maka-agent 0.2.0-dev.28.20260911 → 0.2.0-dev.29.20260912

package/dist/pi-tui-runner.js

@@ -20,7 +20,7 @@ import { randomUUID } from 'node:crypto';
 import { Key, ProcessTerminal, SelectList, TuiMainScreen, isKeyRelease, isKeyRepeat, matchesKey, } from '@earendil-works/pi-tui';
 import { CurrentTodoStore, TodoOverlay, renderTodoIndicator } from './pi-tui-todo.js';
 import { isThinkingLevel } from '@maka/core/model-thinking';
-import { deriveConnectionSlug, } from '@maka/core/llm-connections';
+import { deriveConnectionSlug } from '@maka/core/llm-connections';
 import { projectRevisionLinkedSessionTree } from '@maka/core/session-revisions';
 import { slashCommandsForSurface, } from '@maka/core/slash-command-catalog';
 import { latestAssistantModelId, } from '@maka/core/session';
@@ -49,7 +49,7 @@ import { CTX_REFRESH_DEBOUNCE_MS, createCtxRefresher, scheduleCtxRefreshTimeout,
 import { sessionStatusBadge } from './tui-session-status.js';
 import { AttentionController, DISABLE_FOCUS_REPORTING, ENABLE_FOCUS_REPORTING, FOCUS_IN_SEQUENCE, FOCUS_OUT_SEQUENCE, } from './tui-attention.js';
 import { MakaActivityStripComponent, MakaPendingQueueComponent, MakaPiLayoutComponent, MakaStatusLineComponent, MakaTranscriptComponent, } from './pi-tui-layout.js';
-import { MakaAutocompleteProvider, DirectoryPickerOverlay, ModelSearchOverlay, SessionSearchOverlay, OnboardingWizard, PickerOverlay, UserQuestionOverlay, modelChoiceConnectionLabels, getTuiPickerCopy, modelPickerItems, onboardingFailureMessage, permissionModePickerItems, skillPickerItems, thinkingLevelPickerItems, } from './pi-tui-pickers.js';
+import { MakaAutocompleteProvider, DirectoryPickerOverlay, ModelSearchOverlay, SessionSearchOverlay, OnboardingWizard, PickerOverlay, UserQuestionOverlay, modelChoiceConnectionLabels, getTuiPickerCopy, modelPickerItems, onboardingFailureMessage, onboardingOAuthFailureMessage, permissionModePickerItems, skillPickerItems, thinkingLevelPickerItems, } from './pi-tui-pickers.js';
 import { formatMakaResumeCommand } from './cli-invocation.js';
 import { goalAttachedNoticeText, goalPausedNoticeText, goalStatusLabel, goalSummaryLines, isLiveGoalStatus, } from './pi-goal.js';
 import { getTuiPrimaryGuidance } from './tui-primary-guidance.js';
@@ -934,9 +934,8 @@ export async function runMakaPiTui(input) {
             requestRender();
         })().catch(reportError);
     };
-    // Onboarding wizard (#1098 UX redesign): one overlay spans provider search
-    // → API key → model curation, keeping every prompt/verifying/failure/saving/
-    // success notice beside the input field instead of the transcript entry flow.
+    // Onboarding wizard (#1098 UX redesign): one overlay spans provider search,
+    // authentication, model curation, and success without transcript notices.
     let wizardOverlay;
     let wizard;
     // The user's supplied key from the key step ('' reuses the stored secret for an
@@ -949,11 +948,7 @@ export async function runMakaPiTui(input) {
     // The existing connection the picked provider resolved to, so saving edits
     // it in place (a Desktop-created relay may live under a custom slug).
     let wizardTarget;
-    // The identity step's answer for a create target. Null halves keep the wire
-    // target bare so any Host vintage accepts it; an edited slug/name rides on
-    // the target and gets `slug_taken` back when it loses.
-    let wizardIdentity = { slug: null, name: null };
-    let wizardModels = [];
+    let wizardOAuthAbort;
     // Authoritative ready model choices for `/model`. A startup snapshot refreshed
     // in place after `/setup` saves so newly configured models are immediately
     // available — the single source the picker and connection/model lookups read.
@@ -976,7 +971,7 @@ export async function runMakaPiTui(input) {
     const currentModelContextWindow = () => currentModelChoice()?.contextWindow ??
         (onInitialTarget() ? input.modelContextWindow : undefined);
     // The Host resolved these when it projected the choice — including a relay's
-    // declared `relayModelProfiles[model].thinkingLevels`. A model no choice
+    // declared `modelOverrides[model].thinkingLevels`. A model no choice
     // describes offers none rather than a locally guessed list.
     const currentThinkingLevels = () => currentModelChoice()?.thinkingLevels ?? [];
     unsubscribeModelCatalogChanges = input.subscribeModelCatalogChanges?.((refresh) => {
@@ -1673,7 +1668,24 @@ export async function runMakaPiTui(input) {
         state.entries.push(pendingNotice);
         requestRender();
         try {
-            const result = await input.driver.rewindToTurn(turnId);
+            const result = await input.driver.rewindToTurn(turnId).catch((error) => {
+                // The driver refuses rewind with a machine code when the selected
+                // turn carries structured context the TUI cannot restore (#5109).
+                // Render the localized catalog copy for that code instead of the
+                // driver's English fallback.
+                const code = error?.code;
+                if (code === 'rewind_unsupported_quotes' ||
+                    code === 'rewind_unsupported_attachments' ||
+                    code === 'rewind_unsupported_directory_references') {
+                    const localized = code === 'rewind_unsupported_quotes'
+                        ? TUI_REWIND_COPY[locale].unsupportedQuotes
+                        : code === 'rewind_unsupported_attachments'
+                            ? TUI_REWIND_COPY[locale].unsupportedAttachments
+                            : TUI_REWIND_COPY[locale].unsupportedDirectoryReferences;
+                    throw new Error(localized);
+                }
+                throw error;
+            });
             await applySwitchResult(result);
             await discardCurrentSidePair();
             // Record the discarded turn's prompt in the editor history before
@@ -1937,6 +1949,8 @@ export async function runMakaPiTui(input) {
         overlay = showBottomPicker(picker);
     };
     const closeWizard = () => {
+        wizardOAuthAbort?.abort();
+        wizardOAuthAbort = undefined;
         wizardAttempt += 1; // drop any in-flight verify/save before clearing the slots
         wizardOverlay?.hide();
         wizardOverlay = undefined;
@@ -1944,8 +1958,108 @@ export async function runMakaPiTui(input) {
         wizardApiKey = '';
         wizardBaseUrl = '';
         wizardTarget = undefined;
-        wizardIdentity = { slug: null, name: null };
-        wizardModels = [];
+    };
+    const discoverWizardOAuthModels = (targetWizard, attempt, target) => {
+        if (!input.onboarding)
+            return;
+        void input.onboarding.verify({ target }).then((result) => {
+            if (closed || wizard !== targetWizard || attempt !== wizardAttempt)
+                return;
+            if (result.kind !== 'ok') {
+                targetWizard.setOAuthModelError(onboardingFailureMessage(result, locale));
+                requestRender();
+                return;
+            }
+            targetWizard.setModels(result.models);
+            requestRender();
+        }, () => {
+            if (closed || wizard !== targetWizard || attempt !== wizardAttempt)
+                return;
+            targetWizard.setOAuthModelError(onboardingFailureMessage({ kind: 'unavailable' }, locale));
+            requestRender();
+        });
+    };
+    const startWizardOAuth = () => {
+        const target = wizardTarget;
+        const targetWizard = wizard;
+        if (!target || !targetWizard)
+            return;
+        if (!input.onboarding?.loginOAuth) {
+            targetWizard.setOAuthError(pickerCopy.onboardingUnavailable);
+            requestRender();
+            return;
+        }
+        wizardOAuthAbort?.abort();
+        const abort = new AbortController();
+        wizardOAuthAbort = abort;
+        const attempt = ++wizardAttempt;
+        requestRender();
+        void input.onboarding
+            .loginOAuth({
+            target,
+            signal: abort.signal,
+            onPresentation: (presentation) => {
+                if (closed || wizard !== targetWizard || attempt !== wizardAttempt)
+                    return;
+                targetWizard.setOAuthPresentation(presentation);
+                requestRender();
+            },
+        })
+            .then((result) => {
+            if (wizardOAuthAbort === abort)
+                wizardOAuthAbort = undefined;
+            if (closed || wizard !== targetWizard || attempt !== wizardAttempt)
+                return;
+            if (result.kind === 'unconfirmed') {
+                targetWizard.setOAuthUnconfirmed();
+                requestRender();
+                return;
+            }
+            if (result.kind === 'cancelled') {
+                targetWizard.setOAuthCancelled();
+                wizardAttempt += 1;
+                requestRender();
+                return;
+            }
+            if (result.kind === 'failed') {
+                const message = onboardingOAuthFailureMessage(result.reason, locale);
+                if (result.reason === 'slug_taken' && target.kind === 'create') {
+                    targetWizard.setIdentityError(message);
+                }
+                else {
+                    targetWizard.setOAuthError(message);
+                }
+                requestRender();
+                return;
+            }
+            const existingTarget = {
+                kind: 'existing',
+                connectionId: result.connection.connectionId,
+            };
+            // Authentication is the durable create/reauthorize commit point. All
+            // later work addresses that exact Connection and never repeats OAuth.
+            wizardTarget = existingTarget;
+            targetWizard.setOAuthAuthenticated();
+            requestRender();
+            discoverWizardOAuthModels(targetWizard, attempt, existingTarget);
+        }, () => {
+            if (wizardOAuthAbort === abort)
+                wizardOAuthAbort = undefined;
+            if (closed || wizard !== targetWizard || attempt !== wizardAttempt)
+                return;
+            targetWizard.setOAuthError(onboardingOAuthFailureMessage('unavailable', locale));
+            requestRender();
+        });
+    };
+    const continueWizardOAuth = () => {
+        const target = wizardTarget;
+        const targetWizard = wizard;
+        if (!targetWizard || target?.kind !== 'existing')
+            return;
+        const attempt = ++wizardAttempt;
+        targetWizard.setOAuthAuthenticated();
+        requestRender();
+        discoverWizardOAuthModels(targetWizard, attempt, target);
     };
     // Key submit from the wizard. Slash commands route as commands (so /exit
     // still escapes the wizard) instead of being stored as an API key; every
@@ -1983,7 +2097,6 @@ export async function runMakaPiTui(input) {
                 requestRender();
                 return;
             }
-            wizardModels = result.models;
             wizard.setModels(result.models); // advance to the models step
             requestRender();
         }, () => {
@@ -2106,15 +2219,12 @@ export async function runMakaPiTui(input) {
                 // reselects the same catalog row. A late save may converge only the
                 // exact target object captured by its own submit.
                 wizardTarget = { ...provider.target };
-                wizardIdentity = { slug: null, name: null };
                 wizardApiKey = '';
                 wizardBaseUrl = '';
-                wizardModels = [];
                 wizardAttempt += 1; // a new pick supersedes any in-flight attempt
                 requestRender();
             },
             onSubmitIdentity: (identity) => {
-                wizardIdentity = identity;
                 if (wizardTarget?.kind === 'create') {
                     wizardTarget = {
                         kind: 'create',
@@ -2130,6 +2240,28 @@ export async function runMakaPiTui(input) {
                 requestRender();
             },
             onSubmitKey: submitWizardKey,
+            onStartOAuth: startWizardOAuth,
+            onCancelOAuth: () => {
+                wizard?.setOAuthCancelling();
+                wizardOAuthAbort?.abort();
+                requestRender();
+            },
+            onContinueOAuth: continueWizardOAuth,
+            onReturnToProviders: () => {
+                const targetWizard = wizard;
+                const attempt = ++wizardAttempt;
+                requestRender();
+                if (!targetWizard || !input.onboarding)
+                    return;
+                void input.onboarding.listProviders().then((providers) => {
+                    if (closed || wizard !== targetWizard || attempt !== wizardAttempt)
+                        return;
+                    targetWizard.setProviders(providers);
+                    requestRender();
+                }, () => {
+                    // Keep the cached list usable if refreshing the saved account fails.
+                });
+            },
             onSubmitModels: submitWizardModels,
             onCancel: () => {
                 closeWizard();

package/dist/runtime-host-onboarding.js

@@ -16,13 +16,58 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { deriveConnectionSlug, offerableCatalogEntries } from '@maka/core/llm-connections';
-import { readRuntimeHostConnectionCatalog, } from '@maka/runtime-host/client';
+import { randomUUID } from 'node:crypto';
+import { deriveConnectionSlug, deriveInteractiveOAuthConnectionSlug, offerableCatalogEntries, providerFallbackModelIds, PROVIDER_REGISTRY, } from '@maka/core/llm-connections';
+import { createOAuthPresentationClientProvider, readRuntimeHostConnectionCatalog, RuntimeHostOperationError, RuntimeHostRequestInterruptedError, } from '@maka/runtime-host/client';
 import { listApiKeyOnboardableProviders } from './onboarding-catalog.js';
 /** Adapt the TUI onboarding workflow to Host-owned verification and persistence. */
-export function createRuntimeHostOnboardingSurface(connection) {
+export function createRuntimeHostOnboardingSurface(connection, options = {}) {
+    const shutdown = new AbortController();
+    // An interrupted observation is not a new login intent. Keep its identity
+    // until a later observation establishes a terminal result on the same root.
+    const oauthAttempts = new Map();
     return {
-        listProviders: async () => projectProviders(await readRuntimeHostConnectionCatalog(connection)),
+        listProviders: async () => {
+            const catalog = await readRuntimeHostConnectionCatalog(connection);
+            let codexOAuthEnabled = false;
+            try {
+                codexOAuthEnabled = (await connection.request('oauth.enrollment.query', { provider: 'openai-codex' })).enabled;
+            }
+            catch {
+                // The API-key catalog remains useful when an older or temporarily
+                // unavailable Host cannot answer the optional OAuth enrollment query.
+            }
+            return projectProviders(catalog, codexOAuthEnabled);
+        },
+        loginOAuth: (input) => {
+            const target = asOAuthTarget(input.target);
+            if (!target)
+                return Promise.resolve({ kind: 'failed', reason: 'unavailable' });
+            const key = JSON.stringify(target);
+            const pending = oauthAttempts.get(key);
+            if (input.signal.aborted || shutdown.signal.aborted) {
+                return Promise.resolve({ kind: pending?.startRequested ? 'unconfirmed' : 'cancelled' });
+            }
+            const attempt = pending ?? {
+                attemptId: (options.createAttemptId ?? randomUUID)(),
+                target,
+                startRequested: false,
+            };
+            // Re-entering the same intent observes its existing result.
+            if (attempt.task)
+                return attempt.task;
+            oauthAttempts.set(key, attempt);
+            const task = runOAuthLogin(input, options, shutdown.signal, attempt);
+            attempt.task = task;
+            void task.then((result) => {
+                attempt.task = undefined;
+                if (result.kind !== 'unconfirmed')
+                    oauthAttempts.delete(key);
+            }, () => {
+                attempt.task = undefined;
+            });
+            return task;
+        },
         verify: async (input) => {
             try {
                 const result = await connection.request('connection.onboarding.verify', {
@@ -79,7 +124,276 @@ export function createRuntimeHostOnboardingSurface(connection) {
                 return { kind: 'unavailable' };
             }
         },
+        close: async () => {
+            shutdown.abort();
+            await Promise.allSettled([...oauthAttempts.values()].map(({ task }) => task));
+            oauthAttempts.clear();
+        },
+    };
+}
+async function runOAuthLogin(input, options, shutdownSignal, attempt) {
+    if (!options.connectOAuth)
+        return { kind: 'failed', reason: 'unavailable' };
+    const signal = AbortSignal.any([input.signal, shutdownSignal]);
+    if (signal.aborted)
+        return { kind: attempt.startRequested ? 'unconfirmed' : 'cancelled' };
+    const requestTimeoutMs = options.requestTimeoutMs ?? 5_000;
+    const shutdownTimeoutMs = options.shutdownTimeoutMs ?? 1_000;
+    const observation = new AbortController();
+    const pollingSignal = AbortSignal.any([signal, observation.signal]);
+    let connected;
+    let stopTimer;
+    let stopDeadline = Number.POSITIVE_INFINITY;
+    const stopAfter = (milliseconds) => {
+        const deadline = Date.now() + milliseconds;
+        if (deadline >= stopDeadline)
+            return;
+        stopDeadline = deadline;
+        clearTimeout(stopTimer);
+        stopTimer = setTimeout(() => observation.abort(), milliseconds);
     };
+    const cancelObservation = () => stopAfter(options.cancellationTimeoutMs ?? requestTimeoutMs);
+    const closeObservation = () => stopAfter(shutdownTimeoutMs);
+    input.signal.addEventListener('abort', cancelObservation, { once: true });
+    shutdownSignal.addEventListener('abort', closeObservation, { once: true });
+    try {
+        const connecting = options.connectOAuth(AbortSignal.any([signal, observation.signal]));
+        void connecting.then((resource) => {
+            // A connector may finish after its observer timed out. It still needs
+            // an owner to release the late connection.
+            if (observation.signal.aborted)
+                void resource.close().catch(() => undefined);
+        }, () => undefined);
+        connected = await waitForOAuthOperation(connecting, undefined, observation.signal);
+        const connection = connected.connection;
+        if (attempt.rootId !== undefined && attempt.rootId !== connection.rootId) {
+            return { kind: 'unconfirmed' };
+        }
+        attempt.rootId = connection.rootId;
+        const provider = createOAuthPresentationClientProvider({
+            openExternal: async (url, stateHint) => {
+                if (!signal.aborted && !observation.signal.aborted) {
+                    input.onPresentation({ url, ...(stateHint === undefined ? {} : { stateHint }) });
+                }
+            },
+        });
+        const connectionKey = () => JSON.stringify([connection.hostEpoch, connection.connectionId]);
+        let presentationConnectionKey;
+        const request = async (operation, input, deadline) => {
+            const remainingTimeout = () => {
+                if (observation.signal.aborted)
+                    throw new Error('OAuth observation ended');
+                const remaining = Math.min(deadline ?? Infinity, stopDeadline) - Date.now();
+                if (remaining <= 0)
+                    throw new Error('OAuth reconciliation timed out');
+                return Math.min(requestTimeoutMs, remaining);
+            };
+            if (operation === 'oauth.login.start') {
+                const current = connectionKey();
+                if (presentationConnectionKey !== current) {
+                    // Capability ownership follows a physical connection. Queries need
+                    // no presentation service; only a start must await its publication.
+                    const timeoutMs = remainingTimeout();
+                    try {
+                        await waitForOAuthOperation(connection.replaceClientCapabilities(provider, timeoutMs), timeoutMs, observation.signal);
+                    }
+                    catch (error) {
+                        if (error instanceof RuntimeHostRequestInterruptedError &&
+                            error.reason === 'connection_lost') {
+                            throw interruptedOAuthStart();
+                        }
+                        throw error;
+                    }
+                    if (current !== connectionKey())
+                        throw interruptedOAuthStart();
+                    presentationConnectionKey = current;
+                }
+                remainingTimeout();
+                if (signal.aborted && !attempt.startRequested)
+                    throw new Error('OAuth cancelled before start');
+                attempt.startRequested = true;
+            }
+            const timeoutMs = remainingTimeout();
+            return waitForOAuthOperation(connection.request(operation, input, timeoutMs), timeoutMs, observation.signal);
+        };
+        const { attemptId, target } = attempt;
+        let projection = await startOAuthAttempt(request, attemptId, target, requestTimeoutMs, attempt.startRequested);
+        let cancellationSent = false;
+        while (!isTerminalOAuthProjection(projection)) {
+            if (signal.aborted && !cancellationSent) {
+                cancellationSent = true;
+                const cancelledProjection = await cancelOAuthAttempt(request, attemptId, requestTimeoutMs);
+                if (!cancelledProjection)
+                    return { kind: 'cancelled' };
+                projection = cancelledProjection;
+                continue;
+            }
+            // Once cancellation has reached the Host, the aborted UI signal must no
+            // longer collapse this delay into a busy query loop while a commit wins.
+            await waitForOAuthPoll(options.pollIntervalMs ?? 250, cancellationSent ? observation.signal : pollingSignal);
+            if (signal.aborted && !cancellationSent)
+                continue;
+            projection = await request('oauth.login.query', { attemptId });
+        }
+        if (projection.phase === 'authenticated') {
+            return { kind: 'authenticated', connection: projection.connection };
+        }
+        if (projection.phase === 'cancelled')
+            return { kind: 'cancelled' };
+        return { kind: 'failed', reason: projection.failure ?? 'internal_failure' };
+    }
+    catch (error) {
+        if (error instanceof RuntimeHostOperationError) {
+            if (attempt.startRequested &&
+                (error.code === 'persistence_failed' ||
+                    error.code === 'internal_failure' ||
+                    (error.code === 'not_found' && error.operation === 'oauth.login.query')))
+                return { kind: 'unconfirmed' };
+            if (error.code === 'not_found')
+                return { kind: 'failed', reason: 'connection_not_found' };
+            if (error.code === 'operation_conflict') {
+                return { kind: 'failed', reason: 'operation_conflict' };
+            }
+            if (error.code === 'slug_taken')
+                return { kind: 'failed', reason: 'slug_taken' };
+            if (error.code === 'capability_unavailable') {
+                return { kind: 'failed', reason: 'capability_unavailable' };
+            }
+            if (error.code === 'persistence_failed' || error.code === 'internal_failure') {
+                return { kind: 'failed', reason: error.code };
+            }
+        }
+        if (attempt.startRequested)
+            return { kind: 'unconfirmed' };
+        return signal.aborted ? { kind: 'cancelled' } : { kind: 'failed', reason: 'unavailable' };
+    }
+    finally {
+        observation.abort();
+        clearTimeout(stopTimer);
+        input.signal.removeEventListener('abort', cancelObservation);
+        shutdownSignal.removeEventListener('abort', closeObservation);
+        if (connected) {
+            const resource = connected;
+            await waitForOAuthOperation(Promise.resolve().then(() => resource.close()), Math.max(1, Math.min(shutdownTimeoutMs, stopDeadline - Date.now()))).catch(() => undefined);
+        }
+    }
+}
+async function startOAuthAttempt(request, attemptId, target, timeoutMs, resume) {
+    const deadline = Date.now() + timeoutMs;
+    if (resume) {
+        try {
+            return await request('oauth.login.query', { attemptId }, deadline);
+        }
+        catch (error) {
+            if (!isOAuthAttemptNotFound(error))
+                throw error;
+        }
+    }
+    while (true) {
+        try {
+            return await request('oauth.login.start', { attemptId, target }, deadline);
+        }
+        catch (error) {
+            if (!isOAuthRequestInterruption(error, 'oauth.login.start'))
+                throw error;
+            try {
+                // A write acknowledged by the local transport may already be running
+                // on the Host. Query the stable attempt identity before retrying the
+                // idempotent start so a lost response cannot create a second login.
+                return await request('oauth.login.query', { attemptId }, deadline);
+            }
+            catch (queryError) {
+                if (!isOAuthAttemptNotFound(queryError))
+                    throw queryError;
+                // No live or durable state is visible yet. Starting again with the same
+                // attemptId is safe and synchronizes with an original handler still
+                // behind the Host start gate, even if local cancellation arrived while
+                // the outcome was unknown.
+            }
+        }
+    }
+}
+async function cancelOAuthAttempt(request, attemptId, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        try {
+            return await request('oauth.login.cancel', { attemptId }, deadline);
+        }
+        catch (error) {
+            if (isOAuthAttemptNotFound(error))
+                return null;
+            if (!isOAuthRequestInterruption(error, 'oauth.login.cancel'))
+                throw error;
+            try {
+                const projection = await request('oauth.login.query', { attemptId }, deadline);
+                if (isTerminalOAuthProjection(projection))
+                    return projection;
+                // A non-terminal query cannot prove that the interrupted cancellation
+                // reached the Host. Cancel again; the operation is attempt-idempotent.
+            }
+            catch (queryError) {
+                if (isOAuthAttemptNotFound(queryError))
+                    return null;
+                throw queryError;
+            }
+        }
+    }
+}
+function interruptedOAuthStart() {
+    return new RuntimeHostRequestInterruptedError('oauth.login.start', 'command', 'not_dispatched', 'connection_lost');
+}
+/** A local observation deadline says nothing about whether the Host committed. */
+function waitForOAuthOperation(task, timeoutMs, signal) {
+    let timeout;
+    let stop;
+    return new Promise((resolve, reject) => {
+        stop = () => reject(new Error('OAuth result could not be confirmed'));
+        if (timeoutMs !== undefined)
+            timeout = setTimeout(stop, timeoutMs);
+        signal?.addEventListener('abort', stop, { once: true });
+        void task.then(resolve, reject);
+        if (signal?.aborted)
+            stop();
+    }).finally(() => {
+        clearTimeout(timeout);
+        signal?.removeEventListener('abort', stop);
+    });
+}
+function isOAuthRequestInterruption(error, operation) {
+    return error instanceof RuntimeHostRequestInterruptedError && error.operation === operation;
+}
+function isOAuthAttemptNotFound(error) {
+    return error instanceof RuntimeHostOperationError && error.code === 'not_found';
+}
+function asOAuthTarget(target) {
+    if (target.kind === 'existing')
+        return { kind: 'existing', connectionId: target.connectionId };
+    return target.providerType === 'openai-codex'
+        ? {
+            kind: 'create',
+            providerType: target.providerType,
+            ...(target.slug === undefined ? {} : { slug: target.slug }),
+            ...(target.name === undefined ? {} : { name: target.name }),
+        }
+        : null;
+}
+function isTerminalOAuthProjection(projection) {
+    return (projection.phase === 'authenticated' ||
+        projection.phase === 'cancelled' ||
+        projection.phase === 'failed');
+}
+function waitForOAuthPoll(milliseconds, signal) {
+    if (milliseconds <= 0 || signal?.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const timeout = setTimeout(done, milliseconds);
+        signal?.addEventListener('abort', done, { once: true });
+        function done() {
+            clearTimeout(timeout);
+            signal?.removeEventListener('abort', done);
+            resolve();
+        }
+    });
 }
 export function projectRuntimeHostModelChoices(catalog) {
     const choices = [];
@@ -113,7 +427,7 @@ export function projectRuntimeHostConnectionIdentities(catalog) {
         enabled: connection.enabled,
     }));
 }
-export function projectProviders(catalog) {
+export function projectProviders(catalog, codexOAuthEnabled = false) {
     const entries = [];
     const existingSlugs = catalog.connections.map((connection) => connection.slug);
     for (const provider of listApiKeyOnboardableProviders()) {
@@ -135,6 +449,32 @@ export function projectProviders(catalog) {
             suggestedSlug: deriveConnectionSlug(provider.providerType, existingSlugs),
             enabledModelIds: [],
         });
+        if (provider.providerType === 'openai' && codexOAuthEnabled) {
+            const providerType = 'openai-codex';
+            const definition = PROVIDER_REGISTRY[providerType];
+            for (const connection of catalog.connections) {
+                if (connection.providerType !== providerType)
+                    continue;
+                entries.push({
+                    providerType,
+                    label: `${connection.name} · ${connection.slug}`,
+                    requiresBaseUrl: false,
+                    setupMethod: 'oauth',
+                    target: { kind: 'existing', connectionId: connection.connectionId },
+                    connectionSlug: connection.slug,
+                    enabledModelIds: [...connection.enabledModelIds],
+                });
+            }
+            entries.push({
+                providerType,
+                label: definition.label,
+                requiresBaseUrl: false,
+                setupMethod: 'oauth',
+                target: { kind: 'create', providerType },
+                suggestedSlug: deriveInteractiveOAuthConnectionSlug(providerType, existingSlugs),
+                enabledModelIds: [...providerFallbackModelIds(definition)],
+            });
+        }
     }
     return entries;
 }

package/dist/runtime-host-session-driver.js

@@ -648,6 +648,24 @@ class RuntimeHostMakaSessionDriverImpl {
         if (promptMessage.origin) {
             throw new Error(`Cannot rewind to turn ${turnId}: Host-triggered prompts are read-only.`);
         }
+        const unsupported = (promptMessage.quotes?.length ?? 0) > 0
+            ? 'rewind_unsupported_quotes'
+            : (promptMessage.attachments?.length ?? 0) > 0
+                ? 'rewind_unsupported_attachments'
+                : (promptMessage.directoryReferences?.length ?? 0) > 0
+                    ? 'rewind_unsupported_directory_references'
+                    : null;
+        if (unsupported) {
+            // Refilling only the human-facing text would silently drop the turn's
+            // structured context from the replacement submit (#5109). Fail closed
+            // until the TUI can carry it. The machine code lets the runner render
+            // a localized notice naming the carrier; the message text is the
+            // depth-of-defence fallback and deliberately promises nothing about
+            // other surfaces.
+            const error = new Error(`Cannot rewind to turn ${turnId}: it carries structured context the TUI cannot restore into the replacement prompt.`);
+            error.code = unsupported;
+            throw error;
+        }
         const targetSessionId = this.#newId();
         for (let attempt = 0; attempt < MAX_CATALOG_ATTEMPTS; attempt += 1) {
             const current = await getRuntimeHostSession(this.#connection, sourceSessionId);