johns-harness 2026.9.10 → 2026.9.12

package/README.md

@@ -45,6 +45,14 @@ The wizard sets up credentials, workspace, gateway, and channels. It asks for yo
 | Connect | `johnness channels add --channel telegram --token "<bot token>"` | Connects a chat channel. Discord, Slack, WhatsApp, Signal, iMessage, Matrix, and more are supported. |
 | Check | `johnness doctor` | Health checks and quick fixes for the gateway and channels. |
 
+<!-- JOHNNESS_PATCH_DEVICE_LOGIN_60B -->
+### Signing in from chat
+Owners and allowlisted senders can send `/login` (or `/relogin`) in Telegram, Discord, or another chat channel.
+Open the link, sign in to ChatGPT if asked, then enter the device code on the same page and tap Approve. In Telegram, tap the code to copy it.
+Enable "Device code authorization for Codex" once in chatgpt.com > Settings > Security; if it was disabled, send `/login` again for a fresh code.
+For headless installs, run `johnness models auth login --device`; no browser or localhost callback needed.
+Expired ChatGPT credentials trigger an owner notice with the `/login` recovery command.
+
 ### From source
 
 ```bash

package/dist/codex-oauth-device.js

@@ -0,0 +1,229 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+// Native OpenAI device flow, verified against Codex 0.154.0 device_code_auth.rs.
+// OpenAI uses deviceauth + an authorization-code/PKCE exchange, NOT RFC 8628.
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { canonicalPath, acquireOwnedLock, profileLockPath, readAuthStore, transactAuthStore } from './auth-store-transactions.js';
+import { readManagedCodexStore, mutateAuthProfile, resolveCodexProfileOwner } from './codex-oauth-owner.js';
+import { validateRefreshedCredential } from './codex-oauth-token.js';
+const PROVIDER = 'openai-codex';
+const ISSUER = 'https://auth.openai.com';
+const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const TTL = 15 * 60 * 1000;
+const active = globalThis[Symbol.for('johnness.codexDeviceLogin.v60')] ??= new Map();
+export class DeviceLoginError extends Error {
+  constructor(reason, status) { super(`Codex device login: ${reason}${status ? ` (HTTP ${status})` : ''}`); this.reason = reason; }
+}
+const fail = (reason, status) => { throw new DeviceLoginError(reason, status); };
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+function claims(token) { try { return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()); } catch { return {}; } }
+export function redactLoginEmail(email) {
+  if (typeof email !== 'string' || !email.includes('@')) return 'ChatGPT account';
+  const [local, domain] = email.split('@');
+  return `${local.slice(0, 1)}***@${domain.slice(0, 1)}***`;
+}
+export const DEVICE_LOGIN_SECURITY_FIX = "Go to chatgpt.com > Settings > Security, turn on 'Device code authorization for Codex'";
+export function formatDeviceLoginInstructions(login, { email, chat = false } = {}) {
+  const account = typeof email === 'string' && email.includes('@') ? redactLoginEmail(email) : 'the same account as before';
+  const code = chat ? `\`${login.userCode}\`` : login.userCode;
+  const retry = chat ? 'send /login again' : 'run johnness models auth login --device again';
+  const minutes = Math.max(1, Math.ceil((login.expiresAt - Date.now()) / 60000));
+  return `Let's sign you back into ChatGPT.
+1. Open ${login.verificationUri} on your phone or computer.
+2. Sign in with your ChatGPT account (${account}) if asked.
+3. On the same page, enter this code${chat ? ' (tap the code to copy it)' : ''}:
+${code}
+4. Tap Approve.
+Code is good for ${minutes} minute${minutes === 1 ? '' : 's'}. If you see 'Device code authorization is disabled', ${DEVICE_LOGIN_SECURITY_FIX.charAt(0).toLowerCase() + DEVICE_LOGIN_SECURITY_FIX.slice(1)}, then ${retry} for a fresh code.`;
+}
+function hasDeviceLoginSecurityFix(error) {
+  return ['device_login_unavailable', 'device_code_authorization_disabled'].includes(error?.reason);
+}
+export async function startDeviceLogin({ provider = PROVIDER, fetch: fetchImpl = globalThis.fetch, now = Date.now, sleep: pause = sleep, signal } = {}) {
+  if (provider !== PROVIDER) fail('unsupported_provider');
+  async function request(url, body, form = false, remaining = 30000) {
+    if (signal?.aborted) fail('cancelled');
+    const timeout = AbortSignal.timeout(Math.max(1, Math.min(30000, remaining)));
+    let response;
+    try { response = await fetchImpl(url, { method: 'POST', headers: { 'Content-Type': form ? 'application/x-www-form-urlencoded' : 'application/json' }, body: form ? new URLSearchParams(body) : JSON.stringify(body), signal: signal ? AbortSignal.any([signal, timeout]) : timeout }); }
+    catch { fail(signal?.aborted ? 'cancelled' : 'network_error'); }
+    let data; try { data = await response.json(); } catch { data = {}; }
+    return { response, data };
+  }
+  const started = now();
+  const { response, data } = await request(`${ISSUER}/api/accounts/deviceauth/usercode`, { client_id: CLIENT_ID });
+  if (!response.ok) {
+    // Only classify the initial request, never reinterpret polling's bare 403/404.
+    const messages = [data?.message, data?.error_description, data?.error?.message, data?.error];
+    if (response.status === 403 && messages.some(message => typeof message === 'string' && /device code authorization is disabled|security settings do not allow device code authorization for codex/i.test(message))) fail('device_code_authorization_disabled', response.status);
+    fail(response.status === 404 ? 'device_login_unavailable' : 'request_failed', response.status);
+  }
+  const userCode = data.user_code ?? data.usercode;
+  if (typeof data.device_auth_id !== 'string' || !data.device_auth_id || typeof userCode !== 'string' || !/^[A-Za-z0-9-]{4,32}$/.test(userCode)) fail('invalid_response');
+  const expiresAt = started + TTL;
+  let interval = Math.max(1000, Math.min(60000, (Number(data.interval) || 5) * 1000));
+  let promise;
+  async function pollLoop() {
+    while (now() < expiresAt) {
+      const { response, data: result } = await request(`${ISSUER}/api/accounts/deviceauth/token`, { device_auth_id: data.device_auth_id, user_code: userCode }, false, expiresAt - now());
+      if (now() >= expiresAt) fail('expired');
+      const code = typeof result.error === 'string' ? result.error : result.error?.code;
+      if (['access_denied', 'authorization_declined', 'denied'].includes(code)) fail('denied');
+      if (['expired_token', 'expired', 'device_code_expired'].includes(code)) fail('expired');
+      if (response.ok) {
+        if (typeof result.authorization_code !== 'string' || !result.authorization_code || typeof result.code_verifier !== 'string' || !result.code_verifier) fail('invalid_response');
+        const exchanged = await request(`${ISSUER}/oauth/token`, { grant_type: 'authorization_code', client_id: CLIENT_ID, redirect_uri: `${ISSUER}/deviceauth/callback`, code: result.authorization_code, code_verifier: result.code_verifier }, true, expiresAt - now());
+        if (!exchanged.response.ok) fail('exchange_failed', exchanged.response.status);
+        const tokens = exchanged.data, accessClaims = claims(tokens.access_token), idClaims = claims(tokens.id_token);
+        const accountId = accessClaims['https://api.openai.com/auth']?.chatgpt_account_id ?? idClaims['https://api.openai.com/auth']?.chatgpt_account_id;
+        const expires = Number.isFinite(tokens.expires_in) && tokens.expires_in > 0 ? Date.now() + tokens.expires_in * 1000 : accessClaims.exp * 1000;
+        const email = idClaims.email ?? accessClaims['https://api.openai.com/profile']?.email;
+        try { return validateRefreshedCredential({ type: 'oauth', provider: PROVIDER, access: tokens.access_token, refresh: tokens.refresh_token, expires, accountId, ...(typeof email === 'string' ? { email } : {}) }); }
+        catch { fail('invalid_response'); }
+      }
+      // Codex treats bare 403 and 404 as pending, not denial.
+      if (response.status === 429) {
+        const retry = Number(response.headers?.get('retry-after'));
+        interval = Math.max(interval, Number.isFinite(retry) && retry > 0 ? retry * 1000 : 5000);
+      } else if (code === 'slow_down') interval += 5000;
+      else if (![403, 404].includes(response.status) && code !== 'authorization_pending') fail('poll_failed', response.status);
+      await pause(Math.min(interval, Math.max(0, expiresAt - now())));
+    }
+    fail('expired');
+  }
+  return { userCode, verificationUri: `${ISSUER}/codex/device`, expiresAt, poll() { return promise ??= pollLoop(); } };
+}
+function ownerContext(params = {}) {
+  const stateDir = canonicalPath(params.stateDir || process.env.JOHNNESS_STATE_DIR || path.join(os.homedir(), '.johnness'));
+  const mainAgentDir = canonicalPath(params.mainAgentDir || process.env.JOHNNESS_AGENT_DIR || process.env.PI_CODING_AGENT_DIR || path.join(stateDir, 'agents/main/agent'));
+  return { ...params, stateDir, mainAgentDir, agentDir: canonicalPath(params.agentDir || mainAgentDir) };
+}
+export function selectDeviceLoginProfile(params = {}) {
+  const ctx = ownerContext(params), store = readManagedCodexStore(ctx);
+  const ids = Object.keys(store.profiles).filter(id => store.profiles[id]?.provider === PROVIDER && store.profiles[id]?.type === 'oauth');
+  const preferred = [params.profileId, store.lastGood?.[PROVIDER], ...(store.order?.[PROVIDER] ?? []), `${PROVIDER}:default`, ...ids].find(id => ids.includes(id));
+  const owner = preferred ? resolveCodexProfileOwner({ ...ctx, profileId: preferred }) : ctx;
+  return { ...owner, profileId: preferred, previous: preferred ? store.profiles[preferred] : undefined };
+}
+export async function handoffDeviceCredential(params, credential) {
+  const selected = selectDeviceLoginProfile(params);
+  const profileId = selected.profileId ?? `${PROVIDER}:${credential.email?.trim() || 'default'}`;
+  let next;
+  try { next = validateRefreshedCredential(credential, selected.previous, { profileId }); }
+  catch (error) {
+    if (error.reason !== 'account_mismatch') fail('invalid_response');
+    next = validateRefreshedCredential(credential, undefined, { profileId });
+    (params.log ?? console.info)('[codex-device-login] Owner selected a different ChatGPT account; replacing the existing profile (identities redacted).');
+  }
+  // A new login is a clean credential, not a merge of old failure/token metadata.
+  const clean = { type: 'oauth', provider: PROVIDER, access: next.access, refresh: next.refresh, expires: next.expires, accountId: next.accountId, ...(credential.email ? { email: credential.email } : {}) };
+  await mutateAuthProfile({ ...selected, profileId, credential: clean, expected: selected.previous, clearLoginFailures: true });
+  return { profileId, credential: clean };
+}
+export async function getOrStartDeviceLogin(params = {}) {
+  const selected = selectDeviceLoginProfile(params);
+  const slot = selected.profileId ?? PROVIDER;
+  const file = path.join(selected.agentDir, 'auth-profiles.json');
+  const key = `${file}\0${slot}`;
+  if (active.has(key)) return active.get(key);
+  // The profile owner handles token writes; a separate device lock spans the
+  // human authorization window, including CLI/gateway and bundle boundaries.
+  const pending = (async () => {
+    const lock = profileLockPath(selected.stateDir, 'openai-codex-device', `${file}:${slot}`);
+    let release;
+    try { release = await acquireOwnedLock(lock, { waitMs: 1, pollMs: 1 }); }
+    catch (error) {
+      if (error.reason !== 'lock_contention') throw error;
+      let record;
+      for (let attempt = 0; attempt < 150; attempt++) {
+        record = readAuthStore(file).codexDeviceLogins?.[slot];
+        if (record?.status === 'pending' && record.expiresAt > Date.now()) break;
+        await sleep(200);
+      }
+      if (record?.status !== 'pending' || record.expiresAt <= Date.now()) fail('login_already_pending');
+      let completion;
+      return { userCode: record.userCode, verificationUri: record.verificationUri, expiresAt: record.expiresAt, complete() {
+        return completion ??= (async () => {
+          while (Date.now() < record.expiresAt) {
+            const store = readAuthStore(file), current = store.codexDeviceLogins?.[slot];
+            if (current?.id !== record.id) fail('cancelled');
+            if (current.status === 'success') return { profileId: current.profileId, credential: store.profiles[current.profileId] };
+            if (current.status === 'failed') fail(current.reason === 'expired' ? 'expired' : 'denied');
+            await sleep(1000);
+          }
+          fail('expired');
+        })().finally(() => { if (active.get(key) === pending) active.delete(key); });
+      } };
+    }
+    try {
+      const login = await (params.start ?? startDeviceLogin)({ ...params, provider: PROVIDER });
+      const id = randomUUID();
+      await transactAuthStore(file, store => {
+        store.codexDeviceLogins ??= {};
+        // Only the public prompt is stored. The device-auth id and PKCE material
+        // remain in the issuing process, and tokens only go through the owner.
+        store.codexDeviceLogins[slot] = { id, userCode: login.userCode, verificationUri: login.verificationUri, expiresAt: login.expiresAt, status: 'pending' };
+      });
+      let completion;
+      return { ...login, complete() {
+        return completion ??= (async () => {
+          try {
+            const result = await handoffDeviceCredential(selected, await login.poll());
+            await transactAuthStore(file, store => {
+              store.codexDeviceLogins[slot] = { id, status: 'success', profileId: result.profileId };
+            });
+            return result;
+          } catch (error) {
+            await transactAuthStore(file, store => { store.codexDeviceLogins[slot] = { id, status: 'failed', reason: error.reason === 'expired' ? 'expired' : 'denied' }; });
+            throw error;
+          } finally { await release(); if (active.get(key) === pending) active.delete(key); }
+        })();
+      } };
+    } catch (error) { await release(); throw error; }
+  })();
+  active.set(key, pending);
+  pending.catch(() => { if (active.get(key) === pending) active.delete(key); });
+  return pending;
+}
+export async function runDeviceLoginCli(opts, runtime, params = {}) {
+  if (opts.provider && opts.provider !== PROVIDER) fail('unsupported_provider');
+  try {
+    const login = await getOrStartDeviceLogin(params);
+    runtime.log(formatDeviceLoginInstructions(login, { email: selectDeviceLoginProfile(params).previous?.email }));
+    const result = await login.complete();
+    runtime.log(`Signed in as ${redactLoginEmail(result.credential.email)}`);
+    return result;
+  } catch (error) {
+    if (hasDeviceLoginSecurityFix(error)) runtime.log(`${DEVICE_LOGIN_SECURITY_FIX}, then run johnness models auth login --device again for a fresh code.`);
+    throw error;
+  }
+}
+export async function handleDeviceLoginCommand(params, allowTextCommands, { routeReply, callGateway, log = console.info, ...options } = {}) {
+  if (!allowTextCommands || !/^\/(login|relogin)(?:\s|$)/i.test(params.command.commandBodyNormalized)) return null;
+  const reply = text => ({ shouldContinue: false, reply: { text } });
+  // Same authoritative sender check as config-changing commands. No model call needed.
+  if (!params.command.isAuthorizedSender) return reply('Only the owner can do that.');
+  try {
+    const login = await getOrStartDeviceLogin({ ...options, agentDir: params.agentDir, log });
+    const route = { channel: params.ctx.OriginatingChannel || params.command.channel, to: params.ctx.OriginatingTo || params.command.from || params.command.to, sessionKey: params.sessionKey, accountId: params.ctx.AccountId, threadId: params.ctx.MessageThreadId, cfg: params.cfg };
+    const routeKey = JSON.stringify([route.channel, route.to, route.accountId, route.threadId]);
+    login.notifiedRoutes ??= new Set();
+    if (!login.notifiedRoutes.has(routeKey)) {
+      login.notifiedRoutes.add(routeKey);
+      // Never keep the command lane occupied for the 15-minute authorization window.
+      void login.complete().then(() => 'Signed in. I\'m back.', error => error.reason === 'expired' ? "That code expired (they last 15 minutes). Send /login and I'll give you a fresh one." : error.reason === 'denied' ? 'That sign-in was declined. Send /login to try again.' : 'Login failed. Send /login to try again.').then(async text => {
+        const result = ["webchat", "internal"].includes(route.channel) && callGateway
+          ? await callGateway({ method: "chat.inject", params: { sessionKey: route.sessionKey, message: text } })
+          : await routeReply({ ...route, payload: { text } });
+        if (result?.ok === false) throw new Error('delivery_failed');
+        log('[codex-device-login] completion delivered');
+      }).catch(() => log('[codex-device-login] completion delivery failed; send /login again.'));
+    }
+    log('[codex-device-login] /login recognized; code issued (code and identity redacted)');
+    return reply(formatDeviceLoginInstructions(login, { email: selectDeviceLoginProfile({ ...options, agentDir: params.agentDir }).previous?.email, chat: true }));
+  } catch (error) {
+    return reply(hasDeviceLoginSecurityFix(error) ? `${DEVICE_LOGIN_SECURITY_FIX}, then send /login again for a fresh code.` : 'Could not start ChatGPT login. Send /login to try again.');
+  }
+}

package/dist/codex-oauth-nudge.js

@@ -0,0 +1,61 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import fs from 'node:fs';
+import path from 'node:path';
+import { transactAuthStore, sameCredential } from './auth-store-transactions.js';
+export const LOGIN_NUDGE_TEXT = "My ChatGPT login expired. Send /login and I'll walk you through signing back in (takes about a minute).";
+const DEAD = new Set(['refresh_token_reused', 'invalid_grant', 'refresh_token_expired', 'refresh_token_invalidated', 'expired_no_refresh']);
+export function resolveLoginOwnerRoute(cfg = {}) {
+  const owners = cfg.commands?.ownerAllowFrom ?? [];
+  // Primary channel: first enabled configured transport; choose only a concrete owner,
+  // never a wildcard or group target. Account-specific allowFrom wins over base config.
+  for (const [channel, base] of Object.entries(cfg.channels ?? {})) {
+    if (!base || base.enabled === false || !['telegram', 'discord', 'slack', 'signal', 'whatsapp', 'imessage', 'mattermost', 'msteams', 'googlechat'].includes(channel)) continue;
+    const accounts = base.accounts ? Object.entries(base.accounts) : [[undefined, base]];
+    for (const [accountId, account] of accounts) {
+      if (account.enabled === false) continue;
+      const scoped = owners.filter(owner => typeof owner === 'string' && owner.startsWith(`${channel}:`)).map(owner => owner.slice(channel.length + 1));
+      const unscoped = owners.filter(owner => typeof owner === 'string' && !owner.includes(':'));
+      const candidates = scoped.length ? scoped : unscoped.length ? unscoped : account.allowFrom ?? account.dm?.allowFrom ?? base.allowFrom ?? base.dm?.allowFrom ?? [];
+      const to = candidates.map(String).map(id => id.replace(new RegExp(`^${channel}:`), '')).find(id => id && id !== '*' && !/^(?:group|channel|chat):/.test(id) && (channel !== 'telegram' || /^\d+$/.test(id)));
+      if (to) return { channel, to: channel === 'discord' && /^\d+$/.test(to) ? `user:${to}` : to, accountId };
+    }
+  }
+  return null;
+}
+export async function notifyDeadCodexChain(params = {}) {
+  if (!DEAD.has(params.reason)) return false;
+  const now = params.now?.() ?? Date.now();
+  // Persist reservation before sending: concurrent bundles/processes and restarts
+  // cannot produce a notification storm. Never mutate a credential in this path.
+  const result = await transactAuthStore(params.ownerPath, store => {
+    if (params.attempted && !sameCredential(store.profiles[params.profileId], params.attempted)) return false;
+    const prior = store.codexLoginNudges?.[params.profileId]?.at;
+    if (Number.isFinite(prior) && now - prior < 6 * 60 * 60 * 1000) return false;
+    store.codexLoginNudges ??= {};
+    store.codexLoginNudges[params.profileId] = { at: now };
+    return true;
+  }, params);
+  if (!result.result) return false;
+  const log = params.nudgeLog ?? console.info;
+  try {
+    let cfg = params.cfg;
+    if (!cfg) {
+      // Do not resolve some other installation's config when inspecting a fixture.
+      const configPath = process.env.JOHNNESS_CONFIG_PATH || path.join(params.stateDir, 'johnness.json');
+      if (fs.existsSync(configPath) && path.resolve(path.dirname(configPath)) === path.resolve(params.stateDir)) {
+        const { H: loadConfig } = await import('./auth-profiles-5CHn7vq1.js');
+        cfg = loadConfig();
+      }
+    }
+    const route = resolveLoginOwnerRoute(cfg);
+    if (!route) { log(`[codex-device-login] ${LOGIN_NUDGE_TEXT} (No owner route resolved.)`); return true; }
+    if (params.send) await params.send({ ...route, text: LOGIN_NUDGE_TEXT, cfg });
+    else {
+      const { deliverOutboundPayloads } = await import('./deliver-runtime-JZdz0coW.js');
+      await deliverOutboundPayloads({ ...route, cfg, payloads: [{ text: LOGIN_NUDGE_TEXT }] });
+    }
+    log('[codex-device-login] login-expired owner notice delivered');
+  } catch { log('[codex-device-login] Login-expired notice delivery failed. Send /login to fix it.'); }
+  return true;
+}

package/dist/codex-oauth-owner.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { notifyDeadCodexChain } from './codex-oauth-nudge.js';
 // JOHNNESS_PATCH_CODEX_OAUTH_OWNERSHIP_58
 import fs from 'node:fs';
 import os from 'node:os';
@@ -31,6 +34,10 @@ function resolveOwner(ctx,profileId) {
   if(credentialAccount(a) && credentialAccount(b))return {file:ctx.localPath,credential:b,main,local};
   throw new AuthOwnershipError('owner_conflict',{profileId});
 }
+export function resolveCodexProfileOwner(params={}) {
+  const ctx=context(params),owner=resolveOwner(ctx,params.profileId);
+  return {...ctx,agentDir:path.dirname(owner.file)};
+}
 function storeFiles(ctx) {
   const files=new Set([ctx.mainPath,ctx.localPath]);
   try {for(const ent of fs.readdirSync(path.join(ctx.stateDir,'agents'),{withFileTypes:true})){if(ent.isDirectory())files.add(canonicalPath(path.join(ctx.stateDir,'agents',ent.name,'agent/auth-profiles.json')));}}
@@ -62,6 +69,10 @@ function effective(ctx,store) {
     if(isManagedCodexCredential(owner.credential)) {
       // Read-only observation must not discard a positively bound newer local chain.
       const credential=owner.duplicate && owner.localCredential.expires>owner.credential.expires?owner.localCredential:owner.credential;
+      if(!sameCredential(result.profiles[id],credential) && result.usageStats){
+        const usage=readAuthStore(owner.file).usageStats?.[id];
+        if(usage)result.usageStats[id]=clone(usage);else delete result.usageStats[id];
+      }
       result.profiles[id]=clone(credential);
       const failure=readAuthStore(owner.file).codexAuthFailures?.[id];
       if(failure){result.codexAuthFailures??={};result.codexAuthFailures[id]=clone(failure);}
@@ -124,6 +135,7 @@ async function unavailable(ctx,profileId,attempted,reason) {
     if(store.lastGood)for(const provider of Object.keys(store.lastGood))if(store.lastGood[provider]===profileId)delete store.lastGood[provider];
   },ctx);
   publish(ctx,profileId);
+  void notifyDeadCodexChain({...ctx,profileId,attempted,reason}).catch(()=>{});
 }
 export async function refreshManagedCodexProfile(params={}) {
   const ctx=context(params),profileId=params.profileId;registerSnapshot(ctx,params.store);
@@ -138,8 +150,15 @@ export async function refreshManagedCodexProfile(params={}) {
       const store=readAuthStore(ctx.ownerPath),current=store.profiles[profileId];
       if(!compatible(attempted,current))throw new AuthOwnershipError('credential_changed',{profileId});
       attempted=clone(current);
-      if(store.codexAuthFailures?.[profileId])throw new AuthOwnershipError('auth_unavailable',{profileId});
+      if(store.codexAuthFailures?.[profileId]){
+        void notifyDeadCodexChain({...ctx,profileId,attempted,reason:store.codexAuthFailures[profileId].reason}).catch(()=>{});
+        throw new AuthOwnershipError('auth_unavailable',{profileId});
+      }
       if(usable(attempted,ctx)){publish(ctx,profileId);log('adopted');return {apiKey:attempted.access,newCredentials:attempted};}
+      if(!attempted.refresh){
+        await unavailable(ctx,profileId,attempted,'expired_no_refresh');
+        throw new AuthOwnershipError('auth_unavailable',{profileId});
+      }
       let next;
       try {
         const result=ctx.refresh?await withRefreshDeadline(signal=>ctx.refresh(clone(attempted),{signal,profileId}),ctx):await refreshCodexToken({...ctx,credential:attempted,profileId});
@@ -220,6 +239,10 @@ export async function mutateAuthProfile(params={}) {
     const {store}=await transactAuthStore(owner.file,fresh=>{
       if(Object.hasOwn(params,'expected')&&!sameCredential(fresh.profiles[profileId],params.expected))throw new AuthOwnershipError('credential_changed',{profileId});
       if(params.credential===null)delete fresh.profiles[profileId];else fresh.profiles[profileId]=clone(params.credential);
+      if(params.clearLoginFailures){
+        if(fresh.usageStats)delete fresh.usageStats[profileId];
+        if(fresh.lastGood?.[PROVIDER]===profileId)delete fresh.lastGood[PROVIDER];
+      }
       if(fresh.codexAuthFailures)delete fresh.codexAuthFailures[profileId];
     },ctx);
     publish(ctx,profileId);return store;

package/dist/commands-registry-C78-tPS3.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { l as escapeRegExp } from "./utils-DC4zYvW0.js";
 import { i as listThinkingLevels } from "./thinking-BYwvlJ3S.js";
 import { Gi as DEFAULT_PROVIDER, Wi as DEFAULT_MODEL, h as resolveConfiguredModelRef } from "./model-selection-L7RMwsG-.js";
@@ -179,6 +181,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/commands-registry-D0Jkz-Sn.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-Bj0Xl6pn.js";
 import { Fr as DEFAULT_MODEL, Ir as DEFAULT_PROVIDER, l as resolveConfiguredModelRef, nn as getActivePluginRegistry } from "./model-selection-BGlGpPgM.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-CAzdgmNV.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/commands-registry-DJWLO-6B.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-BW8uLq6f.js";
 import { Mr as DEFAULT_PROVIDER, jr as DEFAULT_MODEL, tn as getActivePluginRegistry, u as resolveConfiguredModelRef } from "./model-selection-BU6wl1le.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-B5B36ffe.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/commands-registry-l51VuG0m.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { Bi as DEFAULT_PROVIDER, Or as resolveConfiguredModelRef, zi as DEFAULT_MODEL } from "./auth-profiles-5CHn7vq1.js";
 import { c as escapeRegExp } from "./utils-C5WN6czr.js";
 import { u as getActivePluginRegistry } from "./registry-DoLLbW4m.js";
@@ -179,6 +181,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/compact-B247y5Qt.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "./codex-oauth-device.js";
 import { E as normalizeLogLevel, a as logVerbose, c as shouldLogVerbose, k as resolvePreferredJohnnessTmpDir, m as getChildLogger, p as theme, t as danger, u as warn } from "./globals-Bv4ZcVWM.js";
 import { g as resolveStateDir, r as STATE_DIR, u as resolveGatewayPort, y as resolveRequiredHomeDir } from "./paths-BfR2LXbA.js";
 import { c as sanitizeForLog, d as createNonExitingRuntime, f as defaultRuntime, t as createSubsystemLogger } from "./subsystem-Cf9yS0UI.js";
@@ -40974,6 +40977,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/models-CxHdes0w.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { runDeviceLoginCli } from "./codex-oauth-device.js";
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
 import { d as colorize, f as isRich$1, p as theme } from "./globals-Bv4ZcVWM.js";
 import { t as CONFIG_PATH } from "./paths-BfR2LXbA.js";
@@ -336,6 +339,10 @@ async function runBuiltInOpenAICodexLogin(params) {
 	else params.runtime.log(`Default model available: ${OPENAI_CODEX_DEFAULT_MODEL} (use --set-default to apply)`);
 }
 async function modelsAuthLoginCommand(opts, runtime) {
+	if (opts.device) {
+		const config = await loadValidConfigOrThrow();
+		return await runDeviceLoginCli(opts, runtime, { agentDir: resolveAgentDir(config, resolveDefaultAgentId(config)) });
+	}
 	if (!process.stdin.isTTY) throw new Error("models auth login requires an interactive TTY.");
 	const config = await loadValidConfigOrThrow();
 	const defaultAgentId = resolveDefaultAgentId(config);

package/dist/models-cli-DZnoM8Ln.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { runDeviceLoginCli } from "./codex-oauth-device.js";
 import { t as CONFIG_PATH } from "./paths-BJV7vkaX.js";
 import { d as colorize, f as isRich$1, p as theme } from "./globals-BM8hKFm0.js";
 import { S as shortenHomePath } from "./utils-DC4zYvW0.js";
@@ -437,6 +440,10 @@ async function runBuiltInOpenAICodexLogin(params) {
 	else params.runtime.log(`Default model available: ${OPENAI_CODEX_DEFAULT_MODEL} (use --set-default to apply)`);
 }
 async function modelsAuthLoginCommand(opts, runtime) {
+	if (opts.device) {
+		const config = await loadValidConfigOrThrow();
+		return await runDeviceLoginCli(opts, runtime, { agentDir: resolveAgentDir(config, resolveDefaultAgentId(config)) });
+	}
 	if (!process.stdin.isTTY) throw new Error("models auth login requires an interactive TTY.");
 	const config = await loadValidConfigOrThrow();
 	const defaultAgentId = resolveDefaultAgentId(config);
@@ -2586,9 +2593,10 @@ function registerModelsCli(program) {
 			await modelsAuthAddCommand({}, defaultRuntime);
 		});
 	});
-	auth.command("login").description("Run a provider plugin auth flow (OAuth/API key)").option("--provider <id>", "Provider id registered by a plugin").option("--method <id>", "Provider auth method id").option("--set-default", "Apply the provider's default model recommendation", false).action(async (opts) => {
+	auth.command("login").description("Run a provider plugin auth flow (OAuth/API key)").option("--device", "Sign in to ChatGPT using a headless device code", false).option("--provider <id>", "Provider id registered by a plugin").option("--method <id>", "Provider auth method id").option("--set-default", "Apply the provider's default model recommendation", false).action(async (opts) => {
 		await runModelsCommand(async () => {
 			await modelsAuthLoginCommand({
+				device: Boolean(opts.device),
 				provider: opts.provider,
 				method: opts.method,
 				setDefault: Boolean(opts.setDefault)

package/dist/models-cli-U89juIRK.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { p as theme } from "./globals-Bv4ZcVWM.js";
 import "./paths-BfR2LXbA.js";
 import { f as defaultRuntime } from "./subsystem-Cf9yS0UI.js";
@@ -246,9 +248,10 @@ function registerModelsCli(program) {
 			await modelsAuthAddCommand({}, defaultRuntime);
 		});
 	});
-	auth.command("login").description("Run a provider plugin auth flow (OAuth/API key)").option("--provider <id>", "Provider id registered by a plugin").option("--method <id>", "Provider auth method id").option("--set-default", "Apply the provider's default model recommendation", false).action(async (opts) => {
+	auth.command("login").description("Run a provider plugin auth flow (OAuth/API key)").option("--device", "Sign in to ChatGPT using a headless device code", false).option("--provider <id>", "Provider id registered by a plugin").option("--method <id>", "Provider auth method id").option("--set-default", "Apply the provider's default model recommendation", false).action(async (opts) => {
 		await runModelsCommand(async () => {
 			await modelsAuthLoginCommand({
+				device: Boolean(opts.device),
 				provider: opts.provider,
 				method: opts.method,
 				setDefault: Boolean(opts.setDefault)

package/dist/pi-embedded-C6ITuRXf.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "./codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { _ as normalizeStringEntries, a as resolveAgentDir, b as resolveAgentModelPrimaryValue, c as resolveAgentWorkspaceDir, d as resolveRunModelFallbacksOverride, f as resolveSessionAgentId, g as normalizeHyphenSlug, h as normalizeAtHashSlug, i as resolveAgentConfig, l as resolveDefaultAgentId, n as hasConfiguredModelFallbacks, p as resolveSessionAgentIds, r as listAgentIds, s as resolveAgentSkillsFilter, t as runTasksWithConcurrency, u as resolveEffectiveModelFallbacks, v as normalizeStringEntriesLower, x as toAgentModelListLike, y as resolveAgentModelFallbackValues } from "./run-with-concurrency-Cuc1THN9.js";
 import { a as resolveGatewayPort, c as resolveStateDir, d as resolveRequiredHomeDir, l as expandHomePrefix, n as STATE_DIR, r as resolveConfigPath } from "./paths-hfkBoC7i.js";
@@ -33951,6 +33954,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/pi-embedded-DoQsYfIY.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "./codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { $ as isValidAgentId, C as filterBootstrapFilesForSession, D as runCommandWithTimeout, G as normalizeStringEntries, J as DEFAULT_MAIN_KEY, K as normalizeStringEntriesLower, M as openBoundaryFileSync, O as runExec, Q as classifySessionKeyShape, S as ensureAgentWorkspace, T as resolveJohnnessPackageRoot, U as normalizeAtHashSlug, V as normalizeWindowsPathForComparison, W as normalizeHyphenSlug, X as buildAgentPeerSessionKey, Y as buildAgentMainSessionKey, _t as resolveAgentModelFallbackValues, a as resolveAgentDir, at as scopedHeartbeatWakeOptions, c as resolveAgentWorkspaceDir, ct as normalizeOptionalAccountId, d as resolveRunModelFallbacksOverride, dt as getSubagentDepth, et as normalizeAgentId, f as resolveSessionAgentId, ft as isAcpSessionKey, gt as resolveThreadParentSessionKey, h as DEFAULT_AGENT_WORKSPACE_DIR, ht as parseAgentSessionKey, i as resolveAgentConfig, it as sanitizeAgentId, j as openBoundaryFile, k as spawnWithFallback, l as resolveDefaultAgentId, lt as isBlockedObjectKey, mt as isSubagentSessionKey, n as hasConfiguredModelFallbacks, nt as resolveAgentIdFromSessionKey, ot as DEFAULT_ACCOUNT_ID, p as resolveSessionAgentIds, pt as isCronSessionKey, q as DEFAULT_AGENT_ID, r as listAgentIds, rt as resolveThreadSessionKeys, s as resolveAgentSkillsFilter, st as normalizeAccountId$2, t as runTasksWithConcurrency, tt as normalizeMainKey, u as resolveEffectiveModelFallbacks, ut as deriveSessionChatType, v as DEFAULT_IDENTITY_FILENAME, vt as resolveAgentModelPrimaryValue, w as loadWorkspaceBootstrapFiles, yt as toAgentModelListLike } from "./run-with-concurrency-BXSUl5Nj.js";
 import { a as resolveGatewayPort, c as resolveStateDir, d as resolveRequiredHomeDir, l as expandHomePrefix, n as STATE_DIR, r as resolveConfigPath } from "./paths-GBpjI3o0.js";
@@ -33947,6 +33950,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/plugin-sdk/commands-registry-B4ZP4Y1B.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { It as getActivePluginRegistry, Nr as DEFAULT_MODEL, Pr as DEFAULT_PROVIDER, or as resolveConfiguredModelRef } from "./model-auth-Ciehz0x5.js";
 import { D as isPlainObject, u as escapeRegExp } from "./logger-Cxu-Klb_.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-WQ4Zq8Nl.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/commands-registry-B8Og-fWU.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-3VRkTvTU.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-B-rIrY_n.js";
 import { Dn as resolveConfiguredModelRef, Xn as DEFAULT_PROVIDER, Yn as DEFAULT_MODEL, mr as getActivePluginRegistry } from "./model-auth-CX9cPHdC.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/commands-registry-BoAXxFpH.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { Ir as DEFAULT_MODEL, Lr as DEFAULT_PROVIDER, Rt as getActivePluginRegistry, cr as resolveConfiguredModelRef } from "./model-auth-DVyo6JSX.js";
 import { D as isPlainObject, u as escapeRegExp } from "./logger-By5InJr-.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-WXqkGljb.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/commands-registry-Ca1h6XvV.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { C as isPlainObject, o as escapeRegExp } from "./utils-B0IyLNx9.js";
 import { r as normalizeChannelId } from "./plugins-BQilE2mk.js";
 import { Ar as DEFAULT_MODEL, Mt as getActivePluginRegistry, jr as DEFAULT_PROVIDER, nr as resolveConfiguredModelRef } from "./model-auth-kiHYHGrs.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/commands-registry-Do-Y2EhN.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { Dt as getActivePluginRegistry, Rn as resolveConfiguredModelRef, ii as DEFAULT_PROVIDER, ri as DEFAULT_MODEL } from "./config-4Fgm-yEH.js";
 import { F as isPlainObject, v as escapeRegExp } from "./logger-U3s76KST.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-pTdxk2dr.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/commands-registry-DpRs-E_M.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { Kt as resolveConfiguredModelRef, Xn as DEFAULT_MODEL, Zn as DEFAULT_PROVIDER, yr as getActivePluginRegistry } from "./config-Di-lyCdh.js";
 import { D as isPlainObject, u as escapeRegExp } from "./logger-Blr-bUxJ.js";
 import { r as normalizeChannelId } from "./plugins-Bv1h7dAV.js";
@@ -216,6 +218,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/dispatch-BP0viZiL.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "../codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { $ as buildAgentPeerSessionKey, C as filterBootstrapFilesForSession, D as runCommandWithTimeout, G as normalizeStringEntries, J as resolveAgentModelPrimaryValue, K as normalizeStringEntriesLower, M as openBoundaryFileSync, O as runExec, Q as buildAgentMainSessionKey, S as ensureAgentWorkspace, T as resolveJohnnessPackageRoot, U as normalizeAtHashSlug, V as normalizeWindowsPathForComparison, W as normalizeHyphenSlug, X as DEFAULT_AGENT_ID, Y as toAgentModelListLike, Z as DEFAULT_MAIN_KEY, _t as isSubagentSessionKey, a as resolveAgentDir, at as resolveAgentIdFromSessionKey, c as resolveAgentWorkspaceDir, ct as scopedHeartbeatWakeOptions, d as resolveRunModelFallbacksOverride, dt as normalizeOptionalAccountId, f as resolveSessionAgentId, ft as isBlockedObjectKey, gt as isCronSessionKey, h as DEFAULT_AGENT_WORKSPACE_DIR, ht as isAcpSessionKey, i as resolveAgentConfig, it as normalizeMainKey, j as openBoundaryFile, k as spawnWithFallback, l as resolveDefaultAgentId, lt as DEFAULT_ACCOUNT_ID, mt as getSubagentDepth, n as hasConfiguredModelFallbacks, nt as isValidAgentId, ot as resolveThreadSessionKeys, p as resolveSessionAgentIds, pt as deriveSessionChatType, q as resolveAgentModelFallbackValues, r as listAgentIds, rt as normalizeAgentId, s as resolveAgentSkillsFilter, st as sanitizeAgentId, t as runTasksWithConcurrency, tt as classifySessionKeyShape, u as resolveEffectiveModelFallbacks, ut as normalizeAccountId$2, v as DEFAULT_IDENTITY_FILENAME, vt as parseAgentSessionKey, w as loadWorkspaceBootstrapFiles, yt as resolveThreadParentSessionKey } from "./run-with-concurrency-XmKq-xNS.js";
 import { a as getWebAuthAgeMs, d as readWebSelfId, g as resolveAccountEntry, h as webAuthExists, n as resolveWhatsAppAccount, o as logWebSelfId, s as logoutWeb, t as hasAnyWhatsAppAuth } from "./accounts-D-pSCe1E.js";
@@ -96313,6 +96316,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/plugin-sdk/dispatch-CQsjmw7g.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "../codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { A as mediaKindFromMime, C as imageMimeFromFormat, E as kindFromMime, O as MAX_IMAGE_BYTES, T as isGifMedia, a as isMarkdownCapableMessageChannel, b as detectMime, c as resolveGatewayMessageChannel, d as GATEWAY_CLIENT_MODES, f as GATEWAY_CLIENT_NAMES, g as getImageMetadata, i as isInternalMessageChannel, l as resolveMessageChannel, n as isDeliverableMessageChannel, o as listDeliverableMessageChannels, r as isGatewayMessageChannel, s as normalizeMessageChannel, t as INTERNAL_MESSAGE_CHANNEL, u as GATEWAY_CLIENT_IDS, w as isAudioFileName, x as extensionForMime, y as resizeToJpeg } from "./message-channel-DfmYEnql.js";
 import { B as shouldLogVerbose, C as isPlainObject, D as logWarn, E as logInfo, F as unregisterActiveProgressLine, G as theme, H as warn, I as danger, K as getChildLogger, M as defaultRuntime, N as clearActiveProgressLine, O as createSubsystemLogger, P as registerActiveProgressLine, R as logVerbose, S as truncateUtf16Safe, T as logError, U as colorize, W as isRich, X as resolvePreferredJohnnessTmpDir, Y as normalizeLogLevel, Z as consumeRootOptionToken, _ as shortenHomeInString, a as ensureDir$3, b as sliceUtf16Safe, c as isRecord$1, d as normalizeE164, h as resolveUserPath, j as createNonExitingRuntime, k as sanitizeForLog, o as escapeRegExp, r as clampInt, s as formatTerminalLink, t as CONFIG_DIR, v as shortenHomePath, w as logDebug, y as sleep$1, z as setVerbose } from "./utils-B0IyLNx9.js";
@@ -96313,6 +96316,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/plugin-sdk/dispatch-Cerq29sy.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "../codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { $ as buildAgentPeerSessionKey, C as filterBootstrapFilesForSession, D as runCommandWithTimeout, G as normalizeStringEntries, J as resolveAgentModelPrimaryValue, K as normalizeStringEntriesLower, M as openBoundaryFileSync, O as runExec, Q as buildAgentMainSessionKey, S as ensureAgentWorkspace, T as resolveJohnnessPackageRoot, U as normalizeAtHashSlug, V as normalizeWindowsPathForComparison, W as normalizeHyphenSlug, X as DEFAULT_AGENT_ID, Y as toAgentModelListLike, Z as DEFAULT_MAIN_KEY, _t as isSubagentSessionKey, a as resolveAgentDir, at as resolveAgentIdFromSessionKey, c as resolveAgentWorkspaceDir, ct as scopedHeartbeatWakeOptions, d as resolveRunModelFallbacksOverride, dt as normalizeOptionalAccountId, f as resolveSessionAgentId, ft as isBlockedObjectKey, gt as isCronSessionKey, h as DEFAULT_AGENT_WORKSPACE_DIR, ht as isAcpSessionKey, i as resolveAgentConfig, it as normalizeMainKey, j as openBoundaryFile, k as spawnWithFallback, l as resolveDefaultAgentId, lt as DEFAULT_ACCOUNT_ID, mt as getSubagentDepth, n as hasConfiguredModelFallbacks, nt as isValidAgentId, ot as resolveThreadSessionKeys, p as resolveSessionAgentIds, pt as deriveSessionChatType, q as resolveAgentModelFallbackValues, r as listAgentIds, rt as normalizeAgentId, s as resolveAgentSkillsFilter, st as sanitizeAgentId, t as runTasksWithConcurrency, tt as classifySessionKeyShape, u as resolveEffectiveModelFallbacks, ut as normalizeAccountId$2, v as DEFAULT_IDENTITY_FILENAME, vt as parseAgentSessionKey, w as loadWorkspaceBootstrapFiles, yt as resolveThreadParentSessionKey } from "./run-with-concurrency-BMh-rgTO.js";
 import { c as getWebAuthAgeMs, i as resolveWhatsAppAccount, l as logWebSelfId, m as readWebSelfId, t as hasAnyWhatsAppAuth, u as logoutWeb, v as webAuthExists, y as resolveAccountEntry } from "./accounts-B2lcx0zq.js";
@@ -96627,6 +96630,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/plugin-sdk/dispatch-Cndjtt0g.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "../codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { $ as isValidAgentId, C as filterBootstrapFilesForSession, D as runCommandWithTimeout, G as normalizeStringEntries, J as DEFAULT_MAIN_KEY, K as normalizeStringEntriesLower, M as openBoundaryFileSync, O as runExec, Q as classifySessionKeyShape, S as ensureAgentWorkspace, T as resolveJohnnessPackageRoot, U as normalizeAtHashSlug, V as normalizeWindowsPathForComparison, W as normalizeHyphenSlug, X as buildAgentPeerSessionKey, Y as buildAgentMainSessionKey, _t as resolveAgentModelFallbackValues, a as resolveAgentDir, at as scopedHeartbeatWakeOptions, c as resolveAgentWorkspaceDir, ct as normalizeOptionalAccountId, d as resolveRunModelFallbacksOverride, dt as getSubagentDepth, et as normalizeAgentId, f as resolveSessionAgentId, ft as isAcpSessionKey, gt as resolveThreadParentSessionKey, h as DEFAULT_AGENT_WORKSPACE_DIR, ht as parseAgentSessionKey, i as resolveAgentConfig, it as sanitizeAgentId, j as openBoundaryFile, k as spawnWithFallback, l as resolveDefaultAgentId, lt as isBlockedObjectKey, mt as isSubagentSessionKey, n as hasConfiguredModelFallbacks, nt as resolveAgentIdFromSessionKey, ot as DEFAULT_ACCOUNT_ID, p as resolveSessionAgentIds, pt as isCronSessionKey, q as DEFAULT_AGENT_ID, r as listAgentIds, rt as resolveThreadSessionKeys, s as resolveAgentSkillsFilter, st as normalizeAccountId$2, t as runTasksWithConcurrency, tt as normalizeMainKey, u as resolveEffectiveModelFallbacks, ut as deriveSessionChatType, v as DEFAULT_IDENTITY_FILENAME, vt as resolveAgentModelPrimaryValue, w as loadWorkspaceBootstrapFiles, yt as toAgentModelListLike } from "./run-with-concurrency-DCb27DCP.js";
 import { a as resolveGatewayPort, c as resolveStateDir, d as resolveRequiredHomeDir, l as expandHomePrefix, n as STATE_DIR, r as resolveConfigPath } from "./paths-B9fwHuf0.js";
@@ -96354,6 +96357,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/plugin-sdk/dispatch-UogiJYul.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "../codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { $ as stripUndefinedFields, A as unpinMessageDiscord, At as resolveAllowlistProviderRuntimeGroupPolicy, B as listScheduledEventsDiscord, C as editMessageDiscord, Ct as hasAnyGuildPermissionDiscord, D as pinMessageDiscord, Dt as evaluateGroupRouteAccessForPolicy, E as listThreadsDiscord, Et as chunkDiscordTextWithMode, F as fetchMemberInfoDiscord, Ft as buildChannelKeyCandidates, G as uploadStickerDiscord, H as timeoutMemberDiscord, I as fetchRoleInfoDiscord, It as normalizeChannelSlug, J as editChannelDiscord, K as createChannelDiscord, L as fetchVoiceStatusDiscord, Lt as resolveChannelEntryMatchWithFallback, M as banMemberDiscord, Mt as resolveOpenProviderRuntimeGroupPolicy, N as createScheduledEventDiscord, Nt as warnMissingProviderGroupPolicyFallbackOnce, O as readMessagesDiscord, Ot as evaluateMatchedGroupAccessForPolicy, P as fetchChannelInfoDiscord, Pt as applyChannelMatchMeta, Q as sendDiscordText, R as kickMemberDiscord, S as deleteMessageDiscord, St as fetchChannelPermissionsDiscord, T as listPinsDiscord, Tt as createDiscordRestClient, U as listGuildEmojisDiscord, V as removeRoleDiscord, W as uploadEmojiDiscord, X as removeChannelPermissionDiscord, Y as moveChannelDiscord, Z as setChannelPermissionDiscord, _ as sendStickerDiscord, _t as formatDiscordUserTag, a as sendDiscordComponentMessage, at as normalizeDiscordAllowList, b as formatMention, bt as DiscordApiError, c as parseDiscordComponentCustomId, ct as resolveDiscordChannelConfigWithFallback, d as parseDiscordModalCustomIdForCarbon, dt as resolveDiscordOwnerAccess, et as parseDiscordTarget, f as readDiscordComponentSpec, ft as resolveDiscordOwnerAllowFrom, g as sendPollDiscord, gt as formatDiscordReactionEmoji, h as sendMessageDiscord, ht as shouldEmitDiscordReactionNotification, i as removeReactionDiscord, it as isDiscordGroupAllowedByPolicy, j as addRoleDiscord, jt as resolveDefaultGroupPolicy, k as searchMessagesDiscord, kt as GROUP_POLICY_BLOCKED_LABEL, l as parseDiscordComponentCustomIdForCarbon, lt as resolveDiscordGuildEntry, m as resolveDiscordModalEntry, mt as resolveGroupDmAllow, n as reactMessageDiscord, nt as listDiscordDirectoryGroupsLive, o as createDiscordFormModal, ot as normalizeDiscordSlug, p as resolveDiscordComponentEntry, pt as resolveDiscordShouldRequireMention, q as deleteChannelDiscord, r as removeOwnReactionsDiscord, rt as listDiscordDirectoryPeersLive, s as formatDiscordComponentEventText, st as resolveDiscordAllowListMatch, t as fetchReactionsDiscord, tt as resolveDiscordChannelId, u as parseDiscordModalCustomId, ut as resolveDiscordMemberAccessState, v as sendVoiceMessageDiscord, vt as resolveDiscordSystemLocation, w as fetchMessageDiscord, wt as createDiscordClient, x as createThreadDiscord, xt as fetchDiscord, y as sendWebhookMessageDiscord, yt as resolveTimestampMs, z as listGuildChannelsDiscord } from "./send-Dy8sRjb5.js";
 import { $ as buildAgentPeerSessionKey, C as filterBootstrapFilesForSession, D as runCommandWithTimeout, G as normalizeStringEntries, J as resolveAgentModelPrimaryValue, K as normalizeStringEntriesLower, M as openBoundaryFileSync, O as runExec, Q as buildAgentMainSessionKey, S as ensureAgentWorkspace, T as resolveJohnnessPackageRoot, U as normalizeAtHashSlug, V as normalizeWindowsPathForComparison, W as normalizeHyphenSlug, X as DEFAULT_AGENT_ID, Y as toAgentModelListLike, Z as DEFAULT_MAIN_KEY, _t as isSubagentSessionKey, a as resolveAgentDir, at as resolveAgentIdFromSessionKey, c as resolveAgentWorkspaceDir, ct as scopedHeartbeatWakeOptions, d as resolveRunModelFallbacksOverride, dt as normalizeOptionalAccountId, f as resolveSessionAgentId, ft as isBlockedObjectKey, gt as isCronSessionKey, h as DEFAULT_AGENT_WORKSPACE_DIR, ht as isAcpSessionKey, i as resolveAgentConfig, it as normalizeMainKey, j as openBoundaryFile, k as spawnWithFallback, l as resolveDefaultAgentId, lt as DEFAULT_ACCOUNT_ID, mt as getSubagentDepth, n as hasConfiguredModelFallbacks, nt as isValidAgentId, ot as resolveThreadSessionKeys, p as resolveSessionAgentIds, pt as deriveSessionChatType, q as resolveAgentModelFallbackValues, r as listAgentIds, rt as normalizeAgentId, s as resolveAgentSkillsFilter, st as sanitizeAgentId, t as runTasksWithConcurrency, tt as classifySessionKeyShape, u as resolveEffectiveModelFallbacks, ut as normalizeAccountId$2, v as DEFAULT_IDENTITY_FILENAME, vt as parseAgentSessionKey, w as loadWorkspaceBootstrapFiles, yt as resolveThreadParentSessionKey } from "./run-with-concurrency-D4zr_gVN.js";
@@ -96313,6 +96316,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/plugin-sdk/mattermost.js

@@ -1,3 +1,5 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { $ as findOverlappingPluginHttpRoute, A as parseCanonicalIpAddress, B as resolveMemorySlotDecision, Bt as resolvePreferredJohnnessTmpDir, C as isBlockedSpecialUseIpv6Address, Ct as normalizeStringEntries, D as isLegacyIpv4Literal, Dt as normalizeE164, E as isIpv4Address, Et as isRecord, F as resolveProcessScopedMap, Ft as normalizeOptionalAccountId, G as normalizeChatChannelId, Gt as resolveRequiredHomeDir, H as MANIFEST_KEY, Ht as resolveOAuthDir, I as isPathInsideWithRealpath, It as resolveThreadParentSessionKey, J as isValidFileSecretRefId, K as isTruthyEnvValue, L as loadPluginManifestRegistry, Lt as createSubsystemLogger, M as applyConfigEnvVars, Mt as resolveThreadSessionKeys, Nt as DEFAULT_ACCOUNT_ID, O as isLoopbackIpAddress, Ot as resolveUserPath, P as resolveJohnnessAgentDir, Pt as normalizeAccountId, Q as requireActivePluginRegistry, R as normalizePluginsConfig, Rt as logVerbose, S as isBlockedSpecialUseIpv4Address, St as normalizeHyphenSlug, T as isIpInCidr, Tt as escapeRegExp, U as CHAT_CHANNEL_ORDER, Ut as resolveStateDir, V as LEGACY_MANIFEST_KEYS, Vt as consumeRootOptionToken, W as getChatChannelMeta, Wt as expandHomePrefix, X as getActivePluginRegistry, Y as resolveDefaultSecretProviderAlias, Z as getActivePluginRegistryVersion, _ as DmPolicySchema, _t as isNotFoundPathError, a as resolveModelRefFromString, at as normalizeResolvedSecretInputString, b as requireOpenAllowFrom, bt as normalizeSkillFilter, c as resolveImplicitCopilotProvider, ct as resolveAgentConfig, d as resolveSecretRefString, dt as resolveDefaultAgentId, et as normalizePluginHttpPath, f as encodeJsonPointerToken, ft as resolveJohnnessPackageRootSync, g as BlockStreamingCoalesceSchema, gt as hasNodeErrorCode, h as loadConfig, ht as sameFileIdentity, i as resolveDefaultModelForAgent, it as isValidEnvSecretRefId, j as parseLooseIpAddress, jt as normalizeAgentId, k as normalizeIpAddress, kt as safeParseJson, l as resolveImplicitProviders, lt as resolveAgentSkillsFilter, m as getRuntimeConfigSourceSnapshot, mt as logWarn, n as buildModelAliasIndex, nt as coerceSecretRef, o as normalizeProviders, ot as normalizeSecretInputString, p as getRuntimeConfigSnapshot, pt as runExec, q as parseBooleanValue, r as normalizeProviderId, rt as hasConfiguredSecretInput, s as resolveImplicitBedrockProvider, st as listAgentIds, t as buildAllowedModelSet, tt as formatCliCommand, u as isNonSecretApiKeyMarker, ut as resolveAgentWorkspaceDir, v as GroupPolicySchema, vt as isPathInside, w as isCanonicalDottedDecimalIPv4, wt as CONFIG_DIR, x as extractEmbeddedIpv4FromIpv6, xt as normalizeAtHashSlug, y as MarkdownConfigSchema, yt as isSymlinkOpenError, z as resolveEffectiveEnableState, zt as shouldLogVerbose } from "./model-selection-Dbj4jDYM.js";
 import path from "node:path";
 import fs, { constants } from "node:fs";
@@ -3264,6 +3266,13 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "login",
+			nativeName: "login",
+			description: "Sign in to ChatGPT with a device code (owner only).",
+			textAliases: ["/login", "/relogin"],
+			category: "management"
+		}),
 		defineChatCommand({
 			key: "status",
 			nativeName: "status",

package/dist/plugin-sdk/reply-DbZnH8-h.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "../codex-oauth-device.js";
 // JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59
 import { $ as buildAgentPeerSessionKey, C as filterBootstrapFilesForSession, D as runCommandWithTimeout, G as toAgentModelListLike, J as normalizeStringEntries, K as normalizeAtHashSlug, M as openBoundaryFileSync, O as runExec, Q as buildAgentMainSessionKey, S as ensureAgentWorkspace, T as resolveJohnnessPackageRoot, U as resolveAgentModelFallbackValues, V as normalizeWindowsPathForComparison, W as resolveAgentModelPrimaryValue, X as DEFAULT_AGENT_ID, Y as normalizeStringEntriesLower, Z as DEFAULT_MAIN_KEY, _t as isSubagentSessionKey, a as resolveAgentDir, at as resolveAgentIdFromSessionKey, c as resolveAgentWorkspaceDir, ct as scopedHeartbeatWakeOptions, d as resolveRunModelFallbacksOverride, dt as normalizeOptionalAccountId, f as resolveSessionAgentId, ft as isBlockedObjectKey, gt as isCronSessionKey, h as DEFAULT_AGENT_WORKSPACE_DIR, ht as isAcpSessionKey, i as resolveAgentConfig, it as normalizeMainKey, j as openBoundaryFile, k as spawnWithFallback, l as resolveDefaultAgentId, lt as DEFAULT_ACCOUNT_ID, mt as getSubagentDepth, n as hasConfiguredModelFallbacks, nt as isValidAgentId, ot as resolveThreadSessionKeys, p as resolveSessionAgentIds, pt as deriveSessionChatType, q as normalizeHyphenSlug, r as listAgentIds, rt as normalizeAgentId, s as resolveAgentSkillsFilter, st as sanitizeAgentId, t as runTasksWithConcurrency, tt as classifySessionKeyShape, u as resolveEffectiveModelFallbacks, ut as normalizeAccountId$2, v as DEFAULT_IDENTITY_FILENAME, vt as parseAgentSessionKey, w as loadWorkspaceBootstrapFiles, yt as resolveThreadParentSessionKey } from "./run-with-concurrency-8rEOAFIb.js";
 import { $ as resetConfigOverrides, $n as getShellPathFromLoginShell, An as describeUnknownError$1, Ar as listPluginCommands, At as mapStreamingModeToSlackLegacyDraftStreamMode, B as isSupportedLocalAvatarExtension, Bn as resolveJohnnessAgentDir, Bt as buildModelAliasIndex, C as parseDurationMs, Cn as markAuthProfileFailure, Cr as setActivePluginRegistry, Ct as unwrapKnownShellMultiplexerInvocation, Dn as resolveSecretRefString, Dr as clearPluginCommands, Dt as resolveSafeBinProfiles, En as resolveApiKeyForProfile, Er as normalizePluginHttpPath, Et as normalizeSafeBinProfileFixtures, Fn as dedupeProfileIds, Fr as resolveContextEngine, G as safeStatSync, Gn as resolveAuthProfileDisplayLabel, Gt as normalizeProviderId, H as loadPluginManifestRegistry, Ht as isCliProvider, In as listProfilesForProvider, Ir as formatCliCommand, J as applyTestPluginDefaults, Jn as splitTrailingAuthProfile, Jt as resolveModelRefFromString, Kt as resolveConfiguredModelRef, L as isAvatarDataUrl, Ln as markAuthProfileGood, Lr as resolveCliName, Lt as resolveAgentMaxConcurrent, Mn as isRecord$1, Mr as createInternalHookEvent, Mt as resolveSlackNativeStreaming, Nn as parseDotPath, Nr as triggerInternalHook, Nt as resolveSlackStreamingMode, On as resolveSecretRefValue, Or as executePluginCommand, Ot as applyMergePatch, Pr as registerContextEngine, Q as getConfigOverrides, Qn as VERSION, R as isAvatarHttpUrl, Rn as ensureAuthProfileStore, Rt as buildAllowedModelSet, Sn as isProfileInCooldown, Sr as requireActivePluginRegistry, St as unwrapKnownDispatchWrapperInvocation, Tn as resolveProfilesUnavailableReason, Tr as findOverlappingPluginHttpRoute, Tt as SAFE_BIN_PROFILES, U as discoverJohnnessPlugins, Ut as modelKey, V as validateJsonSchemaValue, Vn as withFileLock, Vt as findNormalizedProviderValue, W as isPathInside, Wt as normalizeModelRef$2, X as resolveEffectiveEnableState, Xn as DEFAULT_MODEL, Xt as resolveSubagentSpawnModelSelection, Y as normalizePluginsConfig, Yn as DEFAULT_CONTEXT_TOKENS, Yt as resolveReasoningDefault, Z as resolveMemorySlotDecision, Zn as DEFAULT_PROVIDER, Zt as resolveThinkingDefault, _n as isSecretRefHeaderValueMarker, _r as normalizeChannelId$1, _t as resolveAllowlistCandidatePath, a as readConfigFileSnapshot, an as createConfiguredOllamaStreamFn, at as unsetConfigValueAtPath, b as normalizeScpRemoteHost, bn as clearExpiredCooldowns, br as getActivePluginRegistryKey, bt as isDispatchWrapperExecutable, c as setRuntimeConfigSnapshot, cn as buildStreamErrorAssistantMessage, cr as hasConfiguredSecretInput, ct as listWritableExplicitTrustedSafeBinDirs, dn as getCustomProviderApiKey, dr as resolveSecretInputRef, dt as analyzeShellCommand, er as resolveShellEnvFallbackTimeoutMs, et as setConfigOverride, f as TELEGRAM_COMMAND_NAME_PATTERN, fn as requireApiKey, ft as buildEnforcedShellCommand, g as isInboundPathAllowed, gn as isNonSecretApiKeyMarker, gr as normalizeAnyChannelId, gt as matchAllowlist, hn as resolveModelAuthMode, hr as listChatChannels, ht as DEFAULT_SAFE_BINS, i as loadConfig, in as retryAsync, ir as parseBooleanValue$1, it as setConfigValueAtPath, jn as isNonEmptyString, jr as matchPluginCommand, jt as resolveDiscordPreviewStreamMode, kr as getPluginCommandSpecs, kt as isSafeExecutableValue, l as writeConfigFile, ln as buildUsageWithNoCost, lr as normalizeResolvedSecretInputString, lt as normalizeTrustedSafeBinDirs, m as resolveTelegramCustomCommands, mn as resolveEnvApiKey, mr as getChatChannelMeta, mt as splitCommandChain, nr as resolveOwnerDisplaySetting, nt as getConfigValueAtPath, o as readConfigFileSnapshotForWrite, on as buildAssistantMessage, ot as getTrustedSafeBinDirs, p as normalizeTelegramCommandName, pn as resolveApiKeyForProvider, pr as CHAT_CHANNEL_ORDER, pt as isWindowsPlatform, q as MANIFEST_KEY, qn as normalizeSecretInput, qt as resolveDefaultModelForAgent, rn as resolveRetryConfig, rr as isTruthyEnvValue, rt as parseConfigPath, s as resolveConfigSnapshotHash, sn as buildAssistantMessageWithZeroUsage, sr as coerceSecretRef, st as isTrustedSafeBinPath, tr as isDangerousHostEnvVarName, tt as unsetConfigOverride, u as validateConfigObjectWithPlugins, un as getApiKeyForModel, ur as normalizeSecretInputString, ut as validateSafeBinArgv, v as resolveIMessageAttachmentRoots, vr as normalizeChatChannelId, vt as resolveCommandResolutionFromArgv, wn as markAuthProfileUsed, wr as createPluginRegistry, wt as splitShellArgs, x as parseNonNegativeByteSize, xn as getSoonestCooldownExpiry, xt as isShellWrapperExecutable, y as resolveIMessageRemoteAttachmentRoots, yn as resolveAuthProfileOrder, yr as getActivePluginRegistry, yt as extractShellWrapperInlineCommand, z as isPathWithinRoot, zn as resolveAuthStorePathForDisplay, zt as buildConfiguredAllowlistKeys } from "./config-Di-lyCdh.js";
@@ -97802,6 +97805,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/dist/reply-C5LKjXcC.js

@@ -1,3 +1,6 @@
+// JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
+import { handleDeviceLoginCommand } from "./codex-oauth-device.js";
 import { g as resolveStateDir, r as STATE_DIR, u as resolveGatewayPort, y as resolveRequiredHomeDir } from "./paths-BJV7vkaX.js";
 import { E as normalizeLogLevel, R as consumeRootOptionToken, a as logVerbose, c as shouldLogVerbose, k as resolvePreferredJohnnessTmpDir, m as getChildLogger, p as theme, t as danger, u as warn } from "./globals-BM8hKFm0.js";
 import { C as sleep$1, D as isPlainObject, E as truncateUtf16Safe, S as shortenHomePath, d as isRecord$1, i as clampInt, l as escapeRegExp, m as normalizeE164, t as CONFIG_DIR, w as sliceUtf16Safe, x as shortenHomeInString, y as resolveUserPath } from "./utils-DC4zYvW0.js";
@@ -89523,6 +89526,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 	for (const [candidateKey, candidateEntry] of Object.entries(sessionStore)) if (candidateKey.trim().toLowerCase() === normalizedTarget) return candidateEntry;
 }
 async function handleCommands(params) {
+	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
+	if (deviceLoginReply) return deviceLoginReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,

package/docs/PATCHES.md

@@ -17,7 +17,7 @@ they predate ~2026-06-06).
 
 ## Index
 
-Family 01 is retired. Families 02 through 41 and 43 through 59 are live on `main`. Family 42 is omitted; native Codex OAuth ownership is Family 58.
+Family 01 is retired. Families 02 through 41 and 43 through 60 are live on `main`. Family 42 is omitted; native Codex OAuth ownership is Family 58.
 
 1. **01, announce queue TTL, retired:** Removed the five-minute age filter that could discard delayed sub-agent completion announcements. [Details](#01--announce-ttl-retired-2026-07-30)
 2. **02, failover rotation:** Returns model selection to the highest-priority profile after its cooldown ends. [Details](#02--failover-rotation-undocumented)
@@ -78,6 +78,7 @@ Family 01 is retired. Families 02 through 41 and 43 through 59 are live on `main
 57. **57, swarm operating protocol:** the swarm preamble carries the protocol as guidance with escape hatches (plan the shape, one integrator per converging target, one gateway or shared budget per rate-limited host, done means done, verification sized to the blast radius); the board gains service items, durable requests with inbox wake and `wait`, and token-bucket budgets; `swarm_status` shows services and budgets. [Details](#57-swarm-operating-protocol-guidance-preamble-integrator-and-gateway-services-requests-shared-budgets)
 58. **58, Codex OAuth ownership:** One refresh authority per credential, cross-process locks, durable read-through, compare-and-swap persistence, and metadata-only updates prevent rotating-token races. [Details](#58-codex-oauth-ownership)
 59. **59, native state migration:** `johnness migrate` backs up and rewrites selected state into the native namespace, with staged publication, verification and rollback; installed plugins win over bundled duplicates. [Details](#59-native-state-migration)
+60. **60, device-code OAuth login:** Owner/allowlisted `/login` and `/relogin`, headless `models auth login --device`, canonical token handoff, shared polling and six-hour dead-chain recovery notices. [Details](#60-device-code-oauth-login)
 
 ---
 
@@ -2341,3 +2342,23 @@ Confirm its in-flight request has finished before handoff, archive its plist/scr
 **Files and replay.** Shared `dist/migrate-*.js` modules and CLI registration, legacy doctor/path resolvers, fourteen discovery copies, exec-approvals resolvers, native plugin adapter integration, [`scripts/patch-native-state-migration.py`](../scripts/patch-native-state-migration.py), [`patches/59-native-state-migration.patch`](../patches/59-native-state-migration.patch), and `tests/migrate-*.test.mjs` plus runtime regression tests. Source-name detection literals are protected from namespace replay. Marker: `JOHNNESS_PATCH_NATIVE_STATE_MIGRATION_59`.
 
 **Acceptance and rollback.** Synthetic tests cover filesystem boundaries, redaction, plugin precedence, staged-copy/resume/idempotency, service artifacts, offline validation and rollback. The release additionally exercises an isolated packed installation and a private temporary copy of real state; no private fixtures enter the repository or package. `johnness migrate --rollback --to <target>` restores only transaction-owned state after ownership/divergence checks and prints the selected old-service handoff. Runtime rollback and state rollback are separate operations; retain the verified backup and known-good package until cutover is accepted.
+
+## 60. Device-code OAuth login
+
+**Patch:** `patches/60-codex-oauth-device.patch`; `scripts/patch-codex-oauth-device.py` validates all anchors before writing and supports an alternate package root.
+**Runtime:** `dist/codex-oauth-device.js`, `dist/codex-oauth-nudge.js`, the shared Family 58 owner, ten command dispatch bundles, eleven command registries, two CLI action copies and two CLI registrations (three distinct CLI files). Total: 27 runtime files; one `JOHNNESS_PATCH_DEVICE_LOGIN_60` marker per file.
+
+**What it does:** `/login` and `/relogin` run before model-backed work, use the existing config-changing-command sender authorization, return a device URL/code in the originating channel, and poll without holding its command lane. Duplicate requests share the public prompt and one poller across bundle copies, inherited main-agent profiles, and CLI/gateway processes. A separate ownership-checked device lock spans the human authorization window. Public prompt/status metadata is kept in the canonical auth store; the device-auth id and PKCE verifier are memory-only. Success says "Signed in. I'm back."; expiry says "That code expired (they last 15 minutes). Send /login and I'll give you a fresh one." Native slash registries advertise `/login`; `/relogin` is a text alias. Natural-language phrases are not added to the slash matcher.
+
+`johnness models auth login --device` defaults to `openai-codex`, needs no TTY, and prints the prompt followed by a redacted identity. `--provider openai-codex --device` is equivalent. Without `--device`, the browser/callback flow is unchanged.
+
+**Protocol:** Verified against OpenAI Codex CLI 0.154.0 and `codex-rs/login/src/device_code_auth.rs` at commit `9e22e74e8dcab53f8bf1799c0eed1f9834c32f1a`. This is not the generic RFC 8628 grant: POST `/api/accounts/deviceauth/usercode` with the existing Codex client id only, poll `/api/accounts/deviceauth/token` with `device_auth_id` and `user_code`, then exchange the returned authorization code plus PKCE verifier at `/oauth/token` using `/deviceauth/callback`. Bare 403/404 mean pending; explicit denial/expiry is distinct. Respect server polling interval, Retry-After/slow-down, bounded fetch deadlines, and a 15-minute window. No scope is sent in the device request because that endpoint's contract accepts only the client id.
+
+**Credential handoff:** Resolve the existing provider profile, including legacy ids and inherited main ownership. Validate account continuity with Family 58; an explicit owner-selected account change is accepted with an identity-redacted notice. Commit through `mutateAuthProfile`, clear the durable dead-chain marker and cooldown/usage failure entry, and publish the owner's snapshots. New profiles use `openai-codex:<email-or-default>`. No secondary token store or Codex CLI helper is involved.
+
+**Recovery notice:** The shared owner (already reached by all ten refresh adapters) recognizes refresh-token reuse, invalid grant/expired refresh chains, and expired credentials with no refresh token. A fresh-store transaction reserves one notice per profile per six hours in `codexLoginNudges` before sending to a concrete configured owner on an enabled channel. Wildcard/group targets are not used. Unresolved owners or delivery failures get a token-free log notice instead; the reservation prevents storms across process restarts. Existing auth failures nudge when next inspected by the owner, not via an extra periodic job.
+
+**Tests:** `tests/codex-oauth-device.test.mjs` covers exact fake endpoints, pending/success, expiry/denial, rate limits, sanitized failures, canonical handoff, explicit account changes, inherited ownership, authorization, duplicate prompts, background routing, CLI identity redaction, nudge debounce, all ten real dispatcher adapters, and exact/idempotent/atomic patch replay. Historical Family 51/54 replay tests now replay Family 60 before exact byte comparison; the Family 59 header fixture excludes only the independent Family 60 import/comment. Verifier checks every runtime copy plus exact read-only replay. Live end-to-end account authorization still requires the human to complete OpenAI's device page.
+
+<!-- JOHNNESS_PATCH_DEVICE_LOGIN_60B -->
+**Amendment 60B (2026.9.12): first-try instructions.** Additive patch: `patches/60b-device-login-instructions.patch`. Chat and CLI now give four numbered steps: open the device page, sign in first if asked, enter the code on that same page, then tap Approve. Telegram's code is on its own line in inline-code formatting, with a tap-to-copy instruction. A redacted known account (or "the same account as before") helps choose the right sign-in. The prompt explains the one-time chatgpt.com > Settings > Security > "Device code authorization for Codex" setting and asks for a fresh code after enabling it. CLI startup unavailability or an explicit disabled-setting HTTP 403 prints that same fix without echoing the response body. Bare polling 403/404 semantics are unchanged. Expiry, declined-sign-in and dead-chain notices now explain the next action. All 27 runtime surfaces carry the 60B sub-marker and are checked by exact replay; tests cover walkthrough content, copyable Telegram code, sanitized startup errors, and unchanged pending behavior.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "johns-harness",
-  "version": "2026.9.10",
+  "version": "2026.9.12",
   "description": "John's Harness: a production agent harness that runs autonomous coding agents as one cooperative swarm.",
   "keywords": [
     "ai-agents",