V0.9.0rc

[Shironex]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces significant new functionality by adding support for Codex (OpenAI) and Cursor as AI providers. The changes are extensive and well-engineered, particularly the refactoring of authentication utilities to be more secure and robust, and the new API-first settings synchronization mechanism. The addition of a unified CLI detection framework and error handling system are also great improvements for maintainability.
I've identified a couple of bugs in the new authentication and CLI detection logic that could lead to incorrect behavior, and have suggested fixes. I also noticed some leftover debugging console.log statements in the new Codex-related files that should be replaced with a proper logger. Overall, this is a very strong set of changes that greatly expands the application's capabilities.

[gemini-code-assist]

The logic to determine the environment variable for the API key doesn't handle the cursor provider correctly. It defaults to ANTHROPIC_API_KEY for any provider that is not openai. This will cause CLI authentication to fail for the Cursor provider.

Suggested change

	const envKey = provider === 'openai' ? 'OPENAI_API_KEY' : 'ANTHROPIC_API_KEY';
	const envKey = provider === 'openai' ? 'OPENAI_API_KEY' : provider === 'cursor' ? 'CURSOR_API_KEY' : 'ANTHROPIC_API_KEY';

[gemini-code-assist]

Similar to the logic for CLI authentication, the environment variable key for API key authentication is incorrect for the cursor provider. It defaults to ANTHROPIC_API_KEY, which will cause API key-based authentication for Cursor to fail.

Suggested change

	const envKey = provider === 'openai' ? 'OPENAI_API_KEY' : 'ANTHROPIC_API_KEY';
	const envKey = provider === 'openai' ? 'OPENAI_API_KEY' : provider === 'cursor' ? 'CURSOR_API_KEY' : 'ANTHROPIC_API_KEY';

[gemini-code-assist]

The checkClaudeAuth function incorrectly assumes the CLI is authenticated if the --version command succeeds. A version command usually works even when not authenticated. The more reliable whoami check should be the primary method for verifying authentication.

The current implementation might return a false positive for authentication status.

async function checkClaudeAuth(command: string): Promise<'cli' | 'api_key' | 'none'> {
  // Check for environment variable
  if (process.env.ANTHROPIC_API_KEY) {
    return 'api_key';
  }

  // Try a more specific auth check
  return new Promise((resolve) => {
    const child = spawn(command, ['whoami'], {
      stdio: 'pipe',
      timeout: 3000,
    });

    let stdout = '';
    let stderr = '';

    child.stdout?.on('data', (data) => {
      stdout += data.toString();
    });

    child.stderr?.on('data', (data) => {
      stderr += data.toString();
    });

    child.on('close', (code) => {
      if (code === 0 && stdout && !stderr.includes('not authenticated')) {
        resolve('cli');
      } else {
        resolve('none');
      }
    });

    child.on('error', () => {
      resolve('none');
    });
  });
}

[gemini-code-assist]

The checkCodexAuth function uses the --version command to check for authentication, which is not a reliable indicator. A user can have the CLI installed (and thus a version) without being logged in.

A more robust method is to use the codex login status command and check its output. This would align with the implementation in the new codex-auth.ts file.

async function checkCodexAuth(command: string): Promise<'cli' | 'api_key' | 'none'> {
  // Check for environment variable
  if (process.env.OPENAI_API_KEY) {
    return 'api_key';
  }

  try {
    // Use 'codex login status' for a reliable auth check
    const output = execSync(`${command} login status`, { encoding: 'utf8', timeout: 5000 });
    if (output.toLowerCase().includes('logged in')) {
      return 'cli';
    }
  } catch {
    // Command failed, not authenticated via CLI
  }

  return 'none';
}

[gemini-code-assist]

This file contains many console.log statements, likely for debugging. In a production environment, this can lead to noisy and unstructured logs. It's better to use a dedicated logger, like the one provided by @automaker/utils, and log at a debug level. This allows logs to be enabled or disabled based on the environment.

For example, you could add import { createLogger } from '@automaker/utils'; and const logger = createLogger('CodexAuth'); at the top of the file, and then change this line to logger.debug(...).

[gemini-code-assist]

This file uses console.error for logging, and console.log in other places. For consistency and better log management, it's recommended to use a dedicated logger instance (e.g., from @automaker/utils) and use appropriate log levels like logger.error and logger.debug.

Additionally, this file is over 1000 lines long. Consider refactoring it into smaller, more focused modules to improve maintainability. For example, prompt building, CLI argument construction, and event stream parsing could each be extracted into their own utility files.