@yagni-app/code 0.2.1 → 0.3.1

package/dist/cli.d.ts

@@ -12,6 +12,36 @@
  * plus a configured pi spawn. Everything that makes this "YAGNI Code" lives in
  * pi-extension-yagni and the YAGNI backend.
  */
+/**
+ * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
+ * input aligns with the chat/output area (`outputPad`) and the status bar.
+ * Fills the key in only when absent — an explicit user choice (including 0)
+ * is never overwritten. Best-effort: a missing/corrupt settings file or a
+ * write failure must never block the launch.
+ */
+export declare function seedEditorPadding(piAgentDir: string): void;
+/**
+ * Seed `collapseChangelog` into the per-profile pi `settings.json` so the
+ * "What's New" section on startup renders as a one-liner instead of a full
+ * markdown dump. Fills the key in only when absent — an explicit user choice
+ * (including false) is never overwritten. Best-effort: a missing/corrupt
+ * settings file or a write failure must never block the launch.
+ */
+export declare function seedCollapseChangelog(piAgentDir: string): void;
+/**
+ * Seed `hideThinkingBlock` into the per-profile pi `settings.json` so the
+ * model's raw chain-of-thought collapses to a single labeled line instead of
+ * streaming its entire reasoning to the terminal. Fills the key in only when
+ * absent — an explicit user choice (including false, e.g. via Ctrl+T) is never
+ * overwritten. Best-effort: a missing/corrupt settings file or a write failure
+ * must never block the launch.
+ *
+ * Returns true only when this call actually collapsed reasoning for the first
+ * time (the key was absent and the write succeeded), so the caller can pass a
+ * one-time hint to the extension. Ctrl+T still reveals the full trace and
+ * persists the user's choice, so this default is always reversible.
+ */
+export declare function seedHideThinkingBlock(piAgentDir: string): boolean;
 export declare const HELP_TEXT: string;
 /** Parse `use <name> [--base-url <url>]` argv into its parts. */
 export declare function parseUseArgs(args: string[]): {

package/dist/cli.js

@@ -13,20 +13,25 @@
  * pi-extension-yagni and the YAGNI backend.
  */
 import { spawn } from "node:child_process";
-import { mkdirSync, realpathSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { PI_CONFIG_NAME } from "./branding.js";
 import { claudeCompatArgs } from "./claudeCompat.js";
 import { agentDir, credentialsDir, piPackageDir } from "./credentials.js";
 import { DISTRIBUTION } from "./distribution.js";
+import { connectCommand } from "./connectClaudeCode.js";
 import { login } from "./login.js";
 import { logout } from "./logout.js";
+import { tokenCommand } from "./token.js";
 import { buildLaunch } from "./launch.js";
 import { runDoctor } from "./doctor.js";
 import { installProcessCrashHandlers } from "./crashReport.js";
 import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgrade.js";
 import { maybeRefreshAtLaunch } from "./refresh.js";
+import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
+import { PAD_X } from "./padding.js";
 import { ensureShadowPiPackage } from "./piPackage.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
 import { credentialsFromProfile, getActiveProfileName, listProfiles, migrateLegacyCredentials, persistProfileTokenRotation, profilePath, readActiveProfile, useProfile, } from "./profiles.js";
@@ -43,6 +48,115 @@ async function confirmOnTty(question) {
         rl.close();
     }
 }
+/**
+ * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
+ * input is padded to match the chat/output area (`outputPad`) and the status
+ * bar. Fills the key in only when absent — an explicit user choice (including
+ * 0) is never overwritten. Best-effort: a missing/corrupt settings file or a
+ * write failure must never block the launch.
+ */
+/**
+ * Seed a key into the per-profile pi `settings.json`. Shared guard rails for
+ * all settings seeds:
+ *
+ * This writes to a user-owned file, so it is deliberately conservative:
+ *  - fills the key in ONLY when absent — an explicit user choice (including 0
+ *    or false) is never overwritten;
+ *  - backs off on a missing-dir, corrupt, non-object, or symlinked settings
+ *    file rather than risk clobbering anything;
+ *  - writes ATOMICALLY (temp file + rename) and preserves the existing file's
+ *    permissions, so a crash mid-write can never truncate the user's settings.
+ * Any failure is swallowed: seeding must never block or break a launch.
+ *
+ * Returns true only when this call actually wrote the key (the key was absent
+ * and the write succeeded), letting callers distinguish a first-seed from a
+ * no-op so they can surface a one-time hint. Returns false on any existing
+ * value (explicit or previously seeded), a back-off case, or a write failure.
+ */
+function seedSetting(piAgentDir, key, value) {
+    try {
+        const settingsPath = join(piAgentDir, "settings.json");
+        let settings = {};
+        let existingMode;
+        if (existsSync(settingsPath)) {
+            // Refuse to follow a symlink: we must only ever write a regular, real
+            // settings file the user (or pi) owns.
+            if (lstatSync(settingsPath).isSymbolicLink())
+                return false;
+            let parsed;
+            try {
+                parsed = JSON.parse(readFileSync(settingsPath, "utf8"));
+            }
+            catch {
+                return false; // corrupt file: back off rather than clobber the user's settings
+            }
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return false; // non-object settings: leave it alone
+            }
+            settings = parsed;
+            existingMode = lstatSync(settingsPath).mode & 0o777;
+        }
+        if (settings[key] !== undefined)
+            return false; // user (or a prior seed) already set it
+        settings[key] = value;
+        // Atomic write: serialize to a temp file in the same directory, then
+        // rename over the target. A crash leaves either the old file or the temp
+        // file, never a half-written settings.json.
+        const tmpPath = join(piAgentDir, `.settings.json.yagni-${process.pid}-${Date.now()}.tmp`);
+        try {
+            writeFileSync(tmpPath, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
+            renameSync(tmpPath, settingsPath);
+        }
+        finally {
+            rmSync(tmpPath, { force: true }); // no-op once the rename succeeded
+        }
+        // Restore the original permissions if the file already had them (rename
+        // replaces the inode, which would otherwise reset to 0600).
+        if (existingMode !== undefined)
+            chmodSync(settingsPath, existingMode);
+        return true;
+    }
+    catch {
+        // never block launch on a settings-seed failure
+        return false;
+    }
+}
+/**
+ * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
+ * input aligns with the chat/output area (`outputPad`) and the status bar.
+ * Fills the key in only when absent — an explicit user choice (including 0)
+ * is never overwritten. Best-effort: a missing/corrupt settings file or a
+ * write failure must never block the launch.
+ */
+export function seedEditorPadding(piAgentDir) {
+    seedSetting(piAgentDir, "editorPaddingX", PAD_X);
+}
+/**
+ * Seed `collapseChangelog` into the per-profile pi `settings.json` so the
+ * "What's New" section on startup renders as a one-liner instead of a full
+ * markdown dump. Fills the key in only when absent — an explicit user choice
+ * (including false) is never overwritten. Best-effort: a missing/corrupt
+ * settings file or a write failure must never block the launch.
+ */
+export function seedCollapseChangelog(piAgentDir) {
+    seedSetting(piAgentDir, "collapseChangelog", true);
+}
+/**
+ * Seed `hideThinkingBlock` into the per-profile pi `settings.json` so the
+ * model's raw chain-of-thought collapses to a single labeled line instead of
+ * streaming its entire reasoning to the terminal. Fills the key in only when
+ * absent — an explicit user choice (including false, e.g. via Ctrl+T) is never
+ * overwritten. Best-effort: a missing/corrupt settings file or a write failure
+ * must never block the launch.
+ *
+ * Returns true only when this call actually collapsed reasoning for the first
+ * time (the key was absent and the write succeeded), so the caller can pass a
+ * one-time hint to the extension. Ctrl+T still reveals the full trace and
+ * persists the user's choice, so this default is always reversible.
+ */
+export function seedHideThinkingBlock(piAgentDir) {
+    return seedSetting(piAgentDir, "hideThinkingBlock", true);
+}
 async function runDefault(passthroughArgs) {
     // Cache-backed update nudge (never a network wait), then a background cache
     // refresh that completes while the session runs. Both fail soft.
@@ -72,6 +186,20 @@ async function runDefault(passthroughArgs) {
     // instead of ~/.pi/agent, and prod state never bleeds into staging.
     const piAgentDir = agentDir(profile.name);
     mkdirSync(piAgentDir, { recursive: true, mode: 0o700 });
+    // Seed the editor's horizontal padding so the prompt input aligns with the
+    // chat/output area and the status bar, and collapse the changelog so the
+    // "What's New" section on startup renders as a one-liner instead of a full
+    // markdown dump. Only fills in when the user has not set either themselves —
+    // an explicit choice is never clobbered. Best-effort: a corrupt or
+    // unreadable settings.json must never block the launch.
+    seedEditorPadding(piAgentDir);
+    seedCollapseChangelog(piAgentDir);
+    // Collapse raw chain-of-thought to one line on first launch. Seeded here
+    // (before the extension boots) so `setHiddenThinkingLabel`/any Ctrl+T toggle
+    // in this session sees the collapsed default. `seededHideThinking` is true
+    // only THIS launch — a downstream one-time hint must not re-nag on the next
+    // real run once the key already exists.
+    const seededHideThinking = seedHideThinkingBlock(piAgentDir);
     // Generate the shadow pi package so the terminal title/process name read
     // "YAGNI Code" instead of "pi"/"π". Best-effort: if it can't be built we
     // still launch (un-rebranded but hermetic), never blocking the agent.
@@ -120,6 +248,7 @@ async function runDefault(passthroughArgs) {
             stateDir: credentialsDir(),
             cliVersion: cliVersion(),
             baseEnv: process.env,
+            ...(seededHideThinking ? { hideThinkingSeeded: true } : {}),
         });
     }
     catch (err) {
@@ -136,7 +265,12 @@ async function runDefault(passthroughArgs) {
             stdio: "inherit",
             env,
         });
-        child.on("exit", (code) => resolve(code ?? 0));
+        // Forward termination signals to pi instead of dying around it (see
+        // signalForward.ts for the policy: first signal graceful, second tree-kill).
+        installSignalForwarding(child);
+        // 128+n for a signal death (bash parity), so a cancelled/killed run never
+        // reads as success to scripts or CI.
+        child.on("exit", (code, signal) => resolve(exitCodeFor(code, signal)));
         child.on("error", (err) => {
             process.stderr.write(`Failed to start YAGNI Code: ${err.message}\n`);
             resolve(1);
@@ -154,6 +288,10 @@ export const HELP_TEXT = [
     "  yagni login              Authorize the active environment (device-code flow).",
     "  yagni logout             Revoke and clear the active environment's token.",
     "  yagni doctor             Check that everything is ready (green/red checklist).",
+    "  yagni connect claude-code  Route Claude Code through the YAGNI model proxy",
+    "                           (--project scopes to this repo; --off disconnects).",
+    "  yagni connect codex      Route Codex CLI through the YAGNI model proxy.",
+    "  yagni token              Output the active environment's API token (for helpers).",
     "  yagni use <name>         Switch the active environment (sticky).",
     "                           Presets: prod, local. Others need --base-url <url>.",
     "  yagni profiles           List saved environments; the active one is marked.",
@@ -161,7 +299,7 @@ export const HELP_TEXT = [
     "  yagni version            Print the CLI version.",
     "",
     "Common agent flags (passed straight through):",
-    "  --model <tier>           Pick the model tier (balanced by default).",
+    "  --model <tier>           Model tier (fixed to advanced).",
     "  --thinking <level>       off | minimal | low | medium | high | xhigh | max",
     "  --session <id>           Open a specific session; --fork <id> branches one.",
     "  --mode json              Emit machine-readable events (for scripts and CI).",
@@ -283,6 +421,12 @@ export async function main(argv) {
     if (command === "doctor") {
         return runDoctor();
     }
+    if (command === "connect") {
+        return connectCommand(rest);
+    }
+    if (command === "token") {
+        return tokenCommand();
+    }
     if (command === "upgrade") {
         return upgradeCommand(rest, { current: cliVersion() });
     }

package/dist/connectClaudeCode.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `yagni connect claude-code` — point Claude Code at the YAGNI model proxy.
+ *
+ * Writes the three settings Claude Code needs into `~/.claude/settings.json`
+ * (or `.claude/settings.local.json` with `--project`):
+ *
+ *   env.ANTHROPIC_BASE_URL      the active environment's base URL (Claude Code
+ *                               appends /v1/messages — the proxy's Anthropic-
+ *                               dialect route)
+ *   env.ANTHROPIC_CUSTOM_HEADERS  `x-yagni-caller: claude-code`, the
+ *                               attribution label the usage report rolls up on
+ *   apiKeyHelper                `yagni token` — the credential comes from the
+ *                               profile at call time, so nothing secret is
+ *                               ever baked into a settings file and a rotated
+ *                               token is picked up automatically
+ *
+ * Everything else in the file is preserved verbatim. `--off` removes exactly
+ * the managed keys (the helper only when it is ours). The planner is pure and
+ * the writer is atomic (temp + rename, symlink-refusing) — the same guard
+ * rails as the launcher's settings seeding, except a corrupt file is an ERROR
+ * here rather than a silent back-off: the user asked for a config change, so
+ * failing quietly would be lying.
+ */
+import { type Profile } from "./profiles.js";
+export declare const CALLER_HEADER_LINE = "x-yagni-caller: claude-code";
+export interface ConnectPlanInput {
+    /** The active environment's base URL (no trailing slash). */
+    baseUrl: string;
+    /** The apiKeyHelper command, e.g. `yagni token`. */
+    helperCommand: string;
+}
+export interface ConnectPlan {
+    settings: Record<string, unknown>;
+    /** Human-readable `key: old → new` lines for the summary. */
+    changes: string[];
+    /** Keys that belonged to something else and were replaced — surfaced loudly. */
+    replaced: string[];
+}
+type Settings = Record<string, unknown>;
+/**
+ * Merge our caller header into an existing ANTHROPIC_CUSTOM_HEADERS value:
+ * foreign header lines are preserved, a stale x-yagni-caller line is replaced,
+ * ours lands last. Newline-separated per the Claude Code contract.
+ */
+export declare function mergeCustomHeaders(existing: unknown): string;
+/** Pure: the settings object after connecting, plus what changed. */
+export declare function planConnect(existing: Settings, input: ConnectPlanInput): ConnectPlan;
+export interface DisconnectPlan {
+    settings: Settings;
+    removed: string[];
+    /** A foreign apiKeyHelper we refused to touch, if any. */
+    keptForeignHelper?: string;
+}
+/** Pure: the settings object after `--off` — managed keys out, all else kept. */
+export declare function planDisconnect(existing: Settings, helperCommand: string): DisconnectPlan;
+export declare function settingsPathFor(scope: "user" | "project", cwd: string, home?: string): string;
+/** Read + parse a settings file. Missing → {}. Corrupt/symlink/non-object → throws. */
+export declare function readSettings(path: string): Settings;
+/** Atomic write (temp + rename), preserving an existing file's permissions. */
+export declare function writeSettings(path: string, settings: Settings): void;
+export interface ConnectArgs {
+    target?: string;
+    project: boolean;
+    off: boolean;
+}
+export declare function parseConnectArgs(args: string[]): ConnectArgs;
+export interface ConnectDeps {
+    readProfile?: () => Promise<Profile>;
+    cwd?: string;
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+    stdout?: (text: string) => void;
+    stderr?: (text: string) => void;
+}
+export declare function connectCommand(args: string[], deps?: ConnectDeps): Promise<number>;
+export {};
+//# sourceMappingURL=connectClaudeCode.d.ts.map

package/dist/connectClaudeCode.js

@@ -0,0 +1,228 @@
+/**
+ * `yagni connect claude-code` — point Claude Code at the YAGNI model proxy.
+ *
+ * Writes the three settings Claude Code needs into `~/.claude/settings.json`
+ * (or `.claude/settings.local.json` with `--project`):
+ *
+ *   env.ANTHROPIC_BASE_URL      the active environment's base URL (Claude Code
+ *                               appends /v1/messages — the proxy's Anthropic-
+ *                               dialect route)
+ *   env.ANTHROPIC_CUSTOM_HEADERS  `x-yagni-caller: claude-code`, the
+ *                               attribution label the usage report rolls up on
+ *   apiKeyHelper                `yagni token` — the credential comes from the
+ *                               profile at call time, so nothing secret is
+ *                               ever baked into a settings file and a rotated
+ *                               token is picked up automatically
+ *
+ * Everything else in the file is preserved verbatim. `--off` removes exactly
+ * the managed keys (the helper only when it is ours). The planner is pure and
+ * the writer is atomic (temp + rename, symlink-refusing) — the same guard
+ * rails as the launcher's settings seeding, except a corrupt file is an ERROR
+ * here rather than a silent back-off: the user asked for a config change, so
+ * failing quietly would be lying.
+ */
+import { existsSync, lstatSync, readFileSync, renameSync, rmSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { DISTRIBUTION } from "./distribution.js";
+import { credentialsFromProfile, readActiveProfile } from "./profiles.js";
+export const CALLER_HEADER_LINE = "x-yagni-caller: claude-code";
+function envOf(settings) {
+    const env = settings.env;
+    return env && typeof env === "object" && !Array.isArray(env) ? { ...env } : {};
+}
+/**
+ * Merge our caller header into an existing ANTHROPIC_CUSTOM_HEADERS value:
+ * foreign header lines are preserved, a stale x-yagni-caller line is replaced,
+ * ours lands last. Newline-separated per the Claude Code contract.
+ */
+export function mergeCustomHeaders(existing) {
+    const lines = typeof existing === "string" && existing.length > 0 ? existing.split("\n") : [];
+    const kept = lines.filter((l) => l.trim() !== "" && !/^x-yagni-caller\s*:/i.test(l));
+    return [...kept, CALLER_HEADER_LINE].join("\n");
+}
+/** Pure: the settings object after connecting, plus what changed. */
+export function planConnect(existing, input) {
+    const env = envOf(existing);
+    const changes = [];
+    const replaced = [];
+    const note = (key, prior, next) => {
+        if (prior === next)
+            return;
+        changes.push(prior === undefined ? `${key} = ${next}` : `${key}: ${String(prior)} → ${next}`);
+        if (prior !== undefined)
+            replaced.push(key);
+    };
+    note("env.ANTHROPIC_BASE_URL", env.ANTHROPIC_BASE_URL, input.baseUrl);
+    env.ANTHROPIC_BASE_URL = input.baseUrl;
+    const headers = mergeCustomHeaders(env.ANTHROPIC_CUSTOM_HEADERS);
+    if (env.ANTHROPIC_CUSTOM_HEADERS !== headers) {
+        changes.push(`env.ANTHROPIC_CUSTOM_HEADERS = ${headers.replaceAll("\n", " | ")}`);
+    }
+    env.ANTHROPIC_CUSTOM_HEADERS = headers;
+    note("apiKeyHelper", existing.apiKeyHelper, input.helperCommand);
+    return {
+        settings: { ...existing, env, apiKeyHelper: input.helperCommand },
+        changes,
+        replaced,
+    };
+}
+/** Pure: the settings object after `--off` — managed keys out, all else kept. */
+export function planDisconnect(existing, helperCommand) {
+    const env = envOf(existing);
+    const removed = [];
+    const out = { ...existing };
+    if (env.ANTHROPIC_BASE_URL !== undefined) {
+        removed.push("env.ANTHROPIC_BASE_URL");
+        delete env.ANTHROPIC_BASE_URL;
+    }
+    if (typeof env.ANTHROPIC_CUSTOM_HEADERS === "string") {
+        const kept = env.ANTHROPIC_CUSTOM_HEADERS
+            .split("\n")
+            .filter((l) => l.trim() !== "" && !/^x-yagni-caller\s*:/i.test(l));
+        if (kept.length !== env.ANTHROPIC_CUSTOM_HEADERS.split("\n").filter((l) => l.trim() !== "").length) {
+            removed.push("env.ANTHROPIC_CUSTOM_HEADERS (x-yagni-caller line)");
+        }
+        if (kept.length === 0)
+            delete env.ANTHROPIC_CUSTOM_HEADERS;
+        else
+            env.ANTHROPIC_CUSTOM_HEADERS = kept.join("\n");
+    }
+    let keptForeignHelper;
+    if (typeof out.apiKeyHelper === "string") {
+        // Only remove a helper that is ours — `yagni token` under any install path
+        // (npx wrapper, absolute bin). Someone else's gateway helper stays.
+        if (new RegExp(`(^|[/\\s])${helperCommand.split(" ")[0]}\\s+token\\s*$`).test(out.apiKeyHelper)) {
+            removed.push("apiKeyHelper");
+            delete out.apiKeyHelper;
+        }
+        else {
+            keptForeignHelper = out.apiKeyHelper;
+        }
+    }
+    if (Object.keys(env).length === 0 && out.env !== undefined)
+        delete out.env;
+    else
+        out.env = env;
+    return { settings: out, removed, ...(keptForeignHelper ? { keptForeignHelper } : {}) };
+}
+// ---------------------------------------------------------------------------
+// File I/O
+// ---------------------------------------------------------------------------
+export function settingsPathFor(scope, cwd, home = homedir()) {
+    return scope === "project"
+        ? join(cwd, ".claude", "settings.local.json")
+        : join(home, ".claude", "settings.json");
+}
+/** Read + parse a settings file. Missing → {}. Corrupt/symlink/non-object → throws. */
+export function readSettings(path) {
+    if (!existsSync(path))
+        return {};
+    if (lstatSync(path).isSymbolicLink()) {
+        throw new Error(`${path} is a symlink; refusing to rewrite it. Point yagni at the real file.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new Error(`${path} is not valid JSON. Fix or remove it, then re-run.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`${path} does not hold a JSON object. Fix or remove it, then re-run.`);
+    }
+    return parsed;
+}
+/** Atomic write (temp + rename), preserving an existing file's permissions. */
+export function writeSettings(path, settings) {
+    const existingMode = existsSync(path) ? lstatSync(path).mode & 0o777 : undefined;
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = join(dirname(path), `.${DISTRIBUTION.commandName}-connect-${process.pid}.tmp`);
+    try {
+        writeFileSync(tmp, `${JSON.stringify(settings, null, 2)}\n`);
+        renameSync(tmp, path);
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+    if (existingMode !== undefined)
+        chmodSync(path, existingMode);
+}
+export function parseConnectArgs(args) {
+    let target;
+    let project = false;
+    let off = false;
+    for (const a of args) {
+        if (a === "--project")
+            project = true;
+        else if (a === "--off")
+            off = true;
+        else if (!a.startsWith("-") && target === undefined)
+            target = a;
+    }
+    return { target, project, off };
+}
+export async function connectCommand(args, deps = {}) {
+    const stdout = deps.stdout ?? ((t) => process.stdout.write(t));
+    const stderr = deps.stderr ?? ((t) => process.stderr.write(t));
+    const { target, project, off } = parseConnectArgs(args);
+    if (target === "codex") {
+        if (project) {
+            stderr("`connect codex` has no --project scope: Codex reads one user-level config.toml.\n");
+            return 1;
+        }
+        const { connectCodexCommand } = await import("./connectCodex.js");
+        return connectCodexCommand({ off }, deps);
+    }
+    if (target !== "claude-code") {
+        stderr(target
+            ? `Unknown connect target "${target}". Supported: claude-code, codex.\n`
+            : `Usage: ${DISTRIBUTION.commandName} connect <claude-code|codex> [--project] [--off]\n`);
+        return 1;
+    }
+    const profile = await (deps.readProfile ?? readActiveProfile)();
+    const helperCommand = `${DISTRIBUTION.commandName} token`;
+    const path = settingsPathFor(project ? "project" : "user", deps.cwd ?? process.cwd(), deps.home);
+    let existing;
+    try {
+        existing = readSettings(path);
+    }
+    catch (err) {
+        stderr(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    if (off) {
+        const plan = planDisconnect(existing, DISTRIBUTION.commandName);
+        writeSettings(path, plan.settings);
+        stdout(plan.removed.length > 0
+            ? `✓ Claude Code disconnected from YAGNI.\n  ${path}\n  Removed: ${plan.removed.join(", ")}\n`
+            : `Nothing to disconnect in ${path}.\n`);
+        if (plan.keptForeignHelper) {
+            stdout(`  Kept apiKeyHelper (${plan.keptForeignHelper}) since it is not YAGNI's.\n`);
+        }
+        return 0;
+    }
+    const creds = credentialsFromProfile(profile);
+    if (!creds?.token) {
+        stderr(`Not logged in to environment "${profile.name}" (${profile.baseUrl}). Run \`${DISTRIBUTION.commandName} login\` first.\n`);
+        return 1;
+    }
+    const plan = planConnect(existing, { baseUrl: profile.baseUrl, helperCommand });
+    writeSettings(path, plan.settings);
+    stdout(`✓ Claude Code connected to YAGNI (${profile.name} → ${profile.baseUrl}).\n`);
+    stdout(`  ${path}\n`);
+    for (const change of plan.changes)
+        stdout(`    ${change}\n`);
+    for (const key of plan.replaced) {
+        stdout(`  Replaced an existing ${key}. \`connect claude-code --off\` removes YAGNI's value but cannot restore the old one.\n`);
+    }
+    const shellEnv = deps.env ?? process.env;
+    for (const key of ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"]) {
+        if (shellEnv[key]) {
+            stdout(`  ⚠ ${key} is set in your shell and OUTRANKS the settings written here. Unset it or Claude Code will keep using it.\n`);
+        }
+    }
+    stdout(`  Restart Claude Code to pick this up. Model picks map to YAGNI tiers (fable→peak, opus→advanced, sonnet→standard, haiku→efficient).\n`);
+    return 0;
+}
+//# sourceMappingURL=connectClaudeCode.js.map

package/dist/connectCodex.d.ts

@@ -0,0 +1,75 @@
+/**
+ * `yagni connect codex` — point Codex CLI at the YAGNI model proxy.
+ *
+ * Writes into `~/.codex/config.toml` (respecting CODEX_HOME):
+ *
+ *   model_provider = "yagni"               the active provider
+ *   model = "advanced"                     a YAGNI tier — Codex sends it
+ *                                          verbatim and the proxy's catalog
+ *                                          enforcement validates it
+ *   [model_providers.yagni]                base_url → `<base>/v1` (Codex
+ *                                          appends /responses — the proxy's
+ *                                          Responses-dialect route),
+ *                                          wire_api "responses" (the only
+ *                                          wire current Codex speaks),
+ *                                          x-yagni-caller: codex attribution,
+ *                                          and auth.command = `yagni token` —
+ *                                          Codex's command-backed bearer
+ *                                          token, so no secret is ever baked
+ *                                          into the config and rotation rides
+ *                                          the same refresh client as
+ *                                          everything else.
+ *
+ * TOML cannot be comment-preservingly round-tripped by a parser, so when the
+ * existing config carries comments we save a one-time `config.toml.yagni-backup`
+ * next to it before rewriting and say so — never silently eat a user's notes.
+ * Everything else follows the claude-code connector's contract: managed keys
+ * only, atomic write, symlink refusal, corrupt file is a loud error, `--off`
+ * removes exactly what we own.
+ */
+import { type Profile } from "./profiles.js";
+export declare const CODEX_PROVIDER_ID = "yagni";
+export declare const CODEX_DEFAULT_TIER = "advanced";
+type TomlTable = Record<string, unknown>;
+export declare function codexConfigPath(home?: string, env?: NodeJS.ProcessEnv): string;
+export interface CodexConnectPlan {
+    config: TomlTable;
+    changes: string[];
+    replaced: string[];
+}
+/** Pure: the config after connecting, plus what changed. */
+export declare function planConnectCodex(existing: TomlTable, input: {
+    baseUrl: string;
+    commandName: string;
+}): CodexConnectPlan;
+export interface CodexDisconnectPlan {
+    config: TomlTable;
+    removed: string[];
+}
+/** Pure: the config after `--off` — our provider and its selection out. */
+export declare function planDisconnectCodex(existing: TomlTable): CodexDisconnectPlan;
+export interface CodexConfigFile {
+    config: TomlTable;
+    /** The raw text, kept so a comment-carrying file can be backed up. */
+    raw: string | null;
+}
+/** Read + parse the Codex config. Missing → {}. Corrupt/symlink → throws. */
+export declare function readCodexConfig(path: string): CodexConfigFile;
+/**
+ * Atomic write; when the original text carried comments (which a parse →
+ * stringify round-trip cannot preserve), a `config.toml.yagni-backup` copy of
+ * the original is written first. Returns the backup path when one was made.
+ */
+export declare function writeCodexConfig(path: string, config: TomlTable, originalRaw: string | null): string | null;
+export interface ConnectCodexDeps {
+    readProfile?: () => Promise<Profile>;
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+    stdout?: (text: string) => void;
+    stderr?: (text: string) => void;
+}
+export declare function connectCodexCommand(opts: {
+    off: boolean;
+}, deps?: ConnectCodexDeps): Promise<number>;
+export {};
+//# sourceMappingURL=connectCodex.d.ts.map