wotann 0.5.0

package/dist/providers/codex-adapter.js

@@ -0,0 +1,493 @@
+/**
+ * Codex provider adapter using the ChatGPT backend Responses API.
+ *
+ * CRITICAL: The ChatGPT OAuth token does NOT work against api.openai.com.
+ * It ONLY works against the ChatGPT backend:
+ *   https://chatgpt.com/backend-api/codex/responses
+ *
+ * Auth: Bearer <access_token> + ChatGPT-Account-Id header.
+ * Format: Responses API (input array, instructions field, NOT chat/completions).
+ *
+ * Token refresh: WOTANN does NOT refresh tokens itself (V9 T0.2 —
+ * POSTing to OpenAI's OAuth endpoint with Codex CLI's public client_id
+ * would masquerade as the official CLI). Instead, we re-read
+ * ~/.codex/auth.json — the Codex CLI's own refresh loop keeps that
+ * file fresh. If a request returns 401 and the on-disk token is
+ * unchanged, we surface "session expired — run `codex login`".
+ */
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { getModelContextConfig } from "../context/limits.js";
+import { toCodexTools } from "./tool-serializer.js";
+import { getProviderService } from "./provider-service.js";
+import { discoverCodexModels, resolveCodexAlias } from "./codex-models.js";
+// ── Auth Helpers ────────────────────────────────────────────
+function getAuthPath() {
+    const codexHome = process.env["CODEX_HOME"] ?? join(homedir(), ".codex");
+    return process.env["CODEX_AUTH_JSON_PATH"] ?? join(codexHome, "auth.json");
+}
+function readCodexAuthFile() {
+    const authPath = getAuthPath();
+    if (!existsSync(authPath))
+        return null;
+    try {
+        return JSON.parse(readFileSync(authPath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build a synthetic CodexAuthFile from a caller-supplied raw access token.
+ * Used as a fallback when no on-disk Codex auth exists — primarily for test
+ * fixtures that need to exercise the wire-format assembly path without
+ * vendoring credentials. The `refresh_token` is left empty; refreshTokens()
+ * will surface an error if the synthetic token expires mid-session, which is
+ * the correct failure mode (tests never reach that branch because they
+ * capture the first fetch call and abort).
+ */
+function synthesizeAuthFromToken(rawToken) {
+    if (!rawToken)
+        return null;
+    return {
+        auth_mode: "raw_token",
+        tokens: {
+            access_token: rawToken,
+            id_token: "",
+            refresh_token: "",
+            account_id: "",
+        },
+        // Set to a future-enough timestamp so ensureFreshAuth() doesn't
+        // trigger a refresh path on first use.
+        last_refresh: new Date().toISOString(),
+    };
+}
+/**
+ * Extract the access token from the auth file, searching multiple nested paths.
+ * Matches OpenClaw's resilient approach (10+ paths searched).
+ */
+export function readCodexToken() {
+    const auth = readCodexAuthFile();
+    if (!auth)
+        return null;
+    // Search multiple nested paths (from OpenClaw's resolveCodexApiCredentials)
+    const raw = auth;
+    const tokens = raw["tokens"];
+    const authBlock = raw["auth"];
+    const tokenBlock = raw["token"];
+    return (tokens?.["access_token"] ??
+        tokens?.["accessToken"] ??
+        raw["access_token"] ??
+        raw["accessToken"] ??
+        authBlock?.["access_token"] ??
+        authBlock?.["accessToken"] ??
+        tokenBlock?.["access_token"] ??
+        tokenBlock?.["accessToken"] ??
+        raw["OPENAI_API_KEY"] ??
+        null);
+}
+/**
+ * Refresh is NOT performed by WOTANN per V9 T0.2 — POSTing to OpenAI's
+ * OAuth endpoint with Codex CLI's public client_id would masquerade as
+ * the official CLI. Instead, we re-read `~/.codex/auth.json`. If the
+ * Codex CLI is running its own refresh loop (as `codex login` leaves
+ * it), the file on disk will already have a fresh token when we
+ * re-read. If not, this returns the same auth it was called with —
+ * the caller then surfaces the 401 and asks the user to run
+ * `codex login` themselves.
+ */
+function rereadAuthFromDisk() {
+    return readCodexAuthFile();
+}
+// ── Adapter ─────────────────────────────────────────────────
+const CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex";
+export function createCodexAdapter(rawToken) {
+    // Prefer the on-disk Codex auth file (where Codex CLI stores the refreshable
+    // access_token + refresh_token). Fall back to the caller-supplied rawToken
+    // so fixtures and test harnesses can exercise the adapter without a live
+    // ~/.codex/auth.json on the runner. The fallback path skips refresh logic
+    // (there's no refresh_token to use) but preserves every downstream wire-
+    // format assertion — tools[], messages[], stream decoding — so CI can
+    // validate request shape without vendored credentials.
+    let auth = readCodexAuthFile() ?? synthesizeAuthFromToken(rawToken);
+    const contextConfig = getModelContextConfig("codexplan", "codex");
+    const capabilities = {
+        supportsComputerUse: false,
+        supportsToolCalling: true,
+        supportsVision: false,
+        supportsStreaming: true,
+        supportsThinking: true,
+        maxContextWindow: contextConfig.maxContextTokens,
+    };
+    async function ensureFreshAuth() {
+        if (!auth)
+            return null;
+        // Re-read the on-disk auth file in case the Codex CLI rotated the
+        // token out-of-band. WOTANN no longer performs OAuth refresh itself
+        // (V9 T0.2) — if the token is stale, the request fails with 401
+        // and the user is prompted to run `codex login` themselves.
+        const fresh = rereadAuthFromDisk();
+        if (fresh?.tokens.access_token) {
+            auth = fresh;
+        }
+        return {
+            token: auth.tokens.access_token,
+            accountId: auth.tokens.account_id,
+        };
+    }
+    async function* query(options) {
+        const creds = await ensureFreshAuth();
+        if (!creds) {
+            yield {
+                type: "error",
+                content: 'Codex auth not available. Run: npx @openai/codex --full-auto "hello"',
+                provider: "codex",
+            };
+            return;
+        }
+        // Map model aliases to actual model IDs. The legacy
+        // codexspark/codexplan/codexmini names came from OpenClaude and are
+        // kept here as backward-compat aliases — the alias map lives in
+        // codex-models.ts so a single source of truth governs the
+        // resolution. Real Codex slugs (`gpt-5.5`, `gpt-5.4-mini`, etc.)
+        // pass through unchanged.
+        const inputModel = options.model ?? "codexspark";
+        const model = resolveCodexAlias(inputModel);
+        // Build Responses API request body.
+        //
+        // Codex Responses API requires prior tool interactions to be round-
+        // tripped back as `function_call` and `function_call_output` items,
+        // NOT as plain messages. The Opus audit found the prior loop only
+        // wrote `{type: "message", role, content}` so the model lost all
+        // pending call_ids on the second turn and would either retry the
+        // call or desync entirely. Multi-turn tool loops on Codex were
+        // effectively broken.
+        //
+        // Now:
+        // - assistant messages with a toolCallId emit `function_call` items
+        //   carrying call_id + name + arguments (JSON-stringified content)
+        // - tool-role messages emit `function_call_output` items with the
+        //   matching call_id and the tool's output string
+        // - everything else keeps the current `{type: "message", ...}` shape
+        const input = [];
+        if (options.messages) {
+            for (const msg of options.messages) {
+                if (msg.role === "assistant" && msg.toolCallId) {
+                    input.push({
+                        type: "function_call",
+                        call_id: msg.toolCallId,
+                        name: msg.toolName ?? "unknown",
+                        arguments: msg.content,
+                    });
+                    continue;
+                }
+                if (msg.role === "tool") {
+                    input.push({
+                        type: "function_call_output",
+                        call_id: msg.toolCallId ?? "",
+                        output: msg.content,
+                    });
+                    continue;
+                }
+                input.push({
+                    type: "message",
+                    role: msg.role === "assistant" ? "assistant" : "user",
+                    content: [
+                        {
+                            type: msg.role === "assistant" ? "output_text" : "input_text",
+                            text: msg.content,
+                        },
+                    ],
+                });
+            }
+        }
+        // Add current prompt
+        input.push({
+            type: "message",
+            role: "user",
+            content: [{ type: "input_text", text: options.prompt }],
+        });
+        // S1-6 + P0-4: Codex Responses API accepts a flat `tools` array. The
+        // shared tool-serializer produces the exact flat shape with the JSON
+        // schema preserved verbatim and `$ref`-bearing schemas rejected up
+        // front. Distinct from OpenAI Chat Completions where `parameters` is
+        // nested under `function:`.
+        const codexTools = options.tools && options.tools.length > 0 ? toCodexTools(options.tools) : undefined;
+        const body = JSON.stringify({
+            model,
+            instructions: options.systemPrompt ?? "",
+            input,
+            stream: true,
+            store: false,
+            ...(inputModel === "codexplan" ? { reasoning: { effort: "high" } } : {}),
+            ...(codexTools ? { tools: codexTools } : {}),
+        });
+        try {
+            const response = await fetch(`${CODEX_BASE_URL}/responses`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${creds.token}`,
+                    "ChatGPT-Account-Id": creds.accountId,
+                    "User-Agent": "wotann-cli",
+                },
+                body,
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                if (response.status === 401) {
+                    // V9 Wave 6-MM — flag the failed bearer as expired so the
+                    // rest of the harness (UI badge, fallback chain) can react
+                    // BEFORE we attempt the on-disk re-read fallback.
+                    try {
+                        getProviderService().markCredentialExpired("codex", creds.token);
+                    }
+                    catch {
+                        /* provider-service init is best-effort */
+                    }
+                    // Re-read the on-disk auth file — if the Codex CLI rotated
+                    // the token out-of-band, we'll see a newer value. WOTANN no
+                    // longer performs OAuth refresh itself (V9 T0.2).
+                    //
+                    // QB#9: this re-read path stays so that the existing test
+                    // codifying "Codex CLI rotated the token out-of-band" still
+                    // passes; we just additionally call markCredentialExpired.
+                    const fresh = rereadAuthFromDisk();
+                    if (fresh?.tokens.access_token &&
+                        fresh.tokens.access_token !== auth.tokens.access_token) {
+                        auth = fresh;
+                        // V9 Wave 6-MM — drop the expired flag on a fresh on-disk
+                        // token so subsequent requests don't see a stale "expired"
+                        // marker for what is now a valid credential.
+                        try {
+                            getProviderService().clearExpiredCredential("codex");
+                        }
+                        catch {
+                            /* best effort */
+                        }
+                        yield {
+                            type: "error",
+                            content: "Token refreshed by Codex CLI — please retry the request.",
+                            model: inputModel,
+                            provider: "codex",
+                        };
+                    }
+                    else {
+                        // Codex needs the upstream `codex login` CLI flow to refresh
+                        // tokens — `wotann login codex` then re-imports the file.
+                        // Kept verbatim so existing UX docs / muscle memory survive,
+                        // but tagged with auth_expired so structured error consumers
+                        // (router, fallback chain) treat it like any other 401.
+                        yield {
+                            type: "error",
+                            content: "Codex session expired. Re-authenticate by running `codex login` in a shell, then `wotann login codex`.",
+                            code: "auth_expired",
+                            model: inputModel,
+                            provider: "codex",
+                            stopReason: "error",
+                        };
+                    }
+                    return;
+                }
+                yield {
+                    type: "error",
+                    content: `Codex API error (${response.status}): ${errorText.slice(0, 300)}`,
+                    model: inputModel,
+                    provider: "codex",
+                };
+                return;
+            }
+            // Parse SSE stream (Responses API format)
+            const reader = response.body?.getReader();
+            if (!reader) {
+                yield { type: "error", content: "No response body", model: inputModel, provider: "codex" };
+                return;
+            }
+            const decoder = new TextDecoder();
+            let buffer = "";
+            let totalTokens = 0;
+            let inputTokens = 0;
+            let outputTokens = 0;
+            let stopReason = "stop";
+            // S1-23: Codex Responses API tool-call + reasoning events.
+            // The stream sends response.function_call_arguments.delta fragments
+            // keyed by item_id, plus response.reasoning.delta for chain-of-thought.
+            // Function call metadata (name, id) arrives on response.output_item.added
+            // before any argument fragments.
+            const codexToolState = new Map();
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true });
+                const lines = buffer.split("\n");
+                buffer = lines.pop() ?? "";
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (!trimmed.startsWith("data: "))
+                        continue;
+                    const data = trimmed.slice(6);
+                    if (data === "[DONE]")
+                        continue;
+                    try {
+                        const event = JSON.parse(data);
+                        const eventType = event["type"];
+                        if (eventType === "response.output_text.delta") {
+                            const delta = event["delta"];
+                            if (delta) {
+                                yield { type: "text", content: delta, model: inputModel, provider: "codex" };
+                            }
+                        }
+                        else if (eventType === "response.reasoning.delta") {
+                            const delta = event["delta"];
+                            if (delta) {
+                                yield { type: "thinking", content: delta, model: inputModel, provider: "codex" };
+                            }
+                        }
+                        else if (eventType === "response.output_item.added") {
+                            const item = event["item"];
+                            if (item && item["type"] === "function_call") {
+                                const id = item["id"] ?? "";
+                                const callId = item["call_id"] ?? id;
+                                const name = item["name"] ?? "";
+                                if (id) {
+                                    codexToolState.set(id, { name, callId, args: "", emitted: false });
+                                }
+                            }
+                        }
+                        else if (eventType === "response.function_call_arguments.delta") {
+                            const itemId = event["item_id"] ?? "";
+                            const delta = event["delta"] ?? "";
+                            if (itemId) {
+                                const state = codexToolState.get(itemId) ?? {
+                                    name: "",
+                                    callId: itemId,
+                                    args: "",
+                                    emitted: false,
+                                };
+                                state.args += delta;
+                                codexToolState.set(itemId, state);
+                            }
+                        }
+                        else if (eventType === "response.function_call_arguments.done") {
+                            const itemId = event["item_id"] ?? "";
+                            const state = codexToolState.get(itemId);
+                            if (state && !state.emitted && state.name) {
+                                let parsedInput = {};
+                                try {
+                                    parsedInput = state.args
+                                        ? JSON.parse(state.args)
+                                        : {};
+                                }
+                                catch {
+                                    yield {
+                                        type: "error",
+                                        content: `Codex: malformed tool arguments for ${state.name}`,
+                                        model: inputModel,
+                                        provider: "codex",
+                                    };
+                                    state.emitted = true;
+                                    continue;
+                                }
+                                yield {
+                                    type: "tool_use",
+                                    content: state.args,
+                                    toolName: state.name,
+                                    toolCallId: state.callId,
+                                    toolInput: parsedInput,
+                                    model: inputModel,
+                                    provider: "codex",
+                                    stopReason: "tool_calls",
+                                };
+                                state.emitted = true;
+                                stopReason = "tool_calls";
+                            }
+                        }
+                        else if (eventType === "response.completed" || eventType === "response.done") {
+                            const resp = event["response"];
+                            const usage = (resp?.["usage"] ?? event["usage"]);
+                            if (usage) {
+                                totalTokens = usage["total_tokens"] ?? 0;
+                                inputTokens = usage["input_tokens"] ?? usage["prompt_tokens"] ?? 0;
+                                outputTokens = usage["output_tokens"] ?? usage["completion_tokens"] ?? 0;
+                            }
+                        }
+                        else if (eventType === "response.failed") {
+                            const error = event["error"];
+                            yield {
+                                type: "error",
+                                content: `Codex response failed: ${error?.["message"] ?? "unknown error"}`,
+                                model: inputModel,
+                                provider: "codex",
+                            };
+                        }
+                    }
+                    catch {
+                        // Skip malformed SSE chunks
+                    }
+                }
+            }
+            // Wave 4G: surface split usage for honest cost attribution.
+            const finalInput = inputTokens > 0 ? inputTokens : Math.floor(totalTokens / 2);
+            const finalOutput = outputTokens > 0 ? outputTokens : Math.max(0, totalTokens - finalInput);
+            yield {
+                type: "done",
+                content: "",
+                model: inputModel,
+                provider: "codex",
+                tokensUsed: totalTokens,
+                usage: {
+                    inputTokens: finalInput,
+                    outputTokens: finalOutput,
+                },
+                stopReason,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Unknown error";
+            yield {
+                type: "error",
+                content: `Codex error: ${message}`,
+                model: inputModel,
+                provider: "codex",
+            };
+        }
+    }
+    async function listModels() {
+        // Codex multi-model gap fix (companion change to discovery.ts):
+        // call into the live `/backend-api/codex/models` endpoint via the
+        // codex-models.ts cache. We pass through the JWT and account_id
+        // so the server gates per-account and we get the user's actual
+        // entitlement set rather than a hardcoded 3-of-6 alias subset.
+        //
+        // Falls back to the bundled 5-model catalog when the network is
+        // down or auth is missing/expired — mirrors the openai/codex CLI
+        // behaviour. Aliases (`codexspark`/`codexplan`/`codexmini`) are
+        // appended so existing user scripts keep working.
+        const result = await discoverCodexModels({
+            accessToken: auth?.tokens?.access_token,
+            accountId: auth?.tokens?.account_id,
+            idToken: auth?.tokens?.id_token,
+        });
+        const slugs = result.models.map((m) => m.slug);
+        for (const alias of ["codexspark", "codexplan", "codexmini"]) {
+            if (!slugs.includes(alias))
+                slugs.push(alias);
+        }
+        return slugs;
+    }
+    async function isAvailable() {
+        return auth !== null && auth.tokens?.access_token?.length > 0;
+    }
+    return {
+        id: "codex",
+        name: "codex",
+        transport: "codex_responses",
+        capabilities,
+        query,
+        listModels,
+        isAvailable,
+    };
+}
+//# sourceMappingURL=codex-adapter.js.map

package/dist/providers/codex-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-adapter.js","sourceRoot":"","sources":["../../src/providers/codex-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAOlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAgB3E,+DAA+D;AAE/D,SAAS,WAAW;IAClB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAkB,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,QAA4B;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,MAAM,EAAE;YACN,YAAY,EAAE,QAAQ;YACtB,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,EAAE;SACf;QACD,gEAAgE;QAChE,uCAAuC;QACvC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,4EAA4E;IAC5E,MAAM,GAAG,GAAG,IAA0C,CAAC;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAwC,CAAC;IACpE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAwC,CAAC;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAwC,CAAC;IAEvE,OAAO,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC;QAC9B,MAAM,EAAE,CAAC,aAAa,CAAC;QACvB,GAAG,CAAC,cAAc,CAAC;QACnB,GAAG,CAAC,aAAa,CAAC;QAClB,SAAS,EAAE,CAAC,cAAc,CAAC;QAC3B,SAAS,EAAE,CAAC,aAAa,CAAC;QAC1B,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,GAAG,CAAC,gBAAgB,CAAC;QACrB,IAAI,CAAkB,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB;IACzB,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,+DAA+D;AAE/D,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,uDAAuD;IACvD,IAAI,IAAI,GAAG,iBAAiB,EAAE,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,YAAY,GAAyB;QACzC,mBAAmB,EAAE,KAAK;QAC1B,mBAAmB,EAAE,IAAI;QACzB,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,IAAI;QACvB,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;KACjD,CAAC;IAEF,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,kEAAkE;QAClE,oEAAoE;QACpE,gEAAgE;QAChE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,OAA4B;QAChD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM;gBACJ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,sEAAsE;gBAC/E,QAAQ,EAAE,OAAO;aAClB,CAAC;YACF,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,oEAAoE;QACpE,gEAAgE;QAChE,0DAA0D;QAC1D,iEAAiE;QACjE,0BAA0B;QAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;QACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE5C,oCAAoC;QACpC,EAAE;QACF,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,sBAAsB;QACtB,EAAE;QACF,OAAO;QACP,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,kDAAkD;QAClD,qEAAqE;QACrE,MAAM,KAAK,GAAmC,EAAE,CAAC;QAEjD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBAC/C,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,GAAG,CAAC,UAAU;wBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;wBAC/B,SAAS,EAAE,GAAG,CAAC,OAAO;qBACvB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;wBAC7B,MAAM,EAAE,GAAG,CAAC,OAAO;qBACpB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;oBACrD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;4BAC7D,IAAI,EAAE,GAAG,CAAC,OAAO;yBAClB;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,4BAA4B;QAC5B,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK;YACL,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;YACxC,KAAK;YACL,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,YAAY,EAAE;gBAC1D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;oBACtC,oBAAoB,EAAE,KAAK,CAAC,SAAS;oBACrC,YAAY,EAAE,YAAY;iBAC3B;gBACD,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,0DAA0D;oBAC1D,2DAA2D;oBAC3D,kDAAkD;oBAClD,IAAI,CAAC;wBACH,kBAAkB,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oBACnE,CAAC;oBAAC,MAAM,CAAC;wBACP,0CAA0C;oBAC5C,CAAC;oBAED,2DAA2D;oBAC3D,4DAA4D;oBAC5D,kDAAkD;oBAClD,EAAE;oBACF,0DAA0D;oBAC1D,4DAA4D;oBAC5D,2DAA2D;oBAC3D,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;oBACnC,IACE,KAAK,EAAE,MAAM,CAAC,YAAY;wBAC1B,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,IAAK,CAAC,MAAM,CAAC,YAAY,EACvD,CAAC;wBACD,IAAI,GAAG,KAAK,CAAC;wBACb,0DAA0D;wBAC1D,2DAA2D;wBAC3D,6CAA6C;wBAC7C,IAAI,CAAC;4BACH,kBAAkB,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;wBACvD,CAAC;wBAAC,MAAM,CAAC;4BACP,iBAAiB;wBACnB,CAAC;wBACD,MAAM;4BACJ,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,0DAA0D;4BACnE,KAAK,EAAE,UAAU;4BACjB,QAAQ,EAAE,OAAO;yBAClB,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,6DAA6D;wBAC7D,0DAA0D;wBAC1D,6DAA6D;wBAC7D,6DAA6D;wBAC7D,wDAAwD;wBACxD,MAAM;4BACJ,IAAI,EAAE,OAAO;4BACb,OAAO,EACL,wGAAwG;4BAC1G,IAAI,EAAE,cAAc;4BACpB,KAAK,EAAE,UAAU;4BACjB,QAAQ,EAAE,OAAO;4BACjB,UAAU,EAAE,OAAO;yBACpB,CAAC;oBACJ,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,oBAAoB,QAAQ,CAAC,MAAM,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBAC3E,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,OAAO;iBAClB,CAAC;gBACF,OAAO;YACT,CAAC;YAED,0CAA0C;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAC3F,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAA4D,MAAM,CAAC;YAEjF,2DAA2D;YAC3D,oEAAoE;YACpE,wEAAwE;YACxE,0EAA0E;YAC1E,iCAAiC;YACjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;YAEJ,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,IAAI,KAAK,QAAQ;wBAAE,SAAS;oBAEhC,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;wBAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAuB,CAAC;wBAEtD,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;4BAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAuB,CAAC;4BACnD,IAAI,KAAK,EAAE,CAAC;gCACV,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;4BAC/E,CAAC;wBACH,CAAC;6BAAM,IAAI,SAAS,KAAK,0BAA0B,EAAE,CAAC;4BACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAuB,CAAC;4BACnD,IAAI,KAAK,EAAE,CAAC;gCACV,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;4BACnF,CAAC;wBACH,CAAC;6BAAM,IAAI,SAAS,KAAK,4BAA4B,EAAE,CAAC;4BACtD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAwC,CAAC;4BAClE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,eAAe,EAAE,CAAC;gCAC7C,MAAM,EAAE,GAAI,IAAI,CAAC,IAAI,CAAY,IAAI,EAAE,CAAC;gCACxC,MAAM,MAAM,GAAI,IAAI,CAAC,SAAS,CAAY,IAAI,EAAE,CAAC;gCACjD,MAAM,IAAI,GAAI,IAAI,CAAC,MAAM,CAAY,IAAI,EAAE,CAAC;gCAC5C,IAAI,EAAE,EAAE,CAAC;oCACP,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gCACrE,CAAC;4BACH,CAAC;wBACH,CAAC;6BAAM,IAAI,SAAS,KAAK,wCAAwC,EAAE,CAAC;4BAClE,MAAM,MAAM,GAAI,KAAK,CAAC,SAAS,CAAY,IAAI,EAAE,CAAC;4BAClD,MAAM,KAAK,GAAI,KAAK,CAAC,OAAO,CAAY,IAAI,EAAE,CAAC;4BAC/C,IAAI,MAAM,EAAE,CAAC;gCACX,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;oCAC1C,IAAI,EAAE,EAAE;oCACR,MAAM,EAAE,MAAM;oCACd,IAAI,EAAE,EAAE;oCACR,OAAO,EAAE,KAAK;iCACf,CAAC;gCACF,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;gCACpB,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;4BACpC,CAAC;wBACH,CAAC;6BAAM,IAAI,SAAS,KAAK,uCAAuC,EAAE,CAAC;4BACjE,MAAM,MAAM,GAAI,KAAK,CAAC,SAAS,CAAY,IAAI,EAAE,CAAC;4BAClD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;4BACzC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gCAC1C,IAAI,WAAW,GAA4B,EAAE,CAAC;gCAC9C,IAAI,CAAC;oCACH,WAAW,GAAG,KAAK,CAAC,IAAI;wCACtB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA6B;wCACrD,CAAC,CAAC,EAAE,CAAC;gCACT,CAAC;gCAAC,MAAM,CAAC;oCACP,MAAM;wCACJ,IAAI,EAAE,OAAO;wCACb,OAAO,EAAE,uCAAuC,KAAK,CAAC,IAAI,EAAE;wCAC5D,KAAK,EAAE,UAAU;wCACjB,QAAQ,EAAE,OAAO;qCAClB,CAAC;oCACF,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;oCACrB,SAAS;gCACX,CAAC;gCACD,MAAM;oCACJ,IAAI,EAAE,UAAU;oCAChB,OAAO,EAAE,KAAK,CAAC,IAAI;oCACnB,QAAQ,EAAE,KAAK,CAAC,IAAI;oCACpB,UAAU,EAAE,KAAK,CAAC,MAAM;oCACxB,SAAS,EAAE,WAAW;oCACtB,KAAK,EAAE,UAAU;oCACjB,QAAQ,EAAE,OAAO;oCACjB,UAAU,EAAE,YAAY;iCACzB,CAAC;gCACF,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gCACrB,UAAU,GAAG,YAAY,CAAC;4BAC5B,CAAC;wBACH,CAAC;6BAAM,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;4BAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAwC,CAAC;4BACtE,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAEnC,CAAC;4BACd,IAAI,KAAK,EAAE,CAAC;gCACV,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gCACzC,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gCACnE,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;4BAC3E,CAAC;wBACH,CAAC;6BAAM,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;4BAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAwC,CAAC;4BACpE,MAAM;gCACJ,IAAI,EAAE,OAAO;gCACb,OAAO,EAAE,0BAA0B,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,eAAe,EAAE;gCAC1E,KAAK,EAAE,UAAU;gCACjB,QAAQ,EAAE,OAAO;6BAClB,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,4BAA4B;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,MAAM,UAAU,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;YAC/E,MAAM,WAAW,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,CAAC;YAC5F,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,WAAW;gBACvB,KAAK,EAAE;oBACL,WAAW,EAAE,UAAU;oBACvB,YAAY,EAAE,WAAW;iBAC1B;gBACD,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM;gBACJ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,gBAAgB,OAAO,EAAE;gBAClC,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,UAAU;QACvB,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,EAAE;QACF,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY;YACvC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU;YACnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;SAChC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,iBAAiB;QAC5B,YAAY;QACZ,KAAK;QACL,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/providers/codex-detector.d.ts

@@ -0,0 +1,73 @@
+/**
+ * codex-detector — read-existing-Codex-CLI-credential only.
+ *
+ * Replaces `src/providers/codex-oauth.ts` per V9 T0.2. The old module
+ * ran its own PKCE flow against OpenAI's OAuth endpoint using the
+ * official Codex CLI's public client_id, effectively masquerading as
+ * that CLI. This file drops all OAuth machinery and only reads
+ * credentials the user has already authenticated with `codex login`
+ * themselves.
+ *
+ * Exports:
+ *   - `detectExistingCodexCredential()` — check whether `~/.codex/auth.json`
+ *     (or `~/.config/codex/auth.json`) exists and is parseable.
+ *   - `importCodexCliCredential(path)` — validate shape and copy into
+ *     WOTANN's token store at `~/.wotann/codex-tokens.json`. Does NOT
+ *     network.
+ *   - `migrateLegacyCodexCredential()` — one-shot migration for users
+ *     upgrading from prior WOTANN versions that ran PKCE. If the old
+ *     file is in WOTANN's own token store, archive it under `.legacy/`.
+ *
+ * WOTANN quality bars:
+ *   - QB #6 honest failures: `importCodexCliCredential` returns
+ *     `{ok:false, error}` on missing token fields; never silently
+ *     succeeds with a partial credential.
+ *   - QB #7 per-call state: no module-level caches of token contents.
+ */
+export interface CodexTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly idToken?: string;
+    readonly expiresAt: number;
+}
+export interface CodexCredentialDetection {
+    readonly found: boolean;
+    readonly path?: string;
+    readonly expiresAt?: number | null;
+}
+export interface CodexImportResult {
+    readonly success: boolean;
+    readonly error?: string;
+}
+/**
+ * Detect an existing Codex CLI credential without reading the full
+ * token body into memory. Returns the source path and expiry metadata
+ * if available. Swallows parse errors: a malformed file is still
+ * reported as `found: true` with a null expiry so the caller can
+ * prompt the user to re-auth via `codex login`.
+ */
+export declare function detectExistingCodexCredential(): CodexCredentialDetection;
+/**
+ * Import a Codex CLI credential into WOTANN's token store. Reads the
+ * CLI's `auth.json`, validates the shape, and persists a WOTANN-native
+ * copy at `~/.wotann/codex-tokens.json` with mode 0600.
+ *
+ * The import is offline — it does not contact `auth.openai.com`. The
+ * caller is responsible for verifying the JWT out-of-band if needed.
+ * Accepts both the Codex CLI shape (`tokens.access_token` + sibling
+ * `refresh_token`) and flat shape (top-level `access_token` +
+ * `refresh_token`) to be robust across versions.
+ */
+export declare function importCodexCliCredential(path: string): CodexImportResult;
+/**
+ * One-shot migration for users upgrading from WOTANN versions that ran
+ * their own PKCE flow. Detects `~/.wotann/codex-tokens.json` and, if it
+ * was written by an old PKCE path (no `tokens` wrapper, flat shape),
+ * archives it to `~/.wotann/.legacy/codex-tokens.<timestamp>.json.bak`.
+ * Leaves the Codex CLI's own `~/.codex/auth.json` completely alone.
+ *
+ * Returns true if a migration happened. Never throws — the caller just
+ * logs the return value and proceeds.
+ */
+export declare function migrateLegacyCodexCredential(): boolean;
+//# sourceMappingURL=codex-detector.d.ts.map

package/dist/providers/codex-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-detector.d.ts","sourceRoot":"","sources":["../../src/providers/codex-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAUH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAeD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,IAAI,wBAAwB,CAaxE;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAmCxE;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAatD"}