@tractorscorch/clank 1.6.0 → 1.7.0

package/dist/index.js

@@ -843,10 +843,18 @@ var init_agent = __esm({
       alwaysApproved = /* @__PURE__ */ new Set();
       /** Background task registry (if available) */
       taskRegistry = null;
-      /** Function to spawn background tasks (main agent only) */
+      /** Function to spawn background tasks */
       spawnTaskFn = void 0;
-      /** Session key for this engine (used to consume completed tasks) */
+      /** Function to kill a running task */
+      killTaskFn = void 0;
+      /** Function to message a running child task */
+      messageTaskFn = void 0;
+      /** Session key for this engine */
       sessionKey = "";
+      /** Spawn depth: 0 = main, 1+ = sub-agent */
+      spawnDepth = 0;
+      /** Maximum allowed spawn depth */
+      maxSpawnDepth = 1;
       constructor(opts) {
         super();
         this.setMaxListeners(30);
@@ -858,7 +866,11 @@ var init_agent = __esm({
         if (opts.systemPrompt) this.systemPrompt = opts.systemPrompt;
         if (opts.taskRegistry) this.taskRegistry = opts.taskRegistry;
         if (opts.spawnTask) this.spawnTaskFn = opts.spawnTask;
+        if (opts.killTask) this.killTaskFn = opts.killTask;
+        if (opts.messageTask) this.messageTaskFn = opts.messageTask;
         if (opts.sessionKey) this.sessionKey = opts.sessionKey;
+        if (opts.spawnDepth !== void 0) this.spawnDepth = opts.spawnDepth;
+        if (opts.maxSpawnDepth !== void 0) this.maxSpawnDepth = opts.maxSpawnDepth;
         this.contextEngine = new ContextEngine({
           contextWindow: opts.provider.provider.contextWindow(),
           isLocal: opts.provider.isLocal
@@ -1076,7 +1088,12 @@ ${results}`
                 agentId: this.identity.id,
                 signal,
                 taskRegistry: this.taskRegistry ?? void 0,
-                spawnTask: this.spawnTaskFn
+                spawnTask: this.spawnTaskFn,
+                killTask: this.killTaskFn,
+                messageTask: this.messageTaskFn,
+                spawnDepth: this.spawnDepth,
+                maxSpawnDepth: this.maxSpawnDepth,
+                sessionKey: this.sessionKey
               };
               const validation = tool.validate(tc.arguments, toolCtx);
               if (!validation.ok) {
@@ -2131,7 +2148,11 @@ function defaultConfig() {
         model: { primary: "ollama/qwen3.5" },
         workspace: process.cwd(),
         toolTier: "auto",
-        temperature: 0.7
+        temperature: 0.7,
+        subagents: {
+          maxConcurrent: 8,
+          maxSpawnDepth: 1
+        }
       },
       list: []
     },
@@ -3488,6 +3509,34 @@ function createProvider(modelId, config, opts) {
       });
       return { provider: p, providerName: "openrouter", modelId, isLocal: false };
     }
+    case "codex": {
+      const codexConfig = config.codex ?? config["codex"];
+      if (!codexConfig?.apiKey) {
+        throw new Error(
+          `Codex OAuth not configured. Run 'clank auth login' to sign in with your OpenAI account.`
+        );
+      }
+      const p = new OpenAIProvider({
+        apiKey: codexConfig.apiKey,
+        baseUrl: "https://api.openai.com",
+        model,
+        maxResponseTokens: opts?.maxResponseTokens
+      });
+      return { provider: p, providerName: "codex", modelId, isLocal: false };
+    }
+    case "opencode": {
+      const ocConfig = config.opencode ?? config["opencode"];
+      if (!ocConfig?.apiKey) {
+        throw new Error(`OpenCode API key required for model ${modelId}`);
+      }
+      const p = new OpenAIProvider({
+        apiKey: ocConfig.apiKey,
+        baseUrl: ocConfig.baseUrl || "https://opencode.ai/zen",
+        model,
+        maxResponseTokens: opts?.maxResponseTokens
+      });
+      return { provider: p, providerName: "opencode", modelId, isLocal: false };
+    }
     case "lmstudio":
     case "llamacpp":
     case "vllm":
@@ -3627,7 +3676,7 @@ var init_model_tool = __esm({
           properties: {
             action: { type: "string", description: "'list', 'detect', 'set-default', or 'add-provider'" },
             model: { type: "string", description: "Model ID for set-default (e.g., 'ollama/qwen3.5')" },
-            provider: { type: "string", description: "Provider name for add-provider ('anthropic', 'openai', 'google', 'openrouter')" },
+            provider: { type: "string", description: "Provider name for add-provider ('anthropic', 'openai', 'google', 'openrouter', 'opencode')" },
             apiKey: { type: "string", description: "API key for add-provider" }
           },
           required: ["action"]
@@ -3678,6 +3727,8 @@ var init_model_tool = __esm({
           const entry = { apiKey: args.apiKey };
           if (provider === "openrouter") {
             entry.baseUrl = "https://openrouter.ai/api/v1";
+          } else if (provider === "opencode") {
+            entry.baseUrl = "https://opencode.ai/zen";
           }
           config.models.providers[provider] = entry;
           await saveConfig(config);
@@ -4376,17 +4427,17 @@ var init_tts = __esm({
       /** Transcribe via local whisper.cpp */
       async transcribeLocal(audioBuffer, format) {
         try {
-          const { writeFile: writeFile10, unlink: unlink5 } = await import("fs/promises");
+          const { writeFile: writeFile11, unlink: unlink6 } = await import("fs/promises");
           const { execSync: execSync3 } = await import("child_process");
-          const { join: join20 } = await import("path");
+          const { join: join21 } = await import("path");
           const { tmpdir } = await import("os");
-          const tmpFile = join20(tmpdir(), `clank-stt-${Date.now()}.${format}`);
-          await writeFile10(tmpFile, audioBuffer);
+          const tmpFile = join21(tmpdir(), `clank-stt-${Date.now()}.${format}`);
+          await writeFile11(tmpFile, audioBuffer);
           const output = execSync3(`whisper "${tmpFile}" --model base.en --output-txt`, {
             encoding: "utf-8",
             timeout: 6e4
           });
-          await unlink5(tmpFile).catch(() => {
+          await unlink6(tmpFile).catch(() => {
           });
           return output.trim() ? { text: output.trim() } : null;
         } catch {
@@ -4449,11 +4500,11 @@ var init_voice_tool = __esm({
           voiceId: args.voice_id
         });
         if (!result) return "Error: TTS synthesis failed";
-        const { writeFile: writeFile10 } = await import("fs/promises");
-        const { join: join20 } = await import("path");
+        const { writeFile: writeFile11 } = await import("fs/promises");
+        const { join: join21 } = await import("path");
         const { tmpdir } = await import("os");
-        const outPath = join20(tmpdir(), `clank-tts-${Date.now()}.${result.format}`);
-        await writeFile10(outPath, result.audioBuffer);
+        const outPath = join21(tmpdir(), `clank-tts-${Date.now()}.${result.format}`);
+        await writeFile11(outPath, result.audioBuffer);
         return `Audio generated: ${outPath} (${result.format}, ${Math.round(result.audioBuffer.length / 1024)}KB)`;
       }
     };
@@ -4476,19 +4527,19 @@ var init_voice_tool = __esm({
         return { ok: true };
       },
       async execute(args, ctx) {
-        const { readFile: readFile13 } = await import("fs/promises");
-        const { existsSync: existsSync12 } = await import("fs");
+        const { readFile: readFile14 } = await import("fs/promises");
+        const { existsSync: existsSync13 } = await import("fs");
         const { guardPath: guardPath2 } = await Promise.resolve().then(() => (init_path_guard(), path_guard_exports));
         const guard = guardPath2(args.file_path, ctx.projectRoot, { allowExternal: ctx.allowExternal });
         if (!guard.ok) return guard.error;
         const filePath = guard.path;
-        if (!existsSync12(filePath)) return `Error: File not found: ${filePath}`;
+        if (!existsSync13(filePath)) return `Error: File not found: ${filePath}`;
         const config = await loadConfig();
         const engine = new STTEngine(config);
         if (!engine.isAvailable()) {
           return "Error: Speech-to-text not configured. Need OpenAI API key or local whisper.cpp installed.";
         }
-        const audioBuffer = await readFile13(filePath);
+        const audioBuffer = await readFile14(filePath);
         const ext = filePath.split(".").pop() || "wav";
         const result = await engine.transcribe(audioBuffer, ext);
         if (!result) return "Error: Transcription failed";
@@ -4576,13 +4627,13 @@ var init_task_tool = __esm({
     taskTool = {
       definition: {
         name: "spawn_task",
-        description: "Spawn a background task on a sub-agent, check task status, or list tasks. Use 'spawn' to start a task that runs independently while you continue chatting. Use 'status' to check a specific task. Use 'list' to see all tasks.",
+        description: "Manage background tasks on sub-agents. 'spawn' starts a task that runs independently while you continue chatting. 'kill' cancels a running task. 'steer' kills and re-spawns with new instructions. 'message' sends a message to a running child. 'status' checks one task. 'list' shows all.",
         parameters: {
           type: "object",
           properties: {
             action: {
               type: "string",
-              description: "Action: 'spawn' to start a task, 'status' to check one, 'list' to see all"
+              description: "Action: 'spawn', 'status', 'list', 'kill', 'steer', or 'message'"
             },
             agentId: {
               type: "string",
@@ -4592,13 +4643,17 @@ var init_task_tool = __esm({
               type: "string",
               description: "The instruction for the sub-agent (required for spawn)"
             },
+            message: {
+              type: "string",
+              description: "Message to send (required for steer and message actions)"
+            },
             label: {
               type: "string",
               description: "Human-readable task name (optional for spawn)"
             },
             taskId: {
               type: "string",
-              description: "Task ID to check (required for status)"
+              description: "Task ID (required for status, kill, steer, message)"
             },
             timeoutMs: {
               type: "number",
@@ -4609,13 +4664,14 @@ var init_task_tool = __esm({
         }
       },
       safetyLevel: ((args) => {
-        return args.action === "spawn" ? "medium" : "low";
+        const action = args.action;
+        return action === "spawn" || action === "kill" || action === "steer" ? "medium" : "low";
       }),
       readOnly: false,
       validate(args, _ctx) {
         const action = args.action;
-        if (!["spawn", "status", "list"].includes(action)) {
-          return { ok: false, error: "action must be 'spawn', 'status', or 'list'" };
+        if (!["spawn", "status", "list", "kill", "steer", "message"].includes(action)) {
+          return { ok: false, error: "action must be 'spawn', 'status', 'list', 'kill', 'steer', or 'message'" };
         }
         if (action === "spawn") {
           if (!args.agentId || typeof args.agentId !== "string") {
@@ -4625,8 +4681,14 @@ var init_task_tool = __esm({
             return { ok: false, error: "prompt is required for spawn" };
           }
         }
-        if (action === "status" && (!args.taskId || typeof args.taskId !== "string")) {
-          return { ok: false, error: "taskId is required for status" };
+        if (["status", "kill", "message"].includes(action) && (!args.taskId || typeof args.taskId !== "string")) {
+          return { ok: false, error: "taskId is required for " + action };
+        }
+        if (action === "steer" && (!args.taskId || !args.message)) {
+          return { ok: false, error: "taskId and message are required for steer" };
+        }
+        if (action === "message" && !args.message) {
+          return { ok: false, error: "message is required for message action" };
         }
         return { ok: true };
       },
@@ -4635,7 +4697,16 @@ var init_task_tool = __esm({
         switch (action) {
           case "spawn": {
             if (!ctx.spawnTask) {
-              return "Error: spawn_task is only available to the main agent. Sub-agents cannot spawn tasks.";
+              if (ctx.spawnDepth !== void 0 && ctx.maxSpawnDepth !== void 0 && ctx.spawnDepth >= ctx.maxSpawnDepth) {
+                return "Error: This agent is at maximum spawn depth and cannot create sub-agents.";
+              }
+              return "Error: spawn_task is not available in this context.";
+            }
+            if (ctx.taskRegistry && ctx.sessionKey) {
+              const active = ctx.taskRegistry.countActiveByParent(ctx.sessionKey);
+              if (active >= 8) {
+                return `Error: Concurrent task limit reached (${active}/8 running). Kill a task first.`;
+              }
             }
             const agentId = args.agentId;
             const prompt = args.prompt;
@@ -4655,6 +4726,50 @@ The task is running in the background. Results will be delivered when the task c
               return `Error spawning task: ${msg}`;
             }
           }
+          case "kill": {
+            if (!ctx.killTask) return "Error: kill is not available in this context.";
+            try {
+              const result = await ctx.killTask(args.taskId);
+              if (result.status === "not_found") return `No running task found with ID: ${args.taskId}`;
+              if (result.status === "not_owner") return `Cannot kill task ${args.taskId} \u2014 it was not spawned by this agent.`;
+              return `Task ${args.taskId} killed.${result.cascadeKilled ? ` ${result.cascadeKilled} child task(s) also cancelled.` : ""}`;
+            } catch (err) {
+              return `Error killing task: ${err instanceof Error ? err.message : err}`;
+            }
+          }
+          case "steer": {
+            if (!ctx.killTask || !ctx.spawnTask) return "Error: steer is not available in this context.";
+            const taskId = args.taskId;
+            const message = args.message;
+            const task = ctx.taskRegistry?.get(taskId);
+            if (!task) return `No task found with ID: ${taskId}`;
+            await ctx.killTask(taskId);
+            try {
+              const newId = await ctx.spawnTask({
+                agentId: task.agentId,
+                prompt: message,
+                label: task.label + " (steered)",
+                timeoutMs: task.timeoutMs
+              });
+              return `Task ${taskId} killed and re-spawned.
+New Task ID: ${newId}
+New instructions: ${message.slice(0, 100)}`;
+            } catch (err) {
+              return `Killed old task but failed to re-spawn: ${err instanceof Error ? err.message : err}`;
+            }
+          }
+          case "message": {
+            if (!ctx.messageTask) return "Error: message is not available in this context.";
+            try {
+              const result = await ctx.messageTask(args.taskId, args.message);
+              if (result.status === "not_found") return `No running task found with ID: ${args.taskId}`;
+              if (result.status === "not_owner") return `Cannot message task ${args.taskId} \u2014 it was not spawned by this agent.`;
+              return `Message sent to task ${args.taskId}.
+Reply: ${result.replyText || "(no reply)"}`;
+            } catch (err) {
+              return `Error messaging task: ${err instanceof Error ? err.message : err}`;
+            }
+          }
           case "status": {
             if (!ctx.taskRegistry) return "Error: Task registry not available.";
             const task = ctx.taskRegistry.get(args.taskId);
@@ -4666,7 +4781,9 @@ The task is running in the background. Results will be delivered when the task c
               `Agent: ${task.agentId}`,
               `Model: ${task.model}`,
               `Status: ${task.status}`,
-              `Elapsed: ${elapsed}s`
+              `Depth: ${task.spawnDepth}`,
+              `Elapsed: ${elapsed}s`,
+              `Children: ${task.children.length}`
             ];
             if (task.result) lines.push(`Result: ${task.result.slice(0, 500)}`);
             if (task.error) lines.push(`Error: ${task.error}`);
@@ -4678,7 +4795,8 @@ The task is running in the background. Results will be delivered when the task c
             if (tasks.length === 0) return "No background tasks.";
             return tasks.map((t) => {
               const elapsed = Math.round(((t.completedAt || Date.now()) - t.startedAt) / 1e3);
-              return `\u2022 [${t.status}] ${t.label} (agent: ${t.agentId}, ${elapsed}s)`;
+              const depth = t.spawnDepth > 0 ? ` [depth ${t.spawnDepth}]` : "";
+              return `\u2022 [${t.status}] ${t.label}${depth} (agent: ${t.agentId}, ${elapsed}s)`;
             }).join("\n");
           }
           default:
@@ -4686,7 +4804,11 @@ The task is running in the background. Results will be delivered when the task c
         }
       },
       formatConfirmation(args) {
-        return `Spawn background task on agent "${args.agentId}": ${args.prompt?.slice(0, 80)}`;
+        const action = args.action;
+        if (action === "spawn") return `Spawn background task on agent "${args.agentId}": ${args.prompt?.slice(0, 80)}`;
+        if (action === "kill") return `Kill task ${args.taskId}`;
+        if (action === "steer") return `Steer task ${args.taskId} with new instructions`;
+        return `${action} task`;
       }
     };
   }
@@ -4812,9 +4934,9 @@ async function runChat(opts) {
       console.log(dim("Starting gateway..."));
       const { spawn } = await import("child_process");
       const { fileURLToPath: fileURLToPath6 } = await import("url");
-      const { dirname: dirname6, join: join20 } = await import("path");
+      const { dirname: dirname6, join: join21 } = await import("path");
       const __filename4 = fileURLToPath6(import.meta.url);
-      const entryPoint = join20(dirname6(__filename4), "index.js");
+      const entryPoint = join21(dirname6(__filename4), "index.js");
       const child = spawn(process.execPath, [entryPoint, "gateway", "start", "--foreground"], {
         detached: true,
         stdio: "ignore",
@@ -4840,10 +4962,10 @@ async function runChat(opts) {
     }
     const url = `http://127.0.0.1:${port}/#token=${token}`;
     console.log(dim(`Opening ${url}`));
-    const { platform: platform5 } = await import("os");
-    const { exec } = await import("child_process");
-    const openCmd = platform5() === "win32" ? `start "" "${url}"` : platform5() === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
-    exec(openCmd);
+    const { platform: platform6 } = await import("os");
+    const { exec: exec2 } = await import("child_process");
+    const openCmd = platform6() === "win32" ? `start "" "${url}"` : platform6() === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+    exec2(openCmd);
     console.log(green("Web UI opened in browser."));
     return;
   }
@@ -5397,32 +5519,58 @@ var init_registry2 = __esm({
           startedAt: Date.now(),
           timeoutMs: opts.timeoutMs,
           spawnedBy: opts.spawnedBy,
-          delivered: false
+          delivered: false,
+          spawnDepth: opts.spawnDepth ?? 0,
+          parentSessionKey: opts.parentSessionKey,
+          children: []
         };
         this.tasks.set(entry.id, entry);
+        if (opts.parentSessionKey?.startsWith("task:")) {
+          const parentTaskId = opts.parentSessionKey.slice(5);
+          const parent = this.tasks.get(parentTaskId);
+          if (parent) parent.children.push(entry.id);
+        }
         return entry;
       }
       /** Update a task's fields */
       update(id, patch) {
         const task = this.tasks.get(id);
-        if (task) {
-          Object.assign(task, patch);
-        }
+        if (task) Object.assign(task, patch);
       }
       /** Get a specific task */
       get(id) {
         return this.tasks.get(id);
       }
-      /** List all tasks, optionally filtered by status */
+      /** Find a task by its session key (task:{id}) */
+      getBySessionKey(sessionKey) {
+        if (!sessionKey.startsWith("task:")) return void 0;
+        return this.tasks.get(sessionKey.slice(5));
+      }
+      /** List all tasks, optionally filtered */
       list(filter) {
         let results = Array.from(this.tasks.values());
-        if (filter?.status) {
-          results = results.filter((t) => t.status === filter.status);
+        if (filter?.status) results = results.filter((t) => t.status === filter.status);
+        if (filter?.spawnedBy) results = results.filter((t) => t.spawnedBy === filter.spawnedBy);
+        return results.sort((a, b) => b.startedAt - a.startedAt);
+      }
+      /** Count running tasks spawned by a specific session */
+      countActiveByParent(spawnedBy) {
+        let count = 0;
+        for (const task of this.tasks.values()) {
+          if (task.spawnedBy === spawnedBy && task.status === "running") count++;
         }
-        if (filter?.spawnedBy) {
-          results = results.filter((t) => t.spawnedBy === filter.spawnedBy);
+        return count;
+      }
+      /** Recursively count all active descendants of a session */
+      countActiveDescendants(sessionKey) {
+        let count = 0;
+        for (const task of this.tasks.values()) {
+          if (task.spawnedBy === sessionKey && task.status === "running") {
+            count++;
+            count += this.countActiveDescendants(`task:${task.id}`);
+          }
         }
-        return results.sort((a, b) => b.startedAt - a.startedAt);
+        return count;
       }
       /**
        * Get completed tasks for a session that haven't been delivered yet.
@@ -5438,6 +5586,32 @@ var init_registry2 = __esm({
         }
         return ready;
       }
+      /** Cancel a specific task */
+      cancel(taskId) {
+        const task = this.tasks.get(taskId);
+        if (!task || task.status !== "running") return task;
+        task.status = "timeout";
+        task.completedAt = Date.now();
+        task.error = "Cancelled by parent";
+        return task;
+      }
+      /**
+       * Cancel all tasks spawned by a session, and recursively cancel
+       * their children. Returns total number of tasks cancelled.
+       */
+      cascadeCancel(sessionKey) {
+        let count = 0;
+        for (const task of this.tasks.values()) {
+          if (task.spawnedBy === sessionKey && task.status === "running") {
+            task.status = "timeout";
+            task.completedAt = Date.now();
+            task.error = "Parent cancelled";
+            count++;
+            count += this.cascadeCancel(`task:${task.id}`);
+          }
+        }
+        return count;
+      }
       /** Remove completed tasks older than maxAgeMs */
       cleanup(maxAgeMs) {
         const now = Date.now();
@@ -5470,6 +5644,335 @@ var init_tasks = __esm({
   }
 });
 
+// src/auth/oauth.ts
+var oauth_exports = {};
+__export(oauth_exports, {
+  buildAuthorizationUrl: () => buildAuthorizationUrl,
+  decodeJwt: () => decodeJwt,
+  exchangeCodeForTokens: () => exchangeCodeForTokens,
+  extractAccountInfo: () => extractAccountInfo,
+  generatePKCE: () => generatePKCE,
+  generateState: () => generateState,
+  isRemoteEnvironment: () => isRemoteEnvironment,
+  openBrowser: () => openBrowser,
+  refreshAccessToken: () => refreshAccessToken,
+  runOAuthFlow: () => runOAuthFlow,
+  startCallbackServer: () => startCallbackServer
+});
+import { randomBytes, createHash } from "crypto";
+import { createServer } from "http";
+import { exec } from "child_process";
+import { platform as platform4 } from "os";
+function generatePKCE() {
+  const verifier = randomBytes(32).toString("hex");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function generateState() {
+  return randomBytes(32).toString("hex");
+}
+function buildAuthorizationUrl(challenge, state) {
+  const url = new URL(AUTHORIZE_URL);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", CLIENT_ID);
+  url.searchParams.set("redirect_uri", REDIRECT_URI);
+  url.searchParams.set("scope", SCOPES);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", state);
+  url.searchParams.set("id_token_add_organizations", "true");
+  url.searchParams.set("originator", "pi");
+  return url;
+}
+function startCallbackServer(expectedState, timeoutMs = 6e4) {
+  return new Promise((resolve4, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url || "/", `http://localhost:${CALLBACK_PORT}`);
+      if (url.pathname === "/auth/callback") {
+        const code = url.searchParams.get("code");
+        const returnedState = url.searchParams.get("state");
+        if (returnedState !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<html><body><h2>State mismatch \u2014 possible CSRF attack.</h2></body></html>");
+          cleanup();
+          reject(new Error("OAuth state mismatch \u2014 possible CSRF attack"));
+          return;
+        }
+        if (!code) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<html><body><h2>No authorization code received.</h2></body></html>");
+          cleanup();
+          reject(new Error("No authorization code in callback"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end("<html><body><h2>Authenticated! You can close this tab.</h2></body></html>");
+        cleanup();
+        resolve4(code);
+      }
+    });
+    const timeout = setTimeout(() => {
+      cleanup();
+      reject(new Error("OAuth callback timed out \u2014 no response within 60 seconds"));
+    }, timeoutMs);
+    function cleanup() {
+      clearTimeout(timeout);
+      server.close();
+    }
+    server.on("error", (err) => {
+      clearTimeout(timeout);
+      if (err.code === "EADDRINUSE") {
+        reject(new Error(`Port ${CALLBACK_PORT} is in use. Close whatever is using it and try again.`));
+      } else {
+        reject(err);
+      }
+    });
+    server.listen(CALLBACK_PORT, "127.0.0.1");
+  });
+}
+async function exchangeCodeForTokens(code, verifier) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      code_verifier: verifier,
+      redirect_uri: REDIRECT_URI
+    })
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "Unknown error");
+    throw new Error(`Token exchange failed (${res.status}): ${text}`);
+  }
+  return await res.json();
+}
+async function refreshAccessToken(refreshToken) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID
+    })
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "Unknown error");
+    throw new Error(`Token refresh failed (${res.status}): ${text}`);
+  }
+  return await res.json();
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new Error("Invalid JWT format");
+  return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+}
+function extractAccountInfo(accessToken) {
+  const claims = decodeJwt(accessToken);
+  const authClaims = claims["https://api.openai.com/auth"];
+  return {
+    accountId: authClaims?.chatgpt_account_id || "",
+    email: claims.email || ""
+  };
+}
+function isRemoteEnvironment() {
+  return !!(process.env.SSH_CLIENT || process.env.SSH_TTY || process.env.REMOTE_CONTAINERS || process.env.CODESPACES || platform4() === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY);
+}
+function openBrowser(url) {
+  const cmd = platform4() === "darwin" ? "open" : platform4() === "win32" ? "start" : "xdg-open";
+  exec(`${cmd} "${url}"`, () => {
+  });
+}
+async function runOAuthFlow(opts) {
+  const { verifier, challenge } = generatePKCE();
+  const state = generateState();
+  const authUrl = buildAuthorizationUrl(challenge, state);
+  opts?.onProgress?.("Starting OAuth flow...");
+  const codePromise = startCallbackServer(state);
+  if (isRemoteEnvironment()) {
+    opts?.onProgress?.("Remote environment detected \u2014 paste this URL in your browser:");
+    opts?.onUrl?.(authUrl.toString());
+  } else {
+    opts?.onProgress?.("Opening browser for OpenAI login...");
+    openBrowser(authUrl.toString());
+    opts?.onUrl?.(authUrl.toString());
+  }
+  const code = await codePromise;
+  opts?.onProgress?.("Authorization code received, exchanging for tokens...");
+  const tokens = await exchangeCodeForTokens(code, verifier);
+  opts?.onProgress?.("Tokens received, extracting account info...");
+  const { accountId, email } = extractAccountInfo(tokens.access_token);
+  return {
+    type: "oauth",
+    provider: "openai-codex",
+    access: tokens.access_token,
+    refresh: tokens.refresh_token,
+    expires: Date.now() + tokens.expires_in * 1e3,
+    accountId,
+    email,
+    clientId: CLIENT_ID
+  };
+}
+var AUTHORIZE_URL, TOKEN_URL, REDIRECT_URI, CLIENT_ID, SCOPES, CALLBACK_PORT;
+var init_oauth = __esm({
+  "src/auth/oauth.ts"() {
+    "use strict";
+    init_esm_shims();
+    AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+    TOKEN_URL = "https://auth.openai.com/oauth/token";
+    REDIRECT_URI = "http://localhost:1455/auth/callback";
+    CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+    SCOPES = "openid profile email offline_access";
+    CALLBACK_PORT = 1455;
+  }
+});
+
+// src/auth/credentials.ts
+var credentials_exports = {};
+__export(credentials_exports, {
+  AuthProfileStore: () => AuthProfileStore,
+  needsRefresh: () => needsRefresh
+});
+import { readFile as readFile10, writeFile as writeFile8, unlink as unlink3, stat as stat6 } from "fs/promises";
+import { existsSync as existsSync8, writeFileSync } from "fs";
+import { join as join13 } from "path";
+function needsRefresh(credential) {
+  return Date.now() >= credential.expires - 5 * 60 * 1e3;
+}
+var AuthProfileStore;
+var init_credentials = __esm({
+  "src/auth/credentials.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config2();
+    init_oauth();
+    AuthProfileStore = class {
+      filePath;
+      lockPath;
+      constructor() {
+        const configDir = getConfigDir();
+        this.filePath = join13(configDir, "auth-profiles.json");
+        this.lockPath = join13(configDir, ".auth-lock");
+      }
+      /** Load profiles from disk */
+      async load() {
+        try {
+          const data = await readFile10(this.filePath, "utf-8");
+          return JSON.parse(data);
+        } catch {
+          return { profiles: {} };
+        }
+      }
+      /** Save profiles to disk with restricted permissions */
+      async save(profiles) {
+        await writeFile8(this.filePath, JSON.stringify(profiles, null, 2), { mode: 384 });
+      }
+      /** Get a specific credential by profile ID */
+      async getCredential(profileId) {
+        const profiles = await this.load();
+        return profiles.profiles[profileId];
+      }
+      /** Store a credential */
+      async setCredential(profileId, credential) {
+        const profiles = await this.load();
+        profiles.profiles[profileId] = credential;
+        await this.save(profiles);
+      }
+      /** Remove a credential */
+      async removeCredential(profileId) {
+        const profiles = await this.load();
+        delete profiles.profiles[profileId];
+        await this.save(profiles);
+      }
+      /** List all profile IDs */
+      async listProfiles() {
+        const profiles = await this.load();
+        return Object.entries(profiles.profiles).map(([id, cred]) => ({
+          id,
+          provider: cred.provider,
+          type: cred.type,
+          email: cred.type === "oauth" ? cred.email : void 0
+        }));
+      }
+      /**
+       * Resolve an API key or access token for a profile.
+       * For OAuth: checks expiry, refreshes if needed, returns access token.
+       * For API key: returns the key directly.
+       */
+      async resolveApiKey(profileId) {
+        const credential = await this.getCredential(profileId);
+        if (!credential) {
+          throw new Error(`No credential found for profile "${profileId}". Run 'clank auth login' first.`);
+        }
+        if (credential.type === "api_key") {
+          return credential.key;
+        }
+        if (needsRefresh(credential)) {
+          const refreshed = await this.refreshWithLock(credential, profileId);
+          return refreshed.access;
+        }
+        return credential.access;
+      }
+      /**
+       * Refresh an OAuth token with file-based locking.
+       * Prevents multiple processes from refreshing simultaneously.
+       */
+      async refreshWithLock(credential, profileId) {
+        if (existsSync8(this.lockPath)) {
+          try {
+            const lockStat = await stat6(this.lockPath);
+            if (Date.now() - lockStat.mtimeMs < 3e4) {
+              await new Promise((r) => setTimeout(r, 2e3));
+              const fresh = await this.getCredential(profileId);
+              if (fresh && fresh.type === "oauth" && !needsRefresh(fresh)) {
+                return fresh;
+              }
+            }
+          } catch {
+          }
+        }
+        try {
+          writeFileSync(this.lockPath, String(process.pid), { flag: "wx" });
+        } catch {
+          await new Promise((r) => setTimeout(r, 2e3));
+          const fresh = await this.getCredential(profileId);
+          if (fresh && fresh.type === "oauth" && !needsRefresh(fresh)) {
+            return fresh;
+          }
+        }
+        try {
+          const tokens = await refreshAccessToken(credential.refresh);
+          const refreshed = {
+            ...credential,
+            access: tokens.access_token,
+            refresh: tokens.refresh_token,
+            expires: Date.now() + tokens.expires_in * 1e3
+          };
+          await this.setCredential(profileId, refreshed);
+          return refreshed;
+        } finally {
+          try {
+            await unlink3(this.lockPath);
+          } catch {
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/auth/index.ts
+var init_auth = __esm({
+  "src/auth/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_oauth();
+    init_credentials();
+  }
+});
+
 // src/routing/resolve-route.ts
 function resolveRoute(context, bindings, agents2, defaultAgentId) {
   const scored = bindings.map((b) => ({
@@ -5885,10 +6388,10 @@ Describe or analyze the image if you can, or acknowledge it.`
                   return;
                 }
                 const { writeFile: wf } = await import("fs/promises");
-                const { join: join20 } = await import("path");
+                const { join: join21 } = await import("path");
                 const { tmpdir } = await import("os");
                 const safeName = (doc.file_name || "file").replace(/[^a-zA-Z0-9._-]/g, "_");
-                const savePath = join20(tmpdir(), `clank-upload-${Date.now()}-${safeName}`);
+                const savePath = join21(tmpdir(), `clank-upload-${Date.now()}-${safeName}`);
                 await wf(savePath, Buffer.from(await res.arrayBuffer()));
                 const caption = msg.caption || "";
                 const isGroup = msg.chat.type === "group" || msg.chat.type === "supergroup";
@@ -5997,7 +6500,9 @@ You can read this file with the read_file tool.`
             if (tasks.length === 0) return "No background tasks.";
             return "*Background Tasks:*\n" + tasks.map((t) => {
               const elapsed = Math.round(((t.completedAt || Date.now()) - t.startedAt) / 1e3);
-              return `\u2022 *${t.label.slice(0, 40)}* (${t.agentId}) \u2014 ${t.status} (${elapsed}s)`;
+              const depth = t.spawnDepth > 0 ? ` [depth ${t.spawnDepth}]` : "";
+              const kids = t.children.length > 0 ? ` (${t.children.length} children)` : "";
+              return `\u2022 *${t.label.slice(0, 40)}* (${t.agentId})${depth}${kids} \u2014 ${t.status} (${elapsed}s)`;
             }).join("\n");
           }
           case "think":
@@ -6167,9 +6672,9 @@ var init_web = __esm({
 });
 
 // src/plugins/loader.ts
-import { readdir as readdir6, readFile as readFile10 } from "fs/promises";
-import { existsSync as existsSync8 } from "fs";
-import { join as join13 } from "path";
+import { readdir as readdir6, readFile as readFile11 } from "fs/promises";
+import { existsSync as existsSync9 } from "fs";
+import { join as join14 } from "path";
 import { homedir as homedir2 } from "os";
 var PluginLoader;
 var init_loader = __esm({
@@ -6202,25 +6707,25 @@ var init_loader = __esm({
       /** Discover plugin directories */
       async discoverPlugins() {
         const dirs = [];
-        const userPluginDir = join13(homedir2(), ".clank", "plugins");
-        if (existsSync8(userPluginDir)) {
+        const userPluginDir = join14(homedir2(), ".clank", "plugins");
+        if (existsSync9(userPluginDir)) {
           try {
             const entries = await readdir6(userPluginDir, { withFileTypes: true });
             for (const entry of entries) {
               if (entry.isDirectory()) {
-                dirs.push(join13(userPluginDir, entry.name));
+                dirs.push(join14(userPluginDir, entry.name));
               }
             }
           } catch {
           }
         }
-        const nodeModulesDir = join13(process.cwd(), "node_modules");
-        if (existsSync8(nodeModulesDir)) {
+        const nodeModulesDir = join14(process.cwd(), "node_modules");
+        if (existsSync9(nodeModulesDir)) {
           try {
             const entries = await readdir6(nodeModulesDir);
             for (const entry of entries) {
               if (entry.startsWith("clank-plugin-")) {
-                dirs.push(join13(nodeModulesDir, entry));
+                dirs.push(join14(nodeModulesDir, entry));
               }
             }
           } catch {
@@ -6230,9 +6735,9 @@ var init_loader = __esm({
       }
       /** Load a single plugin from a directory */
       async loadPlugin(dir) {
-        const manifestPath = join13(dir, "clank-plugin.json");
-        if (!existsSync8(manifestPath)) return null;
-        const raw = await readFile10(manifestPath, "utf-8");
+        const manifestPath = join14(dir, "clank-plugin.json");
+        if (!existsSync9(manifestPath)) return null;
+        const raw = await readFile11(manifestPath, "utf-8");
         const manifest = JSON.parse(raw);
         if (!manifest.name) return null;
         const plugin = {
@@ -6244,7 +6749,7 @@ var init_loader = __esm({
         if (manifest.tools) {
           for (const toolEntry of manifest.tools) {
             try {
-              const entrypoint = join13(dir, toolEntry.entrypoint);
+              const entrypoint = join14(dir, toolEntry.entrypoint);
               const mod = await import(entrypoint);
               const tool = mod.default || mod.tool;
               if (tool) {
@@ -6258,7 +6763,7 @@ var init_loader = __esm({
         if (manifest.hooks) {
           for (const hookEntry of manifest.hooks) {
             try {
-              const handlerPath = join13(dir, hookEntry.handler);
+              const handlerPath = join14(dir, hookEntry.handler);
               const mod = await import(handlerPath);
               const handler = mod.default || mod.handler;
               if (handler) {
@@ -6314,10 +6819,10 @@ var init_plugins = __esm({
 });
 
 // src/gateway/server.ts
-import { createServer } from "http";
+import { createServer as createServer2 } from "http";
 import { WebSocketServer, WebSocket } from "ws";
-import { readFile as readFile11 } from "fs/promises";
-import { join as join14, dirname as dirname2 } from "path";
+import { readFile as readFile12 } from "fs/promises";
+import { join as join15, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var GatewayServer;
 var init_server = __esm({
@@ -6332,6 +6837,7 @@ var init_server = __esm({
     init_config2();
     init_cron();
     init_tasks();
+    init_auth();
     init_routing();
     init_telegram();
     init_discord();
@@ -6351,6 +6857,7 @@ var init_server = __esm({
       configWatcher;
       pluginLoader;
       taskRegistry;
+      authProfileStore;
       adapters = [];
       running = false;
       /** Rate limiting: track message timestamps per session */
@@ -6361,13 +6868,14 @@ var init_server = __esm({
       // max 20 messages per minute per session
       constructor(config) {
         this.config = config;
-        this.sessionStore = new SessionStore(join14(getConfigDir(), "conversations"));
+        this.sessionStore = new SessionStore(join15(getConfigDir(), "conversations"));
         this.toolRegistry = createFullRegistry();
-        this.memoryManager = new MemoryManager(join14(getConfigDir(), "memory"));
-        this.cronScheduler = new CronScheduler(join14(getConfigDir(), "cron"));
+        this.memoryManager = new MemoryManager(join15(getConfigDir(), "memory"));
+        this.cronScheduler = new CronScheduler(join15(getConfigDir(), "cron"));
         this.configWatcher = new ConfigWatcher();
         this.pluginLoader = new PluginLoader();
         this.taskRegistry = new TaskRegistry();
+        this.authProfileStore = new AuthProfileStore();
       }
       /** Get the task registry (for adapters to list tasks) */
       getTaskRegistry() {
@@ -6379,8 +6887,8 @@ var init_server = __esm({
           console.error(`  Unhandled rejection: ${err instanceof Error ? err.message : err}`);
         });
         if (this.config.gateway.auth.mode === "token" && !this.config.gateway.auth.token) {
-          const { randomBytes: randomBytes2 } = await import("crypto");
-          this.config.gateway.auth.token = randomBytes2(16).toString("hex");
+          const { randomBytes: randomBytes3 } = await import("crypto");
+          this.config.gateway.auth.token = randomBytes3(16).toString("hex");
           console.log(`  Generated auth token: ${this.config.gateway.auth.token.slice(0, 8)}...`);
         }
         await this.sessionStore.init();
@@ -6408,7 +6916,7 @@ var init_server = __esm({
         await this.startAdapters();
         const port = this.config.gateway.port || DEFAULT_PORT;
         const bind = this.config.gateway.bind === "loopback" ? "127.0.0.1" : "0.0.0.0";
-        this.httpServer = createServer((req, res) => this.handleHttp(req, res));
+        this.httpServer = createServer2((req, res) => this.handleHttp(req, res));
         this.wss = new WebSocketServer({ server: this.httpServer });
         this.wss.on("connection", (ws) => this.handleConnection(ws));
         return new Promise((resolve4, reject) => {
@@ -6571,7 +7079,7 @@ var init_server = __esm({
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             status: "ok",
-            version: "1.6.0",
+            version: "1.7.0",
             uptime: process.uptime(),
             clients: this.clients.size,
             agents: this.engines.size
@@ -6601,14 +7109,14 @@ var init_server = __esm({
         if (url === "/chat" || url === "/") {
           try {
             const __dirname4 = dirname2(fileURLToPath2(import.meta.url));
-            const htmlPath = join14(__dirname4, "..", "web", "index.html");
-            const html = await readFile11(htmlPath, "utf-8");
+            const htmlPath = join15(__dirname4, "..", "web", "index.html");
+            const html = await readFile12(htmlPath, "utf-8");
             res.writeHead(200, { "Content-Type": "text/html" });
             res.end(html);
             return;
           } catch {
             try {
-              const html = await readFile11(join14(process.cwd(), "src", "web", "index.html"), "utf-8");
+              const html = await readFile12(join15(process.cwd(), "src", "web", "index.html"), "utf-8");
               res.writeHead(200, { "Content-Type": "text/html" });
               res.end(html);
               return;
@@ -6683,7 +7191,7 @@ var init_server = __esm({
         const hello = {
           type: "hello",
           protocol: PROTOCOL_VERSION,
-          version: "1.6.0",
+          version: "1.7.0",
           agents: this.config.agents.list.map((a) => ({
             id: a.id,
             name: a.name || a.id,
@@ -6784,10 +7292,30 @@ var init_server = __esm({
                 result: task.result,
                 error: task.error,
                 startedAt: task.startedAt,
-                completedAt: task.completedAt
+                completedAt: task.completedAt,
+                spawnDepth: task.spawnDepth,
+                children: task.children.length
               } : null);
               break;
             }
+            case "task.kill": {
+              const killId = frame.params?.taskId;
+              const killTask = this.taskRegistry.get(killId);
+              if (!killTask) {
+                this.sendResponse(client, frame.id, false, void 0, "Task not found");
+                break;
+              }
+              const subEng = this.engines.get(`task:${killId}`);
+              if (subEng) {
+                subEng.cancel();
+                subEng.destroy();
+                this.engines.delete(`task:${killId}`);
+              }
+              this.taskRegistry.cancel(killId);
+              const cascaded = this.taskRegistry.cascadeCancel(`task:${killId}`);
+              this.sendResponse(client, frame.id, true, { killed: killId, cascadeKilled: cascaded });
+              break;
+            }
             // === Config ===
             case "config.get": {
               const { redactConfig: redactConfig2 } = await Promise.resolve().then(() => (init_redact(), redact_exports));
@@ -6930,6 +7458,15 @@ var init_server = __esm({
         if (engine) return engine;
         const agentConfig = this.config.agents.list.find((a) => a.id === agentId);
         const modelConfig = agentConfig?.model || this.config.agents.defaults.model;
+        const allModels = [modelConfig.primary, ...modelConfig.fallbacks || []];
+        if (allModels.some((m) => m.startsWith("codex/"))) {
+          try {
+            const token = await this.authProfileStore.resolveApiKey("openai-codex:default");
+            this.config.models.providers.codex = { apiKey: token };
+          } catch (err) {
+            console.error(`  Codex OAuth: ${err instanceof Error ? err.message : err}`);
+          }
+        }
         const resolved = await resolveWithFallback(
           modelConfig.primary,
           modelConfig.fallbacks || [],
@@ -6956,8 +7493,15 @@ var init_server = __esm({
         const memoryBudget = resolved.isLocal ? 1500 : 4e3;
         const memoryBlock = await this.memoryManager.buildMemoryBlock("", identity.workspace, memoryBudget);
         const fullPrompt = memoryBlock ? systemPrompt + "\n\n---\n\n" + memoryBlock : systemPrompt;
-        const isMainAgent = !sessionKey.startsWith("task:") && (agentId === (this.config.agents.list[0]?.id || "default") || agentId === "default");
-        const spawnTaskFn = isMainAgent ? async (opts) => {
+        const currentDepth = sessionKey.startsWith("task:") ? (this.taskRegistry.getBySessionKey(sessionKey)?.spawnDepth ?? 0) + 1 : 0;
+        const maxSpawnDepth = this.config.agents.defaults.subagents?.maxSpawnDepth ?? 1;
+        const maxConcurrent = this.config.agents.defaults.subagents?.maxConcurrent ?? 8;
+        const canSpawn = currentDepth < maxSpawnDepth;
+        const spawnTaskFn = canSpawn ? async (opts) => {
+          const active = this.taskRegistry.countActiveByParent(sessionKey);
+          if (active >= maxConcurrent) {
+            throw new Error(`Concurrent task limit reached (${active}/${maxConcurrent}). Kill a task first.`);
+          }
           const subAgentConfig = this.config.agents.list.find((a) => a.id === opts.agentId);
           const subModel = subAgentConfig?.model?.primary || this.config.agents.defaults.model.primary;
           const task = this.taskRegistry.create({
@@ -6966,7 +7510,9 @@ var init_server = __esm({
             prompt: opts.prompt,
             label: opts.label,
             timeoutMs: opts.timeoutMs,
-            spawnedBy: sessionKey
+            spawnedBy: sessionKey,
+            spawnDepth: currentDepth,
+            parentSessionKey: sessionKey
           });
           const subSessionKey = `task:${task.id}`;
           const subEngine = await this.getOrCreateEngine(subSessionKey, opts.agentId, "task");
@@ -6993,16 +7539,59 @@ var init_server = __esm({
           });
           return task.id;
         } : void 0;
+        const killTaskFn = async (taskId) => {
+          const task = this.taskRegistry.get(taskId);
+          if (!task) return { status: "not_found" };
+          if (task.spawnedBy !== sessionKey) return { status: "not_owner" };
+          if (task.status !== "running") return { status: "already_done" };
+          const subEngine = this.engines.get(`task:${taskId}`);
+          if (subEngine) {
+            subEngine.cancel();
+            subEngine.destroy();
+            this.engines.delete(`task:${taskId}`);
+          }
+          this.taskRegistry.cancel(taskId);
+          const cascadeKilled = this.taskRegistry.cascadeCancel(`task:${taskId}`);
+          return { status: "ok", cascadeKilled };
+        };
+        const messageTaskFn = async (taskId, message) => {
+          const task = this.taskRegistry.get(taskId);
+          if (!task) return { status: "not_found" };
+          if (task.spawnedBy !== sessionKey) return { status: "not_owner" };
+          if (task.status !== "running") return { status: "not_running" };
+          const subEngine = this.engines.get(`task:${taskId}`);
+          if (!subEngine) return { status: "not_found" };
+          try {
+            const reply = await subEngine.sendMessage(message);
+            return { status: "ok", replyText: reply };
+          } catch (err) {
+            return { status: "error", replyText: err instanceof Error ? err.message : String(err) };
+          }
+        };
+        let finalPrompt = fullPrompt;
+        if (currentDepth > 0) {
+          const depthNote = currentDepth < maxSpawnDepth ? "You can spawn further sub-agents if needed." : "You cannot spawn further sub-agents (depth limit reached).";
+          finalPrompt = `[Sub-Agent] You were spawned by a parent agent to complete a specific task.
+${depthNote}
+
+---
+
+${fullPrompt}`;
+        }
         engine = new AgentEngine({
           identity,
           toolRegistry: this.toolRegistry,
           sessionStore: this.sessionStore,
           provider: resolved,
           autoApprove: this.config.tools.autoApprove,
-          systemPrompt: fullPrompt,
+          systemPrompt: finalPrompt,
           taskRegistry: this.taskRegistry,
           spawnTask: spawnTaskFn,
-          sessionKey
+          killTask: killTaskFn,
+          messageTask: messageTaskFn,
+          sessionKey,
+          spawnDepth: currentDepth,
+          maxSpawnDepth
         });
         await engine.loadSession(sessionKey, channel);
         this.engines.set(sessionKey, engine);
@@ -7110,9 +7699,9 @@ __export(gateway_cmd_exports, {
   gatewayStop: () => gatewayStop,
   isGatewayRunning: () => isGatewayRunning
 });
-import { writeFile as writeFile8, readFile as readFile12, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
-import { join as join15, dirname as dirname3 } from "path";
+import { writeFile as writeFile9, readFile as readFile13, unlink as unlink4 } from "fs/promises";
+import { existsSync as existsSync10 } from "fs";
+import { join as join16, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 async function isGatewayRunning(port) {
   const config = await loadConfig();
@@ -7125,7 +7714,7 @@ async function isGatewayRunning(port) {
   }
 }
 function pidFilePath() {
-  return join15(getConfigDir(), "gateway.pid");
+  return join16(getConfigDir(), "gateway.pid");
 }
 async function gatewayStartForeground(opts) {
   await ensureConfigDir();
@@ -7137,12 +7726,12 @@ async function gatewayStartForeground(opts) {
     console.log(green2(`  Gateway already running on port ${config.gateway.port}`));
     return;
   }
-  await writeFile8(pidFilePath(), String(process.pid), "utf-8");
+  await writeFile9(pidFilePath(), String(process.pid), "utf-8");
   const server = new GatewayServer(config);
   const shutdown = async () => {
     console.log(dim2("\nShutting down..."));
     try {
-      await unlink3(pidFilePath());
+      await unlink4(pidFilePath());
     } catch {
     }
     await server.stop();
@@ -7156,7 +7745,7 @@ async function gatewayStartForeground(opts) {
     console.log(dim2("Press Ctrl+C to stop"));
   } catch (err) {
     try {
-      await unlink3(pidFilePath());
+      await unlink4(pidFilePath());
     } catch {
     }
     console.error(red2(`Failed to start gateway: ${err instanceof Error ? err.message : err}`));
@@ -7170,12 +7759,12 @@ async function gatewayStartBackground() {
     return true;
   }
   console.log(dim2("  Starting gateway in background..."));
-  const entryPoint = join15(dirname3(__filename2), "index.js");
+  const entryPoint = join16(dirname3(__filename2), "index.js");
   const { mkdir: mkdir7 } = await import("fs/promises");
   const { spawn } = await import("child_process");
   const { openSync } = await import("fs");
-  await mkdir7(join15(getConfigDir(), "logs"), { recursive: true });
-  const logFile = join15(getConfigDir(), "logs", "gateway.log");
+  await mkdir7(join16(getConfigDir(), "logs"), { recursive: true });
+  const logFile = join16(getConfigDir(), "logs", "gateway.log");
   const logFd = openSync(logFile, "a");
   const child = spawn(process.execPath, [entryPoint, "gateway", "start", "--foreground"], {
     detached: true,
@@ -7205,16 +7794,16 @@ async function gatewayStart(opts) {
 }
 async function gatewayStop() {
   const pidPath = pidFilePath();
-  if (existsSync9(pidPath)) {
+  if (existsSync10(pidPath)) {
     try {
-      const pid = parseInt(await readFile12(pidPath, "utf-8"), 10);
+      const pid = parseInt(await readFile13(pidPath, "utf-8"), 10);
       process.kill(pid, "SIGTERM");
-      await unlink3(pidPath);
+      await unlink4(pidPath);
       console.log(green2("Gateway stopped"));
       return;
     } catch {
       try {
-        await unlink3(pidPath);
+        await unlink4(pidPath);
       } catch {
       }
     }
@@ -7238,8 +7827,8 @@ async function gatewayStatus() {
       console.log(dim2(`  Clients: ${data.clients?.length || 0}`));
       console.log(dim2(`  Sessions: ${data.sessions?.length || 0}`));
       const pidPath = pidFilePath();
-      if (existsSync9(pidPath)) {
-        const pid = await readFile12(pidPath, "utf-8");
+      if (existsSync10(pidPath)) {
+        const pid = await readFile13(pidPath, "utf-8");
         console.log(dim2(`  PID: ${pid.trim()}`));
       }
     } else {
@@ -7267,12 +7856,12 @@ var init_gateway_cmd = __esm({
 });
 
 // src/daemon/install.ts
-import { writeFile as writeFile9, mkdir as mkdir6, unlink as unlink4 } from "fs/promises";
-import { join as join16 } from "path";
-import { homedir as homedir3, platform as platform4 } from "os";
+import { writeFile as writeFile10, mkdir as mkdir6, unlink as unlink5 } from "fs/promises";
+import { join as join17 } from "path";
+import { homedir as homedir3, platform as platform5 } from "os";
 import { execSync } from "child_process";
 async function installDaemon() {
-  const os = platform4();
+  const os = platform5();
   switch (os) {
     case "darwin":
       await installLaunchd();
@@ -7288,7 +7877,7 @@ async function installDaemon() {
   }
 }
 async function uninstallDaemon() {
-  const os = platform4();
+  const os = platform5();
   switch (os) {
     case "darwin":
       await uninstallLaunchd();
@@ -7304,7 +7893,7 @@ async function uninstallDaemon() {
   }
 }
 async function daemonStatus() {
-  const os = platform4();
+  const os = platform5();
   switch (os) {
     case "darwin":
       try {
@@ -7336,8 +7925,8 @@ async function daemonStatus() {
   }
 }
 async function installLaunchd() {
-  const plistDir = join16(homedir3(), "Library", "LaunchAgents");
-  const plistPath = join16(plistDir, "com.clank.gateway.plist");
+  const plistDir = join17(homedir3(), "Library", "LaunchAgents");
+  const plistPath = join17(plistDir, "com.clank.gateway.plist");
   const clankPath = execSync("which clank || echo clank", { encoding: "utf-8" }).trim();
   await mkdir6(plistDir, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
@@ -7358,21 +7947,21 @@ async function installLaunchd() {
   <key>KeepAlive</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${join16(homedir3(), ".clank", "logs", "gateway.log")}</string>
+  <string>${join17(homedir3(), ".clank", "logs", "gateway.log")}</string>
   <key>StandardErrorPath</key>
-  <string>${join16(homedir3(), ".clank", "logs", "gateway-error.log")}</string>
+  <string>${join17(homedir3(), ".clank", "logs", "gateway-error.log")}</string>
 </dict>
 </plist>`;
-  await writeFile9(plistPath, plist, "utf-8");
+  await writeFile10(plistPath, plist, "utf-8");
   execSync(`launchctl load "${plistPath}"`);
   console.log(green3("Daemon installed (launchd)"));
   console.log(dim3(`  Plist: ${plistPath}`));
 }
 async function uninstallLaunchd() {
-  const plistPath = join16(homedir3(), "Library", "LaunchAgents", "com.clank.gateway.plist");
+  const plistPath = join17(homedir3(), "Library", "LaunchAgents", "com.clank.gateway.plist");
   try {
     execSync(`launchctl unload "${plistPath}"`);
-    await unlink4(plistPath);
+    await unlink5(plistPath);
     console.log(green3("Daemon uninstalled"));
   } catch {
     console.log(dim3("Daemon was not installed"));
@@ -7407,8 +7996,8 @@ async function uninstallTaskScheduler() {
   }
 }
 async function installSystemd() {
-  const unitDir = join16(homedir3(), ".config", "systemd", "user");
-  const unitPath = join16(unitDir, "clank-gateway.service");
+  const unitDir = join17(homedir3(), ".config", "systemd", "user");
+  const unitPath = join17(unitDir, "clank-gateway.service");
   const clankPath = execSync("which clank || echo clank", { encoding: "utf-8" }).trim();
   await mkdir6(unitDir, { recursive: true });
   const unit = `[Unit]
@@ -7423,7 +8012,7 @@ RestartSec=5
 [Install]
 WantedBy=default.target
 `;
-  await writeFile9(unitPath, unit, "utf-8");
+  await writeFile10(unitPath, unit, "utf-8");
   execSync("systemctl --user daemon-reload");
   execSync("systemctl --user enable clank-gateway");
   execSync("systemctl --user start clank-gateway");
@@ -7434,8 +8023,8 @@ async function uninstallSystemd() {
   try {
     execSync("systemctl --user stop clank-gateway");
     execSync("systemctl --user disable clank-gateway");
-    const unitPath = join16(homedir3(), ".config", "systemd", "user", "clank-gateway.service");
-    await unlink4(unitPath);
+    const unitPath = join17(homedir3(), ".config", "systemd", "user", "clank-gateway.service");
+    await unlink5(unitPath);
     execSync("systemctl --user daemon-reload");
     console.log(green3("Daemon uninstalled"));
   } catch {
@@ -7474,8 +8063,8 @@ __export(setup_exports, {
   runSetup: () => runSetup
 });
 import { createInterface as createInterface2 } from "readline";
-import { randomBytes } from "crypto";
-import { dirname as dirname4, join as join17 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+import { dirname as dirname4, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function ask(rl, question) {
   return new Promise((resolve4) => rl.question(question, resolve4));
@@ -7553,7 +8142,9 @@ async function runSetup(opts) {
         console.log("    2. OpenAI (GPT-4o, Codex)");
         console.log("    3. Google (Gemini)");
         console.log("    4. OpenRouter (many models via one key)");
-        console.log("    5. Done");
+        console.log("    5. OpenCode (subscription-based, many models)");
+        console.log("    6. OpenAI Codex (ChatGPT Plus/Pro login)");
+        console.log("    7. Done");
         const choice = await ask(rl, cyan2("    Which provider? "));
         const providerSetup = async (name, defaultModel, keyName) => {
           const existing = providers[name]?.apiKey;
@@ -7569,6 +8160,7 @@ async function runSetup(opts) {
           if (key.trim()) {
             const entry = { apiKey: key.trim() };
             if (name === "openrouter") entry.baseUrl = "https://openrouter.ai/api/v1";
+            else if (name === "opencode") entry.baseUrl = "https://opencode.ai/zen";
             config.models.providers[name] = entry;
             if (!fallbacks.includes(defaultModel)) fallbacks.push(defaultModel);
             console.log(green4(`    ${name} configured`));
@@ -7597,7 +8189,31 @@ async function runSetup(opts) {
             }
             break;
           }
-          case "5":
+          case "5": {
+            await providerSetup("opencode", "opencode/claude-sonnet-4-6", "OpenCode");
+            break;
+          }
+          case "6": {
+            try {
+              const { runOAuthFlow: runOAuthFlow2 } = await Promise.resolve().then(() => (init_oauth(), oauth_exports));
+              const { AuthProfileStore: AuthProfileStore2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
+              console.log(dim4("    Launching browser for OpenAI login..."));
+              const credential = await runOAuthFlow2({
+                onUrl: (url) => console.log(dim4(`    If browser didn't open: ${url}`)),
+                onProgress: (msg) => console.log(dim4(`    ${msg}`))
+              });
+              const store = new AuthProfileStore2();
+              await store.setCredential("openai-codex:default", credential);
+              if (!fallbacks.includes("codex/codex-mini-latest")) {
+                fallbacks.push("codex/codex-mini-latest");
+              }
+              console.log(green4(`    Codex configured (${credential.email})`));
+            } catch (err) {
+              console.log(yellow2(`    Codex OAuth failed: ${err instanceof Error ? err.message : err}`));
+            }
+            break;
+          }
+          case "7":
           case "":
             picking = false;
             break;
@@ -7614,14 +8230,14 @@ async function runSetup(opts) {
       const port = await ask(rl, cyan2(`    Port [${config.gateway.port}]: `));
       if (port.trim()) config.gateway.port = parseInt(port, 10);
     }
-    config.gateway.auth.token = randomBytes(16).toString("hex");
+    config.gateway.auth.token = randomBytes2(16).toString("hex");
     console.log(dim4(`    Port: ${config.gateway.port}`));
     console.log(dim4(`    Token: ${config.gateway.auth.token.slice(0, 8)}...`));
     console.log("");
     console.log(dim4("  Creating workspace..."));
     const { ensureWorkspaceFiles: ensureWorkspaceFiles2 } = await Promise.resolve().then(() => (init_system_prompt(), system_prompt_exports));
-    const templateDir = join17(__dirname2, "..", "workspace", "templates");
-    const wsDir = join17(getConfigDir(), "workspace");
+    const templateDir = join18(__dirname2, "..", "workspace", "templates");
+    const wsDir = join18(getConfigDir(), "workspace");
     try {
       await ensureWorkspaceFiles2(wsDir, templateDir);
     } catch {
@@ -7782,9 +8398,9 @@ var fix_exports = {};
 __export(fix_exports, {
   runFix: () => runFix
 });
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { readdir as readdir7 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 async function runFix(opts) {
   console.log("");
   console.log("  Clank Diagnostics");
@@ -7814,7 +8430,7 @@ async function runFix(opts) {
 }
 async function checkConfig() {
   const configPath = getConfigPath();
-  if (!existsSync10(configPath)) {
+  if (!existsSync11(configPath)) {
     return {
       name: "Config",
       status: "warn",
@@ -7882,8 +8498,8 @@ async function checkModels() {
   return { name: "Model (primary)", status: "ok", message: modelId };
 }
 async function checkSessions() {
-  const sessDir = join18(getConfigDir(), "conversations");
-  if (!existsSync10(sessDir)) {
+  const sessDir = join19(getConfigDir(), "conversations");
+  if (!existsSync11(sessDir)) {
     return { name: "Sessions", status: "ok", message: "no sessions yet" };
   }
   try {
@@ -7895,8 +8511,8 @@ async function checkSessions() {
   }
 }
 async function checkWorkspace() {
-  const wsDir = join18(getConfigDir(), "workspace");
-  if (!existsSync10(wsDir)) {
+  const wsDir = join19(getConfigDir(), "workspace");
+  if (!existsSync11(wsDir)) {
     return {
       name: "Workspace",
       status: "warn",
@@ -8189,7 +8805,7 @@ async function runTui(opts) {
   ws.on("open", () => {
     ws.send(JSON.stringify({
       type: "connect",
-      params: { auth: { token }, mode: "tui", version: "1.6.0" }
+      params: { auth: { token }, mode: "tui", version: "1.7.0" }
     }));
   });
   ws.on("message", (data) => {
@@ -8538,7 +9154,7 @@ __export(uninstall_exports, {
 });
 import { createInterface as createInterface4 } from "readline";
 import { rm } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 async function runUninstall(opts) {
   const configDir = getConfigDir();
   console.log("");
@@ -8577,7 +9193,7 @@ async function runUninstall(opts) {
   } catch {
   }
   console.log(dim10("  Deleting data..."));
-  if (existsSync11(configDir)) {
+  if (existsSync12(configDir)) {
     await rm(configDir, { recursive: true, force: true });
     console.log(green10(`  Removed ${configDir}`));
   } else {
@@ -8615,12 +9231,12 @@ init_esm_shims();
 import { Command } from "commander";
 import { readFileSync } from "fs";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { dirname as dirname5, join as join19 } from "path";
+import { dirname as dirname5, join as join20 } from "path";
 var __filename3 = fileURLToPath5(import.meta.url);
 var __dirname3 = dirname5(__filename3);
-var version = "1.6.0";
+var version = "1.7.0";
 try {
-  const pkg = JSON.parse(readFileSync(join19(__dirname3, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync(join20(__dirname3, "..", "package.json"), "utf-8"));
   version = pkg.version;
 } catch {
 }
@@ -8710,10 +9326,10 @@ program.command("dashboard").description("Open the Web UI in your browser").opti
   Web UI: ${url}
 `);
   if (opts.open !== false) {
-    const { platform: platform5 } = await import("os");
-    const { exec } = await import("child_process");
-    const cmd = platform5() === "win32" ? `start ${url}` : platform5() === "darwin" ? `open ${url}` : `xdg-open ${url}`;
-    exec(cmd);
+    const { platform: platform6 } = await import("os");
+    const { exec: exec2 } = await import("child_process");
+    const cmd = platform6() === "win32" ? `start ${url}` : platform6() === "darwin" ? `open ${url}` : `xdg-open ${url}`;
+    exec2(cmd);
   }
 });
 var pipeline = program.command("pipeline").description("Manage agent pipelines");
@@ -8729,10 +9345,10 @@ pipeline.command("status <id>").description("Check pipeline execution status").a
 });
 var cron = program.command("cron").description("Manage scheduled jobs");
 cron.command("list").description("List cron jobs").action(async () => {
-  const { join: join20 } = await import("path");
+  const { join: join21 } = await import("path");
   const { getConfigDir: getConfigDir3 } = await Promise.resolve().then(() => (init_config2(), config_exports));
   const { CronScheduler: CronScheduler2 } = await Promise.resolve().then(() => (init_cron(), cron_exports));
-  const scheduler = new CronScheduler2(join20(getConfigDir3(), "cron"));
+  const scheduler = new CronScheduler2(join21(getConfigDir3(), "cron"));
   await scheduler.init();
   const jobs = scheduler.listJobs();
   if (jobs.length === 0) {
@@ -8744,10 +9360,10 @@ cron.command("list").description("List cron jobs").action(async () => {
   }
 });
 cron.command("add").description("Add a cron job").requiredOption("--schedule <expr>", "Schedule (e.g., '1h', '30m', 'daily')").requiredOption("--prompt <text>", "What the agent should do").option("--name <name>", "Job name").option("--agent <id>", "Agent ID", "default").action(async (opts) => {
-  const { join: join20 } = await import("path");
+  const { join: join21 } = await import("path");
   const { getConfigDir: getConfigDir3 } = await Promise.resolve().then(() => (init_config2(), config_exports));
   const { CronScheduler: CronScheduler2 } = await Promise.resolve().then(() => (init_cron(), cron_exports));
-  const scheduler = new CronScheduler2(join20(getConfigDir3(), "cron"));
+  const scheduler = new CronScheduler2(join21(getConfigDir3(), "cron"));
   await scheduler.init();
   const job = await scheduler.addJob({
     name: opts.name || "CLI Job",
@@ -8758,10 +9374,10 @@ cron.command("add").description("Add a cron job").requiredOption("--schedule <ex
   console.log(`  Job created: ${job.id.slice(0, 8)} \u2014 "${job.name}" every ${job.schedule}`);
 });
 cron.command("remove <id>").description("Remove a cron job").action(async (id) => {
-  const { join: join20 } = await import("path");
+  const { join: join21 } = await import("path");
   const { getConfigDir: getConfigDir3 } = await Promise.resolve().then(() => (init_config2(), config_exports));
   const { CronScheduler: CronScheduler2 } = await Promise.resolve().then(() => (init_cron(), cron_exports));
-  const scheduler = new CronScheduler2(join20(getConfigDir3(), "cron"));
+  const scheduler = new CronScheduler2(join21(getConfigDir3(), "cron"));
   await scheduler.init();
   const removed = await scheduler.removeJob(id);
   console.log(removed ? `  Job ${id.slice(0, 8)} removed` : `  Job not found`);
@@ -8793,5 +9409,57 @@ program.action(async () => {
   const { runTui: runTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
   await runTui2({});
 });
+var auth = program.command("auth").description("Manage OAuth authentication (Codex login)");
+auth.command("login").description("Sign in with your OpenAI account (ChatGPT Plus/Pro)").action(async () => {
+  const { runOAuthFlow: runOAuthFlow2 } = await Promise.resolve().then(() => (init_oauth(), oauth_exports));
+  const { AuthProfileStore: AuthProfileStore2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
+  try {
+    const credential = await runOAuthFlow2({
+      onUrl: (url) => console.log(`
+  If browser didn't open:
+  ${url}
+`),
+      onProgress: (msg) => console.log(`  ${msg}`)
+    });
+    const store = new AuthProfileStore2();
+    await store.setCredential("openai-codex:default", credential);
+    console.log(`
+  Authenticated as ${credential.email}`);
+    console.log(`  Account: ${credential.accountId}`);
+    console.log(`  Token expires: ${new Date(credential.expires).toLocaleString()}`);
+    console.log(`
+  Use model "codex/codex-mini-latest" in your agent config.`);
+  } catch (err) {
+    console.error(`  OAuth failed: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+});
+auth.command("status").description("Show stored authentication credentials").action(async () => {
+  const { AuthProfileStore: AuthProfileStore2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
+  const store = new AuthProfileStore2();
+  const profiles = await store.listProfiles();
+  if (profiles.length === 0) {
+    console.log("  No stored credentials. Run 'clank auth login' to sign in.");
+    return;
+  }
+  console.log("  Stored credentials:\n");
+  for (const p of profiles) {
+    const cred = await store.getCredential(p.id);
+    const expiry = cred?.type === "oauth" ? new Date(cred.expires).toLocaleString() : "n/a";
+    const expired = cred?.type === "oauth" && Date.now() >= cred.expires;
+    console.log(`  ${p.id}`);
+    console.log(`    Provider: ${p.provider}`);
+    console.log(`    Type: ${p.type}`);
+    if (p.email) console.log(`    Email: ${p.email}`);
+    console.log(`    Expires: ${expiry}${expired ? " (EXPIRED \u2014 will auto-refresh)" : ""}`);
+    console.log("");
+  }
+});
+auth.command("logout").description("Remove stored OAuth credentials").action(async () => {
+  const { AuthProfileStore: AuthProfileStore2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
+  const store = new AuthProfileStore2();
+  await store.removeCredential("openai-codex:default");
+  console.log("  Credentials removed.");
+});
 program.parse();
 //# sourceMappingURL=index.js.map