remove webhooks");
+    consola.log("4. Remove webhooks");
     consola.log(`   GitHub: open ${repo} -> Settings -> Webhooks, delete the Aegis webhook.`);
     if (config.linearApiKey) {
         consola.log("   Linear: open Linear Settings -> API/Webhooks, delete the Aegis webhook.");
@@ -46,7 +60,7 @@ export function runDisconnectGuide() {
         consola.log('   curl "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/deleteWebhook"');
     }
     consola.log("");
-    consola.log("4. Remove local config from this repo");
+    consola.log("5. Remove local config from this repo");
     consola.log("   rm -rf .aegis");
     if (config.monitoredRepo) {
         consola.log("   Remove this user's cached GitHub App credentials too:");
@@ -55,7 +69,7 @@ export function runDisconnectGuide() {
     consola.log("   If you installed Aegis as a dev dependency:");
     consola.log("   npm remove @nairon-ai/aegis");
     consola.log("");
-    consola.log("5. Optional cleanup");
+    consola.log("6. Optional cleanup");
     consola.log("   Leave labels like bug and ready to implement if your team uses them.");
     consola.log("   Remove Aegis-only labels if you do not want them:");
     consola.log("   aegis:in-progress, aegis:needs-info, aegis:blocked, aegis:pr-opened");

package/dist-node/cli/commands/disconnect.js.map

@@ -1 +1 @@
-{"version":3,"file":"disconnect.js","sourceRoot":"","sources":["../../../src/cli/commands/disconnect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;IAC9C,IAAI,EAAE;QACL,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mDAAmD;KAChE;IACD,GAAG;QACF,kBAAkB,EAAE,CAAC;IACtB,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB;IACjC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAExD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CACV,uFAAuF,CACvF,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CACV,qBAAqB,IAAI,4DAA4D,CACrF,CAAC;QACF,OAAO,CAAC,GAAG,CACV,mFAAmF,CACnF,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,qDAAqD,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"file":"disconnect.js","sourceRoot":"","sources":["../../../src/cli/commands/disconnect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;IAC9C,IAAI,EAAE;QACL,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mDAAmD;KAChE;IACD,GAAG;QACF,kBAAkB,EAAE,CAAC;IACtB,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB;IACjC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAExD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CACV,uFAAuF,CACvF,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CACV,qBAAqB,IAAI,4DAA4D,CACrF,CAAC;QACF,OAAO,CAAC,GAAG,CACV,mFAAmF,CACnF,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,qDAAqD,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC"}

package/dist-node/cli/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAkGA,eAAO,MAAM,WAAW,qDAKtB,CAAC;AAEH,wBAAgB,OAAO,IAAI,IAAI,CAc9B"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAqGA,eAAO,MAAM,WAAW,qDAKtB,CAAC;AAEH,wBAAgB,OAAO,IAAI,IAAI,CAc9B"}

package/dist-node/cli/commands/init.js

@@ -6,8 +6,11 @@ import { PROJECT_AEGIS_DIR } from "../paths.js";
 const ENV_EXAMPLE = `# Required
 MONITORED_REPO=KeyLead-Team/keylead
 BASE_BRANCH=main
-AGENT_MODEL=openai/gpt-5.5
-OPENAI_API_KEY=sk-...
+AGENT_AUTH_METHOD=codex-account
+AGENT_MODEL=openai-codex/gpt-5.5
+CODEX_OAUTH_CREDENTIALS_B64=
+# Or use AGENT_AUTH_METHOD=openai-api-key with OPENAI_API_KEY=sk-...
+OPENAI_API_KEY=
 
 # Labels / automation
 READY_LABEL=ready to implement

package/dist-node/cli/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CnB,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Cd,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;IACxC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qCAAqC,EAAE;IAC1E,KAAK,CAAC,GAAG;QACR,OAAO,EAAE,CAAC;IACX,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,UAAU,OAAO;IACtB,SAAS,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;IAC1E,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;IACxE,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO;IACR,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CnB,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Cd,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;IACxC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qCAAqC,EAAE;IAC1E,KAAK,CAAC,GAAG;QACR,OAAO,EAAE,CAAC;IACX,CAAC;CACD,CAAC,CAAC;AAEH,MAAM,UAAU,OAAO;IACtB,SAAS,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;IAC1E,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;IACxE,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO;IACR,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC"}

package/dist-node/cli/commands/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/setup.ts"],"names":[],"mappings":"AAuCA,eAAO,MAAM,YAAY,qDAKvB,CAAC;AAEH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAoCpD"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/setup.ts"],"names":[],"mappings":"AA6CA,eAAO,MAAM,YAAY,qDAKvB,CAAC;AAEH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAoCpD"}

package/dist-node/cli/commands/setup.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 import { defineCommand } from "citty";
 import { consola } from "consola";
-import { AGENT_MODEL_OPTIONS, DEFAULT_AGENT_MODEL } from "../../shared/constants.js";
+import { CODEX_AGENT_MODEL_OPTIONS, DEFAULT_AGENT_AUTH_METHOD, DEFAULT_CODEX_AGENT_MODEL, DEFAULT_OPENAI_API_AGENT_MODEL, OPENAI_API_AGENT_MODEL_OPTIONS, } from "../../shared/constants.js";
 import { restoreGitHubAppCache, saveGitHubAppCache } from "../github-app-cache.js";
 import { runGitHubAppFlow } from "../github-app-flow.js";
 import { resolveEnvFileForWrite } from "../paths.js";
@@ -323,6 +323,47 @@ function sleep(ms) {
 function hasGitHubAppConfig(config) {
     return Boolean(config.githubAppId && config.githubAppPrivateKey && config.githubInstallationId);
 }
+function hasLinearConfig(config) {
+    return Boolean(config.linearApiKey && config.linearTeamId);
+}
+function hasLinearWorkflowConfig(config) {
+    return Boolean(config.linearReadyStatus &&
+        config.linearInProgressStatus &&
+        config.linearNeedsInfoStatus &&
+        config.linearBlockedStatus &&
+        config.linearBugLabel);
+}
+function hasAutomationConfig(config) {
+    const authMethod = config.agentAuthMethod ?? DEFAULT_AGENT_AUTH_METHOD;
+    const hasModelKey = authMethod === "codex-account"
+        ? Boolean(config.codexOauthCredentials)
+        : !config.agentModel?.startsWith("openai/") || Boolean(config.openaiApiKey);
+    return Boolean(config.readyLabel &&
+        config.bugLabel &&
+        config.automationMode &&
+        config.agentAuthMethod &&
+        config.agentModel &&
+        hasModelKey);
+}
+function hasProductionContextConfig(config) {
+    return Boolean(config.contextProfile &&
+        (config.contextProfile === "minimal" ||
+            config.databaseUrl ||
+            (config.vercelToken && config.vercelProjectId)));
+}
+function hasTelegramConfig(config) {
+    return Boolean(config.telegramBotToken && config.telegramChatId);
+}
+function maskSecret(value) {
+    if (!value)
+        return "not configured";
+    if (value.length <= 8)
+        return "configured";
+    return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function encodeBase64Json(value) {
+    return Buffer.from(JSON.stringify(value), "utf-8").toString("base64");
+}
 function detectInstalledAegisApps(monitoredRepo) {
     if (!monitoredRepo)
         return [];
@@ -371,6 +412,22 @@ function slugify(value) {
         .replace(/^-|-$/g, "");
 }
 async function setupLinear(config) {
+    let forceTeamSelection = false;
+    let forceWorkflowSelection = false;
+    if (hasLinearConfig(config)) {
+        printStep("Step 4: Linear already connected", [
+            `Using saved API key ${maskSecret(config.linearApiKey)}.`,
+            `Watching team ${config.linearTeamId}.`,
+            config.linearProjectId
+                ? `Limited to project ${config.linearProjectId}.`
+                : "Watching the whole Linear team.",
+        ]);
+        const reconfigure = await promptConfirm("Reconfigure Linear?", false);
+        if (!reconfigure)
+            return;
+        forceTeamSelection = true;
+        forceWorkflowSelection = true;
+    }
     printStep("Step 4: optional Linear connection", [
         "Use this only if your team tracks bugs in Linear.",
         "If you only use GitHub Issues, choose no.",
@@ -379,33 +436,52 @@ async function setupLinear(config) {
     const enable = await promptConfirm("Connect Linear too?", Boolean(config.linearApiKey));
     if (!enable)
         return;
-    printStep("Linear API key", [
-        "Open Linear settings, create a personal API key, then paste it here.",
-        "Aegis uses it to read ready bug tickets and comment with status updates.",
-    ]);
-    config.linearApiKey = await promptText("Linear API key:", config.linearApiKey);
-    await setupLinearTeam(config);
-    printStep("Linear webhook secret", [
-        "This protects Linear webhook calls after deploy.",
-        "Choose yes and Aegis will generate one.",
-    ]);
-    const generateSecret = await promptConfirm("Generate a Linear webhook signing secret?", !config.linearWebhookSecret);
-    config.linearWebhookSecret = generateSecret
-        ? crypto.randomUUID()
-        : await promptText("Linear webhook signing secret:", config.linearWebhookSecret);
-    printStep("Linear statuses and labels", [
-        "These names must match your Linear workflow.",
-        "If your team uses the default names, press Enter through these prompts.",
-    ]);
-    config.linearReadyStatus = await promptText("Linear ready status name:", config.linearReadyStatus ?? "Ready to Implement");
-    config.linearInProgressStatus = await promptText("Linear in-progress status name:", config.linearInProgressStatus ?? "In Progress");
-    config.linearNeedsInfoStatus = await promptText("Linear needs-info status name:", config.linearNeedsInfoStatus ?? "Needs Info");
-    config.linearBlockedStatus = await promptText("Linear blocked status name:", config.linearBlockedStatus ?? "Blocked");
-    config.linearBugLabel = await promptText("Linear bug label:", config.linearBugLabel ?? "bug");
+    if (config.linearApiKey) {
+        consola.info(`Using saved Linear API key ${maskSecret(config.linearApiKey)}.`);
+    }
+    else {
+        printStep("Linear API key", [
+            "Open Linear settings, create a personal API key, then paste it here.",
+            "Aegis uses it to read ready bug tickets and comment with status updates.",
+        ]);
+        config.linearApiKey = await promptText("Linear API key:", config.linearApiKey);
+    }
+    await setupLinearTeam(config, forceTeamSelection);
+    if (config.linearWebhookSecret) {
+        consola.info("Linear webhook secret is already configured.");
+    }
+    else {
+        printStep("Linear webhook secret", [
+            "This protects Linear webhook calls after deploy.",
+            "Choose yes and Aegis will generate one.",
+        ]);
+        const generateSecret = await promptConfirm("Generate a Linear webhook signing secret?", true);
+        config.linearWebhookSecret = generateSecret
+            ? crypto.randomUUID()
+            : await promptText("Linear webhook signing secret:", config.linearWebhookSecret);
+    }
+    if (hasLinearWorkflowConfig(config) && !forceWorkflowSelection) {
+        consola.info("Linear statuses and bug label are already configured.");
+    }
+    else {
+        printStep("Linear statuses and labels", [
+            "These names must match your Linear workflow.",
+            "If your team uses the default names, press Enter through these prompts.",
+        ]);
+        config.linearReadyStatus = await promptText("Linear ready status name:", config.linearReadyStatus ?? "Ready to Implement");
+        config.linearInProgressStatus = await promptText("Linear in-progress status name:", config.linearInProgressStatus ?? "In Progress");
+        config.linearNeedsInfoStatus = await promptText("Linear needs-info status name:", config.linearNeedsInfoStatus ?? "Needs Info");
+        config.linearBlockedStatus = await promptText("Linear blocked status name:", config.linearBlockedStatus ?? "Blocked");
+        config.linearBugLabel = await promptText("Linear bug label:", config.linearBugLabel ?? "bug");
+    }
 }
-async function setupLinearTeam(config) {
+async function setupLinearTeam(config, forceSelection = false) {
     if (!config.linearApiKey)
         return;
+    if (config.linearTeamId && !forceSelection) {
+        consola.info(`Using saved Linear team ${config.linearTeamId}.`);
+        return;
+    }
     printStep("Linear team/project", [
         "Aegis will fetch your Linear teams so you can pick one by name.",
         "Project ID is optional. Leave it blank to watch the whole team.",
@@ -464,6 +540,22 @@ function formatLinearTeam(team) {
     return `${team.name} (${team.key})`;
 }
 async function setupAutomation(config) {
+    if (hasAutomationConfig(config)) {
+        printStep("Steps 5-7: automation already configured", [
+            `GitHub labels: ${config.bugLabel}, ${config.readyLabel}.`,
+            `Mode: ${config.automationMode}.`,
+            `Auth: ${formatAgentAuthMethod(config.agentAuthMethod)}.`,
+            `Model: ${config.agentModel}.`,
+            config.agentAuthMethod === "codex-account"
+                ? "Codex account: connected."
+                : config.openaiApiKey
+                    ? `OpenAI key: ${maskSecret(config.openaiApiKey)}.`
+                    : "OpenAI key: not configured.",
+        ]);
+        const reconfigure = await promptConfirm("Reconfigure labels, mode, or model?", false);
+        if (!reconfigure)
+            return;
+    }
     printStep("Step 5: GitHub labels Aegis should watch", [
         "Aegis only picks up open issues with both labels.",
         "Default labels are bug and ready to implement.",
@@ -480,24 +572,93 @@ async function setupAutomation(config) {
         { label: "Plan first, ask approval before patching", value: "plan-first" },
         { label: "Auto-implement only bugs labeled low-risk", value: "auto-low-risk" },
     ], config.automationMode ?? "plan-first");
-    printStep("Step 7: AI model", [
-        "Use GPT-5.5 unless you know you want another OpenAI/Codex model.",
-        "Flue model names look like provider/model-id, for example openai/gpt-5.5.",
+    await setupAgentAuth(config);
+    printStep("Step 7b: AI model", [
+        "Choose after auth, because Codex account models use openai-codex/... and API-key models use openai/...",
+        "Use GPT-5.5 unless you know you want a cheaper or faster model.",
         "Custom models need provider access and their provider key configured manually.",
     ]);
-    config.agentModel = await promptAgentModel(config.agentModel);
+    config.agentModel = await promptAgentModel(config.agentModel, config.agentAuthMethod);
+}
+async function setupAgentAuth(config) {
+    printStep("Step 7: coding model account", [
+        "Choose Codex account if you want to use your ChatGPT/Codex subscription, like Sandcastle.",
+        "Choose OpenAI API key if you want normal platform API billing.",
+        "Aegis asks this before model selection because each auth method has a different model prefix.",
+    ]);
+    config.agentAuthMethod = await promptSelect("Model authentication:", [
+        { label: "Codex account / ChatGPT login (recommended)", value: "codex-account" },
+        { label: "OpenAI API key", value: "openai-api-key" },
+    ], config.agentAuthMethod ?? DEFAULT_AGENT_AUTH_METHOD);
+    if (config.agentAuthMethod === "codex-account") {
+        await setupCodexAccountAuth(config);
+        return;
+    }
+    await setupOpenAiApiKeyAuth(config);
+}
+async function setupCodexAccountAuth(config) {
+    config.openaiApiKey = undefined;
+    if (config.codexOauthCredentials) {
+        consola.info("Using saved Codex account credentials.");
+        if (!config.agentModel?.startsWith("openai-codex/")) {
+            config.agentModel = DEFAULT_CODEX_AGENT_MODEL;
+        }
+        return;
+    }
+    printStep("Connect Codex account", [
+        "A browser window will open for OpenAI/Codex login.",
+        "Aegis saves OAuth credentials to .aegis/.env and deploys them as a Cloudflare secret.",
+        "Only use this on a Worker you control. To disconnect later, run aegis disconnect and revoke Codex access in OpenAI settings.",
+    ]);
+    const { loginOpenAICodex } = await import("@mariozechner/pi-ai/oauth");
+    const credentials = await loginOpenAICodex({
+        onAuth: ({ url, instructions }) => {
+            consola.info(instructions ?? "Complete OpenAI login in your browser.");
+            consola.info(`Open: ${url}`);
+            openBrowser(url);
+        },
+        onPrompt: async (prompt) => await promptText(prompt.message, prompt.placeholder),
+        onProgress: (message) => consola.info(message),
+        onManualCodeInput: async () => await promptText("Paste OpenAI auth code or final redirect URL if the browser did not finish:", undefined),
+        originator: "aegis",
+    });
+    config.codexOauthCredentials = encodeBase64Json(credentials);
+    if (!config.agentModel?.startsWith("openai-codex/")) {
+        config.agentModel = DEFAULT_CODEX_AGENT_MODEL;
+    }
+    consola.success("Codex account connected.");
+}
+async function setupOpenAiApiKeyAuth(config) {
+    config.codexOauthCredentials = undefined;
+    if (!config.agentModel?.startsWith("openai/")) {
+        config.agentModel = DEFAULT_OPENAI_API_AGENT_MODEL;
+    }
     printStep("OpenAI API key", [
-        "Paste your OpenAI API key if using an openai/... model.",
+        "Paste your OpenAI API key.",
         "It is stored in .aegis/.env and later copied to Cloudflare secrets during deploy.",
-        "Leave blank only if you configured a different model provider yourself.",
+        "Use Codex account instead if you do not want to manage an API key.",
     ]);
-    config.openaiApiKey = await promptText("OpenAI API key:", config.openaiApiKey);
+    if (config.openaiApiKey) {
+        consola.info(`Using saved OpenAI API key ${maskSecret(config.openaiApiKey)}.`);
+    }
+    else {
+        config.openaiApiKey = await promptText("OpenAI API key:", config.openaiApiKey);
+    }
 }
-async function promptAgentModel(current) {
-    const selectedModel = current ?? DEFAULT_AGENT_MODEL;
-    const knownValues = AGENT_MODEL_OPTIONS.map((option) => option.value);
+function formatAgentAuthMethod(method) {
+    if (method === "codex-account")
+        return "Codex account";
+    if (method === "openai-api-key")
+        return "OpenAI API key";
+    return "not configured";
+}
+async function promptAgentModel(current, authMethod) {
+    const options = authMethod === "openai-api-key" ? OPENAI_API_AGENT_MODEL_OPTIONS : CODEX_AGENT_MODEL_OPTIONS;
+    const defaultModel = authMethod === "openai-api-key" ? DEFAULT_OPENAI_API_AGENT_MODEL : DEFAULT_CODEX_AGENT_MODEL;
+    const selectedModel = current ?? defaultModel;
+    const knownValues = options.map((option) => option.value);
     const customValue = "__custom__";
-    const selected = await promptSelect("Flue model:", [...AGENT_MODEL_OPTIONS, { label: "Custom Flue provider/model string", value: customValue }], (knownValues.includes(selectedModel)
+    const selected = await promptSelect("Flue model:", [...options, { label: "Custom Flue provider/model string", value: customValue }], (knownValues.includes(selectedModel)
         ? selectedModel
         : customValue));
     if (selected !== customValue)
@@ -505,6 +666,23 @@ async function promptAgentModel(current) {
     return await promptText("Custom Flue model:", selectedModel);
 }
 async function setupProductionContext(config) {
+    if (hasProductionContextConfig(config)) {
+        printStep("Step 8: production context already configured", [
+            `Context profile: ${config.contextProfile}.`,
+            config.databaseUrl
+                ? "Read-only database URL: configured."
+                : "Read-only database URL: not set.",
+            config.vercelToken
+                ? `Vercel token: ${maskSecret(config.vercelToken)}.`
+                : "Vercel token: not set.",
+            config.vercelProjectId
+                ? `Vercel project: ${config.vercelProjectId}.`
+                : "Vercel project: not set.",
+        ]);
+        const reconfigure = await promptConfirm("Reconfigure production context?", false);
+        if (!reconfigure)
+            return;
+    }
     printStep("Step 8: production context", [
         "Start with Minimal. It uses only issue text and repo code.",
         "Production context lets Aegis inspect read-only database data and Vercel logs.",
@@ -527,6 +705,18 @@ async function setupProductionContext(config) {
     config.vercelTeamId = await promptText("Vercel team ID (optional):", config.vercelTeamId);
 }
 async function setupTelegram(config) {
+    if (hasTelegramConfig(config)) {
+        printStep("Step 9: Telegram already connected", [
+            `Bot token: ${maskSecret(config.telegramBotToken)}.`,
+            `Chat ID: ${config.telegramChatId}.`,
+            config.telegramWebhookSecret
+                ? "Telegram webhook secret: configured."
+                : "Telegram webhook secret: not configured.",
+        ]);
+        const reconfigure = await promptConfirm("Reconfigure Telegram?", false);
+        if (!reconfigure)
+            return;
+    }
     printStep("Step 9: optional Telegram approval pings", [
         "Use this if you want Aegis to message you when it needs approval.",
         "For the first local dry-run, choose no.",
@@ -539,18 +729,42 @@ async function setupTelegram(config) {
         "Create a bot with BotFather, paste the bot token, then paste your chat ID.",
         "Aegis will send short approval summaries to that chat.",
     ]);
-    config.telegramBotToken = await promptText("Telegram bot token:", config.telegramBotToken);
-    config.telegramChatId = await promptText("Telegram chat ID:", config.telegramChatId);
-    printStep("Telegram webhook secret", [
-        "This protects Telegram webhook calls after deploy.",
-        "Choose yes and Aegis will generate one.",
-    ]);
-    const generateSecret = await promptConfirm("Generate a Telegram webhook secret?", !config.telegramWebhookSecret);
-    config.telegramWebhookSecret = generateSecret
-        ? crypto.randomUUID()
-        : await promptText("Telegram webhook secret:", config.telegramWebhookSecret);
+    if (config.telegramBotToken) {
+        consola.info(`Using saved Telegram bot token ${maskSecret(config.telegramBotToken)}.`);
+    }
+    else {
+        config.telegramBotToken = await promptText("Telegram bot token:", config.telegramBotToken);
+    }
+    if (config.telegramChatId) {
+        consola.info(`Using saved Telegram chat ID ${config.telegramChatId}.`);
+    }
+    else {
+        config.telegramChatId = await promptText("Telegram chat ID:", config.telegramChatId);
+    }
+    if (config.telegramWebhookSecret) {
+        consola.info("Telegram webhook secret is already configured.");
+    }
+    else {
+        printStep("Telegram webhook secret", [
+            "This protects Telegram webhook calls after deploy.",
+            "Choose yes and Aegis will generate one.",
+        ]);
+        const generateSecret = await promptConfirm("Generate a Telegram webhook secret?", true);
+        config.telegramWebhookSecret = generateSecret
+            ? crypto.randomUUID()
+            : await promptText("Telegram webhook secret:", config.telegramWebhookSecret);
+    }
 }
 async function setupWorker(config) {
+    if (config.workerUrl) {
+        printStep("Step 10: Worker URL already saved", [
+            `Using ${config.workerUrl}.`,
+            "Deploy updates this automatically when possible.",
+        ]);
+        const reconfigure = await promptConfirm("Reconfigure Worker URL?", false);
+        if (!reconfigure)
+            return;
+    }
     printStep("Step 10: Worker URL", [
         "Leave this blank before your first deploy.",
         "After deploy, Aegis saves the Worker URL automatically.",