zidane 1.6.17 → 1.7.0

package/README.md

@@ -10,15 +10,18 @@ Minimal TypeScript agent loop built with [Bun](https://bun.sh). Hook into every
 
 ```bash
 bun install
-bun run auth                                    # Anthropic OAuth
+bun run auth                                    # Anthropic + OpenAI Codex OAuth
 bun start --prompt "create a hello world app"
 ```
 
+`auth` runs both OAuth flows by default. Pass `--openai` or `--anthropic` to authenticate only one provider; the npm script form works too, e.g. `npm run auth --openai`.
+
 ## Agent Setup
 
 ```ts
-import { createAgent, anthropic } from 'zidane'
-import { basic } from 'zidane'
+import { createAgent } from 'zidane'
+import { basic } from 'zidane/harnesses'
+import { anthropic } from 'zidane/providers'
 
 const agent = createAgent({
   provider: anthropic({ apiKey: 'sk-ant-...' }),
@@ -77,7 +80,7 @@ Precedence: `run.behavior` > `agent.behavior` > `harness.behavior` > hardcoded d
 bun start \
   --prompt "your task"    \   # required
   --model claude-opus-4-6 \   # model id
-  --provider anthropic    \   # anthropic | openrouter | cerebras
+  --provider anthropic    \   # anthropic | openai | openrouter | cerebras
   --harness basic         \   # tool set
   --system "be concise"   \   # system prompt
   --thinking off          \   # off | minimal | low | medium | high
@@ -92,10 +95,11 @@ All providers accept runtime credentials via a params object. Env vars are fallb
 ### Anthropic
 
 ```ts
-import { anthropic } from 'zidane'
+import { anthropic } from 'zidane/providers'
 
 anthropic({ apiKey: 'sk-ant-...' })
 anthropic({ access: 'sk-ant-oat-...' })                      // OAuth
+anthropic({ access: 'sk-ant-oat-...', refresh: '...', expires: Date.now() + 3600_000 }) // auto-refresh
 anthropic({ apiKey: '...', defaultModel: 'claude-sonnet-4-6' })
 ```
 
@@ -104,17 +108,31 @@ Fallback: `params.apiKey` > `params.access` > `ANTHROPIC_API_KEY` env > `.creden
 ### OpenRouter
 
 ```ts
-import { openrouter } from 'zidane'
+import { openrouter } from 'zidane/providers'
 
 openrouter({ apiKey: 'sk-or-...', defaultModel: 'google/gemini-pro' })
 ```
 
 Fallback: `params.apiKey` > `OPENROUTER_API_KEY` env
 
+### OpenAI
+
+```ts
+import { openai } from 'zidane/providers'
+
+openai()                                                // OpenAI Codex OAuth
+openai({ access: 'eyJ...', defaultModel: 'gpt-5.4' })
+openai({ access: 'eyJ...', refresh: '...', expires: Date.now() + 3600_000, accountId: 'acct_123' })
+```
+
+Fallback: `params.apiKey` > `params.access` > `OPENAI_CODEX_API_KEY` env > `.credentials.json`
+
+Pass the full OAuth credential fields (`access`, `refresh`, `expires`, plus provider extras like `accountId`) to let the provider auto-refresh tokens without reading `.credentials.json`.
+
 ### Cerebras
 
 ```ts
-import { cerebras } from 'zidane'
+import { cerebras } from 'zidane/providers'
 
 cerebras({ apiKey: 'csk-...', defaultModel: 'zai-glm-4.7' })
 ```
@@ -136,7 +154,7 @@ Tools are grouped into **harnesses**. The `basic` harness includes:
 Define a custom harness:
 
 ```ts
-import { defineHarness, basicTools } from 'zidane'
+import { defineHarness, basicTools } from 'zidane/harnesses'
 
 const harness = defineHarness({
   name: 'researcher',
@@ -221,6 +239,12 @@ agent.hooks.hook('stream:thinking', (ctx) => {
   // ctx.delta, ctx.thinking (accumulated), ctx.turnId
   // Fires when the model streams reasoning traces (Anthropic, OpenRouter)
 })
+
+agent.hooks.hook('oauth:refresh', (ctx) => {
+  // ctx.provider, ctx.providerId, ctx.source
+  // ctx.previousCredentials, ctx.credentials
+  // Fires when an OAuth token is refreshed from passed credentials or .credentials.json
+})
 ```
 
 ### Tool execution
@@ -290,7 +314,8 @@ agent.followUp('now write tests for what you built')
 The `spawn` tool delegates tasks to child agents that run independently.
 
 ```ts
-import { createSpawnTool, defineHarness, basicTools } from 'zidane'
+import { createSpawnTool } from 'zidane/tools'
+import { defineHarness, basicTools } from 'zidane/harnesses'
 
 const harness = defineHarness({
   name: 'orchestrator',
@@ -312,7 +337,8 @@ Children inherit the parent's harness and can spawn their own children.
 Let the agent pause and request structured input from the outside world. Not included in any harness by default.
 
 ```ts
-import { createInteractionTool, defineHarness, basicTools } from 'zidane'
+import { createInteractionTool } from 'zidane/tools'
+import { defineHarness, basicTools } from 'zidane/harnesses'
 
 const askUser = createInteractionTool({
   name: 'ask_user',

package/dist/{agent-CtGvwTdo.d.ts → agent-B__ISsOE.d.ts}

@@ -158,6 +158,22 @@ interface SpawnHookContext {
 interface StreamHookContext {
     turnId: string;
 }
+/** Context for OAuth refresh hooks */
+interface OAuthRefreshHookContext {
+    provider: string;
+    providerId: string;
+    source: 'params' | 'file';
+    previousCredentials: Record<string, unknown> & {
+        access: string;
+        refresh: string;
+        expires: number;
+    };
+    credentials: Record<string, unknown> & {
+        access: string;
+        refresh: string;
+        expires: number;
+    };
+}
 type SessionEndStatus = 'completed' | 'aborted' | 'error';
 
 interface AnthropicParams {
@@ -175,6 +191,19 @@ interface CerebrasParams {
 }
 declare function cerebras(params?: CerebrasParams): Provider;
 
+interface OpenAIParams {
+    /** OpenAI Codex OAuth access token. Falls back to OPENAI_CODEX_API_KEY and .credentials.json. */
+    apiKey?: string;
+    /** Alias for apiKey, matching the OAuth credential field. */
+    access?: string;
+    refresh?: string;
+    expires?: number;
+    accountId?: string;
+    defaultModel?: string;
+    transport?: 'sse' | 'websocket' | 'auto';
+}
+declare function openai(params?: OpenAIParams): Provider;
+
 interface OpenRouterParams {
     apiKey?: string;
     defaultModel?: string;
@@ -198,6 +227,7 @@ interface ToolResult {
 interface StreamCallbacks {
     onText: (delta: string) => void;
     onThinking?: (delta: string) => void;
+    onOAuthRefresh?: (ctx: OAuthRefreshHookContext) => void | Promise<void>;
 }
 interface TurnResult {
     /** Full assistant turn as a SessionMessage */
@@ -553,6 +583,7 @@ interface AgentHooks {
         delta: string;
         thinking: string;
     }) => void;
+    'oauth:refresh': (ctx: OAuthRefreshHookContext) => void;
     'tool:gate': (ctx: ToolHookContext & {
         block: boolean;
         reason: string;
@@ -683,4 +714,4 @@ interface Agent {
 }
 declare function createAgent({ harness: harnessOption, provider, behavior: agentBehavior, execution, mcpServers, session, skills: agentSkills, _mcpConnector }: AgentOptions): Agent;
 
-export { fromOpenAI as $, type Agent as A, type ToolDef as B, type CerebrasParams as C, type ToolExecutionMode as D, type ToolHookContext as E, type ToolMap as F, type ToolResult as G, type Harness as H, type ImageContent as I, type ToolSpec as J, type TurnResult as K, type TurnUsage as L, type McpConnection as M, autoDetectAndConvert as N, type OpenRouterParams as O, type Provider as P, connectMcpServers as Q, type RemoteStoreOptions as R, type Session as S, type ThinkingLevel as T, createAgent as U, createMemoryStore as V, createRemoteStore as W, createSession as X, createSqliteStore as Y, defineHarness as Z, fromAnthropic as _, type AgentBehavior as a, loadSession as a0, noTools as a1, toAnthropic as a2, toOpenAI as a3, anthropic as a4, cerebras as a5, openrouter as a6, _default as a7, basicTools as a8, resultToString as a9, type AgentHooks as b, type AgentOptions as c, type AgentRunOptions as d, type AgentStats as e, type AnthropicParams as f, type ChildRunStats as g, type CreateSessionOptions as h, type HarnessConfig as i, type McpServerConfig as j, type McpToolHookContext as k, type SessionContentBlock as l, type SessionData as m, type SessionEndStatus as n, type SessionHookContext as o, type SessionMessage as p, type SessionRun as q, type SessionStore as r, type SessionTurn as s, type SpawnHookContext as t, type SqliteStoreOptions as u, type StreamCallbacks as v, type StreamHookContext as w, type StreamOptions as x, type ToolCall as y, type ToolContext as z };
+export { defineHarness as $, type Agent as A, type ToolCall as B, type CerebrasParams as C, type ToolContext as D, type ToolDef as E, type ToolExecutionMode as F, type ToolHookContext as G, type Harness as H, type ImageContent as I, type ToolMap as J, type ToolResult as K, type ToolSpec as L, type McpConnection as M, type TurnResult as N, type OAuthRefreshHookContext as O, type Provider as P, type TurnUsage as Q, type RemoteStoreOptions as R, type Session as S, type ThinkingLevel as T, autoDetectAndConvert as U, connectMcpServers as V, createAgent as W, createMemoryStore as X, createRemoteStore as Y, createSession as Z, createSqliteStore as _, type AgentBehavior as a, fromAnthropic as a0, fromOpenAI as a1, loadSession as a2, noTools as a3, toAnthropic as a4, toOpenAI as a5, anthropic as a6, cerebras as a7, openai as a8, openrouter as a9, _default as aa, basicTools as ab, resultToString as ac, type AgentHooks as b, type AgentOptions as c, type AgentRunOptions as d, type AgentStats as e, type AnthropicParams as f, type ChildRunStats as g, type CreateSessionOptions as h, type HarnessConfig as i, type McpServerConfig as j, type McpToolHookContext as k, type OpenAIParams as l, type OpenRouterParams as m, type SessionContentBlock as n, type SessionData as o, type SessionEndStatus as p, type SessionHookContext as q, type SessionMessage as r, type SessionRun as s, type SessionStore as t, type SessionTurn as u, type SpawnHookContext as v, type SqliteStoreOptions as w, type StreamCallbacks as x, type StreamHookContext as y, type StreamOptions as z };

package/dist/{chunk-OJATGJ5F.js → chunk-O4QCBJQF.js}

@@ -196,6 +196,9 @@ async function executeTurn(ctx, turn) {
         onThinking(delta) {
           currentThinking += delta;
           ctx.hooks.callHook("stream:thinking", { delta, thinking: currentThinking, turnId });
+        },
+        onOAuthRefresh(refreshCtx) {
+          return ctx.hooks.callHook("oauth:refresh", refreshCtx);
         }
       }
     );
@@ -243,8 +246,13 @@ async function executeTurn(ctx, turn) {
           signal: ctx.signal,
           toolChoice: { type: "tool", name: "__output__" }
         },
-        { onText: () => {
-        } }
+        {
+          onText: () => {
+          },
+          onOAuthRefresh(refreshCtx) {
+            return ctx.hooks.callHook("oauth:refresh", refreshCtx);
+          }
+        }
       );
       const output = schemaResult.toolCalls.find((tc) => tc.name === "__output__")?.input;
       if (output) {

package/dist/{chunk-KLFSGJE4.js → chunk-T6MC3WP5.js}

@@ -4,7 +4,7 @@ import {
   shell,
   spawn,
   writeFile
-} from "./chunk-OJATGJ5F.js";
+} from "./chunk-O4QCBJQF.js";
 
 // src/harnesses/basic.ts
 var basicTools = { shell, readFile, writeFile, listFiles };

package/dist/harnesses.d.ts

@@ -1,5 +1,5 @@
 import 'hookable';
-export { H as Harness, i as HarnessConfig, z as ToolContext, B as ToolDef, F as ToolMap, a7 as basic, a8 as basicTools, Z as defineHarness, a1 as noTools } from './agent-CtGvwTdo.js';
+export { H as Harness, i as HarnessConfig, D as ToolContext, E as ToolDef, J as ToolMap, aa as basic, ab as basicTools, $ as defineHarness, a3 as noTools } from './agent-B__ISsOE.js';
 import './types-BpvTmawk.js';
 import './types-CDI8Kmve.js';
 import '@modelcontextprotocol/sdk/client/index.js';

package/dist/harnesses.js

@@ -3,8 +3,8 @@ import {
   basic_default,
   defineHarness,
   noTools
-} from "./chunk-KLFSGJE4.js";
-import "./chunk-OJATGJ5F.js";
+} from "./chunk-T6MC3WP5.js";
+import "./chunk-O4QCBJQF.js";
 import "./chunk-4C6Y56CC.js";
 import "./chunk-SZA4FKW5.js";
 import "./chunk-WDBO3JCO.js";

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-export { A as Agent, a as AgentBehavior, b as AgentHooks, c as AgentOptions, d as AgentRunOptions, e as AgentStats, h as CreateSessionOptions, H as Harness, i as HarnessConfig, I as ImageContent, M as McpConnection, j as McpServerConfig, k as McpToolHookContext, R as RemoteStoreOptions, S as Session, l as SessionContentBlock, m as SessionData, n as SessionEndStatus, o as SessionHookContext, p as SessionMessage, q as SessionRun, r as SessionStore, s as SessionTurn, t as SpawnHookContext, u as SqliteStoreOptions, w as StreamHookContext, T as ThinkingLevel, z as ToolContext, B as ToolDef, D as ToolExecutionMode, E as ToolHookContext, F as ToolMap, L as TurnUsage, N as autoDetectAndConvert, Q as connectMcpServers, U as createAgent, V as createMemoryStore, W as createRemoteStore, X as createSession, Y as createSqliteStore, Z as defineHarness, _ as fromAnthropic, $ as fromOpenAI, a0 as loadSession, a1 as noTools, a2 as toAnthropic, a3 as toOpenAI } from './agent-CtGvwTdo.js';
+export { A as Agent, a as AgentBehavior, b as AgentHooks, c as AgentOptions, d as AgentRunOptions, e as AgentStats, h as CreateSessionOptions, H as Harness, i as HarnessConfig, I as ImageContent, M as McpConnection, j as McpServerConfig, k as McpToolHookContext, O as OAuthRefreshHookContext, R as RemoteStoreOptions, S as Session, n as SessionContentBlock, o as SessionData, p as SessionEndStatus, q as SessionHookContext, r as SessionMessage, s as SessionRun, t as SessionStore, u as SessionTurn, v as SpawnHookContext, w as SqliteStoreOptions, y as StreamHookContext, T as ThinkingLevel, D as ToolContext, E as ToolDef, F as ToolExecutionMode, G as ToolHookContext, J as ToolMap, Q as TurnUsage, U as autoDetectAndConvert, V as connectMcpServers, W as createAgent, X as createMemoryStore, Y as createRemoteStore, Z as createSession, _ as createSqliteStore, $ as defineHarness, a0 as fromAnthropic, a1 as fromOpenAI, a2 as loadSession, a3 as noTools, a4 as toAnthropic, a5 as toOpenAI } from './agent-B__ISsOE.js';
 export { createDockerContext, createProcessContext } from './contexts.js';
 export { S as SandboxProvider, c as createSandboxContext } from './sandbox-CW72eLDP.js';
 export { C as ContextCapabilities, a as ContextType, E as ExecResult, b as ExecutionContext, c as ExecutionHandle, S as SpawnConfig } from './types-BpvTmawk.js';
 export { buildCatalog, defineSkill, discoverSkills, interpolateShellCommands, mergeSkillsConfig, parseSkillFile, resolveSkills, validateSkillName, writeSkillToDisk, writeSkillsToDisk } from './skills.js';
 export { S as SkillConfig, a as SkillResource, b as SkillsConfig } from './types-CDI8Kmve.js';
-export { C as ChildAgent, I as InteractionToolOptions, S as SpawnToolOptions, a as SpawnToolState, c as createInteractionTool, b as createSpawnTool, s as spawn } from './spawn-hNTJA3Iw.js';
+export { C as ChildAgent, I as InteractionToolOptions, S as SpawnToolOptions, a as SpawnToolState, c as createInteractionTool, b as createSpawnTool, s as spawn } from './spawn-DRamirTu.js';
 import 'hookable';
 import '@modelcontextprotocol/sdk/client/index.js';
 

package/dist/index.js

@@ -4,13 +4,13 @@ import {
 import {
   defineHarness,
   noTools
-} from "./chunk-KLFSGJE4.js";
+} from "./chunk-T6MC3WP5.js";
 import {
   createAgent,
   createInteractionTool,
   createSpawnTool,
   spawn
-} from "./chunk-OJATGJ5F.js";
+} from "./chunk-O4QCBJQF.js";
 import {
   buildCatalog,
   discoverSkills,

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import 'hookable';
-export { M as McpConnection, j as McpServerConfig, Q as connectMcpServers, a9 as resultToString } from './agent-CtGvwTdo.js';
+export { M as McpConnection, j as McpServerConfig, V as connectMcpServers, ac as resultToString } from './agent-B__ISsOE.js';
 import '@modelcontextprotocol/sdk/client/index.js';
 import './types-BpvTmawk.js';
 import './types-CDI8Kmve.js';

package/dist/providers.d.ts

@@ -1,4 +1,4 @@
-export { f as AnthropicParams, C as CerebrasParams, O as OpenRouterParams, P as Provider, v as StreamCallbacks, x as StreamOptions, y as ToolCall, G as ToolResult, J as ToolSpec, K as TurnResult, a4 as anthropic, a5 as cerebras, a6 as openrouter } from './agent-CtGvwTdo.js';
+export { f as AnthropicParams, C as CerebrasParams, l as OpenAIParams, m as OpenRouterParams, P as Provider, x as StreamCallbacks, z as StreamOptions, B as ToolCall, K as ToolResult, L as ToolSpec, N as TurnResult, a6 as anthropic, a7 as cerebras, a8 as openai, a9 as openrouter } from './agent-B__ISsOE.js';
 import 'hookable';
 import './types-BpvTmawk.js';
 import '@modelcontextprotocol/sdk/client/index.js';

package/dist/providers.js

@@ -11,35 +11,99 @@ import {
 } from "./chunk-QCJKUQTQ.js";
 
 // src/providers/anthropic.ts
-import { existsSync, readFileSync } from "fs";
-import { resolve } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
 import Anthropic from "@anthropic-ai/sdk";
-var CREDENTIALS_FILE = resolve(import.meta.dir, "../../.credentials.json");
-function getApiKey(anthropicParams) {
+
+// src/providers/oauth.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { resolve } from "path";
+import { getOAuthApiKey } from "@yaelg/pi-ai/oauth";
+var CREDENTIALS_FILE = resolve(process.cwd(), ".credentials.json");
+function readOAuthCredentials() {
+  if (!existsSync(CREDENTIALS_FILE))
+    return {};
+  return JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+}
+function writeOAuthCredentials(credentials) {
+  writeFileSync(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2));
+}
+function credentialsFromParams(params, extraKeys = []) {
+  if (typeof params?.access !== "string" || typeof params.refresh !== "string" || typeof params.expires !== "number")
+    return void 0;
+  const extras = Object.fromEntries(
+    extraKeys.map((key) => [key, params[key]]).filter(([, value]) => value !== void 0)
+  );
+  return {
+    access: params.access,
+    refresh: params.refresh,
+    expires: params.expires,
+    ...extras
+  };
+}
+async function resolveOAuthApiKey(options, callbacks) {
+  if (typeof options.params?.apiKey === "string")
+    return options.params.apiKey;
+  const paramsCredentials = credentialsFromParams(options.params, options.extraCredentialKeys);
+  if (paramsCredentials) {
+    return await resolveCredentialSource("params", paramsCredentials);
+  }
+  if (typeof options.params?.access === "string")
+    return options.params.access;
+  if (options.envKey && process.env[options.envKey])
+    return process.env[options.envKey];
+  const readCredentials = options.readCredentials ?? readOAuthCredentials;
+  const writeCredentials = options.writeCredentials ?? writeOAuthCredentials;
+  const allCredentials = readCredentials();
+  const storedCredentials = allCredentials[options.providerId];
+  if (!storedCredentials)
+    throw new Error(options.missingError);
+  return await resolveCredentialSource("file", storedCredentials, allCredentials, writeCredentials);
+  async function resolveCredentialSource(source, current, allCredentials2, persistCredentials) {
+    try {
+      const refreshOAuthApiKey = options.getOAuthApiKey ?? getOAuthApiKey;
+      const result = await refreshOAuthApiKey(options.providerId, { [options.providerId]: current });
+      if (!result)
+        throw new Error(options.missingError);
+      if (result.newCredentials !== current) {
+        if (source === "file" && allCredentials2 && persistCredentials) {
+          allCredentials2[options.providerId] = result.newCredentials;
+          persistCredentials(allCredentials2);
+        }
+        await callbacks?.onOAuthRefresh?.({
+          provider: options.provider,
+          providerId: options.providerId,
+          source,
+          previousCredentials: { ...current },
+          credentials: { ...result.newCredentials }
+        });
+      }
+      return result.apiKey;
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new Error(options.refreshError(reason));
+    }
+  }
+}
+
+// src/providers/anthropic.ts
+var CREDENTIALS_FILE2 = resolve2(process.cwd(), ".credentials.json");
+function getConfiguredApiKey(anthropicParams) {
   if (anthropicParams?.apiKey)
     return anthropicParams.apiKey;
   if (anthropicParams?.access)
     return anthropicParams.access;
   if (process.env.ANTHROPIC_API_KEY)
     return process.env.ANTHROPIC_API_KEY;
-  if (existsSync(CREDENTIALS_FILE)) {
-    const creds = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+  if (existsSync2(CREDENTIALS_FILE2)) {
+    const creds = JSON.parse(readFileSync2(CREDENTIALS_FILE2, "utf-8"));
     if (creds.anthropic?.access)
       return creds.anthropic.access;
   }
   throw new Error("No API key found. Run `bun run auth` first.");
 }
-var THINKING_BUDGETS = {
-  minimal: 1024,
-  low: 4096,
-  medium: 10240,
-  high: 32768
-};
-function anthropic(anthropicParams) {
-  const apiKey = getApiKey(anthropicParams);
-  const isOAuth = apiKey.includes("sk-ant-oat");
-  const defaultModel = anthropicParams?.defaultModel || "claude-opus-4-6";
-  const client = new Anthropic(
+function createClient(apiKey, isOAuth) {
+  return new Anthropic(
     isOAuth ? {
       apiKey: null,
       authToken: apiKey,
@@ -52,6 +116,22 @@ function anthropic(anthropicParams) {
       }
     } : { apiKey }
   );
+}
+var THINKING_BUDGETS = {
+  minimal: 1024,
+  low: 4096,
+  medium: 10240,
+  high: 32768
+};
+function anthropic(anthropicParams) {
+  const configuredApiKey = getConfiguredApiKey(anthropicParams);
+  const isOAuth = configuredApiKey.includes("sk-ant-oat");
+  const defaultModel = anthropicParams?.defaultModel || "claude-opus-4-6";
+  let runtimeCredentials = typeof anthropicParams?.access === "string" && typeof anthropicParams.refresh === "string" && typeof anthropicParams.expires === "number" ? {
+    access: anthropicParams.access,
+    refresh: anthropicParams.refresh,
+    expires: anthropicParams.expires
+  } : void 0;
   return {
     name: "anthropic",
     meta: { defaultModel, isOAuth },
@@ -92,6 +172,30 @@ function anthropic(anthropicParams) {
       };
     },
     async stream(options, callbacks) {
+      const apiKey = await resolveOAuthApiKey(
+        {
+          provider: "anthropic",
+          providerId: "anthropic",
+          params: runtimeCredentials ? { ...anthropicParams, ...runtimeCredentials } : anthropicParams,
+          envKey: "ANTHROPIC_API_KEY",
+          missingError: "No API key found. Run `bun run auth` first.",
+          refreshError: (reason) => `Anthropic OAuth token refresh failed. Run \`bun run auth --anthropic\` again. ${reason}`
+        },
+        {
+          ...callbacks,
+          async onOAuthRefresh(ctx) {
+            if (ctx.source === "params") {
+              runtimeCredentials = {
+                access: ctx.credentials.access,
+                refresh: ctx.credentials.refresh,
+                expires: ctx.credentials.expires
+              };
+            }
+            await callbacks.onOAuthRefresh?.(ctx);
+          }
+        }
+      );
+      const client = createClient(apiKey, apiKey.includes("sk-ant-oat"));
       const system = isOAuth ? `You are Claude Code, Anthropic's official CLI for Claude.` : options.system;
       const messages = isOAuth && options.system ? [
         { role: "user", content: [{ type: "text", text: options.system }] },
@@ -157,7 +261,7 @@ function anthropic(anthropicParams) {
 
 // src/providers/cerebras.ts
 var BASE_URL = "https://api.cerebras.ai/v1";
-function getApiKey2(params) {
+function getApiKey(params) {
   if (params?.apiKey)
     return params.apiKey;
   if (process.env.CEREBRAS_API_KEY)
@@ -165,7 +269,7 @@ function getApiKey2(params) {
   throw new Error("No Cerebras API key found. Set CEREBRAS_API_KEY in your environment.");
 }
 function cerebras(params) {
-  const apiKey = getApiKey2(params);
+  const apiKey = getApiKey(params);
   const defaultModel = params?.defaultModel || "zai-glm-4.7";
   return {
     name: "cerebras",
@@ -219,9 +323,235 @@ function cerebras(params) {
   };
 }
 
+// src/providers/openai.ts
+import { getModel } from "@yaelg/pi-ai";
+import { streamOpenAICodexResponses } from "@yaelg/pi-ai/openai-codex-responses";
+var PROVIDER_ID = "openai-codex";
+var DEFAULT_MODEL = "gpt-5.4";
+function resolveModel(modelId) {
+  const model = getModel(PROVIDER_ID, modelId);
+  if (model)
+    return model;
+  const fallback = getModel(PROVIDER_ID, DEFAULT_MODEL);
+  if (!fallback)
+    throw new Error(`OpenAI Codex model registry is missing the default model: ${DEFAULT_MODEL}`);
+  return { ...fallback, id: modelId, name: modelId };
+}
+function emptyUsage() {
+  return {
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    totalTokens: 0,
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 }
+  };
+}
+function formatTools2(tools) {
+  return tools.map((t) => ({
+    name: t.name,
+    description: t.description,
+    parameters: t.inputSchema
+  }));
+}
+function toPiMessages(messages, modelId) {
+  const out = [];
+  for (const msg of messages) {
+    const toolResults = msg.content.filter((b) => b.type === "tool_result");
+    if (toolResults.length > 0) {
+      for (const result of toolResults) {
+        out.push({
+          role: "toolResult",
+          toolCallId: result.callId,
+          toolName: "",
+          content: [{ type: "text", text: result.output }],
+          isError: result.isError ?? false,
+          timestamp: Date.now()
+        });
+      }
+      continue;
+    }
+    const textBlocks = msg.content.filter((b) => b.type === "text");
+    const imageBlocks = msg.content.filter((b) => b.type === "image");
+    if (msg.role === "user") {
+      if (imageBlocks.length === 0 && textBlocks.length === 1) {
+        out.push({ role: "user", content: textBlocks[0].text, timestamp: Date.now() });
+        continue;
+      }
+      out.push({
+        role: "user",
+        content: [
+          ...imageBlocks.map((img) => ({ type: "image", data: img.data, mimeType: img.mediaType })),
+          ...textBlocks.map((block) => ({ type: "text", text: block.text }))
+        ],
+        timestamp: Date.now()
+      });
+      continue;
+    }
+    const content = [];
+    for (const block of msg.content) {
+      if (block.type === "text") {
+        content.push({ type: "text", text: block.text });
+      } else if (block.type === "thinking") {
+        content.push({ type: "thinking", thinking: block.text, thinkingSignature: block.signature });
+      } else if (block.type === "tool_call") {
+        content.push({ type: "toolCall", id: block.id, name: block.name, arguments: block.input });
+      }
+    }
+    out.push({
+      role: "assistant",
+      content,
+      api: "openai-codex-responses",
+      provider: PROVIDER_ID,
+      model: modelId,
+      usage: emptyUsage(),
+      stopReason: "stop",
+      timestamp: Date.now()
+    });
+  }
+  return out;
+}
+function fromPiAssistantMessage(message) {
+  const content = [];
+  for (const block of message.content) {
+    if (block.type === "text") {
+      content.push({ type: "text", text: block.text });
+    } else if (block.type === "thinking") {
+      content.push({ type: "thinking", text: block.thinking, signature: block.thinkingSignature });
+    } else if (block.type === "toolCall") {
+      content.push({ type: "tool_call", id: block.id, name: block.name, input: block.arguments });
+    }
+  }
+  return { role: "assistant", content };
+}
+function extractToolCalls(message) {
+  return message.content.filter((block) => block.type === "toolCall").map((block) => ({
+    id: block.id,
+    name: block.name,
+    input: block.arguments
+  }));
+}
+function extractText(message) {
+  return message.content.filter((block) => block.type === "text").map((block) => block.text).join("");
+}
+function toTurnUsage(usage) {
+  return {
+    input: usage.input,
+    output: usage.output,
+    cacheRead: usage.cacheRead || void 0,
+    cacheCreation: usage.cacheWrite || void 0,
+    cost: usage.cost.total || void 0
+  };
+}
+function applyPayloadOverrides(payload, options) {
+  const body = payload;
+  if (options.toolChoice) {
+    if (options.toolChoice.type === "tool" && options.toolChoice.name)
+      body.tool_choice = { type: "function", name: options.toolChoice.name };
+    else if (options.toolChoice.type === "required")
+      body.tool_choice = "required";
+    else
+      body.tool_choice = "auto";
+  }
+  return body;
+}
+function openai(params) {
+  const defaultModel = params?.defaultModel || DEFAULT_MODEL;
+  let runtimeCredentials = typeof params?.access === "string" && typeof params.refresh === "string" && typeof params.expires === "number" ? {
+    access: params.access,
+    refresh: params.refresh,
+    expires: params.expires,
+    ...params.accountId ? { accountId: params.accountId } : {}
+  } : void 0;
+  return {
+    name: "openai",
+    meta: { defaultModel, isOAuth: true },
+    formatTools: formatTools2,
+    userMessage,
+    assistantMessage,
+    toolResultsMessage,
+    async stream(options, callbacks) {
+      const modelId = options.model || defaultModel;
+      const model = resolveModel(modelId);
+      const apiKey = await resolveOAuthApiKey(
+        {
+          provider: "openai",
+          providerId: PROVIDER_ID,
+          params: runtimeCredentials ? { ...params, ...runtimeCredentials } : params,
+          envKey: "OPENAI_CODEX_API_KEY",
+          extraCredentialKeys: ["accountId"],
+          missingError: "No OpenAI Codex OAuth token found. Run `bun run auth --openai` first.",
+          refreshError: (reason) => `OpenAI Codex OAuth token refresh failed. Run \`bun run auth --openai\` again. ${reason}`
+        },
+        {
+          ...callbacks,
+          async onOAuthRefresh(ctx) {
+            if (ctx.source === "params") {
+              runtimeCredentials = {
+                access: ctx.credentials.access,
+                refresh: ctx.credentials.refresh,
+                expires: ctx.credentials.expires,
+                ...typeof ctx.credentials.accountId === "string" ? { accountId: ctx.credentials.accountId } : {}
+              };
+            }
+            await callbacks.onOAuthRefresh?.(ctx);
+          }
+        }
+      );
+      const context = {
+        systemPrompt: options.system,
+        messages: toPiMessages(options.messages, modelId),
+        tools: options.tools
+      };
+      const stream = streamOpenAICodexResponses(model, context, {
+        apiKey,
+        maxTokens: options.maxTokens,
+        signal: options.signal,
+        transport: params?.transport,
+        reasoningEffort: options.thinking && options.thinking !== "off" ? options.thinking : void 0,
+        reasoningSummary: options.thinking && options.thinking !== "off" ? "auto" : void 0,
+        onPayload: (payload) => applyPayloadOverrides(payload, options)
+      });
+      let finalMessage;
+      let text = "";
+      let thinking = "";
+      for await (const event of stream) {
+        if (event.type === "text_delta") {
+          text += event.delta;
+          callbacks.onText(event.delta);
+        } else if (event.type === "thinking_delta") {
+          thinking += event.delta;
+          callbacks.onThinking?.(event.delta);
+        } else if (event.type === "thinking_end") {
+          const delta = event.content.startsWith(thinking) ? event.content.slice(thinking.length) : thinking ? "" : event.content;
+          if (delta) {
+            thinking += delta;
+            callbacks.onThinking?.(delta);
+          }
+        } else if (event.type === "done") {
+          finalMessage = event.message;
+        } else if (event.type === "error") {
+          throw new Error(event.error.errorMessage || "OpenAI Codex API error");
+        }
+      }
+      finalMessage ??= await stream.result();
+      text ||= extractText(finalMessage);
+      const toolCalls = extractToolCalls(finalMessage);
+      const assistantTurn = fromPiAssistantMessage(finalMessage);
+      return {
+        assistantMessage: assistantTurn,
+        text,
+        toolCalls,
+        done: toolCalls.length === 0,
+        usage: toTurnUsage(finalMessage.usage)
+      };
+    }
+  };
+}
+
 // src/providers/openrouter.ts
 var BASE_URL2 = "https://openrouter.ai/api/v1";
-function getApiKey3(params) {
+function getApiKey2(params) {
   if (params?.apiKey)
     return params.apiKey;
   if (process.env.OPENROUTER_API_KEY)
@@ -229,7 +559,7 @@ function getApiKey3(params) {
   throw new Error("No OpenRouter API key found. Set OPENROUTER_API_KEY in your environment.");
 }
 function openrouter(params) {
-  const apiKey = getApiKey3(params);
+  const apiKey = getApiKey2(params);
   const defaultModel = params?.defaultModel || "anthropic/claude-sonnet-4-6";
   return {
     name: "openrouter",
@@ -287,5 +617,6 @@ function openrouter(params) {
 export {
   anthropic,
   cerebras,
+  openai,
   openrouter
 };

package/dist/session.d.ts

@@ -1,4 +1,4 @@
-export { h as CreateSessionOptions, R as RemoteStoreOptions, S as Session, l as SessionContentBlock, m as SessionData, p as SessionMessage, q as SessionRun, r as SessionStore, s as SessionTurn, u as SqliteStoreOptions, N as autoDetectAndConvert, V as createMemoryStore, W as createRemoteStore, X as createSession, Y as createSqliteStore, _ as fromAnthropic, $ as fromOpenAI, a0 as loadSession, a2 as toAnthropic, a3 as toOpenAI } from './agent-CtGvwTdo.js';
+export { h as CreateSessionOptions, R as RemoteStoreOptions, S as Session, n as SessionContentBlock, o as SessionData, r as SessionMessage, s as SessionRun, t as SessionStore, u as SessionTurn, w as SqliteStoreOptions, U as autoDetectAndConvert, X as createMemoryStore, Y as createRemoteStore, Z as createSession, _ as createSqliteStore, a0 as fromAnthropic, a1 as fromOpenAI, a2 as loadSession, a4 as toAnthropic, a5 as toOpenAI } from './agent-B__ISsOE.js';
 import 'hookable';
 import './types-BpvTmawk.js';
 import '@modelcontextprotocol/sdk/client/index.js';

package/dist/{spawn-hNTJA3Iw.d.ts → spawn-DRamirTu.d.ts}

@@ -1,4 +1,4 @@
-import { z as ToolContext, B as ToolDef, i as HarnessConfig, e as AgentStats } from './agent-CtGvwTdo.js';
+import { D as ToolContext, E as ToolDef, i as HarnessConfig, e as AgentStats } from './agent-B__ISsOE.js';
 
 /**
  * Interaction tool — lets the agent request structured input from the outside world.

package/dist/tools.d.ts

@@ -1,5 +1,5 @@
-export { C as ChildAgent, I as InteractionToolOptions, S as SpawnToolOptions, a as SpawnToolState, c as createInteractionTool, b as createSpawnTool, s as spawn } from './spawn-hNTJA3Iw.js';
-import { B as ToolDef } from './agent-CtGvwTdo.js';
+export { C as ChildAgent, I as InteractionToolOptions, S as SpawnToolOptions, a as SpawnToolState, c as createInteractionTool, b as createSpawnTool, s as spawn } from './spawn-DRamirTu.js';
+import { E as ToolDef } from './agent-B__ISsOE.js';
 export { V as ValidationResult, v as validateToolArgs } from './validation-DOY_k7lW.js';
 import 'hookable';
 import './types-BpvTmawk.js';

package/dist/tools.js

@@ -7,7 +7,7 @@ import {
   spawn,
   validateToolArgs,
   writeFile
-} from "./chunk-OJATGJ5F.js";
+} from "./chunk-O4QCBJQF.js";
 import "./chunk-4C6Y56CC.js";
 import "./chunk-SZA4FKW5.js";
 import "./chunk-WDBO3JCO.js";

package/dist/types.d.ts

@@ -1,8 +1,8 @@
-export { A as Agent, a as AgentBehavior, b as AgentHooks, c as AgentOptions, d as AgentRunOptions, e as AgentStats, f as AnthropicParams, C as CerebrasParams, g as ChildRunStats, h as CreateSessionOptions, H as Harness, i as HarnessConfig, I as ImageContent, M as McpConnection, j as McpServerConfig, k as McpToolHookContext, O as OpenRouterParams, P as Provider, R as RemoteStoreOptions, S as Session, l as SessionContentBlock, m as SessionData, n as SessionEndStatus, o as SessionHookContext, p as SessionMessage, q as SessionRun, r as SessionStore, s as SessionTurn, t as SpawnHookContext, u as SqliteStoreOptions, v as StreamCallbacks, w as StreamHookContext, x as StreamOptions, T as ThinkingLevel, y as ToolCall, z as ToolContext, B as ToolDef, D as ToolExecutionMode, E as ToolHookContext, F as ToolMap, G as ToolResult, J as ToolSpec, K as TurnResult, L as TurnUsage } from './agent-CtGvwTdo.js';
+export { A as Agent, a as AgentBehavior, b as AgentHooks, c as AgentOptions, d as AgentRunOptions, e as AgentStats, f as AnthropicParams, C as CerebrasParams, g as ChildRunStats, h as CreateSessionOptions, H as Harness, i as HarnessConfig, I as ImageContent, M as McpConnection, j as McpServerConfig, k as McpToolHookContext, O as OAuthRefreshHookContext, l as OpenAIParams, m as OpenRouterParams, P as Provider, R as RemoteStoreOptions, S as Session, n as SessionContentBlock, o as SessionData, p as SessionEndStatus, q as SessionHookContext, r as SessionMessage, s as SessionRun, t as SessionStore, u as SessionTurn, v as SpawnHookContext, w as SqliteStoreOptions, x as StreamCallbacks, y as StreamHookContext, z as StreamOptions, T as ThinkingLevel, B as ToolCall, D as ToolContext, E as ToolDef, F as ToolExecutionMode, G as ToolHookContext, J as ToolMap, K as ToolResult, L as ToolSpec, N as TurnResult, Q as TurnUsage } from './agent-B__ISsOE.js';
 export { C as ContextCapabilities, a as ContextType, E as ExecResult, b as ExecutionContext, c as ExecutionHandle, S as SpawnConfig } from './types-BpvTmawk.js';
 export { S as SandboxProvider } from './sandbox-CW72eLDP.js';
 export { S as SkillConfig, a as SkillResource, b as SkillsConfig } from './types-CDI8Kmve.js';
-export { C as ChildAgent, I as InteractionToolOptions, S as SpawnToolOptions, a as SpawnToolState } from './spawn-hNTJA3Iw.js';
+export { C as ChildAgent, I as InteractionToolOptions, S as SpawnToolOptions, a as SpawnToolState } from './spawn-DRamirTu.js';
 export { V as ValidationResult } from './validation-DOY_k7lW.js';
 import 'hookable';
 import '@modelcontextprotocol/sdk/client/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zidane",
-  "version": "1.6.17",
+  "version": "1.7.0",
   "description": "an agent that goes straight to the goal",
   "type": "module",
   "private": false,
@@ -67,9 +67,9 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.80.0",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "@yaelg/pi-ai": "^0.58.4",
+    "@anthropic-ai/sdk": "^0.88.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@yaelg/pi-ai": "^0.66.1",
     "chalk": "^5.6.2",
     "hookable": "^6.1.0",
     "md4x": "^0.0.25"
@@ -83,13 +83,13 @@
     }
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^7.7.3",
-    "@types/bun": "^1.3.11",
+    "@antfu/eslint-config": "^8.1.1",
+    "@types/bun": "^1.3.12",
     "@types/dockerode": "^4.0.1",
     "bumpp": "^11.0.1",
-    "eslint": "^10.0.3",
+    "eslint": "^10.2.0",
     "jiti": "^2.6.1",
     "tsup": "^8.5.1",
-    "typescript": "~5.9.3"
+    "typescript": "~6.0.2"
   }
 }