…tian-Engineering#58)

* fix(tui): delegate OAuth/setup-token calls to claude CLI subprocess

Setup-tokens (sk-ant-oat01-...) cannot authenticate directly against
api.anthropic.com, which returns 401 'OAuth authentication is currently
not supported'. This breaks all compaction operations (backfill,
recompact, rewrite) for Claude Max subscribers using lcm-tui.

When an OAuth token is detected, delegate to the `claude` CLI binary
(`claude --print -p <prompt>`) which already holds valid Max OAuth
credentials and handles the exchange transparently. ANTHROPIC_API_KEY
is unset in the subprocess environment so the CLI uses its own stored
OAuth credentials rather than the setup-token.

Also fixes resolveGatewayURL() to look for port under gateway.port
(nested) in addition to the top-level port field, matching actual
OpenClaw config layout.

Non-OAuth flow is unchanged: regular API keys still hit
api.anthropic.com directly with x-api-key header.

Fixes Martian-Engineering#57

* docs: add screenshot evidence of setup-token auth working

Shows lcm-tui rewrite dry-run succeeding with Claude Max OAuth
setup-token, no ANTHROPIC_API_KEY needed. The claude CLI handles
the OAuth exchange transparently.

* docs: replace screenshot with redacted version (cache bust)

* fix(tui): preserve oauth CLI summary settings

* chore: add changeset for oauth summary fix

* chore: remove oauth evidence screenshot

---------

Co-authored-by: Josh Lehman <josh@martian.engineering>

When the user has a ChatGPT Plus/Pro subscription (no raw OPENAI_API_KEY
but a populated ~/.codex/auth.json), route openai-codex summarization
through the local `codex` CLI so it can use its stored OAuth
credentials. Mirrors the existing Anthropic OAuth delegate pattern (PR
Martian-Engineering#58).

Changes in tui/repair.go:
- Hoist cliSummarizationSystemPrompt constant, reused by both CLI
  delegates.
- Add hasCodexOAuth() that probes ~/.codex/auth.json presence.
- Add summarizeViaCodexCLI() that runs `codex exec` with a restrictive
  sandbox (--sandbox read-only), --ephemeral, --output-last-message, and
  streams the prompt on stdin. The system directive is prepended to the
  stdin payload because codex has no --system-prompt flag.
- Add filteredOpenAIChildEnv() that strips every OPENAI_* env var from
  the child environment, preventing OPENAI_BASE_URL or proxy vars from
  re-routing OAuth traffic to an unintended endpoint.
- Gate in summarize(): allow an empty apiKey when provider is
  openai-codex and hasCodexOAuth() returns true.
- Branch in summarizeOpenAI(): delegate to summarizeViaCodexCLI() when
  the Codex OAuth path applies.
- resolveProviderAPIKey(): when Codex OAuth is available, return an
  empty string with nil error so the caller can route to the CLI
  delegate instead of failing hard. When OAuth is absent, the error now
  hints at `codex login`.

Tests in tui/codex_oauth_test.go cover:
- hasCodexOAuth: file absent, empty, present, directory.
- OAuth path delegates to CLI (HTTP transport never called).
- API-key path still uses direct HTTP (regression).
- Empty key without OAuth still errors.
- resolveProviderAPIKey returns empty sentinel under OAuth; hints at
  `codex login` without OAuth.
- CLI missing from PATH yields an actionable error.
- Non-zero exit surfaces stderr.
- Empty and oversized CLI output are rejected.
- filteredOpenAIChildEnv removes every OPENAI_* var and preserves
  unrelated env.

Closes Martian-Engineering#469

Refs Martian-Engineering#58 (Anthropic delegate pattern), Martian-Engineering#273 (plugin-side Codex OAuth).

* feat(tui): support Codex OAuth via codex CLI delegate

When the user has a ChatGPT Plus/Pro subscription (no raw OPENAI_API_KEY
but a populated ~/.codex/auth.json), route openai-codex summarization
through the local `codex` CLI so it can use its stored OAuth
credentials. Mirrors the existing Anthropic OAuth delegate pattern (PR
#58).

Changes in tui/repair.go:
- Hoist cliSummarizationSystemPrompt constant, reused by both CLI
  delegates.
- Add hasCodexOAuth() that probes ~/.codex/auth.json presence.
- Add summarizeViaCodexCLI() that runs `codex exec` with a restrictive
  sandbox (--sandbox read-only), --ephemeral, --output-last-message, and
  streams the prompt on stdin. The system directive is prepended to the
  stdin payload because codex has no --system-prompt flag.
- Add filteredOpenAIChildEnv() that strips every OPENAI_* env var from
  the child environment, preventing OPENAI_BASE_URL or proxy vars from
  re-routing OAuth traffic to an unintended endpoint.
- Gate in summarize(): allow an empty apiKey when provider is
  openai-codex and hasCodexOAuth() returns true.
- Branch in summarizeOpenAI(): delegate to summarizeViaCodexCLI() when
  the Codex OAuth path applies.
- resolveProviderAPIKey(): when Codex OAuth is available, return an
  empty string with nil error so the caller can route to the CLI
  delegate instead of failing hard. When OAuth is absent, the error now
  hints at `codex login`.

Tests in tui/codex_oauth_test.go cover:
- hasCodexOAuth: file absent, empty, present, directory.
- OAuth path delegates to CLI (HTTP transport never called).
- API-key path still uses direct HTTP (regression).
- Empty key without OAuth still errors.
- resolveProviderAPIKey returns empty sentinel under OAuth; hints at
  `codex login` without OAuth.
- CLI missing from PATH yields an actionable error.
- Non-zero exit surfaces stderr.
- Empty and oversized CLI output are rejected.
- filteredOpenAIChildEnv removes every OPENAI_* var and preserves
  unrelated env.

Closes #469

Refs #58 (Anthropic delegate pattern), #273 (plugin-side Codex OAuth).

* docs: clarify tui codex oauth usage

---------

Co-authored-by: Josh Lehman <josh@martian.engineering>