@tryarcanist/cli 0.1.187 → 0.1.189

package/README.md

@@ -137,6 +137,45 @@ ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 
 JSON mode prints the raw `/api/auth/whoami` API response. Fields currently include `userId`, `email`, `tokenId`, `tokenScope`, and `authMode`.
 
+### `arcanist codex login`
+
+Authenticates a Codex/ChatGPT subscription and stores it for your Codex sessions, then activates it (turns on "use subscription auth for OpenAI sessions"). Runs the Codex CLI device-authorization login locally under a temporary `CODEX_HOME`, then uploads the resulting `auth.json` to Arcanist (encrypted, per user). The credential is never written to your default `~/.codex`. Requires a write-scoped token and a workspace with Codex subscription auth enabled. If activation fails the credential is still saved; run `arcanist codex use on`.
+
+```bash
+arcanist codex login
+arcanist codex login --codex-path /usr/local/bin/codex
+```
+
+`--codex-path <path>` overrides the `codex` executable used (default: `codex` on `PATH`, or `ARCANIST_CODEX_BIN`).
+
+### `arcanist codex use <on|off>`
+
+Turns using your saved Codex subscription auth for OpenAI sessions on or off, without changing the stored credential. `arcanist codex login` turns it on automatically; use this to toggle it later.
+
+```bash
+arcanist codex use on
+arcanist codex use off
+```
+
+### `arcanist codex status`
+
+Shows whether your workspace is eligible for Codex subscription auth and whether an `auth.json` is currently saved.
+
+```bash
+arcanist codex status
+arcanist codex status --json
+```
+
+JSON mode returns `{eligible, credential: {isSet, lastValidationStatus?, lastValidationReasonCode?}}`.
+
+### `arcanist codex logout`
+
+Deactivates the selector and removes the stored Codex subscription auth for your user (write-scoped token).
+
+```bash
+arcanist codex logout
+```
+
 ### `arcanist sessions create <repo-url> [prompt]`
 
 Creates a new session and sends the initial prompt.

package/dist/index.js

@@ -1086,9 +1086,12 @@ var AUTOMATION_ERROR_HINTS = {
   invalid_model: "Model is unknown or not selectable for its backend. Run `arcanist automations create --help` for allowed models.",
   repo_not_available: "Check that the token owner has GitHub access and Arcanist is installed for that repo.",
   duplicate_rule: "An enabled automation already exists for this repo, cron, and prompt.",
+  invalid_skill: "Use a leading slash skill that exists in the selected repo, for example: /audit-prod-docs",
   rule_cap_reached: "Delete or disable an existing automation before creating another one. The cap is 20 enabled rules.",
   installation_unresolved: "Reconnect or reinstall the GitHub integration for that repository, then retry.",
-  model_not_available: "That model's backend (Claude/opencode) is limited to Arcanist team businesses; use the codex default or a codex model."
+  model_not_available: "That model's backend (Claude/opencode) is limited to Arcanist team businesses; use the codex default or a codex model.",
+  repo_skills_unavailable: "Arcanist could not verify the repo's skills right now. Retry once GitHub skill discovery is healthy.",
+  unknown_skill: "That leading slash skill does not exist in the selected repository."
 };
 var MAX_ALL_PAGES = 1e3;
 async function createAutomationCommand(repoUrl, promptArg, options, command) {
@@ -1246,6 +1249,133 @@ function formatTime(value) {
   return typeof value === "number" ? new Date(value).toISOString() : "none";
 }
 
+// src/commands/codex.ts
+import { spawn } from "child_process";
+import { mkdtemp, readFile, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+var CODEX_SUBSCRIPTION_PATH = "/api/settings/codex-subscription";
+var CODEX_SUBSCRIPTION_AUTH_JSON_PATH = "/api/settings/codex-subscription/auth-json";
+var CODEX_SUBSCRIPTION_ENABLED_PATH = "/api/settings/codex-subscription/enabled";
+function resolveCodexPath(optionPath) {
+  return optionPath?.trim() || process.env.ARCANIST_CODEX_BIN?.trim() || "codex";
+}
+function runCodexDeviceLogin(codexPath, codexHome) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(codexPath, ["login", "--device-auth"], {
+      stdio: "inherit",
+      env: { ...process.env, CODEX_HOME: codexHome }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(
+          new CliError("user", `Could not find the \`${codexPath}\` executable.`, {
+            hint: "Install the Codex CLI, or point at it with --codex-path <path> or ARCANIST_CODEX_BIN."
+          })
+        );
+        return;
+      }
+      reject(new CliError("user", `Failed to launch \`${codexPath} login --device-auth\`: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new CliError("user", `\`${codexPath} login --device-auth\` exited with code ${code ?? "unknown"}.`, {
+          hint: "Complete the device approval in your browser, then re-run `arcanist codex login`."
+        })
+      );
+    });
+  });
+}
+async function setCodexSubscriptionEnabled(config, enabled) {
+  return apiFetch(config, CODEX_SUBSCRIPTION_ENABLED_PATH, {
+    method: "PUT",
+    body: JSON.stringify({ enabled })
+  });
+}
+async function codexLoginCommand(options, command) {
+  const { config } = resolveBusinessContext(command, options);
+  const codexPath = resolveCodexPath(options.codexPath);
+  const codexHome = await mkdtemp(join2(tmpdir(), "arcanist-codex-"));
+  try {
+    await runCodexDeviceLogin(codexPath, codexHome);
+    let authJson;
+    try {
+      authJson = await readFile(join2(codexHome, "auth.json"), "utf8");
+    } catch {
+      throw new CliError("user", "Codex login completed but no auth.json was written.", {
+        hint: "Verify `codex login --device-auth` succeeds on its own, then re-run `arcanist codex login`."
+      });
+    }
+    if (!authJson.trim()) {
+      throw new CliError("user", "Codex login produced an empty auth.json.");
+    }
+    const state = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
+      method: "PUT",
+      body: JSON.stringify({ authJson })
+    });
+    let activated = false;
+    let activationError;
+    try {
+      await setCodexSubscriptionEnabled(config, true);
+      activated = true;
+    } catch (err) {
+      activationError = err instanceof Error ? err.message : String(err);
+    }
+    emit(command, options, { ...state, useCodexSubscription: activated }, (payload) => {
+      console.log(
+        activated ? "Codex subscription auth saved and activated for OpenAI sessions." : "Codex subscription auth saved."
+      );
+      if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
+      if (!activated) {
+        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+        console.log("Run `arcanist codex use on` to start using it.");
+      }
+    });
+  } finally {
+    await rm(codexHome, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function codexUseCommand(state, options, command) {
+  const normalized = state.trim().toLowerCase();
+  if (normalized !== "on" && normalized !== "off") {
+    throw new CliError("user", "Usage: arcanist codex use <on|off>");
+  }
+  const enabled = normalized === "on";
+  const { config } = resolveBusinessContext(command, options);
+  const result = await setCodexSubscriptionEnabled(config, enabled);
+  emit(
+    command,
+    options,
+    result,
+    () => console.log(
+      result.useCodexSubscription ? "Codex subscription auth is now used for OpenAI sessions." : "Codex subscription auth is no longer used for OpenAI sessions."
+    )
+  );
+}
+async function codexStatusCommand(options, command) {
+  const { config } = resolveBusinessContext(command, options);
+  const payload = await apiFetch(config, CODEX_SUBSCRIPTION_PATH);
+  emit(command, options, payload, (state) => {
+    console.log(`Eligible: ${state.eligible ? "yes" : "no"}`);
+    console.log(`Auth.json saved: ${state.credential.isSet ? "yes" : "no"}`);
+    if (state.credential.lastValidationStatus) console.log(`Status: ${state.credential.lastValidationStatus}`);
+  });
+}
+async function codexLogoutCommand(options, command) {
+  const { config } = resolveBusinessContext(command, options);
+  await setCodexSubscriptionEnabled(config, false).catch(() => {
+  });
+  const payload = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
+    method: "DELETE"
+  });
+  emit(command, options, payload, () => console.log("Codex subscription auth deactivated and cleared."));
+}
+
 // ../../shared/utils/timing.ts
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
@@ -1297,7 +1427,7 @@ function isWatchTerminal(phase) {
 }
 
 // src/uploads.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { basename, extname } from "path";
 
 // ../../shared/constants/uploads.ts
@@ -1400,7 +1530,7 @@ async function resolveUploadedFileOptions(files) {
     paths.map(async (path) => {
       const name = basename(path);
       try {
-        return { name, content: await readFile(path, "utf8") };
+        return { name, content: await readFile2(path, "utf8") };
       } catch (err) {
         const message = stringifyError(err);
         throw new CliError("user", `Failed to read uploaded file ${path}: ${message}`);
@@ -5350,6 +5480,22 @@ Examples:
   ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 `
 ).action((options, command) => whoamiCommand(options, command));
+var codex = program.command("codex").description("Codex subscription (bring-your-own-subscription) commands");
+codex.command("login").description("Authenticate a Codex/ChatGPT subscription and store it for your Codex sessions").option("--codex-path <path>", "Path to the codex executable (default: codex on PATH, or ARCANIST_CODEX_BIN)").addHelpText(
+  "after",
+  `
+Runs the Codex CLI device-authorization login locally under a temporary CODEX_HOME, then uploads
+the resulting auth.json to Arcanist (encrypted, per user) and activates it. Your workspace must have
+Codex subscription auth enabled. The credential is never written to your default ~/.codex.
+
+Examples:
+  arcanist codex login
+  arcanist codex login --codex-path /usr/local/bin/codex
+`
+).action((options, command) => codexLoginCommand(options, command));
+codex.command("use <state>").description("Turn using your saved Codex subscription auth for OpenAI sessions on or off (state: on|off)").action((state, options, command) => codexUseCommand(state, options, command));
+codex.command("status").description("Show whether your workspace is eligible and whether a Codex subscription auth is saved").action((options, command) => codexStatusCommand(options, command));
+codex.command("logout").description("Deactivate the selector and remove the stored Codex subscription auth for your user").action((options, command) => codexLogoutCommand(options, command));
 var sessions = program.command("sessions").description("Session commands");
 addCreateOptions(sessions.command("create").description("Create a session and send a prompt")).action(
   (repoUrl, prompt, options, command) => createCommand(repoUrl, prompt, options, command)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.187",
+  "version": "0.1.189",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {