@omniaseo/cli 0.1.1 → 0.1.2

package/README.md

@@ -2,10 +2,10 @@
 
 Node 24 CLI for initializing a non-secret Omnia Connect workspace and connecting supported MCP hosts.
 
-With Node 24 and Codex CLI installed, run the ready-to-use connection command from the Omniaseo Connect page. It downloads this CLI automatically, opens the native browser authorization and checks a workspace read; no manual OAuth settings are required. The command pins the release, for example:
+With Node 24 and Codex CLI installed, run the ready-to-use connection command from the Omniaseo Connect page. It downloads this CLI automatically, prints the authorization link for your usual browser and checks a workspace read; no manual OAuth settings are required. The command pins the release, for example:
 
 ```bash
-npx --yes @omniaseo/cli@0.1.1 connect codex --url https://connect.example.com/mcp --resource https://connect.example.com
+npx --yes @omniaseo/cli@0.1.2 connect codex --url https://connect.example.com/mcp --resource https://connect.example.com
 ```
 
 Use the command supplied by your workspace so its server addresses are correct. Already-open Codex applications must restart after setup to load the connection settings.
@@ -20,9 +20,9 @@ omnia audit tail
 omnia doctor
 ```
 
-First-party CLI OAuth requires explicit `OMNIA_CLI_*` public-client configuration and a native OS vault (Linux Secret Service, macOS Keychain or Windows Password Vault). Refresh rotation is serialized per profile, bearer/OAuth HTTP redirects fail closed, and logout retains the vault credential if remote revocation is incomplete unless `--local-only` is explicit. The CLI never accepts bearer tokens on the command line, reads Codex/browser OAuth storage, or writes credentials into `.omnia` or `.codex`. Public NPM or ChatGPT publication requires separate authorization.
+First-party CLI OAuth requires explicit `OMNIA_CLI_*` public-client configuration and a native OS vault (Linux Secret Service, macOS Keychain or Windows Password Vault). Refresh rotation is serialized per profile, bearer/OAuth HTTP redirects fail closed, and logout retains the vault credential if remote revocation is incomplete unless `--local-only` is explicit. The CLI never accepts bearer tokens on the command line, reads Codex/browser OAuth storage, or writes first-party CLI OAuth tokens into `.omnia` or `.codex`. The separate Codex callback receiver stores a private installation key and delivery credential in its installation directory; these are not Codex access or refresh tokens.
 
-`omnia init` creates workspace files; it does not authenticate. `omnia connect codex` delegates registration and OAuth to Codex's native client and requests `offline_access` together with the selected tool scopes. `omnia login` instead uses the separately configured `OMNIA_CLI_OAUTH_CLIENT_ID`; it does not register a client or reuse Codex credentials. That public client must support both `authorization_code` and `refresh_token` grants. An older authorization-code-only registration cannot acquire offline access silently.
+`omnia init` creates workspace files; it does not authenticate. `omnia connect codex` registers a unique installation receiver and delegates OAuth state, PKCE exchange and tokens to Codex's native client and requests `offline_access` together with the selected tool scopes. `omnia login` instead uses the separately configured `OMNIA_CLI_OAUTH_CLIENT_ID`; it does not register a client or reuse Codex credentials. That public client must support both `authorization_code` and `refresh_token` grants. An older authorization-code-only registration cannot acquire offline access silently.
 
 Offline consent is separate from tool permissions. The Omnia issuer keeps access tokens at 900 seconds and rotates refresh tokens after every successful renewal. Renewal extends the 180-day inactivity window without an absolute authorization lifetime; revocation or loss of authority still blocks access immediately. Existing links without offline consent need that initial consent once, not periodic reauthorization.
 
@@ -30,8 +30,20 @@ Offline consent is separate from tool permissions. The Omnia issuer keeps access
 
 `omnia connect codex` checks the installed Codex feature capabilities before changing configuration or starting OAuth. For compatible versions it enables coordinated OAuth renewal automatically, with a backup of the existing config and preservation of unrelated settings and comments. Customers do not need to edit flags. Restart already-open Codex applications after setup so their existing connections adopt the setting. An unsupported Codex version receives an update instruction; an explicit conflicting preference is left unchanged and reported before login.
 
-The setting is Codex-wide (`features.mcp_oauth_refresh_coordination = true`), not limited to the Omniaseo server. Upstream still marks it experimental. Windows Codex `0.155.0-alpha.9.2` passed two real access-token expiry/renewal cycles, process restart and revocation with this setting; this is not a compatibility claim for every Codex release or other MCP hosts. The installer checks support rather than assuming it from a version number. The immediate read-only smoke uses the same effective user and project configuration as setup, without feature or server overrides. This detects configuration conflicts but does not replace the timed renewal acceptance test. A reported stable capability is accepted without matching a release number; an absent capability is not assumed safe.
+The setting is Codex-wide (`features.mcp_oauth_refresh_coordination = true`), not limited to the Omniaseo server. Upstream still marks it experimental. Windows Codex `0.155.0-alpha.9.2` passed two real access-token expiry/renewal cycles, process restart and revocation with this setting; this is not a compatibility claim for every Codex release or other MCP hosts. The automatic callback setup requires Codex 0.160.1 or later and checks the renewal capability. The immediate read-only smoke uses the same effective user and project configuration as setup, without feature or server overrides. This detects configuration conflicts but does not replace the timed renewal acceptance test. A reported stable capability is accepted without matching a release number; an absent capability is not assumed safe.
 
-The CLI archive bundles its private contract dependency so installation does not require a repository checkout. Codex retains custody of all OAuth credentials; this compatibility setup changes only non-secret configuration. Public distribution does not establish compatibility with untested clients or authorize production promotion.
+The CLI archive bundles its private contract dependency so installation does not require a repository checkout. Codex retains custody of all OAuth credentials; this setup also stores an installation receiver key and delivery credential in a private directory. Native Codex OAuth tokens remain under Codex custody. Public distribution does not establish compatibility with untested clients or authorize production promotion.
 
 Existing connections are migrated in place only when their endpoint and authorization settings agree. A missing OAuth resource is added without replacing the table, its comments or other MCP servers. Disabled connections, incompatible tool filters, different resources and existing authentication headers require resolving the conflict or choosing a separate connection name; setup does not widen those preferences. Every changed file has a backup.
+
+### Automatic callback and native reconnect
+
+Use Node 24 and Codex 0.160.1 or later. Setup installs a persistent receiver with Linux systemd, macOS LaunchAgents, or a Windows user Scheduled Task; unavailable service managers fail before OAuth. The receiver polls outbound HTTPS and forwards one encrypted response to the exact registered native loopback callback. No extra inbound port, pasted callback/code, terminal restart, or assistant-operated consent is required. Open the printed link yourself in your usual browser. Already-open Codex apps must reload the saved configuration once after initial setup. Later native reconnect uses the same installation client and receiver.
+
+The receiver directory under `CODEX_HOME/omnia-connect/<name>` (or `~/.codex`) is private: permissions 0700/0600 on Unix and an owner-only inherited ACL on Windows. Keep it with the installation; deleting it requires explicit installation replacement in Omniaseo consent. Same-installation reconnect preserves the connection and governance. Explicit replacement revokes the old installation, keeps its audit history, and creates a new draft with copied governance; providers require revalidation. A canceled or interrupted attempt resumes with a fresh authorization request.
+
+Selected areas are intersected with actual plan entitlements and effective consent. Setup reports effective scopes and unavailable modules; when Kanban read is effective and available, it also performs a bounded project-list read. A workspace-only success does not establish access to unavailable provider areas.
+
+Linux native CLI and native app-server reconnect were exercised with Codex 0.160.1 in an isolated HTTPS/PKCE fixture. Windows/macOS service adapters are implemented but require platform runtime acceptance before claiming equivalent proof. The legacy staging profile with a shared predefined synthetic client deliberately rejects receiver registration: use a dedicated synthetic acceptance profile with unique clients and exact-identity seeded fixture connections. Never attach multiple host keys to that shared client.
+
+Release distribution: publish the reviewed exact 0.1.2 archive under npm `next` before staging so the pinned version resolves. Promote npm `latest` only after production acceptance; package publication and product deployment each require their own readback.

package/dist/auth/callback-receiver.d.ts

@@ -0,0 +1,18 @@
+export type ReceiverConfig = {
+    clientId: string;
+    receiverSecret: string;
+    privateKey: string;
+    issuer: string;
+    redirectUri: string;
+};
+type Envelope = {
+    version: number;
+    key: string;
+    iv: string;
+    tag: string;
+    data: string;
+};
+export declare function decryptCallback(envelope: Envelope, config: ReceiverConfig, now?: number): string;
+export declare function receiveCallbacks(config: ReceiverConfig, signal?: AbortSignal): Promise<void>;
+export {};
+//# sourceMappingURL=callback-receiver.d.ts.map

package/dist/auth/callback-receiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-receiver.d.ts","sourceRoot":"","sources":["../../src/auth/callback-receiver.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AACnI,KAAK,QAAQ,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,SAAa,GAAG,MAAM,CAkBpG;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBlG"}

package/dist/auth/callback-receiver.js

@@ -0,0 +1,58 @@
+// Standalone receiver copied into the host's private installation directory.
+// Native Codex owns state validation, PKCE exchange and all OAuth tokens.
+import { readFile } from 'node:fs/promises';
+import { createDecipheriv, privateDecrypt } from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+export function decryptCallback(envelope, config, now = Date.now()) {
+    if (envelope.version !== 1)
+        throw new Error('Unsupported callback envelope');
+    const key = privateDecrypt({ key: config.privateKey, oaepHash: 'sha256' }, Buffer.from(envelope.key, 'base64url'));
+    const cipher = createDecipheriv('aes-256-gcm', key, Buffer.from(envelope.iv, 'base64url'));
+    cipher.setAuthTag(Buffer.from(envelope.tag, 'base64url'));
+    const data = JSON.parse(Buffer.concat([cipher.update(Buffer.from(envelope.data, 'base64url')), cipher.final()]).toString('utf8'));
+    const url = new URL(data.redirect);
+    const target = new URL(config.redirectUri);
+    if (data.clientId !== config.clientId || !Number.isFinite(Date.parse(data.expiresAt)) || Date.parse(data.expiresAt) <= now
+        || !/^[A-Za-z0-9_-]{43,128}$/u.test(data.codeChallenge)
+        || target.protocol !== 'http:' || target.hostname !== '127.0.0.1' || target.pathname !== '/callback'
+        || url.origin !== target.origin || url.pathname !== target.pathname || url.hash || url.username || url.password
+        || url.searchParams.get('iss') !== config.issuer || !url.searchParams.get('state')
+        || ['iss', 'state', 'code', 'error'].some(name => url.searchParams.getAll(name).length > 1)
+        || !(url.searchParams.has('code') !== url.searchParams.has('error')))
+        throw new Error('Callback installation or attempt does not match');
+    return url.toString();
+}
+export async function receiveCallbacks(config, signal) {
+    const issuer = new URL(config.issuer);
+    if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash)
+        throw new Error('Invalid receiver issuer');
+    let idlePolls = 0;
+    while (!signal?.aborted) {
+        try {
+            const response = await fetch(`${config.issuer}/relay/${encodeURIComponent(config.clientId)}/delivery`, {
+                method: 'POST', headers: { Authorization: `Bearer ${config.receiverSecret}` },
+                redirect: 'error', signal: AbortSignal.timeout(10_000),
+            });
+            if (response.ok && response.status !== 204 && Number(response.headers.get('content-length') || 0) <= 65536) {
+                const callback = decryptCallback(await response.json(), config);
+                // The only inbound listener is Codex's native loopback listener. A
+                // stopped/expired native login is never replaced by a token exchange here.
+                await fetch(callback, { redirect: 'error', signal: AbortSignal.timeout(5_000) });
+                idlePolls = 0;
+            }
+            else {
+                idlePolls += 1;
+            }
+        }
+        catch {
+            // Delivery is single-use. Native interrupted logins resume with a new
+            // attempt, never by replaying a saved code or printing it to the chat/log.
+        }
+        await new Promise(resolve => setTimeout(resolve, Math.min(10_000, 2_000 * (idlePolls + 1))));
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    const config = JSON.parse(await readFile(process.argv[2] || '', 'utf8'));
+    await receiveCallbacks(config);
+}
+//# sourceMappingURL=callback-receiver.js.map

package/dist/auth/callback-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-receiver.js","sourceRoot":"","sources":["../../src/auth/callback-receiver.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKzC,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,MAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1F,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3F,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE/H,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG;WACrH,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;WACpD,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;WACjG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;WAC5G,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;WAC/E,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;WACxF,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAsB,EAAE,MAAoB;IACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnJ,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACrG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE,EAAE;gBAC7E,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC3G,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAc,EAAE,MAAM,CAAC,CAAC;gBAC5E,mEAAmE;gBACnE,2EAA2E;gBAC3E,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjF,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,2EAA2E;QAC7E,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAmB,CAAC;IAC3F,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC"}

package/dist/auth/callback-relay.d.ts

@@ -0,0 +1,11 @@
+import type { CommandRunner } from '../process/runner.js';
+import type { ReceiverConfig } from './callback-receiver.js';
+export declare function prepareCallbackRelay(options: {
+    name: string;
+    resource: string;
+    runner: CommandRunner;
+    env?: NodeJS.ProcessEnv;
+    accessMode?: string;
+    scopes?: readonly string[];
+}): Promise<ReceiverConfig>;
+//# sourceMappingURL=callback-relay.d.ts.map

package/dist/auth/callback-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-relay.d.ts","sourceRoot":"","sources":["../../src/auth/callback-relay.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAC1G,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CA2DrG"}

package/dist/auth/callback-relay.js

@@ -0,0 +1,80 @@
+import { generateKeyPairSync } from 'node:crypto';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { mkdir, copyFile, chmod, lstat } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { atomicWrite, readText } from '../io/atomic.js';
+import { CliError, EXIT } from '../errors.js';
+import { installReceiverService, probeReceiverService } from './receiver-service.js';
+export async function prepareCallbackRelay(options) {
+    const env = options.env ?? process.env;
+    const directory = join(env.CODEX_HOME ?? join(homedir(), '.codex'), 'omnia-connect', options.name);
+    if (/[\r\n\0]/u.test(directory))
+        throw new CliError('Invalid receiver storage path', 'CALLBACK_RECEIVER_STORAGE_UNSAFE', EXIT.AUTH_BLOCKED);
+    const statePath = join(directory, 'receiver.json');
+    const scriptPath = join(directory, 'receiver.mjs');
+    probeReceiverService(options.runner);
+    const stat = await lstat(statePath).catch(() => null);
+    if (stat && (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65536
+        || process.platform !== 'win32' && (stat.mode & 0o077) !== 0))
+        throw new CliError('The receiver credential file is unsafe', 'CALLBACK_RECEIVER_STORAGE_UNSAFE', EXIT.AUTH_BLOCKED);
+    const prior = await readText(statePath);
+    let config;
+    if (prior) {
+        config = JSON.parse(prior);
+        const metadata = await fetch(`${options.resource}/.well-known/oauth-protected-resource`, { redirect: 'error', signal: AbortSignal.timeout(10_000) });
+        const document = await metadata.json();
+        if (!metadata.ok || !document.authorization_servers?.includes(config.issuer))
+            throw new CliError('Saved receiver belongs to another server', 'CALLBACK_RECEIVER_CONFLICT', EXIT.CONFIG_CONFLICT);
+        const preference = await fetch(`${config.issuer}/relay/${encodeURIComponent(config.clientId)}/preferences`, {
+            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${config.receiverSecret}` },
+            redirect: 'error', signal: AbortSignal.timeout(10_000), body: JSON.stringify({ accessMode: options.accessMode || 'view' })
+        });
+        if (!preference.ok)
+            throw new CliError('The saved receiver installation is unavailable; review or replace it explicitly', 'CALLBACK_RECEIVER_UNAVAILABLE', EXIT.AUTH_BLOCKED);
+    }
+    else {
+        const metadata = await fetch(`${options.resource}/.well-known/oauth-protected-resource`, { redirect: 'error', signal: AbortSignal.timeout(10_000) });
+        const document = await metadata.json();
+        if (!metadata.ok || document.authorization_servers?.length !== 1)
+            throw new CliError('The server does not identify one authorization issuer', 'CALLBACK_ISSUER_UNVERIFIED', EXIT.AUTH_BLOCKED);
+        const issuer = new URL(document.authorization_servers[0] || '');
+        if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash)
+            throw new CliError('Invalid callback issuer', 'CALLBACK_ISSUER_UNVERIFIED', EXIT.AUTH_BLOCKED);
+        const keys = generateKeyPairSync('rsa', { modulusLength: 2048, privateKeyEncoding: { type: 'pkcs8', format: 'pem' }, publicKeyEncoding: { type: 'spki', format: 'pem' } });
+        const callbackPort = await new Promise((resolve, reject) => {
+            const probe = createServer();
+            probe.once('error', reject);
+            probe.listen(0, '127.0.0.1', () => {
+                const port = probe.address().port;
+                probe.close(error => error ? reject(error) : resolve(port));
+            });
+        });
+        const response = await fetch(`${issuer.toString().replace(/\/$/u, '')}/relay/register`, { method: 'POST',
+            headers: { 'Content-Type': 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(10_000),
+            body: JSON.stringify({ publicKey: keys.publicKey, callbackPort, accessMode: options.accessMode || 'view' }) });
+        if (!response.ok)
+            throw new CliError('Automatic callback relay is unavailable on this server', 'CALLBACK_RELAY_UNAVAILABLE', EXIT.AUTH_BLOCKED);
+        const registration = await response.json();
+        config = { ...registration, privateKey: keys.privateKey };
+        if (config.issuer !== issuer.toString().replace(/\/$/u, '') || !/^omnia_[A-Za-z0-9_-]{32}$/u.test(config.clientId)
+            || !/^[A-Za-z0-9_-]{43}$/u.test(config.receiverSecret) || config.redirectUri !== `http://127.0.0.1:${callbackPort}/callback`) {
+            throw new CliError('The server returned an invalid installation registration', 'CALLBACK_REGISTRATION_INVALID', EXIT.AUTH_BLOCKED);
+        }
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        await chmod(directory, 0o700);
+        if (process.platform === 'win32') {
+            const literalDirectory = `'${directory.replace(/'/gu, "''")}'`;
+            const script = `$ErrorActionPreference='Stop'; $user=[System.Security.Principal.WindowsIdentity]::GetCurrent().Name; & icacls.exe ${literalDirectory} /inheritance:r /grant:r ($user + ':(OI)(CI)F'); if($LASTEXITCODE -ne 0){exit 1}`;
+            if (options.runner.run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]).status !== 0)
+                throw new CliError('Private receiver storage could not be secured', 'CALLBACK_RECEIVER_STORAGE_UNSAFE', EXIT.AUTH_BLOCKED);
+        }
+        await atomicWrite(statePath, JSON.stringify(config), 0o600);
+    }
+    await copyFile(fileURLToPath(new URL('./callback-receiver.js', import.meta.url)), scriptPath);
+    await chmod(scriptPath, 0o600);
+    await installReceiverService({ directory, scriptPath, statePath, runner: options.runner });
+    return config;
+}
+//# sourceMappingURL=callback-relay.js.map

package/dist/auth/callback-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-relay.js","sourceRoot":"","sources":["../../src/auth/callback-relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAErF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OACiC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;WACpE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrL,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAsB,CAAC;IAC3B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmB,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,uCAAuC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,4BAA4B,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACjM,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC1G,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE,EAAE;YACjH,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;SAAE,CAAC,CAAC;QAChI,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,iFAAiF,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChL,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,uCAAuC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/L,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACvM,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3K,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBAChC,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;gBACnD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM;YACtG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACvG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChJ,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwC,CAAC;QACjF,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC7G,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,oBAAoB,YAAY,WAAW,EAAE,CAAC;YAC/H,MAAM,IAAI,QAAQ,CAAC,0DAA0D,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,gBAAgB,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/D,MAAM,MAAM,GAAG,qHAAqH,gBAAgB,kFAAkF,CAAC;YACvO,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3O,CAAC;QACD,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/receiver-service.d.ts

@@ -0,0 +1,9 @@
+import type { CommandRunner } from '../process/runner.js';
+export declare function probeReceiverService(runner: CommandRunner, platform?: NodeJS.Platform): void;
+export declare function installReceiverService({ directory, scriptPath, statePath, runner }: {
+    directory: string;
+    scriptPath: string;
+    statePath: string;
+    runner: CommandRunner;
+}): Promise<void>;
+//# sourceMappingURL=receiver-service.d.ts.map

package/dist/auth/receiver-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-service.d.ts","sourceRoot":"","sources":["../../src/auth/receiver-service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,kBAAmB,GAAG,IAAI,CAK7F;AAED,wBAAsB,sBAAsB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IACzF,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;CACjF,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB"}

package/dist/auth/receiver-service.js

@@ -0,0 +1,56 @@
+import { mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { atomicWrite } from '../io/atomic.js';
+import { CliError, EXIT } from '../errors.js';
+export function probeReceiverService(runner, platform = process.platform) {
+    const result = platform === 'linux' ? runner.run('systemctl', [...(process.getuid?.() === 0 ? [] : ['--user']), 'show-environment'])
+        : platform === 'darwin' ? runner.run('launchctl', ['print', `gui/${process.getuid?.()}`])
+            : platform === 'win32' ? runner.run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', '$PSVersionTable.PSVersion.Major']) : null;
+    if (!result || result.status !== 0)
+        throw new CliError('The native host service manager is unavailable. No configuration or login was changed. Enable its user service session and run setup again.', 'CALLBACK_HOST_UNSUPPORTED', EXIT.DEPENDENCY_MISSING);
+}
+export async function installReceiverService({ directory, scriptPath, statePath, runner }) {
+    const serviceId = `omnia-connect-${createHash('sha256').update(directory).digest('hex').slice(0, 16)}`;
+    for (const path of [directory, scriptPath, statePath, process.execPath]) {
+        if (/[\r\n\0]/u.test(path))
+            throw new CliError('Invalid service path', 'CALLBACK_SERVICE_PATH_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    const ensure = (command, args) => {
+        if (runner.run(command, args).status !== 0)
+            throw new CliError('Authorization receiver did not start. No OAuth login was started. Rerun setup to resume the same installation.', 'CALLBACK_RECEIVER_NOT_RUNNING', EXIT.AUTH_BLOCKED);
+    };
+    if (process.platform === 'linux') {
+        const system = process.getuid?.() === 0;
+        const unitDirectory = system ? '/etc/systemd/system' : join(homedir(), '.config', 'systemd', 'user');
+        await mkdir(unitDirectory, { recursive: true });
+        const quote = (value) => JSON.stringify(value.replace(/%/gu, '%%'));
+        const unit = `[Unit]\nDescription=Omniaseo Connect authorization receiver\nAfter=network-online.target\n[Service]\nType=simple\nExecStart=${quote(process.execPath)} ${quote(scriptPath)} ${quote(statePath)}\nRestart=always\nRestartSec=5\nUMask=0077\nNoNewPrivileges=true\n[Install]\nWantedBy=${system ? 'multi-user.target' : 'default.target'}\n`;
+        await atomicWrite(join(unitDirectory, `${serviceId}.service`), unit, 0o600);
+        const prefix = system ? [] : ['--user'];
+        ensure('systemctl', [...prefix, 'daemon-reload']);
+        ensure('systemctl', [...prefix, 'enable', '--now', `${serviceId}.service`]);
+        ensure('systemctl', [...prefix, 'is-active', '--quiet', `${serviceId}.service`]);
+    }
+    else if (process.platform === 'darwin') {
+        const escape = (value) => value.replace(/&/gu, '&amp;').replace(/</gu, '&lt;').replace(/>/gu, '&gt;').replace(/"/gu, '&quot;');
+        const label = `com.omniaseo.${serviceId}`;
+        const plist = join(homedir(), 'Library', 'LaunchAgents', `${label}.plist`);
+        await atomicWrite(plist, `<?xml version="1.0" encoding="UTF-8"?><plist version="1.0"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array>${[process.execPath, scriptPath, statePath].map(value => `<string>${escape(value)}</string>`).join('')}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>5</integer><key>Umask</key><integer>63</integer></dict></plist>`, 0o600);
+        const domain = `gui/${process.getuid?.()}`;
+        runner.run('launchctl', ['bootout', `${domain}/${label}`]);
+        ensure('launchctl', ['bootstrap', domain, plist]);
+        ensure('launchctl', ['kickstart', `${domain}/${label}`]);
+        ensure('launchctl', ['print', `${domain}/${label}`]);
+    }
+    else if (process.platform === 'win32') {
+        const literal = (value) => `'${value.replace(/'/gu, "''")}'`;
+        const argument = [scriptPath, statePath].map(value => `"${value.replace(/"/gu, '\\"')}"`).join(' ');
+        const installationScript = `$ErrorActionPreference = 'Stop'\n$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name\n$action = New-ScheduledTaskAction -Execute ${literal(process.execPath)} -Argument ${literal(argument)}\n$trigger = New-ScheduledTaskTrigger -AtLogOn -User $user\n$principal = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited\n$settings = New-ScheduledTaskSettingsSet -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries\nRegister-ScheduledTask -TaskName ${literal(serviceId)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null\nStart-ScheduledTask -TaskName ${literal(serviceId)}\n$ready = $false\nfor($attempt = 0; $attempt -lt 20; $attempt++){ if((Get-ScheduledTask -TaskName ${literal(serviceId)}).State -eq 'Running'){$ready = $true; break}; Start-Sleep -Milliseconds 250 }\nif(-not $ready){throw 'Receiver task did not reach Running'}\n`;
+        ensure('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', installationScript]);
+    }
+    else
+        throw new CliError('This host has no supported native receiver service', 'CALLBACK_HOST_UNSUPPORTED', EXIT.DEPENDENCY_MISSING);
+}
+//# sourceMappingURL=receiver-service.js.map

package/dist/auth/receiver-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-service.js","sourceRoot":"","sources":["../../src/auth/receiver-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAG9C,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACrF,MAAM,MAAM,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAClI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,iCAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnJ,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,6IAA6I,EAAE,2BAA2B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC9P,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAEtF;IACC,MAAM,SAAS,GAAG,iBAAiB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACvG,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,+BAA+B,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,IAAc,EAAQ,EAAE;QACvD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,gHAAgH,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvO,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,+HAA+H,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,yFAAyF,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC;QACzV,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,SAAS,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,SAAS,UAAU,CAAC,CAAC,CAAC;IACnF,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/I,MAAM,KAAK,GAAG,gBAAgB,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,KAAK,EAAE,4FAA4F,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,mKAAmK,EAAE,KAAK,CAAC,CAAC;QACxb,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;QAC7E,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpG,MAAM,kBAAkB,GAAG,uJAAuJ,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,OAAO,CAAC,QAAQ,CAAC,uZAAuZ,OAAO,CAAC,SAAS,CAAC,iIAAiI,OAAO,CAAC,SAAS,CAAC,sGAAsG,OAAO,CAAC,SAAS,CAAC,gJAAgJ,CAAC;QAC/iC,MAAM,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9F,CAAC;;QAAM,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE,2BAA2B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACxI,CAAC"}

package/dist/codex/config.d.ts

@@ -2,6 +2,12 @@ export type CodexServerConfig = {
     name: string;
     url: string;
     resource: string;
+    scopes?: string[];
+    oauth?: {
+        client_id: string;
+        callback_url: string;
+        callback_port: number;
+    };
 };
 export declare const CODEX_REFRESH_FEATURE = "mcp_oauth_refresh_coordination";
 /** Validate only the requested connection; never widen user-owned access settings. */

package/dist/codex/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,qBAAqB,mCAAmC,CAAC;AA2CtE,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAqBnF;AAuCD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAO,GAChF,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0C5C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5E,CAAC;AAEF,eAAO,MAAM,qBAAqB,mCAAmC,CAAC;AA2CtE,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAqBnF;AA+ED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAO,GAChF,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA4C5C"}

package/dist/codex/config.js

@@ -123,6 +123,64 @@ function migrateExistingServer(original, server) {
         return prefixed;
     throw new Error('The existing connection could not be updated safely. Use a separate connection name');
 }
+function addNativeOAuthSettings(original, server) {
+    if (!server.oauth)
+        return original;
+    let content = original;
+    const parsed = TOML.parse(content);
+    const current = parsed.mcp_servers[server.name];
+    if (current.oauth && !isDeepStrictEqual(current.oauth, server.oauth)) {
+        throw new Error('This connection has another registered installation. Preserve its OAuth settings and review explicit installation replacement before changing them');
+    }
+    if (!current.oauth) {
+        const addition = `\n[mcp_servers.${server.name}.oauth]\n${Object.entries(server.oauth).map(([key, value]) => `${key} = ${JSON.stringify(value)}`).join('\n')}\n`;
+        const expected = { ...parsed, mcp_servers: { ...parsed.mcp_servers, [server.name]: { ...current, oauth: server.oauth } } };
+        const inline = `oauth = { ${Object.entries(server.oauth).map(([key, value]) => `${key} = ${JSON.stringify(value)}`).join(', ')} }`;
+        const candidates = [`${content}${addition}`];
+        for (const match of content.matchAll(/\}/gu))
+            for (const separator of ['', ', '])
+                candidates.push(`${content.slice(0, match.index)}${separator}${inline}${content.slice(match.index)}`);
+        const candidate = candidates.find(value => { try {
+            return isDeepStrictEqual(TOML.parse(value), expected);
+        }
+        catch {
+            return false;
+        } });
+        if (!candidate)
+            throw new Error('Native OAuth settings could not be saved without changing another connection');
+        content = candidate;
+    }
+    if (server.scopes) {
+        const snapshot = TOML.parse(content);
+        const servers = snapshot.mcp_servers;
+        const expected = { ...snapshot, mcp_servers: { ...servers, [server.name]: { ...servers[server.name], scopes: server.scopes } } };
+        if (isDeepStrictEqual(snapshot, expected))
+            return content;
+        const assignment = `scopes = ${JSON.stringify(server.scopes)}`;
+        const candidates = [];
+        for (const match of content.matchAll(/^.*\][^\r\n]*(?:\r?\n|$)/gmu)) {
+            const position = match.index + match[0].length;
+            candidates.push(`${content.slice(0, position)}${match[0].endsWith('\n') ? '' : '\n'}${assignment}\n${content.slice(position)}`);
+        }
+        for (const match of content.matchAll(/^\s*scopes\s*=.*$/gmu))
+            candidates.push(`${content.slice(0, match.index)}${assignment}${content.slice(match.index + match[0].length)}`);
+        for (const match of content.matchAll(/\}/gu))
+            for (const separator of ['', ', '])
+                candidates.push(`${content.slice(0, match.index)}${separator}${assignment}${content.slice(match.index)}`);
+        const result = candidates.find(candidate => {
+            try {
+                return isDeepStrictEqual(TOML.parse(candidate), expected);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!result)
+            throw new Error('Selected scopes could not be saved without changing existing configuration');
+        content = result;
+    }
+    return content;
+}
 function configPath(env) {
     return join(env.CODEX_HOME ?? join(homedir(), '.codex'), 'config.toml');
 }
@@ -154,6 +212,8 @@ export async function mergeCodexServerConfig(server, env = process.env, options
                 'required = false',
             ].join('\n'));
         merged.changed = merged.content !== original;
+        merged.content = addNativeOAuthSettings(merged.content, server);
+        merged.changed = merged.content !== original;
         TOML.parse(merged.content);
     }
     catch (error) {

package/dist/codex/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAQnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAEtE,SAAS,yBAAyB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,YAAY,IAAI,CAAC,EAAE,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACzI,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,GAAG,qBAAqB,SAAS,CAAC;IACrD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAW,EAAE;QACrD,IAAI,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,wEAAwE,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjH,IAAI,eAAe,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACnD,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,IAAI,eAAe,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACnD,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,YAAY,UAAU,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC/D,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;AAC7G,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,MAAyB;IAC3E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACtE,CAAC,CAAC,KAAK,CAAC,SAAoC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,SAAS,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACtJ,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAC9H,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC;QAC3I,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACjG,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,MAAyB;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAkE,CAAC;IAC1F,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5H,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC7C,IAAI,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC5F,CAAC,CAAC;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9I,IAAI,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,IAAI,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;IACjG,IAAI,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAA+E,EAAE;IAEjF,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,QAAQ,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,eAAe,GAAG,gBAAgB,MAAM,CAAC,IAAI,GAAG,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAI,MAAM,CAAC,WAAmD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClG,IAAI,MAA6C,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnG,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChG,MAAM,GAAG,cAAc,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,KAAK,QAAQ,EAAE;YAC3D,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE;gBACpD,eAAe;gBACf,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACrC,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;gBACrD,kBAAkB;aACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,EACpE,uBAAuB,EACvB,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/F,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAUnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAEtE,SAAS,yBAAyB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,YAAY,IAAI,CAAC,EAAE,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACzI,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,GAAG,qBAAqB,SAAS,CAAC;IACrD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAW,EAAE;QACrD,IAAI,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC5F,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,wEAAwE,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjH,IAAI,eAAe,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACnD,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,IAAI,eAAe,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACnD,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,YAAY,UAAU,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC/D,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;AAC7G,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,MAAyB;IAC3E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACtE,CAAC,CAAC,KAAK,CAAC,SAAoC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,SAAS,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACtJ,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAC9H,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC;QAC3I,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACjG,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,MAAyB;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAkE,CAAC;IAC1F,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5H,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC7C,IAAI,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC5F,CAAC,CAAC;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9I,IAAI,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,IAAI,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;IACjG,IAAI,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,MAAyB;IACzE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAI,MAAM,CAAC,WAAuD,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC;IAC9F,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oJAAoJ,CAAC,CAAC;IACxK,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,kBAAkB,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACjK,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,GAAI,MAAM,CAAC,WAAsB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;QACvI,MAAM,MAAM,GAAG,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACnI,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxL,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAChH,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAsD,CAAC;QAChF,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QACjI,IAAI,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC;QAC1D,MAAM,UAAU,GAAG,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9K,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5L,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACzC,IAAI,CAAC;gBAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC3G,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAA+E,EAAE;IAEjF,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,QAAQ,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,eAAe,GAAG,gBAAgB,MAAM,CAAC,IAAI,GAAG,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAI,MAAM,CAAC,WAAmD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClG,IAAI,MAA6C,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnG,MAAM,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChG,MAAM,GAAG,cAAc,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,KAAK,QAAQ,EAAE;YAC3D,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE;gBACpD,eAAe;gBACf,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACrC,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;gBACrD,kBAAkB;aACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;QAC7C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,EACpE,uBAAuB,EACvB,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/F,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/commands/connect.d.ts

@@ -1,4 +1,5 @@
 import type { CommandRunner } from '../process/runner.js';
+import { prepareCallbackRelay } from '../auth/callback-relay.js';
 export type ConnectCodexOptions = {
     name: string;
     url: string;
@@ -7,6 +8,8 @@ export type ConnectCodexOptions = {
     skipSmoke: boolean;
     runner: CommandRunner;
     env?: NodeJS.ProcessEnv;
+    accessMode?: string;
+    prepareRelay?: typeof prepareCallbackRelay;
 };
 export type ConnectCodexResult = {
     host: 'codex';
@@ -15,7 +18,17 @@ export type ConnectCodexResult = {
     registration: 'atomic_config_merge' | 'existing';
     oauth: 'completed';
     smoke: 'passed' | 'blocked_by_explicit_skip';
+    installationLocation: 'remote_server' | 'local_computer';
     configPath?: string;
+    effectiveScopes?: string[];
+    unavailableModules?: string[];
+    contentRead?: 'kanban_projects';
+    areaChecks?: Array<{
+        module: string;
+        status: 'verified_read' | 'scope_not_granted' | 'unavailable' | 'requires_resource';
+        action?: string;
+        reason?: string;
+    }>;
 };
 export declare function connectCodex(options: ConnectCodexOptions): Promise<ConnectCodexResult>;
 export declare function connectCustom(urlValue: string, resourceValue: string): Record<string, unknown>;

package/dist/commands/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA0EzE,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,qBAAqB,GAAG,UAAU,CAAC;IACjD,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,QAAQ,GAAG,0BAA0B,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8F5F;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAY9F;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS/F"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAkGjE,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,qBAAqB,GAAG,UAAU,CAAC;IACjD,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,QAAQ,GAAG,0BAA0B,CAAC;IAC7C,oBAAoB,EAAE,eAAe,GAAG,gBAAgB,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,GAAG,aAAa,GAAG,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/J,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmJ5F;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAY9F;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS/F"}