@wrongstack/cli 0.299.0 → 0.300.0

package/dist/wiring/fallback-gate.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Factory for the fallback gate function.
+ *
+ * The gate is injected into `createFallbackModelExtension` as `fallbackGate`.
+ * When the fallback chain is about to engage, the gate:
+ *
+ * 1. Registers a `provider.fallback_choice` listener keyed on `requestId`.
+ * 2. Emits `provider.fallback_pending` on the EventBus — carrying the
+ *    candidate list, countdown duration, and the caller-supplied
+ *    `requestId` (generated by the fallback-model extension so the
+ *    `provider.fallback` completion event can share the same id).
+ * 3. Waits for the choice event (the user manually picked a model), OR for
+ *    the countdown timer to expire (auto-switch to the chain head).
+ * 4. Resolves with the chosen model reference, or `null` for auto-switch.
+ *
+ * Registration happens BEFORE the emit so a same-tick choice reply from a
+ * synchronous EventBus listener (test harness, automated UI pick) is not
+ * dropped.
+ *
+ * An absolute deadline (autoSwitchSeconds * 1.5) ensures the gate never
+ * hangs indefinitely even if neither signal arrives (headless mode, no UI
+ * listener, etc.).
+ */
+import type { FallbackGateFn } from '@wrongstack/core/agent';
+import type { EventBus } from '@wrongstack/core/kernel';
+/**
+ * Create a fallback gate that emits `provider.fallback_pending` and waits
+ * for a `provider.fallback_choice` event or the countdown timer.
+ */
+export declare function createFallbackGate(_events: EventBus): FallbackGateFn;
+//# sourceMappingURL=fallback-gate.d.ts.map

package/dist/wiring/fleet-command-handlers.d.ts

@@ -3,7 +3,7 @@ import type { EventBus } from '@wrongstack/core/kernel';
 import type { MultiAgentHost } from '../multi-agent.js';
 import type { BuiltinSlashCommandDeps } from './slash-commands.js';
 type SlashCommandDeps = BuiltinSlashCommandDeps;
-export type FleetCommandHandlers = Pick<SlashCommandDeps, 'onSpawn' | 'onSpawnAndWait' | 'onAgents' | 'onFleet' | 'onFleetStatus' | 'onFleetUsage' | 'onFleetKill' | 'onFleetTerminate' | 'onFleetSpawn' | 'onFleetLog' | 'onFleetRetry' | 'onDirector'>;
+export type FleetCommandHandlers = Pick<SlashCommandDeps, 'onSpawn' | 'onSpawnAndWait' | 'onAgents' | 'onFleet' | 'onFleetStatus' | 'onFleetBudget' | 'onFleetUsage' | 'onFleetKill' | 'onFleetTerminate' | 'onFleetSpawn' | 'onFleetLog' | 'onFleetRetry' | 'onDirector'>;
 export interface FleetCommandHandlersInput {
     multiAgentHost: MultiAgentHost;
     getDirector: () => Director | null;

package/dist/wiring/plugins.d.ts

@@ -1,7 +1,7 @@
 import type { AgentPipelines } from '@wrongstack/core/agent';
 import type { Config, HealthRegistry, Logger, MetricsRuntimeStatus, MetricsSinkView, ModelsRegistry, Plugin, PromptLoader, SkillLoader } from '@wrongstack/core/types';
 import type { ExtensionRegistry } from '@wrongstack/core/extension';
-import type { PluginHostHandle } from '@wrongstack/core/plugin';
+import type { PluginAPIInit, PluginHostHandle } from '@wrongstack/core/plugin';
 import type { ConfigStore, SessionWriter } from '@wrongstack/core/types';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry, SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
@@ -71,13 +71,7 @@ export interface PluginsWiringDeps {
      * default model, and a factory for named-provider overrides. Optional —
      * minimal hosts omit it and plugins see `api.llm === undefined`.
      */
-    llm?: {
-        provider: import('@wrongstack/core/types').Provider;
-        model: string;
-        getProvider?: (() => import('@wrongstack/core/types').Provider) | undefined;
-        getModel?: (() => string) | undefined;
-        createProvider?: ((name: string, model?: string) => import('@wrongstack/core/types').Provider) | undefined;
-    } | undefined;
+    llm?: PluginAPIInit['llm'];
     /** Health registry — injected so the observability built-in can run /health. */
     healthRegistry?: HealthRegistry | undefined;
     /** Skill loader — injected so the skills built-in can list/read skills. */

package/dist/wiring/provider-utility-tools.d.ts

@@ -1,7 +1,8 @@
 /** Registers provider-neutral one-shot, council, and context-summary tools. */
-import type { Config, Provider } from '@wrongstack/core/types';
+import type { Config, CouncilToolConfig, OneShotModelRouter, Provider } from '@wrongstack/core/types';
 import { createContextManagerTool } from '@wrongstack/core/infrastructure';
 import type { FallbackProfileManager } from '@wrongstack/core/agent';
+import { type CouncilPersonaRegistry, type CouncilProfileRegistry } from '@wrongstack/core/execution';
 import type { ProviderModelStatusTracker } from '@wrongstack/core/coordination';
 import type { ToolRegistry } from '@wrongstack/core/registry';
 export interface ProviderUtilityToolsInput {
@@ -21,5 +22,29 @@ export declare function adoptResumedProvider(input: {
         warn(message: string): void;
     };
 }): Promise<void>;
+/**
+ * A router that reads the LIVE config on every pick.
+ *
+ * `ModelRouter` snapshots `modelMatrix` and the provider list at construction,
+ * but `/setmodel` and credential edits change both mid-session. Rebuilding per
+ * call keeps role routing consistent with what the user last configured; the
+ * router itself does no I/O, so this is a plain object construction.
+ */
+export declare function createLiveModelRouter(getConfig: () => Config): OneShotModelRouter;
+/**
+ * Build the Council tool's persona/profile registries from configuration.
+ *
+ * `createCouncilPersonaRegistry` / `createCouncilProfileRegistry` shipped from
+ * day one but no host ever called them, so the tool was pinned to the built-in
+ * lenses and panels with no way to add either. A malformed entry must not take
+ * the whole tool registration down with it — a bad panel definition degrades to
+ * the built-ins and is reported, exactly like an unresolvable Brain pool entry.
+ */
+export declare function buildCouncilRegistries(cfg: CouncilToolConfig | undefined): {
+    personas?: CouncilPersonaRegistry | undefined;
+    profiles?: CouncilProfileRegistry | undefined;
+    defaultProfile?: string | undefined;
+    maxConcurrency?: number | undefined;
+};
 export declare function registerProviderUtilityTools(input: ProviderUtilityToolsInput): void;
 //# sourceMappingURL=provider-utility-tools.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "0.299.0",
+  "version": "0.300.0",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -42,30 +42,30 @@
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/acp": "0.299.0",
-    "@wrongstack/core": "0.299.0",
-    "@wrongstack/kanban": "0.299.0",
-    "@wrongstack/bench": "0.299.0",
-    "@wrongstack/plug-lsp": "0.299.0",
-    "@wrongstack/plugins": "0.299.0",
-    "@wrongstack/runtime": "0.299.0",
-    "@wrongstack/providers": "0.299.0",
-    "@wrongstack/mcp": "0.299.0",
-    "@wrongstack/requirement-intake": "0.299.0",
-    "@wrongstack/sdd": "0.299.0",
-    "@wrongstack/sage": "0.299.0",
-    "@wrongstack/techstack": "0.299.0",
-    "@wrongstack/security-scanner": "0.299.0",
-    "@wrongstack/tools": "0.299.0",
-    "@wrongstack/simpleui": "0.299.0",
-    "@wrongstack/telegram": "0.299.0",
-    "@wrongstack/webui": "0.299.0",
-    "@wrongstack/tui": "0.299.0",
-    "@wrongstack/webui-server": "0.299.0",
-    "@wrongstack/webui-hq": "0.299.0"
+    "@wrongstack/core": "0.300.0",
+    "@wrongstack/bench": "0.300.0",
+    "@wrongstack/providers": "0.300.0",
+    "@wrongstack/mcp": "0.300.0",
+    "@wrongstack/acp": "0.300.0",
+    "@wrongstack/kanban": "0.300.0",
+    "@wrongstack/sdd": "0.300.0",
+    "@wrongstack/plugins": "0.300.0",
+    "@wrongstack/plug-lsp": "0.300.0",
+    "@wrongstack/requirement-intake": "0.300.0",
+    "@wrongstack/security-scanner": "0.300.0",
+    "@wrongstack/runtime": "0.300.0",
+    "@wrongstack/sage": "0.300.0",
+    "@wrongstack/techstack": "0.300.0",
+    "@wrongstack/telegram": "0.300.0",
+    "@wrongstack/simpleui": "0.300.0",
+    "@wrongstack/tools": "0.300.0",
+    "@wrongstack/webui-hq": "0.300.0",
+    "@wrongstack/tui": "0.300.0",
+    "@wrongstack/webui": "0.300.0",
+    "@wrongstack/webui-server": "0.300.0"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "0.299.0"
+    "@wrongstack/desktop": "0.300.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

package/dist/chunk-GO3TJICK.js

@@ -1,489 +0,0 @@
-import {
-  mutateConfigProviders,
-  normalizeKeys,
-  nowIso,
-  writeKeysBack
-} from "./chunk-PJHET45A.js";
-
-// src/auth-menu/openai-codex-oauth.ts
-import { createHash, randomBytes } from "node:crypto";
-
-// src/auth-menu/loopback-server.ts
-import { spawn } from "node:child_process";
-import { createServer } from "node:http";
-var ESCAPE_HTML = {
-  "&": "&",
-  "<": "&lt;",
-  ">": "&gt;",
-  '"': "&quot;",
-  "'": "&#39;"
-};
-function escapeHtml(s) {
-  return s.replace(/[&<>"']/g, (ch) => ESCAPE_HTML[ch] ?? ch);
-}
-function callbackHtml(ok, message) {
-  const heading = ok ? "Authentication successful" : "Authentication failed";
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>${escapeHtml(heading)}</title><style>body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#09090b;color:#fafafa;font-family:ui-sans-serif,system-ui,sans-serif;text-align:center}h1{font-size:26px;margin:0 0 8px}p{color:#a1a1aa}</style></head><body><main><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(message)}</p></main></body></html>`;
-}
-function openBrowser(url) {
-  try {
-    const platform = process.platform;
-    const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
-    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-function startLoopbackServer(expectedState, ports, signal, callbackPath = "/auth/callback", redirectHost = "127.0.0.1") {
-  let resolveCode = () => {
-  };
-  const codePromise = new Promise((resolve) => {
-    let settled = false;
-    resolveCode = (v) => {
-      if (settled) return;
-      settled = true;
-      resolve(v);
-    };
-  });
-  const server = createServer((req, res) => {
-    let url;
-    try {
-      url = new URL(req.url ?? "", `http://${redirectHost}`);
-    } catch {
-      res.statusCode = 400;
-      res.end();
-      return;
-    }
-    if (url.pathname !== callbackPath) {
-      res.statusCode = 404;
-      res.setHeader("content-type", "text/html; charset=utf-8");
-      res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'");
-      res.setHeader("x-frame-options", "DENY");
-      res.setHeader("x-content-type-options", "nosniff");
-      res.setHeader("referrer-policy", "no-referrer");
-      res.end(callbackHtml(false, "Callback route not found."));
-      return;
-    }
-    res.setHeader("content-type", "text/html; charset=utf-8");
-    res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'");
-    res.setHeader("x-frame-options", "DENY");
-    res.setHeader("x-content-type-options", "nosniff");
-    res.setHeader("referrer-policy", "no-referrer");
-    const err = url.searchParams.get("error");
-    if (err) {
-      res.statusCode = 400;
-      res.end(callbackHtml(false, `Authorization error: ${err}`));
-      resolveCode(null);
-      return;
-    }
-    const state = url.searchParams.get("state") ?? "";
-    if (state !== expectedState) {
-      res.statusCode = 400;
-      res.end(callbackHtml(false, "State mismatch \u2014 please restart the login."));
-      resolveCode(null);
-      return;
-    }
-    const code = url.searchParams.get("code");
-    if (!code) {
-      res.statusCode = 400;
-      res.end(callbackHtml(false, "Missing authorization code."));
-      return;
-    }
-    res.statusCode = 200;
-    res.end(callbackHtml(true, "You can close this window and return to the terminal."));
-    resolveCode({ code, state });
-  });
-  const onAbort = () => {
-    resolveCode(null);
-    try {
-      server.close();
-    } catch {
-    }
-  };
-  if (signal) {
-    if (signal.aborted) onAbort();
-    else signal.addEventListener("abort", onAbort, { once: true });
-  }
-  return new Promise((resolve) => {
-    const close = () => {
-      resolveCode(null);
-      try {
-        server.close();
-      } catch {
-      }
-    };
-    const fail = () => {
-      resolveCode(null);
-      resolve({
-        bound: false,
-        port: ports[0] ?? 1455,
-        waitForCode: () => Promise.resolve(null),
-        close
-      });
-    };
-    let index = 0;
-    server.on("error", () => {
-      index += 1;
-      const nextPort = ports[index];
-      if (nextPort !== void 0) {
-        server.listen(nextPort, redirectHost);
-        return;
-      }
-      fail();
-    });
-    server.on("listening", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : ports[index] ?? 1455;
-      resolve({
-        bound: true,
-        port,
-        waitForCode: () => codePromise,
-        close
-      });
-    });
-    server.listen(ports[0] ?? 1455, redirectHost);
-  });
-}
-
-// src/auth-menu/openai-codex-oauth.ts
-import { CODEX_MODELS } from "@wrongstack/core/models";
-import { color } from "@wrongstack/core/utils";
-import { FetchError, ParseError } from "@wrongstack/core/types";
-var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTH_BASE_URL = "https://auth.openai.com";
-var AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
-var TOKEN_URL = `${AUTH_BASE_URL}/oauth/token`;
-var REDIRECT_PORT = 1455;
-var FALLBACK_REDIRECT_PORT = 1457;
-var REDIRECT_HOST = "127.0.0.1";
-var REDIRECT_PATH = "/auth/callback";
-var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
-var ORIGINATOR = "wrongstack";
-var CODEX_PROVIDER_ID = "openai-codex";
-var CODEX_BASE_URL = "https://chatgpt.com/backend-api";
-function startLoopbackServer2(expectedState, signal) {
-  return startLoopbackServer(
-    expectedState,
-    [REDIRECT_PORT, FALLBACK_REDIRECT_PORT],
-    signal,
-    REDIRECT_PATH,
-    REDIRECT_HOST
-  );
-}
-function base64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function generatePkce() {
-  const verifier = base64url(randomBytes(64));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function createState() {
-  return base64url(randomBytes(32));
-}
-function redirectUri(port) {
-  return `http://localhost:${port}${REDIRECT_PATH}`;
-}
-function buildAuthorizeUrl(challenge, state, port = REDIRECT_PORT) {
-  const url = new URL(AUTHORIZE_URL);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID);
-  url.searchParams.set("redirect_uri", redirectUri(port));
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", ORIGINATOR);
-  return url.toString();
-}
-function decodeJwtPayload(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const json = Buffer.from(parts[1], "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return null;
-  }
-}
-function extractAccountId(token) {
-  const payload = decodeJwtPayload(token);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const id = auth?.chatgpt_account_id;
-  return typeof id === "string" && id.length > 0 ? id : null;
-}
-var FALLBACK_CODEX_MODELS = CODEX_MODELS.map(
-  (m) => ({ id: m.id, name: m.name })
-);
-var CODEX_CATALOG_FAMILIES = /* @__PURE__ */ new Set(["gpt-codex", "gpt-codex-spark"]);
-function fallbackCodexModelIds() {
-  return FALLBACK_CODEX_MODELS.map((m) => m.id);
-}
-function fallbackCodexProviderModels() {
-  return FALLBACK_CODEX_MODELS.map((m) => ({ id: m.id, name: m.name }));
-}
-function filterCurrentCodexModelIds(ids) {
-  const available = new Set(ids);
-  return FALLBACK_CODEX_MODELS.map((m) => m.id).filter((id) => available.has(id));
-}
-function isCodexCatalogModel(model) {
-  return typeof model.family === "string" && CODEX_CATALOG_FAMILIES.has(model.family);
-}
-async function resolveCodexModels(modelsRegistry, accessToken, baseUrl, signal) {
-  const token = typeof accessToken === "string" ? accessToken : await accessToken;
-  const live = filterCurrentCodexModelIds(await fetchCodexModels(token, baseUrl, signal));
-  if (live.length > 0) return live;
-  try {
-    const openaiProvider = await modelsRegistry.getProvider("openai");
-    if (openaiProvider) {
-      const catalog = openaiProvider.models.filter(isCodexCatalogModel).map((m) => m.id).filter((id) => typeof id === "string" && id.length > 0);
-      const currentCatalog = filterCurrentCodexModelIds(catalog);
-      if (currentCatalog.length > 0) return currentCatalog;
-    }
-  } catch {
-  }
-  return fallbackCodexModelIds();
-}
-async function fetchCodexModels(accessToken, baseUrl, signal) {
-  const url = `${(baseUrl ?? CODEX_BASE_URL).replace(/\/+$/, "")}/models`;
-  try {
-    const res = await fetch(url, {
-      headers: {
-        accept: "application/json",
-        authorization: `Bearer ${accessToken}`,
-        originator: "wrongstack",
-        "OpenAI-Beta": "responses=experimental"
-      },
-      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(8e3)]) : AbortSignal.timeout(8e3)
-    });
-    if (!res.ok) return [];
-    const json = await res.json();
-    if (!json) return [];
-    const rawList = "data" in json && Array.isArray(json.data) ? json.data : "models" in json && Array.isArray(json.models) ? json.models : [];
-    const ids = [];
-    for (const entry of rawList) {
-      if (!entry || typeof entry !== "object") continue;
-      const id = entry.id;
-      if (typeof id === "string" && id.length > 0) ids.push(id);
-    }
-    return ids;
-  } catch {
-    return [];
-  }
-}
-async function readTokens(res, op, url) {
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new FetchError({
-      message: `Codex token ${op} failed (${res.status}): ${text || res.statusText}`,
-      status: res.status,
-      context: { provider: "openai-codex", op, url }
-    });
-  }
-  const json = await res.json();
-  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-    throw new ParseError({
-      message: `Codex token ${op} response missing fields`,
-      source: "openai-codex-token-response",
-      context: { op }
-    });
-  }
-  return {
-    access: json.access_token,
-    refresh: json.refresh_token,
-    expires: Date.now() + json.expires_in * 1e3,
-    idToken: json.id_token
-  };
-}
-async function exchangeAuthorizationCode(code, verifier, signal, port = REDIRECT_PORT) {
-  const res = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      code_verifier: verifier,
-      redirect_uri: redirectUri(port)
-    }).toString(),
-    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
-  });
-  return readTokens(res, "exchange", TOKEN_URL);
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  return { code: value };
-}
-async function runCodexOAuthLogin(deps, opts = {}) {
-  const providerId = opts.providerId ?? CODEX_PROVIDER_ID;
-  const pkce = generatePkce();
-  const state = createState();
-  const ac = new AbortController();
-  let sigintCount = 0;
-  const onSig = () => {
-    sigintCount += 1;
-    if (sigintCount === 1) {
-      deps.renderer.write(color.dim("\n  Cancelling sign-in\u2026 (press Ctrl+C again to force-quit)\n"));
-      ac.abort();
-    } else {
-      process.exit(130);
-    }
-  };
-  const external = opts.signal;
-  const onExternalAbort = () => ac.abort();
-  if (external) {
-    if (external.aborted) ac.abort();
-    else external.addEventListener("abort", onExternalAbort, { once: true });
-  } else {
-    process.on("SIGINT", onSig);
-  }
-  const server = await startLoopbackServer2(state, ac.signal);
-  const authorizeUrl = buildAuthorizeUrl(pkce.challenge, state, server.port);
-  const osc8 = (url) => `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
-  deps.renderer.write(
-    color.bold(`
-  Sign in with ChatGPT \u2014 ${color.cyan(providerId)}
-`) + color.dim("  Uses your ChatGPT Plus/Pro/Team subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Codex client may violate\n") + color.amber("    OpenAI\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth openai") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
-`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${osc8(authorizeUrl)}
-`) + color.bold(`  ${"\u2500".repeat(56)}
-
-`)
-  );
-  if (server.bound) {
-    openBrowser(authorizeUrl);
-    deps.renderer.write(
-      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim(`  (Listening on ${redirectUri(server.port)} \u2014 press Ctrl+C to cancel.)
-`)
-    );
-  } else {
-    deps.renderer.write(
-      color.amber("  \u26A0 Could not start the local callback listener (ports 1455 and 1457 in use).\n") + color.dim("  After signing in, copy the full redirect URL from your browser\n") + color.dim("  (it starts with http://localhost:1455/auth/callback or :1457) and paste it below.\n")
-    );
-  }
-  let code;
-  try {
-    if (server.bound) {
-      const callback = await server.waitForCode();
-      if (ac.signal.aborted) {
-        deps.renderer.write(color.dim("  Cancelled.\n"));
-        return 1;
-      }
-      if (callback) code = callback.code;
-    }
-    if (!code) {
-      const input = (await deps.reader.readLine(
-        `
-  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
-      )).trim();
-      if (input.toLowerCase() === "q" || input === "") {
-        deps.renderer.write(color.dim("  Cancelled.\n"));
-        return 1;
-      }
-      const parsed = parseAuthorizationInput(input);
-      if (parsed.state && parsed.state !== state) {
-        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
-        return 1;
-      }
-      code = parsed.code;
-    }
-    if (!code) {
-      deps.renderer.writeError("  No authorization code received.");
-      return 1;
-    }
-    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
-    const tokens = await exchangeAuthorizationCode(code, pkce.verifier, ac.signal, server.port);
-    const accountId = extractAccountId(tokens.access) ?? (tokens.idToken ? extractAccountId(tokens.idToken) : null);
-    if (!accountId) {
-      deps.renderer.writeError(
-        "  Signed in, but the token has no ChatGPT account id.\n  This account may not have Codex/ChatGPT subscription access."
-      );
-      return 1;
-    }
-    deps.renderer.write(color.dim("  Fetching available models...\n"));
-    const models = await resolveCodexModels(
-      deps.modelsRegistry,
-      tokens.access,
-      CODEX_BASE_URL,
-      ac.signal
-    );
-    const saved = await saveCodexTokens(deps, providerId, tokens, accountId, models);
-    if (!saved) return 1;
-    const modelHint = models[0] ?? "gpt-5.5";
-    deps.renderer.write(color.green("\n  \u2713 Signed in with ChatGPT!\n"));
-    deps.renderer.writeInfo(
-      `  Saved as provider ${color.bold(providerId)}${models.length > 0 ? ` (${models.length} models)` : ""}.
-  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
-` + color.dim("  Tokens refresh automatically before they expire.\n")
-    );
-    return 0;
-  } catch (err) {
-    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
-    deps.renderer.writeError(`  Login failed: ${msg}`);
-    return 1;
-  } finally {
-    server.close();
-    if (!external) process.off("SIGINT", onSig);
-  }
-}
-async function saveCodexTokens(deps, providerId, tokens, accountId, models) {
-  const entry = {
-    label: "oauth-default",
-    apiKey: tokens.access,
-    createdAt: nowIso(),
-    authMethod: "oauth",
-    expiresAt: new Date(tokens.expires).toISOString(),
-    refreshToken: tokens.refresh,
-    tokenType: "bearer",
-    scope: SCOPE,
-    accountId
-  };
-  try {
-    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
-      const existing = all[providerId];
-      const p = existing ? { ...existing } : { type: providerId };
-      p.family = "openai-codex";
-      if (!p.baseUrl) p.baseUrl = CODEX_BASE_URL;
-      p.models = [...models];
-      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
-      keys.push(entry);
-      writeKeysBack(p, keys);
-      p.activeKey = entry.label;
-      all[providerId] = p;
-    }, deps.profileConfigPath);
-    return true;
-  } catch (err) {
-    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
-    return false;
-  }
-}
-
-export {
-  openBrowser,
-  startLoopbackServer,
-  fallbackCodexProviderModels,
-  filterCurrentCodexModelIds,
-  isCodexCatalogModel,
-  runCodexOAuthLogin
-};
-//# sourceMappingURL=chunk-GO3TJICK.js.map