sanook-cli 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## Unreleased
 
+### Fix: couldn't type in the REPL after first-run setup
+
+The setup wizard and the REPL were two separate Ink renders (`render(SetupWizard)` → `unmount` → `render(App)`). After the first Ink instance unmounted, stdin raw-mode/keypress handling didn't reattach to the second, so the chat input was dead — you couldn't type anything. Now the wizard, the brain wizard, and the REPL live under **one Ink render** (a `Root` component swaps screens), so stdin stays continuous and input works the moment the REPL appears. (Regression-tested with ink-testing-library: typed characters reach the input box; phase routing verified.)
+
+### Setup/first-run audit — 8 bugs found by adversarial review, all fixed
+
+A multi-agent review of the first-run + setup + REPL flow surfaced (and independently verified) eight real, user-facing bugs — now fixed and regression-tested:
+
+- **Empty API key silently completed setup.** `@inkjs/ui` PasswordInput fires `onSubmit` on Enter even when empty, so pressing Enter on a blank key advanced the wizard, finished, and saved *no key* — the first message then failed with "no API key" and no way back. The key step now rejects an empty submit (stays put, shows an inline error).
+- **Wizard accepted OAuth/malformed keys it explicitly warned against.** The key step now runs the same `assertDirectApiKey` policy the runtime uses — paste a `sk-ant-oat…` subscription token and it's rejected *at the input* with a clear message, instead of being saved and blowing up later.
+- **No way back from the key/model steps.** Picking the wrong provider dead-ended you into typing a key for the wrong service (Ctrl+C was the only escape). **Esc now returns to provider selection** from any step.
+- **First-run env-detect trusted banned tokens.** An exported OAuth token (`ANTHROPIC_API_KEY=sk-ant-oat…`) made sanook print "✅ ready" and skip the wizard, then error on every message. `detectEnvProvider` now validates the key against policy (new `hasUsableEnvKey`) and falls through to the wizard when it's unusable.
+- **First-run ignored an explicit `-m` flag.** `sanook -m groq` on a machine with only `OPENAI_API_KEY` printed "OpenAI ready" and ran a keyless Groq session. First-run now keys off the `-m` provider when given.
+- **Codex auth step could wedge.** `detectCodex` had no timeout, so a hung `codex` binary left the step with no way forward. Added a 5s timeout (+ Esc always backs out).
+- **Brain wizard name fields were pre-filled with the literal default** (`Owner` / `ผู้ช่วย`), so typing a custom name produced `OwnerPick`. Switched to a placeholder so the field starts empty (Enter still accepts the default).
+- **Banner showed a stale model after `/model`.** It now tracks the live model.
+
+### Fix: duplicate / empty model choices in the setup wizard
+
+`mergeModelOptions` only deduped *remote* model ids against the curated list — never the curated list against itself. So aliases pointing at the same id rendered as **two identical-looking choices** (e.g. `haiku — claude-haiku-4-5` and `fast — claude-haiku-4-5`; OpenAI's `smart`/`gpt` both → `gpt-5.5`), which also collided on React keys (`Encountered two children with the same key` → options could duplicate or vanish). It now groups by model id and merges the alias names into one option (`haiku / fast — claude-haiku-4-5`). Separately, the old code dropped the `default` alias entirely, which **emptied the model list for LM Studio** (`{ default: 'local-model' }`) and hid Ollama's `qwen3` — those models are now selectable again. Locked in with tests (every provider yields unique option values; LM Studio/Ollama are non-empty).
+
+### Setup wizard — better provider selection + working OpenAI Codex login
+
+- **Provider menu**: each option now shows a one-line hint — `✓ เจอ key ใน env`, `local · ไม่ต้อง key`, `login ChatGPT · ไม่ใช้ API key`, or `ต้องมี API key` — and the list is ordered (popular cloud → others → local → Codex). The API-key step shows the expected key format.
+- **OpenAI Codex (ChatGPT plan)**: picking Codex used to skip straight past auth. It now runs a dedicated step that detects whether the `codex` CLI is installed and logged in (reads `~/.codex/auth.json` — robust inside sandboxes where `codex login status` can panic), and guides you: `npm i -g @openai/codex` → `codex login` → re-check, then continues automatically once you're signed in. No API key required.
+- **Codex runs**: `codex exec` now passes `--ask-for-approval never` (no hang waiting on approvals; safe under the default read-only sandbox) and removes `OPENAI_API_KEY` from the child env so it can't fight the ChatGPT-plan login (codex #2733/#3286). Verified the exact CLI surface against the official OpenAI Codex docs.
+
+## 0.5.0
+
 ### Install UX — `sanook doctor` + post-install guidance (the "`sanook` is not recognized" fix)
 
 The #1 first-run snag is `npm i sanook-cli` **without `-g`** → a local install that never lands on PATH, so typing `sanook` fails. Two root-cause fixes:

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { runAgent } from './loop.js';
 import { redactKey } from './providers/keys.js';
-import { specKey, parseSpec, PROVIDERS, consoleUrl, detectEnvProvider } from './providers/registry.js';
+import { specKey, parseSpec, PROVIDERS, consoleUrl, detectEnvProvider, hasUsableEnvKey } from './providers/registry.js';
 import { resolveKeyFromEnv } from './providers/keys.js';
 import { hasPricingForKey } from './cost.js';
 import { loadConfig, isFirstRun, loadKeysIntoEnv, parsePricingOverride } from './config.js';
@@ -769,19 +769,21 @@ async function main() {
         return;
     }
     await maybePromptForInteractiveUpdate();
-    // interactive — ครั้งแรก (ยังไม่มี config)
+    // interactive — ครั้งแรก (ยังไม่มี config): ถ้าไม่มี key ใช้ได้ใน env → ต้องโชว์ wizard
+    let needsSetup = false;
     if (await isFirstRun()) {
-        const detected = detectEnvProvider();
-        if (detected) {
-            // มี API key ใน env แล้ว → ข้าม wizard, ตั้ง default ให้ตรง provider นั้น, บอกว่าพร้อมใช้
+        // provider เป้าหมาย: เคารพ -m ที่ user ใส่ก่อน (กันขึ้น "พร้อมใช้" ผิด provider), ไม่งั้น scan env ตามนิยม
+        const flagProvider = model ? parseSpec(model).provider : undefined;
+        const target = flagProvider ?? detectEnvProvider()?.provider;
+        const tcfg = target ? PROVIDERS[target] : undefined;
+        if (target && tcfg && hasUsableEnvKey(target)) {
+            // มี key ใช้ได้จริง (ผ่าน policy ไม่ใช่ OAuth) → ข้าม wizard, ตั้ง default, บอกว่าพร้อมใช้
             const { saveGlobalConfig } = await import('./config.js');
-            await saveGlobalConfig({ model: `${detected.provider}:${detected.model}`, provider: detected.provider });
-            console.log(`✅ เจอ ${detected.label} (${detected.envVar}) — พร้อมใช้เลย (ข้าม setup wizard)\n`);
+            await saveGlobalConfig({ model: model ?? `${target}:${tcfg.models.default}`, provider: target });
+            console.log(`✅ ${tcfg.label} พร้อมใช้เลย (ข้าม setup wizard)\n`);
         }
         else {
-            const { startSetup } = await import('./ui/render.js'); // ไม่มี key → wizard ทีละขั้น
-            await startSetup();
-            console.log('✅ ตั้งค่าเสร็จ — พิมพ์งานในช่อง › ได้เลย (/help ดูคำสั่ง)\n');
+            needsSetup = true; // ไม่มี provider ที่ key ใช้ได้ (หรือ -m provider ไม่มี key) → wizard (รัน Ink เดียวกับ REPL)
         }
     }
     const config = await loadConfig({ model, budgetUsd });
@@ -789,13 +791,16 @@ async function main() {
     const initialHistory = argv.includes('--continue') || argv.includes('-c') || argv.includes('--continue-any')
         ? (await latestSession(argv.includes('--continue-any') ? null : process.cwd()))?.messages
         : undefined;
-    const { startRepl } = await import('./ui/render.js');
-    startRepl({
-        initialModel: config.model,
-        fallbackModel: config.fallbackModel,
-        budgetUsd: config.budgetUsd,
-        permissionMode: yes ? 'auto' : config.permissionMode,
-        initialHistory,
+    const { startApp } = await import('./ui/render.js');
+    startApp({
+        needsSetup,
+        appProps: {
+            initialModel: config.model,
+            fallbackModel: config.fallbackModel,
+            budgetUsd: config.budgetUsd,
+            permissionMode: yes ? 'auto' : config.permissionMode,
+            initialHistory,
+        },
     });
 }
 main().catch((err) => {

package/dist/providers/codex.js

@@ -6,8 +6,19 @@ import { join } from 'node:path';
 export async function detectCodex() {
     const hasBinary = await new Promise((resolve) => {
         const p = spawn('codex', ['--version'], { shell: process.platform === 'win32' });
-        p.on('error', () => resolve(false));
-        p.on('close', (code) => resolve(code === 0));
+        // timeout: binary ค้าง (shim รอ stdin / Gatekeeper stall ตอนรันครั้งแรกบน macOS) → ไม่ให้ wizard ตัน
+        const timer = setTimeout(() => {
+            p.kill();
+            resolve(false);
+        }, 5000);
+        p.on('error', () => {
+            clearTimeout(timer);
+            resolve(false);
+        });
+        p.on('close', (code) => {
+            clearTimeout(timer);
+            resolve(code === 0);
+        });
     });
     if (!hasBinary) {
         return { installed: false, loggedIn: false, reason: 'ไม่พบ codex CLI — ติดตั้ง: npm i -g @openai/codex' };
@@ -26,16 +37,19 @@ export async function detectCodex() {
  * tolerant ต่อ malformed JSONL (codex bug #15451: --json ถูก ignore เมื่อมี tools active)
  */
 export async function runCodex(opts) {
-    const args = ['exec', '--skip-git-repo-check', '--sandbox', opts.sandbox ?? 'read-only', '--json'];
+    // --ask-for-approval never: รัน non-interactive ไม่ค้างรอ approval (ปลอดภัยเพราะ default sandbox = read-only)
+    const args = ['exec', '--skip-git-repo-check', '--sandbox', opts.sandbox ?? 'read-only', '--ask-for-approval', 'never', '--json'];
     if (opts.model)
         args.push('-m', opts.model);
     if (opts.resumeThreadId)
         args.push('resume', opts.resumeThreadId);
     args.push('-'); // prompt via stdin
     return new Promise((resolve, reject) => {
-        // OPENAI_API_KEY='' กัน BYOK key ของ Sanook ไป override ChatGPT login ของ codex
-        const env = { ...process.env, OPENAI_API_KEY: '' };
-        const p = spawn('codex', args, { env, shell: process.platform === 'win32' }); // Windows: codex.cmd
+        // ลบ OPENAI_API_KEY ออกจาก env ของ child — กัน BYOK key ของ Sanook ไป override/ชนกับ ChatGPT login
+        // (codex bug #2733/#3286: ตั้ง OPENAI_API_KEY ค้าง env ทำให้ ChatGPT-plan auth วน loop sign-in)
+        const env = { ...process.env };
+        delete env.OPENAI_API_KEY;
+        const p = spawn('codex', args, { env, shell: process.platform === 'win32' }); // Windows: codex = JS shim ผ่าน .cmd → ต้อง shell
         let finalText = '';
         let threadId;
         let buf = '';

package/dist/providers/models.js

@@ -43,13 +43,29 @@ export async function listRemoteModels(cfg, key, timeoutMs = 6000) {
 }
 /**
  * merge: curated alias (registry — มี label สื่อความหมาย) นำหน้า + remote id ที่เหลือต่อท้าย
- * dedup ด้วย model id (ไม่โชว์ id ซ้ำสองครั้ง). ใช้ทั้ง setup wizard และ /model picker
+ * dedup ด้วย model id — alias หลายตัวที่ชี้ id เดียวกัน (เช่น haiku/fast → claude-haiku-4-5,
+ * smart/gpt → gpt-5.5) ต้องรวมเป็น "haiku / fast — id" บรรทัดเดียว ไม่งั้น value ซ้ำ → React key ชน
+ * → ตัวเลือกโผล่ซ้ำ/หาย (bug "มีตัวเลือกสองตัวเลือกเป็น model เดียวกัน"). ใช้ทั้ง setup wizard และ /model picker
  */
 export function mergeModelOptions(cfg, remote = []) {
-    const curated = Object.entries(cfg.models)
-        .filter(([alias]) => alias !== 'default')
-        .map(([alias, id]) => ({ id, label: `${alias} — ${id}` }));
-    const seen = new Set(curated.map((c) => c.id));
-    const extra = remote.filter((id) => !seen.has(id)).map((id) => ({ id, label: id }));
+    // group alias ทั้งหมดตาม id (รวม 'default' ด้วย — กัน id ที่มีแต่ alias 'default' เช่น lmstudio:local-model,
+    // ollama:qwen3 หายไปจนเลือกไม่ได้/Select ว่าง). ตอนทำ label ค่อยซ่อนคำ "default" ถ้ามีชื่ออื่นอยู่แล้ว
+    const aliasesById = new Map();
+    const order = []; // คง first-seen order ของ id
+    for (const [alias, id] of Object.entries(cfg.models)) {
+        if (!aliasesById.has(id)) {
+            aliasesById.set(id, []);
+            order.push(id);
+        }
+        aliasesById.get(id)?.push(alias);
+    }
+    const curated = order.map((id) => {
+        const aliases = aliasesById.get(id) ?? [];
+        const named = aliases.filter((a) => a !== 'default');
+        const shown = named.length ? named : aliases; // มีแต่ 'default' → โชว์ 'default' (ดีกว่าซ่อน id หายไป)
+        return { id, label: `${shown.join(' / ')} — ${id}` };
+    });
+    const seen = new Set(order);
+    const extra = [...new Set(remote)].filter((id) => id && !seen.has(id)).map((id) => ({ id, label: id }));
     return [...curated, ...extra].map((o) => ({ label: o.label, value: o.id }));
 }

package/dist/providers/registry.js

@@ -236,11 +236,33 @@ const CONSOLE_URLS = {
 export function consoleUrl(provider) {
     return CONSOLE_URLS[provider];
 }
-/** หา provider ที่ "มี key ใน env แล้ว" (cloud, ตามลำดับนิยม) — ใช้ทำ first-run smart skip + แนะ headless */
+/**
+ * provider นี้มี key ใน env ที่ "ใช้ได้จริง" ไหม — มี key + ผ่าน policy (ไม่ใช่ OAuth/subscription token
+ * หรือ format ผิด). ใช้ทั้ง first-run smart-skip และ -m flag เพื่อไม่ให้ข้าม wizard ทั้งที่ key ใช้ไม่ได้
+ * (เช่น export ANTHROPIC_API_KEY=sk-ant-oat… → ถูกแบน → ต้องเข้า wizard ไม่ใช่ขึ้น "พร้อมใช้")
+ */
+export function hasUsableEnvKey(provider) {
+    const cfg = PROVIDERS[provider];
+    if (!cfg)
+        return false;
+    if (!cfg.requiresKey)
+        return true; // local — ไม่ต้อง key
+    const k = resolveKeyFromEnv(cfg.envVar, cfg.envFallbacks);
+    if (!k)
+        return false;
+    try {
+        assertDirectApiKey(cfg, k); // reject OAuth prefix / format ผิด
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** หา provider ที่ "มี key ใช้ได้จริงใน env" (cloud, ตามลำดับนิยม) — ใช้ทำ first-run smart skip + แนะ headless */
 export function detectEnvProvider() {
     for (const id of ['anthropic', 'openai', 'google', 'deepseek', 'xai', 'mistral', 'groq', 'glm', 'minimax']) {
         const cfg = PROVIDERS[id];
-        if (cfg?.requiresKey && resolveKeyFromEnv(cfg.envVar, cfg.envFallbacks)) {
+        if (cfg?.requiresKey && hasUsableEnvKey(id)) {
             return { provider: id, label: cfg.label, envVar: cfg.envVar, model: cfg.models.default };
         }
     }

package/dist/ui/app.js

@@ -18,11 +18,16 @@ import { BRAND } from '../brand.js';
 import { Banner } from './banner.js';
 const execFileP = promisify(execFile);
 const PRE_TURN_COMPACT_TOKENS = 100_000; // session ยาวมากเท่านั้นถึง summarize ก่อน turn (mode summarize)
-export function App({ initialModel, fallbackModel, budgetUsd, permissionMode = 'ask', initialHistory }) {
+export function App({ initialModel, fallbackModel, budgetUsd, permissionMode = 'ask', initialHistory, initialNote }) {
     const { exit } = useApp();
-    const [history, setHistory] = useState(initialHistory?.length
-        ? [{ id: -1, role: 'system', text: `↻ ต่อจาก session ก่อน (${initialHistory.length} ข้อความ)` }]
-        : []);
+    const [history, setHistory] = useState(() => {
+        const seed = [];
+        if (initialNote)
+            seed.push({ id: -2, role: 'system', text: initialNote });
+        if (initialHistory?.length)
+            seed.push({ id: -1, role: 'system', text: `↻ ต่อจาก session ก่อน (${initialHistory.length} ข้อความ)` });
+        return seed;
+    });
     const [streaming, setStreaming] = useState('');
     const [busy, setBusy] = useState(false);
     const [model, setModel] = useState(initialModel);
@@ -299,7 +304,8 @@ export function App({ initialModel, fallbackModel, budgetUsd, permissionMode = '
         if (next)
             void submit(next);
     }
-    const banner = useMemo(() => _jsx(Banner, { model: initialModel }), [initialModel]);
+    // banner ผูกกับ live `model` (ไม่ใช่ initialModel) → /model เปลี่ยนแล้ว banner อัปเดตตาม ไม่ค้าง model เก่า
+    const banner = useMemo(() => _jsx(Banner, { model: model }), [model]);
     const costHint = lastCost.current.includes('cost ') ? lastCost.current.split('cost ')[1] : '';
     return (_jsxs(Box, { flexDirection: "column", children: [banner, _jsx(Static, { items: history, children: (turn) => _jsx(TurnView, { turn: turn }, turn.id) }), streaming ? (_jsx(Box, { marginTop: 1, children: _jsx(Text, { children: streaming }) })) : null, queued.length ? (_jsx(Box, { flexDirection: "column", marginTop: 1, children: queued.map((q, i) => (_jsxs(Text, { dimColor: true, children: ["\u23F3 \u0E04\u0E34\u0E27 ", i + 1, ": ", q.length > 64 ? `${q.slice(0, 64)}…` : q] }, i))) })) : null, approvalReq ? (_jsxs(Box, { marginTop: 1, borderStyle: "round", borderColor: "yellow", paddingX: 1, flexDirection: "column", children: [_jsxs(Text, { color: "yellow", children: ["\u0E2D\u0E19\u0E38\u0E21\u0E31\u0E15\u0E34\u0E23\u0E31\u0E19 ", approvalReq.tool, "?"] }), _jsx(Text, { dimColor: true, children: approvalReq.summary }), _jsx(Text, { dimColor: true, children: "y = \u0E23\u0E31\u0E19 \u00B7 n = \u0E1B\u0E0F\u0E34\u0E40\u0E2A\u0E18" })] })) : (_jsxs(Box, { marginTop: 1, borderStyle: "round", borderColor: busy ? 'gray' : 'blue', paddingX: 1, children: [_jsx(Text, { color: busy ? 'gray' : 'cyan', children: busy ? '· ' : '› ' }), _jsx(InputView, { value: editor.value, cursor: editor.cursor, busy: busy })] })), _jsxs(Text, { dimColor: true, children: ['  ', model, " \u00B7 ", permissionMode === 'ask' ? 'ask-mode' : 'auto', " \u00B7 /help \u00B7 @file \u00B7 \u2191 history", costHint ? ` · ${costHint}` : ''] })] }));
 }

package/dist/ui/brain-wizard.js

@@ -15,10 +15,10 @@ export function BrainWizard({ onComplete }) {
     return (_jsxs(Box, { flexDirection: "column", gap: 1, marginY: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "\uD83E\uDDE0 \u0E2A\u0E23\u0E49\u0E32\u0E07 Second Brain workspace" }), step === 'path' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "1. \u0E27\u0E32\u0E07\u0E42\u0E04\u0E23\u0E07\u0E2A\u0E23\u0E49\u0E32\u0E07\u0E44\u0E27\u0E49\u0E17\u0E35\u0E48\u0E44\u0E2B\u0E19? (Enter = default)" }), _jsxs(Text, { color: "gray", children: ["   ", DEFAULT_PATH] }), _jsx(TextInput, { defaultValue: DEFAULT_PATH, placeholder: DEFAULT_PATH, onSubmit: (v) => {
                             setPath(v.trim() || DEFAULT_PATH);
                             setStep('owner');
-                        } })] })), step === 'owner' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "2. \u0E40\u0E23\u0E35\u0E22\u0E01\u0E04\u0E38\u0E13\u0E27\u0E48\u0E32\u0E2D\u0E30\u0E44\u0E23\u0E14\u0E35? (\u0E0A\u0E37\u0E48\u0E2D/\u0E0A\u0E37\u0E48\u0E2D\u0E40\u0E25\u0E48\u0E19 \u2014 Enter = \u0E02\u0E49\u0E32\u0E21)" }), _jsx(TextInput, { defaultValue: BRAIN_DEFAULTS.ownerName, onSubmit: (v) => {
+                        } })] })), step === 'owner' && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: ["2. \u0E40\u0E23\u0E35\u0E22\u0E01\u0E04\u0E38\u0E13\u0E27\u0E48\u0E32\u0E2D\u0E30\u0E44\u0E23\u0E14\u0E35? (\u0E0A\u0E37\u0E48\u0E2D/\u0E0A\u0E37\u0E48\u0E2D\u0E40\u0E25\u0E48\u0E19 \u2014 Enter \u0E40\u0E1B\u0E25\u0E48\u0E32 = \u0E43\u0E0A\u0E49 \"", BRAIN_DEFAULTS.ownerName, "\")"] }), _jsx(TextInput, { placeholder: BRAIN_DEFAULTS.ownerName, onSubmit: (v) => {
                             setOwnerName(v.trim() || BRAIN_DEFAULTS.ownerName);
                             setStep('ai');
-                        } })] })), step === 'ai' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "3. \u0E2D\u0E22\u0E32\u0E01\u0E43\u0E2B\u0E49 AI \u0E40\u0E23\u0E35\u0E22\u0E01\u0E15\u0E31\u0E27\u0E40\u0E2D\u0E07\u0E27\u0E48\u0E32\u0E2D\u0E30\u0E44\u0E23?" }), _jsx(TextInput, { defaultValue: BRAIN_DEFAULTS.aiName, onSubmit: (v) => {
+                        } })] })), step === 'ai' && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: ["3. \u0E2D\u0E22\u0E32\u0E01\u0E43\u0E2B\u0E49 AI \u0E40\u0E23\u0E35\u0E22\u0E01\u0E15\u0E31\u0E27\u0E40\u0E2D\u0E07\u0E27\u0E48\u0E32\u0E2D\u0E30\u0E44\u0E23? ", _jsxs(Text, { color: "gray", children: ["(Enter \u0E40\u0E1B\u0E25\u0E48\u0E32 = \"", BRAIN_DEFAULTS.aiName, "\")"] })] }), _jsx(TextInput, { placeholder: BRAIN_DEFAULTS.aiName, onSubmit: (v) => {
                             setAiName(v.trim() || BRAIN_DEFAULTS.aiName);
                             setStep('autonomy');
                         } })] })), step === 'autonomy' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "4. \u0E43\u0E2B\u0E49 AI \u0E17\u0E33\u0E07\u0E32\u0E19\u0E41\u0E1A\u0E1A\u0E44\u0E2B\u0E19?" }), _jsx(Select, { options: [

package/dist/ui/render.js

@@ -1,32 +1,72 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { useState } from 'react';
 import { render } from 'ink';
 import { App } from './app.js';
 import { SetupWizard } from './setup.js';
 import { BrainWizard } from './brain-wizard.js';
 import { saveKey, saveGlobalConfig, saveBrainPath } from '../config.js';
-export function startRepl(props) {
-    render(_jsx(App, { ...props }));
-}
-/** render first-run wizard → save key+config → (ถ้าเลือก) ต่อ BrainWizard สร้าง second-brain → resolve */
-export function startSetup() {
-    return new Promise((resolve) => {
-        let unmount = () => { };
+/**
+ * Root — โฮสต์ setup wizard → brain wizard → REPL ใน **Ink render เดียว**
+ *
+ * ก่อนหน้านี้แยกเป็น render(SetupWizard) → unmount → render(App) = 2 Ink instances ต่อกัน
+ * พอ instance แรก unmount, stdin raw-mode/keypress listener ไม่ reattach กับ instance ที่ 2
+ * → พิมพ์ในช่องแชทไม่ได้. รวมเป็น tree เดียว (React สลับ component ภายใน) stdin ต่อเนื่องไม่หลุด.
+ */
+export function Root({ needsSetup, appProps }) {
+    const [phase, setPhase] = useState(needsSetup ? 'setup' : 'app');
+    const [model, setModel] = useState(appProps.initialModel);
+    const [brainNote, setBrainNote] = useState(undefined);
+    if (phase === 'setup') {
         const onComplete = (r) => {
             void (async () => {
                 if (r.key)
                     await saveKey(r.envVar, r.key);
                 await saveGlobalConfig({ model: r.model, provider: r.provider });
-                unmount();
-                if (r.createBrain)
-                    await startBrainSetup(); // ถาม identity + path จริง แล้ว scaffold
-                resolve(r);
+                setModel(r.model);
+                setPhase(r.createBrain ? 'brain' : 'app');
             })();
         };
-        const instance = render(_jsx(SetupWizard, { onComplete: onComplete }));
-        unmount = instance.unmount;
-    });
+        return _jsx(SetupWizard, { onComplete: onComplete });
+    }
+    if (phase === 'brain') {
+        const onComplete = (a) => {
+            void (async () => {
+                const { scaffoldBrain, BRAIN_DEFAULTS, expandHome, wireBrainMcp } = await import('../brain.js');
+                const today = new Date().toISOString().slice(0, 10);
+                const target = expandHome(a.path);
+                try {
+                    const res = await scaffoldBrain(target, {
+                        ...BRAIN_DEFAULTS,
+                        ownerName: a.ownerName,
+                        aiName: a.aiName,
+                        autonomy: a.autonomy,
+                        today,
+                    });
+                    await saveBrainPath(target);
+                    const wired = await wireBrainMcp(target).catch(() => 'skip');
+                    setBrainNote(`✅ second-brain — ${target} · สร้าง ${res.created.length} ไฟล์ · ` +
+                        `${wired === 'added' ? 'wire filesystem MCP เข้า vault แล้ว' : 'MCP เดิมอยู่แล้ว (ไม่ทับ)'} · เปิดใน Obsidian: Open folder as vault`);
+                }
+                catch (e) {
+                    setBrainNote(`⚠ สร้าง second-brain ไม่สำเร็จ: ${e.message} — ลองใหม่ด้วย ${'`'}sanook brain init${'`'}`);
+                }
+                setPhase('app');
+            })();
+        };
+        return _jsx(BrainWizard, { onComplete: onComplete });
+    }
+    // App mount สดตอน phase = 'app' → useState(initialModel) หยิบ model ที่เลือกจาก wizard ถูกต้อง
+    return _jsx(App, { ...appProps, initialModel: model, initialNote: brainNote ?? appProps.initialNote });
+}
+/** เปิดแอป: wizard (ถ้า first-run) → REPL — Ink render ครั้งเดียว (fix: พิมพ์ในช่องแชทไม่ได้) */
+export function startApp(props) {
+    render(_jsx(Root, { ...props }));
+}
+/** เปิด REPL ตรงๆ (ไม่ผ่าน wizard) — เก็บไว้เผื่อ caller อื่น */
+export function startRepl(appProps) {
+    render(_jsx(App, { ...appProps }));
 }
-/** standalone / first-run brain: ถาม path + ตัวตน → scaffold (personalized) + auto-wire filesystem MCP */
+/** standalone `sanook brain init` (interactive): ถาม path + ตัวตน → scaffold + wire MCP — single render, จบแล้ว process ออก */
 export function startBrainSetup() {
     return new Promise((resolve) => {
         let unmount = () => { };

package/dist/ui/setup.js

@@ -1,11 +1,29 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
-import { Box, Text } from 'ink';
+import { Box, Text, useInput } from 'ink';
 import { Select, PasswordInput } from '@inkjs/ui';
 import { PROVIDERS, consoleUrl } from '../providers/registry.js';
+import { resolveKeyFromEnv, assertDirectApiKey } from '../providers/keys.js';
 import { listRemoteModels, mergeModelOptions } from '../providers/models.js';
+import { detectCodex } from '../providers/codex.js';
 import { BRAND } from '../brand.js';
-/** first-run setup wizard: เลือก provider → ใส่ API key → เลือก model → เสนอสร้าง second-brain */
+// จัดลำดับ provider ในเมนู: cloud ยอดนิยม → cloud อื่น → local → ChatGPT-plan (codex) ท้ายสุด
+const PROVIDER_ORDER = ['anthropic', 'openai', 'google', 'deepseek', 'xai', 'mistral', 'groq', 'glm', 'minimax', 'ollama', 'lmstudio', 'codex'];
+/** label + hint ต่อ provider: เจอ key ใน env / local / ChatGPT-login / ต้องมี key — ให้เลือกง่ายขึ้น */
+export function providerOption(id) {
+    const p = PROVIDERS[id];
+    let hint;
+    if (p.kind === 'delegate')
+        hint = 'login ChatGPT · ไม่ใช้ API key';
+    else if (!p.requiresKey)
+        hint = 'local · ไม่ต้อง key';
+    else if (resolveKeyFromEnv(p.envVar, p.envFallbacks))
+        hint = '✓ เจอ key ใน env';
+    else
+        hint = 'ต้องมี API key';
+    return { label: `${p.label}  —  ${hint}`, value: p.id };
+}
+/** first-run setup wizard: เลือก provider → (codex login | API key) → เลือก model → เสนอสร้าง second-brain */
 export function SetupWizard({ onComplete }) {
     const [step, setStep] = useState('provider');
     const [provider, setProvider] = useState('');
@@ -13,8 +31,32 @@ export function SetupWizard({ onComplete }) {
     const [model, setModel] = useState('');
     const [remote, setRemote] = useState([]);
     const [loadingModels, setLoadingModels] = useState(false);
+    const [codexStatus, setCodexStatus] = useState(null);
+    const [recheck, setRecheck] = useState(0);
+    const [keyError, setKeyError] = useState('');
     const cfg = provider ? PROVIDERS[provider] : undefined;
-    const providerOptions = Object.values(PROVIDERS).map((p) => ({ label: p.label, value: p.id }));
+    const providerOptions = PROVIDER_ORDER.filter((id) => PROVIDERS[id]).map(providerOption);
+    // codex-auth: เช็ก codex CLI ติดตั้ง + login ChatGPT (re-run เมื่อกด "เช็กใหม่")
+    useEffect(() => {
+        if (step !== 'codex-auth')
+            return;
+        let alive = true;
+        setCodexStatus(null);
+        void detectCodex().then((s) => {
+            if (!alive)
+                return;
+            setCodexStatus(s);
+            if (s.installed && s.loggedIn) {
+                // login แล้ว → ใช้ default model ของ codex (ChatGPT-plan เลือก model เอง) ข้ามขั้นเลือก key/model
+                setModel(`codex:${PROVIDERS.codex.models.default}`);
+                setStep('brain-offer');
+            }
+        });
+        return () => {
+            alive = false;
+        };
+    }, [step, recheck]);
+    // ดึงรายชื่อ model จริงจาก provider (เฉพาะ provider แบบ SDK ที่ต้อง/ไม่ต้อง key)
     useEffect(() => {
         if (step !== 'model' || !cfg)
             return;
@@ -29,13 +71,55 @@ export function SetupWizard({ onComplete }) {
     }, [step, cfg, key]);
     const modelOptions = cfg ? mergeModelOptions(cfg, remote) : [];
     const finish = (createBrain) => onComplete({ provider, model, envVar: cfg?.envVar ?? '', key, createBrain });
-    return (_jsxs(Box, { flexDirection: "column", gap: 1, marginY: 1, children: [_jsxs(Text, { bold: true, color: "cyan", children: ["\u2699  \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 ", BRAND.bannerTitle, " (\u0E04\u0E23\u0E31\u0E49\u0E07\u0E41\u0E23\u0E01)"] }), step === 'provider' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "1. \u0E40\u0E25\u0E37\u0E2D\u0E01 AI provider:" }), _jsx(Select, { options: providerOptions, onChange: (v) => {
+    const backToProvider = () => {
+        setProvider('');
+        setCodexStatus(null);
+        setKeyError('');
+        setKey('');
+        setStep('provider');
+    };
+    // Esc บนทุก step (ยกเว้น provider) = ย้อนกลับไปเลือก provider — กัน dead-end ตอนเลือกผิด
+    // หรือ codex detect ค้าง (step codex-auth ตอน pending ไม่มีปุ่มอื่น แต่ Esc ออกได้เสมอ)
+    useInput((_input, key) => {
+        if (key.escape && step !== 'provider')
+            backToProvider();
+    });
+    // ตรวจ API key ในขั้นใส่ key — ว่าง = ไม่ผ่าน, OAuth/format ผิด = บอก error (กัน setup จบทั้งที่ key ใช้ไม่ได้)
+    const submitKey = (raw) => {
+        const k = raw.trim();
+        if (!k) {
+            setKeyError('วาง API key ก่อนค่ะ (กด Enter ทั้งที่ว่างไม่ได้) · Esc = กลับไปเลือก provider');
+            return;
+        }
+        if (cfg) {
+            try {
+                assertDirectApiKey(cfg, k); // reject OAuth/subscription token + format ผิด (เหมือน runtime)
+            }
+            catch (e) {
+                setKeyError(e.message.split('\n')[0]);
+                return;
+            }
+        }
+        setKeyError('');
+        setKey(k);
+        setStep('model');
+    };
+    return (_jsxs(Box, { flexDirection: "column", gap: 1, marginY: 1, children: [_jsxs(Text, { bold: true, color: "cyan", children: ["\u2699  \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 ", BRAND.bannerTitle, " (\u0E04\u0E23\u0E31\u0E49\u0E07\u0E41\u0E23\u0E01)"] }), step === 'provider' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "1. \u0E40\u0E25\u0E37\u0E2D\u0E01 AI provider (\u2191\u2193 \u0E40\u0E25\u0E37\u0E2D\u0E01 \u00B7 Enter \u0E22\u0E37\u0E19\u0E22\u0E31\u0E19):" }), _jsx(Text, { color: "gray", children: "   cloud = \u0E43\u0E2A\u0E48 API key \u00B7 local = \u0E1F\u0E23\u0E35\u0E1A\u0E19\u0E40\u0E04\u0E23\u0E37\u0E48\u0E2D\u0E07 \u00B7 Codex = login \u0E14\u0E49\u0E27\u0E22 ChatGPT" }), _jsx(Select, { options: providerOptions, onChange: (v) => {
                             setProvider(v);
-                            setStep(PROVIDERS[v].requiresKey ? 'key' : 'model');
-                        } })] })), step === 'key' && cfg && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: ["2. \u0E27\u0E32\u0E07 API key \u0E02\u0E2D\u0E07 ", cfg.label, ":"] }), consoleUrl(provider) ? (_jsxs(Text, { color: "cyan", children: ["   \u2192 \u0E40\u0E2D\u0E32 key \u0E17\u0E35\u0E48: ", consoleUrl(provider)] })) : null, _jsx(Text, { color: "gray", children: "   (API key \u0E15\u0E23\u0E07\u0E08\u0E32\u0E01 console \u2014 \u0E2B\u0E49\u0E32\u0E21 OAuth/subscription token)" }), _jsx(PasswordInput, { placeholder: cfg.envVar, onSubmit: (v) => {
-                            setKey(v.trim());
-                            setStep('model');
-                        } })] })), step === 'model' &&
+                            const p = PROVIDERS[v];
+                            if (p.kind === 'delegate')
+                                setStep('codex-auth');
+                            else if (p.requiresKey)
+                                setStep('key');
+                            else
+                                setStep('model');
+                        } })] })), step === 'codex-auth' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "2. \u0E40\u0E0A\u0E37\u0E48\u0E2D\u0E21 OpenAI Codex (\u0E43\u0E0A\u0E49\u0E42\u0E04\u0E27\u0E15\u0E49\u0E32 ChatGPT plan \u2014 \u0E44\u0E21\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E21\u0E35 API key):" }), codexStatus === null ? (_jsx(Text, { color: "gray", children: "   \u0E01\u0E33\u0E25\u0E31\u0E07\u0E40\u0E0A\u0E47\u0E01 codex CLI + \u0E2A\u0E16\u0E32\u0E19\u0E30 login\u2026" })) : !codexStatus.installed ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: "yellow", children: "   \u274C \u0E22\u0E31\u0E07\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E15\u0E34\u0E14\u0E15\u0E31\u0E49\u0E07 codex CLI" }), _jsxs(Text, { children: ['   ', "\u0E15\u0E34\u0E14\u0E15\u0E31\u0E49\u0E07\u0E43\u0E19 terminal \u0E2D\u0E35\u0E01\u0E2B\u0E19\u0E49\u0E32\u0E15\u0E48\u0E32\u0E07: ", _jsx(Text, { color: "cyan", children: "npm i -g @openai/codex" })] }), _jsx(Select, { options: [
+                                    { label: 'เช็กใหม่ (ติดตั้งเสร็จแล้ว)', value: 'recheck' },
+                                    { label: '← กลับไปเลือก provider อื่น', value: 'back' },
+                                ], onChange: (v) => (v === 'recheck' ? setRecheck((n) => n + 1) : backToProvider()) })] })) : !codexStatus.loggedIn ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: "yellow", children: "   \u26A0 \u0E15\u0E34\u0E14\u0E15\u0E31\u0E49\u0E07\u0E41\u0E25\u0E49\u0E27 \u0E41\u0E15\u0E48\u0E22\u0E31\u0E07\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49 login ChatGPT" }), _jsxs(Text, { children: ['   ', "\u0E23\u0E31\u0E19\u0E43\u0E19 terminal \u0E2D\u0E35\u0E01\u0E2B\u0E19\u0E49\u0E32\u0E15\u0E48\u0E32\u0E07: ", _jsx(Text, { color: "cyan", children: "codex login" }), " ", _jsx(Text, { color: "gray", children: "(\u0E40\u0E1B\u0E34\u0E14 browser \u0E43\u0E2B\u0E49\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E14\u0E49\u0E27\u0E22\u0E1A\u0E31\u0E0D\u0E0A\u0E35 ChatGPT)" })] }), _jsx(Select, { options: [
+                                    { label: 'เช็กใหม่ (login เสร็จแล้ว)', value: 'recheck' },
+                                    { label: '← กลับไปเลือก provider อื่น', value: 'back' },
+                                ], onChange: (v) => (v === 'recheck' ? setRecheck((n) => n + 1) : backToProvider()) })] })) : (_jsx(Text, { color: "green", children: "   \u2705 login ChatGPT \u0E41\u0E25\u0E49\u0E27 \u2014 \u0E01\u0E33\u0E25\u0E31\u0E07\u0E44\u0E1B\u0E15\u0E48\u0E2D\u2026" }))] })), step === 'key' && cfg && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: ["2. \u0E27\u0E32\u0E07 API key \u0E02\u0E2D\u0E07 ", cfg.label, ": ", _jsx(Text, { color: "gray", children: "(Esc = \u0E01\u0E25\u0E31\u0E1A)" })] }), consoleUrl(provider) ? _jsxs(Text, { color: "cyan", children: ["   \u2192 \u0E40\u0E2D\u0E32 key \u0E17\u0E35\u0E48: ", consoleUrl(provider)] }) : null, cfg.keyExample ? _jsxs(Text, { color: "gray", children: ["   \u0E23\u0E39\u0E1B\u0E41\u0E1A\u0E1A key: ", cfg.keyExample] }) : null, _jsx(Text, { color: "gray", children: "   (API key \u0E15\u0E23\u0E07\u0E08\u0E32\u0E01 console \u2014 \u0E2B\u0E49\u0E32\u0E21 OAuth/subscription token \u00B7 key \u0E08\u0E30\u0E40\u0E01\u0E47\u0E1A\u0E41\u0E1A\u0E1A\u0E40\u0E02\u0E49\u0E32\u0E23\u0E2B\u0E31\u0E2A\u0E43\u0E19\u0E40\u0E04\u0E23\u0E37\u0E48\u0E2D\u0E07)" }), _jsx(PasswordInput, { placeholder: cfg.envVar, onSubmit: submitKey }), keyError ? _jsxs(Text, { color: "red", children: ["   \u2717 ", keyError] }) : null] })), step === 'model' &&
                 cfg &&
                 (loadingModels ? (_jsxs(Text, { color: "gray", children: ["   \u0E01\u0E33\u0E25\u0E31\u0E07\u0E14\u0E36\u0E07\u0E23\u0E32\u0E22\u0E0A\u0E37\u0E48\u0E2D model \u0E08\u0E32\u0E01 ", cfg.label, "\u2026"] })) : (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: ["3. \u0E40\u0E25\u0E37\u0E2D\u0E01 model \u0E40\u0E23\u0E34\u0E48\u0E21\u0E15\u0E49\u0E19", remote.length ? _jsxs(Text, { color: "gray", children: [" (", modelOptions.length, " \u0E15\u0E31\u0E27\u0E08\u0E32\u0E01 provider + alias)"] }) : null, ":"] }), _jsx(Select, { options: modelOptions, onChange: (v) => {
                                 setModel(`${provider}:${v}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanook-cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "A terminal AI coding agent — BYOK, 12 providers, MCP, cron gateway, skills, and git awareness. Built from scratch in TypeScript.",
   "type": "module",
   "bin": {