Setup: codex auth-mode parsing, nested Claude guardrails, and --ts config output

[eve-senara]

Summary

• add Codex auth.json parsing for auth_mode variants: chatgpt/oauth -> tokens.access_token, api_key -> OPENAI_API_KEY, and missing mode fallback order
• keep auth.json read/parse failures silent and non-throwing
• harden nested Claude Code detection and guardrails: force run executor to codex with required warning text, mark Claude unavailable during setup in nested sessions, and fail fast with actionable error when Codex is unavailable
• add orca setup --ts output mode writing typed TS config modules to ~/.orca/config.ts or ./orca.config.ts
• preserve key persistence model: only explicit overrides persist; auto-detected env/keychain/codex auth are detection-only
• extend tests and setup integration script for oauth auth-mode and TS output paths (global + project), plus nested Claude run behavior

Verification

• bun test
• bun run build
• bun run test:setup

All pass locally.

[github-actions]

Code Review: PR #7 — Setup: codex auth-mode parsing, nested Claude guardrails, and --ts config output

BUG: maybeCreateFirstRunGlobalConfig not aware of .ts global config

File: src/cli/commands/run.ts:125-131

const globalConfigPath = path.join(homedir, ".orca", "config.js");
// ...
const hasAnyConfig = (await pathExists(globalConfigPath))
  || (await pathExists(projectJsConfigPath))
  || (await pathExists(projectTsConfigPath));

This function checks for ~/.orca/config.js but not ~/.orca/config.ts. After a user runs orca setup --ts --global, only ~/.orca/config.ts exists. On the first subsequent orca run, maybeCreateFirstRunGlobalConfig will not find any config (it doesn't check the .ts global path) and will create a redundant ~/.orca/config.js with hardcoded executor: "codex" defaults.

Concrete failure scenario:

1. orca setup --ts --global --openai-key sk-xxx → creates ~/.orca/config.ts
2. orca run --task "hello" → maybeCreateFirstRunGlobalConfig() doesn't see the .ts config, creates ~/.orca/config.js with executor: "codex"
3. User now has two global configs; if they later remove/rename their .ts config, the stale auto-created .js config silently takes over

Fix: Add ~/.orca/config.ts to the hasAnyConfig check:

const globalTsConfigPath = path.join(homedir, ".orca", "config.ts");
const hasAnyConfig = (await pathExists(globalConfigPath))
  || (await pathExists(globalTsConfigPath))
  || (await pathExists(projectJsConfigPath))
  || (await pathExists(projectTsConfigPath));

---

Everything else in the PR (auth-mode parsing logic, nested Claude Code guardrails, TS config output, config-loader .ts preference) looks correct.

[github-actions]

No issues found. This PR adds Codex auth.json parsing for multiple auth-mode variants, hardens nested Claude Code detection to force the codex executor with a fail-fast path, and introduces a --ts flag for typed TypeScript config output — all with proper fallback logic, config resolution priority, and comprehensive test coverage.