@stratusagent/cli 0.9.1 → 0.10.0

package/dist/index.js

@@ -17,8 +17,9 @@ import { createLocalCommandExecutor, } from '@stratusagent/executor-local';
 import { loadPlugins } from '@stratusagent/plugins';
 import { createFileCommandWhitelist, createPermissionPolicy, describeCommandScope, } from '@stratusagent/permissions';
 import { DEFAULT_ANTHROPIC_MODEL, redactAnthropicRawTurns, } from '@stratusagent/provider-anthropic';
+import { DEFAULT_CODEX_MODEL } from '@stratusagent/provider-codex';
 import { canonicalDestination, createForgetTool, createRecallTool, createRememberTool, defineAgent, describeCadence, describeSchedule, FORGET_TOOL_NAME, MEMORY_TOOL_NAME, formatSoul, generateAgentName, parseSoul, } from '@stratusagent/agents';
-import { agentsDirPath, claimSoulFile, collectAvailableModels as collectModels, createDemoTool, createFileMemoryStore, createRuntimeProvider, credentialsPath, defaultApiKeyEnvName, DEFAULT_ANTHROPIC_BASE_URL, DEFAULT_OPENAI_BASE_URL, DEFAULT_OPENAI_MODEL, DEFAULT_STRATUS_AGENT, discoverActiveConfig, globalConfigPath, loadChannelCredentials, loadCredentials, installSkillsFromDirectory, loadOperatorSkills, loadRosterSouls, skillsDirPath, listAgentSummaries, loadSoulFile, memoryFilePath, migrateLegacyMemory, parseProviderName, readNonEmptyString, readProcessEnv, resolveConfiguredSoul, logsDirPath, readWorkingDirectory, resolveAgentApprovals, DEFAULT_CONFIG_FILENAME, loadConfigFile, resolveConfigLocation, resolveRuntimeConfig as resolveStateRuntimeConfig, saveChannelCredentials, saveConfigFile, readTrustedConfigBlock, saveCredentials, servedRuntimes, verifyProviderKey, withLegacyDefaultMemories, workspacesDirPath, gatewayInfoPath, gatewayTokenPath, newerStateMessage, pendingStateMigrations, readStateStamp, runStateMigrations, STATE_SCHEMA_VERSION, } from '@stratusagent/state';
+import { agentsDirPath, claimSoulFile, collectAvailableModels as collectModels, createDemoTool, createFileMemoryStore, createRuntimeProvider, credentialsPath, defaultApiKeyEnvName, DEFAULT_ANTHROPIC_BASE_URL, DEFAULT_OPENAI_BASE_URL, DEFAULT_OPENAI_MODEL, DEFAULT_STRATUS_AGENT, discoverActiveConfig, globalConfigPath, loadChannelCredentials, loadCredentials, installSkillsFromDirectory, loadOperatorSkills, loadRosterSouls, skillsDirPath, listAgentSummaries, loadSoulFile, memoryFilePath, migrateLegacyMemory, parseProviderName, readNonEmptyString, readProcessEnv, resolveConfiguredSoul, logsDirPath, readWorkingDirectory, resolveAgentApprovals, DEFAULT_CONFIG_FILENAME, loadConfigFile, resolveConfigLocation, resolveRuntimeConfig as resolveStateRuntimeConfig, saveChannelCredentials, saveConfigFile, readTrustedConfigBlock, saveCredentials, servedRuntimes, CREDENTIAL_PROVIDER_NAMES, verifyProviderKey, withLegacyDefaultMemories, workspacesDirPath, gatewayInfoPath, gatewayTokenPath, newerStateMessage, pendingStateMigrations, readStateStamp, runStateMigrations, STATE_SCHEMA_VERSION, } from '@stratusagent/state';
 import { installService, readServiceCommand, readServiceStatus, servicePlatform, serviceUnitPath, startService, stopService, uninstallService, } from "./service.js";
 export { installService, launchdPlist, readServiceCommand, readServiceStatus, servicePlatform, serviceUnitPath, startService, stopService, systemdUnit, uninstallService, SERVICE_LABEL, } from "./service.js";
 import { createLogWriter, currentLogPosition, truncateRedirectLogs, formatLogRecord, readRecentRecords, tailLog, } from "./logs.js";
@@ -122,7 +123,7 @@ const defaultPackageInstaller = async (packages) => {
         });
     });
 };
-export const CLI_VERSION = '0.9.1';
+export const CLI_VERSION = '0.10.0';
 const DASHBOARD_TITLE = 'Stratus Agent Dashboard';
 /**
  * The range every package declares in its `engines` field. Two floors, not
@@ -161,6 +162,70 @@ export const unsupportedNodeMessage = (version) => {
         + "The gateway's session store uses node:sqlite, unflagged in 22.13.0 and, on the 23.x line, not until 23.4.0.\n"
         + 'Upgrade with `brew install node` on macOS, or your package manager or nvm on Linux.';
 };
+/**
+ * The warning listeners to install in place of Node's default one, so the
+ * `node:sqlite` ExperimentalWarning stops being the first thing the CLI
+ * prints.
+ *
+ * The session store imports `node:sqlite`, which is experimental on every
+ * Node release this supports — that is exactly why
+ * {@link SUPPORTED_NODE_RANGE} is written the way it is — so the warning
+ * announces a dependency the project chose deliberately and a user can do
+ * nothing about. It landed above `stratusd ready` on every `stratus serve`,
+ * and on `stratus schedules`.
+ *
+ * Filtered rather than silenced wholesale (`--no-warnings` would be the
+ * blunt version): every other warning still reaches stderr through the
+ * listeners passed in, because a deprecation in our own dependencies is
+ * ours to act on.
+ */
+export const withoutSqliteExperimentalWarning = (listeners) => (warning) => {
+    if (warning.name === 'ExperimentalWarning' && /\bSQLite\b/i.test(warning.message)) {
+        return;
+    }
+    for (const listener of listeners) {
+        listener(warning);
+    }
+};
+/**
+ * The name Node gives its own `warning` printer. Matched rather than assumed
+ * so that a Node which renames it simply stops being filtered — the warning
+ * comes back, which is noise, where guessing wrong would rewrite somebody
+ * else's listener.
+ */
+const NODE_DEFAULT_WARNING_LISTENER = 'onWarning';
+/**
+ * Swap Node's default warning printer for the filtered one above.
+ *
+ * Node installs its printer as an ordinary `warning` listener, so adding one
+ * alongside it would print twice rather than filter; the default has to come
+ * off and be handed to the replacement.
+ *
+ * **Only ever Node's own printer.** Wrapping a listener somebody else
+ * registered changes it in two ways that are not ours to change: `listeners()`
+ * hands back the *unwrapped* function for a `once` listener, so re-registering
+ * it makes it permanent — it then runs for every later warning instead of one
+ * — and a caller that keeps a reference can no longer `process.off('warning',
+ * theirs)`, because what is registered is this wrapper. So when anything other
+ * than the default is present — a `--require` preload, an embedding host — this
+ * does nothing at all and the warning stays. A host that took an interest in
+ * warnings owns them.
+ *
+ * Called once from the binary, before anything imports the session store.
+ */
+export const filterSqliteExperimentalWarning = (process_ = process) => {
+    // rawListeners, not listeners: the wrapper is the registration, and only it
+    // carries the once-ness. It matters even here, where the guard below means
+    // the sole listener is Node's own — the next reader should not have to know
+    // that to see why this is safe.
+    const existing = process_.rawListeners('warning');
+    const [only] = existing;
+    if (existing.length !== 1 || only?.name !== NODE_DEFAULT_WARNING_LISTENER) {
+        return;
+    }
+    process_.removeAllListeners('warning');
+    process_.on('warning', withoutSqliteExperimentalWarning([only]));
+};
 const HELP_TEXT = `Stratus Agent CLI
 
 Usage:
@@ -265,8 +330,8 @@ Agent options:
 Options:
   --prompt, -p     Prompt to send to the local agent loop
   --stdin          Read the prompt from stdin
-  --provider       Provider to use: anthropic, openai, or demo
-  --model          Model name for real providers (anthropic default: ${DEFAULT_ANTHROPIC_MODEL}, openai default: gpt-4.1-mini)
+  --provider       Provider to use: anthropic, openai, codex, or demo
+  --model          Model name for real providers (anthropic default: ${DEFAULT_ANTHROPIC_MODEL}, openai default: gpt-4.1-mini, codex default: ${DEFAULT_CODEX_MODEL})
   --base-url       Override the provider API base URL
   --soul           Run as the agent defined by a soul file (markdown + frontmatter, see examples/souls)
   --config         Config file path (run: load settings from it, setup: write it)
@@ -1082,30 +1147,42 @@ export const warnOnCredentialOverride = async (runtime, streams, env = {}) => {
     if (runtime.provider === 'demo') {
         return;
     }
-    const stored = (await loadCredentials(env)).anthropic;
-    if (stored?.type !== 'oauth_token') {
-        return;
-    }
+    const credentials = await loadCredentials(env);
+    const processEnv = readProcessEnv(env);
     // The resolver records the variable that actually won — guessing it here
     // would name the wrong one whenever a custom apiKeyEnv supplied the key,
     // sending the reader to unset something that was never the cause.
-    const primary = runtime.provider === 'anthropic' && runtime.apiKey ? runtime.apiKeyEnvVar : undefined;
-    // A fallback demoted the same way costs exactly as much, and only bites
-    // once the primary is already failing — the worst moment to discover it.
-    // The fallback path consults the provider's own conventional variable.
-    const processEnv = readProcessEnv(env);
-    const fallbackVar = runtime.fallback?.provider === 'anthropic'
-        && runtime.fallback.apiKey !== undefined
-        && readNonEmptyString(processEnv.ANTHROPIC_API_KEY) === runtime.fallback.apiKey
-        ? 'ANTHROPIC_API_KEY'
+    const primaryOverride = runtime.apiKey !== undefined
+        ? { provider: runtime.provider, envVar: runtime.apiKeyEnvVar }
         : undefined;
-    const culprit = primary ?? fallbackVar;
-    if (!culprit) {
-        return;
+    // Both subscription sign-ins demote the same way: a Claude setup token
+    // and the codex ChatGPT marker each lose to an environment API key, and
+    // the run otherwise looks identical while billing per token.
+    for (const target of ['anthropic', 'codex']) {
+        if (credentials[target]?.type !== 'oauth_token') {
+            continue;
+        }
+        const planName = target === 'anthropic'
+            ? 'Claude subscription sign-in'
+            : 'ChatGPT (codex login) sign-in';
+        const primary = primaryOverride?.provider === target ? primaryOverride.envVar : undefined;
+        // A fallback demoted the same way costs exactly as much, and only bites
+        // once the primary is already failing — the worst moment to discover it.
+        // The fallback path consults the provider's own conventional variable.
+        const conventionalVar = defaultApiKeyEnvName(target);
+        const fallbackVar = runtime.fallback?.provider === target
+            && runtime.fallback.apiKey !== undefined
+            && readNonEmptyString(processEnv[conventionalVar]) === runtime.fallback.apiKey
+            ? conventionalVar
+            : undefined;
+        const culprit = primary ?? fallbackVar;
+        if (!culprit) {
+            continue;
+        }
+        writeLine(streams.stderr, `Warning: ${culprit} in your environment outranks the ${planName} saved by \`stratus setup\`, `
+            + `so ${primary ? 'this run is' : 'a fallback retry would be'} billed per token instead of through your plan. `
+            + 'Unset it to use the subscription, or run `stratus doctor` to see everything that is being overridden.');
     }
-    writeLine(streams.stderr, `Warning: ${culprit} in your environment outranks the Claude subscription sign-in saved by \`stratus setup\`, `
-        + `so ${primary ? 'this run is' : 'a fallback retry would be'} billed per token instead of through your plan. `
-        + 'Unset it to use the subscription, or run `stratus doctor` to see everything that is being overridden.');
 };
 const createApprovalPolicy = (mode, streams, env, ask) => {
     if (mode === 'always') {
@@ -2051,15 +2128,21 @@ export const runSetup = async (command, streams, env = {}) => {
         header: stratusHeaderLines,
         consumeNotices: () => recentNotices.splice(0),
     });
-    const defaultModelFor = (provider) => provider === 'openai' ? DEFAULT_OPENAI_MODEL : DEFAULT_ANTHROPIC_MODEL;
+    const defaultModelFor = (provider) => provider === 'openai'
+        ? DEFAULT_OPENAI_MODEL
+        : provider === 'codex'
+            ? DEFAULT_CODEX_MODEL
+            : DEFAULT_ANTHROPIC_MODEL;
     // Widened to CliProviderName only so setup can ask about the provider it
     // currently has selected, `demo` included; the rule itself is the shared one.
-    const defaultKeyEnvFor = (provider) => defaultApiKeyEnvName(provider === 'openai' ? 'openai' : 'anthropic');
-    const credentialLabel = (credential) => credential.type === 'oauth_token' ? 'Claude subscription' : 'API key';
+    const defaultKeyEnvFor = (provider) => defaultApiKeyEnvName(provider === 'demo' ? 'anthropic' : provider);
+    const credentialLabel = (provider, credential) => credential.type === 'oauth_token'
+        ? (provider === 'codex' ? 'ChatGPT sign-in' : 'Claude subscription')
+        : 'API key';
     const providerSignInStatus = (provider) => {
         const credential = state.credentials[provider];
         if (credential) {
-            return `signed in (${credentialLabel(credential)})`;
+            return `signed in (${credentialLabel(provider, credential)})`;
         }
         if (readNonEmptyString(processEnv[defaultKeyEnvFor(provider)])) {
             return `using ${defaultKeyEnvFor(provider)} from your environment`;
@@ -2068,10 +2151,10 @@ export const runSetup = async (command, streams, env = {}) => {
     };
     const providersSummary = () => {
         const parts = [];
-        for (const provider of ['anthropic', 'openai']) {
+        for (const provider of CREDENTIAL_PROVIDER_NAMES) {
             const credential = state.credentials[provider];
             if (credential) {
-                parts.push(`${provider} (${credentialLabel(credential)})`);
+                parts.push(`${provider} (${credentialLabel(provider, credential)})`);
             }
             else if (readNonEmptyString(processEnv[defaultKeyEnvFor(provider)])) {
                 parts.push(`${provider} (env key)`);
@@ -2099,7 +2182,9 @@ export const runSetup = async (command, streams, env = {}) => {
         const credential = state.credentials[state.provider];
         if (credential) {
             return credential.type === 'oauth_token'
-                ? 'signed in with your Claude subscription'
+                ? (state.provider === 'codex'
+                    ? 'using your ChatGPT (codex login) sign-in'
+                    : 'signed in with your Claude subscription')
                 : 'signed in with an API key';
         }
         const keyEnv = state.apiKeyEnv ?? defaultKeyEnvFor(state.provider);
@@ -2233,6 +2318,59 @@ export const runSetup = async (command, streams, env = {}) => {
             writeLine(streams.stdout, `! Could not reach the API to verify (${verdict.detail}). Saved the key anyway — it will be checked on your first run.`);
         }
     };
+    const signInCodex = async () => {
+        const signedIn = state.credentials.codex !== undefined;
+        const answer = await prompter.select('How should Stratus connect to Codex?', [
+            'ChatGPT subscription — uses this machine\'s `codex login` sign-in, no per-token cost',
+            'OpenAI API key — pay per use (platform.openai.com)',
+            'Skip for now',
+            ...(signedIn ? ['Sign out'] : []),
+        ]);
+        if (signedIn && answer.kind === 'index' && answer.index === 3) {
+            delete state.credentials.codex;
+            state.credentialsDirty = true;
+            writeLine(streams.stdout, 'Signed out of Codex. (A `codex login` sign-in, if any, stays with codex itself — run `codex logout` to clear it.)');
+            return;
+        }
+        if (answer.kind !== 'index' || answer.index === 2) {
+            return;
+        }
+        if (answer.index === 1) {
+            const key = await prompter.askSecret('Paste your OpenAI API key (Enter to skip; input is hidden): ');
+            if (!key) {
+                writeLine(streams.stdout, 'Skipped — you can sign in any time by re-running this menu.');
+                return;
+            }
+            writeLine(streams.stdout, 'Checking the key against the OpenAI API…');
+            const verdict = await verifyProviderKey('codex', key, undefined, env.fetch ?? globalThis.fetch);
+            if (verdict.status === 'ok') {
+                storeCredential('codex', { type: 'api_key', value: key });
+                writeLine(streams.stdout, '✓ Key verified — Codex runs will bill this OpenAI API key.');
+            }
+            else if (verdict.status === 'rejected') {
+                writeLine(streams.stdout, `✗ OpenAI rejected that key (${verdict.detail}). It was NOT saved — check platform.openai.com and try again from this menu.`);
+            }
+            else {
+                storeCredential('codex', { type: 'api_key', value: key });
+                writeLine(streams.stdout, `! Could not reach the OpenAI API to verify (${verdict.detail}). Saved the key anyway — it will be checked on your first run.`);
+            }
+            return;
+        }
+        // Default: the machine's own ChatGPT sign-in. Codex keeps those tokens
+        // in its own auth store; Stratus records only that this machine uses
+        // it, so nothing secret is written here.
+        writeLine(streams.stdout, 'Your ChatGPT plan covers usage made through Codex.');
+        writeLine(streams.stdout, 'If you have not signed in yet, run this in another terminal on this machine:');
+        writeLine(streams.stdout, '  codex login');
+        writeLine(streams.stdout, '(requires the Codex CLI: npm install -g @openai/codex)');
+        const confirmed = await prompter.select('Use this machine\'s codex sign-in?', ['Yes — codex is (or will be) signed in here', 'Skip for now']);
+        if (confirmed.kind !== 'index' || confirmed.index !== 0) {
+            writeLine(streams.stdout, 'Skipped — you can sign in any time by re-running this menu.');
+            return;
+        }
+        storeCredential('codex', { type: 'oauth_token', value: 'chatgpt' });
+        writeLine(streams.stdout, '✓ Recorded — Codex runs use this machine\'s ChatGPT sign-in. It is verified on your first run.');
+    };
     // Changing the default provider invalidates settings that were chosen
     // for the old one: the model and apiKeyEnv are cleared (defaults take
     // over), while the openai base URL is kept — it belongs to the openai
@@ -2292,17 +2430,25 @@ export const runSetup = async (command, streams, env = {}) => {
         const answer = await prompter.select('Providers — sign in to one or more:', [
             `Claude (Anthropic) — ${providerSignInStatus('anthropic')}`,
             `OpenAI-compatible — ${providerSignInStatus('openai')}`,
+            `Codex (ChatGPT) — ${providerSignInStatus('codex')}`,
             'Demo — built-in fake model, offline, no account',
             'Back',
         ]);
-        if (answer.kind !== 'index' || answer.index === 3) {
+        if (answer.kind !== 'index' || answer.index === 4) {
             return;
         }
-        if (answer.index === 2) {
+        if (answer.index === 3) {
             await switchDefaultProvider('demo');
             writeLine(streams.stdout, 'Demo selected — no sign-in needed. Mention "echo" or "tool" in a prompt to see tool calls.');
             return;
         }
+        if (answer.index === 2) {
+            await signInCodex();
+            if (state.credentials.codex) {
+                await maybeSwitchDefault('codex');
+            }
+            return;
+        }
         if (answer.index === 1) {
             await signInOpenAI();
             if (state.credentials.openai) {
@@ -2349,10 +2495,10 @@ export const runSetup = async (command, streams, env = {}) => {
             if (typed.includes(':')) {
                 const [providerPart, ...idParts] = typed.split(':');
                 const id = idParts.join(':').trim();
-                if ((providerPart === 'anthropic' || providerPart === 'openai') && id) {
+                if ((providerPart === 'anthropic' || providerPart === 'openai' || providerPart === 'codex') && id) {
                     return { provider: providerPart, id };
                 }
-                writeLine(streams.stdout, 'Use provider:model, e.g. anthropic:claude-opus-5.');
+                writeLine(streams.stdout, 'Use provider:model, e.g. anthropic:claude-opus-5 or codex:gpt-5.5.');
                 return undefined;
             }
             // A typed id that appears in the collected list belongs to that
@@ -2487,10 +2633,17 @@ export const runSetup = async (command, streams, env = {}) => {
             ? readNonEmptyString(processEnv.STRATUS_API_KEY)
             : undefined)
             ?? readNonEmptyString(processEnv[defaultKeyEnvFor(fallbackProvider)]);
-        const credential = envKey ? undefined : state.credentials[fallbackProvider];
+        const candidate = envKey ? undefined : state.credentials[fallbackProvider];
+        // A codex fallback consumes no endpoint URL, so a stored key bound to
+        // one cannot serve it — the same skip resolveRuntimeConfig performs.
+        const credential = fallbackProvider === 'codex' && candidate?.type === 'api_key' && candidate.baseUrl !== undefined
+            ? undefined
+            : candidate;
         const apiKey = envKey ?? (credential?.type === 'api_key' ? credential.value : undefined);
-        const authToken = credential?.type === 'oauth_token' ? credential.value : undefined;
-        if (!apiKey && !authToken) {
+        // A codex oauth entry is the subscription marker, not a token to send.
+        const codexSubscription = fallbackProvider === 'codex' && !apiKey && credential?.type === 'oauth_token';
+        const authToken = fallbackProvider !== 'codex' && credential?.type === 'oauth_token' ? credential.value : undefined;
+        if (!apiKey && !authToken && !codexSubscription) {
             return undefined;
         }
         return {
@@ -2503,13 +2656,17 @@ export const runSetup = async (command, streams, env = {}) => {
                         ?? (state.provider === 'openai' ? state.baseUrl : undefined)
                         ?? DEFAULT_OPENAI_BASE_URL,
                 }
-                : (() => {
-                    const url = (fallbackProvider === state.provider ? state.baseUrl : undefined)
-                        ?? (credential?.type === 'api_key' ? credential.baseUrl : undefined);
-                    return url ? { baseUrl: url } : {};
-                })()),
+                // The codex harness owns its endpoints; only anthropic can carry one.
+                : fallbackProvider === 'codex'
+                    ? {}
+                    : (() => {
+                        const url = (fallbackProvider === state.provider ? state.baseUrl : undefined)
+                            ?? (credential?.type === 'api_key' ? credential.baseUrl : undefined);
+                        return url ? { baseUrl: url } : {};
+                    })()),
             ...(apiKey ? { apiKey } : {}),
             ...(authToken ? { authToken } : {}),
+            ...(codexSubscription ? { codexSubscription: true } : {}),
         };
     };
     const buildTestRuntime = async () => {
@@ -2558,6 +2715,32 @@ export const runSetup = async (command, streams, env = {}) => {
                 ...(fallback ? { fallback } : {}),
             };
         }
+        if (state.provider === 'codex') {
+            // The harness owns its endpoints: a key bound to one cannot be
+            // honored on codex — resolveRuntimeConfig refuses this outright, and
+            // the inline test mirrors it rather than quietly unbinding the key.
+            if (boundUrl !== undefined) {
+                writeLine(streams.stdout, `Your saved codex key is bound to ${boundUrl}, and codex does not use a custom base URL. Store the key without one to run on codex.`);
+                return undefined;
+            }
+            const apiKey = envKey ?? (credential?.type === 'api_key' ? credential.value : undefined);
+            // The subscription marker means the machine's own codex sign-in
+            // serves the run — nothing more to resolve here.
+            if (!apiKey && credential?.type !== 'oauth_token') {
+                writeLine(streams.stdout, 'You are not signed in yet — pick option 1 first (or export CODEX_API_KEY).');
+                return undefined;
+            }
+            const fallback = buildTestFallback();
+            return {
+                provider: 'codex',
+                model,
+                ...(apiKey ? { apiKey } : {}),
+                ...(state.systemPrompt ? { systemPrompt: state.systemPrompt } : {}),
+                ...(env.fetch ? { fetch: env.fetch } : {}),
+                ...(soul ? { soul } : {}),
+                ...(fallback ? { fallback } : {}),
+            };
+        }
         const apiKey = envKey ?? (credential?.type === 'api_key' ? credential.value : undefined);
         if (!apiKey) {
             writeLine(streams.stdout, 'You are not signed in yet — pick option 1 first (or export OPENAI_API_KEY).');
@@ -2996,7 +3179,22 @@ export const runSetup = async (command, streams, env = {}) => {
                 : `Skipped. Install them yourself with: npm install -g ${rest}`);
         }
     };
+    /**
+     * Write everything the menu decided, then report whether the always-on
+     * install it performed succeeded.
+     *
+     * A boolean rather than a throw: the install is the one optional part of
+     * setup and everything else is already on disk by the time it runs, so
+     * failing outright would lose the saved config to a service that can be
+     * installed later. The exit code carries it instead — the same answer
+     * `stratus service install` gives for the identical failure, which is what
+     * a script driving setup has to be able to see.
+     */
     const save = async () => {
+        // The always-on install is the only step here that can fail without
+        // taking the rest of setup with it, so it is the only one the exit code
+        // has to carry.
+        let serviceInstallFailed = false;
         const config = { provider: state.provider };
         if (state.provider !== 'demo') {
             config.model = state.model ?? defaultModelFor(state.provider);
@@ -3114,6 +3312,7 @@ export const runSetup = async (command, streams, env = {}) => {
             }
             if (!result.ok) {
                 writeLine(streams.stderr, `Setup is saved either way — start the daemon yourself with \`${serveCommand()}\`.`);
+                serviceInstallFailed = true;
             }
         }
         writeLine(streams.stdout);
@@ -3164,6 +3363,7 @@ export const runSetup = async (command, streams, env = {}) => {
         if (dashboardReady) {
             writeLine(streams.stdout, '  stratus dashboard');
         }
+        return !serviceInstallFailed;
     };
     try {
         if (!interactive) {
@@ -3207,8 +3407,12 @@ export const runSetup = async (command, streams, env = {}) => {
                 await testRun();
             }
         }
-        await save();
-        return 0;
+        // Non-zero when the always-on install failed, matching `stratus service
+        // install`. Everything setup saved is still saved, and the output above
+        // says so — but a daemon that will not come up at login is not a
+        // successful setup, and a script that only reads the exit code had no
+        // way to tell.
+        return (await save()) ? 0 : 1;
     }
     finally {
         prompter.close();
@@ -3489,9 +3693,11 @@ export const collectDoctorReport = async (command, warn, env = {}) => {
     const usedKeyEnvVar = resolved && resolved.provider !== 'demo' ? resolved.apiKeyEnvVar : undefined;
     const usesAuthToken = resolved?.provider === 'anthropic' && resolved.authToken !== undefined;
     const fallback = resolved && resolved.provider !== 'demo' ? resolved.fallback : undefined;
-    for (const target of ['anthropic', 'openai']) {
+    for (const target of CREDENTIAL_PROVIDER_NAMES) {
         const stored = credentials[target];
-        const label = stored?.type === 'oauth_token' ? 'Claude subscription (Pro/Max)' : 'API key';
+        const label = stored?.type === 'oauth_token'
+            ? (target === 'codex' ? 'ChatGPT sign-in (codex login)' : 'Claude subscription (Pro/Max)')
+            : 'API key';
         const isDefault = resolved?.provider === target;
         const isFallback = fallback?.provider === target;
         // A provider no resolved run consults is reported, never diagnosed:
@@ -3505,7 +3711,7 @@ export const collectDoctorReport = async (command, warn, env = {}) => {
             });
             continue;
         }
-        const envVar = isDefault ? usedKeyEnvVar : (target === 'openai' ? 'OPENAI_API_KEY' : 'ANTHROPIC_API_KEY');
+        const envVar = isDefault ? usedKeyEnvVar : defaultApiKeyEnvName(target);
         const viaEnv = isDefault
             ? usedKeyEnvVar !== undefined
             : fallback?.apiKey !== undefined && fallback.apiKey === readNonEmptyString(processEnv[String(envVar)]);
@@ -4404,6 +4610,37 @@ export const runSkills = async (streams, env = {}) => {
     }
     return 0;
 };
+/**
+ * The provider/model a newly created soul pins. Frontmatter pins what a run
+ * from this directory would actually use: env vars outrank the active
+ * config file (project-local or explicit first, global otherwise), and no
+ * provider anywhere falls back to demo — the exact precedence of stratus
+ * run. Demo produces no model at all: the soul keeps following the
+ * machine's configuration instead of demanding credentials nothing has
+ * signed in for. The active config's model was written for the provider
+ * named in that config, so it only travels into the soul when they still
+ * match; otherwise the selected provider's own default model stands in.
+ *
+ * Exported for tests: the interactive path that consumes it needs a TTY.
+ */
+export const soulPinForNewAgent = (activeConfig, processEnv) => {
+    // The map already validates, so the value is a provider name; the cast
+    // only undoes `readNonEmptyString`'s widening to `string`.
+    const envProvider = readNonEmptyString(processEnv.STRATUS_PROVIDER, (value) => parseProviderName(value, 'STRATUS_PROVIDER'));
+    const provider = envProvider ?? activeConfig.provider ?? 'demo';
+    if (provider === 'demo') {
+        return { provider };
+    }
+    const configModelApplies = (activeConfig.provider ?? 'openai') === provider;
+    const model = readNonEmptyString(processEnv.STRATUS_MODEL)
+        ?? (configModelApplies ? activeConfig.model : undefined)
+        ?? (provider === 'openai'
+            ? DEFAULT_OPENAI_MODEL
+            : provider === 'codex'
+                ? DEFAULT_CODEX_MODEL
+                : DEFAULT_ANTHROPIC_MODEL);
+    return { provider, model };
+};
 export const runAgentNew = async (command, streams, env = {}) => {
     // On a real terminal, creating an agent is the same guided experience as
     // setup: a headed screen, a prefilled (editable) name, a personality, and
@@ -4427,28 +4664,16 @@ export const runAgentNew = async (command, streams, env = {}) => {
             const name = (await prompter.ask('Choose your name: ', { prefill: suggested })) || suggested;
             const instructions = await prompter.ask('Describe their personality (Enter for a starter you can edit later): ', ...(command.instructions ? [{ prefill: command.instructions }] : []));
             const persona = instructions || DEFAULT_SOUL_STARTER;
-            // Frontmatter pins what a run from this directory would actually use:
-            // env vars outrank the active config file (project-local or explicit
-            // first, global otherwise), and no provider anywhere falls back to
-            // demo — the exact precedence of stratus run. Demo produces no pin
-            // at all: the soul keeps following the machine's configuration
-            // instead of demanding credentials nothing has signed in for.
             const processEnv = readProcessEnv(env);
             // Creating an agent must not be blocked by a broken config — it only
             // feeds the soul's provider/model hint, so fall back to defaults.
             const { location: configLocation, config: activeConfig } = await discoverActiveConfig(env, (message) => {
                 writeLine(streams.stdout, `Note: ${message}.`);
             });
-            const soulProvider = readNonEmptyString(processEnv.STRATUS_PROVIDER, (value) => parseProviderName(value, 'STRATUS_PROVIDER'))
-                ?? activeConfig.provider
-                ?? 'demo';
-            // The active config's model was written for the provider named in
-            // that config; it only travels into the soul when they still match.
-            const configModelApplies = (activeConfig.provider ?? 'openai') === soulProvider;
-            const soulModel = readNonEmptyString(processEnv.STRATUS_MODEL)
-                ?? (configModelApplies ? activeConfig.model : undefined)
-                ?? (soulProvider === 'openai' ? DEFAULT_OPENAI_MODEL : DEFAULT_ANTHROPIC_MODEL);
-            const soulPin = soulProvider !== 'demo' ? { provider: soulProvider, model: soulModel } : {};
+            const { provider: soulProvider, model: soulModel } = soulPinForNewAgent(activeConfig, processEnv);
+            const soulPin = soulProvider !== 'demo' && soulModel !== undefined
+                ? { provider: soulProvider, model: soulModel }
+                : {};
             const claimed = await claimSoulFile(env, { name, instructions: persona }, (candidate) => formatSoul({ agent: candidate, ...soulPin }), (message) => writeLine(streams.stdout, message));
             const { agent, soulPath } = claimed;
             const makeDefault = await prompter.select(`Make ${agent.name} your default agent?`, [