@nairon-ai/aegis 0.4.9 → 0.5.0

package/src/cli/commands/init.ts

@@ -7,8 +7,11 @@ import { PROJECT_AEGIS_DIR } from "../paths.js";
 const ENV_EXAMPLE = `# Required
 MONITORED_REPO=KeyLead-Team/keylead
 BASE_BRANCH=main
-AGENT_MODEL=openai/gpt-5.5
-OPENAI_API_KEY=sk-...
+AGENT_AUTH_METHOD=codex-account
+AGENT_MODEL=openai-codex/gpt-5.5
+CODEX_OAUTH_CREDENTIALS_B64=
+# Or use AGENT_AUTH_METHOD=openai-api-key with OPENAI_API_KEY=sk-...
+OPENAI_API_KEY=
 
 # Labels / automation
 READY_LABEL=ready to implement

package/src/cli/commands/setup.ts

@@ -3,7 +3,13 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 import { defineCommand } from "citty";
 import { consola } from "consola";
-import { AGENT_MODEL_OPTIONS, DEFAULT_AGENT_MODEL } from "../../shared/constants.js";
+import {
+	CODEX_AGENT_MODEL_OPTIONS,
+	DEFAULT_AGENT_AUTH_METHOD,
+	DEFAULT_CODEX_AGENT_MODEL,
+	DEFAULT_OPENAI_API_AGENT_MODEL,
+	OPENAI_API_AGENT_MODEL_OPTIONS,
+} from "../../shared/constants.js";
 import type { AegisCliConfig } from "../../shared/types.js";
 import { restoreGitHubAppCache, saveGitHubAppCache } from "../github-app-cache.js";
 import { runGitHubAppFlow } from "../github-app-flow.js";
@@ -376,6 +382,59 @@ function hasGitHubAppConfig(config: AegisCliConfig): boolean {
 	return Boolean(config.githubAppId && config.githubAppPrivateKey && config.githubInstallationId);
 }
 
+function hasLinearConfig(config: AegisCliConfig): boolean {
+	return Boolean(config.linearApiKey && config.linearTeamId);
+}
+
+function hasLinearWorkflowConfig(config: AegisCliConfig): boolean {
+	return Boolean(
+		config.linearReadyStatus &&
+			config.linearInProgressStatus &&
+			config.linearNeedsInfoStatus &&
+			config.linearBlockedStatus &&
+			config.linearBugLabel,
+	);
+}
+
+function hasAutomationConfig(config: AegisCliConfig): boolean {
+	const authMethod = config.agentAuthMethod ?? DEFAULT_AGENT_AUTH_METHOD;
+	const hasModelKey =
+		authMethod === "codex-account"
+			? Boolean(config.codexOauthCredentials)
+			: !config.agentModel?.startsWith("openai/") || Boolean(config.openaiApiKey);
+	return Boolean(
+		config.readyLabel &&
+			config.bugLabel &&
+			config.automationMode &&
+			config.agentAuthMethod &&
+			config.agentModel &&
+			hasModelKey,
+	);
+}
+
+function hasProductionContextConfig(config: AegisCliConfig): boolean {
+	return Boolean(
+		config.contextProfile &&
+			(config.contextProfile === "minimal" ||
+				config.databaseUrl ||
+				(config.vercelToken && config.vercelProjectId)),
+	);
+}
+
+function hasTelegramConfig(config: AegisCliConfig): boolean {
+	return Boolean(config.telegramBotToken && config.telegramChatId);
+}
+
+function maskSecret(value: string | undefined): string {
+	if (!value) return "not configured";
+	if (value.length <= 8) return "configured";
+	return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+
+function encodeBase64Json(value: unknown): string {
+	return Buffer.from(JSON.stringify(value), "utf-8").toString("base64");
+}
+
 function detectInstalledAegisApps(monitoredRepo: string | undefined): InstalledGitHubApp[] {
 	if (!monitoredRepo) return [];
 	const [owner, repo] = monitoredRepo.split("/");
@@ -437,6 +496,22 @@ function slugify(value: string): string {
 }
 
 async function setupLinear(config: AegisCliConfig): Promise<void> {
+	let forceTeamSelection = false;
+	let forceWorkflowSelection = false;
+	if (hasLinearConfig(config)) {
+		printStep("Step 4: Linear already connected", [
+			`Using saved API key ${maskSecret(config.linearApiKey)}.`,
+			`Watching team ${config.linearTeamId}.`,
+			config.linearProjectId
+				? `Limited to project ${config.linearProjectId}.`
+				: "Watching the whole Linear team.",
+		]);
+		const reconfigure = await promptConfirm("Reconfigure Linear?", false);
+		if (!reconfigure) return;
+		forceTeamSelection = true;
+		forceWorkflowSelection = true;
+	}
+
 	printStep("Step 4: optional Linear connection", [
 		"Use this only if your team tracks bugs in Linear.",
 		"If you only use GitHub Issues, choose no.",
@@ -445,50 +520,65 @@ async function setupLinear(config: AegisCliConfig): Promise<void> {
 	const enable = await promptConfirm("Connect Linear too?", Boolean(config.linearApiKey));
 	if (!enable) return;
 
-	printStep("Linear API key", [
-		"Open Linear settings, create a personal API key, then paste it here.",
-		"Aegis uses it to read ready bug tickets and comment with status updates.",
-	]);
-	config.linearApiKey = await promptText("Linear API key:", config.linearApiKey);
-	await setupLinearTeam(config);
+	if (config.linearApiKey) {
+		consola.info(`Using saved Linear API key ${maskSecret(config.linearApiKey)}.`);
+	} else {
+		printStep("Linear API key", [
+			"Open Linear settings, create a personal API key, then paste it here.",
+			"Aegis uses it to read ready bug tickets and comment with status updates.",
+		]);
+		config.linearApiKey = await promptText("Linear API key:", config.linearApiKey);
+	}
+	await setupLinearTeam(config, forceTeamSelection);
 
-	printStep("Linear webhook secret", [
-		"This protects Linear webhook calls after deploy.",
-		"Choose yes and Aegis will generate one.",
-	]);
-	const generateSecret = await promptConfirm(
-		"Generate a Linear webhook signing secret?",
-		!config.linearWebhookSecret,
-	);
-	config.linearWebhookSecret = generateSecret
-		? crypto.randomUUID()
-		: await promptText("Linear webhook signing secret:", config.linearWebhookSecret);
-	printStep("Linear statuses and labels", [
-		"These names must match your Linear workflow.",
-		"If your team uses the default names, press Enter through these prompts.",
-	]);
-	config.linearReadyStatus = await promptText(
-		"Linear ready status name:",
-		config.linearReadyStatus ?? "Ready to Implement",
-	);
-	config.linearInProgressStatus = await promptText(
-		"Linear in-progress status name:",
-		config.linearInProgressStatus ?? "In Progress",
-	);
-	config.linearNeedsInfoStatus = await promptText(
-		"Linear needs-info status name:",
-		config.linearNeedsInfoStatus ?? "Needs Info",
-	);
-	config.linearBlockedStatus = await promptText(
-		"Linear blocked status name:",
-		config.linearBlockedStatus ?? "Blocked",
-	);
-	config.linearBugLabel = await promptText("Linear bug label:", config.linearBugLabel ?? "bug");
+	if (config.linearWebhookSecret) {
+		consola.info("Linear webhook secret is already configured.");
+	} else {
+		printStep("Linear webhook secret", [
+			"This protects Linear webhook calls after deploy.",
+			"Choose yes and Aegis will generate one.",
+		]);
+		const generateSecret = await promptConfirm("Generate a Linear webhook signing secret?", true);
+		config.linearWebhookSecret = generateSecret
+			? crypto.randomUUID()
+			: await promptText("Linear webhook signing secret:", config.linearWebhookSecret);
+	}
+
+	if (hasLinearWorkflowConfig(config) && !forceWorkflowSelection) {
+		consola.info("Linear statuses and bug label are already configured.");
+	} else {
+		printStep("Linear statuses and labels", [
+			"These names must match your Linear workflow.",
+			"If your team uses the default names, press Enter through these prompts.",
+		]);
+		config.linearReadyStatus = await promptText(
+			"Linear ready status name:",
+			config.linearReadyStatus ?? "Ready to Implement",
+		);
+		config.linearInProgressStatus = await promptText(
+			"Linear in-progress status name:",
+			config.linearInProgressStatus ?? "In Progress",
+		);
+		config.linearNeedsInfoStatus = await promptText(
+			"Linear needs-info status name:",
+			config.linearNeedsInfoStatus ?? "Needs Info",
+		);
+		config.linearBlockedStatus = await promptText(
+			"Linear blocked status name:",
+			config.linearBlockedStatus ?? "Blocked",
+		);
+		config.linearBugLabel = await promptText("Linear bug label:", config.linearBugLabel ?? "bug");
+	}
 }
 
-async function setupLinearTeam(config: AegisCliConfig): Promise<void> {
+async function setupLinearTeam(config: AegisCliConfig, forceSelection = false): Promise<void> {
 	if (!config.linearApiKey) return;
 
+	if (config.linearTeamId && !forceSelection) {
+		consola.info(`Using saved Linear team ${config.linearTeamId}.`);
+		return;
+	}
+
 	printStep("Linear team/project", [
 		"Aegis will fetch your Linear teams so you can pick one by name.",
 		"Project ID is optional. Leave it blank to watch the whole team.",
@@ -565,6 +655,22 @@ function formatLinearTeam(team: LinearTeam): string {
 }
 
 async function setupAutomation(config: AegisCliConfig): Promise<void> {
+	if (hasAutomationConfig(config)) {
+		printStep("Steps 5-7: automation already configured", [
+			`GitHub labels: ${config.bugLabel}, ${config.readyLabel}.`,
+			`Mode: ${config.automationMode}.`,
+			`Auth: ${formatAgentAuthMethod(config.agentAuthMethod)}.`,
+			`Model: ${config.agentModel}.`,
+			config.agentAuthMethod === "codex-account"
+				? "Codex account: connected."
+				: config.openaiApiKey
+					? `OpenAI key: ${maskSecret(config.openaiApiKey)}.`
+					: "OpenAI key: not configured.",
+		]);
+		const reconfigure = await promptConfirm("Reconfigure labels, mode, or model?", false);
+		if (!reconfigure) return;
+	}
+
 	printStep("Step 5: GitHub labels Aegis should watch", [
 		"Aegis only picks up open issues with both labels.",
 		"Default labels are bug and ready to implement.",
@@ -588,36 +694,139 @@ async function setupAutomation(config: AegisCliConfig): Promise<void> {
 		],
 		config.automationMode ?? "plan-first",
 	);
-	printStep("Step 7: AI model", [
-		"Use GPT-5.5 unless you know you want another OpenAI/Codex model.",
-		"Flue model names look like provider/model-id, for example openai/gpt-5.5.",
+	await setupAgentAuth(config);
+	printStep("Step 7b: AI model", [
+		"Choose after auth, because Codex account models use openai-codex/... and API-key models use openai/...",
+		"Use GPT-5.5 unless you know you want a cheaper or faster model.",
 		"Custom models need provider access and their provider key configured manually.",
 	]);
-	config.agentModel = await promptAgentModel(config.agentModel);
+	config.agentModel = await promptAgentModel(config.agentModel, config.agentAuthMethod);
+}
+
+async function setupAgentAuth(config: AegisCliConfig): Promise<void> {
+	printStep("Step 7: coding model account", [
+		"Choose Codex account if you want to use your ChatGPT/Codex subscription, like Sandcastle.",
+		"Choose OpenAI API key if you want normal platform API billing.",
+		"Aegis asks this before model selection because each auth method has a different model prefix.",
+	]);
+	config.agentAuthMethod = await promptSelect<NonNullable<AegisCliConfig["agentAuthMethod"]>>(
+		"Model authentication:",
+		[
+			{ label: "Codex account / ChatGPT login (recommended)", value: "codex-account" },
+			{ label: "OpenAI API key", value: "openai-api-key" },
+		],
+		config.agentAuthMethod ?? DEFAULT_AGENT_AUTH_METHOD,
+	);
+
+	if (config.agentAuthMethod === "codex-account") {
+		await setupCodexAccountAuth(config);
+		return;
+	}
+
+	await setupOpenAiApiKeyAuth(config);
+}
+
+async function setupCodexAccountAuth(config: AegisCliConfig): Promise<void> {
+	config.openaiApiKey = undefined;
+	if (config.codexOauthCredentials) {
+		consola.info("Using saved Codex account credentials.");
+		if (!config.agentModel?.startsWith("openai-codex/")) {
+			config.agentModel = DEFAULT_CODEX_AGENT_MODEL;
+		}
+		return;
+	}
+
+	printStep("Connect Codex account", [
+		"A browser window will open for OpenAI/Codex login.",
+		"Aegis saves OAuth credentials to .aegis/.env and deploys them as a Cloudflare secret.",
+		"Only use this on a Worker you control. To disconnect later, run aegis disconnect and revoke Codex access in OpenAI settings.",
+	]);
+	const { loginOpenAICodex } = await import("@mariozechner/pi-ai/oauth");
+	const credentials = await loginOpenAICodex({
+		onAuth: ({ url, instructions }) => {
+			consola.info(instructions ?? "Complete OpenAI login in your browser.");
+			consola.info(`Open: ${url}`);
+			openBrowser(url);
+		},
+		onPrompt: async (prompt) => await promptText(prompt.message, prompt.placeholder),
+		onProgress: (message) => consola.info(message),
+		onManualCodeInput: async () =>
+			await promptText(
+				"Paste OpenAI auth code or final redirect URL if the browser did not finish:",
+				undefined,
+			),
+		originator: "aegis",
+	});
+	config.codexOauthCredentials = encodeBase64Json(credentials);
+	if (!config.agentModel?.startsWith("openai-codex/")) {
+		config.agentModel = DEFAULT_CODEX_AGENT_MODEL;
+	}
+	consola.success("Codex account connected.");
+}
+
+async function setupOpenAiApiKeyAuth(config: AegisCliConfig): Promise<void> {
+	config.codexOauthCredentials = undefined;
+	if (!config.agentModel?.startsWith("openai/")) {
+		config.agentModel = DEFAULT_OPENAI_API_AGENT_MODEL;
+	}
 	printStep("OpenAI API key", [
-		"Paste your OpenAI API key if using an openai/... model.",
+		"Paste your OpenAI API key.",
 		"It is stored in .aegis/.env and later copied to Cloudflare secrets during deploy.",
-		"Leave blank only if you configured a different model provider yourself.",
+		"Use Codex account instead if you do not want to manage an API key.",
 	]);
-	config.openaiApiKey = await promptText("OpenAI API key:", config.openaiApiKey);
+	if (config.openaiApiKey) {
+		consola.info(`Using saved OpenAI API key ${maskSecret(config.openaiApiKey)}.`);
+	} else {
+		config.openaiApiKey = await promptText("OpenAI API key:", config.openaiApiKey);
+	}
+}
+
+function formatAgentAuthMethod(method: AegisCliConfig["agentAuthMethod"]): string {
+	if (method === "codex-account") return "Codex account";
+	if (method === "openai-api-key") return "OpenAI API key";
+	return "not configured";
 }
 
-async function promptAgentModel(current: string | undefined): Promise<string> {
-	const selectedModel = current ?? DEFAULT_AGENT_MODEL;
-	const knownValues = AGENT_MODEL_OPTIONS.map((option) => option.value);
+async function promptAgentModel(
+	current: string | undefined,
+	authMethod: AegisCliConfig["agentAuthMethod"],
+): Promise<string> {
+	const options =
+		authMethod === "openai-api-key" ? OPENAI_API_AGENT_MODEL_OPTIONS : CODEX_AGENT_MODEL_OPTIONS;
+	const defaultModel =
+		authMethod === "openai-api-key" ? DEFAULT_OPENAI_API_AGENT_MODEL : DEFAULT_CODEX_AGENT_MODEL;
+	const selectedModel = current ?? defaultModel;
+	const knownValues = options.map((option) => option.value);
 	const customValue = "__custom__";
 	const selected = await promptSelect(
 		"Flue model:",
-		[...AGENT_MODEL_OPTIONS, { label: "Custom Flue provider/model string", value: customValue }],
+		[...options, { label: "Custom Flue provider/model string", value: customValue }],
 		(knownValues.includes(selectedModel as (typeof knownValues)[number])
 			? selectedModel
-			: customValue) as (typeof AGENT_MODEL_OPTIONS)[number]["value"] | typeof customValue,
+			: customValue) as (typeof options)[number]["value"] | typeof customValue,
 	);
 	if (selected !== customValue) return selected;
 	return await promptText("Custom Flue model:", selectedModel);
 }
 
 async function setupProductionContext(config: AegisCliConfig): Promise<void> {
+	if (hasProductionContextConfig(config)) {
+		printStep("Step 8: production context already configured", [
+			`Context profile: ${config.contextProfile}.`,
+			config.databaseUrl
+				? "Read-only database URL: configured."
+				: "Read-only database URL: not set.",
+			config.vercelToken
+				? `Vercel token: ${maskSecret(config.vercelToken)}.`
+				: "Vercel token: not set.",
+			config.vercelProjectId
+				? `Vercel project: ${config.vercelProjectId}.`
+				: "Vercel project: not set.",
+		]);
+		const reconfigure = await promptConfirm("Reconfigure production context?", false);
+		if (!reconfigure) return;
+	}
+
 	printStep("Step 8: production context", [
 		"Start with Minimal. It uses only issue text and repo code.",
 		"Production context lets Aegis inspect read-only database data and Vercel logs.",
@@ -648,6 +857,18 @@ async function setupProductionContext(config: AegisCliConfig): Promise<void> {
 }
 
 async function setupTelegram(config: AegisCliConfig): Promise<void> {
+	if (hasTelegramConfig(config)) {
+		printStep("Step 9: Telegram already connected", [
+			`Bot token: ${maskSecret(config.telegramBotToken)}.`,
+			`Chat ID: ${config.telegramChatId}.`,
+			config.telegramWebhookSecret
+				? "Telegram webhook secret: configured."
+				: "Telegram webhook secret: not configured.",
+		]);
+		const reconfigure = await promptConfirm("Reconfigure Telegram?", false);
+		if (!reconfigure) return;
+	}
+
 	printStep("Step 9: optional Telegram approval pings", [
 		"Use this if you want Aegis to message you when it needs approval.",
 		"For the first local dry-run, choose no.",
@@ -663,22 +884,40 @@ async function setupTelegram(config: AegisCliConfig): Promise<void> {
 		"Create a bot with BotFather, paste the bot token, then paste your chat ID.",
 		"Aegis will send short approval summaries to that chat.",
 	]);
-	config.telegramBotToken = await promptText("Telegram bot token:", config.telegramBotToken);
-	config.telegramChatId = await promptText("Telegram chat ID:", config.telegramChatId);
-	printStep("Telegram webhook secret", [
-		"This protects Telegram webhook calls after deploy.",
-		"Choose yes and Aegis will generate one.",
-	]);
-	const generateSecret = await promptConfirm(
-		"Generate a Telegram webhook secret?",
-		!config.telegramWebhookSecret,
-	);
-	config.telegramWebhookSecret = generateSecret
-		? crypto.randomUUID()
-		: await promptText("Telegram webhook secret:", config.telegramWebhookSecret);
+	if (config.telegramBotToken) {
+		consola.info(`Using saved Telegram bot token ${maskSecret(config.telegramBotToken)}.`);
+	} else {
+		config.telegramBotToken = await promptText("Telegram bot token:", config.telegramBotToken);
+	}
+	if (config.telegramChatId) {
+		consola.info(`Using saved Telegram chat ID ${config.telegramChatId}.`);
+	} else {
+		config.telegramChatId = await promptText("Telegram chat ID:", config.telegramChatId);
+	}
+	if (config.telegramWebhookSecret) {
+		consola.info("Telegram webhook secret is already configured.");
+	} else {
+		printStep("Telegram webhook secret", [
+			"This protects Telegram webhook calls after deploy.",
+			"Choose yes and Aegis will generate one.",
+		]);
+		const generateSecret = await promptConfirm("Generate a Telegram webhook secret?", true);
+		config.telegramWebhookSecret = generateSecret
+			? crypto.randomUUID()
+			: await promptText("Telegram webhook secret:", config.telegramWebhookSecret);
+	}
 }
 
 async function setupWorker(config: AegisCliConfig): Promise<void> {
+	if (config.workerUrl) {
+		printStep("Step 10: Worker URL already saved", [
+			`Using ${config.workerUrl}.`,
+			"Deploy updates this automatically when possible.",
+		]);
+		const reconfigure = await promptConfirm("Reconfigure Worker URL?", false);
+		if (!reconfigure) return;
+	}
+
 	printStep("Step 10: Worker URL", [
 		"Leave this blank before your first deploy.",
 		"After deploy, Aegis saves the Worker URL automatically.",

package/src/cli/state.ts

@@ -110,12 +110,18 @@ export function loadConfig(): AegisCliConfig {
 			case "VERCEL_TEAM_ID":
 				config.vercelTeamId = value;
 				break;
+			case "AGENT_AUTH_METHOD":
+				config.agentAuthMethod = value as AegisCliConfig["agentAuthMethod"];
+				break;
 			case "AGENT_MODEL":
 				config.agentModel = value;
 				break;
 			case "OPENAI_API_KEY":
 				config.openaiApiKey = value;
 				break;
+			case "CODEX_OAUTH_CREDENTIALS_B64":
+				config.codexOauthCredentials = value;
+				break;
 		}
 	}
 	return config;
@@ -159,8 +165,10 @@ export function saveConfig(config: AegisCliConfig): void {
 	add("VERCEL_TOKEN", config.vercelToken);
 	add("VERCEL_PROJECT_ID", config.vercelProjectId);
 	add("VERCEL_TEAM_ID", config.vercelTeamId);
+	add("AGENT_AUTH_METHOD", config.agentAuthMethod);
 	add("AGENT_MODEL", config.agentModel);
 	add("OPENAI_API_KEY", config.openaiApiKey);
+	add("CODEX_OAUTH_CREDENTIALS_B64", config.codexOauthCredentials);
 	mkdirSync(dirname(envFile), { recursive: true });
 	writeFileSync(envFile, `${lines.join("\n")}\n`);
 }

package/src/shared/config.ts

@@ -1,4 +1,5 @@
 import {
+	DEFAULT_AGENT_AUTH_METHOD,
 	DEFAULT_AGENT_MODEL,
 	DEFAULT_APPROVAL_REQUIRED_LABELS,
 	DEFAULT_APPROVAL_REQUIRED_PATHS,
@@ -64,6 +65,7 @@ export function configFromBindings(env: Bindings): AegisConfig {
 				DEFAULT_LOG_LOOKBACK_MINUTES,
 			),
 		},
+		agentAuthMethod: env.AGENT_AUTH_METHOD,
 		model: env.AGENT_MODEL,
 	});
 }
@@ -107,6 +109,7 @@ export function configFromCli(cli: AegisCliConfig): AegisConfig {
 			vercelTeamId: cli.vercelTeamId,
 			logLookbackMinutes: DEFAULT_LOG_LOOKBACK_MINUTES,
 		},
+		agentAuthMethod: cli.agentAuthMethod,
 		model: cli.agentModel,
 	});
 }
@@ -135,6 +138,7 @@ function normalizeConfig(input: Partial<AegisConfig> & { monitoredRepo: string }
 		linear: input.linear,
 		telegram: input.telegram,
 		production: input.production ?? { logLookbackMinutes: DEFAULT_LOG_LOOKBACK_MINUTES },
+		agentAuthMethod: input.agentAuthMethod ?? DEFAULT_AGENT_AUTH_METHOD,
 		model: input.model ?? DEFAULT_AGENT_MODEL,
 	};
 }

package/src/shared/constants.ts

@@ -5,8 +5,53 @@ export const DEFAULT_NEEDS_INFO_LABEL = "aegis:needs-info";
 export const DEFAULT_BLOCKED_LABEL = "aegis:blocked";
 export const DEFAULT_PR_OPENED_LABEL = "aegis:pr-opened";
 export const DEFAULT_BASE_BRANCH = "main";
-export const DEFAULT_AGENT_MODEL = "openai/gpt-5.5";
-export const AGENT_MODEL_OPTIONS = [
+export const DEFAULT_AGENT_AUTH_METHOD = "codex-account";
+export const DEFAULT_CODEX_AGENT_MODEL = "openai-codex/gpt-5.5";
+export const DEFAULT_OPENAI_API_AGENT_MODEL = "openai/gpt-5.5";
+export const DEFAULT_AGENT_MODEL = DEFAULT_CODEX_AGENT_MODEL;
+export const CODEX_AGENT_MODEL_OPTIONS = [
+	{
+		label: "Codex GPT-5.5 (recommended)",
+		value: "openai-codex/gpt-5.5",
+	},
+	{
+		label: "Codex GPT-5.4",
+		value: "openai-codex/gpt-5.4",
+	},
+	{
+		label: "Codex GPT-5.4 Mini",
+		value: "openai-codex/gpt-5.4-mini",
+	},
+	{
+		label: "Codex GPT-5.3 Codex",
+		value: "openai-codex/gpt-5.3-codex",
+	},
+	{
+		label: "Codex GPT-5.3 Codex Spark",
+		value: "openai-codex/gpt-5.3-codex-spark",
+	},
+	{
+		label: "Codex GPT-5.2 Codex",
+		value: "openai-codex/gpt-5.2-codex",
+	},
+	{
+		label: "Codex GPT-5.2",
+		value: "openai-codex/gpt-5.2",
+	},
+	{
+		label: "Codex GPT-5.1 Codex Max",
+		value: "openai-codex/gpt-5.1-codex-max",
+	},
+	{
+		label: "Codex GPT-5.1 Codex Mini",
+		value: "openai-codex/gpt-5.1-codex-mini",
+	},
+	{
+		label: "Codex GPT-5.1",
+		value: "openai-codex/gpt-5.1",
+	},
+] as const;
+export const OPENAI_API_AGENT_MODEL_OPTIONS = [
 	{
 		label: "OpenAI GPT-5.5 (recommended)",
 		value: "openai/gpt-5.5",

package/src/shared/types.ts

@@ -8,6 +8,8 @@ export type AutomationMode = "plan-first" | "auto-low-risk";
 
 export type ContextProfile = "minimal" | "production";
 
+export type AgentAuthMethod = "codex-account" | "openai-api-key";
+
 export type WorkItemStatus =
 	| "ready"
 	| "needs-info"
@@ -176,6 +178,7 @@ export type AegisConfig = {
 		vercelTeamId?: string;
 		logLookbackMinutes: number;
 	};
+	agentAuthMethod: AgentAuthMethod;
 	model: string;
 };
 
@@ -219,8 +222,10 @@ export type Bindings = {
 	VERCEL_PROJECT_ID?: string;
 	VERCEL_TEAM_ID?: string;
 	VERCEL_LOG_LOOKBACK_MINUTES?: string;
+	AGENT_AUTH_METHOD?: AgentAuthMethod;
 	AGENT_MODEL?: string;
 	OPENAI_API_KEY?: string;
+	CODEX_OAUTH_CREDENTIALS_B64?: string;
 };
 
 export type AegisCliConfig = {
@@ -252,6 +257,8 @@ export type AegisCliConfig = {
 	vercelToken?: string;
 	vercelProjectId?: string;
 	vercelTeamId?: string;
+	agentAuthMethod?: AgentAuthMethod;
 	agentModel?: string;
 	openaiApiKey?: string;
+	codexOauthCredentials?: string;
 };