@redstone-md/mapr 0.0.5-alpha → 0.0.6-alpha

package/README.md

@@ -10,6 +10,7 @@ This repository is public for source visibility and collaboration. The license r
 
 - Bun-only CLI/TUI with interactive setup through `@clack/prompts`
 - OpenAI and OpenAI-compatible provider support
+- OpenAI Codex family support with fast/reasoning selection
 - Built-in provider presets for BlackBox AI, Nvidia NIM, and OnlySQ
 - Model discovery with searchable selection
 - Automatic context-window detection from provider model metadata when available
@@ -77,6 +78,14 @@ npx @redstone-md/mapr --help
 - `onlysq` -> `https://api.onlysq.ru/ai/openai`
 - `custom` -> any other OpenAI-compatible endpoint
 
+## OpenAI Auth Modes
+
+- `API key` uses the standard OpenAI API at `https://api.openai.com/v1`
+- `Use existing Codex CLI auth` reuses the local `codex login` browser session from `~/.codex/auth.json`
+- Codex CLI auth automatically switches OpenAI requests to `https://chatgpt.com/backend-api/codex`
+- When the local Codex access token expires, Mapr refreshes it through the official OpenAI refresh-token flow before retrying the request
+- If Codex CLI auth is missing, run `codex login` first and then re-run Mapr
+
 ## Usage
 
 Interactive:
@@ -105,6 +114,17 @@ List models with detected context sizes when available:
 npx @redstone-md/mapr --list-models --headless --provider-preset nvidia-nim --api-key secret
 ```
 
+List models through an existing Codex CLI login:
+
+```bash
+npx @redstone-md/mapr \
+  --headless \
+  --list-models \
+  --provider-type openai \
+  --auth-method codex-cli \
+  --codex-home ~/.codex
+```
+
 Useful flags:
 
 - `--max-pages <n>` limits same-origin HTML pages

package/index.ts

@@ -9,7 +9,8 @@ import { AiBundleAnalyzer, chunkTextByBytes, deriveChunkSizeBytes } from "./lib/
 import { getConfigOverrides, parseCliArgs, renderHelpText } from "./lib/cli-args";
 import { ConfigManager } from "./lib/config";
 import { BundleFormatter } from "./lib/formatter";
-import { renderProgressBar } from "./lib/progress";
+import { renderAdaptiveAnalysisProgressLine, renderProgressBar } from "./lib/progress";
+import { findKnownModelInfo, isCodexModel } from "./lib/provider";
 import { ReportWriter } from "./lib/reporter";
 import { BundleScraper } from "./lib/scraper";
 import { SWARM_AGENT_ORDER } from "./lib/swarm-prompts";
@@ -177,6 +178,7 @@ async function run(): Promise<void> {
   const analysisConcurrency = await resolveAnalysisConcurrency(headless, args.analysisConcurrency, totalChunks);
   const totalAgentTasks = Math.max(1, totalChunks * SWARM_AGENT_ORDER.length);
   let completedAgentTasks = 0;
+  const analysisStartedAt = Date.now();
 
   const analysisStep = spinner({ indicator: "timer" });
   analysisStep.start(formatAnalysisProgress(0, totalAgentTasks, `Starting swarm analysis (${analysisConcurrency} lane${analysisConcurrency === 1 ? "" : "s"})`));
@@ -190,7 +192,24 @@ async function run(): Promise<void> {
         completedAgentTasks += 1;
       }
 
-      const progressLine = formatAnalysisProgress(completedAgentTasks, totalAgentTasks, event.message);
+      const progressLine =
+        event.stage === "agent" && event.agent
+          ? renderAdaptiveAnalysisProgressLine({
+              completed: completedAgentTasks,
+              total: totalAgentTasks,
+              elapsedMs: Date.now() - analysisStartedAt,
+              agent: event.agent,
+              state: event.state,
+              artifactUrl: event.artifactUrl,
+              ...(event.chunkIndex !== undefined ? { chunkIndex: event.chunkIndex } : {}),
+              ...(event.chunkCount !== undefined ? { chunkCount: event.chunkCount } : {}),
+              ...(event.estimatedOutputTokens !== undefined
+                ? { estimatedOutputTokens: event.estimatedOutputTokens }
+                : {}),
+              ...(event.outputTokens !== undefined ? { outputTokens: event.outputTokens } : {}),
+              ...(event.tokensPerSecond !== undefined ? { tokensPerSecond: event.tokensPerSecond } : {}),
+            })
+          : formatAnalysisProgress(completedAgentTasks, totalAgentTasks, event.message);
       analysisStep.message(progressLine);
 
       if (args.verboseAgents && event.stage === "agent" && event.state === "completed") {
@@ -247,12 +266,16 @@ async function run(): Promise<void> {
   });
   reportStep.stop(reportStatus === "partial" ? "Partial report written to disk" : "Report written to disk");
 
+  const selectedModelInfo = findKnownModelInfo(config.model);
   const summaryLines = [
     reportStatus === "partial" ? `${pc.yellow("Analysis incomplete.")}` : `${pc.green("Analysis complete.")}`,
     `${pc.bold("Status:")} ${reportStatus === "partial" ? "partial report saved after error" : "complete"}`,
     `${pc.bold("Target:")} ${scrapeResult.pageUrl}`,
     `${pc.bold("Provider:")} ${config.providerName} (${config.model})`,
+    ...(config.authMethod !== undefined ? [`${pc.bold("Auth:")} ${config.authMethod}`] : []),
     `${pc.bold("Context size:")} ${config.modelContextSize.toLocaleString()} tokens`,
+    ...(config.openAiMode !== undefined ? [`${pc.bold("OpenAI mode:")} ${config.openAiMode}`] : []),
+    ...(isCodexModel(config.model) && selectedModelInfo?.usageLimitsNote ? [`${pc.bold("Codex limits:")} ${selectedModelInfo.usageLimitsNote}`] : []),
     `${pc.bold("Concurrency:")} ${analysisConcurrency}`,
     `${pc.bold("Local RAG:")} ${args.localRag ? "enabled" : "disabled"}`,
     `${pc.bold("Pages:")} ${scrapeResult.htmlPages.length}`,

package/lib/ai-analyzer.ts

@@ -85,12 +85,14 @@ export class AiBundleAnalyzer {
   private readonly localRagEnabled: boolean;
   private readonly analysisConcurrency: number;
   private readonly onProgress: ((event: AnalysisProgressEvent) => void) | undefined;
+  private readonly providerOptions: Record<string, unknown>;
 
   public constructor(options: AnalyzerOptions) {
     this.providerClient = new AiProviderClient(options.providerConfig);
     this.chunkSizeBytes = options.chunkSizeBytes ?? deriveChunkSizeBytes(options.providerConfig.modelContextSize);
     this.localRagEnabled = options.localRag ?? false;
     this.analysisConcurrency = Math.max(1, Math.floor(options.analysisConcurrency ?? 1));
+    this.providerOptions = this.providerClient.getProviderOptions();
     this.onProgress = options.onProgress;
   }
 
@@ -271,7 +273,7 @@ export class AiBundleAnalyzer {
       ].join("\n"),
       attempts: 4,
       maxRetries: 2,
-      providerOptions: { openai: { store: false } },
+      providerOptions: this.providerOptions,
       onRetry: (attempt, error) =>
         this.emitAgentEvent(
           "streaming",
@@ -306,7 +308,7 @@ export class AiBundleAnalyzer {
       ].join("\n"),
       attempts: 4,
       maxRetries: 2,
-      providerOptions: { openai: { store: false } },
+      providerOptions: this.providerOptions,
       onRetry: (attempt, error) =>
         this.emitAgentEvent(
           "streaming",
@@ -346,7 +348,7 @@ export class AiBundleAnalyzer {
         ].join("\n"),
         attempts: 4,
         maxRetries: 2,
-        providerOptions: { openai: { store: false } },
+        providerOptions: this.providerOptions,
       });
 
       return finalAnalysisSchema.parse({

package/lib/cli-args.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { getProviderPreset, providerPresetSchema, providerTypeSchema } from "./provider";
+import { authMethodSchema, getProviderPreset, openAiModeSchema, providerPresetSchema, providerTypeSchema } from "./provider";
 
 const rawCliArgsSchema = z.object({
   help: z.boolean().default(false),
@@ -14,8 +14,11 @@ const rawCliArgsSchema = z.object({
   output: z.string().min(1).optional(),
   providerType: providerTypeSchema.optional(),
   providerPreset: providerPresetSchema.optional(),
+  openAiMode: openAiModeSchema.optional(),
+  authMethod: authMethodSchema.optional(),
   providerName: z.string().min(1).optional(),
   apiKey: z.string().min(1).optional(),
+  codexHomePath: z.string().min(1).optional(),
   baseURL: z.string().url().optional(),
   model: z.string().min(1).optional(),
   contextSize: z.number().int().positive().optional(),
@@ -29,8 +32,11 @@ const cliConfigOverrideSchema = z
   .object({
     providerType: providerTypeSchema.optional(),
     providerPreset: providerPresetSchema.optional(),
+    openAiMode: openAiModeSchema.optional(),
+    authMethod: authMethodSchema.optional(),
     providerName: z.string().min(1).optional(),
     apiKey: z.string().min(1).optional(),
+    codexHomePath: z.string().min(1).optional(),
     baseURL: z.string().url().optional(),
     model: z.string().min(1).optional(),
     modelContextSize: z.number().int().positive().optional(),
@@ -54,8 +60,11 @@ const optionMap = new Map<string, keyof CliArgs>([
   ["--output", "output"],
   ["--provider-type", "providerType"],
   ["--provider-preset", "providerPreset"],
+  ["--openai-mode", "openAiMode"],
+  ["--auth-method", "authMethod"],
   ["--provider-name", "providerName"],
   ["--api-key", "apiKey"],
+  ["--codex-home", "codexHomePath"],
   ["--base-url", "baseURL"],
   ["--model", "model"],
   ["--context-size", "contextSize"],
@@ -117,6 +126,8 @@ export function getConfigOverrides(args: CliArgs) {
   const overrides: Record<string, unknown> = {};
 
   if (args.providerType !== undefined) overrides.providerType = args.providerType;
+  if (args.openAiMode !== undefined) overrides.openAiMode = args.openAiMode;
+  if (args.authMethod !== undefined) overrides.authMethod = args.authMethod;
   if (args.providerPreset !== undefined) {
     const preset = getProviderPreset(args.providerPreset);
     overrides.providerType = "openai-compatible";
@@ -126,6 +137,7 @@ export function getConfigOverrides(args: CliArgs) {
   }
   if (args.providerName !== undefined) overrides.providerName = args.providerName;
   if (args.apiKey !== undefined) overrides.apiKey = args.apiKey;
+  if (args.codexHomePath !== undefined) overrides.codexHomePath = args.codexHomePath;
   if (args.baseURL !== undefined) overrides.baseURL = args.baseURL;
   if (args.model !== undefined) overrides.model = args.model;
   if (args.contextSize !== undefined) overrides.modelContextSize = args.contextSize;
@@ -151,8 +163,11 @@ export function renderHelpText(): string {
     "Provider options:",
     "  --provider-type <type>          openai | openai-compatible",
     "  --provider-preset <preset>      custom | blackbox | nvidia-nim | onlysq",
+    "  --openai-mode <mode>            fast | reasoning",
+    "  --auth-method <method>          api-key | codex-cli",
     "  --provider-name <name>          Display name for the provider",
     "  --api-key <key>                 Provider API key",
+    "  --codex-home <path>             Path to the local Codex CLI home, defaults to ~/.codex",
     "  --base-url <url>                Base URL for the provider",
     "  --model <id>                    Model identifier",
     "  --context-size <tokens>         Model context window, for example 128000 or 512000",

package/lib/codex-auth.ts

@@ -0,0 +1,275 @@
+import { readFile, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+import { z } from "zod";
+
+export const CODEX_REFRESH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export const DEFAULT_CODEX_HOME_PATH = join(homedir(), ".codex");
+export const DEFAULT_CHATGPT_CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex";
+const DEFAULT_REFRESH_ENDPOINT = "https://auth.openai.com/oauth/token";
+const TOKEN_REFRESH_LEEWAY_MS = 5 * 60 * 1000;
+
+const codexTokenSchema = z
+  .object({
+    id_token: z.string().min(1),
+    access_token: z.string().min(1),
+    refresh_token: z.string().min(1),
+    account_id: z.string().min(1).nullable().optional(),
+  })
+  .strict();
+
+const codexAuthFileSchema = z
+  .object({
+    auth_mode: z.string().optional(),
+    OPENAI_API_KEY: z.string().nullable().optional(),
+    tokens: codexTokenSchema.optional(),
+    last_refresh: z.string().min(1).optional(),
+  })
+  .strict();
+
+const refreshResponseSchema = z
+  .object({
+    id_token: z.string().min(1).optional(),
+    access_token: z.string().min(1).optional(),
+    refresh_token: z.string().min(1).optional(),
+  })
+  .passthrough();
+
+type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+type HeaderLike = Headers | Array<[string, string]> | Record<string, string>;
+
+export interface CodexCliAuthState {
+  accessToken: string;
+  refreshToken: string;
+  accountId: string;
+  planType?: string;
+  expiresAt?: number;
+  idToken: string;
+  authFilePath: string;
+}
+
+function parseJwtPayload(token: string): Record<string, unknown> {
+  const payload = token.split(".")[1];
+  if (!payload) {
+    throw new Error("Codex token is malformed.");
+  }
+
+  const normalizedPayload = payload.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = normalizedPayload.length % 4 === 0 ? "" : "=".repeat(4 - (normalizedPayload.length % 4));
+  const decoded = Buffer.from(`${normalizedPayload}${padding}`, "base64").toString("utf8");
+  return z.record(z.string(), z.unknown()).parse(JSON.parse(decoded) as unknown);
+}
+
+function extractString(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim().length > 0 ? value : undefined;
+}
+
+function extractAccountId(idToken: string, fallbackAccountId?: string): string | undefined {
+  const payload = parseJwtPayload(idToken);
+  const auth = z.record(z.string(), z.unknown()).safeParse(payload["https://api.openai.com/auth"]);
+  if (auth.success) {
+    return extractString(auth.data.chatgpt_account_id) ?? fallbackAccountId;
+  }
+
+  return fallbackAccountId;
+}
+
+function extractPlanType(idToken: string): string | undefined {
+  const payload = parseJwtPayload(idToken);
+  const auth = z.record(z.string(), z.unknown()).safeParse(payload["https://api.openai.com/auth"]);
+  if (!auth.success) {
+    return undefined;
+  }
+
+  return extractString(auth.data.chatgpt_plan_type)?.toLowerCase();
+}
+
+function extractExpiresAt(accessToken: string): number | undefined {
+  const payload = parseJwtPayload(accessToken);
+  const exp = payload.exp;
+  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1000 : undefined;
+}
+
+function mergeHeaders(input: HeaderLike | undefined, overrides: Record<string, string>): Headers {
+  const headers = new Headers(input);
+  for (const [key, value] of Object.entries(overrides)) {
+    headers.set(key, value);
+  }
+  return headers;
+}
+
+export class CodexCliAuthManager {
+  private readonly codexHomePath: string;
+  private readonly fetcher: FetchLike;
+  private refreshPromise: Promise<CodexCliAuthState> | null = null;
+
+  public constructor(options: { codexHomePath?: string; fetcher?: FetchLike } = {}) {
+    this.codexHomePath = options.codexHomePath ?? DEFAULT_CODEX_HOME_PATH;
+    this.fetcher = options.fetcher ?? fetch;
+  }
+
+  public getCodexHomePath(): string {
+    return this.codexHomePath;
+  }
+
+  public getAuthFilePath(): string {
+    return join(this.codexHomePath, "auth.json");
+  }
+
+  public async loadState(): Promise<CodexCliAuthState> {
+    const raw = await readFile(this.getAuthFilePath(), "utf8");
+    const parsed = codexAuthFileSchema.parse(JSON.parse(raw) as unknown);
+    if (!parsed.tokens) {
+      throw new Error(`Codex CLI auth was not found at ${this.getAuthFilePath()}. Run \`codex login\` first.`);
+    }
+
+    const accountId = extractAccountId(parsed.tokens.id_token, parsed.tokens.account_id ?? undefined);
+    if (!accountId) {
+      throw new Error("Codex CLI auth is missing a ChatGPT account identifier.");
+    }
+
+    return {
+      accessToken: parsed.tokens.access_token,
+      refreshToken: parsed.tokens.refresh_token,
+      accountId,
+      ...(extractPlanType(parsed.tokens.id_token) !== undefined
+        ? { planType: extractPlanType(parsed.tokens.id_token)! }
+        : {}),
+      ...(extractExpiresAt(parsed.tokens.access_token) !== undefined
+        ? { expiresAt: extractExpiresAt(parsed.tokens.access_token)! }
+        : {}),
+      idToken: parsed.tokens.id_token,
+      authFilePath: this.getAuthFilePath(),
+    };
+  }
+
+  public async ensureFreshState(): Promise<CodexCliAuthState> {
+    const state = await this.loadState();
+    if (!this.shouldRefresh(state)) {
+      return state;
+    }
+
+    return this.refreshState();
+  }
+
+  public async buildAuthHeaders(): Promise<Record<string, string>> {
+    const state = await this.ensureFreshState();
+    return {
+      Authorization: `Bearer ${state.accessToken}`,
+      "ChatGPT-Account-Id": state.accountId,
+      Accept: "application/json",
+    };
+  }
+
+  public createAuthenticatedFetch(baseFetch: FetchLike = this.fetcher): FetchLike {
+    return async (input, init) => {
+      const sourceRequest = input instanceof Request ? input : new Request(String(input), init);
+      const requestBody =
+        sourceRequest.method === "GET" || sourceRequest.method === "HEAD"
+          ? undefined
+          : await sourceRequest.clone().arrayBuffer();
+      const execute = async (forceRefresh = false): Promise<Response> => {
+        const state = forceRefresh ? await this.refreshState() : await this.ensureFreshState();
+        const headers = mergeHeaders(sourceRequest.headers, {
+          Authorization: `Bearer ${state.accessToken}`,
+          "ChatGPT-Account-Id": state.accountId,
+        });
+        const request = new Request(sourceRequest, {
+          headers,
+          ...(requestBody !== undefined ? { body: requestBody.slice(0) } : {}),
+        });
+
+        const response = await baseFetch(request);
+
+        if (response.status !== 401 || forceRefresh) {
+          return response;
+        }
+
+        return execute(true);
+      };
+
+      return execute(false);
+    };
+  }
+
+  public async refreshState(): Promise<CodexCliAuthState> {
+    if (!this.refreshPromise) {
+      this.refreshPromise = this.refreshStateInternal().finally(() => {
+        this.refreshPromise = null;
+      });
+    }
+
+    return this.refreshPromise;
+  }
+
+  private shouldRefresh(state: CodexCliAuthState): boolean {
+    return state.expiresAt !== undefined && state.expiresAt - Date.now() <= TOKEN_REFRESH_LEEWAY_MS;
+  }
+
+  private async refreshStateInternal(): Promise<CodexCliAuthState> {
+    const current = await this.loadState();
+    const response = await this.fetcher(DEFAULT_REFRESH_ENDPOINT, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify({
+        client_id: CODEX_REFRESH_CLIENT_ID,
+        grant_type: "refresh_token",
+        refresh_token: current.refreshToken,
+      }),
+    });
+
+    const bodyText = await response.text();
+    if (!response.ok) {
+      let message = bodyText.trim();
+      try {
+        const parsedError = z.record(z.string(), z.unknown()).parse(JSON.parse(bodyText) as unknown);
+        const nestedError = parsedError.error;
+        if (typeof nestedError === "string") {
+          message = nestedError;
+        } else if (nestedError && typeof nestedError === "object" && "message" in nestedError) {
+          message = extractString((nestedError as Record<string, unknown>).message) ?? message;
+        }
+      } catch {
+        // Keep the raw response body when the backend did not return JSON.
+      }
+
+      throw new Error(`Codex CLI auth refresh failed: ${response.status} ${message || response.statusText}`);
+    }
+
+    const refresh = refreshResponseSchema.parse(JSON.parse(bodyText) as unknown);
+    const nextIdToken = refresh.id_token ?? current.idToken;
+    const nextAccessToken = refresh.access_token ?? current.accessToken;
+    const nextRefreshToken = refresh.refresh_token ?? current.refreshToken;
+    const nextAccountId = extractAccountId(nextIdToken, current.accountId);
+    if (!nextAccountId) {
+      throw new Error("Codex CLI auth refresh returned a token without a ChatGPT account identifier.");
+    }
+
+    const persisted = {
+      auth_mode: "chatgpt",
+      OPENAI_API_KEY: null,
+      tokens: {
+        id_token: nextIdToken,
+        access_token: nextAccessToken,
+        refresh_token: nextRefreshToken,
+        account_id: nextAccountId,
+      },
+      last_refresh: new Date().toISOString(),
+    };
+
+    await writeFile(this.getAuthFilePath(), `${JSON.stringify(persisted, null, 2)}\n`, "utf8");
+
+    return {
+      accessToken: nextAccessToken,
+      refreshToken: nextRefreshToken,
+      accountId: nextAccountId,
+      ...(extractPlanType(nextIdToken) !== undefined ? { planType: extractPlanType(nextIdToken)! } : {}),
+      ...(extractExpiresAt(nextAccessToken) !== undefined ? { expiresAt: extractExpiresAt(nextAccessToken)! } : {}),
+      idToken: nextIdToken,
+      authFilePath: this.getAuthFilePath(),
+    };
+  }
+}

package/lib/config-prompts.ts

@@ -0,0 +1,74 @@
+import { select, text } from "@clack/prompts";
+import { z } from "zod";
+
+import { DEFAULT_CODEX_HOME_PATH } from "./codex-auth";
+import { DEFAULT_MODEL_CONTEXT_SIZE } from "./provider";
+
+type ExitIfCancelled = <T>(value: T) => T;
+
+export async function promptForContextSize(defaultValue: number, exitIfCancelled: ExitIfCancelled): Promise<number> {
+  const rawValue = exitIfCancelled(
+    await text({
+      message: "Model context size in tokens",
+      placeholder: String(DEFAULT_MODEL_CONTEXT_SIZE),
+      initialValue: String(defaultValue),
+      validate(value) {
+        const parsed = z.coerce.number().int().positive().safeParse(value);
+        return parsed.success ? undefined : "Context size must be a positive integer.";
+      },
+    }),
+  );
+
+  return z.coerce.number().int().positive().parse(rawValue);
+}
+
+export async function promptForAuthMethod<T>(
+  initialMethod: "api-key" | "codex-cli" | undefined,
+  exitIfCancelled: ExitIfCancelled,
+): Promise<"api-key" | "codex-cli"> {
+  return exitIfCancelled(
+    await select({
+      message: "OpenAI auth method",
+      initialValue: initialMethod ?? "api-key",
+      options: [
+        { value: "api-key", label: "API key", hint: "Use a standard OpenAI API key" },
+        { value: "codex-cli", label: "Use existing Codex CLI auth", hint: "Reuse `codex login` browser sign-in" },
+      ],
+    }),
+  ) as "api-key" | "codex-cli";
+}
+
+export async function promptForCodexMode(
+  initialMode: "fast" | "reasoning" | undefined,
+  exitIfCancelled: ExitIfCancelled,
+): Promise<"fast" | "reasoning"> {
+  return exitIfCancelled(
+    await select({
+      message: "Codex mode",
+      initialValue: initialMode ?? "reasoning",
+      options: [
+        { value: "fast", label: "Fast", hint: "Prefer mini / lower-latency Codex variant" },
+        { value: "reasoning", label: "Reasoning", hint: "Prefer max / deeper reasoning Codex variant" },
+      ],
+    }),
+  ) as "fast" | "reasoning";
+}
+
+export async function promptForCodexHomePath(
+  initialPath: string | undefined,
+  exitIfCancelled: ExitIfCancelled,
+): Promise<string> {
+  return z.string().trim().min(1).parse(
+    exitIfCancelled(
+      await text({
+        message: "Codex CLI home path",
+        placeholder: DEFAULT_CODEX_HOME_PATH,
+        initialValue: initialPath ?? DEFAULT_CODEX_HOME_PATH,
+        validate(value) {
+          const parsed = z.string().trim().min(1).safeParse(value);
+          return parsed.success ? undefined : "Codex home path is required.";
+        },
+      }),
+    ),
+  );
+}