@tryarcanist/cli 0.1.186 → 0.1.188

package/README.md

@@ -137,6 +137,45 @@ ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 
 JSON mode prints the raw `/api/auth/whoami` API response. Fields currently include `userId`, `email`, `tokenId`, `tokenScope`, and `authMode`.
 
+### `arcanist codex login`
+
+Authenticates a Codex/ChatGPT subscription and stores it for your Codex sessions, then activates it (turns on "use subscription auth for OpenAI sessions"). Runs the Codex CLI device-authorization login locally under a temporary `CODEX_HOME`, then uploads the resulting `auth.json` to Arcanist (encrypted, per user). The credential is never written to your default `~/.codex`. Requires a write-scoped token and a workspace with Codex subscription auth enabled. If activation fails the credential is still saved; run `arcanist codex use on`.
+
+```bash
+arcanist codex login
+arcanist codex login --codex-path /usr/local/bin/codex
+```
+
+`--codex-path <path>` overrides the `codex` executable used (default: `codex` on `PATH`, or `ARCANIST_CODEX_BIN`).
+
+### `arcanist codex use <on|off>`
+
+Turns using your saved Codex subscription auth for OpenAI sessions on or off, without changing the stored credential. `arcanist codex login` turns it on automatically; use this to toggle it later.
+
+```bash
+arcanist codex use on
+arcanist codex use off
+```
+
+### `arcanist codex status`
+
+Shows whether your workspace is eligible for Codex subscription auth and whether an `auth.json` is currently saved.
+
+```bash
+arcanist codex status
+arcanist codex status --json
+```
+
+JSON mode returns `{eligible, credential: {isSet, lastValidationStatus?, lastValidationReasonCode?}}`.
+
+### `arcanist codex logout`
+
+Deactivates the selector and removes the stored Codex subscription auth for your user (write-scoped token).
+
+```bash
+arcanist codex logout
+```
+
 ### `arcanist sessions create <repo-url> [prompt]`
 
 Creates a new session and sends the initial prompt.

package/dist/index.js

@@ -221,9 +221,9 @@ import { randomUUID } from "crypto";
 import { createInterface } from "readline/promises";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join, resolve } from "path";
 var CONFIG_DIR = join(homedir(), ".arcanist");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var PROJECT_CONFIG_FILE = ".arcanist-cli.json";
@@ -330,12 +330,34 @@ function validateAndNormalizeConfig(config) {
 function findGitRoot(cwd) {
   let current = cwd;
   while (true) {
-    if (existsSync(join(current, ".git"))) return current;
+    if (hasGitMetadata(current)) return current;
     const parent = dirname(current);
     if (parent === current) return null;
     current = parent;
   }
 }
+function hasGitMetadata(repoPath2) {
+  const gitPath = join(repoPath2, ".git");
+  if (!existsSync(gitPath)) return false;
+  try {
+    const gitStat = statSync(gitPath);
+    if (gitStat.isDirectory()) {
+      return existsSync(join(gitPath, "HEAD")) && existsSync(join(gitPath, "config"));
+    }
+    if (!gitStat.isFile()) return false;
+    const gitDir = readGitDirPointer(gitPath);
+    if (!gitDir) return false;
+    return existsSync(join(resolve(repoPath2, gitDir), "HEAD"));
+  } catch {
+    return false;
+  }
+}
+function readGitDirPointer(gitFilePath) {
+  const gitDirLine = readFileSync(gitFilePath, "utf-8").split(/\r?\n/).find((line) => line.startsWith("gitdir:"));
+  if (!gitDirLine) return null;
+  const gitDir = gitDirLine.slice("gitdir:".length).trim();
+  return gitDir || null;
+}
 function parseProjectConfig(configPath) {
   let parsed;
   try {
@@ -434,7 +456,7 @@ async function readHiddenPrompt(prompt) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new CliError("user", "No interactive terminal available. Re-run with --token-stdin or set ARCANIST_TOKEN.");
   }
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const stdin = process.stdin;
     const inputChars = [];
     let ansiCarry = "";
@@ -450,7 +472,7 @@ async function readHiddenPrompt(prompt) {
       settled = true;
       cleanup();
       process.stdout.write("\n");
-      resolve(inputChars.join(""));
+      resolve2(inputChars.join(""));
     };
     const fail2 = (error) => {
       if (settled) return;
@@ -605,6 +627,10 @@ function asNonEmptyString(value) {
 
 // ../../shared/constants/models.ts
 var OpenAIModel = {
+  GPT56: "gpt-5.6",
+  GPT56Sol: "gpt-5.6-sol",
+  GPT56Terra: "gpt-5.6-terra",
+  GPT56Luna: "gpt-5.6-luna",
   GPT55: "gpt-5.5",
   GPT54: "gpt-5.4",
   GPT54Pro: "gpt-5.4-pro",
@@ -654,6 +680,48 @@ var MODEL_REGISTRY = [
     },
     sessionStart: { eligible: true, isDefault: true }
   },
+  {
+    id: OpenAIModel.GPT56,
+    name: "GPT-5.6",
+    provider: "openai",
+    backends: [CODEX_AGENT_RUNTIME_BACKEND],
+    contextWindow: 105e4,
+    // Verified 2026-07-09 against OpenAI's GPT-5.6 migration guide and model
+    // catalog: the alias routes to gpt-5.6-sol and supports max effort.
+    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
+    costTracked: false,
+    sessionStart: { eligible: true }
+  },
+  {
+    id: OpenAIModel.GPT56Sol,
+    name: "GPT-5.6 Sol",
+    provider: "openai",
+    backends: [CODEX_AGENT_RUNTIME_BACKEND],
+    contextWindow: 105e4,
+    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
+    costTracked: false,
+    sessionStart: { eligible: true }
+  },
+  {
+    id: OpenAIModel.GPT56Terra,
+    name: "GPT-5.6 Terra",
+    provider: "openai",
+    backends: [CODEX_AGENT_RUNTIME_BACKEND],
+    contextWindow: 105e4,
+    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
+    costTracked: false,
+    sessionStart: { eligible: true }
+  },
+  {
+    id: OpenAIModel.GPT56Luna,
+    name: "GPT-5.6 Luna",
+    provider: "openai",
+    backends: [CODEX_AGENT_RUNTIME_BACKEND],
+    contextWindow: 105e4,
+    reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "medium" },
+    costTracked: false,
+    sessionStart: { eligible: true }
+  },
   {
     id: OpenAIModel.GPT55,
     name: "GPT-5.5",
@@ -1178,9 +1246,136 @@ function formatTime(value) {
   return typeof value === "number" ? new Date(value).toISOString() : "none";
 }
 
+// src/commands/codex.ts
+import { spawn } from "child_process";
+import { mkdtemp, readFile, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+var CODEX_SUBSCRIPTION_PATH = "/api/settings/codex-subscription";
+var CODEX_SUBSCRIPTION_AUTH_JSON_PATH = "/api/settings/codex-subscription/auth-json";
+var CODEX_SUBSCRIPTION_ENABLED_PATH = "/api/settings/codex-subscription/enabled";
+function resolveCodexPath(optionPath) {
+  return optionPath?.trim() || process.env.ARCANIST_CODEX_BIN?.trim() || "codex";
+}
+function runCodexDeviceLogin(codexPath, codexHome) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(codexPath, ["login", "--device-auth"], {
+      stdio: "inherit",
+      env: { ...process.env, CODEX_HOME: codexHome }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(
+          new CliError("user", `Could not find the \`${codexPath}\` executable.`, {
+            hint: "Install the Codex CLI, or point at it with --codex-path <path> or ARCANIST_CODEX_BIN."
+          })
+        );
+        return;
+      }
+      reject(new CliError("user", `Failed to launch \`${codexPath} login --device-auth\`: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new CliError("user", `\`${codexPath} login --device-auth\` exited with code ${code ?? "unknown"}.`, {
+          hint: "Complete the device approval in your browser, then re-run `arcanist codex login`."
+        })
+      );
+    });
+  });
+}
+async function setCodexSubscriptionEnabled(config, enabled) {
+  return apiFetch(config, CODEX_SUBSCRIPTION_ENABLED_PATH, {
+    method: "PUT",
+    body: JSON.stringify({ enabled })
+  });
+}
+async function codexLoginCommand(options, command) {
+  const { config } = resolveBusinessContext(command, options);
+  const codexPath = resolveCodexPath(options.codexPath);
+  const codexHome = await mkdtemp(join2(tmpdir(), "arcanist-codex-"));
+  try {
+    await runCodexDeviceLogin(codexPath, codexHome);
+    let authJson;
+    try {
+      authJson = await readFile(join2(codexHome, "auth.json"), "utf8");
+    } catch {
+      throw new CliError("user", "Codex login completed but no auth.json was written.", {
+        hint: "Verify `codex login --device-auth` succeeds on its own, then re-run `arcanist codex login`."
+      });
+    }
+    if (!authJson.trim()) {
+      throw new CliError("user", "Codex login produced an empty auth.json.");
+    }
+    const state = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
+      method: "PUT",
+      body: JSON.stringify({ authJson })
+    });
+    let activated = false;
+    let activationError;
+    try {
+      await setCodexSubscriptionEnabled(config, true);
+      activated = true;
+    } catch (err) {
+      activationError = err instanceof Error ? err.message : String(err);
+    }
+    emit(command, options, { ...state, useCodexSubscription: activated }, (payload) => {
+      console.log(
+        activated ? "Codex subscription auth saved and activated for OpenAI sessions." : "Codex subscription auth saved."
+      );
+      if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
+      if (!activated) {
+        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+        console.log("Run `arcanist codex use on` to start using it.");
+      }
+    });
+  } finally {
+    await rm(codexHome, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function codexUseCommand(state, options, command) {
+  const normalized = state.trim().toLowerCase();
+  if (normalized !== "on" && normalized !== "off") {
+    throw new CliError("user", "Usage: arcanist codex use <on|off>");
+  }
+  const enabled = normalized === "on";
+  const { config } = resolveBusinessContext(command, options);
+  const result = await setCodexSubscriptionEnabled(config, enabled);
+  emit(
+    command,
+    options,
+    result,
+    () => console.log(
+      result.useCodexSubscription ? "Codex subscription auth is now used for OpenAI sessions." : "Codex subscription auth is no longer used for OpenAI sessions."
+    )
+  );
+}
+async function codexStatusCommand(options, command) {
+  const { config } = resolveBusinessContext(command, options);
+  const payload = await apiFetch(config, CODEX_SUBSCRIPTION_PATH);
+  emit(command, options, payload, (state) => {
+    console.log(`Eligible: ${state.eligible ? "yes" : "no"}`);
+    console.log(`Auth.json saved: ${state.credential.isSet ? "yes" : "no"}`);
+    if (state.credential.lastValidationStatus) console.log(`Status: ${state.credential.lastValidationStatus}`);
+  });
+}
+async function codexLogoutCommand(options, command) {
+  const { config } = resolveBusinessContext(command, options);
+  await setCodexSubscriptionEnabled(config, false).catch(() => {
+  });
+  const payload = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
+    method: "DELETE"
+  });
+  emit(command, options, payload, () => console.log("Codex subscription auth deactivated and cleared."));
+}
+
 // ../../shared/utils/timing.ts
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
 // ../../shared/session/phase.ts
@@ -1229,7 +1424,7 @@ function isWatchTerminal(phase) {
 }
 
 // src/uploads.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { basename, extname } from "path";
 
 // ../../shared/constants/uploads.ts
@@ -1332,7 +1527,7 @@ async function resolveUploadedFileOptions(files) {
     paths.map(async (path) => {
       const name = basename(path);
       try {
-        return { name, content: await readFile(path, "utf8") };
+        return { name, content: await readFile2(path, "utf8") };
       } catch (err) {
         const message = stringifyError(err);
         throw new CliError("user", `Failed to read uploaded file ${path}: ${message}`);
@@ -5282,6 +5477,22 @@ Examples:
   ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 `
 ).action((options, command) => whoamiCommand(options, command));
+var codex = program.command("codex").description("Codex subscription (bring-your-own-subscription) commands");
+codex.command("login").description("Authenticate a Codex/ChatGPT subscription and store it for your Codex sessions").option("--codex-path <path>", "Path to the codex executable (default: codex on PATH, or ARCANIST_CODEX_BIN)").addHelpText(
+  "after",
+  `
+Runs the Codex CLI device-authorization login locally under a temporary CODEX_HOME, then uploads
+the resulting auth.json to Arcanist (encrypted, per user) and activates it. Your workspace must have
+Codex subscription auth enabled. The credential is never written to your default ~/.codex.
+
+Examples:
+  arcanist codex login
+  arcanist codex login --codex-path /usr/local/bin/codex
+`
+).action((options, command) => codexLoginCommand(options, command));
+codex.command("use <state>").description("Turn using your saved Codex subscription auth for OpenAI sessions on or off (state: on|off)").action((state, options, command) => codexUseCommand(state, options, command));
+codex.command("status").description("Show whether your workspace is eligible and whether a Codex subscription auth is saved").action((options, command) => codexStatusCommand(options, command));
+codex.command("logout").description("Deactivate the selector and remove the stored Codex subscription auth for your user").action((options, command) => codexLogoutCommand(options, command));
 var sessions = program.command("sessions").description("Session commands");
 addCreateOptions(sessions.command("create").description("Create a session and send a prompt")).action(
   (repoUrl, prompt, options, command) => createCommand(repoUrl, prompt, options, command)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.186",
+  "version": "0.1.188",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {