@namzu/cli 13.0.0 → 14.0.0

package/dist/integrations/providers/registry.js

@@ -15,7 +15,25 @@ export const PROVIDER_REGISTRY = Object.freeze({
         envVars: ['ANTHROPIC_API_KEY', 'ANTHROPIC_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN'],
         defaultModel: 'claude-opus-5',
         requiresApiKey: true,
+        acceptsTypedCredential: true,
+        subscriptionLogin: 'browser',
         constructible: true,
+        driverPackage: '@namzu/anthropic',
+    },
+    codex: {
+        id: 'codex',
+        label: 'OpenAI (Codex subscription)',
+        // A Codex subscription token is never accepted through an environment
+        // variable here. It is a Responses credential with account routing, not
+        // an OpenAI API key; discovery reads its complete owned envelope instead.
+        envVars: [],
+        defaultBaseUrl: 'https://chatgpt.com/backend-api/codex',
+        defaultModel: 'gpt-5.6-sol',
+        requiresApiKey: true,
+        acceptsTypedCredential: false,
+        subscriptionLogin: 'device',
+        constructible: true,
+        driverPackage: '@namzu/openai',
     },
     openai: {
         id: 'openai',
@@ -23,7 +41,9 @@ export const PROVIDER_REGISTRY = Object.freeze({
         envVars: ['OPENAI_API_KEY'],
         defaultModel: 'gpt-4o',
         requiresApiKey: true,
+        acceptsTypedCredential: true,
         constructible: true,
+        driverPackage: '@namzu/openai',
     },
     deepseek: {
         id: 'deepseek',
@@ -35,7 +55,9 @@ export const PROVIDER_REGISTRY = Object.freeze({
         // were discontinued on 2026-07-24 and resolve to nothing.
         defaultModel: 'deepseek-v4-flash',
         requiresApiKey: true,
+        acceptsTypedCredential: true,
         constructible: true,
+        driverPackage: '@namzu/deepseek',
     },
     openrouter: {
         id: 'openrouter',
@@ -44,7 +66,9 @@ export const PROVIDER_REGISTRY = Object.freeze({
         defaultBaseUrl: 'https://openrouter.ai/api/v1',
         defaultModel: 'anthropic/claude-opus-5',
         requiresApiKey: true,
+        acceptsTypedCredential: true,
         constructible: true,
+        driverPackage: '@namzu/openrouter',
     },
     ollama: {
         id: 'ollama',
@@ -54,7 +78,9 @@ export const PROVIDER_REGISTRY = Object.freeze({
         probeUrl: 'http://localhost:11434/api/tags',
         defaultModel: 'llama3.2',
         requiresApiKey: false,
+        acceptsTypedCredential: false,
         constructible: true,
+        driverPackage: '@namzu/ollama',
     },
     lmstudio: {
         id: 'lmstudio',
@@ -64,6 +90,7 @@ export const PROVIDER_REGISTRY = Object.freeze({
         probeUrl: 'http://localhost:1234/v1/models',
         defaultModel: 'auto',
         requiresApiKey: false,
+        acceptsTypedCredential: false,
         constructible: false,
     },
     bedrock: {
@@ -81,6 +108,7 @@ export const PROVIDER_REGISTRY = Object.freeze({
         // means this build cannot construct the driver at all.
         defaultModel: 'anthropic.claude-opus-4-7-v1:0',
         requiresApiKey: true,
+        acceptsTypedCredential: true,
         constructible: false,
     },
     http: {
@@ -91,6 +119,7 @@ export const PROVIDER_REGISTRY = Object.freeze({
         envVars: [],
         defaultModel: 'gpt-4o',
         requiresApiKey: true,
+        acceptsTypedCredential: true,
         constructible: false,
     },
 });

package/dist/integrations/providers/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/integrations/providers/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoEH,MAAM,CAAC,MAAM,iBAAiB,GAAwD,MAAM,CAAC,MAAM,CAClG;IACC,SAAS,EAAE;QACV,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,oBAAoB;QAC3B,sDAAsD;QACtD,qEAAqE;QACrE,8BAA8B;QAC9B,OAAO,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,yBAAyB,CAAC;QAC5E,YAAY,EAAE,eAAe;QAC7B,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACnB;IACD,MAAM,EAAE;QACP,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACnB;IACD,QAAQ,EAAE;QACT,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,cAAc,EAAE,0BAA0B;QAC1C,mEAAmE;QACnE,kEAAkE;QAClE,0DAA0D;QAC1D,YAAY,EAAE,mBAAmB;QACjC,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACnB;IACD,UAAU,EAAE;QACX,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,cAAc,EAAE,8BAA8B;QAC9C,YAAY,EAAE,yBAAyB;QACvC,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACnB;IACD,MAAM,EAAE;QACP,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,wBAAwB;QACxC,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,UAAU;QACxB,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,IAAI;KACnB;IACD,QAAQ,EAAE;QACT,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,0BAA0B;QAC1C,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,MAAM;QACpB,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,KAAK;KACpB;IACD,OAAO,EAAE;QACR,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,wCAAwC;QACxE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,uDAAuD;QACvD,YAAY,EAAE,gCAAgC;QAC9C,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,KAAK;KACpB;IACD,IAAI,EAAE;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,iCAAiC;QACxC,oEAAoE;QACpE,kDAAkD;QAClD,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,KAAK;KACpB;CACD,CACD,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA0B,MAAM,CAAC,MAAM,CACnE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAiB,CAC9C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACpD,MAAM,KAAK,GAAI,iBAAuE,CAAC,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAC7F,IAAI,CACJ,CAAA;IACD,OAAO,GAAG,KAAK,MAAM,EAAE,iHAAiH,MAAM,kDAAkD,CAAA;AACjM,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA4B;IACpE,MAAM,MAAM,GACX,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;IAChG,OAAO,2BAA2B,KAAK,CAAC,KAAK,yBAAyB,MAAM,4DAA4D,CAAA;AACzI,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/integrations/providers/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6EH,MAAM,CAAC,MAAM,iBAAiB,GAAwD,MAAM,CAAC,MAAM,CAClG;IACC,SAAS,EAAE;QACV,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,oBAAoB;QAC3B,sDAAsD;QACtD,qEAAqE;QACrE,8BAA8B;QAC9B,OAAO,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,yBAAyB,CAAC;QAC5E,YAAY,EAAE,eAAe;QAC7B,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;QAC5B,iBAAiB,EAAE,SAAS;QAC5B,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,kBAAkB;KACjC;IACD,KAAK,EAAE;QACN,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,6BAA6B;QACpC,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,uCAAuC;QACvD,YAAY,EAAE,aAAa;QAC3B,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,KAAK;QAC7B,iBAAiB,EAAE,QAAQ;QAC3B,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,eAAe;KAC9B;IACD,MAAM,EAAE;QACP,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,eAAe;KAC9B;IACD,QAAQ,EAAE;QACT,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,cAAc,EAAE,0BAA0B;QAC1C,mEAAmE;QACnE,kEAAkE;QAClE,0DAA0D;QAC1D,YAAY,EAAE,mBAAmB;QACjC,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,iBAAiB;KAChC;IACD,UAAU,EAAE;QACX,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,cAAc,EAAE,8BAA8B;QAC9C,YAAY,EAAE,yBAAyB;QACvC,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,mBAAmB;KAClC;IACD,MAAM,EAAE;QACP,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,wBAAwB;QACxC,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,UAAU;QACxB,cAAc,EAAE,KAAK;QACrB,sBAAsB,EAAE,KAAK;QAC7B,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,eAAe;KAC9B;IACD,QAAQ,EAAE;QACT,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,0BAA0B;QAC1C,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,MAAM;QACpB,cAAc,EAAE,KAAK;QACrB,sBAAsB,EAAE,KAAK;QAC7B,aAAa,EAAE,KAAK;KACpB;IACD,OAAO,EAAE;QACR,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,wCAAwC;QACxE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,8DAA8D;QAC9D,oEAAoE;QACpE,uDAAuD;QACvD,YAAY,EAAE,gCAAgC;QAC9C,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,KAAK;KACpB;IACD,IAAI,EAAE;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,iCAAiC;QACxC,oEAAoE;QACpE,kDAAkD;QAClD,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,IAAI;QACpB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,KAAK;KACpB;CACD,CACD,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA0B,MAAM,CAAC,MAAM,CACnE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAiB,CAC9C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACpD,MAAM,KAAK,GAAI,iBAAuE,CAAC,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAC7F,IAAI,CACJ,CAAA;IACD,OAAO,GAAG,KAAK,MAAM,EAAE,iHAAiH,MAAM,kDAAkD,CAAA;AACjM,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA4B;IACpE,MAAM,MAAM,GACX,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;IAChG,OAAO,2BAA2B,KAAK,CAAC,KAAK,yBAAyB,MAAM,4DAA4D,CAAA;AACzI,CAAC"}

package/dist/tui/App.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../src/tui/App.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EASN,KAAK,OAAO,EASZ,MAAM,YAAY,CAAA;AAkGnB,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAQ/D,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB;AA2CD,sEAAsE;AACtE,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,MAAM,EAAE,MAAM,MAAM,EACpB,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACvC,SAAS,iBAAiB,EAAE,CA4D9B;AAgED,wBAAgB,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,QAAQ,2CA2uGhD"}
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../src/tui/App.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAMN,KAAK,OAAO,EAYZ,MAAM,YAAY,CAAA;AA+GnB,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAG/D,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB;AA2CD,sEAAsE;AACtE,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,MAAM,EAAE,MAAM,MAAM,EACpB,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACvC,SAAS,iBAAiB,EAAE,CA4D9B;AAgED,wBAAgB,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,QAAQ,2CA+vGhD"}

package/dist/tui/App.js

@@ -11,45 +11,45 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
  *   4. If discovery returned zero providers → show <Picker/> in
  *      empty-state mode (explains where to put credentials).
  */
-import { DiskMessageFeedbackStore, GoalRoundLimitError, HostCommandRegistry, SessionGoalActivation, StaleGoalError, kernelHostCommands, createAssistantMessage, createUserMessage, generateRunId, isCompactionMessage, } from '@namzu/sdk';
-import { Box, Text, useApp, useInput, useStdout } from 'ink';
 import { join, relative } from 'node:path';
+import { DiskMessageFeedbackStore, GoalRoundLimitError, HostCommandRegistry, SessionGoalActivation, StaleGoalError, createAssistantMessage, createUserMessage, generateRunId, isCompactionMessage, kernelHostCommands, } from '@namzu/sdk';
+import { Box, Text, useApp, useInput, useStdout } from 'ink';
 import { useCallback, useEffect, useRef, useState } from 'react';
-import { visibleProjectInstructionPath } from '../context/project-path.js';
 import { pinTrustedProjectPath, resolveTrustedProjectContext, } from '../config/trusted-project-context.js';
-import { beginSubscriptionLogin, clearStoredSubscriptionCredential, credentialsPath, primaryProvider, readStoredSubscriptionCredential, writePreferences, } from '../integrations/providers/index.js';
+import { visibleProjectInstructionPath } from '../context/project-path.js';
 import { writeClipboardText } from '../integrations/clipboard/text.js';
 import { terminalNotificationEnabled, writeTerminalNotification, } from '../integrations/notifications/terminal.js';
-import { describeLoginOutcome, describeLoginStart, describeLogout } from './login-prompt.js';
-import { openInBrowser } from './open-browser.js';
+import { beginCodexDeviceLogin, beginSubscriptionLogin, clearAllStoredCredentials, credentialsPath, primaryProvider, readStoredCodexCredential, readStoredSubscriptionCredential, writePreferences, } from '../integrations/providers/index.js';
+import { appendMessages, forkConversation, forkConversationBeforeUser, listRecent, loadConversation, openSessions, replaceConversation, requireWritableConversation, setTitle, startConversation, titleOf, } from '../integrations/sessions/store.js';
+import { conversationMarkdown, writeConversationExport, } from '../integrations/sessions/transcript-export.js';
 import { isTrusted, trustDir } from '../integrations/trust/store.js';
+import { checkUpdates } from '../integrations/updates.js';
 import { appendMemory, composeMemoryPrompt, readMemory } from '../memory/store.js';
 import { composeSkillsPrompt, discoverSkills, loadSkillBody } from '../skills/store.js';
-import { checkUpdates } from '../integrations/updates.js';
-import { LiveActivity, formatElapsed } from './LiveActivity.js';
-import { bottomSpacerRows } from './bottom-spacer.js';
-import { expandFileMentions } from './mentions.js';
+import { discoverUserCommands } from '../user-commands/store.js';
 import { Composer } from './Composer.js';
 import { EditPromptPicker } from './EditPromptPicker.js';
-import { TrustPrompt } from './TrustPrompt.js';
-import { NAMZU_MARK, NAMZU_MARK_COLOR, NAMZU_WORDMARK, NAMZU_WORDMARK_GRADIENT, NAMZU_WORDMARK_MIN_WIDTH, } from './logo.js';
+import { LiveActivity, formatElapsed } from './LiveActivity.js';
 import { PermissionOverlay } from './PermissionOverlay.js';
-import { approvalIsDeliberate } from './consent-timing.js';
 import { Picker } from './Picker.js';
+import { ResumePicker } from './ResumePicker.js';
 import { StatusBar } from './StatusBar.js';
 import { Transcript, willCollapse } from './Transcript.js';
-import { liveWindow, transcriptLines } from './live-window.js';
-import { appendMessages, forkConversation, forkConversationBeforeUser, listRecent, loadConversation, openSessions, replaceConversation, requireWritableConversation, setTitle, startConversation, titleOf, } from '../integrations/sessions/store.js';
-import { conversationMarkdown, writeConversationExport, } from '../integrations/sessions/transcript-export.js';
+import { TrustPrompt } from './TrustPrompt.js';
 import { createAgentSession, probeAgentSession, } from './agent.js';
-import { ResumePicker } from './ResumePicker.js';
-import { editablePrompts } from './edit-prompts.js';
+import { bottomSpacerRows } from './bottom-spacer.js';
+import { keepRecentRows } from './compact-transcript.js';
+import { approvalIsDeliberate } from './consent-timing.js';
 import { planTurnPublication } from './conversation-history.js';
-import { discoverUserCommands } from '../user-commands/store.js';
+import { editablePrompts } from './edit-prompts.js';
+import { liveWindow, transcriptLines } from './live-window.js';
+import { describeCodexDeviceLoginStart, describeLoginOutcome, describeLoginStart, describeLogout, } from './login-prompt.js';
+import { NAMZU_MARK, NAMZU_MARK_COLOR, NAMZU_WORDMARK, NAMZU_WORDMARK_GRADIENT, NAMZU_WORDMARK_MIN_WIDTH, } from './logo.js';
+import { expandFileMentions } from './mentions.js';
+import { openInBrowser } from './open-browser.js';
 import { hostCommandNames, kernelCommandDescriptors, mergeHostCommands, renderOutcome, reviewPrompt, runSlash, } from './slashCommands.js';
 import { splitCompleteBlocks } from './stream-blocks.js';
 import { theme } from './theme.js';
-import { keepRecentRows } from './compact-transcript.js';
 import { renderWorkspaceDiff, workspaceDiff } from './workspace-diff.js';
 /** Last non-empty assistant text in a durable conversation, newest first. */
 function latestAssistantOutput(messages) {
@@ -213,6 +213,8 @@ export function App({ ctx: initialCtx }) {
      * chosen yet would be answering a question that was not asked.
      */
     const [keyEntryFor, setKeyEntryFor] = useState(null);
+    /** Which decision owns the next picker mount. */
+    const [pickerInitialView, setPickerInitialView] = useState('providers');
     /** The chain read from disk, held while the picker repairs its credential. */
     const savedPrefsRef = useRef(null);
     /**
@@ -328,12 +330,15 @@ export function App({ ctx: initialCtx }) {
      * which the code that comes back cannot be exchanged for anything.
      */
     const loginRef = useRef(null);
+    const codexLoginRef = useRef(null);
     const loginAbortCleanupRef = useRef(null);
     const cancelPendingLogin = useCallback(() => {
         loginAbortCleanupRef.current?.();
         loginAbortCleanupRef.current = null;
         loginRef.current?.cancel();
         loginRef.current = null;
+        codexLoginRef.current?.cancel();
+        codexLoginRef.current = null;
     }, []);
     const runProbeRef = useRef(null);
     useEffect(() => cancelPendingLogin, [cancelPendingLogin]);
@@ -651,9 +656,9 @@ export function App({ ctx: initialCtx }) {
     /**
      * Sign in to a subscription without leaving namzu.
      *
-     * Two calls, one command. Bare `/login` starts an attempt and parks it in
-     * `loginRef`; `/login <address>` finishes that one. Nothing here parses the
-     * argument — `slashCommands` already decided which of the two this is.
+     * A bare `/login` no longer guesses a provider: it mounts the subscription
+     * picker first. The argument form remains the paste-completion half of the
+     * browser-callback attempt already in flight.
      *
      * ## Why it re-probes instead of installing the credential directly
      *
@@ -681,46 +686,17 @@ export function App({ ctx: initialCtx }) {
             loginAbortCleanupRef.current?.();
             loginAbortCleanupRef.current = null;
             pushMessage('system', describeLoginOutcome(outcome));
-            if (outcome.ok)
+            if (outcome.ok) {
+                setPickerInitialView('providers');
                 await runProbeRef.current?.();
+            }
             return;
         }
         cancelPendingLogin();
-        let start;
-        try {
-            start = await beginSubscriptionLogin();
-        }
-        catch (err) {
-            pushMessage('system', `Could not start a sign-in: ${err instanceof Error ? err.message : String(err)}`);
-            return;
-        }
-        loginRef.current = start;
-        pushMessage('system', describeLoginStart({
-            url: start.url,
-            loopback: start.loopback,
-            browserOpened: openInBrowser(start.url),
-        }));
-        // The automatic half, when there is one. Not awaited by the caller:
-        // the composer stays live throughout, so the operator can paste
-        // instead — or type anything else — while this waits.
-        const waiting = start.waitForCallback();
-        if (!waiting)
-            return;
-        const outcome = await waiting;
-        if (loginRef.current !== start)
-            return; // superseded, or finished by paste
-        loginRef.current = null;
-        loginAbortCleanupRef.current?.();
-        loginAbortCleanupRef.current = null;
-        start.cancel();
-        // A cancelled listener resolves to a refusal, and saying "sign-in
-        // failed" when the operator finished it another way would be a lie
-        // about their own successful login.
-        if (!outcome.ok && outcome.reason.includes('cancelled'))
-            return;
-        pushMessage('system', describeLoginOutcome(outcome));
-        if (outcome.ok)
-            await runProbeRef.current?.();
+        setPickerNotice(null);
+        setKeyEntryFor(null);
+        setPickerInitialView('subscriptions');
+        setPhase('picker');
     }, [cancelPendingLogin, pushMessage]);
     /**
      * Sign in from the PICKER, where the transcript does not exist.
@@ -737,10 +713,43 @@ export function App({ ctx: initialCtx }) {
      * no-browser case is handed to `namzu login`, which reads the pasted
      * address from standard input and exists for exactly that machine.
      */
-    const startLoginFromPicker = useCallback(async (signal) => {
+    const startLoginFromPicker = useCallback(async (provider, signal) => {
         if (signal.aborted)
             return;
         cancelPendingLogin();
+        if (provider === 'codex') {
+            let start;
+            try {
+                start = await beginCodexDeviceLogin({ signal });
+            }
+            catch (error) {
+                if (!signal.aborted) {
+                    setPickerNotice(`Could not start Codex sign-in: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                return;
+            }
+            if (signal.aborted) {
+                start.cancel();
+                return;
+            }
+            codexLoginRef.current = start;
+            setPickerNotice(describeCodexDeviceLoginStart({
+                url: start.url,
+                userCode: start.userCode,
+                browserOpened: openInBrowser(start.url),
+            }));
+            const outcome = await start.waitForCompletion();
+            if (codexLoginRef.current !== start || signal.aborted)
+                return;
+            codexLoginRef.current = null;
+            start.cancel();
+            setPickerNotice(describeLoginOutcome(outcome));
+            if (outcome.ok) {
+                setPickerInitialView('providers');
+                await runProbeRef.current?.(signal);
+            }
+            return;
+        }
         let start;
         try {
             start = await beginSubscriptionLogin({ signal });
@@ -793,8 +802,10 @@ export function App({ ctx: initialCtx }) {
         if (!outcome.ok && outcome.reason.includes('cancelled'))
             return;
         setPickerNotice(describeLoginOutcome(outcome));
-        if (outcome.ok)
+        if (outcome.ok) {
+            setPickerInitialView('providers');
             await runProbeRef.current?.(signal);
+        }
     }, [cancelPendingLogin]);
     const runProbe = useCallback(async (signal) => {
         try {
@@ -1948,6 +1959,7 @@ export function App({ ctx: initialCtx }) {
                     // been solved — the session behind this picker is running.
                     setPickerNotice(null);
                     setKeyEntryFor(null);
+                    setPickerInitialView('providers');
                     setPhase('picker');
                     return;
                 case 'permission-mode': {
@@ -2007,9 +2019,9 @@ export function App({ ctx: initialCtx }) {
                     return;
                 case 'logout': {
                     const path = credentialsPath();
-                    const had = readStoredSubscriptionCredential() !== null;
+                    const had = readStoredSubscriptionCredential() !== null || readStoredCodexCredential() !== null;
                     try {
-                        clearStoredSubscriptionCredential();
+                        clearAllStoredCredentials();
                     }
                     catch (err) {
                         pushMessage('system', `Could not remove ${path}: ${err instanceof Error ? err.message : String(err)}`);
@@ -2729,6 +2741,7 @@ export function App({ ctx: initialCtx }) {
      * what the empty picker's own footer has always claimed `esc` does.
      */
     const handlePickerCancel = useCallback(() => {
+        setPickerInitialView('providers');
         if (session?.hasProvider) {
             setPhase('ready');
             return;
@@ -2930,7 +2943,7 @@ export function App({ ctx: initialCtx }) {
     // Background is left natural — we inherit the terminal's own background
     // and only theme the foreground. Forcing
     // a filled bg left mismatched patches around bordered areas, so we don't.
-    return (_jsxs(Box, { flexDirection: "column", children: [phase !== 'ready' ? (_jsx(Banner, { version: ctx.version, session: session, permissionMode: permissionMode, cwd: ctx.cwd })) : null, _jsxs(Box, { flexDirection: "column", paddingX: 1, children: [phase === 'trust' ? (_jsx(TrustPrompt, { cwd: ctx.cwd })) : phase === 'resume' ? (_jsx(ResumePicker, { conversations: resumeList, selected: selectedResume })) : phase === 'edit' ? (_jsx(EditPromptPicker, { prompts: editList, selected: selectedEdit })) : phase === 'picker' ? (_jsx(Picker, { detected: detected, currentProvider: currentProvider, currentModel: session?.modelSummary ?? null, onSubmit: handlePickerSubmit, onCancel: handlePickerCancel, onCredential: handleTypedCredential, onLogin: (signal) => void startLoginFromPicker(signal), keyEntryFor: keyEntryFor, notice: pickerNotice })) : (_jsxs(_Fragment, { children: [_jsx(TranscriptFrame, { children: _jsx(Transcript, { messages: finalized, pending: messages.find((m) => m.pending) ?? null, state: state, settled: window.settled, resetKey: resetKey, raw: rawOutput, header: phase === 'ready' ? (_jsx(Banner, { version: ctx.version, session: session, permissionMode: permissionMode, cwd: ctx.cwd })) : undefined }) }), spacerRows > 0 ? _jsx(Box, { height: spacerRows }) : null, _jsx(LiveActivity, { activeTools: activeTools, thinking: state === 'thinking' && !messages.some((m) => m.pending) }), permission ? _jsx(PermissionOverlay, { toolCalls: permission.toolCalls }) : null, _jsxs(ComposerFrame, { focus: state === 'idle' && phase === 'ready' && conversationMutation === null, hidden: permission !== null, children: [queued.length > 0 && permission === null ? (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: theme.text.muted, children: [queuePause ? '⏸' : '⏎', " ", queued.length, " message", queued.length > 1 ? 's' : '', " queued \u2014", ' ', queuePause
+    return (_jsxs(Box, { flexDirection: "column", children: [phase !== 'ready' ? (_jsx(Banner, { version: ctx.version, session: session, permissionMode: permissionMode, cwd: ctx.cwd })) : null, _jsxs(Box, { flexDirection: "column", paddingX: 1, children: [phase === 'trust' ? (_jsx(TrustPrompt, { cwd: ctx.cwd })) : phase === 'resume' ? (_jsx(ResumePicker, { conversations: resumeList, selected: selectedResume })) : phase === 'edit' ? (_jsx(EditPromptPicker, { prompts: editList, selected: selectedEdit })) : phase === 'picker' ? (_jsx(Picker, { detected: detected, currentProvider: currentProvider, currentModel: session?.modelSummary ?? null, initialView: pickerInitialView, onSubmit: handlePickerSubmit, onCancel: handlePickerCancel, onCredential: handleTypedCredential, onLogin: (provider, signal) => void startLoginFromPicker(provider, signal), keyEntryFor: keyEntryFor, notice: pickerNotice })) : (_jsxs(_Fragment, { children: [_jsx(TranscriptFrame, { children: _jsx(Transcript, { messages: finalized, pending: messages.find((m) => m.pending) ?? null, state: state, settled: window.settled, resetKey: resetKey, raw: rawOutput, header: phase === 'ready' ? (_jsx(Banner, { version: ctx.version, session: session, permissionMode: permissionMode, cwd: ctx.cwd })) : undefined }) }), spacerRows > 0 ? _jsx(Box, { height: spacerRows }) : null, _jsx(LiveActivity, { activeTools: activeTools, thinking: state === 'thinking' && !messages.some((m) => m.pending) }), permission ? _jsx(PermissionOverlay, { toolCalls: permission.toolCalls }) : null, _jsxs(ComposerFrame, { focus: state === 'idle' && phase === 'ready' && conversationMutation === null, hidden: permission !== null, children: [queued.length > 0 && permission === null ? (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: theme.text.muted, children: [queuePause ? '⏸' : '⏎', " ", queued.length, " message", queued.length > 1 ? 's' : '', " queued \u2014", ' ', queuePause
                                                     ? `paused after a ${queuePause.outcome} turn; send a message or change model to continue`
                                                     : 'sending when ready'] }) })) : null, _jsx(Composer, { disabled: phase !== 'ready' ||
                                             state === 'awaiting-permission' ||