maka-agent 0.2.0-dev.27.20260910 → 0.2.0-dev.29.20260912

package/LICENSE

@@ -203,15 +203,32 @@
 
 THIRD-PARTY COMPONENTS
 
+Vercel Code Mode and run execution-budget patches
+
+Source: https://www.npmjs.com/package/@ai-sdk/code-mode/v/1.0.56
+        https://www.npmjs.com/package/run/v/2.1.4
+Repository: https://github.com/vercel/ai/tree/main/packages/code-mode
+            https://github.com/vercel-labs/run/tree/run%402.1.4/packages/run
+Dependency patches: patches/@maka+runtime++@ai-sdk+code-mode+1.0.56.patch
+                    patches/run+2.1.4.patch
+Readable source changes: patches/run-2.1.4-source.diff
+Copyright 2023 Vercel, Inc.
+License: Apache-2.0
+
+These patches modify the execution time policy and its SDK forwarding. The
+Apache License, Version 2.0 above applies. The generated run Worker includes
+embedded third-party code; its upstream notices and license texts are retained
+in patches/run-2.1.4-notices.md.
+
 Vercel AI SDK
 
 Source: https://www.npmjs.com/package/@ai-sdk/provider-utils/v/5.0.11
         https://www.npmjs.com/package/@ai-sdk/provider/v/4.0.3
-Patched package: https://www.npmjs.com/package/@ai-sdk/provider-utils/v/5.0.34
+Patched package: https://www.npmjs.com/package/@ai-sdk/provider-utils/v/5.0.40
 Repository: https://github.com/vercel/ai/tree/main/packages/provider-utils
             https://github.com/vercel/ai/tree/main/packages/provider
 Adapted declarations: @ai-sdk/provider-utils 5.0.11, @ai-sdk/provider 4.0.3
-Dependency patch: patches/@ai-sdk+provider-utils+5.0.34.patch
+Dependency patch: patches/@ai-sdk+provider-utils+5.0.40.patch
 Copyright 2023 Vercel, Inc.
 License: Apache-2.0
 
@@ -223,7 +240,7 @@ License, Version 2.0 above applies to the adapted material.
 The pinned versions are the ones present when the adaptation was made. The
 adapted declarations are unchanged through @ai-sdk/provider-utils 5.0.25 and
 @ai-sdk/provider 4.0.7, the versions recorded by the code origin audit. Maka
-also redistributes a patch against @ai-sdk/provider-utils 5.0.34; that patch
+also redistributes a patch against @ai-sdk/provider-utils 5.0.40; that patch
 modifies Apache-2.0 source and is covered by the license reproduced above.
 
 Astryx
@@ -261,6 +278,146 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+xterm.js dependency patch
+
+Source: https://www.npmjs.com/package/@xterm/xterm/v/6.0.0
+Repository: https://github.com/xtermjs/xterm.js
+Version: 6.0.0
+Dependency patch: patches/@xterm+xterm+6.0.0.patch
+License: MIT
+
+Maka redistributes a patch to the TypeScript source and both shipped JavaScript
+bundles that defers selection rendering while the terminal is hidden. The
+following upstream license applies to that material:
+
+Copyright (c) 2017-2019, The xterm.js authors (https://github.com/xtermjs/xterm.js)
+Copyright (c) 2014-2016, SourceLair Private Company (https://www.sourcelair.com)
+Copyright (c) 2012-2013, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Pi TUI dependency patch
+
+Source: https://www.npmjs.com/package/@earendil-works/pi-tui/v/0.84.4
+Repository: https://github.com/earendil-works/pi/tree/v0.84.4/packages/tui
+Version: 0.84.4
+Dependency patch: patches/@earendil-works+pi-tui+0.84.4.patch
+Copyright (c) 2025 Mario Zechner
+License: MIT
+
+Maka redistributes a source patch that copies mutable editor undo state while
+sharing immutable pasted strings. The following MIT License applies to that
+material:
+
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Zod dependency patch
+
+Source: https://www.npmjs.com/package/zod/v/4.5.4
+Repository: https://github.com/colinhacks/zod
+Version: 4.5.4
+Dependency patch: patches/zod+4.5.4.patch
+Copyright (c) 2025 Colin McDonnell
+License: MIT
+
+Maka redistributes a source patch that releases recursive parse state after
+completion or failure. The following MIT License applies to that material:
+
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Model Context Protocol client dependency patch
+
+Source: https://www.npmjs.com/package/@modelcontextprotocol/client/v/2.0.0
+Repository: https://github.com/modelcontextprotocol/typescript-sdk
+Version: 2.0.0
+Dependency patch: patches/@modelcontextprotocol+client+2.0.0.patch
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+Declared package license: MIT
+
+Maka redistributes a source patch that releases settled request observers under
+transport backpressure. The upstream package's LICENSE describes a transition
+from MIT to Apache-2.0: contributions with relicensing consent use Apache-2.0,
+while contributions without that consent retain their original MIT license.
+The Apache License, Version 2.0 is reproduced above. The upstream MIT notice is:
+
+MIT License
+
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 Sigstore dependency patch
 
 Source: https://www.npmjs.com/package/@sigstore/core/v/4.0.1

package/THIRD_PARTY_NOTICES.txt

@@ -208,7 +208,7 @@ Apache License
 
 ================================================================================
 
-Package: @ai-sdk/anthropic@4.0.46
+Package: @ai-sdk/anthropic@4.0.53
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/anthropic
@@ -230,7 +230,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/code-mode@1.0.42
+Package: @ai-sdk/code-mode@1.0.56
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/code-mode
@@ -252,7 +252,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/cohere@4.0.35
+Package: @ai-sdk/cohere@4.0.41
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/cohere
@@ -274,7 +274,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/gateway@4.0.69
+Package: @ai-sdk/gateway@4.0.80
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/gateway
@@ -296,7 +296,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/google@4.0.58
+Package: @ai-sdk/google@4.0.69
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/google
@@ -318,7 +318,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/open-responses@2.0.36
+Package: @ai-sdk/open-responses@2.0.44
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/open-responses
@@ -340,7 +340,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/openai@4.0.52
+Package: @ai-sdk/openai@4.0.66
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/openai
@@ -362,7 +362,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/openai-compatible@3.0.41
+Package: @ai-sdk/openai-compatible@3.0.48
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/openai-compatible
@@ -384,7 +384,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/provider@4.0.9
+Package: @ai-sdk/provider@4.0.14
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/provider
@@ -406,7 +406,7 @@ limitations under the License.
 
 ================================================================================
 
-Package: @ai-sdk/provider-utils@5.0.34
+Package: @ai-sdk/provider-utils@5.0.40
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/provider-utils
@@ -2186,7 +2186,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: ai@7.0.85
+Package: ai@7.0.99
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: https://github.com/vercel/ai#packages/ai
@@ -6643,7 +6643,7 @@ Felix Geisendörfer (felix@debuggable.com)
 
 ================================================================================
 
-Package: run@2.0.0
+Package: run@2.1.4
 Declared license: Apache-2.0
 Selected license: Apache-2.0
 Repository: git+https://github.com/vercel-labs/run.git#packages/run
@@ -7573,7 +7573,7 @@ SOFTWARE.
 ================================================================================
 
 Embedded component: quickjs-emscripten (embedded runtime)
-Embedded by: @ai-sdk/code-mode@1.0.42
+Embedded by: @ai-sdk/code-mode@1.0.56
 Selected license: MIT
 Repository: https://github.com/justjake/quickjs-emscripten
 
@@ -7603,7 +7603,7 @@ SOFTWARE.
 ================================================================================
 
 Embedded component: QuickJS JavaScript engine (embedded runtime)
-Embedded by: @ai-sdk/code-mode@1.0.42
+Embedded by: @ai-sdk/code-mode@1.0.56
 Selected license: MIT
 Repository: https://github.com/bellard/quickjs
 

package/dist/cli-core.js

@@ -54,6 +54,8 @@ export function parseMakaCliArgs(argv, version, cliCommand = RELEASE_MAKA_CLI_LA
         return { kind: 'activate', args: argv.slice(1) };
     if (first === 'session-export')
         return { kind: 'session-export', args: argv.slice(1) };
+    if (first === 'session-import')
+        return { kind: 'session-import', args: argv.slice(1) };
     if (first === 'eval')
         return { kind: 'eval', args: argv.slice(1) };
     if (first === 'update')
@@ -100,6 +102,7 @@ function helpText(cliCommand) {
         `  ${cliCommand} run ...      Run one non-interactive model turn`,
         `  ${cliCommand} activate ... Run one Cloud Session activation and emit JSONL`,
         `  ${cliCommand} session-export --workspace-root <dir> --session <id> --out <file.maka-session>`,
+        `  ${cliCommand} session-import --workspace-root <dir> --bundle <file.maka-session>`,
         `  ${cliCommand} -p ...       Alias for ${cliCommand} run`,
         `  ${cliCommand} eval ...     Run one declarative multi-arm experiment`,
         `  ${cliCommand} update --target <latest|next|version>  Update this npm-global CLI and its local Runtime Host`,
@@ -250,6 +253,10 @@ export async function runMakaCli(argv = process.argv.slice(2), options = RELEASE
             const { runMakaSessionExportCli } = await import('./session-export-command.js');
             return runMakaSessionExportCli(command.args);
         }
+        case 'session-import': {
+            const { runMakaSessionImportCli } = await import('./session-import-command.js');
+            return runMakaSessionImportCli(command.args);
+        }
         case 'eval': {
             const { configureInstalledEvalBundle } = await import('./eval-bundle-path.js');
             configureInstalledEvalBundle();

package/dist/onboarding-catalog.js

@@ -36,6 +36,7 @@ export function listApiKeyOnboardableProviders() {
             providerType,
             label: definition.label,
             requiresBaseUrl: !definition.baseUrl,
+            setupMethod: 'api_key',
         };
     });
 }

package/dist/pi-tui-pickers.js

@@ -35,6 +35,9 @@ export function onboardingFailureMessage(failure, locale) {
             return copy.onboardingRequestFailed;
     }
 }
+export function onboardingOAuthFailureMessage(reason, locale) {
+    return TUI_PICKER_COPY[locale].oauthFailures[reason];
+}
 export class MakaAutocompleteProvider {
     fileProvider;
     slashCommands;
@@ -881,13 +884,10 @@ function isCreateEntry(entry) {
 }
 const ONBOARDING_MODELS_MAX_VISIBLE = 10;
 /**
- * One input field, four phases. The same overlay is the provider search, the
- * API-key field, the searchable model multi-select, and the in-frame success —
- * so onboarding never pushes its prompt/verifying/failure/saving/success notices
- * into the transcript. Status lives in a single status line beside the field
- * instead of the top entry flow (#1098 UX). `Esc` always moves back exactly one
- * level (models → key → provider → close); late async results are ignored after
- * back/close/retry because the runner bumps its attempt id on every transition.
+ * One overlay owns the provider, credentials or OAuth, models, and success
+ * phases, so onboarding never pushes progress or failures into the transcript.
+ * Late async results are ignored after back, close, or retry because the runner
+ * bumps its attempt id on every transition.
  */
 export class OnboardingWizard {
     tui;
@@ -915,6 +915,8 @@ export class OnboardingWizard {
     modelScroll = 0;
     successCount = 0;
     successWarning;
+    oauthPresentation;
+    oauthStatus = { kind: 'starting' };
     copy;
     constructor(tui, input) {
         this.tui = tui;
@@ -964,11 +966,11 @@ export class OnboardingWizard {
             const provider = this.filtered.find((candidate) => onboardingProviderKey(candidate) === item.value);
             if (!provider)
                 return;
-            this.enterKeyPhase(provider);
+            this.enterProvider(provider);
         };
         return list;
     }
-    enterKeyPhase(provider) {
+    enterProvider(provider) {
         this.picked = provider;
         // A create target stops at the identity step first: name and slug come
         // prefilled with the Host-derived defaults, and accepting them verbatim
@@ -976,7 +978,13 @@ export class OnboardingWizard {
         // A relay has no registry endpoint, so the wizard must still collect one
         // before the key — the deferred phase-2 step from #1254 (#3405).
         const create = isCreateEntry(provider);
-        this.phase = create ? 'identity' : provider.requiresBaseUrl ? 'baseUrl' : 'key';
+        this.phase = create
+            ? 'identity'
+            : provider.setupMethod === 'oauth'
+                ? 'oauth'
+                : provider.requiresBaseUrl
+                    ? 'baseUrl'
+                    : 'key';
         if (create) {
             this.identityFocus = 'name';
             this.nameEditor.setText(provider.label);
@@ -997,6 +1005,8 @@ export class OnboardingWizard {
         this.modelScroll = 0;
         this.modelsSearchEditor.setText('');
         this.input.onPickProvider(provider);
+        if (!create && provider.setupMethod === 'oauth')
+            this.startOAuth();
     }
     /**
      * Slug submit on the identity step. The name field needs no validation of
@@ -1031,7 +1041,10 @@ export class OnboardingWizard {
             name: name.length > 0 && name !== defaultName ? name : null,
         });
         this.status = { kind: 'prompt' };
-        this.phase = picked.requiresBaseUrl ? 'baseUrl' : 'key';
+        this.phase =
+            picked.setupMethod === 'oauth' ? 'oauth' : picked.requiresBaseUrl ? 'baseUrl' : 'key';
+        if (picked.setupMethod === 'oauth')
+            this.startOAuth();
     }
     submitBaseUrl(value) {
         if (!this.picked || this.phase !== 'baseUrl')
@@ -1084,6 +1097,10 @@ export class OnboardingWizard {
         this.filtered = next;
         this.list = this.buildList();
     }
+    setProviders(providers) {
+        this.input.providers = providers;
+        this.applyQuery(this.searchEditor.getText());
+    }
     applyModelQuery(text) {
         const query = text.trim().toLowerCase();
         this.filteredModels = query
@@ -1119,12 +1136,63 @@ export class OnboardingWizard {
         this.keyEditor.disableSubmit = false;
         this.keyEditor.setText('');
     }
+    startOAuth() {
+        this.oauthPresentation = undefined;
+        this.oauthStatus = { kind: 'starting' };
+        this.input.onStartOAuth();
+    }
+    setOAuthPresentation(presentation) {
+        if (this.phase !== 'oauth' ||
+            (this.oauthStatus.kind !== 'starting' && this.oauthStatus.kind !== 'waiting'))
+            return;
+        this.oauthPresentation = presentation;
+        this.oauthStatus = { kind: 'waiting' };
+    }
+    setOAuthCancelling() {
+        if (this.phase !== 'oauth')
+            return;
+        this.oauthStatus = { kind: 'cancelling' };
+    }
+    setOAuthUnconfirmed() {
+        if (this.phase !== 'oauth')
+            return;
+        this.oauthStatus = { kind: 'unconfirmed' };
+    }
+    setOAuthAuthenticated(loadingModels = true) {
+        if (this.phase !== 'oauth')
+            return;
+        this.oauthStatus = { kind: 'authenticated', loadingModels };
+    }
+    setOAuthError(text) {
+        if (this.phase !== 'oauth')
+            return;
+        this.oauthStatus = { kind: 'error', text };
+    }
+    setOAuthModelError(text) {
+        if (this.phase !== 'oauth')
+            return;
+        this.oauthStatus = { kind: 'authenticated', loadingModels: false, modelError: text };
+    }
+    setOAuthCancelled() {
+        if (this.phase !== 'oauth')
+            return;
+        if (this.picked?.target.kind === 'create') {
+            this.phase = 'identity';
+            this.identityFocus = 'slug';
+        }
+        else {
+            this.phase = 'search';
+            this.picked = undefined;
+        }
+        this.status = { kind: 'prompt' };
+        this.oauthPresentation = undefined;
+    }
     /** Runner hook: verify succeeded — advance to the models step with fresh
      *  discovered models. Selection seeds from the picked provider's enabled set
      *  on first entry (existing connections preserve it; new ones start empty);
      *  a re-verify preserves the user's toggles, dropping ids no longer discovered. */
     setModels(models) {
-        if (this.phase !== 'key')
+        if (this.phase !== 'key' && this.phase !== 'oauth')
             return;
         this.models = models;
         if (!this.modelsInitialized) {
@@ -1169,11 +1237,15 @@ export class OnboardingWizard {
         this.modelsSearchEditor.invalidate();
         this.list.invalidate();
     }
-    /** Step label: relays add a base-URL step, create targets an identity one. */
+    /** Step label: create targets add identity; relays add Base URL. */
     stepFor(phase) {
-        const create = this.picked?.target.kind === 'create';
-        const relay = this.picked?.requiresBaseUrl === true;
-        const total = 3 + (create ? 1 : 0) + (relay ? 1 : 0);
+        const selectedItem = this.list.getSelectedItem();
+        const entry = this.picked ??
+            this.filtered.find((candidate) => selectedItem !== null && onboardingProviderKey(candidate) === selectedItem.value);
+        const create = entry?.target.kind === 'create';
+        const oauth = entry?.setupMethod === 'oauth';
+        const relay = entry?.requiresBaseUrl === true;
+        const total = oauth ? 3 + (create ? 1 : 0) : 3 + (create ? 1 : 0) + (relay ? 1 : 0);
         let position = 1;
         if (phase === 'search')
             return `1/${total}`;
@@ -1188,7 +1260,7 @@ export class OnboardingWizard {
                 return `${position}/${total}`;
         }
         position += 1;
-        if (phase === 'key')
+        if (phase === 'key' || phase === 'oauth')
             return `${position}/${total}`;
         return `${total}/${total}`;
     }
@@ -1202,6 +1274,8 @@ export class OnboardingWizard {
                 return this.handleBaseUrlInput(data);
             case 'key':
                 return this.handleKeyInput(data);
+            case 'oauth':
+                return this.handleOAuthInput(data);
             case 'models':
                 return this.handleModelsInput(data);
             case 'success':
@@ -1303,17 +1377,58 @@ export class OnboardingWizard {
             return;
         this.keyEditor.handleInput(data);
     }
+    handleOAuthInput(data) {
+        if (matchesKey(data, Key.ctrl('c'))) {
+            this.input.onCancel();
+            return;
+        }
+        if (matchesKey(data, Key.escape)) {
+            if (this.oauthStatus.kind === 'unconfirmed') {
+                this.input.onCancel();
+                return;
+            }
+            if (this.oauthStatus.kind === 'starting' || this.oauthStatus.kind === 'waiting') {
+                this.oauthStatus = { kind: 'cancelling' };
+                this.input.onCancelOAuth();
+                return;
+            }
+            if (this.oauthStatus.kind === 'authenticated') {
+                this.phase = 'search';
+                this.picked = undefined;
+                this.input.onReturnToProviders();
+            }
+            else if (this.oauthStatus.kind === 'error') {
+                this.setOAuthCancelled();
+                this.input.onBack();
+            }
+            return;
+        }
+        if ((matchesKey(data, Key.enter) || matchesKey(data, Key.return)) && !isKeyRepeat(data)) {
+            if (this.oauthStatus.kind === 'error' || this.oauthStatus.kind === 'unconfirmed')
+                this.startOAuth();
+            else if (this.oauthStatus.kind === 'authenticated' && !this.oauthStatus.loadingModels) {
+                this.oauthStatus = { kind: 'authenticated', loadingModels: true };
+                this.input.onContinueOAuth();
+            }
+        }
+    }
     handleModelsInput(data) {
         if (matchesKey(data, Key.ctrl('c'))) {
             this.input.onCancel();
             return;
         }
         if (matchesKey(data, Key.escape)) {
-            // models → key (one level back); query/selection state survives.
-            this.phase = 'key';
+            // An OAuth login is already durable here: return to its signed-in screen
+            // instead of implying identity/authentication can be rolled back.
+            this.phase = this.picked?.setupMethod === 'oauth' ? 'oauth' : 'key';
             this.status = { kind: 'prompt' };
-            this.keyEditor.setText('');
-            this.keyEditor.disableSubmit = false;
+            if (this.phase === 'oauth') {
+                this.oauthStatus = { kind: 'authenticated', loadingModels: false };
+            }
+            else {
+                this.keyEditor.setText('');
+                this.keyEditor.disableSubmit = false;
+            }
             this.input.onBack();
             return;
         }
@@ -1393,6 +1508,8 @@ export class OnboardingWizard {
                 return this.renderBaseUrl(safeWidth);
             case 'key':
                 return this.renderKey(safeWidth);
+            case 'oauth':
+                return this.renderOAuth(safeWidth);
             case 'models':
                 return this.renderModels(safeWidth);
             case 'success':
@@ -1490,6 +1607,51 @@ export class OnboardingWizard {
                 return ansi.dim(this.copy.submitAction);
         }
     }
+    renderOAuth(width) {
+        this.focusOnly(null);
+        const label = this.picked?.label ?? '';
+        const lines = [
+            padLine(`${this.copy.setupTitle} ${ansi.dim(`· ${this.stepFor('oauth')}`)} ${ansi.accent(label)}`, width),
+            padLine(this.oauthStatus.kind === 'authenticated'
+                ? ansi.dim(this.copy.oauthBackHint)
+                : ansi.dim(this.oauthStatus.kind === 'unconfirmed'
+                    ? this.copy.oauthRecheckAction
+                    : this.copy.oauthHint), width),
+            padLine('', width),
+        ];
+        if (this.oauthPresentation) {
+            lines.push(padLine(this.oauthPresentation.url, width));
+            lines.push(padLine('', width));
+            if (this.oauthPresentation.stateHint) {
+                lines.push(padLine(`${this.copy.oauthCodeLabel}: ${this.oauthPresentation.stateHint}`, width));
+                lines.push(padLine('', width));
+            }
+        }
+        lines.push(padLine(this.renderOAuthStatusLine(), width));
+        lines.push(padLine(ansi.accent('-'.repeat(width)), width));
+        return lines;
+    }
+    renderOAuthStatusLine() {
+        switch (this.oauthStatus.kind) {
+            case 'starting':
+                return `${ansi.yellow('⠋')} ${this.copy.oauthStarting}`;
+            case 'waiting':
+                return `${ansi.yellow('⠋')} ${this.copy.oauthWaiting}`;
+            case 'cancelling':
+                return `${ansi.yellow('⠋')} ${this.copy.oauthCancelling}`;
+            case 'unconfirmed':
+                return ansi.yellow(this.copy.oauthUnconfirmed);
+            case 'authenticated':
+                if (this.oauthStatus.loadingModels) {
+                    return `${ansi.yellow('⠋')} ${this.copy.oauthLoadingModels}`;
+                }
+                return this.oauthStatus.modelError
+                    ? ansi.red(`✗ ${this.copy.oauthRetryModelsAction} · ${this.oauthStatus.modelError}`)
+                    : ansi.green(`✓ ${this.copy.oauthContinueToModels}`);
+            case 'error':
+                return ansi.red(`✗ ${this.oauthStatus.text} · ${this.copy.oauthRetryAction}`);
+        }
+    }
     renderModels(width) {
         this.focusOnly(this.status.kind !== 'saving' ? this.modelsSearchEditor : null);
         const label = this.picked?.label ?? '';