@oxagen/cli 2.1.4-957 → 2.1.4-975

package/oxagen.mjs

@@ -5307,7 +5307,22 @@ var init_envelope = __esm({
       // like `proof.observed`. Its strict schema is
       // `hostEgressRefusedMessageSchema` in `@oxagen/oxagen/sandbox-host/protocol`,
       // which this leaf package cannot import.
-      "oxagen:egress_refused": external_exports.object({}).catchall(json)
+      "oxagen:egress_refused": external_exports.object({}).catchall(json),
+      // The in-app assistant's frames (#5943, ADR-5969). The control plane writes
+      // them on the assistant's own session (`assistant-session.ts` in
+      // @oxagen/agent), never a host. A model call and a tool call each take two
+      // frames: the write-ahead request, durable before the provider or the tool
+      // is reached, and the completion. The history summary is the context a
+      // turn carried in place of its older messages, and the goal verdict is one
+      // verifier round. Each body is opaque on the wire, like `proof.observed`:
+      // its members are the receipt the assistant recorded, and the readers in
+      // @oxagen/run-ledger read them by name.
+      "model.engine_call_started": external_exports.object({}).catchall(json),
+      "model.engine_call_completed": external_exports.object({}).catchall(json),
+      "tool.engine_call_started": external_exports.object({}).catchall(json),
+      "tool.engine_call_completed": external_exports.object({}).catchall(json),
+      "context.history_summarized": external_exports.object({}).catchall(json),
+      "verification.goal_verdict": external_exports.object({}).catchall(json)
     };
     TACHO_KINDS = Object.keys(KIND_BODIES);
     agentIdentitySchema = external_exports.object({
@@ -13816,8 +13831,8 @@ var init_backfill = __esm({
           this.parentMs = ms;
           this.clock.ms = ms;
         }
-        const spawn7 = [];
-        return { events: this.mappedLine(parsed2, text5, offset, spawn7), spawn: spawn7 };
+        const spawn9 = [];
+        return { events: this.mappedLine(parsed2, text5, offset, spawn9), spawn: spawn9 };
       }
       /**
        * Begin a session still waiting for its facts once its last line is read:
@@ -13843,28 +13858,28 @@ var init_backfill = __esm({
         this.parentMs = timestampOf(first) ?? 0;
         this.clock.ms = this.parentMs;
         const events = this.collect(this.start(first, facts, permissionMode));
-        const spawn7 = [];
+        const spawn9 = [];
         for (const item of early) {
           const ms = timestampOf(item.record);
           if (ms !== void 0) this.parentMs = Math.max(this.parentMs, ms);
           this.clock.ms = ms ?? this.parentMs;
           events.push(
-            ...this.mappedLine(item.record, item.text, item.offset, spawn7)
+            ...this.mappedLine(item.record, item.text, item.offset, spawn9)
           );
         }
         this.clock.ms = this.parentMs;
-        return { events, spawn: spawn7 };
+        return { events, spawn: spawn9 };
       }
       /** One parent line through the mapping, guarded. */
-      mappedLine(record, text5, offset, spawn7) {
+      mappedLine(record, text5, offset, spawn9) {
         const spawnedBefore = this.spawned.size;
-        const spawnLength = spawn7.length;
+        const spawnLength = spawn9.length;
         return this.guarded(
           offset,
           void 0,
-          () => this.mapped(record, text5, spawn7),
+          () => this.mapped(record, text5, spawn9),
           () => {
-            spawn7.length = spawnLength;
+            spawn9.length = spawnLength;
             for (const toolUseId of [...this.spawned.keys()].slice(spawnedBefore))
               this.spawned.delete(toolUseId);
           }
@@ -14080,7 +14095,7 @@ var init_backfill = __esm({
           })
         );
       }
-      mapped(record, text5, spawn7) {
+      mapped(record, text5, spawn9) {
         const type = nonEmptyString(record["type"]);
         const ms = timestampOf(record);
         const events = [];
@@ -14213,7 +14228,7 @@ var init_backfill = __esm({
               ms
             )
           );
-          spawn7.push(subagent.agentId);
+          spawn9.push(subagent.agentId);
         }
         return events;
       }
@@ -17571,14 +17586,14 @@ var init_recorder = __esm({
         const parent = this.options.parent;
         if (parent === void 0) return;
         const type = parent.subagentType === void 0 ? subagentType : void 0;
-        const spawn7 = parent.spawnToolUseId === void 0 ? spawnToolUseId : void 0;
-        if (type === void 0 && spawn7 === void 0) return;
+        const spawn9 = parent.spawnToolUseId === void 0 ? spawnToolUseId : void 0;
+        if (type === void 0 && spawn9 === void 0) return;
         this.options = {
           ...this.options,
           parent: {
             ...parent,
             ...type !== void 0 ? { subagentType: type } : {},
-            ...spawn7 !== void 0 ? { spawnToolUseId: spawn7 } : {}
+            ...spawn9 !== void 0 ? { spawnToolUseId: spawn9 } : {}
           }
         };
       }
@@ -21029,12 +21044,12 @@ async function sealTranscript(candidate, deps, pass2) {
     const read2 = await readSlices(candidate.path, sliceBytes, async (lines) => {
       let index = 0;
       while (index < lines.length) {
-        const spawn7 = [];
+        const spawn9 = [];
         await deps.exclusive(candidate.sessionId, () => {
           if (deps.heldLocally(candidate.sessionId)) throw new TakenLive();
           const out = [];
           let next = readTo;
-          while (spawn7.length === 0) {
+          while (spawn9.length === 0) {
             const line = lines[index];
             if (line === void 0) break;
             index += 1;
@@ -21045,7 +21060,7 @@ async function sealTranscript(candidate, deps, pass2) {
             }
             const sealed = driver.line(line.text, line.offset);
             out.push(...sealed.events);
-            spawn7.push(...sealed.spawn);
+            spawn9.push(...sealed.spawn);
           }
           emit(out);
           if (driver.hasChain) {
@@ -21053,7 +21068,7 @@ async function sealTranscript(candidate, deps, pass2) {
             partial(readTo, { status: "partial" });
           }
         });
-        for (const agentId of spawn7) await feedSubagent(agentId);
+        for (const agentId of spawn9) await feedSubagent(agentId);
       }
       await between();
     });
@@ -22422,6 +22437,626 @@ var init_claude_code_mcp = __esm({
   }
 });
 
+// ../../packages/tacho/src/host/run-token.ts
+import { createHmac, randomBytes as randomBytes4, timingSafeEqual } from "node:crypto";
+import { readFileSync as readFileSync6 } from "node:fs";
+function keyFromBytes(bytes) {
+  if (bytes.length !== KEY_BYTES)
+    throw new Error(
+      `run token key must be ${KEY_BYTES} bytes, got ${bytes.length}`
+    );
+  const id2 = createHmac("sha256", "tacho.run-token-key-id").update(bytes).digest("hex").slice(0, 16);
+  return { bytes, id: id2 };
+}
+function generateRunTokenKey() {
+  return keyFromBytes(randomBytes4(KEY_BYTES));
+}
+function runTokenKeyFromHex(hex) {
+  const trimmed = hex.trim();
+  if (!/^[0-9a-f]{64}$/i.test(trimmed))
+    throw new Error("run token key file does not hold 64 hex characters");
+  return keyFromBytes(Buffer.from(trimmed, "hex"));
+}
+function loadOrCreateRunTokenKey(path2) {
+  try {
+    return {
+      key: runTokenKeyFromHex(readFileSync6(path2, "utf8")),
+      created: false
+    };
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const key = generateRunTokenKey();
+  writeSensitiveFileAtomic(path2, `${key.bytes.toString("hex")}
+`);
+  return { key, created: true };
+}
+function readRunTokenKey(path2) {
+  const version2 = fileVersion(path2);
+  if (version2 === void 0) {
+    keysSeen.delete(path2);
+    return void 0;
+  }
+  const seen = keysSeen.get(path2);
+  if (seen?.version === version2) return seen.key;
+  let key;
+  try {
+    key = runTokenKeyFromHex(readFileSync6(path2, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  keysSeen.set(path2, { version: version2, key });
+  return key;
+}
+function b64url(bytes) {
+  return bytes.toString("base64url");
+}
+function sign(key, claimsText) {
+  return createHmac("sha256", key.bytes).update(claimsText, "utf8").digest();
+}
+function mintRunToken(options) {
+  const ceiling = options.placement === "static" ? RUN_TOKEN_STATIC_MAX_TTL_MS : RUN_TOKEN_MAX_TTL_MS;
+  const asked = options.ttlMs === void 0 ? options.placement === "static" ? RUN_TOKEN_STATIC_MAX_TTL_MS : RUN_TOKEN_DEFAULT_TTL_MS : options.ttlMs;
+  if (!Number.isFinite(asked) || asked <= 0)
+    throw new Error(`run token ttl must be positive, got ${String(asked)}`);
+  let exp = options.now + Math.min(asked, ceiling);
+  if (options.notAfter !== void 0) exp = Math.min(exp, options.notAfter);
+  if (exp <= options.now)
+    throw new Error("run token would already be expired when minted");
+  const claims = {
+    v: 1,
+    tid: `rt_${randomBytes4(10).toString("hex")}`,
+    host: options.host,
+    harness: options.harness,
+    provider: options.provider,
+    placement: options.placement,
+    iat: options.now,
+    exp
+  };
+  const text5 = jcs(claims);
+  const token = `${RUN_TOKEN_PREFIX}${b64url(Buffer.from(text5, "utf8"))}.${b64url(sign(options.key, text5))}`;
+  return { token, claims };
+}
+function looksLikeRunToken(value) {
+  return typeof value === "string" && value.startsWith(RUN_TOKEN_PREFIX) && value.length < 2048;
+}
+function peekRunTokenClaims(token) {
+  if (!looksLikeRunToken(token)) return void 0;
+  const body2 = token.slice(RUN_TOKEN_PREFIX.length);
+  const dot = body2.indexOf(".");
+  if (dot <= 0) return void 0;
+  try {
+    const parsed2 = JSON.parse(
+      Buffer.from(body2.slice(0, dot), "base64url").toString("utf8")
+    );
+    const claims = runTokenClaimsSchema.safeParse(parsed2);
+    return claims.success ? claims.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyRunToken(token, options) {
+  if (!looksLikeRunToken(token))
+    return { ok: false, code: "run_token_malformed" };
+  const body2 = token.slice(RUN_TOKEN_PREFIX.length);
+  const dot = body2.indexOf(".");
+  if (dot <= 0 || dot === body2.length - 1)
+    return { ok: false, code: "run_token_malformed" };
+  const bodyText = body2.slice(0, dot);
+  let text5;
+  try {
+    text5 = Buffer.from(bodyText, "base64url").toString("utf8");
+  } catch {
+    return { ok: false, code: "run_token_malformed" };
+  }
+  const presented = Buffer.from(body2.slice(dot + 1), "utf8");
+  const expected = Buffer.from(
+    sign(options.key, text5).toString("base64url"),
+    "utf8"
+  );
+  if (presented.length !== expected.length || !timingSafeEqual(presented, expected) || Buffer.from(text5, "utf8").toString("base64url") !== bodyText) {
+    return { ok: false, code: "run_token_invalid", ...peeked(text5) };
+  }
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(text5);
+  } catch {
+    return { ok: false, code: "run_token_malformed" };
+  }
+  const claims = runTokenClaimsSchema.safeParse(parsed2);
+  if (!claims.success) return { ok: false, code: "run_token_malformed" };
+  if (jcs(claims.data) !== text5)
+    return { ok: false, code: "run_token_invalid" };
+  if (claims.data.exp <= options.now)
+    return { ok: false, code: "run_token_expired", claims: claims.data };
+  if (claims.data.host !== options.host || claims.data.provider !== options.provider)
+    return { ok: false, code: "run_token_mismatch", claims: claims.data };
+  return { ok: true, claims: claims.data };
+}
+function peeked(text5) {
+  try {
+    const claims = runTokenClaimsSchema.safeParse(JSON.parse(text5));
+    return claims.success ? { claims: claims.data } : {};
+  } catch {
+    return {};
+  }
+}
+var RUN_TOKEN_PREFIX, RUN_TOKEN_MAX_TTL_MS, RUN_TOKEN_DEFAULT_TTL_MS, RUN_TOKEN_STATIC_MAX_TTL_MS, RUN_TOKEN_PROVIDERS, RUN_TOKEN_PLACEMENTS, runTokenClaimsSchema, KEY_BYTES, keysSeen;
+var init_run_token = __esm({
+  "../../packages/tacho/src/host/run-token.ts"() {
+    "use strict";
+    init_zod();
+    init_digest();
+    init_fs();
+    RUN_TOKEN_PREFIX = "oxrt_";
+    RUN_TOKEN_MAX_TTL_MS = 15 * 6e4;
+    RUN_TOKEN_DEFAULT_TTL_MS = RUN_TOKEN_MAX_TTL_MS;
+    RUN_TOKEN_STATIC_MAX_TTL_MS = 30 * 24 * 60 * 6e4;
+    RUN_TOKEN_PROVIDERS = ["anthropic", "openai"];
+    RUN_TOKEN_PLACEMENTS = ["helper", "static"];
+    runTokenClaimsSchema = external_exports.object({
+      v: external_exports.literal(1),
+      /** `rt_` + 20 hex: cited on frames in place of the token. */
+      tid: external_exports.string().regex(/^rt_[0-9a-f]{20}$/),
+      /** The host enrollment the token was minted for. */
+      host: external_exports.string().min(1).max(64),
+      /** The harness it was handed to. */
+      harness: external_exports.string().min(1).max(32),
+      provider: external_exports.enum(RUN_TOKEN_PROVIDERS),
+      placement: external_exports.enum(RUN_TOKEN_PLACEMENTS),
+      /** Epoch milliseconds. */
+      iat: external_exports.number().int().nonnegative(),
+      exp: external_exports.number().int().nonnegative()
+    }).strict();
+    KEY_BYTES = 32;
+    keysSeen = /* @__PURE__ */ new Map();
+  }
+});
+
+// ../../packages/tacho/src/host/credential-store.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes5 } from "node:crypto";
+import {
+  closeSync as closeSync4,
+  existsSync as existsSync5,
+  fsyncSync as fsyncSync3,
+  openSync as openSync4,
+  readFileSync as readFileSync7,
+  statSync as statSync3,
+  unlinkSync as unlinkSync4,
+  writeSync as writeSync3
+} from "node:fs";
+function anthropicCredentialKind(secret, fallback) {
+  return secret.trim().startsWith(CLAUDE_OAUTH_TOKEN_PREFIX) ? "oauth" : fallback;
+}
+function readKey(path2) {
+  try {
+    const hex = readFileSync7(path2, "utf8").trim();
+    if (!/^[0-9a-f]{64}$/i.test(hex))
+      throw new Error(`${path2} does not hold a 32-byte key`);
+    return Buffer.from(hex, "hex");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function loadOrCreateKey(path2) {
+  const existing = readKey(path2);
+  if (existing !== void 0) return existing;
+  const key = randomBytes5(KEY_BYTES2);
+  writeSensitiveFileAtomic(path2, `${key.toString("hex")}
+`);
+  return key;
+}
+function requireKey(path2) {
+  const key = readKey(path2);
+  if (key === void 0)
+    throw new Error(
+      `${path2} is missing, so the credentials in custody cannot be opened`
+    );
+  return key;
+}
+function overwriteInPlace(path2) {
+  let fd2;
+  try {
+    const size = statSync3(path2).size;
+    fd2 = openSync4(path2, "r+");
+    writeSync3(fd2, randomBytes5(Math.max(size, KEY_BYTES2 * 2)), 0, void 0, 0);
+    fsyncSync3(fd2);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  } finally {
+    if (fd2 !== void 0) closeSync4(fd2);
+  }
+}
+function seal(key, secret, aad) {
+  const nonce = randomBytes5(12);
+  const cipher = createCipheriv("aes-256-gcm", key, nonce);
+  cipher.setAAD(Buffer.from(aad, "utf8"));
+  const ciphertext = Buffer.concat([
+    cipher.update(secret, "utf8"),
+    cipher.final()
+  ]);
+  return {
+    nonce: nonce.toString("base64"),
+    ciphertext: ciphertext.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64")
+  };
+}
+function open(key, sealed, aad) {
+  const decipher = createDecipheriv(
+    "aes-256-gcm",
+    key,
+    Buffer.from(sealed.nonce, "base64")
+  );
+  decipher.setAAD(Buffer.from(aad, "utf8"));
+  decipher.setAuthTag(Buffer.from(sealed.tag, "base64"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(sealed.ciphertext, "base64")),
+    decipher.final()
+  ]).toString("utf8");
+}
+function credentialPrefix(secret) {
+  const head2 = secret.slice(0, Math.min(8, Math.max(0, secret.length - 4)));
+  return head2.length > 0 ? `${head2}\u2026` : "";
+}
+function custodyOf(entry2) {
+  return {
+    provider: entry2.provider,
+    kind: entry2.kind,
+    source: entry2.source,
+    taken_at: entry2.taken_at,
+    prefix: entry2.prefix
+  };
+}
+function openCredentialStore(paths) {
+  let entriesSeen;
+  let keySeen;
+  const keyForWrite = () => loadOrCreateKey(paths.key);
+  function forgetKey() {
+    keySeen?.key.fill(0);
+    keySeen = void 0;
+  }
+  function keyForRead() {
+    const version2 = fileVersion(paths.key);
+    if (version2 !== void 0 && keySeen?.version === version2)
+      return keySeen.key;
+    forgetKey();
+    const key = requireKey(paths.key);
+    if (version2 !== void 0) keySeen = { version: version2, key };
+    return key;
+  }
+  function readAll() {
+    const version2 = fileVersion(paths.file);
+    if (version2 === void 0) {
+      entriesSeen = void 0;
+      forgetKey();
+      return [];
+    }
+    if (entriesSeen?.version === version2) return entriesSeen.entries;
+    let text5;
+    try {
+      text5 = readFileSync7(paths.file, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    }
+    let raw;
+    try {
+      raw = JSON.parse(text5);
+    } catch (error) {
+      throw new Error(
+        `${paths.file} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    const parsed2 = fileSchema.safeParse(raw);
+    if (!parsed2.success)
+      throw new Error(
+        `${paths.file} is not a credential store this build can read: ${parsed2.error.issues[0]?.message ?? "invalid"}`
+      );
+    entriesSeen = { version: version2, entries: parsed2.data.entries };
+    return parsed2.data.entries;
+  }
+  function writeAll2(entries2) {
+    if (entries2.length === 0) {
+      if (existsSync5(paths.file)) unlinkSync4(paths.file);
+      return;
+    }
+    writeSensitiveFileAtomic(
+      paths.file,
+      `${JSON.stringify({ schema: CREDENTIAL_STORE_SCHEMA, entries: entries2 }, null, 2)}
+`
+    );
+  }
+  return {
+    has: (provider) => readAll().some((e) => e.provider === provider),
+    read: (provider) => {
+      const entry2 = readAll().find((e) => e.provider === provider);
+      if (entry2 === void 0) return void 0;
+      return {
+        kind: entry2.kind,
+        secret: open(
+          keyForRead(),
+          entry2.sealed,
+          `${CREDENTIAL_STORE_SCHEMA}:${provider}`
+        )
+      };
+    },
+    take: (provider, { kind, secret }, source, now) => {
+      if (secret.trim().length === 0)
+        throw new Error("refusing to take an empty credential into custody");
+      const entry2 = {
+        provider,
+        kind,
+        source,
+        taken_at: new Date(now).toISOString(),
+        // A ChatGPT login is JSON, whose head says nothing; it is named.
+        prefix: kind === "chatgpt" ? "login" : credentialPrefix(secret),
+        sealed: seal(
+          keyForWrite(),
+          secret,
+          `${CREDENTIAL_STORE_SCHEMA}:${provider}`
+        )
+      };
+      writeAll2([...readAll().filter((e) => e.provider !== provider), entry2]);
+      return custodyOf(entry2);
+    },
+    release: (provider) => {
+      const entries2 = readAll();
+      const entry2 = entries2.find((e) => e.provider === provider);
+      if (entry2 === void 0) return void 0;
+      const secret = open(
+        keyForRead(),
+        entry2.sealed,
+        `${CREDENTIAL_STORE_SCHEMA}:${provider}`
+      );
+      writeAll2(entries2.filter((e) => e.provider !== provider));
+      return { kind: entry2.kind, secret };
+    },
+    status: () => readAll().map(custodyOf),
+    shred: () => {
+      let overwrite;
+      try {
+        overwriteInPlace(paths.key);
+      } catch (error) {
+        overwrite = error;
+      }
+      for (const path2 of [paths.file, paths.key])
+        if (existsSync5(path2)) unlinkSync4(path2);
+      entriesSeen = void 0;
+      forgetKey();
+      if (overwrite !== void 0)
+        throw new Error(
+          `${paths.key} was deleted but could not be overwritten first: ${overwrite instanceof Error ? overwrite.message : String(overwrite)}`
+        );
+    }
+  };
+}
+var CREDENTIAL_STORE_SCHEMA, CREDENTIAL_SOURCES, CREDENTIAL_KINDS, CLAUDE_OAUTH_TOKEN_PREFIX, sealedSchema, entrySchema, fileSchema, KEY_BYTES2;
+var init_credential_store = __esm({
+  "../../packages/tacho/src/host/credential-store.ts"() {
+    "use strict";
+    init_zod();
+    init_fs();
+    init_run_token();
+    CREDENTIAL_STORE_SCHEMA = "tacho.credentials.v1";
+    CREDENTIAL_SOURCES = [
+      /** `env.ANTHROPIC_API_KEY` in Claude Code's user settings. */
+      "claude-code:settings.env",
+      /** `OPENAI_API_KEY`, or the ChatGPT login's `tokens`, in Codex's `auth.json`. */
+      "codex:auth.json",
+      /** A ChatGPT login the gateway refreshed, replacing the one it took. */
+      "chatgpt:refresh",
+      /**
+       * `TACHO_BROKER_<PROVIDER>_API_KEY`, or `CLAUDE_CODE_OAUTH_TOKEN`, in the
+       * enrolling shell.
+       */
+      "enroll:env",
+      /**
+       * The subscription token `claude setup-token` printed, which
+       * `oxagen credential login` took straight into custody.
+       */
+      "claude:setup-token",
+      /**
+       * The run token in an Oxagen Agent Runners sandbox's `launch` message. It
+       * is spent at the cloud gateway, which attaches the operator's model
+       * credential. It is not a model credential itself.
+       */
+      "sandbox:launch"
+    ];
+    CREDENTIAL_KINDS = [
+      "api_key",
+      "bearer",
+      "oauth",
+      "chatgpt"
+    ];
+    CLAUDE_OAUTH_TOKEN_PREFIX = "sk-ant-oat";
+    sealedSchema = external_exports.object({
+      /** AES-256-GCM: 12-byte nonce, ciphertext, 16-byte tag, all base64. */
+      nonce: external_exports.string().min(1),
+      ciphertext: external_exports.string().min(1),
+      tag: external_exports.string().min(1)
+    }).strict();
+    entrySchema = external_exports.object({
+      provider: external_exports.enum(RUN_TOKEN_PROVIDERS),
+      kind: external_exports.enum(CREDENTIAL_KINDS),
+      source: external_exports.enum(CREDENTIAL_SOURCES),
+      taken_at: external_exports.string(),
+      /** The first few characters, the way a vendor console shows a key. */
+      prefix: external_exports.string().max(12),
+      sealed: sealedSchema
+    }).strict();
+    fileSchema = external_exports.object({
+      schema: external_exports.literal(CREDENTIAL_STORE_SCHEMA),
+      entries: external_exports.array(entrySchema)
+    }).strict();
+    KEY_BYTES2 = 32;
+  }
+});
+
+// ../../packages/tacho/src/host/claude-setup-token.ts
+import { spawn } from "node:child_process";
+import { accessSync as accessSync2, constants as constants2 } from "node:fs";
+import { delimiter, join as join13 } from "node:path";
+function isSubscriptionToken(value) {
+  return TOKEN.test(value.trim());
+}
+function extractSetupToken(output) {
+  const lines = output.replace(ANSI, "").split(/\r?\n|\r/).map((line) => line.trim());
+  let found;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const start = line.lastIndexOf(CLAUDE_OAUTH_TOKEN_PREFIX);
+    if (start < 0) continue;
+    let token = "";
+    for (const char of line.slice(start)) {
+      if (!TOKEN_CHAR.test(char)) break;
+      token += char;
+    }
+    if (token.length === line.length - start)
+      for (let j = i2 + 1; j < lines.length; j++) {
+        const next = lines[j];
+        if (next.length === 0 || ![...next].every((c) => TOKEN_CHAR.test(c)))
+          break;
+        token += next;
+      }
+    if (isSubscriptionToken(token)) found = token;
+  }
+  return found;
+}
+function findClaudeBinary(env, home) {
+  return findHarnessBinary("claude", env, home);
+}
+function findHarnessBinary(name, env, home) {
+  const file = process.platform === "win32" ? `${name}.exe` : name;
+  const candidates = [
+    ...(env["PATH"] ?? "").split(delimiter).filter((d) => d.length > 0),
+    join13(home, ".local", "bin"),
+    join13(home, ".claude", "local"),
+    join13(home, ".npm-global", "bin"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin"
+  ].map((dir) => join13(dir, file));
+  for (const path2 of candidates) {
+    try {
+      accessSync2(path2, constants2.X_OK);
+      return path2;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function setupTokenCommand(claude, platform) {
+  const quoted3 = `'${claude.replace(/'/g, `'\\''`)}'`;
+  const inner = `stty cols 1000 2>/dev/null; exec ${quoted3} setup-token`;
+  if (platform === "darwin")
+    return { file: "script", args: ["-q", "/dev/null", "sh", "-c", inner] };
+  if (platform === "linux")
+    return { file: "script", args: ["-q", "-e", "-c", inner, "/dev/null"] };
+  return void 0;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function setupTokenShellLine(claude, platform) {
+  const command2 = setupTokenCommand(claude, platform);
+  if (command2 === void 0) return void 0;
+  const script = [command2.file, ...command2.args].map(shellQuote).join(" ");
+  return `sleep 2147483647 | { ${script}; echo "${SETUP_TOKEN_EXIT_MARK}$?"; }`;
+}
+function runClaudeSetupToken(options) {
+  const command2 = setupTokenCommand(
+    options.claude,
+    options.platform ?? process.platform
+  );
+  return new Promise((resolve25, reject) => {
+    if (command2 === void 0) {
+      const child2 = spawn(options.claude, ["setup-token"], {
+        stdio: "inherit",
+        env: options.env ?? process.env
+      });
+      child2.on("error", reject);
+      child2.on(
+        "close",
+        (code) => resolve25({ token: void 0, code: code ?? 1, captured: false })
+      );
+      return;
+    }
+    const env = options.env ?? process.env;
+    if (options.interactive) {
+      const child2 = spawn(command2.file, command2.args, {
+        stdio: ["inherit", "pipe", "inherit"],
+        env
+      });
+      let output2 = "";
+      child2.stdout?.setEncoding("utf8");
+      child2.stdout?.on("data", (chunk2) => {
+        output2 += chunk2;
+        options.write(chunk2);
+      });
+      child2.on("error", reject);
+      child2.on(
+        "close",
+        (code) => resolve25({
+          token: extractSetupToken(output2),
+          code: code ?? 1,
+          captured: true
+        })
+      );
+      return;
+    }
+    const line = setupTokenShellLine(
+      options.claude,
+      options.platform ?? process.platform
+    );
+    const child = spawn("sh", ["-c", line], {
+      detached: true,
+      stdio: ["ignore", "pipe", "inherit"],
+      env
+    });
+    let output = "";
+    let exited;
+    const mark = new RegExp(`${SETUP_TOKEN_EXIT_MARK}(\\d+)`);
+    const stopGroup = () => {
+      try {
+        if (child.pid !== void 0) process.kill(-child.pid, "SIGTERM");
+      } catch {
+      }
+    };
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk2) => {
+      output += chunk2;
+      const found = mark.exec(output);
+      options.write(chunk2.replace(mark, "").replace(SETUP_TOKEN_EXIT_MARK, ""));
+      if (found !== null && exited === void 0) {
+        exited = Number(found[1]);
+        stopGroup();
+      }
+    });
+    child.on("error", reject);
+    child.on(
+      "close",
+      (code) => resolve25({
+        token: extractSetupToken(output.replace(mark, "")),
+        code: exited ?? code ?? 1,
+        captured: true
+      })
+    );
+  });
+}
+var TOKEN, TOKEN_CHAR, ANSI, SETUP_TOKEN_EXIT_MARK;
+var init_claude_setup_token = __esm({
+  "../../packages/tacho/src/host/claude-setup-token.ts"() {
+    "use strict";
+    init_credential_store();
+    TOKEN = /^sk-ant-oat\d{2}-[A-Za-z0-9_-]{20,}$/;
+    TOKEN_CHAR = /[A-Za-z0-9_-]/;
+    ANSI = // biome-ignore lint/suspicious/noControlCharactersInRegex: terminal escapes
+    /\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)|\u001b\[[0-?]*[ -/]*[@-~]|\u001b[@-Z\\-_]/g;
+    SETUP_TOKEN_EXIT_MARK = "__oxagen_setup_token_exit__=";
+  }
+});
+
 // ../../packages/tacho/src/host/model-base-url-toml.ts
 function splitLines(text5) {
   const lines = [];
@@ -22539,8 +23174,8 @@ var init_model_base_url_toml = __esm({
 });
 
 // ../../packages/tacho/src/host/model-base-url.ts
-import { chmodSync as chmodSync3, existsSync as existsSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync4 } from "node:fs";
-import { basename as basename4, dirname as dirname7, join as join13 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync6, readFileSync as readFileSync8, unlinkSync as unlinkSync5 } from "node:fs";
+import { basename as basename4, dirname as dirname7, join as join14 } from "node:path";
 function claudeToolSearchEnabled(value) {
   return typeof value === "string" && /^(true|auto(:\d+)?)$/i.test(value);
 }
@@ -22554,19 +23189,19 @@ function isModelProxyBaseUrl(harness, value) {
 }
 function modelBaseUrlFile(harness, homes) {
   if (harness === "claude-code")
-    return join13(
+    return join14(
       homes.claudeConfigDir ?? harnessConfigDirs(homes.home).claudeConfigDir,
       "settings.json"
     );
   if (harness === "codex")
-    return join13(
+    return join14(
       homes.codexHome ?? harnessConfigDirs(homes.home).codexHome,
       "config.toml"
     );
-  const stellaHome = homes.stellaHome ?? join13(homes.home, ".stella");
-  const toml = join13(stellaHome, "stella.toml");
-  const json2 = join13(stellaHome, "settings.json");
-  return !existsSync5(toml) && existsSync5(json2) ? json2 : toml;
+  const stellaHome = homes.stellaHome ?? join14(homes.home, ".stella");
+  const toml = join14(stellaHome, "stella.toml");
+  const json2 = join14(stellaHome, "settings.json");
+  return !existsSync6(toml) && existsSync6(json2) ? json2 : toml;
 }
 function keyLabel(harness) {
   if (harness === "claude-code") return `env.${CLAUDE_KEY}`;
@@ -22576,7 +23211,7 @@ function isJsonFile(file) {
   return file.endsWith(".json");
 }
 function sidecarBeside(file, contract) {
-  return join13(dirname7(file), `.${basename4(file)}.${contract}.json`);
+  return join14(dirname7(file), `.${basename4(file)}.${contract}.json`);
 }
 function sidecarFor(file) {
   return sidecarBeside(file, "oxagen-model-base-url");
@@ -22707,9 +23342,9 @@ function stellaManagedSettingsPath(platform = process.platform, env = process.en
   const named = env["STELLA_MANAGED_SETTINGS"];
   if (named !== void 0 && named.length > 0) return named;
   const dir = platform === "darwin" ? "/Library/Application Support/stella" : "/etc/stella";
-  const toml = join13(dir, "stella.toml");
-  const json2 = join13(dir, "settings.json");
-  return !existsSync5(toml) && existsSync5(json2) ? json2 : toml;
+  const toml = join14(dir, "stella.toml");
+  const json2 = join14(dir, "settings.json");
+  return !existsSync6(toml) && existsSync6(json2) ? json2 : toml;
 }
 function managedShadow(harness, managedFile, expected) {
   try {
@@ -22917,7 +23552,7 @@ function describe3(harness, options, { changed, text: text5, sidecar, unreadable
 }
 function readBytesIfExists(path2) {
   try {
-    return readFileSync6(path2);
+    return readFileSync8(path2);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -23031,7 +23666,7 @@ function restoreOne(harness, options) {
   const { sidecar, unreadable } = sidecarOrWhy(backup, harness);
   const text5 = readTextIfExists(file);
   const dropSidecar = () => {
-    if (existsSync5(backup)) unlinkSync4(backup);
+    if (existsSync6(backup)) unlinkSync5(backup);
   };
   const after = (changed, left) => ({
     changed,
@@ -23050,7 +23685,7 @@ function restoreOne(harness, options) {
       writeFileAtomicPreserving(file, original);
       left = original.toString("utf8");
     } else {
-      unlinkSync4(file);
+      unlinkSync5(file);
     }
     dropSidecar();
     return after(true, left);
@@ -23163,186 +23798,66 @@ var init_model_base_url = __esm({
   }
 });
 
-// ../../packages/tacho/src/host/run-token.ts
-import { createHmac, randomBytes as randomBytes4, timingSafeEqual } from "node:crypto";
-import { readFileSync as readFileSync7 } from "node:fs";
-function keyFromBytes(bytes) {
-  if (bytes.length !== KEY_BYTES)
-    throw new Error(
-      `run token key must be ${KEY_BYTES} bytes, got ${bytes.length}`
-    );
-  const id2 = createHmac("sha256", "tacho.run-token-key-id").update(bytes).digest("hex").slice(0, 16);
-  return { bytes, id: id2 };
-}
-function generateRunTokenKey() {
-  return keyFromBytes(randomBytes4(KEY_BYTES));
-}
-function runTokenKeyFromHex(hex) {
-  const trimmed = hex.trim();
-  if (!/^[0-9a-f]{64}$/i.test(trimmed))
-    throw new Error("run token key file does not hold 64 hex characters");
-  return keyFromBytes(Buffer.from(trimmed, "hex"));
+// ../../packages/tacho/src/host/model-credential.ts
+import { chmodSync as chmodSync4, existsSync as existsSync7, lstatSync as lstatSync2, unlinkSync as unlinkSync6 } from "node:fs";
+import { join as join15 } from "node:path";
+function claudeMemberFor(kind) {
+  return kind === "oauth" ? CLAUDE_OAUTH_TOKEN : kind === "bearer" ? CLAUDE_AUTH_TOKEN : CLAUDE_API_KEY;
 }
-function loadOrCreateRunTokenKey(path2) {
-  try {
-    return {
-      key: runTokenKeyFromHex(readFileSync7(path2, "utf8")),
-      created: false
-    };
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+function claudeEnvCredentials(env) {
+  const found = [];
+  for (const [member3, kind] of CLAUDE_MEMBERS) {
+    const value = env[member3];
+    if (isSecret(value))
+      found.push({
+        member: member3,
+        credential: {
+          kind: anthropicCredentialKind(value, kind),
+          secret: value
+        }
+      });
   }
-  const key = generateRunTokenKey();
-  writeSensitiveFileAtomic(path2, `${key.bytes.toString("hex")}
-`);
-  return { key, created: true };
+  return found;
 }
-function readRunTokenKey(path2) {
-  const version2 = fileVersion(path2);
-  if (version2 === void 0) {
-    keysSeen.delete(path2);
+function chatGptTokensOf(auth) {
+  const tokens = auth[CODEX_TOKENS];
+  if (typeof tokens !== "object" || tokens === null || Array.isArray(tokens))
     return void 0;
-  }
-  const seen = keysSeen.get(path2);
-  if (seen?.version === version2) return seen.key;
-  let key;
-  try {
-    key = runTokenKeyFromHex(readFileSync7(path2, "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
-  }
-  keysSeen.set(path2, { version: version2, key });
-  return key;
-}
-function b64url(bytes) {
-  return bytes.toString("base64url");
-}
-function sign(key, claimsText) {
-  return createHmac("sha256", key.bytes).update(claimsText, "utf8").digest();
+  const record = tokens;
+  return isSecret(record["access_token"]) ? record : void 0;
 }
-function mintRunToken(options) {
-  const ceiling = options.placement === "static" ? RUN_TOKEN_STATIC_MAX_TTL_MS : RUN_TOKEN_MAX_TTL_MS;
-  const asked = options.ttlMs === void 0 ? options.placement === "static" ? RUN_TOKEN_STATIC_MAX_TTL_MS : RUN_TOKEN_DEFAULT_TTL_MS : options.ttlMs;
-  if (!Number.isFinite(asked) || asked <= 0)
-    throw new Error(`run token ttl must be positive, got ${String(asked)}`);
-  let exp = options.now + Math.min(asked, ceiling);
-  if (options.notAfter !== void 0) exp = Math.min(exp, options.notAfter);
-  if (exp <= options.now)
-    throw new Error("run token would already be expired when minted");
-  const claims = {
-    v: 1,
-    tid: `rt_${randomBytes4(10).toString("hex")}`,
-    host: options.host,
-    harness: options.harness,
-    provider: options.provider,
-    placement: options.placement,
-    iat: options.now,
-    exp
+function encodeChatGptLogin(tokens) {
+  const login = {
+    access_token: tokens["access_token"],
+    refresh_token: typeof tokens["refresh_token"] === "string" ? tokens["refresh_token"] : ""
   };
-  const text5 = jcs(claims);
-  const token = `${RUN_TOKEN_PREFIX}${b64url(Buffer.from(text5, "utf8"))}.${b64url(sign(options.key, text5))}`;
-  return { token, claims };
-}
-function looksLikeRunToken(value) {
-  return typeof value === "string" && value.startsWith(RUN_TOKEN_PREFIX) && value.length < 2048;
+  if (typeof tokens["id_token"] === "string")
+    login.id_token = tokens["id_token"];
+  if (typeof tokens["account_id"] === "string")
+    login.account_id = tokens["account_id"];
+  return JSON.stringify(login);
 }
-function peekRunTokenClaims(token) {
-  if (!looksLikeRunToken(token)) return void 0;
-  const body2 = token.slice(RUN_TOKEN_PREFIX.length);
-  const dot = body2.indexOf(".");
-  if (dot <= 0) return void 0;
+function decodeChatGptLogin(secret) {
   try {
-    const parsed2 = JSON.parse(
-      Buffer.from(body2.slice(0, dot), "base64url").toString("utf8")
-    );
-    const claims = runTokenClaimsSchema.safeParse(parsed2);
-    return claims.success ? claims.data : void 0;
+    const raw = JSON.parse(secret);
+    if (typeof raw.access_token !== "string" || raw.access_token.length === 0)
+      return void 0;
+    return {
+      access_token: raw.access_token,
+      refresh_token: typeof raw.refresh_token === "string" ? raw.refresh_token : "",
+      ...typeof raw.id_token === "string" ? { id_token: raw.id_token } : {},
+      ...typeof raw.account_id === "string" ? { account_id: raw.account_id } : {}
+    };
   } catch {
     return void 0;
   }
 }
-function verifyRunToken(token, options) {
-  if (!looksLikeRunToken(token))
-    return { ok: false, code: "run_token_malformed" };
-  const body2 = token.slice(RUN_TOKEN_PREFIX.length);
-  const dot = body2.indexOf(".");
-  if (dot <= 0 || dot === body2.length - 1)
-    return { ok: false, code: "run_token_malformed" };
-  const bodyText = body2.slice(0, dot);
-  let text5;
-  try {
-    text5 = Buffer.from(bodyText, "base64url").toString("utf8");
-  } catch {
-    return { ok: false, code: "run_token_malformed" };
-  }
-  const presented = Buffer.from(body2.slice(dot + 1), "utf8");
-  const expected = Buffer.from(
-    sign(options.key, text5).toString("base64url"),
-    "utf8"
-  );
-  if (presented.length !== expected.length || !timingSafeEqual(presented, expected) || Buffer.from(text5, "utf8").toString("base64url") !== bodyText) {
-    return { ok: false, code: "run_token_invalid", ...peeked(text5) };
-  }
-  let parsed2;
-  try {
-    parsed2 = JSON.parse(text5);
-  } catch {
-    return { ok: false, code: "run_token_malformed" };
-  }
-  const claims = runTokenClaimsSchema.safeParse(parsed2);
-  if (!claims.success) return { ok: false, code: "run_token_malformed" };
-  if (jcs(claims.data) !== text5)
-    return { ok: false, code: "run_token_invalid" };
-  if (claims.data.exp <= options.now)
-    return { ok: false, code: "run_token_expired", claims: claims.data };
-  if (claims.data.host !== options.host || claims.data.provider !== options.provider)
-    return { ok: false, code: "run_token_mismatch", claims: claims.data };
-  return { ok: true, claims: claims.data };
-}
-function peeked(text5) {
-  try {
-    const claims = runTokenClaimsSchema.safeParse(JSON.parse(text5));
-    return claims.success ? { claims: claims.data } : {};
-  } catch {
-    return {};
-  }
+function codexTokenMember(auth) {
+  const tokens = chatGptTokensOf(auth);
+  if (tokens !== void 0) return tokens["access_token"];
+  const key = auth[CODEX_KEY2];
+  return typeof key === "string" ? key : void 0;
 }
-var RUN_TOKEN_PREFIX, RUN_TOKEN_MAX_TTL_MS, RUN_TOKEN_DEFAULT_TTL_MS, RUN_TOKEN_STATIC_MAX_TTL_MS, RUN_TOKEN_PROVIDERS, RUN_TOKEN_PLACEMENTS, runTokenClaimsSchema, KEY_BYTES, keysSeen;
-var init_run_token = __esm({
-  "../../packages/tacho/src/host/run-token.ts"() {
-    "use strict";
-    init_zod();
-    init_digest();
-    init_fs();
-    RUN_TOKEN_PREFIX = "oxrt_";
-    RUN_TOKEN_MAX_TTL_MS = 15 * 6e4;
-    RUN_TOKEN_DEFAULT_TTL_MS = RUN_TOKEN_MAX_TTL_MS;
-    RUN_TOKEN_STATIC_MAX_TTL_MS = 30 * 24 * 60 * 6e4;
-    RUN_TOKEN_PROVIDERS = ["anthropic", "openai"];
-    RUN_TOKEN_PLACEMENTS = ["helper", "static"];
-    runTokenClaimsSchema = external_exports.object({
-      v: external_exports.literal(1),
-      /** `rt_` + 20 hex: cited on frames in place of the token. */
-      tid: external_exports.string().regex(/^rt_[0-9a-f]{20}$/),
-      /** The host enrollment the token was minted for. */
-      host: external_exports.string().min(1).max(64),
-      /** The harness it was handed to. */
-      harness: external_exports.string().min(1).max(32),
-      provider: external_exports.enum(RUN_TOKEN_PROVIDERS),
-      placement: external_exports.enum(RUN_TOKEN_PLACEMENTS),
-      /** Epoch milliseconds. */
-      iat: external_exports.number().int().nonnegative(),
-      exp: external_exports.number().int().nonnegative()
-    }).strict();
-    KEY_BYTES = 32;
-    keysSeen = /* @__PURE__ */ new Map();
-  }
-});
-
-// ../../packages/tacho/src/host/model-credential.ts
-import { chmodSync as chmodSync4, existsSync as existsSync6, lstatSync as lstatSync2, unlinkSync as unlinkSync5 } from "node:fs";
-import { join as join14 } from "node:path";
 function isTachoHelper(value) {
   return typeof value === "string" && HELPER_MARK.test(value);
 }
@@ -23350,10 +23865,10 @@ function helperCommandFor(tachoCommand) {
   return `${tachoCommand} credential issue --harness claude-code`;
 }
 function fileFor2(harness, homes) {
-  return harness === "claude-code" ? join14(
+  return harness === "claude-code" ? join15(
     homes.claudeConfigDir ?? harnessConfigDirs(homes.home).claudeConfigDir,
     "settings.json"
-  ) : join14(
+  ) : join15(
     homes.codexHome ?? harnessConfigDirs(homes.home).codexHome,
     "auth.json"
   );
@@ -23396,7 +23911,9 @@ function readSidecar2(path2, harness) {
     existed: parsed2["existed"] === true,
     written_sha256: written2,
     taken: Array.isArray(taken) ? taken.filter(
-      (t) => typeof t === "object" && t !== null && typeof t.member === "string" && (t.kind === "api_key" || t.kind === "bearer")
+      (t) => typeof t === "object" && t !== null && typeof t.member === "string" && CREDENTIAL_KINDS.includes(
+        t.kind
+      )
     ) : []
   };
   if (harness === "codex") return { ...common, harness };
@@ -23419,7 +23936,7 @@ function isSecret(value) {
   return typeof value === "string" && value.length > 0;
 }
 function holdsBothClaudeMembers(env) {
-  return isSecret(env[CLAUDE_API_KEY]) && isSecret(env[CLAUDE_AUTH_TOKEN]);
+  return CLAUDE_MEMBERS.filter(([member3]) => isSecret(env[member3])).length > 1;
 }
 function managedHelperShadow(managedFile, expected) {
   try {
@@ -23469,7 +23986,7 @@ function describe4(harness, options, { changed, text: text5, reason: reason3, un
     const current = settings[HELPER_KEY];
     helper = typeof current === "string" ? current : null;
     const env = envOf(settings) ?? {};
-    brokered = isTachoHelper(current) && typeof env[CLAUDE_API_KEY] !== "string" && typeof env[CLAUDE_AUTH_TOKEN] !== "string";
+    brokered = isTachoHelper(current) && CLAUDE_MEMBERS.every(([member3]) => typeof env[member3] !== "string");
     if (!brokered && holdsBothClaudeMembers(env)) why ??= "two_credentials";
     const managed = managedHelperShadow(
       internals.managedSettingsFile ?? claudeManagedSettingsPath(),
@@ -23479,14 +23996,14 @@ function describe4(harness, options, { changed, text: text5, reason: reason3, un
     if (managed.unreadable !== void 0) unreadable.push(managed.unreadable);
   } else {
     const auth = parseForReport(text5, file, unreadable);
-    const key = auth[CODEX_KEY2];
-    brokered = looksLikeRunToken(typeof key === "string" ? key : void 0);
+    const key = codexTokenMember(auth);
+    brokered = looksLikeRunToken(key);
     if (brokered) {
       const claims = peekRunTokenClaims(key);
       if (claims !== void 0)
         tokenExpiresAt = new Date(claims.exp).toISOString();
     }
-    if (!brokered && why === void 0 && auth["tokens"] !== void 0)
+    if (!brokered && why === void 0 && auth[CODEX_TOKENS] !== void 0)
       why = "subscription_login";
   }
   return {
@@ -23519,21 +24036,15 @@ function applyClaude(options, taken) {
     return { changed: false, text: text5, reason: "two_credentials" };
   const rest = { ...env ?? {} };
   const took = [];
-  for (const [member3, kind] of [
-    [CLAUDE_API_KEY, "api_key"],
-    [CLAUDE_AUTH_TOKEN, "bearer"]
-  ]) {
-    const value = rest[member3];
-    if (isSecret(value)) {
-      taken.push({
-        harness: "claude-code",
-        provider: "anthropic",
-        credential: { kind, secret: value },
-        member: `env.${member3}`
-      });
-      took.push({ member: member3, kind });
-      delete rest[member3];
-    }
+  for (const { member: member3, credential } of claudeEnvCredentials(rest)) {
+    taken.push({
+      harness: "claude-code",
+      provider: "anthropic",
+      credential,
+      member: `env.${member3}`
+    });
+    took.push({ member: member3, kind: credential.kind });
+    delete rest[member3];
   }
   const helperCommand = options.helperCommand;
   if (helperCommand === void 0)
@@ -23581,7 +24092,49 @@ function applyCodex(options, taken) {
   const existing = readSidecar2(backup, "codex");
   const current = auth[CODEX_KEY2];
   const hasKey = typeof current === "string" && current.length > 0;
-  if (auth["tokens"] !== void 0 && !looksLikeRunToken(typeof current === "string" ? current : void 0)) {
+  const tokens = chatGptTokensOf(auth);
+  if (tokens !== void 0) {
+    const access2 = tokens["access_token"];
+    const ours = looksLikeRunToken(access2);
+    if (!ours)
+      taken.push({
+        harness: "codex",
+        provider: "openai",
+        credential: { kind: "chatgpt", secret: encodeChatGptLogin(tokens) },
+        member: CODEX_TOKENS
+      });
+    if (token === void 0) {
+      if (!ours) taken.pop();
+      return { changed: false, text: text5, reason: "no_token" };
+    }
+    if (access2 === token && existing !== void 0)
+      return { changed: false, text: text5 };
+    auth[CODEX_TOKENS] = {
+      ...tokens,
+      access_token: token,
+      refresh_token: CHATGPT_REFRESH_HELD
+    };
+    auth[CODEX_LAST_REFRESH] = (/* @__PURE__ */ new Date()).toISOString();
+    const next2 = serializeJsonLike(text5, auth);
+    const sidecar2 = existing ? {
+      ...existing,
+      written_sha256: sha256Hex(next2),
+      taken: [
+        ...existing.taken.filter((t) => t.member !== CODEX_TOKENS),
+        { member: CODEX_TOKENS, kind: "chatgpt" }
+      ]
+    } : {
+      schema: SIDECAR_SCHEMA2,
+      harness: "codex",
+      existed: true,
+      written_sha256: sha256Hex(next2),
+      taken: [{ member: CODEX_TOKENS, kind: "chatgpt" }]
+    };
+    writeSidecar(backup, sidecar2);
+    writeFileAtomicPreserving(file, next2);
+    return { changed: true, text: next2 };
+  }
+  if (auth[CODEX_TOKENS] !== void 0 && !looksLikeRunToken(typeof current === "string" ? current : void 0)) {
     return { changed: false, text: text5, reason: "subscription_login" };
   }
   if (hasKey && !looksLikeRunToken(current)) {
@@ -23616,11 +24169,11 @@ function restoreClaude(options, released, sidecar) {
   const backup = sidecarFor2(file);
   const text5 = readTextIfExists(file);
   const dropSidecar = () => {
-    if (existsSync6(backup)) unlinkSync5(backup);
+    if (existsSync7(backup)) unlinkSync6(backup);
   };
   if (text5 === void 0) {
     if (released !== void 0) {
-      const member3 = released.kind === "bearer" ? CLAUDE_AUTH_TOKEN : CLAUDE_API_KEY;
+      const member3 = claudeMemberFor(released.kind);
       const written2 = serializeJsonLike(void 0, {
         env: { [member3]: released.secret }
       });
@@ -23640,11 +24193,11 @@ function restoreClaude(options, released, sidecar) {
     touched = true;
   }
   const current = envOf(settings);
-  const foreignKey = current !== void 0 && (isSecret(current[CLAUDE_API_KEY]) || isSecret(current[CLAUDE_AUTH_TOKEN]));
+  const foreignKey = current !== void 0 && CLAUDE_MEMBERS.some(([member3]) => isSecret(current[member3]));
   const why = foreignKey ? { reason: "foreign_key_present" } : {};
   let secretRestored = false;
   if (released !== void 0 && !foreignKey) {
-    const member3 = sidecar?.taken.find((t) => t.kind === released.kind)?.member ?? (released.kind === "bearer" ? CLAUDE_AUTH_TOKEN : CLAUDE_API_KEY);
+    const member3 = sidecar?.taken.find((t) => t.kind === released.kind)?.member ?? claudeMemberFor(released.kind);
     const env = { ...current ?? {} };
     env[member3] = released.secret;
     settings["env"] = env;
@@ -23674,7 +24227,7 @@ function restoreCodex(options, released, sidecar) {
   const backup = sidecarFor2(file);
   const text5 = readTextIfExists(file);
   const dropSidecar = () => {
-    if (existsSync6(backup)) unlinkSync5(backup);
+    if (existsSync7(backup)) unlinkSync6(backup);
   };
   if (text5 === void 0) {
     if (released !== void 0) {
@@ -23689,6 +24242,18 @@ function restoreCodex(options, released, sidecar) {
     return { changed: false, text: text5, secretRestored: false };
   }
   const auth = parseJsonObject(text5, file);
+  const tokens = chatGptTokensOf(auth);
+  if (tokens !== void 0 && looksLikeRunToken(tokens["access_token"])) {
+    const login = released?.kind === "chatgpt" ? decodeChatGptLogin(released.secret) : void 0;
+    if (login !== void 0) {
+      auth[CODEX_TOKENS] = { ...tokens, ...login };
+      auth[CODEX_LAST_REFRESH] = (/* @__PURE__ */ new Date()).toISOString();
+    } else delete auth[CODEX_TOKENS];
+    const next2 = serializeJsonLike(text5, auth);
+    writeFileAtomicPreserving(file, next2);
+    dropSidecar();
+    return { changed: true, text: next2, secretRestored: login !== void 0 };
+  }
   const current = auth[CODEX_KEY2];
   if (!looksLikeRunToken(typeof current === "string" ? current : void 0)) {
     dropSidecar();
@@ -23702,7 +24267,7 @@ function restoreCodex(options, released, sidecar) {
   if (released !== void 0) auth[CODEX_KEY2] = released.secret;
   else delete auth[CODEX_KEY2];
   if (sidecar !== void 0 && !sidecar.existed && Object.keys(auth).length === 0) {
-    unlinkSync5(file);
+    unlinkSync6(file);
     dropSidecar();
     return {
       changed: true,
@@ -23765,22 +24330,30 @@ async function peekModelCredentials(options) {
     if (harness === "claude-code") {
       const env = envOf(document) ?? {};
       if (holdsBothClaudeMembers(env)) continue;
-      for (const [member3, kind] of [
-        [CLAUDE_API_KEY, "api_key"],
-        [CLAUDE_AUTH_TOKEN, "bearer"]
-      ]) {
-        const value = env[member3];
-        if (isSecret(value))
+      for (const { member: member3, credential } of claudeEnvCredentials(env))
+        taken.push({
+          harness,
+          provider: "anthropic",
+          credential,
+          member: `env.${member3}`
+        });
+    } else {
+      const tokens = chatGptTokensOf(document);
+      if (tokens !== void 0) {
+        if (!looksLikeRunToken(tokens["access_token"]))
           taken.push({
             harness,
-            provider: "anthropic",
-            credential: { kind, secret: value },
-            member: `env.${member3}`
+            provider: "openai",
+            credential: {
+              kind: "chatgpt",
+              secret: encodeChatGptLogin(tokens)
+            },
+            member: CODEX_TOKENS
           });
+        continue;
       }
-    } else {
       const current = document[CODEX_KEY2];
-      if (document["tokens"] === void 0 && typeof current === "string" && current.length > 0 && !looksLikeRunToken(current))
+      if (document[CODEX_TOKENS] === void 0 && typeof current === "string" && current.length > 0 && !looksLikeRunToken(current))
         taken.push({
           harness,
           provider: "openai",
@@ -23806,8 +24379,8 @@ function hasOrphanedModelCredential(harness, home, dirs = {}) {
   try {
     const document = parseJsonObject(text5, file);
     if (harness === "claude-code") return isTachoHelper(document[HELPER_KEY]);
-    const key = document[CODEX_KEY2];
-    return looksLikeRunToken(typeof key === "string" ? key : void 0);
+    const key = codexTokenMember(document);
+    return looksLikeRunToken(key);
   } catch {
     return text5.includes("credential issue --harness") || text5.includes("oxrt_");
   }
@@ -23829,24 +24402,46 @@ function staticTokenStillGood(token, host, keyPath2, now) {
   });
   return verdict.ok && verdict.claims.exp - now > staticTokenRenewWindowMs(host, now);
 }
+function restateCodexLastRefresh(home, now, dirs = {}) {
+  const file = fileFor2("codex", { ...dirs, home });
+  const text5 = readTextIfExists(file);
+  if (text5 === void 0 || isSymlink(file)) return false;
+  const auth = parseJsonObject(text5, file);
+  const tokens = chatGptTokensOf(auth);
+  if (tokens === void 0 || !looksLikeRunToken(tokens["access_token"]))
+    return false;
+  const last = Date.parse(
+    typeof auth[CODEX_LAST_REFRESH] === "string" ? auth[CODEX_LAST_REFRESH] : ""
+  );
+  if (Number.isFinite(last) && now - last < CODEX_LAST_REFRESH_RESTATE_MS)
+    return false;
+  auth[CODEX_LAST_REFRESH] = new Date(now).toISOString();
+  const next = serializeJsonLike(text5, auth);
+  const backup = sidecarFor2(file);
+  const sidecar = readSidecar2(backup, "codex");
+  if (sidecar !== void 0)
+    writeSidecar(backup, { ...sidecar, written_sha256: sha256Hex(next) });
+  writeFileAtomicPreserving(file, next);
+  return true;
+}
 function readCodexApiKeyMember(home, dirs = {}) {
   const file = fileFor2("codex", { ...dirs, home });
   try {
     const text5 = readTextIfExists(file);
     if (text5 === void 0) return void 0;
-    const value = parseJsonObject(text5, file)[CODEX_KEY2];
-    return typeof value === "string" ? value : void 0;
+    return codexTokenMember(parseJsonObject(text5, file));
   } catch {
     return void 0;
   }
 }
-var HARNESS_PROVIDER, SIDECAR_SCHEMA2, HELPER_KEY, CLAUDE_API_KEY, CLAUDE_AUTH_TOKEN, CODEX_KEY2, HELPER_MARK, STATIC_TOKEN_RENEW_WINDOW_MS;
+var HARNESS_PROVIDER, SIDECAR_SCHEMA2, HELPER_KEY, CLAUDE_API_KEY, CLAUDE_AUTH_TOKEN, CLAUDE_OAUTH_TOKEN, CLAUDE_MEMBERS, CODEX_KEY2, CODEX_TOKENS, CODEX_LAST_REFRESH, CHATGPT_REFRESH_HELD, HELPER_MARK, STATIC_TOKEN_RENEW_WINDOW_MS, CODEX_LAST_REFRESH_RESTATE_MS;
 var init_model_credential = __esm({
   "../../packages/tacho/src/host/model-credential.ts"() {
     "use strict";
     init_digest();
     init_fs();
     init_wire();
+    init_credential_store();
     init_model_base_url();
     init_paths();
     init_run_token();
@@ -23855,14 +24450,24 @@ var init_model_credential = __esm({
     HELPER_KEY = "apiKeyHelper";
     CLAUDE_API_KEY = "ANTHROPIC_API_KEY";
     CLAUDE_AUTH_TOKEN = "ANTHROPIC_AUTH_TOKEN";
+    CLAUDE_OAUTH_TOKEN = "CLAUDE_CODE_OAUTH_TOKEN";
+    CLAUDE_MEMBERS = [
+      [CLAUDE_API_KEY, "api_key"],
+      [CLAUDE_AUTH_TOKEN, "bearer"],
+      [CLAUDE_OAUTH_TOKEN, "oauth"]
+    ];
     CODEX_KEY2 = "OPENAI_API_KEY";
+    CODEX_TOKENS = "tokens";
+    CODEX_LAST_REFRESH = "last_refresh";
+    CHATGPT_REFRESH_HELD = "held-by-oxagen-gateway";
     HELPER_MARK = /\bcredential issue --harness claude-code\s*$/;
     STATIC_TOKEN_RENEW_WINDOW_MS = 7 * 24 * 60 * 6e4;
+    CODEX_LAST_REFRESH_RESTATE_MS = 5 * 24 * 60 * 6e4;
   }
 });
 
 // ../../packages/tacho/src/cli/credential.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 function harnessDirsOf(deps) {
   return {
@@ -23982,15 +24587,15 @@ function describeHarness(entry2) {
   }
   switch (entry2.reason) {
     case "subscription_login":
-      return `${label2}: signed in with a ChatGPT login, which the gateway cannot take into custody; its own login crosses the proxy`;
+      return `${label2}: signed in with a ChatGPT login that crosses the proxy as its own (run \`oxagen credential login --harness codex\` to put it in the gateway's custody)`;
     case "symlink":
       return `${label2}: ${entry2.file} is a symbolic link, so it was left alone; its own credential crosses the proxy`;
     case "no_file":
       return `${label2}: no ${entry2.file} yet; its own credential crosses the proxy`;
     case "two_credentials":
-      return `${label2}: ${entry2.file} sets both ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN in env, and the gateway holds one ${HARNESS_PROVIDER[entry2.harness]} credential; remove one and run \`oxagen agent enroll\` again. Its own credential crosses the proxy`;
+      return `${label2}: ${entry2.file} sets more than one of ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and CLAUDE_CODE_OAUTH_TOKEN in env, and the gateway holds one ${HARNESS_PROVIDER[entry2.harness]} credential; keep one and run \`oxagen agent enroll\` again. Its own credential crosses the proxy`;
     default:
-      return `${label2}: holds its own credential, which crosses the proxy (run \`oxagen agent enroll\` to broker it)`;
+      return entry2.harness === "claude-code" ? `${label2}: holds its own credential, which crosses the proxy (run \`oxagen credential login\` to put your Claude subscription in the gateway's custody)` : `${label2}: holds its own credential, which crosses the proxy (run \`oxagen agent enroll\` to broker it)`;
   }
 }
 async function brokerCredentials(host, harnesses, deps) {
@@ -24018,11 +24623,17 @@ async function brokerCredentials(host, harnesses, deps) {
     if (!offered.has(provider) && typeof fromEnv === "string" && fromEnv.trim().length > 0)
       offered.set(provider, {
         credential: {
-          kind: provider === "anthropic" ? "api_key" : "bearer",
+          kind: provider === "anthropic" ? anthropicCredentialKind(fromEnv, "api_key") : "bearer",
           secret: fromEnv.trim()
         },
         source: "enroll:env"
       });
+    const oauth = deps.env[CLAUDE_OAUTH_TOKEN_ENV]?.trim();
+    if (provider === "anthropic" && !offered.has(provider) && oauth !== void 0 && isSubscriptionToken(oauth))
+      offered.set(provider, {
+        credential: { kind: "oauth", secret: oauth },
+        source: "enroll:env"
+      });
   }
   const takenNow = [];
   const staticTokens = {};
@@ -24033,8 +24644,7 @@ async function brokerCredentials(host, harnesses, deps) {
       takenNow.push(provider);
     }
     if (targets.includes("codex") && store.has("openai")) {
-      const before = (await contract.read({ home: deps.home, harnesses: ["codex"] })).harnesses[0];
-      if (before?.reason !== "subscription_login") {
+      {
         const current = readCodexApiKeyMember(deps.home, harnessDirsOf(deps));
         if (!staticTokenStillGood(
           current,
@@ -24085,7 +24695,7 @@ async function brokerCredentials(host, harnesses, deps) {
           reason: "no_token"
         };
         warnings.push(
-          `${TACHO_HARNESS_LABELS[entry2.harness]} keeps its own login: no ${provider} key was found in ${entry2.file} or ${brokerEnvVar(provider)}, so there is nothing for the gateway to take into custody. A subscription login crosses the proxy as it is`
+          provider === "anthropic" ? `${TACHO_HARNESS_LABELS[entry2.harness]} keeps its own login: the gateway holds no Anthropic credential yet. Run \`oxagen credential login\` to sign in with your Claude subscription, or put a key in ${entry2.file} and enroll again` : `${TACHO_HARNESS_LABELS[entry2.harness]} keeps its own login: no ${provider} key was found in ${entry2.file} or ${brokerEnvVar(provider)}, so there is nothing for the gateway to take into custody`
         );
       }
       continue;
@@ -24131,7 +24741,7 @@ async function restoreCredentials(host, deps, mode = "unenroll", only) {
     try {
       if (host !== void 0 && !host.harnesses.includes(harness)) {
         const dirs = harnessDirsOf(deps);
-        const hasReceipt = existsSync7(
+        const hasReceipt = existsSync8(
           modelCredentialBackupPath(harness, deps.home, dirs)
         );
         if (!hasReceipt && !hasOrphanedModelCredential(harness, deps.home, dirs))
@@ -24141,8 +24751,13 @@ async function restoreCredentials(host, deps, mode = "unenroll", only) {
       const label2 = TACHO_HARNESS_LABELS[harness];
       let released;
       let unreadable;
+      let fromLogin = false;
       try {
-        released = store?.read(provider);
+        fromLogin = store?.status().some(
+          (c) => c.provider === provider && c.source === "claude:setup-token"
+        ) === true;
+        if (fromLogin) store?.release(provider);
+        else released = store?.read(provider);
       } catch (error) {
         unreadable = error instanceof Error ? error.message : String(error);
       }
@@ -24186,10 +24801,200 @@ async function restoreCredentials(host, deps, mode = "unenroll", only) {
   }
   return { restored, failed: failed3, warnings, custodyUnreadable };
 }
-var MODEL_CREDENTIAL_HARNESSES, CREDENTIAL_MODES;
+async function acquireSubscriptionToken(options, deps) {
+  const io = deps.subscriptionLogin;
+  if (options.tokenStdin === true) {
+    const text5 = (await io?.readStdin())?.trim() ?? "";
+    return isSubscriptionToken(text5) ? { token: text5, source: "claude:setup-token" } : {
+      detail: "stdin did not hold a Claude subscription token (sk-ant-oat\u2026). Pipe in what `claude setup-token` printed"
+    };
+  }
+  const fromEnv = deps.env[CLAUDE_OAUTH_TOKEN_ENV]?.trim();
+  if (fromEnv !== void 0 && isSubscriptionToken(fromEnv))
+    return { token: fromEnv, source: "enroll:env" };
+  if (io === void 0)
+    return {
+      detail: `no Claude subscription token: set ${CLAUDE_OAUTH_TOKEN_ENV} or pipe one in with --token-stdin`
+    };
+  const claude = io.findClaude();
+  if (claude === void 0)
+    return {
+      detail: "Claude Code is not installed, so `claude setup-token` cannot run. Install it, or pipe a token in with --token-stdin"
+    };
+  deps.out(
+    "Signing in to your Claude subscription with `claude setup-token`. Finish the sign-in in your browser."
+  );
+  const run3 = await io.runSetupToken(
+    claude,
+    (chunk2) => process.stdout.write(
+      chunk2.replace(/sk-ant-oat[A-Za-z0-9_-]*/g, "sk-ant-oat\u2026 (sent to Oxagen)")
+    )
+  );
+  if (run3.token !== void 0)
+    return { token: run3.token, source: "claude:setup-token" };
+  if (io.interactive) {
+    const pasted = await io.promptSecret(
+      "Paste the token `claude setup-token` printed (sk-ant-oat\u2026): "
+    );
+    if (pasted !== void 0 && isSubscriptionToken(pasted))
+      return { token: pasted, source: "claude:setup-token" };
+    return {
+      detail: pasted === void 0 || pasted.length === 0 ? "no token was pasted" : "that is not a Claude subscription token (sk-ant-oat\u2026)"
+    };
+  }
+  return {
+    detail: run3.code === 0 ? "`claude setup-token` finished, but no token could be read from its output. Run `oxagen credential login` in a terminal" : `\`claude setup-token\` exited with ${run3.code}. Run \`oxagen credential login\` in a terminal`
+  };
+}
+async function signInIfNoCredential(harnesses, deps) {
+  const store = deps.credentialStore;
+  if (harnesses.includes("codex") && store !== void 0 && deps.subscriptionLogin?.interactive === true && !store.has("openai") && (deps.env[brokerEnvVar("openai")]?.trim() ?? "").length === 0 && (await deps.modelCredentials?.peek({
+    home: deps.home,
+    harnesses: ["codex"]
+  }) ?? []).length === 0) {
+    const why = await ensureCodexLogin(deps);
+    if (why !== void 0)
+      deps.err(
+        `warning: ChatGPT sign-in for Codex did not finish (${why}). Run \`oxagen credential login --harness codex\` to try again`
+      );
+  }
+  if (!harnesses.includes("claude-code") || store === void 0 || deps.subscriptionLogin?.interactive !== true || store.has("anthropic"))
+    return;
+  if ([brokerEnvVar("anthropic"), CLAUDE_OAUTH_TOKEN_ENV].some(
+    (name) => (deps.env[name]?.trim() ?? "").length > 0
+  ))
+    return;
+  const inFile = await deps.modelCredentials?.peek({
+    home: deps.home,
+    harnesses: ["claude-code"],
+    helperCommand: deps.runtime.credentialHelperCommand
+  });
+  if ((inFile ?? []).some((t) => t.provider === "anthropic")) return;
+  const acquired = await acquireSubscriptionToken({}, deps);
+  if (acquired.token === void 0) {
+    deps.err(
+      `warning: Claude subscription sign-in did not finish (${acquired.detail}). Run \`oxagen credential login\` to try again`
+    );
+    return;
+  }
+  const custody = store.take(
+    "anthropic",
+    { kind: "oauth", secret: acquired.token },
+    acquired.source,
+    deps.now()
+  );
+  deps.out(
+    `      Claude subscription ${custody.prefix} taken into the gateway's custody`
+  );
+}
+async function routedToGateway(host, harness, deps) {
+  if (deps.modelBaseUrls === void 0) return false;
+  try {
+    const state = await deps.modelBaseUrls.read({
+      home: deps.home,
+      stellaHome: dirname8(deps.paths.stellaToml),
+      port: modelProxyPortFor(host),
+      harnesses: [harness]
+    });
+    const entry2 = state.harnesses.find((h) => h.harness === harness);
+    return entry2?.ours === true && entry2.shadowedBy === void 0;
+  } catch {
+    return false;
+  }
+}
+async function codexHasChatGptLogin(deps) {
+  const offered = await deps.modelCredentials?.peek({
+    home: deps.home,
+    harnesses: ["codex"]
+  });
+  return (offered ?? []).some((t) => t.credential.kind === "chatgpt");
+}
+async function ensureCodexLogin(deps) {
+  if (await codexHasChatGptLogin(deps)) return void 0;
+  const io = deps.subscriptionLogin;
+  const codex = io?.findCodex();
+  if (io === void 0 || codex === void 0)
+    return "Codex is not installed, so `codex login` cannot run. Install it and try again";
+  deps.out(
+    "Signing in to ChatGPT with `codex login`. Finish the sign-in in your browser."
+  );
+  const code = await io.runCodexLogin(codex);
+  if (code !== 0) return `\`codex login\` exited with ${code}`;
+  return await codexHasChatGptLogin(deps) ? void 0 : "`codex login` finished, but ~/.codex/auth.json holds no ChatGPT login";
+}
+async function codexLogin(deps) {
+  const store = deps.credentialStore;
+  const held = store?.status().some(
+    (c) => c.provider === "openai" && c.kind === "chatgpt"
+  );
+  if (held !== true) {
+    const why = await ensureCodexLogin(deps);
+    if (why !== void 0)
+      return { ok: false, harnesses: [], warnings: [], detail: why };
+  }
+  const host = readHostFileLenient(deps.paths.hostFile).host;
+  if (host === void 0 || !host.harnesses.includes("codex") || !await routedToGateway(host, "codex", deps))
+    return {
+      ok: true,
+      harnesses: [],
+      warnings: [],
+      detail: "Codex is signed in to ChatGPT. Run `oxagen agent enroll --harness codex` to route it through the gateway, which then holds the login"
+    };
+  const outcome = await brokerCredentials(host, ["codex"], deps);
+  return {
+    ok: true,
+    source: "codex:auth.json",
+    harnesses: outcome.harnesses,
+    warnings: outcome.warnings,
+    detail: outcome.harnesses.some((h) => h.brokered) ? "Codex now holds a run token, and the gateway sends your ChatGPT login with every call" : "Codex is signed in, but its login stays in its own file. See the warnings above"
+  };
+}
+async function credentialLogin(options, deps) {
+  const store = deps.credentialStore;
+  if (store === void 0)
+    return {
+      ok: false,
+      harnesses: [],
+      warnings: [],
+      detail: "this build holds no credential store"
+    };
+  if (options.harness === "codex") return codexLogin(deps);
+  const acquired = await acquireSubscriptionToken(options, deps);
+  if (acquired.token === void 0)
+    return { ok: false, harnesses: [], warnings: [], detail: acquired.detail };
+  const custody = store.take(
+    "anthropic",
+    { kind: "oauth", secret: acquired.token },
+    acquired.source,
+    deps.now()
+  );
+  deps.out(
+    `Claude subscription ${custody.prefix} taken into the gateway's custody (${deps.paths.credentials})`
+  );
+  const host = readHostFileLenient(deps.paths.hostFile).host;
+  if (host === void 0 || !host.harnesses.includes("claude-code") || !await routedToGateway(host, "claude-code", deps))
+    return {
+      ok: true,
+      source: acquired.source,
+      harnesses: [],
+      warnings: [],
+      detail: "Run `oxagen agent enroll` to route Claude Code through the gateway. It will use this subscription"
+    };
+  const outcome = await brokerCredentials(host, ["claude-code"], deps);
+  return {
+    ok: true,
+    source: acquired.source,
+    harnesses: outcome.harnesses,
+    warnings: outcome.warnings,
+    detail: outcome.harnesses.some((h) => h.brokered) ? "Claude Code now holds a run token, and the gateway sends your subscription with every call" : "The subscription is in custody. Run `oxagen agent enroll` to route Claude Code through the gateway"
+  };
+}
+var MODEL_CREDENTIAL_HARNESSES, CREDENTIAL_MODES, CLAUDE_OAUTH_TOKEN_ENV;
 var init_credential = __esm({
   "../../packages/tacho/src/cli/credential.ts"() {
     "use strict";
+    init_claude_setup_token();
+    init_credential_store();
     init_host_file();
     init_model_credential();
     init_agents();
@@ -24202,11 +25007,12 @@ var init_credential = __esm({
       "brokered",
       "passthrough"
     ];
+    CLAUDE_OAUTH_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
   }
 });
 
 // ../../packages/tacho/src/host/codex-app-server.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 function cmdArgument(value) {
   let quoted3 = "";
   let slashes = 0;
@@ -24244,7 +25050,7 @@ function codexAppServerClient(options) {
     let child;
     try {
       const invocation = spawnInvocation(options.binary, ["app-server"]);
-      child = spawn(invocation.command, invocation.args, {
+      child = spawn2(invocation.command, invocation.args, {
         cwd: options.cwd,
         env: options.env,
         stdio: ["pipe", "pipe", "pipe"],
@@ -24377,266 +25183,6 @@ var init_codex_app_server = __esm({
   }
 });
 
-// ../../packages/tacho/src/host/credential-store.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes5 } from "node:crypto";
-import {
-  closeSync as closeSync4,
-  existsSync as existsSync8,
-  fsyncSync as fsyncSync3,
-  openSync as openSync4,
-  readFileSync as readFileSync8,
-  statSync as statSync3,
-  unlinkSync as unlinkSync6,
-  writeSync as writeSync3
-} from "node:fs";
-function readKey(path2) {
-  try {
-    const hex = readFileSync8(path2, "utf8").trim();
-    if (!/^[0-9a-f]{64}$/i.test(hex))
-      throw new Error(`${path2} does not hold a 32-byte key`);
-    return Buffer.from(hex, "hex");
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
-  }
-}
-function loadOrCreateKey(path2) {
-  const existing = readKey(path2);
-  if (existing !== void 0) return existing;
-  const key = randomBytes5(KEY_BYTES2);
-  writeSensitiveFileAtomic(path2, `${key.toString("hex")}
-`);
-  return key;
-}
-function requireKey(path2) {
-  const key = readKey(path2);
-  if (key === void 0)
-    throw new Error(
-      `${path2} is missing, so the credentials in custody cannot be opened`
-    );
-  return key;
-}
-function overwriteInPlace(path2) {
-  let fd2;
-  try {
-    const size = statSync3(path2).size;
-    fd2 = openSync4(path2, "r+");
-    writeSync3(fd2, randomBytes5(Math.max(size, KEY_BYTES2 * 2)), 0, void 0, 0);
-    fsyncSync3(fd2);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  } finally {
-    if (fd2 !== void 0) closeSync4(fd2);
-  }
-}
-function seal(key, secret, aad) {
-  const nonce = randomBytes5(12);
-  const cipher = createCipheriv("aes-256-gcm", key, nonce);
-  cipher.setAAD(Buffer.from(aad, "utf8"));
-  const ciphertext = Buffer.concat([
-    cipher.update(secret, "utf8"),
-    cipher.final()
-  ]);
-  return {
-    nonce: nonce.toString("base64"),
-    ciphertext: ciphertext.toString("base64"),
-    tag: cipher.getAuthTag().toString("base64")
-  };
-}
-function open(key, sealed, aad) {
-  const decipher = createDecipheriv(
-    "aes-256-gcm",
-    key,
-    Buffer.from(sealed.nonce, "base64")
-  );
-  decipher.setAAD(Buffer.from(aad, "utf8"));
-  decipher.setAuthTag(Buffer.from(sealed.tag, "base64"));
-  return Buffer.concat([
-    decipher.update(Buffer.from(sealed.ciphertext, "base64")),
-    decipher.final()
-  ]).toString("utf8");
-}
-function credentialPrefix(secret) {
-  const head2 = secret.slice(0, Math.min(8, Math.max(0, secret.length - 4)));
-  return head2.length > 0 ? `${head2}\u2026` : "";
-}
-function custodyOf(entry2) {
-  return {
-    provider: entry2.provider,
-    kind: entry2.kind,
-    source: entry2.source,
-    taken_at: entry2.taken_at,
-    prefix: entry2.prefix
-  };
-}
-function openCredentialStore(paths) {
-  let entriesSeen;
-  let keySeen;
-  const keyForWrite = () => loadOrCreateKey(paths.key);
-  function forgetKey() {
-    keySeen?.key.fill(0);
-    keySeen = void 0;
-  }
-  function keyForRead() {
-    const version2 = fileVersion(paths.key);
-    if (version2 !== void 0 && keySeen?.version === version2)
-      return keySeen.key;
-    forgetKey();
-    const key = requireKey(paths.key);
-    if (version2 !== void 0) keySeen = { version: version2, key };
-    return key;
-  }
-  function readAll() {
-    const version2 = fileVersion(paths.file);
-    if (version2 === void 0) {
-      entriesSeen = void 0;
-      forgetKey();
-      return [];
-    }
-    if (entriesSeen?.version === version2) return entriesSeen.entries;
-    let text5;
-    try {
-      text5 = readFileSync8(paths.file, "utf8");
-    } catch (error) {
-      if (error.code === "ENOENT") return [];
-      throw error;
-    }
-    let raw;
-    try {
-      raw = JSON.parse(text5);
-    } catch (error) {
-      throw new Error(
-        `${paths.file} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    const parsed2 = fileSchema.safeParse(raw);
-    if (!parsed2.success)
-      throw new Error(
-        `${paths.file} is not a credential store this build can read: ${parsed2.error.issues[0]?.message ?? "invalid"}`
-      );
-    entriesSeen = { version: version2, entries: parsed2.data.entries };
-    return parsed2.data.entries;
-  }
-  function writeAll2(entries2) {
-    if (entries2.length === 0) {
-      if (existsSync8(paths.file)) unlinkSync6(paths.file);
-      return;
-    }
-    writeSensitiveFileAtomic(
-      paths.file,
-      `${JSON.stringify({ schema: CREDENTIAL_STORE_SCHEMA, entries: entries2 }, null, 2)}
-`
-    );
-  }
-  return {
-    has: (provider) => readAll().some((e) => e.provider === provider),
-    read: (provider) => {
-      const entry2 = readAll().find((e) => e.provider === provider);
-      if (entry2 === void 0) return void 0;
-      return {
-        kind: entry2.kind,
-        secret: open(
-          keyForRead(),
-          entry2.sealed,
-          `${CREDENTIAL_STORE_SCHEMA}:${provider}`
-        )
-      };
-    },
-    take: (provider, { kind, secret }, source, now) => {
-      if (secret.trim().length === 0)
-        throw new Error("refusing to take an empty credential into custody");
-      const entry2 = {
-        provider,
-        kind,
-        source,
-        taken_at: new Date(now).toISOString(),
-        prefix: credentialPrefix(secret),
-        sealed: seal(
-          keyForWrite(),
-          secret,
-          `${CREDENTIAL_STORE_SCHEMA}:${provider}`
-        )
-      };
-      writeAll2([...readAll().filter((e) => e.provider !== provider), entry2]);
-      return custodyOf(entry2);
-    },
-    release: (provider) => {
-      const entries2 = readAll();
-      const entry2 = entries2.find((e) => e.provider === provider);
-      if (entry2 === void 0) return void 0;
-      const secret = open(
-        keyForRead(),
-        entry2.sealed,
-        `${CREDENTIAL_STORE_SCHEMA}:${provider}`
-      );
-      writeAll2(entries2.filter((e) => e.provider !== provider));
-      return { kind: entry2.kind, secret };
-    },
-    status: () => readAll().map(custodyOf),
-    shred: () => {
-      let overwrite;
-      try {
-        overwriteInPlace(paths.key);
-      } catch (error) {
-        overwrite = error;
-      }
-      for (const path2 of [paths.file, paths.key])
-        if (existsSync8(path2)) unlinkSync6(path2);
-      entriesSeen = void 0;
-      forgetKey();
-      if (overwrite !== void 0)
-        throw new Error(
-          `${paths.key} was deleted but could not be overwritten first: ${overwrite instanceof Error ? overwrite.message : String(overwrite)}`
-        );
-    }
-  };
-}
-var CREDENTIAL_STORE_SCHEMA, CREDENTIAL_SOURCES, CREDENTIAL_KINDS, sealedSchema, entrySchema, fileSchema, KEY_BYTES2;
-var init_credential_store = __esm({
-  "../../packages/tacho/src/host/credential-store.ts"() {
-    "use strict";
-    init_zod();
-    init_fs();
-    init_run_token();
-    CREDENTIAL_STORE_SCHEMA = "tacho.credentials.v1";
-    CREDENTIAL_SOURCES = [
-      /** `env.ANTHROPIC_API_KEY` in Claude Code's user settings. */
-      "claude-code:settings.env",
-      /** `OPENAI_API_KEY` in Codex's `auth.json`. */
-      "codex:auth.json",
-      /** `TACHO_BROKER_<PROVIDER>_API_KEY` in the enrolling shell. */
-      "enroll:env",
-      /**
-       * The run token in an Oxagen Agent Runners sandbox's `launch` message. It
-       * is spent at the cloud gateway, which attaches the operator's model
-       * credential. It is not a model credential itself.
-       */
-      "sandbox:launch"
-    ];
-    CREDENTIAL_KINDS = ["api_key", "bearer"];
-    sealedSchema = external_exports.object({
-      /** AES-256-GCM: 12-byte nonce, ciphertext, 16-byte tag, all base64. */
-      nonce: external_exports.string().min(1),
-      ciphertext: external_exports.string().min(1),
-      tag: external_exports.string().min(1)
-    }).strict();
-    entrySchema = external_exports.object({
-      provider: external_exports.enum(RUN_TOKEN_PROVIDERS),
-      kind: external_exports.enum(CREDENTIAL_KINDS),
-      source: external_exports.enum(CREDENTIAL_SOURCES),
-      taken_at: external_exports.string(),
-      /** The first few characters, the way a vendor console shows a key. */
-      prefix: external_exports.string().max(12),
-      sealed: sealedSchema
-    }).strict();
-    fileSchema = external_exports.object({
-      schema: external_exports.literal(CREDENTIAL_STORE_SCHEMA),
-      entries: external_exports.array(entrySchema)
-    }).strict();
-    KEY_BYTES2 = 32;
-  }
-});
-
 // ../../packages/tacho/src/host/claude-config-lock.ts
 import { mkdirSync as mkdirSync4, rmdirSync as rmdirSync3, statSync as statSync4 } from "node:fs";
 function sleepSync(ms) {
@@ -24709,7 +25255,7 @@ var init_claude_config_lock = __esm({
 });
 
 // ../../packages/tacho/src/host/service.ts
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import {
   existsSync as existsSync9,
   readdirSync as readdirSync6,
@@ -24794,8 +25340,8 @@ function blockingSleep(ms) {
 }
 function launchdManager(options) {
   const sleep2 = options.sleep ?? blockingSleep;
-  const dir = join15(options.home, "Library", "LaunchAgents");
-  const unitPath = join15(dir, `${SERVICE_LABEL}.plist`);
+  const dir = join16(options.home, "Library", "LaunchAgents");
+  const unitPath = join16(dir, `${SERVICE_LABEL}.plist`);
   const domain = `gui/${options.uid ?? process.getuid?.() ?? 501}`;
   const target2 = `${domain}/${SERVICE_LABEL}`;
   const loaded = () => options.exec("launchctl", ["print", target2]).status === 0;
@@ -24900,9 +25446,9 @@ function stopByPidFile(options) {
     );
 }
 function systemdManager(options) {
-  const dir = join15(options.home, ".config", "systemd", "user");
-  const unitPath = join15(dir, "tachod.service");
-  const wants = join15(dir, "default.target.wants");
+  const dir = join16(options.home, ".config", "systemd", "user");
+  const unitPath = join16(dir, "tachod.service");
+  const wants = join16(dir, "default.target.wants");
   return {
     kind: "systemd",
     unitPath,
@@ -25053,8 +25599,8 @@ function windowsCreatedMs(exec4, pid) {
   return result2.status === 0 && /^\d+$/.test(text5) ? Number(text5) : void 0;
 }
 function schtasksManager(options) {
-  const launcher = options.launcherPath ?? join15(options.home, "tachod.cmd");
-  const pidPath = options.pidPath ?? join15(launcher, "..", "tachod.pid");
+  const launcher = options.launcherPath ?? join16(options.home, "tachod.cmd");
+  const pidPath = options.pidPath ?? join16(launcher, "..", "tachod.pid");
   const liveRecord = () => {
     if (!existsSync9(pidPath)) return void 0;
     const record = parseDaemonPid(readFileSync9(pidPath, "utf8"));
@@ -25099,7 +25645,7 @@ function schtasksManager(options) {
     unitPath: launcher,
     install: (spec) => {
       stopDaemon();
-      ensureDir(join15(launcher, ".."), 493);
+      ensureDir(join16(launcher, ".."), 493);
       writeSensitiveFileAtomic(
         launcher,
         renderWindowsLauncher(
@@ -25231,7 +25777,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-957";
+  if (true) return "2.1.4-975";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -25251,7 +25797,7 @@ var init_version = __esm({
 });
 
 // ../../packages/tacho/src/cli/deps.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes7 } from "node:crypto";
 import { existsSync as existsSync10 } from "node:fs";
 import { get as httpGet, request as httpRequest } from "node:http";
@@ -25316,7 +25862,7 @@ function transientBinDir(binDir, env = process.env) {
     return "an AppImage mount";
   return void 0;
 }
-function shellQuote(value, platform = process.platform) {
+function shellQuote2(value, platform = process.platform) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
   if (platform === "win32") return `"${value}"`;
   return `'${value.replace(/'/g, "'\\''")}'`;
@@ -25367,8 +25913,8 @@ function runtimeCommands(entry2 = process.argv[1], env = process.env, nodePath =
     const dir = P.dirname(tacho);
     const transient2 = transientBinDir(dir, env);
     return {
-      hookCommand: `${shellQuote(tacho, platform)} hook`,
-      credentialHelperCommand: helperCommandFor(shellQuote(tacho, platform)),
+      hookCommand: `${shellQuote2(tacho, platform)} hook`,
+      credentialHelperCommand: helperCommandFor(shellQuote2(tacho, platform)),
       daemonCommand: [tacho, "daemon"],
       mcpStdioCommand: [tacho, "mcp-stdio"],
       binDir: dir,
@@ -25382,9 +25928,9 @@ function runtimeCommands(entry2 = process.argv[1], env = process.env, nodePath =
   const flagged = transient !== void 0 ? { transient } : {};
   const node2 = stableExecutablePath(nodePath, platform, exists);
   return {
-    hookCommand: `${shellQuote(node2, platform)} ${shellQuote(P.join(binDir, "tacho-hook.mjs"), platform)}`,
+    hookCommand: `${shellQuote2(node2, platform)} ${shellQuote2(P.join(binDir, "tacho-hook.mjs"), platform)}`,
     credentialHelperCommand: helperCommandFor(
-      `${shellQuote(node2, platform)} ${shellQuote(P.join(binDir, "tacho.mjs"), platform)}`
+      `${shellQuote2(node2, platform)} ${shellQuote2(P.join(binDir, "tacho.mjs"), platform)}`
     ),
     daemonCommand: [node2, P.join(binDir, "tachod.mjs")],
     mcpStdioCommand: [node2, P.join(binDir, "tacho.mjs"), "mcp-stdio"],
@@ -25412,7 +25958,7 @@ function oxagenRuntimeCommands(entry2 = process.argv[1], env = process.env, node
   } else {
     return runtimeCommands(void 0, env, nodePath, platform, false, exists);
   }
-  const line = prefix.map((word) => shellQuote(word, platform)).join(" ");
+  const line = prefix.map((word) => shellQuote2(word, platform)).join(" ");
   const binDir = P.dirname(prefix[prefix.length - 1]);
   const transient = transientBinDir(binDir, env);
   return {
@@ -25550,6 +26096,63 @@ function settleOrThrow(harnessFiles) {
     );
   return outcomes;
 }
+function promptHidden(question) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) return Promise.resolve(void 0);
+  return new Promise((resolve25) => {
+    process.stderr.write(question);
+    let value = "";
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const done = (answer) => {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.off("data", onData);
+      process.stderr.write("\n");
+      resolve25(answer);
+    };
+    const onData = (chunk2) => {
+      for (const char of chunk2) {
+        if (char === "\r" || char === "\n") return done(value.trim());
+        if (char === "" || char === "") return done(void 0);
+        if (char === "\x7F" || char === "\b") value = value.slice(0, -1);
+        else value += char;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+function realSubscriptionLogin(env, home) {
+  return {
+    interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
+    findClaude: () => findClaudeBinary(env, home),
+    runSetupToken: (claude, write) => runClaudeSetupToken({
+      claude,
+      interactive: process.stdin.isTTY === true,
+      write
+    }),
+    promptSecret: promptHidden,
+    findCodex: () => findHarnessBinary("codex", env, home),
+    runCodexLogin: (codex) => new Promise((resolve25, reject) => {
+      const child = spawn3(codex, ["login"], {
+        stdio: [process.stdin.isTTY ? "inherit" : "pipe", "inherit", "inherit"],
+        env: process.env
+      });
+      child.on("error", reject);
+      child.on("close", (code) => {
+        child.stdin?.destroy();
+        resolve25(code ?? 1);
+      });
+    }),
+    readStdin: async () => {
+      let text5 = "";
+      process.stdin.setEncoding("utf8");
+      for await (const chunk2 of process.stdin) text5 += chunk2;
+      return text5;
+    }
+  };
+}
 function defaultCliDeps(overrides = {}, managed = {}) {
   const env = overrides.env ?? process.env;
   const home = overrides.home ?? homedir3();
@@ -25739,6 +26342,7 @@ function defaultCliDeps(overrides = {}, managed = {}) {
       file: paths.credentials,
       key: paths.credentialsKey
     }),
+    subscriptionLogin: realSubscriptionLogin(env, home),
     daemonPost: async (path2, body2) => {
       const host = readHostFile(paths.hostFile);
       if (host === void 0) return void 0;
@@ -25832,6 +26436,7 @@ var init_deps = __esm({
   "../../packages/tacho/src/cli/deps.ts"() {
     "use strict";
     init_hook_client();
+    init_claude_setup_token();
     init_codex_app_server();
     init_credential_store();
     init_claude_config_lock();
@@ -26657,7 +27262,7 @@ import {
   unlinkSync as unlinkSync8
 } from "node:fs";
 import { open as open2 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function parseStoredBody(text5) {
   let value;
   try {
@@ -26858,7 +27463,7 @@ var init_wal_index = __esm({
       /** The scan `ensureAsync` has running for a session, shared by callers. */
       building = /* @__PURE__ */ new Map();
       sidecarFor(sessionUuid2) {
-        return join16(this.dir, `${sessionUuid2}${SIDECAR_SUFFIX}`);
+        return join17(this.dir, `${sessionUuid2}${SIDECAR_SUFFIX}`);
       }
       /** Whether a name in the WAL directory is one of these sidecars. */
       static isSidecar(name) {
@@ -27090,7 +27695,7 @@ import {
   writeSync as writeSync4
 } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function activityAt(event) {
   const at2 = Date.parse(event.ts);
   return Number.isFinite(at2) ? at2 : Number.NEGATIVE_INFINITY;
@@ -27154,7 +27759,7 @@ var init_wal = __esm({
         this.dir = dir;
         ensureDir(dir);
         this.bodyIndexes = new BodyIndexStore(dir);
-        this.cursorPath = join17(dir, "cursor.json");
+        this.cursorPath = join18(dir, "cursor.json");
         let raw;
         if (onCursorSetAside !== void 0)
           raw = readJsonStateFile(this.cursorPath, onCursorSetAside);
@@ -27234,10 +27839,10 @@ var init_wal = __esm({
        */
       dirtyPaths = /* @__PURE__ */ new Set();
       fileFor(sessionUuid2) {
-        return join17(this.dir, `${sessionUuid2}.ndjson`);
+        return join18(this.dir, `${sessionUuid2}.ndjson`);
       }
       bodyFileFor(sessionUuid2) {
-        return join17(this.dir, `${sessionUuid2}.bodies.jsonl`);
+        return join18(this.dir, `${sessionUuid2}.bodies.jsonl`);
       }
       persistCursor() {
         this.flush();
@@ -28666,7 +29271,7 @@ ${lines.join("\n")}
         for (const name of readdirSync7(this.dir)) {
           if (abandonedRewrite.test(name)) {
             try {
-              unlinkSync9(join17(this.dir, name));
+              unlinkSync9(join18(this.dir, name));
             } catch (error) {
               this.bodyFailure(name.slice(0, 36), "cleanup", error);
             }
@@ -28813,7 +29418,7 @@ function githubConfigure(options, rootDeps) {
   const helperBase = deps.runtime.credentialHelperCommand;
   if (!helperBase)
     throw new Error("This installation has no credential helper command");
-  const helper = `!${helperBase.replace(/credential issue --harness claude-code$/, "github credential")} --harness ${shellQuote(options.harness, deps.platform)} --cwd ${shellQuote(cwd, deps.platform)}`;
+  const helper = `!${helperBase.replace(/credential issue --harness claude-code$/, "github credential")} --harness ${shellQuote2(options.harness, deps.platform)} --cwd ${shellQuote2(cwd, deps.platform)}`;
   const previous = (host.github_repositories ?? []).find(
     (entry2) => sameReceipt(entry2, cwd, repository)
   );
@@ -29031,15 +29636,15 @@ var init_github = __esm({
 
 // ../../packages/tacho/src/host/harness-path.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { delimiter, join as join18 } from "node:path";
+import { delimiter as delimiter2, join as join19 } from "node:path";
 function knownDirs(home) {
   return [
-    join18(home, ".local", "bin"),
-    join18(home, ".bun", "bin"),
-    join18(home, ".npm-global", "bin"),
-    join18(home, ".volta", "bin"),
-    join18(home, ".cargo", "bin"),
-    join18(home, "bin"),
+    join19(home, ".local", "bin"),
+    join19(home, ".bun", "bin"),
+    join19(home, ".npm-global", "bin"),
+    join19(home, ".volta", "bin"),
+    join19(home, ".cargo", "bin"),
+    join19(home, "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     "/usr/bin",
@@ -29079,10 +29684,10 @@ function harnessPath(env, home, loginPath) {
     seen.add(dir);
     dirs.push(dir);
   };
-  for (const dir of (loginPath ?? "").split(delimiter)) add2(dir);
-  for (const dir of (env["PATH"] ?? "").split(delimiter)) add2(dir);
+  for (const dir of (loginPath ?? "").split(delimiter2)) add2(dir);
+  for (const dir of (env["PATH"] ?? "").split(delimiter2)) add2(dir);
   for (const dir of knownDirs(home)) add2(dir);
-  return dirs.join(delimiter);
+  return dirs.join(delimiter2);
 }
 var MARK, LOGIN_SHELL_TIMEOUT_MS;
 var init_harness_path = __esm({
@@ -29159,7 +29764,7 @@ var init_policy_mode = __esm({
 
 // ../../packages/tacho/src/host/wal-ceiling.ts
 import { statfsSync } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function freeBytesOn(dir) {
   try {
     const stats2 = statfsSync(dir);
@@ -29206,7 +29811,7 @@ function isDrop(value) {
 function readWalCeilingState(walDir) {
   let raw;
   try {
-    raw = readJsonFileIfExists(join19(walDir, STATE_FILE));
+    raw = readJsonFileIfExists(join20(walDir, STATE_FILE));
   } catch (error) {
     if (error instanceof SyntaxError) return void 0;
     throw error;
@@ -29406,7 +30011,7 @@ var init_wal_ceiling = __esm({
         const changed = this.unsaved || prior === void 0 || prior.stalled_sessions !== next.stalled_sessions || prior.drops.length !== next.drops.length || prior.drops.at(-1)?.dropped_at !== next.drops.at(-1)?.dropped_at || !sameClocks(prior.stall_clocks, next.stall_clocks) || next.stalled_sessions > 0 && (prior.stalled_bytes !== next.stalled_bytes || prior.ceiling_bytes !== next.ceiling_bytes);
         this.state = next;
         if (!changed) return;
-        const path2 = join19(this.walDir, STATE_FILE);
+        const path2 = join20(this.walDir, STATE_FILE);
         try {
           writeSensitiveFileAtomic(path2, JSON.stringify(next));
           this.unsaved = false;
@@ -29910,7 +30515,7 @@ import {
   rmdirSync as rmdirSync5,
   rmSync as rmSync2
 } from "node:fs";
-import { dirname as dirname12, join as join20 } from "node:path";
+import { dirname as dirname12, join as join21 } from "node:path";
 async function revokeOnControlPlane(host, options, deps, warnings) {
   const resolved = resolveCredentials(
     {
@@ -30521,7 +31126,7 @@ async function unenrollLocked(options, deps) {
     ];
     const purged = parts.filter(([, path2, recursive]) => remove2(path2, recursive)).map(([name]) => name);
     let failed3 = purged.length < parts.length;
-    if (!existsSync15(join20(deps.paths.dir, HARNESS_RECEIPTS)) && !remove2(join20(deps.paths.dir, HARNESS_BACKUPS), true))
+    if (!existsSync15(join21(deps.paths.dir, HARNESS_RECEIPTS)) && !remove2(join21(deps.paths.dir, HARNESS_BACKUPS), true))
       failed3 = true;
     const logShared = otherLiveAgents(deps.paths, deps.paths.dir).length > 0;
     if (!logShared) {
@@ -30579,7 +31184,7 @@ var init_unenroll = __esm({
 
 // ../../packages/tacho/src/cli/enroll.ts
 import { existsSync as existsSync16, lstatSync as lstatSync4, rmSync as rmSync3 } from "node:fs";
-import { dirname as dirname13, isAbsolute, join as join21 } from "node:path";
+import { dirname as dirname13, isAbsolute, join as join22 } from "node:path";
 function rootRefusal(command2, deps, allowRoot) {
   if (allowRoot === true || deps.getuid?.() !== 0) return void 0;
   const user = deps.env["SUDO_USER"] ?? "<user>";
@@ -30605,7 +31210,7 @@ function runtimeOf(host) {
   if (first === void 0 || !files2.every((file) => existsSync16(file)))
     return void 0;
   const binDir = dirname13(first);
-  const tacho = host.daemon_command[0] === first ? shellQuote(first) : `${host.daemon_command[0]} ${shellQuote(join21(binDir, "tacho.mjs"))}`;
+  const tacho = host.daemon_command[0] === first ? shellQuote2(first) : `${host.daemon_command[0]} ${shellQuote2(join22(binDir, "tacho.mjs"))}`;
   return {
     hookCommand: host.hook_command,
     credentialHelperCommand: helperCommandFor(tacho),
@@ -31699,6 +32304,7 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
           const mode = options.credentials ?? "brokered";
           try {
             if (mode === "brokered") {
+              await signInIfNoCredential(reaching, deps);
               const outcome = await brokerCredentials(host, reaching, deps);
               for (const entry2 of outcome.harnesses)
                 deps.out(`      ${describeHarness(entry2)}`);
@@ -32861,21 +33467,21 @@ import {
   statSync as statSync7,
   unlinkSync as unlinkSync10
 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute2, join as join22, relative, resolve as resolve7, sep } from "node:path";
+import { dirname as dirname14, isAbsolute as isAbsolute2, join as join23, relative, resolve as resolve7, sep } from "node:path";
 function dataLocalDir(home, env, platform) {
   if (platform === "darwin")
-    return join22(home, "Library", "Application Support");
+    return join23(home, "Library", "Application Support");
   if (platform === "win32")
-    return env["LOCALAPPDATA"] ?? join22(home, "AppData", "Local");
+    return env["LOCALAPPDATA"] ?? join23(home, "AppData", "Local");
   const xdg = env["XDG_DATA_HOME"];
-  return xdg !== void 0 && isAbsolute2(xdg) ? xdg : join22(home, ".local", "share");
+  return xdg !== void 0 && isAbsolute2(xdg) ? xdg : join23(home, ".local", "share");
 }
 function desktopPlaces(deps) {
-  const oxagenDir = join22(deps.home, ".config", "oxagen");
+  const oxagenDir = join23(deps.home, ".config", "oxagen");
   return {
     oxagenDir,
-    desktopConfig: join22(oxagenDir, "desktop.json"),
-    copies: join22(
+    desktopConfig: join23(oxagenDir, "desktop.json"),
+    copies: join23(
       dataLocalDir(deps.home, deps.env, deps.platform),
       "oxagen",
       "bin"
@@ -33120,7 +33726,7 @@ function undoEntry(entry2, deps, tally2) {
 }
 function versionDirs(copies) {
   try {
-    return readdirSync9(copies, { withFileTypes: true }).filter((entry2) => entry2.isDirectory() && !entry2.name.startsWith(".")).map((entry2) => join22(copies, entry2.name)).sort();
+    return readdirSync9(copies, { withFileTypes: true }).filter((entry2) => entry2.isDirectory() && !entry2.name.startsWith(".")).map((entry2) => join23(copies, entry2.name)).sort();
   } catch {
     return [];
   }
@@ -33156,7 +33762,7 @@ function journaledCopies(journal, copies, tally2) {
 function removeSidecars(dir, platform, tally2) {
   const note = platform === "win32" ? `. Windows keeps a running program's file, so delete ${dir} after this command exits` : "";
   for (const name of ["oxagen", "tacho"]) {
-    const file = join22(dir, platform === "win32" ? `${name}.exe` : name);
+    const file = join23(dir, platform === "win32" ? `${name}.exe` : name);
     removeFile(file, tally2, note);
   }
 }
@@ -33244,7 +33850,7 @@ async function uninstall(options, deps) {
       tally2.left.push(`cannot remove ${dir}: ${reasonOf3(error)}`);
     }
   }
-  const configDir = join22(deps.home, ".config");
+  const configDir = join23(deps.home, ".config");
   if (record.configDirCreated && removeDirIfEmpty(configDir))
     tally2.removed.push(configDir);
   for (const path2 of tally2.removed) deps.out(`      removed ${path2}`);
@@ -33658,9 +34264,9 @@ var init_run = __esm({
 });
 
 // ../../packages/tacho/src/cli/agent-run.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { constants as constants2 } from "node:os";
+import { constants as constants3 } from "node:os";
 import { posix as posix3, win32 as win324 } from "node:path";
 function programName(program2) {
   const base2 = (program2.includes("\\") ? win324 : posix3).basename(program2);
@@ -33686,7 +34292,7 @@ function sessionRefusal(stdout) {
 function exitCodeOf(exit) {
   if (exit.error !== void 0) return 1;
   if (exit.code !== null) return exit.code;
-  const number2 = exit.signal !== null ? constants2.signals[exit.signal] : void 0;
+  const number2 = exit.signal !== null ? constants3.signals[exit.signal] : void 0;
   return number2 !== void 0 ? 128 + number2 : 1;
 }
 function spawnAgent(command2, args, options) {
@@ -33697,7 +34303,7 @@ function spawnAgent(command2, args, options) {
     options.env
   );
   return new Promise((resolve25) => {
-    const child = spawn2(invocation.command, invocation.args, {
+    const child = spawn4(invocation.command, invocation.args, {
       cwd: options.cwd,
       env: options.env,
       stdio: "inherit",
@@ -33922,11 +34528,11 @@ var init_work_order_start = __esm({
 
 // ../../packages/tacho/src/host/work-orders.ts
 import { readdirSync as readdirSync10, rmSync as rmSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function orderFile(paths, id2) {
   if (!WORK_ORDER_ID_PATTERN.test(id2))
     throw new Error(`${JSON.stringify(id2)} is not a work order id`);
-  return join23(paths.workOrders, `${id2}.json`);
+  return join24(paths.workOrders, `${id2}.json`);
 }
 function readKept(path2) {
   try {
@@ -33976,7 +34582,7 @@ function removeWorkOrder(paths, id2) {
 function runningFile(paths, id2) {
   if (!WORK_ORDER_ID_PATTERN.test(id2))
     throw new Error(`${JSON.stringify(id2)} is not a work order id`);
-  return join23(paths.workOrders, `${id2}.running`);
+  return join24(paths.workOrders, `${id2}.running`);
 }
 function processIsAlive(pid) {
   try {
@@ -34378,10 +34984,12 @@ var init_work = __esm({
 var cli_exports = {};
 __export(cli_exports, {
   BACKFILL_EXIT: () => BACKFILL_EXIT,
+  CLAUDE_OAUTH_TOKEN_ENV: () => CLAUDE_OAUTH_TOKEN_ENV,
   CONTAINED_AGENTS: () => CONTAINED_AGENTS,
   CURSOR_COVERAGE_NOTE: () => CURSOR_COVERAGE_NOTE,
   MODEL_CREDENTIAL_HARNESSES: () => MODEL_CREDENTIAL_HARNESSES,
   SHIPPING_STALL_MS: () => SHIPPING_STALL_MS,
+  acquireSubscriptionToken: () => acquireSubscriptionToken,
   addMissingClaudeCodeMcp: () => addMissingClaudeCodeMcp,
   agentNameFromCommand: () => agentNameFromCommand,
   backfillCommand: () => backfillCommand,
@@ -34389,6 +34997,7 @@ __export(cli_exports, {
   canServeOxagenTools: () => canServeOxagenTools,
   claudeFacts: () => claudeFacts,
   credentialIssue: () => credentialIssue,
+  credentialLogin: () => credentialLogin,
   credentialStatus: () => credentialStatus,
   cursorAppFacts: () => cursorAppFacts,
   cursorFacts: () => cursorFacts,
@@ -34436,9 +35045,10 @@ __export(cli_exports, {
   runtimeCommands: () => runtimeCommands,
   serviceInstalled: () => serviceInstalled,
   sessionRefusal: () => sessionRefusal,
-  shellQuote: () => shellQuote,
+  shellQuote: () => shellQuote2,
   shimError: () => shimError,
   shippingHealth: () => shippingHealth,
+  signInIfNoCredential: () => signInIfNoCredential,
   spawnAgent: () => spawnAgent,
   stableExecutablePath: () => stableExecutablePath,
   status: () => status,
@@ -38173,6 +38783,7 @@ function containedBridgeHandler(options) {
       const modelPaths = options.harness === "claude-code" ? ["/model/v1/messages", "/model/v1/messages/count_tokens"] : ["/model/v1/responses", "/model/v1/chat/completions"];
       if (request3.method === "POST" && modelPaths.includes(path2)) {
         const credential = options.issueCredential();
+        const chatgpt = options.harness === "codex" && options.chatgptLogin?.() === true;
         request3.headers = {
           "content-type": "application/json",
           ...request3.headers["content-length"] ? { "content-length": request3.headers["content-length"] } : {},
@@ -38180,9 +38791,12 @@ function containedBridgeHandler(options) {
           ...request3.headers["anthropic-beta"] ? { "anthropic-beta": request3.headers["anthropic-beta"] } : {},
           host: `127.0.0.1:${options.modelPort}`,
           "x-oxagen-session": options.sessionId,
-          ...options.harness === "claude-code" ? { "x-api-key": credential } : { authorization: `Bearer ${credential}` }
+          ...options.harness === "claude-code" ? { "x-api-key": credential } : { authorization: `Bearer ${credential}` },
+          // Marks the call as a ChatGPT login's; the gateway puts the
+          // login's own account in its place.
+          ...chatgpt ? { "chatgpt-account-id": "custody" } : {}
         };
-        request3.url = options.harness === "claude-code" ? path2.replace("/model", "/anthropic") : path2.replace("/model", "/openai");
+        request3.url = options.harness === "claude-code" ? path2.replace("/model", "/anthropic") : chatgpt ? path2.replace("/model/v1", "/backend-api/codex") : path2.replace("/model", "/openai");
         options.model(request3, response);
         return;
       }
@@ -38334,7 +38948,7 @@ var init_bridge = __esm({
 
 // ../../packages/tacho/src/contained/workspace.ts
 import { lstatSync as lstatSync6, readFileSync as readFileSync14, readdirSync as readdirSync11, realpathSync as realpathSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join24, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join25, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
 function within(root, path2) {
   const rel = relative2(root, path2);
   return rel === "" || !isAbsolute3(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
@@ -38364,7 +38978,7 @@ function validateContainedWorkspace(workspace, sessionDirectory, mountInfo = rea
   }
   const visit2 = (directory) => {
     for (const entry2 of readdirSync11(directory)) {
-      const path2 = join24(directory, entry2);
+      const path2 = join25(directory, entry2);
       if (CREDENTIAL_PATHS.has(entry2) || isEnvFile(entry2))
         throw new Error(
           `Remove local credential files from the contained checkout before launch: ${named(path2)}`
@@ -38398,7 +39012,7 @@ function validateContainedWorkspace(workspace, sessionDirectory, mountInfo = rea
 }
 function gitDirectoryMounts(workspace) {
   const root = realpathSync3(workspace);
-  const dotGit = join24(root, ".git");
+  const dotGit = join25(root, ".git");
   let stat7;
   try {
     stat7 = lstatSync6(dotGit);
@@ -38436,7 +39050,7 @@ function gitDirectoryMounts(workspace) {
   if (gitDir !== void 0) {
     let common;
     try {
-      common = readFileSync14(join24(gitDir, "commondir"), "utf8").trim();
+      common = readFileSync14(join25(gitDir, "commondir"), "utf8").trim();
     } catch {
       common = void 0;
     }
@@ -38463,7 +39077,7 @@ var init_workspace = __esm({
 // ../../packages/tacho/src/collector/hardened-git.ts
 import { execFile as execFile2 } from "node:child_process";
 import { lstatSync as lstatSync7, readFileSync as readFileSync15, statSync as statSync8 } from "node:fs";
-import { dirname as dirname15, join as join25, resolve as resolve10 } from "node:path";
+import { dirname as dirname15, join as join26, resolve as resolve10 } from "node:path";
 function hardenedGitArgs(cwd, args, globals = []) {
   const subcommand = args[0];
   const end = args.indexOf("--");
@@ -38480,9 +39094,9 @@ function hardenedGitArgs(cwd, args, globals = []) {
   ];
 }
 function hardenedGitShellPrefix() {
-  return ["git", ...HARDENED_GIT_CONFIG.map(shellQuote2)].join(" ");
+  return ["git", ...HARDENED_GIT_CONFIG.map(shellQuote3)].join(" ");
 }
-function shellQuote2(value) {
+function shellQuote3(value) {
   return /^[A-Za-z0-9_./=:-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
 }
 function hardenedGitExecOptions(repository) {
@@ -38502,7 +39116,7 @@ function gitIdentity(repository, deps = DEFAULT_IDENTITY_DEPS) {
     };
   }
   for (let at2 = directory; ; at2 = dirname15(at2)) {
-    const marker = join25(at2, ".git");
+    const marker = join26(at2, ".git");
     const link = tryStat(deps.lstat, marker);
     if (link !== void 0) {
       owners.push(link);
@@ -38510,7 +39124,7 @@ function gitIdentity(repository, deps = DEFAULT_IDENTITY_DEPS) {
       if (target2 !== void 0) {
         owners.push(target2);
         if (target2.isDirectory()) {
-          const config = tryStat(deps.stat, join25(marker, "config"));
+          const config = tryStat(deps.stat, join26(marker, "config"));
           if (config !== void 0) owners.push(config);
         }
       }
@@ -38662,7 +39276,7 @@ var init_hardened_git = __esm({
 
 // ../../packages/tacho/src/contained/profile.ts
 import { createHash as createHash6 } from "node:crypto";
-import { isAbsolute as isAbsolute4, join as join26, relative as relative3, sep as sep3 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join27, relative as relative3, sep as sep3 } from "node:path";
 function containerPath(workspace, path2) {
   const inside2 = relative3(workspace, path2);
   if (inside2 === "" || isAbsolute4(inside2) || inside2 === ".." || inside2.startsWith(`..${sep3}`))
@@ -38672,7 +39286,7 @@ function containerPath(workspace, path2) {
   return `/workspace/${inside2.split(sep3).join("/")}`;
 }
 function gitMountPairs(spec) {
-  if (!spec.gitMounts.includes(join26(spec.workspace, ".git")))
+  if (!spec.gitMounts.includes(join27(spec.workspace, ".git")))
     throw new Error(
       "Contained execution must mount the repository's .git read-only"
     );
@@ -38829,7 +39443,7 @@ var init_profile = __esm({
 });
 
 // ../../packages/tacho/src/contained/launcher.ts
-import { execFile as execFile3, spawn as spawn3 } from "node:child_process";
+import { execFile as execFile3, spawn as spawn5 } from "node:child_process";
 import { randomBytes as randomBytes8 } from "node:crypto";
 import {
   chmodSync as chmodSync7,
@@ -38839,7 +39453,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute5, join as join27 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join28 } from "node:path";
 import { promisify } from "node:util";
 function reason(error) {
   return error instanceof Error ? error.message : String(error);
@@ -38878,7 +39492,7 @@ async function launchContainedAgent(options) {
   if (digest6 === void 0)
     throw new Error("The operator's contained image is not installed");
   const sessionId = `contained-${randomBytes8(16).toString("hex")}`;
-  const directory = mkdtempSync(join27(tmpdir(), "oxagen-contained-"));
+  const directory = mkdtempSync(join28(tmpdir(), "oxagen-contained-"));
   chmodSync7(directory, 448);
   let prepared;
   let containerCreated = false;
@@ -38899,7 +39513,7 @@ async function launchContainedAgent(options) {
     for (const [name2, contents] of entries2) {
       if (!/^[a-z0-9.-]+$/.test(name2))
         throw new Error("Invalid contained configuration filename");
-      writeFileSync2(join27(directory, name2), contents, {
+      writeFileSync2(join28(directory, name2), contents, {
         mode: 256,
         flag: "wx"
       });
@@ -38930,7 +39544,7 @@ async function launchContainedAgent(options) {
     if (options.signal?.aborted)
       throw new Error("Contained run cancelled before start");
     exitCode = await new Promise((resolve25, reject) => {
-      const child = spawn3("docker", ["start", "--attach", name], {
+      const child = spawn5("docker", ["start", "--attach", name], {
         stdio: ["ignore", "pipe", "pipe"]
       });
       const stop = () => {
@@ -39298,8 +39912,8 @@ var init_privilege = __esm({
 
 // ../../packages/tacho/src/contained/sandbox/launcher.ts
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { join as join28 } from "node:path";
-function shellQuote3(value) {
+import { join as join29 } from "node:path";
+function shellQuote4(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function sandboxHarnessEnvironment(request3, gatewayPort) {
@@ -39325,7 +39939,7 @@ function ptyCommand(argv) {
       "-f",
       "-e",
       "-c",
-      `exec ${argv.map(shellQuote3).join(" ")}`,
+      `exec ${argv.map(shellQuote4).join(" ")}`,
       "/dev/null"
     ]
   };
@@ -39388,7 +40002,7 @@ async function launchSandboxAgent(options) {
       { ...asAgent, cwd: SANDBOX_AGENT_HOME, timeoutMs: 15 * 6e4 }
     );
     for (const [name, contents] of Object.entries(claudeCodeUserState())) {
-      const path2 = join28(SANDBOX_AGENT_HOME, name);
+      const path2 = join29(SANDBOX_AGENT_HOME, name);
       system.writeFile(path2, contents, 384);
       system.chown(path2, SANDBOX_AGENT_UID, SANDBOX_AGENT_GID);
     }
@@ -39512,7 +40126,7 @@ var init_request = __esm({
 });
 
 // ../../packages/tacho/src/contained/sandbox/system.ts
-import { execFile as execFile4, spawn as spawn4 } from "node:child_process";
+import { execFile as execFile4, spawn as spawn6 } from "node:child_process";
 import {
   chmodSync as chmodSync8,
   chownSync as chownSync2,
@@ -39543,7 +40157,7 @@ var init_system = __esm({
         return { stdout: String(answer.stdout), stderr: String(answer.stderr) };
       },
       spawn: (file, args, options) => {
-        const child = spawn4(file, [...args], {
+        const child = spawn6(file, [...args], {
           ...options.uid !== void 0 ? { uid: options.uid } : {},
           ...options.gid !== void 0 ? { gid: options.gid } : {},
           ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
@@ -39594,10 +40208,10 @@ var init_system = __esm({
 });
 
 // ../../packages/tacho/src/contained/runner.ts
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 function containedHookEnv(harness, workspace) {
-  const home = join29(workspace, ".oxagen-contained", "home");
-  return harness === "codex" ? { CODEX_HOME: join29(home, ".codex") } : { CLAUDE_CONFIG_DIR: join29(home, ".claude") };
+  const home = join30(workspace, ".oxagen-contained", "home");
+  return harness === "codex" ? { CODEX_HOME: join30(home, ".codex") } : { CLAUDE_CONFIG_DIR: join30(home, ".claude") };
 }
 function containedLaunchEndpoint(host) {
   const ingest = new URL(host.endpoints.ingest);
@@ -39693,6 +40307,7 @@ function createContainedRunner(options) {
           throw new Error("Credential custody unavailable");
         return answer.body.token;
       },
+      ...options.chatgptLogin !== void 0 ? { chatgptLogin: options.chatgptLogin } : {},
       model: (request3, response) => options.model.handle(request3, response),
       hook: options.hook,
       opening: route.opening,
@@ -39795,7 +40410,7 @@ function createContainedRunner(options) {
             sessionUuid2 = started.recorder.sessionUuid;
             active2.set(sessionUuid2, controller);
             const bridge = await startContainedBridge({
-              socketPath: join29(directory, "bridge.sock"),
+              socketPath: join30(directory, "bridge.sock"),
               ...bridgeRoutes({
                 sessionId,
                 workspace,
@@ -39879,7 +40494,7 @@ function createContainedRunner(options) {
       const abort = () => controller.abort();
       signal?.addEventListener("abort", abort, { once: true });
       if (signal?.aborted) abort();
-      const env = { CLAUDE_CONFIG_DIR: join29(SANDBOX_AGENT_HOME, ".claude") };
+      const env = { CLAUDE_CONFIG_DIR: join30(SANDBOX_AGENT_HOME, ".claude") };
       let sessionUuid2;
       let launchedSessionId;
       let opened = false;
@@ -40012,14 +40627,96 @@ var init_runner = __esm({
   }
 });
 
+// ../../packages/tacho/src/host/chatgpt-refresh.ts
+function jwtExpiryMs(token) {
+  const payload = token.split(".")[1];
+  if (payload === void 0) return void 0;
+  try {
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8")
+    );
+    return typeof claims.exp === "number" ? claims.exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function chatGptLoginDue(login, takenAt, now) {
+  const exp = jwtExpiryMs(login.access_token);
+  if (exp !== void 0) return exp - now < CHATGPT_REFRESH_MARGIN_MS;
+  return now - takenAt > CHATGPT_REFRESH_MAX_AGE_MS;
+}
+async function refreshChatGptLogin(login, fetchImpl) {
+  if (login.refresh_token.length === 0)
+    throw new Error("the ChatGPT login in custody has no refresh token");
+  const response = await fetchImpl(CHATGPT_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_id: CODEX_OAUTH_CLIENT_ID,
+      grant_type: "refresh_token",
+      refresh_token: login.refresh_token,
+      scope: "openid profile email"
+    })
+  });
+  if (!response.ok)
+    throw new Error(
+      `auth.openai.com refused to refresh the ChatGPT login (${response.status}); run \`codex login\`, then \`oxagen agent enroll\``
+    );
+  let body2;
+  try {
+    body2 = JSON.parse(await response.text());
+  } catch {
+    throw new Error("auth.openai.com answered with something other than JSON");
+  }
+  if (typeof body2.access_token !== "string" || body2.access_token.length === 0)
+    throw new Error("auth.openai.com answered without an access token");
+  return {
+    ...login,
+    access_token: body2.access_token,
+    refresh_token: typeof body2.refresh_token === "string" ? body2.refresh_token : login.refresh_token,
+    ...typeof body2.id_token === "string" ? { id_token: body2.id_token } : {}
+  };
+}
+async function refreshChatGptCustody(store, fetchImpl, now) {
+  const entry2 = store.status().find((c) => c.provider === "openai" && c.kind === "chatgpt");
+  if (entry2 === void 0) return "none";
+  const held = store.read("openai");
+  const login = held?.kind === "chatgpt" ? decodeChatGptLogin(held.secret) : void 0;
+  if (login === void 0) return { failed: "custody holds no ChatGPT login" };
+  if (!chatGptLoginDue(login, Date.parse(entry2.taken_at), now)) return "fresh";
+  try {
+    const next = await refreshChatGptLogin(login, fetchImpl);
+    store.take(
+      "openai",
+      { kind: "chatgpt", secret: JSON.stringify(next) },
+      "chatgpt:refresh",
+      now
+    );
+    return "refreshed";
+  } catch (error) {
+    return { failed: error instanceof Error ? error.message : String(error) };
+  }
+}
+var CODEX_OAUTH_CLIENT_ID, CHATGPT_TOKEN_URL, CHATGPT_REFRESH_MARGIN_MS, CHATGPT_REFRESH_MAX_AGE_MS;
+var init_chatgpt_refresh = __esm({
+  "../../packages/tacho/src/host/chatgpt-refresh.ts"() {
+    "use strict";
+    init_model_credential();
+    CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+    CHATGPT_TOKEN_URL = "https://auth.openai.com/oauth/token";
+    CHATGPT_REFRESH_MARGIN_MS = 60 * 6e4;
+    CHATGPT_REFRESH_MAX_AGE_MS = 7 * 24 * 60 * 6e4;
+  }
+});
+
 // ../../packages/tacho/src/host/repositories.ts
 import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
-import { dirname as dirname17, join as join30, resolve as resolve11, sep as sep4 } from "node:path";
+import { dirname as dirname17, join as join31, resolve as resolve11, sep as sep4 } from "node:path";
 function repositoriesFile(home) {
-  return join30(home.tachoDir, "repositories.json");
+  return join31(home.tachoDir, "repositories.json");
 }
 function workTreesDir(home) {
-  return join30(home.tachoDir, "work");
+  return join31(home.tachoDir, "work");
 }
 function readIndex(home) {
   let raw;
@@ -40071,7 +40768,7 @@ function recordCheckout(home, canonical3, root, seenAt) {
   return true;
 }
 function mainCheckoutOf(root) {
-  const dotGit = join30(root, ".git");
+  const dotGit = join31(root, ".git");
   try {
     if (!statSync10(dotGit).isFile()) return root;
     const line = readFileSync17(dotGit, "utf8").trim();
@@ -40081,13 +40778,13 @@ function mainCheckoutOf(root) {
     const worktrees = dirname17(gitdir);
     if (!worktrees.endsWith(`${sep4}.git${sep4}worktrees`)) return root;
     const clone4 = dirname17(dirname17(worktrees));
-    return existsSync18(join30(clone4, ".git")) ? clone4 : root;
+    return existsSync18(join31(clone4, ".git")) ? clone4 : root;
   } catch {
     return root;
   }
 }
 function defaultIsCheckout(root) {
-  return existsSync18(join30(root, ".git"));
+  return existsSync18(join31(root, ".git"));
 }
 function findCheckout(home, repository, host, deps = {}) {
   const isCheckout = deps.isCheckout ?? defaultIsCheckout;
@@ -40135,7 +40832,7 @@ var init_repositories = __esm({
 
 // ../../packages/tacho/src/collector/detector.ts
 import { promises as fs3 } from "node:fs";
-import { basename as basename5, join as join31 } from "node:path";
+import { basename as basename5, join as join32 } from "node:path";
 async function eachLimited(items, limit, task) {
   let next = 0;
   const workers = Array.from(
@@ -40161,7 +40858,7 @@ async function scanProject(dir) {
   await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
     const match = SESSION_FILE.exec(name);
     if (match === null) return;
-    const path2 = join31(dir, name);
+    const path2 = join32(dir, name);
     try {
       const st = await fs3.stat(path2);
       out.push({ sessionId: match[1], path: path2, mtimeMs: st.mtimeMs });
@@ -40202,7 +40899,7 @@ var init_detector = __esm({
             continue;
           }
           await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
-            const dir = join31(root, name);
+            const dir = join32(root, name);
             try {
               const st = await fs3.stat(dir);
               if (st.isDirectory()) dirs.push({ dir, mtimeMs: st.mtimeMs });
@@ -40442,7 +41139,7 @@ var init_detector = __esm({
                 transcript_path: transcript.path,
                 transcript_mtime: new Date(transcript.mtimeMs).toISOString(),
                 claude_pids: processes.map((p) => p.pid),
-                project: basename5(join31(transcript.path, ".."))
+                project: basename5(join32(transcript.path, ".."))
               }
             })
           );
@@ -40812,9 +41509,9 @@ var init_git_facts = __esm({
 });
 
 // ../../packages/tacho/src/collector/work-order-autostart.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 import { closeSync as closeSync7, existsSync as existsSync19, openSync as openSync7 } from "node:fs";
-import { dirname as dirname18, join as join32 } from "node:path";
+import { dirname as dirname18, join as join33 } from "node:path";
 function asError(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
@@ -40867,7 +41564,7 @@ function createWorkOrderAutostart(deps) {
   }
   async function abandon(id2) {
     forget(id2);
-    const worktree = join32(workTreesDir(paths), id2);
+    const worktree = join33(workTreesDir(paths), id2);
     if (!existsSync19(worktree)) return;
     const [common, branch, head2] = await Promise.all([
       git6(worktree, ["rev-parse", "--path-format=absolute", "--git-common-dir"]),
@@ -40905,7 +41602,7 @@ function createWorkOrderAutostart(deps) {
     return waitMs;
   }
   async function prepareWorktree(root, id2, itemNumber) {
-    const worktree = join32(workTreesDir(paths), id2);
+    const worktree = join33(workTreesDir(paths), id2);
     const logPath = `${worktree}.log`;
     if (existsSync19(worktree)) {
       const [branch2, head2] = await Promise.all([
@@ -40966,9 +41663,17 @@ function createWorkOrderAutostart(deps) {
       log(`work order ${id2}: the harness ${ended}`);
       return;
     }
-    const [status2, ahead] = await Promise.all([
+    const [status2, ahead, current] = await Promise.all([
       git6(worktree, ["status", "--porcelain"]),
-      base2 === void 0 ? Promise.resolve({ ok: false, out: "", error: "no base commit" }) : git6(worktree, ["rev-list", "--count", `${base2}..HEAD`])
+      base2 === void 0 ? Promise.resolve({ ok: false, out: "", error: "no base commit" }) : git6(worktree, [
+        "rev-list",
+        "--count",
+        "HEAD",
+        "--not",
+        base2,
+        "--remotes"
+      ]),
+      git6(worktree, ["branch", "--show-current"])
     ]);
     const clean = status2.ok && status2.out.length === 0 && ahead.ok && ahead.out === "0";
     if (!clean || root === void 0) {
@@ -40984,13 +41689,26 @@ function createWorkOrderAutostart(deps) {
     );
     if (!removed.ok) {
       log(
-        `work order ${id2}: the harness ${ended} and left no work, but Git could not remove ${worktree}: ${removed.error}`
+        `work order ${id2}: the harness ${ended} and left nothing that is not on a remote, but Git could not remove ${worktree}: ${removed.error}`
       );
       return;
     }
-    if (branch !== void 0) await git6(root, ["branch", "-D", branch]);
+    const used = /* @__PURE__ */ new Set();
+    if (branch !== void 0) used.add(branch);
+    if (current.ok && current.out.length > 0) used.add(current.out);
+    for (const name of used) {
+      const unpushed = await git6(root, [
+        "rev-list",
+        "--count",
+        name,
+        "--not",
+        "--remotes"
+      ]);
+      if (unpushed.ok && unpushed.out === "0")
+        await git6(root, ["branch", "-D", name]);
+    }
     log(
-      `work order ${id2}: the harness ${ended} and left no work, so its worktree is removed${mark.log !== void 0 ? `. Its output is in ${mark.log}` : ""}.`
+      `work order ${id2}: the harness ${ended} and left nothing that is not on a remote, so its worktree is removed${mark.log !== void 0 ? `. Its output is in ${mark.log}` : ""}.`
     );
   }
   function watch2(id2, workspace, exited) {
@@ -41188,7 +41906,7 @@ var init_work_order_autostart = __esm({
       };
       let settled2 = false;
       try {
-        const child = spawn5(command2, args, {
+        const child = spawn7(command2, args, {
           cwd: options.cwd,
           env: options.env,
           // Its own process group, so a daemon restart does not stop the run.
@@ -41275,7 +41993,7 @@ import {
   rm,
   unlink
 } from "node:fs/promises";
-import { dirname as dirname19, join as join33 } from "node:path";
+import { dirname as dirname19, join as join34 } from "node:path";
 function byPath(a, b3) {
   return a.path < b3.path ? -1 : a.path > b3.path ? 1 : 0;
 }
@@ -41318,7 +42036,7 @@ async function contentHash(absolutePath, kind, keep) {
   if (keep !== void 0) {
     try {
       await mkdir(keep.dir, { recursive: true, mode: 448 });
-      const temp2 = join33(keep.dir, `.partial-${randomUUID3()}`);
+      const temp2 = join34(keep.dir, `.partial-${randomUUID3()}`);
       copy = {
         temp: temp2,
         handle: await open3(temp2, "wx", keep.executable ? 448 : 384)
@@ -41362,7 +42080,7 @@ async function settleCopy(temp, name) {
   if (temp === void 0) return;
   if (name !== void 0)
     try {
-      await rename(temp, join33(dirname19(temp), name));
+      await rename(temp, join34(dirname19(temp), name));
       return;
     } catch {
     }
@@ -41378,7 +42096,7 @@ async function copiedBytes(dir) {
   let total2 = 0;
   for (const name of names2) {
     try {
-      total2 += (await lstat(join33(dir, name))).size;
+      total2 += (await lstat(join34(dir, name))).size;
     } catch {
     }
   }
@@ -41394,7 +42112,7 @@ async function removeCopiesOutside(root, live) {
   const keep = new Set(live());
   await Promise.all(
     names2.filter((name) => !keep.has(name)).map(
-      (name) => rm(join33(root, name), { recursive: true, force: true }).catch(
+      (name) => rm(join34(root, name), { recursive: true, force: true }).catch(
         () => void 0
       )
     )
@@ -41501,7 +42219,7 @@ async function contributionOf(exec4, cwd, root, repoRelative, entry2, copies) {
   let copy = null;
   if (entry2 !== null) {
     if (copies === void 0 || !COPY_NAME.test(entry2[0])) return void 0;
-    copy = join33(copies, entry2[0]);
+    copy = join34(copies, entry2[0]);
     const kept = await statOf(copy);
     if (kept === void 0 || kept === "absent" || kept.kind !== "file")
       return void 0;
@@ -41903,7 +42621,7 @@ var init_session_changes = __esm({
 });
 
 // ../../packages/tacho/src/collector/session-commits.ts
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 function parseMeta(stdout) {
   const out = [];
   for (const record of stdout.split("\0")) {
@@ -42028,7 +42746,7 @@ async function readSessionCommits(exec4, cwd, input) {
     const test = input.tests[commit.sha];
     const toolUseId = callAt(times.get(commit.sha), calls);
     const written2 = input.written;
-    const outside = merge || written2 === void 0 || root === void 0 ? void 0 : files2.some((file) => !written2.has(join34(root, file.path)));
+    const outside = merge || written2 === void 0 || root === void 0 ? void 0 : files2.some((file) => !written2.has(join35(root, file.path)));
     return {
       sha: commit.sha,
       parent_shas: commit.parents.slice(0, MAX_COMMIT_PARENTS),
@@ -42076,7 +42794,7 @@ var init_session_commits = __esm({
 
 // ../../packages/tacho/src/collector/worktree-snapshot.ts
 import { lstat as lstat2 } from "node:fs/promises";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 function headerPath(prefix, path2) {
   const name = `${prefix}${path2}`;
   let quoted3 = false;
@@ -42160,7 +42878,7 @@ async function worktreeFingerprint(status2, root) {
       const path2 = statusPath(record);
       if (path2 === null) return "";
       try {
-        const info = await lstat2(join35(root, path2));
+        const info = await lstat2(join36(root, path2));
         return `${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
       } catch {
         return "absent";
@@ -42268,7 +42986,7 @@ async function readWorktreeSnapshot(exec4, cwd, baseline, measured) {
       }
       let present;
       try {
-        present = (await lstat2(join35(root, path2))).isFile();
+        present = (await lstat2(join36(root, path2))).isFile();
       } catch {
         present = false;
       }
@@ -42371,10 +43089,10 @@ var init_worktree_snapshot = __esm({
 });
 
 // ../../packages/tacho/src/collector/git-lane.ts
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 function copiesDirOf(root, session) {
   const uuid = session.recorder.sessionUuid;
-  return /^[0-9a-f-]{36}$/i.test(uuid) ? join36(root, uuid) : void 0;
+  return /^[0-9a-f-]{36}$/i.test(uuid) ? join37(root, uuid) : void 0;
 }
 function holdsBaseline(session) {
   return session.baselineCommit !== void 0 || Object.keys(session.baselines ?? {}).length > 0;
@@ -45742,7 +46460,7 @@ var init_hook_queues = __esm({
 
 // ../../packages/tacho/src/collector/memory-capture/memory-reader.ts
 import { createRequire as createRequire2 } from "node:module";
-import { isAbsolute as isAbsolute8, join as join37, sep as sep6 } from "node:path";
+import { isAbsolute as isAbsolute8, join as join38, sep as sep6 } from "node:path";
 function claudeCodeLocation(projectsDir, memoryDir) {
   return {
     harness: "claude-code",
@@ -45754,13 +46472,13 @@ function claudeCodeLocation(projectsDir, memoryDir) {
 }
 function claudeCodeMemoryLocations(configDir, projectDirs = []) {
   const locations = [
-    claudeCodeLocation(() => join37(configDir, "projects"), "memory"),
-    claudeCodeLocation(() => join37(configDir, "agent-memory"), "")
+    claudeCodeLocation(() => join38(configDir, "projects"), "memory"),
+    claudeCodeLocation(() => join38(configDir, "agent-memory"), "")
   ];
   for (const dir of projectDirs.slice(0, MEMORY_PROJECT_DIRS_MAX))
     locations.push(
-      claudeCodeLocation(() => join37(dir, ".claude", "agent-memory"), ""),
-      claudeCodeLocation(() => join37(dir, ".claude", "agent-memory-local"), "")
+      claudeCodeLocation(() => join38(dir, ".claude", "agent-memory"), ""),
+      claudeCodeLocation(() => join38(dir, ".claude", "agent-memory-local"), "")
     );
   return locations;
 }
@@ -45945,13 +46663,13 @@ function createMemoryReader(deps) {
       const projects = await list2(top);
       let complete = projects.complete;
       for (const project2 of projects.names) {
-        const dir = location.memoryDir === "" ? join37(top, project2) : join37(top, project2, location.memoryDir);
+        const dir = location.memoryDir === "" ? join38(top, project2) : join38(top, project2, location.memoryDir);
         const files2 = await list2(dir);
         if (!files2.complete) complete = false;
         for (const name of files2.names) {
           if (!name.endsWith(location.extension)) continue;
           if (location.skip.includes(name)) continue;
-          const path2 = join37(dir, name);
+          const path2 = join38(dir, name);
           const file = await readAt2(location.harness, path2);
           if (file.kind === "absent" || file.kind === "empty") continue;
           paths.push(path2);
@@ -46037,8 +46755,8 @@ var init_memory_reader = __esm({
     MEMORY_TYPE_PATTERN = /^[a-z][a-z0-9_-]{0,31}$/;
     MEMORY_PROJECT_DIRS_MAX = 200;
     HARNESS_MEMORY_LOCATIONS = [
-      claudeCodeLocation((home) => join37(home, ".claude", "projects"), "memory"),
-      claudeCodeLocation((home) => join37(home, ".claude", "agent-memory"), "")
+      claudeCodeLocation((home) => join38(home, ".claude", "projects"), "memory"),
+      claudeCodeLocation((home) => join38(home, ".claude", "agent-memory"), "")
     ];
     FRONTMATTER = /^---[ \t]*\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)/;
     FRONTMATTER_LINE = /^([ \t]*)([A-Za-z_][\w-]*)[ \t]*:[ \t]*(.*)$/;
@@ -46530,7 +47248,7 @@ var init_memory_recall = __esm({
 });
 
 // ../../packages/tacho/src/collector/memory-capture/memory-uses.ts
-import { basename as basename6, dirname as dirname21, isAbsolute as isAbsolute9, join as join38, resolve as resolve14 } from "node:path";
+import { basename as basename6, dirname as dirname21, isAbsolute as isAbsolute9, join as join39, resolve as resolve14 } from "node:path";
 function memoryFileOf(path2, locations, home) {
   if (!isAbsolute9(path2)) return void 0;
   const file = resolve14(path2);
@@ -46548,7 +47266,7 @@ function memoryFileOf(path2, locations, home) {
   return void 0;
 }
 function pathOf(word, cwd, home) {
-  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join38(home, word.slice(word.indexOf("/") + 1)) : word;
+  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join39(home, word.slice(word.indexOf("/") + 1)) : word;
   if (isAbsolute9(expanded)) return expanded;
   if (cwd !== void 0 && isAbsolute9(cwd)) return resolve14(cwd, expanded);
   return void 0;
@@ -46804,7 +47522,7 @@ ${use.path}`;
 });
 
 // ../../packages/tacho/src/collector/memory-capture/stella-store.ts
-import { dirname as dirname22, isAbsolute as isAbsolute10, join as join39, resolve as resolve15 } from "node:path";
+import { dirname as dirname22, isAbsolute as isAbsolute10, join as join40, resolve as resolve15 } from "node:path";
 function queryStellaStore(path2, afterSeq, limit) {
   const db = new (nodeSqlite()).DatabaseSync(path2, { readOnly: true });
   try {
@@ -46894,7 +47612,7 @@ async function stellaStoreOf(dir, exists) {
   if (!isAbsolute10(dir)) return void 0;
   let at2 = resolve15(dir);
   for (let depth = 0; depth < WORKSPACE_SEARCH_DEPTH; depth += 1) {
-    const candidate = join39(at2, STELLA_CONTEXT_DB);
+    const candidate = join40(at2, STELLA_CONTEXT_DB);
     if (await exists(candidate)) return candidate;
     const up = dirname22(at2);
     if (up === at2) return void 0;
@@ -46907,7 +47625,7 @@ var init_stella_store = __esm({
   "../../packages/tacho/src/collector/memory-capture/stella-store.ts"() {
     "use strict";
     init_memory_reader();
-    STELLA_CONTEXT_DB = join39(".stella", "private", "context.db");
+    STELLA_CONTEXT_DB = join40(".stella", "private", "context.db");
     STELLA_MEMORIES_VIEW = "export_memories_v1";
     STELLA_USES_VIEW = "export_memory_uses_v1";
     STELLA_USES_PER_READ = 5e3;
@@ -47569,7 +48287,7 @@ var init_cloud_link = __esm({
 
 // ../../packages/tacho/src/collector/local-servers/digest.ts
 import { createHash as createHash10 } from "node:crypto";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 function rememberBounded(map, key, value) {
   if (!map.has(key) && map.size >= MAX_REMEMBERED_DIGESTS) {
     const oldest = map.keys().next();
@@ -47606,7 +48324,7 @@ function npmNameSegment(name) {
   return name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
 }
 async function whichOnPath(command2, pathValue, search) {
-  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join40(dir, command2));
+  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join41(dir, command2));
   for (const candidate of candidates) {
     for (const extension of search.extensions) {
       if (await search.isExecutable(candidate + extension))
@@ -48609,7 +49327,7 @@ var init_local_servers = __esm({
 
 // ../../packages/tacho/src/collector/local-servers/machine.ts
 import { spawn as nodeSpawn } from "node:child_process";
-import { access, constants as constants3, readFile, realpath, stat } from "node:fs/promises";
+import { access, constants as constants4, readFile, realpath, stat } from "node:fs/promises";
 function machineParked(host) {
   if (host.revoked_at !== null || host.host_status === "revoked")
     return "the enrollment is revoked";
@@ -48634,7 +49352,7 @@ function createMachineLink(host, fetch2, env) {
 async function isExecutable(path2) {
   try {
     if (!(await stat(path2)).isFile()) return false;
-    await access(path2, constants3.X_OK);
+    await access(path2, constants4.X_OK);
     return true;
   } catch {
     return false;
@@ -48902,9 +49620,9 @@ import {
   writeFile
 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname23, join as join41 } from "node:path";
+import { dirname as dirname23, join as join42 } from "node:path";
 function stagingFolder(root, name) {
-  return join41(root, `.${name}${STAGING_SUFFIX}`);
+  return join42(root, `.${name}${STAGING_SUFFIX}`);
 }
 function isStagingName(name) {
   return name.startsWith(".") && name.endsWith(STAGING_SUFFIX);
@@ -48947,17 +49665,17 @@ function envDir(env, key) {
 function skillsRoot(harness, env = process.env, home = homedir5()) {
   switch (harness) {
     case "claude-code":
-      return join41(
-        envDir(env, "CLAUDE_CONFIG_DIR") ?? join41(home, ".claude"),
+      return join42(
+        envDir(env, "CLAUDE_CONFIG_DIR") ?? join42(home, ".claude"),
         "skills"
       );
     case "codex": {
       const codexHome = envDir(env, "CODEX_HOME");
-      return codexHome === null ? join41(home, ".agents", "skills") : join41(codexHome, "skills");
+      return codexHome === null ? join42(home, ".agents", "skills") : join42(codexHome, "skills");
     }
     case "stella":
-      return join41(
-        envDir(env, "STELLA_HOME") ?? join41(home, ".stella"),
+      return join42(
+        envDir(env, "STELLA_HOME") ?? join42(home, ".stella"),
         "skills"
       );
     case "cursor":
@@ -49018,7 +49736,7 @@ async function readMarker(folder) {
   if (!entries2.includes(SESSION_MARKER)) return { state: "foreign" };
   try {
     const parsed2 = JSON.parse(
-      await readFile2(join41(folder, SESSION_MARKER), "utf8")
+      await readFile2(join42(folder, SESSION_MARKER), "utf8")
     );
     return isMarker(parsed2) ? { state: "ours", marker: parsed2 } : { state: "foreign" };
   } catch {
@@ -49035,22 +49753,22 @@ function liveSessions(marker, now) {
   return live;
 }
 async function writeMarker(folder, marker) {
-  const temp = join41(folder, MARKER_TEMP);
+  const temp = join42(folder, MARKER_TEMP);
   await writeFile(temp, `${JSON.stringify(marker, null, 2)}
 `);
-  await rename2(temp, join41(folder, SESSION_MARKER));
+  await rename2(temp, join42(folder, SESSION_MARKER));
 }
 async function writeSkill(root, skill, marker) {
-  const folder = join41(root, skill.name);
+  const folder = join42(root, skill.name);
   const staging = stagingFolder(root, skill.name);
   await rm2(folder, { recursive: true, force: true });
   await rm2(staging, { recursive: true, force: true });
   await mkdir2(staging);
   await writeMarker(staging, { digest: UNFINISHED_DIGEST, sessions: {} });
   await rename2(staging, folder);
-  await writeFile(join41(folder, "SKILL.md"), skillMarkdown(skill));
+  await writeFile(join42(folder, "SKILL.md"), skillMarkdown(skill));
   for (const file of skill.files) {
-    const target2 = join41(folder, file.path);
+    const target2 = join42(folder, file.path);
     await mkdir2(dirname23(target2), { recursive: true });
     await writeFile(target2, file.content);
   }
@@ -49079,7 +49797,7 @@ async function placeSkills(root, sessionId, skills, now = /* @__PURE__ */ new Da
       result2.warnings.push(refusal);
       continue;
     }
-    const folder = join41(root, skill.name);
+    const folder = join42(root, skill.name);
     if (taken.has(skill.name)) {
       result2.skipped.push(skill.name);
       result2.warnings.push(
@@ -49144,7 +49862,7 @@ async function removeSkills(root, sessionId, now = /* @__PURE__ */ new Date()) {
     throw error;
   }
   for (const name of names2.sort(compareText)) {
-    const folder = join41(root, name);
+    const folder = join42(root, name);
     if (isStagingName(name)) {
       await rm2(folder, { recursive: true, force: true });
       continue;
@@ -50066,13 +50784,27 @@ function connectionTokens(raw) {
   }
   return named;
 }
+function withOAuthBeta(value) {
+  const flags = (value ?? "").split(",").map((flag2) => flag2.trim()).filter((flag2) => flag2.length > 0);
+  if (!flags.includes(ANTHROPIC_OAUTH_BETA)) flags.push(ANTHROPIC_OAUTH_BETA);
+  return flags.join(",");
+}
 function upstreamRequestHeaders(raw, host, bodyLength, dropContentEncoding, attach) {
   const named = connectionTokens(raw);
   const out = ["Host", host];
+  const oauth = attach?.kind === "oauth";
+  let beta;
   for (let i2 = 0; i2 + 1 < raw.length; i2 += 2) {
     const name = raw[i2];
     const lower = name.toLowerCase();
     if (HOP_BY_HOP.has(lower) || named.has(lower)) continue;
+    if (attach?.kind === "chatgpt" && attach.accountId !== void 0 && lower === CHATGPT_ACCOUNT_HEADER)
+      continue;
+    if (oauth && lower === "anthropic-beta") {
+      const value = raw[i2 + 1];
+      beta = beta === void 0 ? value : `${beta},${value}`;
+      continue;
+    }
     if (lower === "host" || lower === "content-length") continue;
     if (lower === "accept-encoding" || lower === "expect") continue;
     if (lower === TACHO_MODEL_SESSION_HEADER) continue;
@@ -50084,6 +50816,9 @@ function upstreamRequestHeaders(raw, host, bodyLength, dropContentEncoding, atta
   if (attach !== void 0) {
     if (attach.kind === "api_key") out.push("X-Api-Key", attach.secret);
     else out.push("Authorization", `Bearer ${attach.secret}`);
+    if (oauth) out.push("anthropic-beta", withOAuthBeta(beta));
+    if (attach.kind === "chatgpt" && attach.accountId !== void 0)
+      out.push("ChatGPT-Account-ID", attach.accountId);
   }
   out.push("Accept-Encoding", "identity");
   if (bodyLength > 0 || raw.some((h, i2) => i2 % 2 === 0 && /^content-length$/i.test(h)))
@@ -50117,7 +50852,7 @@ function providerError(provider, status2, code, message) {
   };
   return { status: status2, body: JSON.stringify(body2) };
 }
-var DEFAULT_MODEL_UPSTREAMS, MODEL_PROXY_ROUTES, HOP_BY_HOP, CREDENTIAL_HEADERS;
+var DEFAULT_MODEL_UPSTREAMS, MODEL_PROXY_ROUTES, HOP_BY_HOP, CREDENTIAL_HEADERS, CHATGPT_ACCOUNT_HEADER, ANTHROPIC_OAUTH_BETA;
 var init_model_routes = __esm({
   "../../packages/tacho/src/collector/model-routes.ts"() {
     "use strict";
@@ -50146,6 +50881,8 @@ var init_model_routes = __esm({
       "upgrade"
     ]);
     CREDENTIAL_HEADERS = ["authorization", "x-api-key"];
+    CHATGPT_ACCOUNT_HEADER = "chatgpt-account-id";
+    ANTHROPIC_OAUTH_BETA = "oauth-2025-04-20";
   }
 });
 
@@ -50877,7 +51614,7 @@ function createModelProxy(deps) {
   function resolveCredential(req, route) {
     const broker = deps.credentials;
     const presented = presentedCredential(req);
-    const brokered = broker !== void 0 && route.upstream !== "chatgpt" && route.harness !== "stella" && broker.brokered(route.provider);
+    const brokered = broker !== void 0 && route.harness !== "stella" && broker.brokered(route.provider) && route.upstream === "chatgpt" === (broker.kind?.(route.provider) === "chatgpt");
     if (broker === void 0 || !brokered) {
       if (presented !== void 0 && looksLikeRunToken(presented.value)) {
         const claims = peekRunTokenClaims(presented.value);
@@ -50932,6 +51669,27 @@ function createModelProxy(deps) {
         }
       };
     }
+    if (held2.kind === "chatgpt") {
+      const login = decodeChatGptLogin(held2.secret);
+      if (login === void 0)
+        return {
+          basis: TACHO_CREDENTIAL_GATEWAY_BROKERED,
+          claims: verdict.claims,
+          refusal: {
+            code: "credential_unavailable",
+            message: CREDENTIAL_MESSAGES.credential_unavailable
+          }
+        };
+      return {
+        basis: TACHO_CREDENTIAL_GATEWAY_BROKERED,
+        claims: verdict.claims,
+        attach: {
+          kind: "chatgpt",
+          secret: login.access_token,
+          ...login.account_id !== void 0 ? { accountId: login.account_id } : {}
+        }
+      };
+    }
     return {
       basis: TACHO_CREDENTIAL_GATEWAY_BROKERED,
       claims: verdict.claims,
@@ -51622,6 +52380,15 @@ function createModelProxy(deps) {
       if (result2.path !== path2 && result2.path.startsWith("/"))
         path2 = result2.path;
     }
+    if (credential.attach?.kind === "chatgpt") {
+      const sent2 = injected ? injectedJson : json2();
+      if (sent2 !== void 0 && sent2["store"] !== false) {
+        const unstored = { ...sent2, store: false };
+        if (injected) injectedJson = unstored;
+        body2 = Buffer.from(JSON.stringify(unstored), "utf8");
+        dropContentEncoding = true;
+      }
+    }
     const requestModel = askedModel;
     const requestEffort = requestEffortOf(injected ? injectedJson : json2());
     const sent = injected ? body2 : readable();
@@ -52186,6 +52953,7 @@ var init_model_proxy = __esm({
     init_frame_body();
     init_replay_grade();
     init_bundle();
+    init_model_credential();
     init_run_token();
     init_wire();
     init_cache_keep_alive();
@@ -52921,12 +53689,12 @@ var init_server = __esm({
 
 // ../../packages/tacho/src/collector/refused.ts
 import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync12 } from "node:fs";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 function refusalRetryable(refusal) {
   return refusal === "malformed" || refusal === "parked";
 }
 function refusedRecordPath(dir, event) {
-  return join42(dir, `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`);
+  return join43(dir, `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`);
 }
 function newRefusedRecord(event, reason3, refusal, at2, body2) {
   const retryable = refusalRetryable(refusal);
@@ -53002,7 +53770,7 @@ function scanRefused(dir, now, limit = MAX_REFUSED_RETRIES_PER_PASS) {
   };
   const due = [];
   for (const name of names2) {
-    const entry2 = readRefusedEntry(join42(dir, name));
+    const entry2 = readRefusedEntry(join43(dir, name));
     if (entry2 === void 0) continue;
     summary.total += 1;
     if (summary.lastRefusedAt === void 0 || entry2.refusedAt > summary.lastRefusedAt)
@@ -53039,7 +53807,7 @@ var init_refused = __esm({
 
 // ../../packages/tacho/src/collector/spool.ts
 import { existsSync as existsSync22, readFileSync as readFileSync20, unlinkSync as unlinkSync12 } from "node:fs";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 function sessionOwnedElsewhere(error) {
   return error.status === 403 && error.body.includes(SESSION_OWNED_ELSEWHERE);
 }
@@ -53272,7 +54040,7 @@ var init_spool = __esm({
       }
       /** Add a body to a quarantine record that was written without one. */
       stashBodyBeside(event, body2) {
-        const path2 = join43(
+        const path2 = join44(
           this.options.quarantineDir,
           `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`
         );
@@ -53928,7 +54696,7 @@ import {
 } from "node:fs";
 import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir7, hostname as osHostname2 } from "node:os";
-import { dirname as dirname24, join as join44 } from "node:path";
+import { dirname as dirname24, join as join45 } from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 function cloudGatewayUpstreams(origin = CLOUD_GATEWAY_ORIGIN) {
   const base2 = new URL(origin).origin;
@@ -54672,7 +55440,7 @@ async function initializeDaemon(options, server, port, ready) {
       controlReachable: lastControlAt !== void 0 && now() - lastControlAt < 2 * timers.bundleRefreshMs
     };
   }
-  const bodyPurgeOwedPath = join44(paths.wal, "body-purge-owed");
+  const bodyPurgeOwedPath = join45(paths.wal, "body-purge-owed");
   function markBodyPurgeOwed(retention, dropped) {
     try {
       ensureDir(paths.wal);
@@ -54949,7 +55717,7 @@ async function initializeDaemon(options, server, port, ready) {
     }
     void workOrderAutostart.reconcile();
   }
-  const lastIngestFile = join44(paths.dir, "last-ingest.json");
+  const lastIngestFile = join45(paths.dir, "last-ingest.json");
   const shipper = new Shipper({
     wal,
     client,
@@ -55471,7 +56239,7 @@ async function initializeDaemon(options, server, port, ready) {
   async function readSpoolFile(name) {
     try {
       const file = parseSpoolFile(
-        await readFile3(join44(paths.spool, name), "utf8")
+        await readFile3(join45(paths.spool, name), "utf8")
       );
       spoolFacts.set(name, spoolFactsOf(file));
       return file;
@@ -55660,7 +56428,7 @@ async function initializeDaemon(options, server, port, ready) {
   function setAsideConflictingTerminal(uuid, pending, conflict) {
     const name = `${uuid}-terminal-conflict-${String(conflict.seq).padStart(8, "0")}.json`;
     writeSensitiveFileAtomic(
-      join44(paths.quarantine, name),
+      join45(paths.quarantine, name),
       JSON.stringify(
         {
           reason: conflict.message,
@@ -55740,8 +56508,8 @@ async function initializeDaemon(options, server, port, ready) {
   function moveToFailedSpool(path2, name, reason3) {
     log(`spool file ${name} moved to spool/failed/: ${reason3}`);
     try {
-      ensureDir(join44(paths.spool, "failed"));
-      renameSync4(path2, join44(paths.spool, "failed", name));
+      ensureDir(join45(paths.spool, "failed"));
+      renameSync4(path2, join45(paths.spool, "failed", name));
     } catch (error) {
       log(
         `spool file ${name} could not be moved to spool/failed/: ${error instanceof Error ? error.message : String(error)}`
@@ -55794,7 +56562,7 @@ async function initializeDaemon(options, server, port, ready) {
         continue;
       }
       reads += 1;
-      const path2 = join44(paths.spool, name);
+      const path2 = join45(paths.spool, name);
       let file;
       try {
         file = await readSpoolFile(name);
@@ -56183,6 +56951,13 @@ async function initializeDaemon(options, server, port, ready) {
     ...options.pauseHold,
     credentials: {
       brokered: (provider) => inCustody(provider),
+      kind: (provider) => {
+        try {
+          return credentialStore.status().find((entry2) => entry2.provider === provider)?.kind;
+        } catch {
+          return void 0;
+        }
+      },
       custody: (provider) => {
         try {
           return credentialStore.read(provider);
@@ -56247,6 +57022,13 @@ async function initializeDaemon(options, server, port, ready) {
     record,
     model: modelProxy,
     modelPort: () => modelProxyListener.port(),
+    chatgptLogin: () => {
+      try {
+        return credentialStore.status().some((c) => c.provider === "openai" && c.kind === "chatgpt");
+      } catch {
+        return false;
+      }
+    },
     issueCredential: (harness) => issueRunToken(
       { harness },
       {
@@ -56621,7 +57403,7 @@ async function initializeDaemon(options, server, port, ready) {
     let removed = 0;
     for (const name of readdirSync13(paths.quarantine)) {
       if (!name.endsWith(".json")) continue;
-      const file = join44(paths.quarantine, name);
+      const file = join45(paths.quarantine, name);
       try {
         const refusedAt = readRefusedEntry(file)?.refusedAt ?? statSync13(file).mtimeMs;
         if (at2 - refusedAt < retainMs) continue;
@@ -56877,8 +57659,29 @@ async function initializeDaemon(options, server, port, ready) {
     });
   }
   let lastStaticRenewalAt = 0;
+  let lastLoginRefreshAt = 0;
   async function renewStaticTokens() {
     if (!host.harnesses.includes("codex")) return;
+    if (now() - lastLoginRefreshAt >= CHATGPT_LOGIN_CHECK_MS) {
+      lastLoginRefreshAt = now();
+      try {
+        const refreshed = await refreshChatGptCustody(
+          credentialStore,
+          options.fetch ?? fetch,
+          now()
+        );
+        if (refreshed === "refreshed")
+          log("refreshed the ChatGPT login in custody");
+        else if (typeof refreshed === "object")
+          log(`ChatGPT login refresh: ${refreshed.failed}`);
+        if (refreshed !== "none")
+          restateCodexLastRefresh(options.home ?? homedir7(), now());
+      } catch (error) {
+        log(
+          `ChatGPT login refresh: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
     if (now() - lastStaticRenewalAt < STATIC_TOKEN_RENEWAL_CHECK_MS) return;
     lastStaticRenewalAt = now();
     if (host.host_status !== "active" || !inCustody("openai")) return;
@@ -56951,7 +57754,7 @@ async function initializeDaemon(options, server, port, ready) {
   let memoryScan;
   if (options.listen ?? true) {
     const codexMemories = createCodexMemoryStore({
-      path: join44(dirname24(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
+      path: join45(dirname24(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
       stat: (path2) => stat2(path2),
       log
     });
@@ -57096,7 +57899,7 @@ async function initializeDaemon(options, server, port, ready) {
     }
   };
 }
-var DEFAULT_TIMERS, STATIC_TOKEN_RENEWAL_CHECK_MS, MEMORY_SCAN_MS, CLOUD_GATEWAY_ORIGIN, CLOUD_GATEWAY_BASE_PATH, QUEUED_PROMPT_CLASS, RECORDER_EVENTS_KEPT, owedBodyPurgeSchema, objectSchema, spoolFileSchema, otlpResourceListSchema, otlpPayloadSchema, defaultExecAsync, STOPPING, STOPPED_EXEC, STATE_WRITE_DEFER_MS;
+var DEFAULT_TIMERS, STATIC_TOKEN_RENEWAL_CHECK_MS, CHATGPT_LOGIN_CHECK_MS, MEMORY_SCAN_MS, CLOUD_GATEWAY_ORIGIN, CLOUD_GATEWAY_BASE_PATH, QUEUED_PROMPT_CLASS, RECORDER_EVENTS_KEPT, owedBodyPurgeSchema, objectSchema, spoolFileSchema, otlpResourceListSchema, otlpPayloadSchema, defaultExecAsync, STOPPING, STOPPED_EXEC, STATE_WRITE_DEFER_MS;
 var init_daemon = __esm({
   "../../packages/tacho/src/collector/daemon.ts"() {
     "use strict";
@@ -57118,6 +57921,7 @@ var init_daemon = __esm({
     init_claude_code_mcp_writer();
     init_model_base_url();
     init_model_credential();
+    init_chatgpt_refresh();
     init_run_token();
     init_process_scan();
     init_retention();
@@ -57190,6 +57994,7 @@ var init_daemon = __esm({
       hookBundleWaitMs: 2e3
     };
     STATIC_TOKEN_RENEWAL_CHECK_MS = 60 * 6e4;
+    CHATGPT_LOGIN_CHECK_MS = 10 * 6e4;
     MEMORY_SCAN_MS = 5 * 6e4;
     CLOUD_GATEWAY_ORIGIN = "https://api.oxagen.sh";
     CLOUD_GATEWAY_BASE_PATH = "/v1/gateway";
@@ -57454,7 +58259,7 @@ var init_run2 = __esm({
 // ../../packages/tacho/src/arp/bundle.ts
 import {
   closeSync as closeSync8,
-  constants as constants4,
+  constants as constants5,
   fstatSync as fstatSync2,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync6,
@@ -57463,7 +58268,7 @@ import {
   realpathSync as realpathSync5,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname25, join as join45, resolve as resolve17 } from "node:path";
+import { dirname as dirname25, join as join46, resolve as resolve17 } from "node:path";
 function bundlePath(root, relative11, create2 = false) {
   const absolute = resolve17(root);
   if (create2) mkdirSync6(absolute, { recursive: true, mode: 448 });
@@ -57474,7 +58279,7 @@ function bundlePath(root, relative11, create2 = false) {
   let current = base2;
   const parts = relative11.split("/");
   for (let i2 = 0; i2 < parts.length; i2++) {
-    current = join45(current, parts[i2]);
+    current = join46(current, parts[i2]);
     try {
       const stat7 = lstatSync8(current);
       if (stat7.isSymbolicLink() || i2 < parts.length - 1 && !stat7.isDirectory()) {
@@ -57495,7 +58300,7 @@ function bundlePath(root, relative11, create2 = false) {
 }
 function readBounded(root, relative11, limit = ARP_MAX_BLOB_BYTES) {
   const path2 = bundlePath(root, relative11);
-  const fd2 = openSync8(path2, constants4.O_RDONLY | constants4.O_NOFOLLOW);
+  const fd2 = openSync8(path2, constants5.O_RDONLY | constants5.O_NOFOLLOW);
   try {
     const stat7 = fstatSync2(fd2);
     if (!stat7.isFile() || stat7.size > limit)
@@ -57520,7 +58325,7 @@ function writeNew(root, relative11, bytes) {
   const path2 = bundlePath(root, relative11, true);
   const fd2 = openSync8(
     path2,
-    constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW,
+    constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW,
     384
   );
   try {
@@ -58425,7 +59230,7 @@ var init_oracles = __esm({
 import { randomUUID as randomUUID4 } from "node:crypto";
 import {
   closeSync as closeSync9,
-  constants as constants5,
+  constants as constants6,
   fstatSync as fstatSync3,
   lstatSync as lstatSync9,
   mkdirSync as mkdirSync7,
@@ -58435,7 +59240,7 @@ import {
   rmSync as rmSync8,
   writeFileSync as writeFileSync5
 } from "node:fs";
-import { dirname as dirname26, isAbsolute as isAbsolute11, join as join46, relative as relative5, resolve as resolve18, sep as sep7 } from "node:path";
+import { dirname as dirname26, isAbsolute as isAbsolute11, join as join47, relative as relative5, resolve as resolve18, sep as sep7 } from "node:path";
 function outsideProfile(path2) {
   return HARNESS_CONFIG_PATH.test(path2) || CREDENTIAL_PATH.test(path2);
 }
@@ -58446,7 +59251,7 @@ function sameJson(bytes, expected) {
   return jcs(JSON.parse(bytes.toString("utf8"))) === jcs(expected);
 }
 function readRegular(label2, path2, limit) {
-  const fd2 = openSync9(path2, constants5.O_RDONLY | constants5.O_NOFOLLOW);
+  const fd2 = openSync9(path2, constants6.O_RDONLY | constants6.O_NOFOLLOW);
   try {
     const before = fstatSync3(fd2);
     if (!before.isFile() || before.size > limit)
@@ -58491,7 +59296,7 @@ function within2(root, path2) {
 }
 function newPath(path2) {
   const full = resolve18(path2);
-  return join46(
+  return join47(
     realpathSync6(dirname26(full)),
     full.slice(dirname26(full).length + 1)
   );
@@ -58505,7 +59310,7 @@ function sourcePath(root, path2) {
   }
   let current = root;
   for (const part2 of path2.split("/")) {
-    current = join46(current, part2);
+    current = join47(current, part2);
     if (lstatSync9(current).isSymbolicLink())
       arpFail(
         `${path2} is a symlink or passes through one. Symlinks require a resource adapter.`
@@ -58772,10 +59577,10 @@ function prepareCheckpoint(options) {
   });
   mkdirSync7(destination, { mode: 448 });
   try {
-    const restored = join46(destination, "workspace");
+    const restored = join47(destination, "workspace");
     mkdirSync7(restored, { mode: 448 });
     for (const item of restore) {
-      const path2 = join46(restored, item.path);
+      const path2 = join47(restored, item.path);
       if (item.kind === "directory")
         mkdirSync7(path2, { recursive: true, mode: 448 });
       else {
@@ -58786,9 +59591,9 @@ function prepareCheckpoint(options) {
         });
       }
     }
-    const promptDir = join46(restored, ".arp");
+    const promptDir = join47(restored, ".arp");
     mkdirSync7(promptDir, { mode: 448 });
-    const promptFile = join46(promptDir, "handoff.json");
+    const promptFile = join47(promptDir, "handoff.json");
     const prompt = {
       checkpoint_digest: checkpointDigest,
       task: task.data.request,
@@ -58805,7 +59610,7 @@ function prepareCheckpoint(options) {
       flag: "wx",
       mode: 384
     });
-    const reportPath = join46(destination, "report.json");
+    const reportPath = join47(destination, "report.json");
     writeFileSync5(
       reportPath,
       jcs(
@@ -59182,6 +59987,41 @@ function buildTachoProgram(options = {}) {
     deps.err(`${name} credential: ${result2.detail}`);
     process.exitCode = 1;
   });
+  credential.command("login").description(
+    "Sign in with your subscription and put it in the gateway's custody, so gateway and contained runs use it: Claude (`claude setup-token`) or ChatGPT for Codex (`codex login`)"
+  ).option("--harness <name>", "claude-code (default) | codex").option(
+    "--token-stdin",
+    "Claude Code only: read a token `claude setup-token` printed from stdin instead of signing in"
+  ).option("--json", "Print the outcome as JSON").action(
+    async (opts) => {
+      const harness = opts.harness ?? "claude-code";
+      if (harness !== "claude-code" && harness !== "codex") {
+        deps.err(
+          `${name} credential login: --harness takes claude-code or codex; got "${harness}"`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const outcome = await credentialLogin(
+        {
+          harness,
+          ...opts.tokenStdin === true ? { tokenStdin: true } : {}
+        },
+        deps
+      );
+      if (opts.json === true) deps.out(JSON.stringify(outcome, null, 2));
+      else {
+        for (const entry2 of outcome.harnesses)
+          deps.out(`      ${describeHarness(entry2)}`);
+        for (const warning of outcome.warnings)
+          deps.err(`warning: ${warning}`);
+        (outcome.ok ? deps.out : deps.err)(
+          `${outcome.ok ? "" : `${name} credential login: `}${outcome.detail}`
+        );
+      }
+      if (!outcome.ok) process.exitCode = 1;
+    }
+  );
   credential.command("status").description(
     "Which providers the gateway holds, and how each harness gets its credential"
   ).option("--json", "Machine-readable output").action(async (opts) => {
@@ -59446,7 +60286,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-957",
+      version: "2.1.4-975",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -59513,10 +60353,10 @@ var init_package = __esm({
 
 // src/lib/atomic-write.ts
 import { writeFileSync as writeFileSync6, renameSync as renameSync5, unlinkSync as unlinkSync15, existsSync as existsSync24 } from "node:fs";
-import { dirname as dirname27, join as join47 } from "node:path";
+import { dirname as dirname27, join as join48 } from "node:path";
 function atomicWriteFileSync(path2, data, mode) {
   const dir = dirname27(path2);
-  const tmp = join47(
+  const tmp = join48(
     dir,
     `.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`
   );
@@ -59541,7 +60381,7 @@ var init_atomic_write = __esm({
 
 // src/lib/config.ts
 import { homedir as homedir8 } from "os";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 import { readFileSync as readFileSync24, mkdirSync as mkdirSync8, existsSync as existsSync25, statSync as statSync14 } from "fs";
 function getConfigDir() {
   return CONFIG_DIR;
@@ -59628,8 +60468,8 @@ var CONFIG_DIR, CONFIG_FILE, STRING_FIELDS, TELEMETRY_FIELDS, cached2;
 var init_config = __esm({
   "src/lib/config.ts"() {
     init_atomic_write();
-    CONFIG_DIR = join48(homedir8(), ".config", "oxagen");
-    CONFIG_FILE = join48(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join49(homedir8(), ".config", "oxagen");
+    CONFIG_FILE = join49(CONFIG_DIR, "config.json");
     STRING_FIELDS = [
       "token",
       "orgSlug",
@@ -59674,16 +60514,16 @@ import {
   writeFile as writeFile2
 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { join as join49 } from "node:path";
+import { join as join50 } from "node:path";
 function isDebugEnabled() {
   const v = process.env[DEBUG_ENV];
   return v === "1" || v === "true";
 }
 function logsDir() {
-  return join49(homedir9(), ".oxagen", "logs");
+  return join50(homedir9(), ".oxagen", "logs");
 }
 function debugLogFile() {
-  return join49(logsDir(), "cli.output");
+  return join50(logsDir(), "cli.output");
 }
 function sanitize(value, depth = 0) {
   if (value === null || value === void 0) return value;
@@ -62978,9 +63818,9 @@ var init_git = __esm({
 
 // ../../packages/steering-freshness/src/cache.ts
 import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname28, join as join50 } from "node:path";
+import { dirname as dirname28, join as join51 } from "node:path";
 function stampPath(gitCommonDir) {
-  return join50(gitCommonDir, "oxagen", "steering-freshness.json");
+  return join51(gitCommonDir, "oxagen", "steering-freshness.json");
 }
 async function readFetchStamp(gitCommonDir, io = defaultIo) {
   try {
@@ -63032,24 +63872,24 @@ var init_cache = __esm({
 // ../../packages/steering-freshness/src/hooks.ts
 import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname29, join as join51 } from "node:path";
+import { dirname as dirname29, join as join52 } from "node:path";
 function hookCommand(harness) {
   return `oxagen steering gate --harness ${harness}`;
 }
 function hookConfigPath(projectRoot, harness, env = process.env, home = homedir10()) {
   switch (harness) {
     case "claude-code":
-      return join51(projectRoot, ".claude", "settings.json");
+      return join52(projectRoot, ".claude", "settings.json");
     case "codex":
-      return join51(env["CODEX_HOME"] ?? join51(home, ".codex"), "hooks.json");
+      return join52(env["CODEX_HOME"] ?? join52(home, ".codex"), "hooks.json");
     case "cursor":
-      return join51(home, ".cursor", "hooks.json");
+      return join52(home, ".cursor", "hooks.json");
     case "stella":
-      return join51(env["STELLA_HOME"] ?? join51(home, ".stella"), "stella.toml");
+      return join52(env["STELLA_HOME"] ?? join52(home, ".stella"), "stella.toml");
   }
 }
 function stellaJsonPath(env, home) {
-  return join51(env["STELLA_HOME"] ?? join51(home, ".stella"), "settings.json");
+  return join52(env["STELLA_HOME"] ?? join52(home, ".stella"), "settings.json");
 }
 function isRecord7(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
@@ -63709,7 +64549,7 @@ var init_policy = __esm({
 // ../../packages/steering-freshness/src/settings.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 async function readLayer(scope, path2, read2) {
   let text5;
   try {
@@ -63761,14 +64601,14 @@ function parseLayer(scope, path2, text5) {
 }
 async function loadSteeringSettings({
   projectRoot,
-  userSettingsPath = join52(homedir11(), USER_SETTINGS_RELATIVE),
+  userSettingsPath = join53(homedir11(), USER_SETTINGS_RELATIVE),
   read: read2 = readFile8,
   workspacePolicy = null
 }) {
   const targets = [
     ["user", userSettingsPath],
-    ["project", join52(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
-    ["local", join52(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
+    ["project", join53(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
+    ["local", join53(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
   ];
   const layers = [];
   const warnings = [];
@@ -63831,7 +64671,7 @@ var init_settings = __esm({
     "use strict";
     init_git();
     init_policy();
-    USER_SETTINGS_RELATIVE = join52(
+    USER_SETTINGS_RELATIVE = join53(
       ".config",
       "oxagen",
       "settings.json"
@@ -63844,7 +64684,7 @@ var init_settings = __esm({
 
 // ../../packages/steering-freshness/src/check.ts
 import { lstat as lstat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute12, join as join53, resolve as resolve19 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join54, resolve as resolve19 } from "node:path";
 function publishedCommits(platform) {
   if (platform.headCommits && platform.headCommits.length > 0)
     return platform.headCommits;
@@ -64181,7 +65021,7 @@ async function absentFromDisk(root, paths) {
   const flags = await Promise.all(
     paths.map(async (path2) => {
       try {
-        await lstat3(join53(root, path2));
+        await lstat3(join54(root, path2));
         return false;
       } catch {
         return true;
@@ -64240,7 +65080,7 @@ var init_check = __esm({
 // ../../packages/steering-freshness/src/sync.ts
 import { mkdtemp, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 function refuse3(refusal, message) {
   return {
     applied: false,
@@ -64421,9 +65261,9 @@ async function syncSteering(opts) {
   };
 }
 async function commitPaths(ctx, message, paths) {
-  const dir = await mkdtemp(join54(tmpdir2(), "oxagen-steering-sync-"));
+  const dir = await mkdtemp(join55(tmpdir2(), "oxagen-steering-sync-"));
   try {
-    const list2 = join54(dir, "pathspec");
+    const list2 = join55(dir, "pathspec");
     await writeFile6(list2, `${paths.join("\0")}\0`, "utf8");
     await git3(
       ctx,
@@ -64951,9 +65791,9 @@ var init_paths2 = __esm({
 
 // src/commands/workspace-link.ts
 import { existsSync as existsSync26, mkdirSync as mkdirSync9, readFileSync as readFileSync25 } from "node:fs";
-import { dirname as dirname30, join as join55 } from "node:path";
+import { dirname as dirname30, join as join56 } from "node:path";
 function workspaceLinkPath(cwd) {
-  return join55(cwd, WORKSPACE_LINK_PATH);
+  return join56(cwd, WORKSPACE_LINK_PATH);
 }
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -65043,7 +65883,7 @@ __export(steering_exports, {
 });
 import { execFileSync } from "node:child_process";
 import { existsSync as existsSync27, realpathSync as realpathSync7 } from "node:fs";
-import { dirname as dirname31, join as join56, normalize, parse as parsePath } from "node:path";
+import { dirname as dirname31, join as join57, normalize, parse as parsePath } from "node:path";
 function findProjectRoot(start) {
   const { root } = parsePath(start);
   const rawGitRoot = gitRootOr(start);
@@ -65052,7 +65892,7 @@ function findProjectRoot(start) {
   if (gitRoot !== null) return gitRoot;
   let dir = from;
   for (; ; ) {
-    if (existsSync27(join56(dir, PROJECT_DIR_NAME))) return dir;
+    if (existsSync27(join57(dir, PROJECT_DIR_NAME))) return dir;
     if (dir === root) return from;
     const parent = dirname31(dir);
     if (parent === dir) return from;
@@ -78530,10 +79370,10 @@ var init_run_list = __esm({
       /** `owner/name` as the frame recorded it; null when it recorded none. */
       repository: external_exports.string().max(512).nullable(),
       /**
-       * The state read from `tacho.run_pull_requests`, which forge webhooks and
-       * one read when the link landed keep current (ADR-192). Null when no row
-       * exists or no forge has reported the pull request, and a caller then
-       * renders "status unknown", never a guessed "open".
+       * The state `forge.pull_requests` holds for the pull request, which the
+       * forge sync keeps current from each delivery and each recorded link
+       * (ADR-288, #5949). Null when the store holds no row for it, and a caller
+       * then renders "status unknown", never a guessed "open".
        */
       state: external_exports.enum(["open", "draft", "merged", "closed"]).nullable(),
       /**
@@ -81417,7 +82257,7 @@ function findSecretsAndPii(text5) {
   const findings = [];
   if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(text5))
     findings.push("private key block");
-  for (const token of text5.match(TOKEN) ?? []) {
+  for (const token of text5.match(TOKEN2) ?? []) {
     if (isSecretToken(token)) {
       findings.push("credential token");
       break;
@@ -81444,7 +82284,7 @@ function findSecretsAndPii(text5) {
   }
   return findings;
 }
-var SECRET_PREFIXES, SENSITIVE_KEY_MARKERS, TOKEN;
+var SECRET_PREFIXES, SENSITIVE_KEY_MARKERS, TOKEN2;
 var init_secrets = __esm({
   "../../packages/steering-check/src/secrets.ts"() {
     "use strict";
@@ -81495,7 +82335,7 @@ var init_secrets = __esm({
       "session_id",
       "client_secret"
     ];
-    TOKEN = /[A-Za-z0-9_\-./+~]+/g;
+    TOKEN2 = /[A-Za-z0-9_\-./+~]+/g;
   }
 });
 
@@ -82443,7 +83283,7 @@ __export(steering_import_exports, {
 });
 import { readdir as readdir4, realpath as realpath2, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
-import { basename as basename8, extname, join as join57, relative as relative7, sep as sep9 } from "node:path";
+import { basename as basename8, extname, join as join58, relative as relative7, sep as sep9 } from "node:path";
 function envDir2(env, key) {
   const value = env[key];
   return value === void 0 || value.trim() === "" ? null : value;
@@ -82451,34 +83291,34 @@ function envDir2(env, key) {
 function harnessHome(harness, env = process.env, home = homedir12()) {
   switch (harness) {
     case "claude-code": {
-      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join57(home, ".claude");
+      const config = envDir2(env, "CLAUDE_CONFIG_DIR") ?? join58(home, ".claude");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("claude-code", env, home) ?? join57(config, "skills"),
+            dir: skillsRoot("claude-code", env, home) ?? join58(config, "skills"),
             mount: ".claude/skills"
           },
-          { dir: join57(config, "commands"), mount: ".claude/commands" },
-          { dir: join57(config, "agents"), mount: ".claude/agents" }
+          { dir: join58(config, "commands"), mount: ".claude/commands" },
+          { dir: join58(config, "agents"), mount: ".claude/agents" }
         ],
         instructions: [
-          { file: join57(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
+          { file: join58(config, "CLAUDE.md"), filename: ".claude/CLAUDE.md" }
         ]
       };
     }
     case "codex": {
-      const codexHome = envDir2(env, "CODEX_HOME") ?? join57(home, ".codex");
+      const codexHome = envDir2(env, "CODEX_HOME") ?? join58(home, ".codex");
       return {
         harness,
         folders: [
           {
-            dir: skillsRoot("codex", env, home) ?? join57(home, ".agents", "skills"),
+            dir: skillsRoot("codex", env, home) ?? join58(home, ".agents", "skills"),
             mount: ".agents/skills"
           }
         ],
         instructions: ["AGENTS.override.md", "AGENTS.md"].map((name) => ({
-          file: join57(codexHome, name),
+          file: join58(codexHome, name),
           filename: `.codex/${name}`
         }))
       };
@@ -82487,8 +83327,8 @@ function harnessHome(harness, env = process.env, home = homedir12()) {
       return {
         harness,
         folders: [
-          { dir: join57(home, ".cursor", "skills"), mount: ".cursor/skills" },
-          { dir: join57(home, ".cursor", "commands"), mount: ".cursor/commands" }
+          { dir: join58(home, ".cursor", "skills"), mount: ".cursor/skills" },
+          { dir: join58(home, ".cursor", "commands"), mount: ".cursor/commands" }
         ],
         instructions: []
       };
@@ -82534,7 +83374,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     const found = [];
     for (const entry2 of entries2.sort(byName)) {
-      const path2 = join57(dir, entry2.name);
+      const path2 = join58(dir, entry2.name);
       if (entry2.isDirectory()) {
         if (!entry2.name.startsWith(".") && entry2.name !== "node_modules")
           found.push(...await filesUnder(path2, from));
@@ -82556,7 +83396,7 @@ async function findMarkdownFiles(paths, harness) {
     const { folder } = frame;
     const named = (rel) => frame.fixedNames ? { filename: rel } : {};
     for (const entry2 of entries2) {
-      const path2 = join57(dir, entry2.name);
+      const path2 = join58(dir, entry2.name);
       const rel = frame.relOf(path2);
       if (entry2.isDirectory()) {
         if (entry2.name === "node_modules") continue;
@@ -82615,7 +83455,7 @@ async function findMarkdownFiles(paths, harness) {
     }
     if (folderGiven) {
       const catalogue = CATALOGUE_FOLDERS.has(basename8(path2));
-      const root = catalogue ? join57(path2, "..") : path2;
+      const root = catalogue ? join58(path2, "..") : path2;
       await walk2(path2, {
         relOf: (p) => under(root, p),
         folder: path2,
@@ -84275,10 +85115,10 @@ __export(verify_exports, {
   verifyBundle: () => verifyBundle3
 });
 import { existsSync as existsSync28, readFileSync as readFileSync26, statSync as statSync15 } from "node:fs";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 function readDirectory(dir) {
   const read2 = (name) => {
-    const path2 = join58(dir, name);
+    const path2 = join59(dir, name);
     return existsSync28(path2) ? readFileSync26(path2, "utf8") : void 0;
   };
   return assemble(read2, dir);
@@ -85233,7 +86073,7 @@ var init_conversation = __esm({
 });
 
 // src/auth/open-browser.ts
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 function openBrowser(url) {
   try {
     let cmd;
@@ -85251,7 +86091,7 @@ function openBrowser(url) {
         cmd = "xdg-open";
         args = [url];
     }
-    const child = spawn6(cmd, args, { detached: true, stdio: "ignore" });
+    const child = spawn8(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -85407,7 +86247,7 @@ import {
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir13, hostname as osHostname3 } from "node:os";
-import { join as join59, relative as relative8, resolve as resolve22, sep as sep10 } from "node:path";
+import { join as join60, relative as relative8, resolve as resolve22, sep as sep10 } from "node:path";
 function git4(cwd, args) {
   return new Promise((done) => {
     try {
@@ -85454,7 +86294,7 @@ function parseRemoteRepository(url) {
 }
 function oxagenPresent(root) {
   try {
-    return readdirSync14(join59(root, ".oxagen")).some(
+    return readdirSync14(join60(root, ".oxagen")).some(
       (name) => name !== "workspace.json"
     );
   } catch {
@@ -85463,18 +86303,18 @@ function oxagenPresent(root) {
 }
 function symlinkState(root) {
   try {
-    if (!lstatSync10(join59(root, ".stella")).isDirectory()) return "none";
+    if (!lstatSync10(join60(root, ".stella")).isDirectory()) return "none";
   } catch {
     return "none";
   }
   let oxagenReal;
   try {
-    oxagenReal = realpathSync8(join59(root, ".oxagen"));
+    oxagenReal = realpathSync8(join60(root, ".oxagen"));
   } catch {
     return "missing";
   }
   for (const link of STELLA_LINKS) {
-    const at2 = join59(root, link);
+    const at2 = join60(root, link);
     try {
       if (!lstatSync10(at2).isSymbolicLink()) return "missing";
       const target2 = realpathSync8(at2);
@@ -85488,7 +86328,7 @@ function symlinkState(root) {
   return "linked";
 }
 function machineId(configDir = getConfigDir()) {
-  const file = join59(configDir, MACHINE_ID_FILE);
+  const file = join60(configDir, MACHINE_ID_FILE);
   let secret = null;
   try {
     if (existsSync29(file)) {
@@ -85570,12 +86410,12 @@ async function ensureWorkspaceLinkIgnored(root) {
   const topDir = resolve22(top);
   const entry2 = relative8(
     topDir,
-    join59(realpathOr2(root), ".oxagen", "workspace.json")
+    join60(realpathOr2(root), ".oxagen", "workspace.json")
   ).split(sep10).join("/");
   if (entry2.startsWith("../")) return null;
   const rule = await git4(topDir, ["check-ignore", "--no-index", "-v", entry2]);
   if (rule !== null) return null;
-  const gitignore = join59(resolve22(top), ".gitignore");
+  const gitignore = join60(resolve22(top), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync27(gitignore, "utf8");
@@ -86100,7 +86940,7 @@ import {
 import {
   dirname as dirname33,
   isAbsolute as isAbsolute14,
-  join as join60,
+  join as join61,
   parse as parsePath2,
   posix as posix4,
   sep as sep11
@@ -86220,7 +87060,7 @@ function findLinkedRoot(start) {
 }
 function fsReader(root) {
   return (path2) => {
-    const abs = join60(root, ...path2.split("/"));
+    const abs = join61(root, ...path2.split("/"));
     try {
       const st = lstatSync11(abs);
       if (!st.isFile()) return Buffer.from(`\0not-a-file:${abs}`);
@@ -86231,14 +87071,14 @@ function fsReader(root) {
   };
 }
 function assertInsideOxagen(root, path2) {
-  const oxagenAbs = join60(root, OXAGEN_DIR);
+  const oxagenAbs = join61(root, OXAGEN_DIR);
   let oxagenReal;
   try {
     oxagenReal = realpathSync9(oxagenAbs);
   } catch {
     return;
   }
-  const abs = join60(root, ...path2.split("/"));
+  const abs = join61(root, ...path2.split("/"));
   try {
     if (lstatSync11(abs).isSymbolicLink()) {
       throw new Error(
@@ -86268,8 +87108,8 @@ function assertInsideOxagen(root, path2) {
   }
 }
 function pruneEmptyDirs(root, path2) {
-  const stop = join60(root, OXAGEN_DIR);
-  let dir = dirname33(join60(root, ...path2.split("/")));
+  const stop = join61(root, OXAGEN_DIR);
+  let dir = dirname33(join61(root, ...path2.split("/")));
   while (dir.startsWith(stop + sep11)) {
     try {
       if (readdirSync15(dir).length > 0) return;
@@ -86284,12 +87124,12 @@ function applyPlan(root, plan) {
   for (const w of plan.writes) assertInsideOxagen(root, w.path);
   for (const d of plan.deletes) assertInsideOxagen(root, d);
   for (const w of plan.writes) {
-    const abs = join60(root, ...w.path.split("/"));
+    const abs = join61(root, ...w.path.split("/"));
     mkdirSync11(dirname33(abs), { recursive: true });
     atomicWriteFileSync(abs, w.content);
   }
   for (const d of plan.deletes) {
-    rmSync10(join60(root, ...d.split("/")), { force: true });
+    rmSync10(join61(root, ...d.split("/")), { force: true });
     pruneEmptyDirs(root, d);
   }
 }
@@ -108252,7 +109092,7 @@ function invalidArguments(message) {
   return new BuildError("Invalid arguments", message);
 }
 function checkedName(parameter) {
-  if (!TOKEN2.test(parameter.name)) {
+  if (!TOKEN3.test(parameter.name)) {
     throw new BuildError(
       "Invalid request",
       `The ${parameter.in} parameter name ${parameter.name} is not an HTTP token.`
@@ -108334,7 +109174,7 @@ function cookiePairs(parameter, value) {
     ]
   ] : shape.kind === "list" ? shape.items.map((item) => [name, item]) : shape.entries;
   for (const [cookie, text5] of pairs) {
-    if (!TOKEN2.test(cookie)) {
+    if (!TOKEN3.test(cookie)) {
       throw invalidArguments(
         `The cookie ${parameter.name} holds a key that is not an HTTP token, so no cookie can take it as a name.`
       );
@@ -108377,12 +109217,12 @@ function queryEntries(parameter, value) {
       }
       if (shape.items.length === 0) return [];
       if (explode) return shape.items.map((item) => pair(name, item));
-      const [raw, delimiter2] = style === "form" ? [",", ","] : style === "spaceDelimited" ? [" ", "%20"] : ["|", "|"];
+      const [raw, delimiter3] = style === "form" ? [",", ","] : style === "spaceDelimited" ? [" ", "%20"] : ["|", "|"];
       return [
         entry(
           name,
           shape.items.join(raw),
-          `${enc(name)}=${shape.items.map(val).join(delimiter2)}`
+          `${enc(name)}=${shape.items.map(val).join(delimiter3)}`
         )
       ];
     }
@@ -108599,7 +109439,7 @@ function createHttpSender(options = {}) {
     }
   };
 }
-var IDEMPOTENT_METHODS, RESERVED_HEADERS, TOKEN2, UNSAFE_HEADER_VALUE, UNSAFE_COOKIE_VALUE;
+var IDEMPOTENT_METHODS, RESERVED_HEADERS, TOKEN3, UNSAFE_HEADER_VALUE, UNSAFE_COOKIE_VALUE;
 var init_http = __esm({
   "../../packages/mcp-studio/src/execute/http.ts"() {
     "use strict";
@@ -108627,7 +109467,7 @@ var init_http = __esm({
       "proxy-authorization",
       "cookie"
     ]);
-    TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
     UNSAFE_HEADER_VALUE = /[\r\n\0]/;
     UNSAFE_COOKIE_VALUE = /[;\r\n\0]/;
   }
@@ -130164,7 +131004,7 @@ import {
   readlinkSync as readlinkSync4,
   statSync as statSync16
 } from "node:fs";
-import { dirname as dirname34, isAbsolute as isAbsolute15, join as join61, relative as relative9, resolve as resolve24, sep as sep12 } from "node:path";
+import { dirname as dirname34, isAbsolute as isAbsolute15, join as join62, relative as relative9, resolve as resolve24, sep as sep12 } from "node:path";
 function git5(cwd, args, input) {
   try {
     return execFileSync2("git", args, {
@@ -130196,7 +131036,7 @@ function commitOf2(root, ref2) {
   return sha2.length > 0 ? sha2 : null;
 }
 function readWorkingFile(root, path2) {
-  const abs = join61(root, ...path2.split("/"));
+  const abs = join62(root, ...path2.split("/"));
   try {
     const stat7 = lstatSync12(abs);
     if (stat7.isSymbolicLink()) return readlinkSync4(abs, "utf8");
@@ -130290,7 +131130,7 @@ function isDir(path2) {
 function findSteeringRoot(start) {
   let dir = resolve24(start);
   for (; ; ) {
-    if (isFile(join61(dir, WORKSPACE_TOML_PATH)) || isFile(join61(dir, AGENTS_MD_PATH)) && isDir(join61(dir, STEERING_DIR))) {
+    if (isFile(join62(dir, WORKSPACE_TOML_PATH)) || isFile(join62(dir, AGENTS_MD_PATH)) && isDir(join62(dir, STEERING_DIR))) {
       return dir;
     }
     const parent = dirname34(dir);
@@ -130370,7 +131210,7 @@ function cacheFile(cacheDir, root) {
     key: token === void 0 ? null : createHash20("sha256").update(token).digest("hex").slice(0, 16)
   };
   const key = createHash20("sha256").update(JSON.stringify([root, identity])).digest("hex").slice(0, 32);
-  return join61(cacheDir, `${key}.json`);
+  return join62(cacheDir, `${key}.json`);
 }
 function readCache(file, now) {
   let entry2;
@@ -130484,7 +131324,7 @@ function defaultDeps2() {
   return {
     fetchPublished: fetchSteeringIndex,
     cedar: cedarHooks,
-    cacheDir: join61(getConfigDir(), "cache", "steering-check"),
+    cacheDir: join62(getConfigDir(), "cache", "steering-check"),
     now: () => Date.now()
   };
 }
@@ -134367,7 +135207,7 @@ var init_src9 = __esm({
 
 // src/commands/codegraph-upload/files.ts
 import { readdir as readdir5, stat as stat5 } from "node:fs/promises";
-import { join as join62, relative as relative10, sep as sep13 } from "node:path";
+import { join as join63, relative as relative10, sep as sep13 } from "node:path";
 function hasGlobChars(pattern) {
   return /[*?[\]{}]/.test(pattern);
 }
@@ -134379,7 +135219,7 @@ async function walk(root, dir, out) {
   const entries2 = await readdir5(dir, { withFileTypes: true });
   for (const entry2 of entries2) {
     if (entry2.isSymbolicLink()) continue;
-    const full = join62(dir, entry2.name);
+    const full = join63(dir, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name)) await walk(root, full, out);
     } else if (entry2.isFile()) {
@@ -134391,7 +135231,7 @@ async function expandPattern(root, pattern) {
   const wanted = normalize2(pattern.trim());
   if (!hasGlobChars(wanted)) {
     try {
-      const info = await stat5(join62(root, wanted));
+      const info = await stat5(join63(root, wanted));
       return info.isFile() ? [wanted] : [];
     } catch {
       return [];
@@ -134542,7 +135382,7 @@ var init_token = __esm({
 });
 
 // src/commands/codegraph-upload/run.ts
-import { join as join63 } from "node:path";
+import { join as join64 } from "node:path";
 function addDropped(into, more) {
   into.sensitiveValues += more.sensitiveValues;
   into.secretData += more.secretData;
@@ -134560,7 +135400,7 @@ async function uploadOne(deps, config, token, group, path2, totals2) {
   const label2 = `${group.kind}/${group.source} ${path2}`;
   let bytes;
   try {
-    bytes = await deps.readFile(join63(deps.cwd, path2));
+    bytes = await deps.readFile(join64(deps.cwd, path2));
   } catch (error) {
     totals2.failed += 1;
     deps.log(`error: ${label2}: cannot read the file: ${error.message}`);