neoagent 2.3.1-beta.6 → 2.3.1-beta.61

package/server/routes/auth.js

@@ -75,6 +75,7 @@ function toUserPayload(user) {
     createdAt: user.created_at || null,
     lastLogin: user.last_login || null,
     hasPassword: Number(user.password_login_enabled || 0) === 1,
+    hasCompletedOnboarding: Number(user.has_completed_onboarding || 0) === 1,
   };
 }
 
@@ -119,7 +120,7 @@ function readAuthenticatedUser(req) {
     return null;
   }
   const user = db.prepare(
-    `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login
+    `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login, has_completed_onboarding
      FROM users
      WHERE id = ?`,
   ).get(req.session.userId);
@@ -322,14 +323,19 @@ router.get('/api/auth/providers/complete', async (req, res) => {
     }
 
     const user = db.prepare(
-      `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login
+      `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login, has_completed_onboarding
        FROM users
        WHERE id = ?`,
     ).get(completion.result.userId);
     if (!user) {
       return res.status(404).json({ error: 'User not found' });
     }
-    if (getTwoFactorStatus(user.id).enabled) {
+    // Skip secondary two-factor when signing in via certain social providers.
+    // Currently skip for Google (`provider === 'google`).
+    const providerKey = String(completion.provider || '').trim();
+    const twoFactor = getTwoFactorStatus(user.id);
+    const skipTwoFactorForProviders = new Set(['google']);
+    if (twoFactor.enabled && !skipTwoFactorForProviders.has(providerKey)) {
       return establishPendingTwoFactorSession(req, res, user);
     }
     updateLastLogin(user.id);
@@ -412,6 +418,7 @@ router.post('/api/auth/register', authLimiter, async (req, res) => {
       password_login_enabled: 1,
       created_at: new Date().toISOString(),
       last_login: null,
+      has_completed_onboarding: 0,
     });
   } catch (err) {
     if (err?.statusCode) {
@@ -443,7 +450,7 @@ router.post('/api/auth/login', authLimiter, async (req, res) => {
     }
 
     const user = db.prepare(
-      `SELECT id, username, email, email_verified_at, password, password_login_enabled, created_at, last_login
+      `SELECT id, username, email, email_verified_at, password, password_login_enabled, created_at, last_login, has_completed_onboarding
        FROM users
        WHERE username = ?`,
     ).get(username);
@@ -494,7 +501,7 @@ router.post('/api/auth/login/2fa', authLimiter, async (req, res) => {
     }
 
     const user = db.prepare(
-      `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login
+      `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login, has_completed_onboarding
        FROM users
        WHERE id = ?`,
     ).get(pendingUserId);
@@ -728,4 +735,18 @@ router.get('/api/auth/me', (req, res) => {
   res.json({ user: toUserPayload(user) });
 });
 
+router.post('/api/auth/onboarding/complete', (req, res) => {
+  const user = readAuthenticatedUser(req);
+  if (!user) {
+    return res.status(401).json({ error: 'Not authenticated' });
+  }
+  try {
+    db.prepare('UPDATE users SET has_completed_onboarding = 1 WHERE id = ?').run(user.id);
+    res.json({ success: true });
+  } catch (err) {
+    console.error('Onboarding complete error:', err);
+    res.status(500).json({ error: 'Failed to update onboarding status' });
+  }
+});
+
 module.exports = router;

package/server/routes/integrations.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const QRCode = require('qrcode');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
@@ -143,6 +144,26 @@ router.get('/oauth/callback', async (req, res) => {
 
 router.use(requireAuth);
 
+router.get('/qr-image', async (req, res) => {
+  try {
+    const data = String(req.query.data || '').trim();
+    if (!data) {
+      return res.status(400).send('Missing QR data.');
+    }
+    const svg = await QRCode.toString(data, {
+      errorCorrectionLevel: 'M',
+      margin: 1,
+      type: 'svg',
+      width: 320,
+    });
+    res.setHeader('Content-Type', 'image/svg+xml; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store, max-age=0');
+    return res.send(svg);
+  } catch (err) {
+    return res.status(400).send(escapeHtml(sanitizeError(err)));
+  }
+});
+
 router.get('/:provider/connect/:sessionId', (req, res) => {
   try {
     const manager = getIntegrationManager(req);
@@ -211,7 +232,7 @@ router.get('/:provider/connect/:sessionId', (req, res) => {
               const status = String(data.status || 'connecting');
               if (status === 'awaiting_qr' && data.qr) {
                 statusEl.textContent = 'Scan this QR code to continue linking.';
-                qrEl.src = 'https://api.qrserver.com/v1/create-qr-code/?data=' + encodeURIComponent(data.qr) + '&size=320x320';
+                qrEl.src = '/api/integrations/qr-image?data=' + encodeURIComponent(data.qr);
                 qrEl.style.display = 'block';
               } else if (status === 'connected') {
                 qrEl.style.display = 'none';
@@ -361,4 +382,90 @@ router.get('/:provider/tools/status', (req, res) => {
   }
 });
 
+router.get('/:provider/config', (req, res) => {
+  try {
+    const manager = getIntegrationManager(req);
+    if (!manager) {
+      throw new Error('Official integration manager is not available on app.locals.integrationManager.');
+    }
+    const provider = manager.getProvider(req.params.provider);
+    if (!provider) {
+      throw new Error(`Unknown integration provider: ${req.params.provider}`);
+    }
+    if (typeof provider.getUserConfig !== 'function') {
+      return res.status(404).json({
+        error: `${provider.label} does not support per-user configuration.`,
+      });
+    }
+    const config = provider.getUserConfig({
+      userId: req.session.userId,
+      agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
+    });
+    res.json({
+      provider: provider.key,
+      config,
+    });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.put('/:provider/config', async (req, res) => {
+  try {
+    const manager = getIntegrationManager(req);
+    if (!manager) {
+      throw new Error('Official integration manager is not available on app.locals.integrationManager.');
+    }
+    const provider = manager.getProvider(req.params.provider);
+    if (!provider) {
+      throw new Error(`Unknown integration provider: ${req.params.provider}`);
+    }
+    if (typeof provider.saveUserConfig !== 'function') {
+      return res.status(404).json({
+        error: `${provider.label} does not support per-user configuration.`,
+      });
+    }
+    const config = await provider.saveUserConfig({
+      userId: req.session.userId,
+      agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
+      config: req.body?.config || req.body || {},
+    });
+    res.json({
+      provider: provider.key,
+      config,
+      saved: true,
+    });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.delete('/:provider/config', async (req, res) => {
+  try {
+    const manager = getIntegrationManager(req);
+    if (!manager) {
+      throw new Error('Official integration manager is not available on app.locals.integrationManager.');
+    }
+    const provider = manager.getProvider(req.params.provider);
+    if (!provider) {
+      throw new Error(`Unknown integration provider: ${req.params.provider}`);
+    }
+    if (typeof provider.clearUserConfig !== 'function') {
+      return res.status(404).json({
+        error: `${provider.label} does not support per-user configuration.`,
+      });
+    }
+    await provider.clearUserConfig({
+      userId: req.session.userId,
+      agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
+    });
+    res.json({
+      provider: provider.key,
+      cleared: true,
+    });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
 module.exports = router;

package/server/routes/memory.js

@@ -1,11 +1,20 @@
 const express = require('express');
 const router = express.Router();
+const rateLimit = require('express-rate-limit');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
 
 router.use(requireAuth);
 
+const apiKeyMutationLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 60,
+  message: { error: 'Too many API key update attempts, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
 function normalizeMemoryIds(value) {
   return [...new Set(
     (Array.isArray(value) ? value : [])
@@ -232,12 +241,12 @@ router.get('/api-keys', (req, res) => {
   res.json(masked);
 });
 
-router.put('/api-keys/:service', (req, res) => {
+router.put('/api-keys/:service', apiKeyMutationLimiter, (req, res) => {
   req.app.locals.memoryManager.setApiKey(req.params.service, req.body.key, req.session.userId);
   res.json({ success: true });
 });
 
-router.delete('/api-keys/:service', (req, res) => {
+router.delete('/api-keys/:service', apiKeyMutationLimiter, (req, res) => {
   req.app.locals.memoryManager.deleteApiKey(req.params.service, req.session.userId);
   res.json({ success: true });
 });

package/server/routes/settings.js

@@ -21,6 +21,9 @@ const {
   ensureDefaultAiSettings,
   normalizeProviderConfigs,
 } = require('../services/ai/settings');
+const {
+  readMeshtasticEnabled,
+} = require('../services/messaging/meshtastic_env');
 const {
   ensureDefaultRuntimeSettings,
   getRuntimeSettings,
@@ -75,6 +78,14 @@ const VOICE_SETTING_KEYS = new Set([
   'voice_live_voice',
 ]);
 
+const ENV_BACKED_SETTING_KEYS = new Set([
+  'meshtastic_enabled',
+]);
+
+const READ_ONLY_ENV_SETTING_KEYS = new Set([
+  'meshtastic_enabled',
+]);
+
 function toOptionalTrimmedString(value) {
   if (typeof value !== 'string') return undefined;
   const trimmed = value.trim();
@@ -151,6 +162,38 @@ function applyHeadlessSetting(req, value) {
     .catch(() => { });
 }
 
+function isEnvBackedSettingKey(key) {
+  return ENV_BACKED_SETTING_KEYS.has(key);
+}
+
+function readEnvBackedSettingValue(key) {
+  switch (key) {
+    case 'meshtastic_enabled':
+      return readMeshtasticEnabled();
+    default:
+      return null;
+  }
+}
+
+async function writeEnvBackedSettingValue(req, key, value) {
+  switch (key) {
+    case 'meshtastic_enabled':
+      return readMeshtasticEnabled();
+    default:
+      return value;
+  }
+}
+
+async function resetEnvBackedSettingValue(req, key) {
+  switch (key) {
+    case 'meshtastic_enabled': {
+      return;
+    }
+    default:
+      return;
+  }
+}
+
 // Get supported models metadata
 router.get('/meta/models', async (req, res) => {
   const { getSupportedModels } = require('../services/ai/models');
@@ -209,11 +252,12 @@ router.get('/', (req, res) => {
   }
   settings.agentId = agentId;
   settings.ai_provider_configs = normalizeProviderConfigs(settings.ai_provider_configs);
+  settings.meshtastic_enabled = readMeshtasticEnabled();
   res.json(settings);
 });
 
 // Update settings (batch)
-router.put('/', (req, res) => {
+router.put('/', async (req, res) => {
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   ensureDefaultAiSettings(userId, agentId);
@@ -238,6 +282,16 @@ router.put('/', (req, res) => {
     normalizedBody.ai_provider_configs = normalizeProviderConfigs(normalizedBody.ai_provider_configs);
   }
 
+  for (const key of Object.keys(normalizedBody)) {
+    if (READ_ONLY_ENV_SETTING_KEYS.has(key)) {
+      delete normalizedBody[key];
+      continue;
+    }
+    if (isEnvBackedSettingKey(key)) {
+      normalizedBody[key] = await writeEnvBackedSettingValue(req, key, normalizedBody[key]);
+    }
+  }
+
   if (
     'runtime_profile' in normalizedBody
     || 'runtime_backend' in normalizedBody
@@ -264,6 +318,8 @@ router.put('/', (req, res) => {
       const v = serializeRuntimeSettingValue(key, value);
       if (isAgentScopedSettingKey(key)) {
         upsertAgent.run(userId, agentId, key, v);
+      } else if (isEnvBackedSettingKey(key)) {
+        continue;
       } else if (key !== 'agentId' && key !== 'agent_id') {
         upsert.run(userId, key, v);
       }
@@ -377,6 +433,9 @@ router.get('/token-usage/summary', (req, res) => {
 
 // Get single setting
 router.get('/:key', (req, res) => {
+  if (isEnvBackedSettingKey(req.params.key)) {
+    return res.json({ value: readEnvBackedSettingValue(req.params.key) });
+  }
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   ensureDefaultRuntimeSettings(userId);
@@ -401,11 +460,22 @@ router.get('/:key', (req, res) => {
 });
 
 // Set single setting
-router.put('/:key', (req, res) => {
+router.put('/:key', async (req, res) => {
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   ensureDefaultRuntimeSettings(userId);
   let value = req.body.value;
+  if (READ_ONLY_ENV_SETTING_KEYS.has(req.params.key)) {
+    return res.status(403).json({
+      success: false,
+      error: `${req.params.key} is managed via environment only`,
+      value: readEnvBackedSettingValue(req.params.key),
+    });
+  }
+  if (isEnvBackedSettingKey(req.params.key)) {
+    const saved = await writeEnvBackedSettingValue(req, req.params.key, value);
+    return res.json({ success: true, value: saved });
+  }
   if (req.params.key === 'platform_whitelist_whatsapp') {
     if (typeof value === 'string') {
       try {
@@ -467,6 +537,18 @@ router.put('/:key', (req, res) => {
 
 // Delete setting
 router.delete('/:key', (req, res) => {
+  if (READ_ONLY_ENV_SETTING_KEYS.has(req.params.key)) {
+    return res.status(403).json({
+      success: false,
+      error: `${req.params.key} is managed via environment only`,
+      value: readEnvBackedSettingValue(req.params.key),
+    });
+  }
+  if (isEnvBackedSettingKey(req.params.key)) {
+    return resetEnvBackedSettingValue(req, req.params.key)
+      .then(() => res.json({ success: true }))
+      .catch((err) => res.status(500).json({ success: false, error: err.message }));
+  }
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   if (

package/server/routes/wearable.js

@@ -0,0 +1,67 @@
+'use strict';
+
+const express = require('express');
+const { requireAuth } = require('../middleware/auth');
+const { sanitizeError } = require('../utils/security');
+
+const router = express.Router();
+
+function wearableService(req) {
+  return req.app?.locals?.wearableService || null;
+}
+
+// Intentionally public so an already-provisioned wearable can sync local time
+// before the user finishes session-based pairing on the device.
+router.get('/timezone', (req, res) => {
+  try {
+    const service = wearableService(req);
+    if (!service) {
+      return res.status(500).json({ error: 'Wearable service unavailable.' });
+    }
+    res.json(service.buildTimeConfig(req));
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.use(requireAuth);
+
+router.get('/bootstrap', async (req, res) => {
+  try {
+    const service = wearableService(req);
+    if (!service) {
+      return res.status(500).json({ error: 'Wearable service unavailable.' });
+    }
+    res.json(await service.buildBootstrap(req));
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.get('/firmware/manifest', async (req, res) => {
+  try {
+    const service = wearableService(req);
+    if (!service) {
+      return res.status(500).json({ error: 'Wearable service unavailable.' });
+    }
+    res.json(await service.buildFirmwareManifest(req));
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.get('/connections', (req, res) => {
+  try {
+    const service = wearableService(req);
+    if (!service) {
+      return res.status(500).json({ error: 'Wearable service unavailable.' });
+    }
+    res.json({
+      connections: service.listConnections(req.session.userId),
+    });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err) });
+  }
+});
+
+module.exports = router;

package/server/services/ai/engine.js

@@ -38,8 +38,8 @@ const {
   normalizeInterimKind,
 } = require('./interim');
 
-const MAX_CONSECUTIVE_TOOL_FAILURES = 3;
-const WIDGET_REFRESH_MAX_ITERATIONS = 6;
+const MAX_CONSECUTIVE_TOOL_FAILURES = 5;
+const WIDGET_REFRESH_MAX_ITERATIONS = 30;
 
 function generateTitle(task) {
   if (!task || typeof task !== 'string') return 'Untitled';
@@ -1551,6 +1551,7 @@ class AgentEngine {
       agentId,
       triggerType,
       triggerSource,
+      widgetId: options.widgetId || null,
     });
     const mcpManager = app?.locals?.mcpManager || app?.locals?.mcpClient || this.mcpManager;
     const integrationManager = app?.locals?.integrationManager || null;

package/server/services/ai/models.js

@@ -3,6 +3,8 @@ const { GoogleProvider } = require('./providers/google');
 const { GrokProvider } = require('./providers/grok');
 const { OllamaProvider } = require('./providers/ollama');
 const { OpenAIProvider } = require('./providers/openai');
+const { GithubCopilotProvider } = require('./providers/githubCopilot');
+const { OpenAICodexProvider } = require('./providers/openaiCodex');
 const {
     AI_PROVIDER_DEFINITIONS,
     getProviderConfigs,
@@ -16,6 +18,30 @@ const STATIC_MODELS = [
         provider: 'grok',
         purpose: 'general'
     },
+    {
+        id: 'gpt-5.3',
+        label: 'GPT-5.3 (Copilot Default)',
+        provider: 'github-copilot',
+        purpose: 'general'
+    },
+    {
+        id: 'gpt-4.1',
+        label: 'GPT-4.1 (Copilot Fast)',
+        provider: 'github-copilot',
+        purpose: 'coding'
+    },
+    {
+        id: 'gpt-5.3-codex',
+        label: 'GPT-5.3 (Codex Default)',
+        provider: 'openai-codex',
+        purpose: 'general'
+    },
+    {
+        id: 'gpt-4.1-codex',
+        label: 'GPT-4.1 (Codex Fast)',
+        provider: 'openai-codex',
+        purpose: 'coding'
+    },
     {
         id: 'gpt-5-nano',
         label: 'GPT-5 Nano (Fast / Subagents)',
@@ -302,6 +328,10 @@ function createProviderInstance(providerStr, userId = null, configOverrides = {}
         return new AnthropicProvider({ apiKey: runtime.apiKey, baseUrl: runtime.baseUrl, ...providerOverrides });
     } else if (providerStr === 'ollama') {
         return new OllamaProvider({ baseUrl: runtime.baseUrl, ...providerOverrides });
+    } else if (providerStr === 'github-copilot') {
+        return new GithubCopilotProvider({ apiKey: runtime.apiKey, ...providerOverrides });
+    } else if (providerStr === 'openai-codex') {
+        return new OpenAICodexProvider({ apiKey: runtime.apiKey, ...providerOverrides });
     }
     throw new Error(`Unknown provider: ${providerStr}`);
 }

package/server/services/ai/providers/githubCopilot.js

@@ -0,0 +1,97 @@
+const { OpenAIProvider } = require('./openai');
+
+class GithubCopilotProvider extends OpenAIProvider {
+  constructor(config = {}) {
+    // GitHub Copilot base URL defaults to the individual endpoint
+    const defaultBaseUrl = 'https://api.individual.githubcopilot.com';
+    const baseUrl = config.baseUrl || process.env.GITHUB_COPILOT_BASE_URL || defaultBaseUrl;
+
+    super({
+      ...config,
+      apiKey: config.apiKey || process.env.GITHUB_COPILOT_ACCESS_TOKEN,
+      baseUrl,
+      // Pass special headers required by GitHub Copilot
+      defaultHeaders: {
+        'Editor-Version': 'vscode/1.90.0',
+        'Editor-Plugin-Version': 'copilot-chat/0.15.0',
+        'User-Agent': 'GithubCopilot/1.155.0',
+        'X-Github-Api-Version': '2023-07-07',
+        'Copilot-Integration-Id': 'vscode-chat'
+      }
+    });
+    this.name = 'github-copilot';
+    this.githubToken = config.apiKey || process.env.GITHUB_COPILOT_ACCESS_TOKEN;
+    this.copilotToken = null;
+    this.tokenExpiresAt = 0;
+    this._refreshPromise = null;
+  }
+
+  async _refreshCopilotToken() {
+    if (this._refreshPromise) return this._refreshPromise;
+
+    const now = Math.floor(Date.now() / 1000);
+    // Refresh token if missing or expiring in less than 5 minutes
+    if (this.copilotToken && this.tokenExpiresAt >= now + 300) {
+      return;
+    }
+
+    this._refreshPromise = (async () => {
+      try {
+        if (!this.githubToken) {
+          throw new Error('GitHub Copilot access token is missing. Please run `neoagent login github-copilot`.');
+        }
+
+        const res = await fetch('https://api.github.com/copilot_internal/v2/token', {
+          headers: {
+            'Authorization': `token ${this.githubToken}`,
+            'Accept': 'application/json',
+            'User-Agent': 'NeoAgent/1.0.0'
+          }
+        });
+
+        if (!res.ok) {
+          const errorText = await res.text().catch(() => 'Unknown error');
+          throw new Error(`Failed to refresh GitHub Copilot token: HTTP ${res.status} - ${errorText}`);
+        }
+
+        const data = await res.json();
+        if (!data || typeof data.token !== 'string' || !data.token) {
+          throw new Error('Invalid token response from GitHub Copilot.');
+        }
+
+        this.copilotToken = data.token;
+        this.tokenExpiresAt = typeof data.expires_at === 'number'
+          ? data.expires_at
+          : Math.floor(new Date(data.expires_at).getTime() / 1000);
+
+        if (isNaN(this.tokenExpiresAt)) {
+          this.tokenExpiresAt = Math.floor(Date.now() / 1000) + 1800;
+        }
+
+        // Update the client's API key
+        this.client.apiKey = this.copilotToken;
+      } finally {
+        this._refreshPromise = null;
+      }
+    })();
+
+    return this._refreshPromise;
+  }
+
+  async chat(messages, tools = [], options = {}) {
+    await this._refreshCopilotToken();
+    return super.chat(messages, tools, options);
+  }
+
+  async *stream(messages, tools = [], options = {}) {
+    await this._refreshCopilotToken();
+    yield* super.stream(messages, tools, options);
+  }
+
+  async analyzeImage(options = {}) {
+    await this._refreshCopilotToken();
+    return super.analyzeImage(options);
+  }
+}
+
+module.exports = { GithubCopilotProvider };

package/server/services/ai/providers/openai.js

@@ -29,7 +29,8 @@ class OpenAIProvider extends BaseProvider {
     };
     this.client = new OpenAI({
       apiKey: config.apiKey || process.env.OPENAI_API_KEY,
-      baseURL: config.baseUrl || process.env.OPENAI_BASE_URL || undefined
+      baseURL: config.baseUrl || process.env.OPENAI_BASE_URL || undefined,
+      defaultHeaders: config.defaultHeaders || undefined
     });
   }
 

package/server/services/ai/providers/openaiCodex.js

@@ -0,0 +1,31 @@
+const { OpenAIProvider } = require('./openai');
+
+class OpenAICodexProvider extends OpenAIProvider {
+  constructor(config = {}) {
+    const officialBaseUrl = 'https://api.openai.com/v1';
+    const baseUrl = config.baseUrl || process.env.OPENAI_CODEX_BASE_URL || 'https://chatgpt.com/backend-api/codex';
+    
+    if (!baseUrl.includes('api.openai.com') && !baseUrl.includes('chatgpt.com')) {
+      console.warn(`[OpenAICodex] Using non-official base URL: ${baseUrl}`);
+    } else if (baseUrl.includes('chatgpt.com')) {
+      console.info(`[OpenAICodex] Using ChatGPT subscription endpoint: ${baseUrl}`);
+    }
+
+    super({
+      ...config,
+      apiKey: config.apiKey || process.env.OPENAI_CODEX_ACCESS_TOKEN,
+      baseUrl,
+      defaultHeaders: {
+        'Editor-Version': process.env.OPENAI_CODEX_EDITOR_VERSION || 'vscode/1.99.0',
+        'Editor-Plugin-Version': process.env.OPENAI_CODEX_EDITOR_PLUGIN_VERSION || 'neoagent/1.0.0',
+        'User-Agent': process.env.OPENAI_CODEX_USER_AGENT || 'NeoAgent/1.0.0'
+      }
+    });
+    this.name = 'openai-codex';
+  }
+
+  // OpenAI Codex (subscription-based) uses the OAuth token directly as the API key.
+  // The base URL routes it through the ChatGPT backend-api.
+}
+
+module.exports = { OpenAICodexProvider };