Add codex and xai-oauth to the credential catalog and adapter contract

apps/sidecar/package.json

@@ -16,9 +16,11 @@
   },
   "dependencies": {
     "@corbits/agent-lifecycle": "workspace:*",
+    "@corbits/codex-provider": "workspace:*",
     "@corbits/credential-providers": "workspace:*",
     "@corbits/error-sink": "workspace:*",
     "@corbits/ollama-adapter": "workspace:*",
+    "@corbits/xai-provider": "workspace:*",
     "@intx/agent": "workspace:*",
     "@intx/authz": "0.3.0",
     "@intx/crypto": "0.3.0",

apps/sidecar/src/config.ts

@@ -17,7 +17,11 @@ import { parseToolRegistries } from "./tool-materialization";
  * Ollama deployment's `quirks.numCtx` (see `@corbits/seeding`'s
  * seed and `./workflow-substrate-factory/context-budget`) actually
  * reaches Ollama's `options.num_ctx` instead of silently falling back
- * to the built-in adapter's defaults. An operator who sets
+ * to the built-in adapter's defaults, and the CL-7510 loopback-OAuth
+ * Responses adapters (`codex`, `xai-oauth`) so a launched source —
+ * rewritten to the provider's own registry key at
+ * `@intx/db`'s `buildSource` — serves through its own adapter rather
+ * than the shared wire-format one. An operator who sets
  * `SIDECAR_ADAPTER_MANIFEST` explicitly gets exactly what they wrote --
  * this default never merges with an operator value, only replaces the
  * unset case.
@@ -28,6 +32,16 @@ const DEFAULT_ADAPTER_MANIFEST: AdapterManifest = [
     specifier: "@corbits/ollama-adapter",
     export: "createOllamaAdapter",
   },
+  {
+    provider: "codex",
+    specifier: "@corbits/codex-provider",
+    export: "createCodexResponsesAdapter",
+  },
+  {
+    provider: "xai-oauth",
+    specifier: "@corbits/xai-provider",
+    export: "createXaiResponsesAdapter",
+  },
 ];
 
 const WsURL = type("string").narrow((url, ctx) => {

apps/sidecar/test/config.test.ts

@@ -15,6 +15,16 @@ const DEFAULT_MANIFEST = [
     specifier: "@corbits/ollama-adapter",
     export: "createOllamaAdapter",
   },
+  {
+    provider: "codex",
+    specifier: "@corbits/codex-provider",
+    export: "createCodexResponsesAdapter",
+  },
+  {
+    provider: "xai-oauth",
+    specifier: "@corbits/xai-provider",
+    export: "createXaiResponsesAdapter",
+  },
 ];
 
 test("parses a complete environment into config", () => {
@@ -39,6 +49,23 @@ test("an unset SIDECAR_ADAPTER_MANIFEST defaults to the shipped Ollama adapter,
   expect(config.adapterManifest).toEqual(DEFAULT_MANIFEST);
 });
 
+test("the shipped default manifest registers the loopback-OAuth Responses adapters (CL-7510)", () => {
+  const config = readSidecarConfig(VALID_ENV);
+  const byProvider = new Map(
+    config.adapterManifest.map((entry) => [entry.provider, entry]),
+  );
+  expect(byProvider.get("codex")).toEqual({
+    provider: "codex",
+    specifier: "@corbits/codex-provider",
+    export: "createCodexResponsesAdapter",
+  });
+  expect(byProvider.get("xai-oauth")).toEqual({
+    provider: "xai-oauth",
+    specifier: "@corbits/xai-provider",
+    export: "createXaiResponsesAdapter",
+  });
+});
+
 test("an operator-set adapter manifest fully replaces the default rather than merging with it", () => {
   const manifest = [
     {

apps/sidecar/tsconfig.json

@@ -16,6 +16,9 @@
     {
       "path": "../../packages/agent-lifecycle/tsconfig.src.json"
     },
+    {
+      "path": "../../packages/codex-provider/tsconfig.src.json"
+    },
     {
       "path": "../../packages/credential-providers/tsconfig.src.json"
     },
@@ -25,6 +28,9 @@
     {
       "path": "../../packages/ollama-adapter/tsconfig.src.json"
     },
+    {
+      "path": "../../packages/xai-provider/tsconfig.src.json"
+    },
     {
       "path": "../../vendor/intx/agent/tsconfig.src.json"
     },

apps/sidecar/tsconfig.src.json

@@ -13,6 +13,9 @@
     {
       "path": "../../packages/agent-lifecycle/tsconfig.src.json"
     },
+    {
+      "path": "../../packages/codex-provider/tsconfig.src.json"
+    },
     {
       "path": "../../packages/credential-providers/tsconfig.src.json"
     },
@@ -22,6 +25,9 @@
     {
       "path": "../../packages/ollama-adapter/tsconfig.src.json"
     },
+    {
+      "path": "../../packages/xai-provider/tsconfig.src.json"
+    },
     {
       "path": "../../vendor/intx/agent/tsconfig.src.json"
     },

apps/web/test/onboarding.test.tsx

@@ -69,9 +69,16 @@ describe("CREDENTIAL_PROVIDERS", () => {
   // list, so a provider added or removed there is caught here rather than
   // drifting silently.
   test("has one card for every provider the hub can test a credential against", () => {
+    // The CL-7510 loopback-OAuth ids (`codex`, `xai-oauth`) are
+    // deliberately absent: their credential only exists after a loopback
+    // OAuth login, so there is no key-paste card to render until that
+    // flow is wired — a card here would offer a paste form no key can
+    // satisfy.
+    const LOOPBACK_OAUTH_ONLY = new Set(["codex", "xai-oauth"]);
     expect(CREDENTIAL_PROVIDERS.map((p) => p.id).sort()).toEqual(
       supportedCredentialProviders()
         .map((p) => p.id)
+        .filter((id) => !LOOPBACK_OAUTH_ONLY.has(id))
         .sort(),
     );
   });

package.json

@@ -32,8 +32,10 @@
   "devDependencies": {
     "@corbits/artifacts": "github:corbitsdev/corbits-artifacts#dc435ba749b4378f19e5de772159c2a57e932938",
     "@corbits/artifacts-hub": "workspace:*",
+    "@corbits/codex-provider": "workspace:*",
     "@corbits/evals": "workspace:*",
     "@corbits/ollama-adapter": "workspace:*",
+    "@corbits/xai-provider": "workspace:*",
     "@intx/db": "workspace:*",
     "@intx/crypto": "workspace:*",
     "@intx/log": "workspace:*",

packages/codex-provider/package.json

@@ -7,7 +7,8 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./constants": "./src/constants.ts"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

packages/codex-provider/tsconfig.src.json

@@ -4,7 +4,6 @@
   "exclude": ["src/**/*.test.ts", "src/**/*.test.tsx"],
   "compilerOptions": {
     "types": ["bun"],
-    "noEmit": true,
     "composite": true,
     "emitDeclarationOnly": true,
     "outDir": "dist",