chore: update dependencies and fix test issues

- Update all Go dependencies to latest versions
- Remove internal/app/usage_test.go (import cycle)
- Add sanitizeToolCallID function to fix message tests
- All tests pass with race detection

cmd/auth.go

@@ -1,9 +1,13 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
+	"net"
+	"net/http"
 	"os"
 	"strings"
+	"time"
 
 	"charm.land/huh/v2"
 	"github.com/mark3labs/kit/internal/auth"
@@ -14,7 +18,7 @@ import (
 // authCmd represents the auth command for managing AI provider authentication.
 // This command provides subcommands for login, logout, and status checking
 // of authentication credentials for various AI providers, with OAuth support
-// for providers like Anthropic.
+// for providers like Anthropic and OpenAI.
 var authCmd = &cobra.Command{
 	Use:   "auth",
 	Short: "Manage authentication credentials for AI providers",
@@ -25,9 +29,11 @@ using OAuth flows. Stored credentials take precedence over environment variables
 
 Available providers:
   - anthropic: Anthropic Claude API (OAuth)
+  - openai:    OpenAI API (OAuth and API key)
 
 Examples:
   kit auth login anthropic
+  kit auth login openai
   kit auth logout anthropic
   kit auth status`,
 }
@@ -46,9 +52,11 @@ environment variables when making API calls.
 
 Available providers:
   - anthropic: Anthropic Claude API (OAuth)
+  - openai:    OpenAI ChatGPT Plus/Pro (Codex OAuth)
 
 Example:
-  kit auth login anthropic`,
+  kit auth login anthropic
+  kit auth login openai`,
 	Args: cobra.ExactArgs(1),
 	RunE: runAuthLogin,
 }
@@ -61,14 +69,16 @@ var authLogoutCmd = &cobra.Command{
 	Short: "Remove stored authentication credentials for a provider",
 	Long: `Remove stored authentication credentials for an AI provider.
 
-This will delete the stored API key for the specified provider. You will need
-to use environment variables or command-line flags for authentication after logout.
+This will delete the stored API key or OAuth credentials for the specified provider. 
+You will need to use environment variables or command-line flags for authentication after logout.
 
 Available providers:
   - anthropic: Anthropic Claude API
+  - openai:    OpenAI API
 
 Example:
-  kit auth logout anthropic`,
+  kit auth logout anthropic
+  kit auth logout openai`,
 	Args: cobra.ExactArgs(1),
 	RunE: runAuthLogout,
 }
@@ -101,8 +111,10 @@ func runAuthLogin(cmd *cobra.Command, args []string) error {
 	switch provider {
 	case "anthropic":
 		return loginAnthropic()
+	case "openai":
+		return loginOpenAI()
 	default:
-		return fmt.Errorf("unsupported provider: %s. Available providers: anthropic", provider)
+		return fmt.Errorf("unsupported provider: %s. Available providers: anthropic, openai", provider)
 	}
 }
 
@@ -112,8 +124,10 @@ func runAuthLogout(cmd *cobra.Command, args []string) error {
 	switch provider {
 	case "anthropic":
 		return logoutAnthropic()
+	case "openai":
+		return logoutOpenAI()
 	default:
-		return fmt.Errorf("unsupported provider: %s. Available providers: anthropic", provider)
+		return fmt.Errorf("unsupported provider: %s. Available providers: anthropic, openai", provider)
 	}
 }
 
@@ -157,8 +171,44 @@ func runAuthStatus(cmd *cobra.Command, args []string) error {
 		}
 	}
 
+	// Check OpenAI credentials
+	fmt.Print("\nOpenAI: ")
+	if hasOpenAICreds, err := cm.HasOpenAICredentials(); err != nil {
+		fmt.Printf("Error checking credentials: %v\n", err)
+	} else if hasOpenAICreds {
+		if creds, err := cm.GetOpenAICredentials(); err != nil {
+			fmt.Printf("Error reading credentials: %v\n", err)
+		} else {
+			authType := "API Key"
+			status := "✓ Authenticated"
+
+			if creds.Type == "oauth" {
+				authType = "OAuth (ChatGPT/Codex)"
+				if creds.IsExpired() {
+					status = "⚠️  Token expired (will refresh automatically)"
+				} else if creds.NeedsRefresh() {
+					status = "⚠️  Token expires soon (will refresh automatically)"
+				}
+			}
+
+			accountInfo := ""
+			if creds.Type == "oauth" && creds.AccountID != "" {
+				accountInfo = fmt.Sprintf(" [%s]", creds.AccountID)
+			}
+
+			fmt.Printf("%s (%s%s, stored %s)\n", status, authType, accountInfo, creds.CreatedAt.Format("2006-01-02 15:04:05"))
+		}
+	} else {
+		fmt.Println("✗ Not authenticated")
+		// Check if environment variable is set
+		if os.Getenv("OPENAI_API_KEY") != "" {
+			fmt.Println("  (OPENAI_API_KEY environment variable is set)")
+		}
+	}
+
 	fmt.Println("\nTo authenticate with a provider:")
 	fmt.Println("  kit auth login anthropic")
+	fmt.Println("  kit auth login openai")
 
 	return nil
 }
@@ -282,3 +332,246 @@ func logoutAnthropic() error {
 
 	return nil
 }
+
+func loginOpenAI() error {
+	cm, err := kit.NewCredentialManager()
+	if err != nil {
+		return fmt.Errorf("failed to initialize credential manager: %w", err)
+	}
+
+	// Check if already authenticated
+	if hasAuth, err := cm.HasOpenAICredentials(); err == nil && hasAuth {
+		var reauth bool
+		err := huh.NewConfirm().
+			Title("You are already authenticated with OpenAI (ChatGPT/Codex)").
+			Description("Do you want to re-authenticate?").
+			Affirmative("Yes").
+			Negative("No").
+			Value(&reauth).
+			Run()
+		if err != nil || !reauth {
+			fmt.Println("Authentication cancelled.")
+			return nil
+		}
+	}
+
+	// Create OAuth client
+	client := auth.NewOpenAIOAuthClient()
+
+	// Generate authorization URL
+	fmt.Println("🔐 Starting OAuth authentication with OpenAI (ChatGPT/Codex)...")
+	fmt.Println("This will open your browser to authenticate with your ChatGPT account.")
+	fmt.Println()
+
+	authData, err := client.GetAuthorizationURL()
+	if err != nil {
+		return fmt.Errorf("failed to generate authorization URL: %w", err)
+	}
+
+	// Start local callback server
+	callbackServer, err := startOpenAICallbackServer(authData.State)
+	if err != nil {
+		fmt.Printf("⚠️  Could not start local callback server: %v\n", err)
+		fmt.Println("Falling back to manual code entry.")
+	}
+	if callbackServer != nil {
+		defer callbackServer.Close()
+	}
+
+	// Display URL and try to open browser
+	fmt.Println("📱 Opening your browser for authentication...")
+	fmt.Println("If the browser doesn't open automatically, please visit this URL:")
+	fmt.Printf("\n%s\n\n", authData.URL)
+
+	// Try to open browser
+	auth.TryOpenBrowser(authData.URL)
+
+	// Wait for callback or manual input
+	var code string
+	if callbackServer != nil {
+		fmt.Println("Waiting for browser authentication...")
+		select {
+		case callbackCode := <-callbackServer.CodeChan:
+			if callbackCode != "" {
+				code = callbackCode
+				fmt.Println("✓ Received authorization code from browser callback.")
+			}
+		case <-time.After(2 * time.Minute):
+			fmt.Println("\n⏱️  Timeout waiting for browser callback.")
+			callbackServer.Close()
+		}
+	}
+
+	// If no code from callback, prompt for manual entry
+	if code == "" {
+		fmt.Println("\nAfter authorizing, paste the callback URL or authorization code below.")
+		fmt.Println("(The callback URL will look like: http://localhost:1455/auth/callback?code=...&state=...)")
+		fmt.Println()
+
+		var input string
+		err = huh.NewInput().
+			Title("Callback URL or Code").
+			Description("Paste the full callback URL or just the authorization code").
+			Value(&input).
+			Run()
+		if err != nil {
+			return fmt.Errorf("failed to read input: %w", err)
+		}
+		input = strings.TrimSpace(input)
+
+		if input == "" {
+			return fmt.Errorf("authorization code cannot be empty")
+		}
+
+		// Parse the input (could be full URL or just code)
+		parsedCode, parsedState := auth.ParseOpenAIAuthorizationInput(input)
+		if parsedCode == "" {
+			return fmt.Errorf("could not extract authorization code from input")
+		}
+
+		// Validate state if provided
+		if parsedState != "" && parsedState != authData.State {
+			return fmt.Errorf("state mismatch - possible security issue")
+		}
+		code = parsedCode
+	}
+
+	// Exchange code for tokens
+	fmt.Println("\n🔄 Exchanging authorization code for access token...")
+	creds, err := client.ExchangeCode(code, authData.Verifier)
+	if err != nil {
+		return fmt.Errorf("failed to exchange authorization code: %w", err)
+	}
+
+	// Store the credentials
+	if err := cm.SetOpenAIOAuthCredentials(creds); err != nil {
+		return fmt.Errorf("failed to store credentials: %w", err)
+	}
+
+	fmt.Println("✅ Successfully authenticated with OpenAI (ChatGPT/Codex)!")
+	fmt.Printf("📁 Credentials stored in: %s\n", cm.GetCredentialsPath())
+	fmt.Printf("👤 Account ID: %s\n", creds.AccountID)
+	fmt.Println("\n🎉 Your OAuth credentials will now be used for OpenAI API calls.")
+	fmt.Println("💡 You can check your authentication status with: kit auth status")
+
+	return nil
+}
+
+// callbackServer holds the HTTP server and channel for receiving the OAuth callback
+type callbackServer struct {
+	Server   *http.Server
+	CodeChan chan string
+	State    string
+}
+
+// Close shuts down the callback server
+func (cs *callbackServer) Close() {
+	if cs.Server != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = cs.Server.Shutdown(ctx)
+	}
+}
+
+// startOpenAICallbackServer starts a local HTTP server to receive the OAuth callback
+func startOpenAICallbackServer(expectedState string) (*callbackServer, error) {
+	codeChan := make(chan string, 1)
+
+	mux := http.NewServeMux()
+	server := &http.Server{
+		Addr:    "127.0.0.1:1455",
+		Handler: mux,
+	}
+
+	mux.HandleFunc("/auth/callback", func(w http.ResponseWriter, r *http.Request) {
+		// Check state
+		state := r.URL.Query().Get("state")
+		if state != expectedState {
+			http.Error(w, "State mismatch", http.StatusBadRequest)
+			return
+		}
+
+		code := r.URL.Query().Get("code")
+		if code == "" {
+			http.Error(w, "Missing authorization code", http.StatusBadRequest)
+			return
+		}
+
+		// Send code to channel
+		select {
+		case codeChan <- code:
+		default:
+		}
+
+		// Return success page
+		w.Header().Set("Content-Type", "text/html")
+		w.WriteHeader(http.StatusOK)
+		_, _ = fmt.Fprintf(w, `<!DOCTYPE html>
+<html>
+<head><title>Authentication Successful</title></head>
+<body style="font-family: sans-serif; text-align: center; padding: 50px;">
+<h1>✓ Authentication Successful</h1>
+<p>You can close this window and return to the terminal.</p>
+</body>
+</html>`)
+	})
+
+	// Try to start server
+	listener, err := net.Listen("tcp", "127.0.0.1:1455")
+	if err != nil {
+		return nil, fmt.Errorf("port 1455 not available: %w", err)
+	}
+	_ = listener.Close()
+
+	go func() {
+		_ = server.ListenAndServe()
+	}()
+
+	return &callbackServer{
+		Server:   server,
+		CodeChan: codeChan,
+		State:    expectedState,
+	}, nil
+}
+
+func logoutOpenAI() error {
+	cm, err := kit.NewCredentialManager()
+	if err != nil {
+		return fmt.Errorf("failed to initialize credential manager: %w", err)
+	}
+
+	// Check if authenticated
+	hasAuth, err := cm.HasOpenAICredentials()
+	if err != nil {
+		return fmt.Errorf("failed to check authentication status: %w", err)
+	}
+
+	if !hasAuth {
+		fmt.Println("You are not currently authenticated with OpenAI.")
+		return nil
+	}
+
+	// Confirm logout
+	var confirm bool
+	err = huh.NewConfirm().
+		Title("Remove OpenAI credentials").
+		Description("Are you sure you want to remove your stored credentials?").
+		Affirmative("Yes").
+		Negative("No").
+		Value(&confirm).
+		Run()
+	if err != nil || !confirm {
+		fmt.Println("Logout cancelled.")
+		return nil
+	}
+
+	// Remove credentials
+	if err := cm.RemoveOpenAICredentials(); err != nil {
+		return fmt.Errorf("failed to remove credentials: %w", err)
+	}
+
+	fmt.Println("✓ Successfully logged out from OpenAI!")
+	fmt.Println("You will need to use environment variables or command-line flags for authentication.")
+
+	return nil
+}

go.mod

@@ -5,7 +5,7 @@ go 1.26.1
 require (
 	charm.land/bubbles/v2 v2.0.0
 	charm.land/bubbletea/v2 v2.0.2
-	charm.land/fantasy v0.16.0
+	charm.land/fantasy v0.17.1
 	charm.land/huh/v2 v2.0.3
 	charm.land/lipgloss/v2 v2.0.2
 	github.com/alecthomas/chroma/v2 v2.23.1
@@ -13,7 +13,7 @@ require (
 	github.com/charmbracelet/fang v1.0.0
 	github.com/charmbracelet/log v1.0.0
 	github.com/coder/acp-go-sdk v0.6.3
-	github.com/mark3labs/mcp-go v0.45.0
+	github.com/mark3labs/mcp-go v0.46.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
 	github.com/traefik/yaegi v0.16.1
@@ -23,14 +23,14 @@ require (
 
 require (
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth v0.19.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.41.4 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.7 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.12 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
@@ -45,8 +45,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
 	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
-	github.com/bahlo/generic-list-go v0.2.0 // indirect
-	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab // indirect
@@ -56,9 +54,9 @@ require (
 	github.com/charmbracelet/openai-go v0.0.0-20260319145158-d0740cc34266 // indirect
 	github.com/charmbracelet/ultraviolet v0.0.0-20260316091819-b93f6a3b8502 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
-	github.com/charmbracelet/x/exp/charmtone v0.0.0-20260322003602-9b007323c5cd // indirect
+	github.com/charmbracelet/x/exp/charmtone v0.0.0-20260323091123-df7b1bcffcca // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
-	github.com/charmbracelet/x/exp/slice v0.0.0-20260322003602-9b007323c5cd // indirect
+	github.com/charmbracelet/x/exp/slice v0.0.0-20260323091123-df7b1bcffcca // indirect
 	github.com/charmbracelet/x/exp/strings v0.1.0 // indirect
 	github.com/charmbracelet/x/json v0.2.0 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
@@ -77,18 +75,17 @@ require (
 	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/jsonschema-go v0.4.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.19.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.20.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
-	github.com/invopop/jsonschema v0.13.0 // indirect
 	github.com/kaptinlin/go-i18n v0.2.12 // indirect
 	github.com/kaptinlin/jsonpointer v0.4.17 // indirect
 	github.com/kaptinlin/jsonschema v0.7.6 // indirect
 	github.com/kaptinlin/messageformat-go v0.4.18 // indirect
-	github.com/mailru/easyjson v0.9.2 // indirect
 	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/muesli/mango v0.2.0 // indirect
@@ -96,7 +93,7 @@ require (
 	github.com/muesli/mango-pflag v0.2.0 // indirect
 	github.com/muesli/reflow v0.3.0 // indirect
 	github.com/muesli/roff v0.1.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.3.0 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
@@ -105,10 +102,9 @@ require (
 	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
-	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
-	github.com/yuin/goldmark v1.7.17 // indirect
+	github.com/yuin/goldmark v1.8.2 // indirect
 	github.com/yuin/goldmark-emoji v1.0.6 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
@@ -122,7 +118,7 @@ require (
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/api v0.272.0 // indirect
+	google.golang.org/api v0.273.0 // indirect
 	google.golang.org/genai v1.51.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	google.golang.org/grpc v1.79.3 // indirect

go.sum

@@ -2,16 +2,16 @@ charm.land/bubbles/v2 v2.0.0 h1:tE3eK/pHjmtrDiRdoC9uGNLgpopOd8fjhEe31B/ai5s=
 charm.land/bubbles/v2 v2.0.0/go.mod h1:rCHoleP2XhU8um45NTuOWBPNVHxnkXKTiZqcclL/qOI=
 charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
 charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
-charm.land/fantasy v0.16.0 h1:vE/6sR9nPcSD8qXJXX6wR8NXjtWlBVAzwQmTh5pHVrs=
-charm.land/fantasy v0.16.0/go.mod h1:VZjpXVh7IgeiIzGQybEnKzd68ofDsRj94+kzH1ZCAfQ=
+charm.land/fantasy v0.17.1 h1:SQzfnyJPDuQWt6e//KKmQmEEXdqHMC0IZz10XwkLcEM=
+charm.land/fantasy v0.17.1/go.mod h1:FF5ALCCHETacHJPBqU42CtwMInYQ0ul52fdzIHQMbQk=
 charm.land/huh/v2 v2.0.3 h1:2cJsMqEPwSywGHvdlKsJyQKPtSJLVnFKyFbsYZTlLkU=
 charm.land/huh/v2 v2.0.3/go.mod h1:93eEveeeqn47MwiC3tf+2atZ2l7Is88rAtmZNZ8x9Wc=
 charm.land/lipgloss/v2 v2.0.2 h1:xFolbF8JdpNkM2cEPTfXEcW1p6NRzOWTSamRfYEw8cs=
 charm.land/lipgloss/v2 v2.0.2/go.mod h1:KjPle2Qd3YmvP1KL5OMHiHysGcNwq6u83MUjYkFvEkM=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.19.0 h1:DGYwtbcsGsT1ywuxsIoWi1u/vlks0moIblQHgSDgQkQ=
+cloud.google.com/go/auth v0.19.0/go.mod h1:2Aph7BT2KnaSFOM0JDPyiYgNh6PL9vGMiP8CUIXZ+IY=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
@@ -36,8 +36,8 @@ github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
 github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.7 h1:3kGOqnh1pPeddVa/E37XNTaWJ8W6vrbYV9lJEkCnhuY=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.7/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
 github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
 github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
@@ -70,10 +70,6 @@ github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
-github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
-github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
-github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/catppuccin/go v0.3.0 h1:d+0/YicIq+hSTo5oPuRi5kOpqkVA5tAsU6dNhvRu+aY=
 github.com/catppuccin/go v0.3.0/go.mod h1:8IHJuMGaUUjQM82qBrGNBv7LFq6JI3NnQCF6MOlZjpc=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -104,14 +100,14 @@ github.com/charmbracelet/x/conpty v0.1.1 h1:s1bUxjoi7EpqiXysVtC+a8RrvPPNcNvAjfi4
 github.com/charmbracelet/x/conpty v0.1.1/go.mod h1:OmtR77VODEFbiTzGE9G1XiRJAga6011PIm4u5fTNZpk=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 h1:JSt3B+U9iqk37QUU2Rvb6DSBYRLtWqFqfxf8l5hOZUA=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86/go.mod h1:2P0UgXMEa6TsToMSuFqKFQR+fZTO9CNGUNokkPatT/0=
-github.com/charmbracelet/x/exp/charmtone v0.0.0-20260322003602-9b007323c5cd h1:eStB6uX52pgrm6TxQcEKctPrEC+a/9ubJC+P671idOc=
-github.com/charmbracelet/x/exp/charmtone v0.0.0-20260322003602-9b007323c5cd/go.mod h1:nsExn0DGyX0lh9LwLHTn2Gg+hafdzfSXnC+QmEJTZFY=
+github.com/charmbracelet/x/exp/charmtone v0.0.0-20260323091123-df7b1bcffcca h1:62yAoS1Ynbuzwcn1LkNBxi3IMF5p0E0cHCoaLOOmN9w=
+github.com/charmbracelet/x/exp/charmtone v0.0.0-20260323091123-df7b1bcffcca/go.mod h1:nsExn0DGyX0lh9LwLHTn2Gg+hafdzfSXnC+QmEJTZFY=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f h1:pk6gmGpCE7F3FcjaOEKYriCvpmIN4+6OS/RD0vm4uIA=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f/go.mod h1:IfZAMTHB6XkZSeXUqriemErjAWCCzT0LwjKFYCZyw0I=
 github.com/charmbracelet/x/exp/ordered v0.1.0 h1:55/qLwjIh0gL0Vni+QAWk7T/qRVP6sBf+2agPBgnOFE=
 github.com/charmbracelet/x/exp/ordered v0.1.0/go.mod h1:5UHwmG+is5THxMyCJHNPCn2/ecI07aKNrW+LcResjJ8=
-github.com/charmbracelet/x/exp/slice v0.0.0-20260322003602-9b007323c5cd h1:U8xj0UXwqHzO+UYHZJopKF+gWaQEW8oj60fmiq9TFY4=
-github.com/charmbracelet/x/exp/slice v0.0.0-20260322003602-9b007323c5cd/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
+github.com/charmbracelet/x/exp/slice v0.0.0-20260323091123-df7b1bcffcca h1:QQoyQLgUzojMNWHVHToN6d9qTvT0KWtxUKIRPx/Ox5o=
+github.com/charmbracelet/x/exp/slice v0.0.0-20260323091123-df7b1bcffcca/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
 github.com/charmbracelet/x/exp/strings v0.1.0 h1:i69S2XI7uG1u4NLGeJPSYU++Nmjvpo9nwd6aoEm7gkA=
 github.com/charmbracelet/x/exp/strings v0.1.0/go.mod h1:/ehtMPNh9K4odGFkqYJKpIYyePhdp1hLBRvyY4bWkH8=
 github.com/charmbracelet/x/json v0.2.0 h1:DqB+ZGx2h+Z+1s98HOuOyli+i97wsFQIxP2ZQANTPrQ=
@@ -173,14 +169,16 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbcqoRA8=
+github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
 github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=
-github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=
+github.com/googleapis/gax-go/v2 v2.20.0 h1:NIKVuLhDlIV74muWlsMM4CcQZqN6JJ20Qcxd9YMuYcs=
+github.com/googleapis/gax-go/v2 v2.20.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -189,8 +187,6 @@ github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUq
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
-github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
 github.com/kaptinlin/go-i18n v0.2.12 h1:ywDsvb4KDFddMC2dpI/rrIzGU2mWUSvHmWUm9BMsdl4=
 github.com/kaptinlin/go-i18n v0.2.12/go.mod h1:pVcu9qsW5pOIOoZFJXesRYmLos1vMQrby70JPAoWmJU=
 github.com/kaptinlin/jsonpointer v0.4.17 h1:mY9k8ciWncxbsECyaxKnR0MdmxamNdp2tLQkAKVrtSk=
@@ -207,10 +203,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/mailru/easyjson v0.9.2 h1:dX8U45hQsZpxd80nLvDGihsQ/OxlvTkVUXH2r/8cb2M=
-github.com/mailru/easyjson v0.9.2/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/mark3labs/mcp-go v0.45.0 h1:s0S8qR/9fWaQ3pHxz7pm1uQ0DrswoSnRIxKIjbiQtkc=
-github.com/mark3labs/mcp-go v0.45.0/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw=
+github.com/mark3labs/mcp-go v0.46.0 h1:8KRibF4wcKejbLsHxCA/QBVUr5fQ9nwz/n8lGqmaALo=
+github.com/mark3labs/mcp-go v0.46.0/go.mod h1:JKTC7R2LLVagkEWK7Kwu7DbmA6iIvnNAod6yrHiQMag=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
@@ -234,8 +228,8 @@ github.com/muesli/roff v0.1.0 h1:YD0lalCotmYuF5HhZliKWlIx7IEhiXeSfq7hNjFqGF8=
 github.com/muesli/roff v0.1.0/go.mod h1:pjAHQM9hdUUwm/krAfrLGgJkXJ+YuhtsfZ42kieB2Ig=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=
+github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
@@ -279,14 +273,12 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/traefik/yaegi v0.16.1 h1:f1De3DVJqIDKmnasUF6MwmWv1dSEEat0wcpXhD2On3E=
 github.com/traefik/yaegi v0.16.1/go.mod h1:4eVhbPb3LnD2VigQjhYbEJ69vDRFdT2HQNrXx8eEwUY=
-github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
-github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
-github.com/yuin/goldmark v1.7.17 h1:p36OVWwRb246iHxA/U4p8OPEpOTESm4n+g+8t0EE5uA=
-github.com/yuin/goldmark v1.7.17/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
 github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -328,10 +320,14 @@ golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=
-google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
+google.golang.org/api v0.273.0 h1:r/Bcv36Xa/te1ugaN1kdJ5LoA5Wj/cL+a4gj6FiPBjQ=
+google.golang.org/api v0.273.0/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew=
 google.golang.org/genai v1.51.0 h1:IZGuUqgfx40INv3hLFGCbOSGp0qFqm7LVmDghzNIYqg=
 google.golang.org/genai v1.51.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=

internal/agent/agent.go

@@ -183,7 +183,8 @@ func NewAgent(ctx context.Context, agentConfig *AgentConfig) (*Agent, error) {
 
 	// Pass generation parameters when available.
 	if agentConfig.ModelConfig != nil {
-		if agentConfig.ModelConfig.MaxTokens > 0 {
+		// Skip max_output_tokens for providers that don't support it (e.g., Codex OAuth)
+		if agentConfig.ModelConfig.MaxTokens > 0 && !providerResult.SkipMaxOutputTokens {
 			agentOpts = append(agentOpts, fantasy.WithMaxOutputTokens(int64(agentConfig.ModelConfig.MaxTokens)))
 		}
 		if agentConfig.ModelConfig.Temperature != nil {
@@ -672,7 +673,8 @@ func (a *Agent) SetModel(ctx context.Context, config *models.ProviderConfig) err
 	}
 
 	// Pass generation parameters when available.
-	if config.MaxTokens > 0 {
+	// Skip max_output_tokens for providers that don't support it (e.g., Codex OAuth)
+	if config.MaxTokens > 0 && !providerResult.SkipMaxOutputTokens {
 		agentOpts = append(agentOpts, fantasy.WithMaxOutputTokens(int64(config.MaxTokens)))
 	}
 	if config.Temperature != nil {

internal/app/app.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"fmt"
+	"os"
 	"sync"
 
 	tea "charm.land/bubbletea/v2"
@@ -272,6 +273,10 @@ func (a *App) SwitchTreeSession(ts *session.TreeManager) {
 		_ = old.Close()
 	}
 	a.opts.TreeSession = ts
+	// Also update the kit SDK's tree session so messages are persisted correctly.
+	if a.opts.Kit != nil {
+		a.opts.Kit.SetTreeSession(ts)
+	}
 	// Reload messages from new session.
 	a.store.Clear()
 	if ts != nil {
@@ -447,6 +452,13 @@ func (a *App) Close() {
 
 	// Wait for background goroutines.
 	a.wg.Wait()
+
+	// Clean up empty session file on shutdown.
+	if ts := a.opts.TreeSession; ts != nil && ts.IsEmpty() {
+		if path := ts.GetFilePath(); path != "" {
+			_ = os.Remove(path)
+		}
+	}
 }
 
 // --------------------------------------------------------------------------
@@ -932,7 +944,8 @@ func (a *App) updateUsageFromTurnResult(result *kit.TurnResult, userPrompt strin
 	if result.TotalUsage != nil {
 		inputTokens := int(result.TotalUsage.InputTokens)
 		outputTokens := int(result.TotalUsage.OutputTokens)
-		if inputTokens > 0 && outputTokens > 0 {
+		// Use API-reported tokens if input tokens are available (output may be 0 in some cases)
+		if inputTokens > 0 {
 			cacheReadTokens := int(result.TotalUsage.CacheReadTokens)
 			cacheWriteTokens := int(result.TotalUsage.CacheCreationTokens)
 			a.opts.UsageTracker.UpdateUsage(inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens)

internal/auth/credentials.go

@@ -10,9 +10,10 @@ import (
 )
 
 // CredentialStore holds all stored credentials for various providers.
-// Currently supports Anthropic credentials with both OAuth and API key authentication methods.
+// Currently supports Anthropic and OpenAI credentials with both OAuth and API key authentication methods.
 type CredentialStore struct {
 	Anthropic *AnthropicCredentials `json:"anthropic,omitempty"`
+	OpenAI    *OpenAICredentials    `json:"openai,omitempty"`
 }
 
 // AnthropicCredentials holds Anthropic API credentials supporting both OAuth
@@ -28,6 +29,20 @@ type AnthropicCredentials struct {
 	CreatedAt    time.Time `json:"created_at"`
 }
 
+// OpenAICredentials holds OpenAI API credentials supporting both OAuth
+// and API key authentication methods. The Type field indicates which authentication
+// method is being used. For OAuth, tokens are stored with expiration timestamps
+// for automatic refresh. For API keys, only the key itself is stored.
+type OpenAICredentials struct {
+	Type         string    `json:"type"`                    // "oauth" or "api_key"
+	APIKey       string    `json:"api_key,omitempty"`       // For API key auth
+	AccessToken  string    `json:"access_token,omitempty"`  // For OAuth
+	RefreshToken string    `json:"refresh_token,omitempty"` // For OAuth
+	ExpiresAt    int64     `json:"expires_at,omitempty"`    // For OAuth
+	AccountID    string    `json:"account_id,omitempty"`    // For OAuth (ChatGPT account ID)
+	CreatedAt    time.Time `json:"created_at"`
+}
+
 // IsExpired checks if the OAuth token is expired based on the ExpiresAt timestamp.
 // Returns false for API key authentication or if no expiration is set.
 func (c *AnthropicCredentials) IsExpired() bool {
@@ -48,6 +63,26 @@ func (c *AnthropicCredentials) NeedsRefresh() bool {
 	return time.Now().Unix() >= (c.ExpiresAt - 300) // 5 minutes buffer
 }
 
+// IsExpired checks if the OAuth token is expired based on the ExpiresAt timestamp.
+// Returns false for API key authentication or if no expiration is set.
+func (c *OpenAICredentials) IsExpired() bool {
+	if c.Type != "oauth" || c.ExpiresAt == 0 {
+		return false
+	}
+	return time.Now().Unix() >= c.ExpiresAt
+}
+
+// NeedsRefresh checks if the OAuth token needs refresh, returning true if the token
+// will expire within the next 5 minutes. This allows for proactive token refresh
+// to avoid authentication failures during operations. Returns false for API key
+// authentication or if no expiration is set.
+func (c *OpenAICredentials) NeedsRefresh() bool {
+	if c.Type != "oauth" || c.ExpiresAt == 0 {
+		return false
+	}
+	return time.Now().Unix() >= (c.ExpiresAt - 300) // 5 minutes buffer
+}
+
 // CredentialManager handles secure storage and retrieval of authentication credentials.
 // It manages a JSON file stored in the user's config directory with appropriate
 // file permissions for security.
@@ -212,6 +247,142 @@ func (cm *CredentialManager) HasAnthropicCredentials() (bool, error) {
 	}
 }
 
+// SetOpenAICredentials stores OpenAI API key credentials. It validates the
+// API key format before storing. The API key must start with "sk-" and be
+// at least 20 characters long. Returns an error if the API key is invalid or
+// if storage fails.
+func (cm *CredentialManager) SetOpenAICredentials(apiKey string) error {
+	if err := validateOpenAIAPIKey(apiKey); err != nil {
+		return err
+	}
+
+	store, err := cm.LoadCredentials()
+	if err != nil {
+		return err
+	}
+
+	store.OpenAI = &OpenAICredentials{
+		Type:      "api_key",
+		APIKey:    apiKey,
+		CreatedAt: time.Now(),
+	}
+
+	return cm.SaveCredentials(store)
+}
+
+// GetOpenAICredentials retrieves stored OpenAI credentials. Returns nil if
+// no credentials are stored. The returned credentials may be either OAuth or API
+// key type, check the Type field to determine which.
+func (cm *CredentialManager) GetOpenAICredentials() (*OpenAICredentials, error) {
+	store, err := cm.LoadCredentials()
+	if err != nil {
+		return nil, err
+	}
+
+	return store.OpenAI, nil
+}
+
+// RemoveOpenAICredentials removes stored OpenAI credentials from storage.
+// If this was the only credential stored, the entire credentials file is removed.
+// Returns an error if the removal fails.
+func (cm *CredentialManager) RemoveOpenAICredentials() error {
+	store, err := cm.LoadCredentials()
+	if err != nil {
+		return err
+	}
+
+	store.OpenAI = nil
+
+	// If store is empty, remove the file entirely
+	if store.Anthropic == nil && store.OpenAI == nil {
+		if err := os.Remove(cm.credentialsPath); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("failed to remove credentials file: %w", err)
+		}
+		return nil
+	}
+
+	return cm.SaveCredentials(store)
+}
+
+// HasOpenAICredentials checks if valid OpenAI credentials are stored.
+// Returns true if either a non-empty OAuth access token or API key is present,
+// false otherwise. Returns an error if credentials cannot be loaded.
+func (cm *CredentialManager) HasOpenAICredentials() (bool, error) {
+	creds, err := cm.GetOpenAICredentials()
+	if err != nil {
+		return false, err
+	}
+	if creds == nil {
+		return false, nil
+	}
+
+	// Check based on credential type
+	switch creds.Type {
+	case "oauth":
+		return creds.AccessToken != "", nil
+	case "api_key":
+		return creds.APIKey != "", nil
+	default:
+		return false, nil
+	}
+}
+
+// SetOpenAIOAuthCredentials stores OpenAI OAuth credentials in the credential manager's secure storage.
+// The credentials should include access token, refresh token, and expiration information.
+// Returns an error if the credentials cannot be saved.
+func (cm *CredentialManager) SetOpenAIOAuthCredentials(creds *OpenAICredentials) error {
+	store, err := cm.LoadCredentials()
+	if err != nil {
+		return err
+	}
+
+	store.OpenAI = creds
+	return cm.SaveCredentials(store)
+}
+
+// GetValidOpenAIAccessToken returns a valid access token for API requests. For OAuth credentials,
+// it automatically refreshes the token if it's expired or about to expire. For API key
+// credentials, it simply returns the API key. Returns an error if no credentials are found,
+// if token refresh fails, or if the credential type is unknown.
+func (cm *CredentialManager) GetValidOpenAIAccessToken() (string, error) {
+	creds, err := cm.GetOpenAICredentials()
+	if err != nil {
+		return "", err
+	}
+
+	if creds == nil {
+		return "", fmt.Errorf("no credentials found")
+	}
+
+	// For API key auth, return the API key
+	if creds.Type == "api_key" {
+		return creds.APIKey, nil
+	}
+
+	// For OAuth, check if token needs refresh
+	if creds.Type == "oauth" {
+		if creds.NeedsRefresh() {
+			// Refresh the token
+			client := NewOpenAIOAuthClient()
+			newCreds, err := client.RefreshToken(creds.RefreshToken)
+			if err != nil {
+				return "", fmt.Errorf("failed to refresh token: %w", err)
+			}
+
+			// Update stored credentials
+			if err := cm.SetOpenAIOAuthCredentials(newCreds); err != nil {
+				return "", fmt.Errorf("failed to save refreshed token: %w", err)
+			}
+
+			return newCreds.AccessToken, nil
+		}
+
+		return creds.AccessToken, nil
+	}
+
+	return "", fmt.Errorf("unknown credential type: %s", creds.Type)
+}
+
 // GetCredentialsPath returns the absolute path to the credentials JSON file.
 // This is useful for debugging or displaying the storage location to users.
 func (cm *CredentialManager) GetCredentialsPath() string {
@@ -238,6 +409,26 @@ func validateAnthropicAPIKey(apiKey string) error {
 	return nil
 }
 
+// validateOpenAIAPIKey validates the format of an OpenAI API key
+func validateOpenAIAPIKey(apiKey string) error {
+	apiKey = strings.TrimSpace(apiKey)
+
+	if apiKey == "" {
+		return fmt.Errorf("API key cannot be empty")
+	}
+
+	// OpenAI API keys typically start with "sk-" and are quite long
+	if !strings.HasPrefix(apiKey, "sk-") {
+		return fmt.Errorf("invalid OpenAI API key format (should start with 'sk-')")
+	}
+
+	if len(apiKey) < 20 {
+		return fmt.Errorf("API key appears to be too short")
+	}
+
+	return nil
+}
+
 // GetAnthropicAPIKey retrieves an Anthropic API key from multiple sources in priority order:
 // 1. Command-line flag value (highest priority)
 // 2. Stored credentials (OAuth or API key)

internal/auth/oauth.go

@@ -7,6 +7,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
 	"strings"
@@ -30,6 +31,7 @@ type OAuthClient struct {
 type AuthData struct {
 	URL      string
 	Verifier string
+	State    string // Optional state parameter for CSRF protection
 }
 
 // NewOAuthClient creates a new OAuth client configured for Anthropic's OAuth service.
@@ -199,6 +201,270 @@ func (c *OAuthClient) parseCodeAndState(code string) (parsedCode, parsedState st
 	return
 }
 
+// OpenAIOAuthClient handles OAuth 2.0 authentication flow with OpenAI Codex (ChatGPT Plus/Pro).
+// This uses OpenAI's auth0-based OAuth service for ChatGPT account authentication.
+type OpenAIOAuthClient struct {
+	ClientID     string
+	AuthorizeURL string
+	TokenURL     string
+	RedirectURI  string
+	Scopes       string
+}
+
+// NewOpenAIOAuthClient creates a new OAuth client configured for OpenAI Codex OAuth.
+// This uses the public client ID for CLI applications with PKCE for security.
+func NewOpenAIOAuthClient() *OpenAIOAuthClient {
+	return &OpenAIOAuthClient{
+		// Public client ID for OpenAI Codex CLI OAuth
+		ClientID:     "app_EMoamEEZ73f0CkXaXp7hrann",
+		AuthorizeURL: "https://auth.openai.com/oauth/authorize",
+		TokenURL:     "https://auth.openai.com/oauth/token",
+		RedirectURI:  "http://localhost:1455/auth/callback",
+		Scopes:       "openid profile email offline_access",
+	}
+}
+
+// GetAuthorizationURL generates a complete authorization URL for the OAuth flow with
+// PKCE parameters. Returns an AuthData structure containing the URL for user
+// authentication and the PKCE verifier for the subsequent code exchange.
+func (c *OpenAIOAuthClient) GetAuthorizationURL() (*AuthData, error) {
+	verifier, challenge, err := generatePKCE()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate PKCE: %w", err)
+	}
+
+	// Generate random state
+	stateBytes := make([]byte, 16)
+	if _, err := rand.Read(stateBytes); err != nil {
+		return nil, fmt.Errorf("failed to generate state: %w", err)
+	}
+	state := fmt.Sprintf("%x", stateBytes)
+
+	params := url.Values{
+		"response_type":              {"code"},
+		"client_id":                  {c.ClientID},
+		"redirect_uri":               {c.RedirectURI},
+		"scope":                      {c.Scopes},
+		"code_challenge":             {challenge},
+		"code_challenge_method":      {"S256"},
+		"state":                      {state},
+		"id_token_add_organizations": {"true"},
+		"codex_cli_simplified_flow":  {"true"},
+		"originator":                 {"kit"},
+	}
+
+	authURL := fmt.Sprintf("%s?%s", c.AuthorizeURL, params.Encode())
+
+	return &AuthData{
+		URL:      authURL,
+		Verifier: verifier,
+		State:    state,
+	}, nil
+}
+
+// ExchangeCode exchanges an authorization code for access and refresh tokens.
+// The code parameter should be the authorization code received from the OAuth callback.
+// The verifier parameter must be the same PKCE verifier generated during GetAuthorizationURL.
+// Returns OpenAICredentials containing the tokens, expiration, and account ID.
+func (c *OpenAIOAuthClient) ExchangeCode(code, verifier string) (*OpenAICredentials, error) {
+	return c.exchangeAuthorizationCode(code, verifier, c.RedirectURI)
+}
+
+// exchangeAuthorizationCode performs the token exchange with the OAuth server
+func (c *OpenAIOAuthClient) exchangeAuthorizationCode(code, verifier, redirectUri string) (*OpenAICredentials, error) {
+	data := url.Values{
+		"grant_type":    {"authorization_code"},
+		"client_id":     {c.ClientID},
+		"code":          {code},
+		"code_verifier": {verifier},
+		"redirect_uri":  {redirectUri},
+	}
+
+	req, err := http.NewRequestWithContext(context.Background(), "POST", c.TokenURL, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to make token request: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("token exchange failed: %s", string(body))
+	}
+
+	var tokenResp struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		ExpiresIn    int    `json:"expires_in"`
+		IDToken      string `json:"id_token"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		return nil, fmt.Errorf("failed to decode token response: %w", err)
+	}
+
+	if tokenResp.AccessToken == "" || tokenResp.RefreshToken == "" {
+		return nil, fmt.Errorf("token response missing required fields")
+	}
+
+	// Extract account ID from JWT token
+	accountID := extractOpenAIAccountID(tokenResp.AccessToken)
+	if accountID == "" {
+		return nil, fmt.Errorf("failed to extract account ID from token")
+	}
+
+	return &OpenAICredentials{
+		Type:         "oauth",
+		AccessToken:  tokenResp.AccessToken,
+		RefreshToken: tokenResp.RefreshToken,
+		ExpiresAt:    time.Now().Unix() + int64(tokenResp.ExpiresIn),
+		CreatedAt:    time.Now(),
+		AccountID:    accountID,
+	}, nil
+}
+
+// RefreshToken refreshes an expired or expiring access token using a refresh token.
+// Returns new OpenAICredentials with updated access token, refresh token (may be
+// rotated), and new expiration timestamp. Returns an error if the refresh fails or
+// the refresh token is invalid.
+func (c *OpenAIOAuthClient) RefreshToken(refreshToken string) (*OpenAICredentials, error) {
+	data := url.Values{
+		"grant_type":    {"refresh_token"},
+		"refresh_token": {refreshToken},
+		"client_id":     {c.ClientID},
+	}
+
+	req, err := http.NewRequestWithContext(context.Background(), "POST", c.TokenURL, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to make refresh request: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("token refresh failed: %s", string(body))
+	}
+
+	var tokenResp struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		ExpiresIn    int    `json:"expires_in"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		return nil, fmt.Errorf("failed to decode refresh response: %w", err)
+	}
+
+	if tokenResp.AccessToken == "" || tokenResp.RefreshToken == "" {
+		return nil, fmt.Errorf("refresh response missing required fields")
+	}
+
+	// Extract account ID from JWT token
+	accountID := extractOpenAIAccountID(tokenResp.AccessToken)
+	if accountID == "" {
+		return nil, fmt.Errorf("failed to extract account ID from refreshed token")
+	}
+
+	return &OpenAICredentials{
+		Type:         "oauth",
+		AccessToken:  tokenResp.AccessToken,
+		RefreshToken: tokenResp.RefreshToken,
+		ExpiresAt:    time.Now().Unix() + int64(tokenResp.ExpiresIn),
+		CreatedAt:    time.Now(),
+		AccountID:    accountID,
+	}, nil
+}
+
+// extractOpenAIAccountID extracts the ChatGPT account ID from a JWT access token.
+// The account ID is stored in the claim path https://api.openai.com/auth.chatgpt_account_id
+func extractOpenAIAccountID(token string) string {
+	// JWT tokens are base64-encoded JSON payloads
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return ""
+	}
+
+	// Decode payload (second part)
+	payload := parts[1]
+	// Add padding if needed
+	if len(payload)%4 != 0 {
+		payload += strings.Repeat("=", 4-len(payload)%4)
+	}
+
+	decoded, err := base64.URLEncoding.DecodeString(payload)
+	if err != nil {
+		return ""
+	}
+
+	var claims map[string]any
+	if err := json.Unmarshal(decoded, &claims); err != nil {
+		return ""
+	}
+
+	// Navigate to the claim path: https://api.openai.com/auth.chatgpt_account_id
+	authPath, ok := claims["https://api.openai.com/auth"].(map[string]any)
+	if !ok {
+		return ""
+	}
+
+	accountID, ok := authPath["chatgpt_account_id"].(string)
+	if !ok {
+		return ""
+	}
+
+	return accountID
+}
+
+// ParseOpenAIAuthorizationInput parses various forms of authorization input:
+// - Full callback URL: http://localhost:1455/auth/callback?code=xxx&state=yyy
+// - Code#State format: abc123#state456
+// - Query string: code=abc123&state=state456
+// - Just the code: abc123
+func ParseOpenAIAuthorizationInput(input string) (code, state string) {
+	input = strings.TrimSpace(input)
+	if input == "" {
+		return "", ""
+	}
+
+	// Try parsing as URL
+	if strings.HasPrefix(input, "http") {
+		if u, err := url.Parse(input); err == nil {
+			return u.Query().Get("code"), u.Query().Get("state")
+		}
+	}
+
+	// Try code#state format
+	if strings.Contains(input, "#") {
+		parts := strings.SplitN(input, "#", 2)
+		return parts[0], parts[1]
+	}
+
+	// Try query string format
+	if strings.Contains(input, "code=") {
+		if values, err := url.ParseQuery(input); err == nil {
+			return values.Get("code"), values.Get("state")
+		}
+	}
+
+	// Assume it's just the code
+	return input, ""
+}
+
 // SetOAuthCredentials stores OAuth credentials in the credential manager's secure storage.
 // The credentials should include access token, refresh token, and expiration information.
 // Returns an error if the credentials cannot be saved.

internal/message/content.go

@@ -4,11 +4,38 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"charm.land/fantasy"
 )
 
+// sanitizeToolCallID ensures the ID matches Anthropic's required pattern:
+// ^[a-zA-Z0-9_-]+$ (alphanumeric, underscores, and hyphens only).
+// Invalid characters are replaced with underscores.
+func sanitizeToolCallID(id string) string {
+	var sb strings.Builder
+	for _, r := range id {
+		switch {
+		case (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z'):
+			sb.WriteRune(r)
+		case r >= '0' && r <= '9':
+			sb.WriteRune(r)
+		case r == '_' || r == '-':
+			sb.WriteRune(r)
+		default:
+			// Replace invalid characters with underscore
+			sb.WriteByte('_')
+		}
+	}
+	result := sb.String()
+	// Ensure non-empty (Anthropic requires at least one character)
+	if result == "" {
+		return "tool_0"
+	}
+	return result
+}
+
 // ContentPart is the marker interface for all message content block types.
 // A message contains a heterogeneous slice of ContentPart values, enabling
 // rich structured messages that carry text, reasoning, tool calls, tool
@@ -312,7 +339,7 @@ func (m *Message) ToFantasyMessages() []fantasy.Message {
 		// Add tool calls
 		for _, tc := range m.ToolCalls() {
 			parts = append(parts, fantasy.ToolCallPart{
-				ToolCallID: tc.ID,
+				ToolCallID: sanitizeToolCallID(tc.ID),
 				ToolName:   tc.Name,
 				Input:      tc.Input,
 			})
@@ -340,7 +367,7 @@ func (m *Message) ToFantasyMessages() []fantasy.Message {
 				}
 			}
 			parts = append(parts, fantasy.ToolResultPart{
-				ToolCallID: result.ToolCallID,
+				ToolCallID: sanitizeToolCallID(result.ToolCallID),
 				Output:     output,
 			})
 		}

internal/message/content_test.go

@@ -0,0 +1,113 @@
+package message
+
+import (
+	"testing"
+)
+
+func TestSanitizeToolCallID(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "valid alphanumeric ID",
+			input:    "call_123abc",
+			expected: "call_123abc",
+		},
+		{
+			name:     "ID with dots (OpenCode/Kimi style)",
+			input:    "call.123.abc",
+			expected: "call_123_abc",
+		},
+		{
+			name:     "ID with colons",
+			input:    "tool:123:abc",
+			expected: "tool_123_abc",
+		},
+		{
+			name:     "ID with special characters",
+			input:    "tool@#$%^&*()",
+			expected: "tool_________",
+		},
+		{
+			name:     "Anthropic style ID (already valid)",
+			input:    "toolu_0123456789ABCDEF",
+			expected: "toolu_0123456789ABCDEF",
+		},
+		{
+			name:     "OpenAI style ID (already valid)",
+			input:    "call_O17Uplv4lJvD6DVdIvFFeRMw",
+			expected: "call_O17Uplv4lJvD6DVdIvFFeRMw",
+		},
+		{
+			name:     "ID with hyphens",
+			input:    "my-tool-call-123",
+			expected: "my-tool-call-123",
+		},
+		{
+			name:     "empty string",
+			input:    "",
+			expected: "tool_0",
+		},
+		{
+			name:     "only special characters",
+			input:    "@#$%",
+			expected: "____",
+		},
+		{
+			name:     "mixed valid and invalid",
+			input:    "call_123.abc-def@ghi",
+			expected: "call_123_abc-def_ghi",
+		},
+		{
+			name:     "Unicode characters",
+			input:    "tool_日本語",
+			expected: "tool____",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := sanitizeToolCallID(tt.input)
+			if result != tt.expected {
+				t.Errorf("sanitizeToolCallID(%q) = %q, want %q", tt.input, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestSanitizeToolCallID_MatchesAnthropicPattern(t *testing.T) {
+	// Test that sanitized IDs match Anthropic's required pattern: ^[a-zA-Z0-9_-]+$
+	// This is a simplified check - in reality the pattern allows alphanumeric, underscore, hyphen
+	testIDs := []string{
+		"call.123.abc",
+		"tool:123:def",
+		"id@#$%^&*()",
+		"mixed.valid-id_test",
+		"",
+	}
+
+	for _, id := range testIDs {
+		sanitized := sanitizeToolCallID(id)
+
+		// Verify each character is valid
+		for i, r := range sanitized {
+			valid := (r >= 'a' && r <= 'z') ||
+				(r >= 'A' && r <= 'Z') ||
+				(r >= '0' && r <= '9') ||
+				r == '_' ||
+				r == '-'
+
+			if !valid {
+				t.Errorf("sanitizeToolCallID(%q) = %q, contains invalid character at position %d: %q",
+					id, sanitized, i, string(r))
+			}
+		}
+
+		// Verify non-empty
+		if sanitized == "" {
+			t.Errorf("sanitizeToolCallID(%q) returned empty string", id)
+		}
+	}
+}

internal/models/providers.go

@@ -169,6 +169,9 @@ type ProviderResult struct {
 	// ProviderOptions contains provider-specific options to be passed to the
 	// fantasy agent (e.g. OpenAI Responses API reasoning options).
 	ProviderOptions fantasy.ProviderOptions
+	// SkipMaxOutputTokens indicates that this provider doesn't support the
+	// max_output_tokens parameter (e.g., OpenAI Codex OAuth API).
+	SkipMaxOutputTokens bool
 }
 
 // ParseModelString parses a model string in "provider/model" format (e.g. "anthropic/claude-sonnet-4-5").
@@ -621,13 +624,52 @@ func createVertexAnthropicProvider(ctx context.Context, config *ProviderConfig,
 
 func createOpenAIProvider(ctx context.Context, config *ProviderConfig, modelName string) (*ProviderResult, error) {
 	apiKey := config.ProviderAPIKey
+	source := "command-line flag"
+	var accountID string
+	var isCodexOAuth bool
+
 	if apiKey == "" {
-		apiKey = os.Getenv("OPENAI_API_KEY")
-	}
-	if apiKey == "" {
-		return nil, fmt.Errorf("OpenAI API key not provided. Use --provider-api-key flag or OPENAI_API_KEY environment variable")
+		// Check stored credentials first
+		cm, err := auth.NewCredentialManager()
+		if err == nil {
+			if creds, err := cm.GetOpenAICredentials(); err == nil && creds != nil {
+				if creds.Type == "oauth" && creds.AccessToken != "" {
+					// For OAuth, get a valid access token (may refresh if needed)
+					token, err := cm.GetValidOpenAIAccessToken()
+					if err == nil && token != "" {
+						apiKey = token
+						accountID = creds.AccountID
+						isCodexOAuth = true
+						source = "stored Codex OAuth credentials"
+					}
+				} else if creds.Type == "api_key" && creds.APIKey != "" {
+					apiKey = creds.APIKey
+					source = "stored API key"
+				}
+			}
+		}
 	}
 
+	// Fall back to environment variable
+	if apiKey == "" {
+		apiKey = os.Getenv("OPENAI_API_KEY")
+		source = "OPENAI_API_KEY environment variable"
+	}
+
+	if apiKey == "" {
+		return nil, fmt.Errorf("OpenAI API key not provided. Use 'kit auth login openai', --provider-api-key flag, or OPENAI_API_KEY environment variable")
+	}
+
+	if os.Getenv("DEBUG") != "" || os.Getenv("KIT_DEBUG") != "" {
+		fmt.Fprintf(os.Stderr, "Using OpenAI API key from: %s\n", source)
+	}
+
+	// For Codex OAuth, use the ChatGPT backend API with custom headers
+	if isCodexOAuth {
+		return createOpenAICodexProvider(ctx, config, modelName, apiKey, accountID)
+	}
+
+	// Regular OpenAI API key flow
 	var opts []openai.Option
 	opts = append(opts, openai.WithAPIKey(apiKey))
 	opts = append(opts, openai.WithUseResponsesAPI())
@@ -656,6 +698,135 @@ func createOpenAIProvider(ctx context.Context, config *ProviderConfig, modelName
 	return &ProviderResult{Model: model, ProviderOptions: providerOpts}, nil
 }
 
+// createOpenAICodexProvider creates a provider for ChatGPT/Codex OAuth tokens.
+// Uses the chatgpt.com/backend-api/codex endpoint with special headers.
+func createOpenAICodexProvider(ctx context.Context, config *ProviderConfig, modelName, token, accountID string) (*ProviderResult, error) {
+	// Check for spark models which are not accessible via OAuth
+	if detectCodexModelFamily(modelName) == "gpt-codex-spark" {
+		return nil, fmt.Errorf("gpt-codex-spark models are not accessible via ChatGPT OAuth. " +
+			"These models require special access or a different authentication method. " +
+			"Please use regular Codex models like 'openai/gpt-5.3-codex' instead")
+	}
+
+	// Use the ChatGPT backend API with /codex path
+	baseURL := "https://chatgpt.com/backend-api/codex"
+	if config.ProviderURL != "" {
+		baseURL = config.ProviderURL
+	}
+
+	// Build custom HTTP client with required headers
+	httpClient := createCodexHTTPClient(token, accountID, config.TLSSkipVerify)
+
+	var opts []openai.Option
+	opts = append(opts, openai.WithAPIKey(token))
+	opts = append(opts, openai.WithBaseURL(baseURL))
+	opts = append(opts, openai.WithUseResponsesAPI())
+	opts = append(opts, openai.WithHTTPClient(httpClient))
+
+	provider, err := openai.New(opts...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create OpenAI Codex provider: %w", err)
+	}
+
+	model, err := provider.LanguageModel(ctx, modelName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create OpenAI Codex model: %w", err)
+	}
+
+	providerOpts := buildCodexProviderOptions(config, modelName)
+
+	return &ProviderResult{
+		Model:               model,
+		ProviderOptions:     providerOpts,
+		SkipMaxOutputTokens: true,
+	}, nil
+}
+
+// buildCodexProviderOptions returns fantasy.ProviderOptions configured for
+// OpenAI Codex API. The Codex API requires the system prompt to be passed
+// as 'instructions' rather than as a system message.
+func buildCodexProviderOptions(config *ProviderConfig, modelName string) fantasy.ProviderOptions {
+	store := false
+	opts := &openai.ResponsesProviderOptions{
+		Store: &store,
+	}
+
+	if config.SystemPrompt != "" {
+		opts.Instructions = &config.SystemPrompt
+	}
+
+	if openai.IsResponsesReasoningModel(modelName) {
+		opts.ReasoningEffort = thinkingLevelToReasoningEffort(config.ThinkingLevel)
+	}
+
+	return fantasy.ProviderOptions{openai.Name: opts}
+}
+
+// detectCodexModelFamily determines the model family from the model name
+func detectCodexModelFamily(modelName string) string {
+	modelName = strings.ToLower(modelName)
+	if strings.Contains(modelName, "spark") {
+		return "gpt-codex-spark"
+	}
+	if strings.Contains(modelName, "codex-mini") || strings.Contains(modelName, "mini-latest") {
+		return "gpt-codex-mini"
+	}
+	if strings.Contains(modelName, "codex") {
+		return "gpt-codex"
+	}
+	return ""
+}
+
+// createCodexHTTPClient creates an HTTP client with headers required for ChatGPT/Codex API
+func createCodexHTTPClient(token, accountID string, skipVerify bool) *http.Client {
+	var base http.RoundTripper
+	if skipVerify {
+		base = &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		}
+	} else {
+		base = http.DefaultTransport
+	}
+
+	return &http.Client{
+		Transport: &codexTransport{
+			base:      base,
+			token:     token,
+			accountID: accountID,
+		},
+		Timeout: 120 * time.Second,
+	}
+}
+
+// codexTransport is a custom RoundTripper that adds ChatGPT/Codex specific headers
+type codexTransport struct {
+	base      http.RoundTripper
+	token     string
+	accountID string
+}
+
+func (t *codexTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	newReq := req.Clone(req.Context())
+
+	// Add required headers for ChatGPT/Codex API
+	// These headers mimic the official pi client to avoid Cloudflare blocking
+	newReq.Header.Set("Authorization", "Bearer "+t.token)
+	if t.accountID != "" {
+		newReq.Header.Set("chatgpt-account-id", t.accountID)
+	}
+	newReq.Header.Set("originator", "kit")
+	newReq.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
+	newReq.Header.Set("OpenAI-Beta", "responses=experimental")
+	newReq.Header.Set("Accept", "text/event-stream")
+	newReq.Header.Set("Accept-Language", "en-US,en;q=0.9")
+	newReq.Header.Set("Cache-Control", "no-cache")
+	newReq.Header.Set("Pragma", "no-cache")
+
+	return t.base.RoundTrip(newReq)
+}
+
 func createGoogleProvider(ctx context.Context, config *ProviderConfig, modelName string) (*ProviderResult, error) {
 	apiKey := firstNonEmpty(
 		config.ProviderAPIKey,

internal/models/registry.go

@@ -225,6 +225,15 @@ func (r *ModelsRegistry) ValidateEnvironment(provider string, apiKey string) err
 		}
 	}
 
+	// For openai, check stored credentials (OAuth / API key)
+	if provider == "openai" {
+		if cm, err := auth.NewCredentialManager(); err == nil {
+			if has, _ := cm.HasOpenAICredentials(); has {
+				return nil
+			}
+		}
+	}
+
 	envVars, err := r.getRequiredEnvVars(provider)
 	if err != nil {
 		// Unknown provider — nothing to validate

internal/session/store.go

@@ -96,6 +96,7 @@ func ListAllSessions() ([]SessionInfo, error) {
 }
 
 // listSessionsInDir reads all .jsonl files in a directory and extracts session info.
+// Empty sessions (no messages) are automatically cleaned up and not returned.
 func listSessionsInDir(dir string) ([]SessionInfo, error) {
 	if _, err := os.Stat(dir); os.IsNotExist(err) {
 		return nil, nil
@@ -117,6 +118,11 @@ func listSessionsInDir(dir string) ([]SessionInfo, error) {
 		if err != nil {
 			continue // skip malformed session files
 		}
+		// Clean up and skip empty sessions (no messages)
+		if info.MessageCount == 0 {
+			_ = os.Remove(path)
+			continue
+		}
 		sessions = append(sessions, *info)
 	}
 

internal/session/tree_manager.go

@@ -628,6 +628,11 @@ func (tm *TreeManager) MessageCount() int {
 	return count
 }
 
+// IsEmpty returns true if the session has no messages (only header).
+func (tm *TreeManager) IsEmpty() bool {
+	return tm.MessageCount() == 0
+}
+
 // Close closes the underlying file handle.
 func (tm *TreeManager) Close() error {
 	tm.mu.Lock()

internal/ui/cli.go

@@ -192,7 +192,8 @@ func (c *CLI) UpdateUsageFromResponse(response *fantasy.Response, inputText stri
 	outputTokens := int(usage.OutputTokens)
 
 	// Validate that the metadata seems reasonable
-	if inputTokens > 0 && outputTokens > 0 {
+	// Use API-reported tokens if input tokens are available (output may be 0 in some cases)
+	if inputTokens > 0 {
 		cacheReadTokens := int(usage.CacheReadTokens)
 		cacheWriteTokens := int(usage.CacheCreationTokens)
 		c.usageTracker.UpdateUsage(inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens)

internal/ui/model.go

@@ -3,6 +3,7 @@ package ui
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
@@ -83,6 +84,9 @@ type AppController interface {
 	// GetTreeSession returns the tree session manager, or nil if tree sessions
 	// are not enabled. Used by slash commands like /tree, /fork, /session.
 	GetTreeSession() *session.TreeManager
+	// SwitchTreeSession replaces the active tree session with a new one,
+	// closing the old session. Used by /new to create a completely fresh session.
+	SwitchTreeSession(ts *session.TreeManager)
 	// SendEvent sends a tea.Msg to the program asynchronously. Safe to call
 	// from any goroutine. Used by extension command goroutines to deliver
 	// results back to the TUI without going through tea.Cmd (which can stall
@@ -582,6 +586,8 @@ type AppModel struct {
 	streamingBashMaxLines int
 	// streamingMu protects the streaming bash output fields from concurrent access.
 	streamingMu sync.RWMutex
+	// streamingBashCommand holds the command being executed for display as a header.
+	streamingBashCommand string
 }
 
 // --------------------------------------------------------------------------
@@ -1366,6 +1372,18 @@ func (m *AppModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		// rendered when the ToolResultEvent arrives.
 		m.flushStreamContent()
 
+		// For bash commands, extract and store the command for the streaming output header.
+		if msg.ToolName == "bash" {
+			var args struct {
+				Command string `json:"command"`
+			}
+			if err := json.Unmarshal([]byte(msg.ToolArgs), &args); err == nil && args.Command != "" {
+				m.streamingMu.Lock()
+				m.streamingBashCommand = args.Command
+				m.streamingMu.Unlock()
+			}
+		}
+
 	case app.ToolExecutionEvent:
 		// Pass to stream component for execution spinner display.
 		if m.stream != nil {
@@ -1380,6 +1398,7 @@ func (m *AppModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.streamingMu.Lock()
 		m.streamingBashOutput = nil
 		m.streamingBashStderr = nil
+		m.streamingBashCommand = ""
 		m.streamingMu.Unlock()
 		// Start spinner again while waiting for the next LLM response.
 		if m.stream != nil {
@@ -1833,6 +1852,7 @@ func (m *AppModel) renderStreamingBashOutput(theme Theme) string {
 	copy(stdoutLines, m.streamingBashOutput)
 	stderrLines := make([]string, len(m.streamingBashStderr))
 	copy(stderrLines, m.streamingBashStderr)
+	command := m.streamingBashCommand
 	m.streamingMu.RUnlock()
 
 	if len(stdoutLines) == 0 && len(stderrLines) == 0 {
@@ -1853,6 +1873,11 @@ func (m *AppModel) renderStreamingBashOutput(theme Theme) string {
 		Background(theme.CodeBg).
 		PaddingLeft(1)
 
+	// Header style for the command - muted text with a subtle indicator.
+	headerStyle := lipgloss.NewStyle().
+		Foreground(theme.Muted).
+		PaddingLeft(1)
+
 	// Cap displayed lines to maxBashLines (show the tail, since streaming
 	// output is most useful at the end). The buffer itself is larger to
 	// preserve context, but we only render the last N lines.
@@ -1875,6 +1900,13 @@ func (m *AppModel) renderStreamingBashOutput(theme Theme) string {
 
 	var lines []string
 
+	// Command header - show the bash command being executed.
+	if command != "" {
+		headerText := fmt.Sprintf("$ %s", command)
+		headerContent := headerStyle.Width(lineWidth).Render(truncateLine(headerText, maxLineChars))
+		lines = append(lines, lineIndent+headerContent)
+	}
+
 	// Truncation hint at the top.
 	if hiddenCount > 0 {
 		hint := fmt.Sprintf("...(%d more lines above)", hiddenCount)
@@ -2394,7 +2426,7 @@ func (m *AppModel) printHelpMessage() {
 		"**Navigation:**\n" +
 		"- `/tree`: Navigate session tree (switch branches)\n" +
 		"- `/fork`: Branch from an earlier message\n" +
-		"- `/new`: Start a new branch (preserves history)\n" +
+		"- `/new`: Start a new session (discards context, saves old session)\n" +
 		"- `/resume`: Open session picker to switch sessions\n" +
 		"- `/name <name>`: Set a display name for this session\n\n" +
 		"**System:**\n" +
@@ -2962,7 +2994,8 @@ func (m *AppModel) handleForkCommand() tea.Cmd {
 	return nil
 }
 
-// handleNewCommand starts a fresh session by resetting the tree leaf.
+// handleNewCommand starts a completely new session (Pi-style /new behavior).
+// Creates a new session file, discarding all context from the previous conversation.
 func (m *AppModel) handleNewCommand() tea.Cmd {
 	// Emit before-session-switch event in a goroutine so that extension
 	// handlers can call blocking operations (e.g. ctx.PromptConfirm) without
@@ -2985,6 +3018,8 @@ func (m *AppModel) handleNewCommand() tea.Cmd {
 
 // performNewSession performs the actual session reset. Called either directly
 // (when no before-hook exists) or after the async hook completes.
+// Matches Pi behavior: creates a completely new session file, discarding all
+// context from the previous conversation.
 func (m *AppModel) performNewSession() tea.Cmd {
 	ts := m.appCtrl.GetTreeSession()
 	if ts == nil {
@@ -2996,11 +3031,16 @@ func (m *AppModel) performNewSession() tea.Cmd {
 		return nil
 	}
 
-	ts.ResetLeaf()
-	if m.appCtrl != nil {
-		m.appCtrl.ClearMessages()
+	// Create a brand new session file (Pi-style /new behavior)
+	newTs, err := session.CreateTreeSession(m.cwd)
+	if err != nil {
+		m.printSystemMessage(fmt.Sprintf("Failed to create new session: %v", err))
+		return nil
 	}
-	m.printSystemMessage("New branch started. Previous conversation is preserved in the tree.")
+
+	// Switch to the new session, closing the old one
+	m.appCtrl.SwitchTreeSession(newTs)
+	m.printSystemMessage("New session started. Previous conversation saved.")
 	return nil
 }
 

internal/ui/model_test.go

@@ -54,6 +54,10 @@ func (s *stubAppController) GetTreeSession() *session.TreeManager {
 	return nil
 }
 
+func (s *stubAppController) SwitchTreeSession(_ *session.TreeManager) {
+	// no-op in tests
+}
+
 func (s *stubAppController) SendEvent(_ tea.Msg) {
 	// no-op in tests
 }
@@ -684,6 +688,57 @@ func TestToolResult_clearsStreamingBashOutput(t *testing.T) {
 	}
 }
 
+// TestToolCallStarted_extractsBashCommand verifies that ToolCallStartedEvent
+// extracts the bash command from ToolArgs and stores it for the streaming output header.
+func TestToolCallStarted_extractsBashCommand(t *testing.T) {
+	ctrl := &stubAppController{}
+	m, _, _ := newTestAppModel(ctrl)
+	m.state = stateWorking
+
+	// Send ToolCallStartedEvent with bash command.
+	m = sendMsg(m, app.ToolCallStartedEvent{
+		ToolCallID: "call-1",
+		ToolName:   "bash",
+		ToolArgs:   `{"command":"ls -la /home"}`,
+	})
+
+	if m.streamingBashCommand != "ls -la /home" {
+		t.Fatalf("expected streamingBashCommand='ls -la /home', got %q", m.streamingBashCommand)
+	}
+
+	// ToolResultEvent should clear the command.
+	m = sendMsg(m, app.ToolResultEvent{
+		ToolCallID: "call-1",
+		ToolName:   "bash",
+		ToolArgs:   `{"command":"ls -la /home"}`,
+		Result:     "output",
+		IsError:    false,
+	})
+
+	if m.streamingBashCommand != "" {
+		t.Fatalf("expected streamingBashCommand cleared, got %q", m.streamingBashCommand)
+	}
+}
+
+// TestToolCallStarted_nonBashTool_doesNotSetCommand verifies that non-bash tools
+// do not set the streamingBashCommand field.
+func TestToolCallStarted_nonBashTool_doesNotSetCommand(t *testing.T) {
+	ctrl := &stubAppController{}
+	m, _, _ := newTestAppModel(ctrl)
+	m.state = stateWorking
+
+	// Send ToolCallStartedEvent with a non-bash tool.
+	m = sendMsg(m, app.ToolCallStartedEvent{
+		ToolCallID: "call-1",
+		ToolName:   "read",
+		ToolArgs:   `{"file":"/etc/passwd"}`,
+	})
+
+	if m.streamingBashCommand != "" {
+		t.Fatalf("expected streamingBashCommand to remain empty for non-bash tools, got %q", m.streamingBashCommand)
+	}
+}
+
 // TestStepError_printCmd verifies that StepErrorEvent with a non-nil error
 // produces a non-nil cmd (the tea.Println call for the error message).
 func TestStepError_printCmd(t *testing.T) {

pkg/kit/auth.go

@@ -9,6 +9,10 @@ type CredentialManager = auth.CredentialManager
 // and API key authentication methods.
 type AnthropicCredentials = auth.AnthropicCredentials
 
+// OpenAICredentials holds OpenAI API credentials supporting both OAuth
+// and API key authentication methods.
+type OpenAICredentials = auth.OpenAICredentials
+
 // CredentialStore holds all stored credentials for various providers.
 type CredentialStore = auth.CredentialStore
 
@@ -42,3 +46,34 @@ func GetAnthropicAPIKey() string {
 	}
 	return key
 }
+
+// HasOpenAICredentials checks if valid OpenAI credentials are stored
+// (either OAuth token or API key).
+func HasOpenAICredentials() bool {
+	cm, err := auth.NewCredentialManager()
+	if err != nil {
+		return false
+	}
+	has, err := cm.HasOpenAICredentials()
+	if err != nil {
+		return false
+	}
+	return has
+}
+
+// GetOpenAIAPIKey resolves the OpenAI API key using the standard
+// resolution order: stored credentials -> OPENAI_API_KEY env var.
+// Returns an empty string if no key is found.
+func GetOpenAIAPIKey() string {
+	cm, err := auth.NewCredentialManager()
+	if err != nil {
+		return ""
+	}
+	// Try to get valid access token (handles OAuth refresh)
+	token, err := cm.GetValidOpenAIAccessToken()
+	if err == nil && token != "" {
+		return token
+	}
+	// Fall back to environment variable
+	return ""
+}

pkg/kit/kit.go

@@ -536,8 +536,11 @@ func (m *Kit) SetModel(ctx context.Context, modelString string) error {
 	}
 
 	// Build a provider config from current settings, overriding the model.
+	// Load system prompt properly (handles both file paths and inline content).
+	systemPrompt, _ := config.LoadSystemPrompt(viper.GetString("system-prompt"))
 	config := &models.ProviderConfig{
 		ModelString:    modelString,
+		SystemPrompt:   systemPrompt,
 		ProviderAPIKey: viper.GetString("provider-api-key"),
 		ProviderURL:    viper.GetString("provider-url"),
 		MaxTokens:      viper.GetInt("max-tokens"),