feat: enhance Nova local integration and authentication flow:

apps/supercode-cli/client/components/auth/login-form.tsx

@@ -11,6 +11,7 @@ import { PixelLogo } from '@/components/ui/pixel-logo'
 
 const ALLOWED_REDIRECT_ORIGINS = new Set([
   "https://nova.supercodeai.tech",
+  "http://nova.localhost:3000",
   "http://nova.localhost:3003",
 ])
 
@@ -45,17 +46,23 @@ const LoginForm = () => {
 
     let cancelled = false
     const transferSession = async () => {
-      const { data: tokenData, error: tokenError } = await authClient.oneTimeToken.generate()
-      if (cancelled) return
-      if (tokenError || !tokenData?.token) {
-        setError("Failed to create the Nova login session. Please try again.")
-        return
+      try {
+        const { data: tokenData, error: tokenError } = await authClient.oneTimeToken.generate()
+        if (cancelled) return
+        if (tokenError || !tokenData?.token) {
+          setError("Failed to create the Nova login session. Please reload to try again.")
+          return
+        }
+
+        const callbackUrl = new URL("/api/auth/cli/callback", novaUrl.origin)
+        callbackUrl.searchParams.set("token", tokenData.token)
+        callbackUrl.searchParams.set("redirect", novaUrl.pathname)
+        window.location.replace(callbackUrl.toString())
+      } catch {
+        if (!cancelled) {
+          setError("The authentication service is unavailable. Please reload to try again.")
+        }
       }
-
-      const callbackUrl = new URL("/api/auth/cli/callback", novaUrl.origin)
-      callbackUrl.searchParams.set("token", tokenData.token)
-      callbackUrl.searchParams.set("redirect", novaUrl.pathname)
-      window.location.replace(callbackUrl.toString())
     }
 
     void transferSession()
@@ -78,7 +85,15 @@ const LoginForm = () => {
   }
 
   if (data?.session) {
-    return null
+    return (
+      <div className="flex min-h-screen items-center justify-center bg-zinc-950 p-4">
+        {error ? (
+          <p role="alert" className="text-sm text-red-400">{error}</p>
+        ) : (
+          <Spinner className="size-8 text-amber-500" />
+        )}
+      </div>
+    )
   }
 
   const handleGitHubSignIn = async () => {
@@ -89,14 +104,16 @@ const LoginForm = () => {
       const callbackURL = novaUrl
         ? `${window.location.origin}/sign-in?redirect=${encodeURIComponent(novaUrl.toString())}`
         : window.location.origin
-      await authClient.signIn.social({
+      const { error: signInError } = await authClient.signIn.social({
         provider: 'github',
         callbackURL,
         errorCallbackURL: `${window.location.origin}/sign-in`,
       })
-    } catch (err) {
-      console.error('Sign in error:', err)
-      setError('Failed to connect to authentication server. Make sure the terminal server is running.')
+      if (signInError) {
+        setError("GitHub sign-in could not be started. Please try again.")
+      }
+    } catch {
+      setError("The authentication service is unavailable. Please try again shortly.")
     } finally {
       setIsLoading(false)
     }
@@ -170,7 +187,7 @@ const LoginForm = () => {
                   </button>
 
                   {error && (
-                    <div className="rounded-lg border border-red-900/50 bg-red-950/30 px-4 py-3">
+                    <div role="alert" className="rounded-lg border border-red-900/50 bg-red-950/30 px-4 py-3">
                       <p className="text-xs text-red-400 leading-relaxed">{error}</p>
                     </div>
                   )}

apps/supercode-cli/client/lib/auth-client.test.ts

@@ -0,0 +1,65 @@
+import { afterAll, beforeEach, describe, expect, spyOn, test } from "bun:test"
+
+const requests: { url: string; init?: RequestInit }[] = []
+let responseStatus = 200
+let responseBody: unknown = {}
+let networkFailure = false
+const fetchMock = spyOn(globalThis, "fetch").mockImplementation(async (input, init) => {
+  requests.push({ url: String(input), init })
+  if (networkFailure) throw new TypeError("Failed to fetch")
+  return Response.json(responseBody, { status: responseStatus })
+})
+
+// Import after installing fetch so Better Auth captures the mocked transport.
+const { authClient } = await import("./auth-client")
+
+afterAll(() => fetchMock.mockRestore())
+beforeEach(() => {
+  requests.length = 0
+  responseStatus = 200
+  responseBody = {}
+  networkFailure = false
+})
+
+describe("same-origin authentication proxy", () => {
+  test("GitHub sign-in uses the proxy and preserves the Nova callback", async () => {
+    const callbackURL = "https://supercode-terminal.vercel.app/sign-in?redirect=https%3A%2F%2Fnova.supercodeai.tech%2Fapp"
+    responseBody = { url: "https://github.com/login/oauth/authorize", redirect: false }
+
+    await authClient.signIn.social({ provider: "github", callbackURL })
+
+    expect(requests).toHaveLength(1)
+    expect(requests[0].url).toBe("/api/auth/sign-in/social")
+    expect(requests[0].init?.credentials).toBe("include")
+    expect(JSON.parse(String(requests[0].init?.body))).toMatchObject({
+      provider: "github",
+      callbackURL,
+    })
+  })
+
+  test("session checks use the same-origin proxy", async () => {
+    responseBody = null
+    await authClient.getSession()
+    expect(requests[0].url).toBe("/api/auth/get-session")
+  })
+
+  test("Nova one-time tokens use the same-origin proxy", async () => {
+    responseBody = { token: "test-one-time-token" }
+    const result = await authClient.oneTimeToken.generate()
+    expect(requests[0].url).toBe("/api/auth/one-time-token/generate")
+    expect(result.data?.token).toBe("test-one-time-token")
+  })
+
+  test("HTTP sign-in failures are returned for the form to display", async () => {
+    responseStatus = 503
+    responseBody = { message: "Authentication unavailable" }
+    const result = await authClient.signIn.social({ provider: "github" })
+    expect(result.error).toBeTruthy()
+    expect(requests[0].url).toBe("/api/auth/sign-in/social")
+  })
+
+  test("network failures reject for the form to catch", async () => {
+    networkFailure = true
+    await expect(authClient.signIn.social({ provider: "github" })).rejects.toThrow("Failed to fetch")
+  })
+})

apps/supercode-cli/client/lib/auth-client.ts

@@ -5,7 +5,10 @@ import {
 } from "better-auth/client/plugins"
 
 export const authClient = createAuthClient({
-  baseURL: process.env.NEXT_PUBLIC_AUTH_URL || "http://localhost:3004",
+  // Always use the Next.js/Vercel proxy, not the backend URL inferred from env.
+  fetchOptions: {
+    baseURL: "/api/auth",
+  },
   plugins: [
     deviceAuthorizationClient(),
     oneTimeTokenClient(),

apps/supercode-cli/server/README.md

@@ -50,6 +50,32 @@ Nova uses those same variables on the **terminal harness server**, not in browse
 
 The URL must be the bare HTTPS branch origin from Neon Console → branch → AI Gateway, without `/v1`. The token needs `ai_gateway:invoke`; a Neon management API key will not work. Access requires a funded Neon project and varies by branch. The SDK routes Claude to Messages, OpenAI/Codex to Responses, and other models to Chat Completions. Gemini structured output and multi-step tools are currently unsupported; Responses tool continuations can fail upstream. Nova's normal plan and budget limits still apply.
 
+### Local Codex in Nova
+
+Native Codex subscription login is supported only with **locally hosted Nova**, not the Vercel-hosted UI. Install the OpenAI Codex CLI separately, start Nova locally, then run from the workspace you want Codex to inspect:
+
+```bash
+# From this repository (development, no publish required)
+bun apps/supercode-cli/server/src/cli/main.ts nova connect --origin http://localhost:3003
+
+# Once the updated CLI is installed
+supercode nova connect --origin http://localhost:3003
+```
+
+Run `codex login` first if you are not already signed in. The companion defaults to your existing `CODEX_HOME` (or `~/.codex`) and detects the signed-in account through Codex app-server without reading or copying auth files. Keep the same `CODEX_HOME` when running both commands. Confirm the profile/workspace/origin in the terminal. In Nova **Settings → Models → Local Codex**, enter the companion port and single-use code, confirm workspace access, and pair. Your account and models appear automatically; choose **Open local Codex chat**. The browser cannot scan installed binaries directly.
+
+Existing-profile mode cannot sign in, switch accounts or sign out through Nova. Use `codex login` / `codex logout` in the terminal, then restart the companion and pair again. The existing credential-storage backend (including OS keyring) is preserved. Codex itself may renew credentials and write its normal session state.
+
+For a separate Nova account, add `--profile isolated`. This uses `~/.nova-codex` instead, enables **Continue with ChatGPT** and **Sign out of Nova Codex**, and does not reuse the CLI account. Complete sign-in and click **Refresh account & models**. Nova does not install Codex automatically.
+
+This is read-only chat/planning with native follow-up threads, not writable Nova agent tools. Read-only sandboxing does not restrict reads to the selected folder. Only normalized text and terminal events are exposed; unsupported native approval/permission requests are denied. Model catalogs are not entitlement guarantees. Failed/interrupted turns are explicitly incomplete.
+
+The companion binds only `127.0.0.1` (default port `43127`; override with `--port`). It accepts only the exact configured localhost origin and a paired credential. OpenAI credentials stay under Codex's control. Existing mode preserves your configured home and does not change its permissions or credential backend. Your existing Codex configuration may contain hooks, plugins or integrations; this preview does not isolate those. Use `--profile isolated` for a separate profile and avoid adding integrations there. API-key accounts are not supported by this subscription connection. Only one companion should use an isolated profile at a time.
+
+Pairing codes expire in five minutes, are single-use, and permit at most five attempts. Browser session credentials remain in memory for up to one hour. Reloading/navigating away requires restarting the companion and re-pairing. **Unpair** disconnects the browser; **Sign out of Nova Codex** logs out the dedicated profile and does not claim to revoke other OpenAI sessions. Ctrl+C stops the companion. Disconnects, deadline/overflow cancellation, or a failed native interruption may terminate Codex; restart/re-pair to recover.
+
+Browsers may require local-network permission or block HTTPS-to-HTTP loopback connections. Do not work around this by exposing the companion publicly or proxying subscription credentials through Vercel. Current OpenAI documentation directs hosted/commercial integrations to partner-provisioned Sign in with ChatGPT; this native-login path rejects remote origins.
+
 ### Voice Input
 
 Voice capture requires `ffmpeg` and a Smallest.ai API key.

apps/supercode-cli/server/src/cli/commands/nova.ts

@@ -0,0 +1,62 @@
+import { Command } from "commander"
+import { mkdir, chmod, lstat, realpath } from "node:fs/promises"
+import { homedir } from "node:os"
+import { basename, resolve } from "node:path"
+import { createInterface } from "node:readline/promises"
+
+import { spawnCodex } from "../../nova/codex-rpc"
+import { resolveCodexProfile } from "../../nova/profile"
+import { LocalCodexRuntime } from "../../nova/runtime"
+import { localOrigin, startCompanion } from "../../nova/server"
+
+export const novaCommand = new Command("nova").description("Local Nova integrations")
+novaCommand.command("connect")
+  .description("Pair locally hosted Nova with your existing Codex login (read-only)")
+  .requiredOption("--origin <origin>", "Exact local Nova origin, e.g. http://localhost:3003")
+  .option("--port <port>", "Loopback companion port", "43127")
+  .option("--workspace <directory>", "Read-only workspace", process.cwd())
+  .option("--profile <mode>", "Codex account profile: existing or isolated", "existing")
+  .action(async (options: { origin: string; port: string; workspace: string; profile: string }) => {
+    const profile = resolveCodexProfile(options.profile)
+    const origin = localOrigin(options.origin)
+    const port = Number(options.port)
+    if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error("Invalid port")
+    if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Pairing requires an interactive terminal")
+    const workspace = await realpath(resolve(options.workspace))
+    if (!(await lstat(workspace)).isDirectory()) throw new Error("Workspace must be a directory")
+    const prompt = createInterface({ input: process.stdin, output: process.stdout })
+    let answer: string
+    try {
+      answer = await prompt.question(`Allow ${origin} to control local Codex in ${workspace} (read-only), using the ${profile.mode} profile at ${profile.path}? Existing Codex configuration may include integrations. [y/N] `)
+    } finally { prompt.close() }
+    if (answer.trim().toLowerCase() !== "y") return
+    if (profile.mode === "isolated") {
+      await mkdir(profile.path, { recursive: true, mode: 0o700 })
+      const metadata = await lstat(profile.path)
+      if (metadata.isSymbolicLink() || !metadata.isDirectory() || (typeof process.getuid === "function" && metadata.uid !== process.getuid())) {
+        throw new Error("Unsafe Nova Codex profile directory")
+      }
+      await chmod(profile.path, 0o700)
+    }
+    // Do not create, chmod, inspect or copy the shared profile's credential files.
+    // Launch outside the selected workspace to avoid startup project config.
+    const rpc = spawnCodex(profile.path, homedir(), profile.mode)
+    const runtime = new LocalCodexRuntime(rpc, workspace, basename(workspace), profile.mode)
+    let companion: Awaited<ReturnType<typeof startCompanion>>
+    try {
+      await runtime.status()
+      companion = await startCompanion({ origin, port, runtime })
+    } catch {
+      runtime.close()
+      throw new Error("Could not start Codex. Install/update the Codex CLI and retry.")
+    }
+    process.stdout.write(`Codex detected (${profile.mode} profile). Companion: http://127.0.0.1:${companion.port}\nOpen Nova Settings → Models. Pairing code (5 minutes, one use): ${companion.pairingCode}\n${profile.mode === "existing" ? "Reusing your Codex login. If not signed in, run codex login with the same CODEX_HOME, then restart this companion. Nova cannot sign out your shared CLI account." : "Credentials remain in the dedicated Nova profile."}\nPress Ctrl+C to stop.\n`)
+    let stopping = false
+    const stop = () => {
+      if (stopping) return
+      stopping = true
+      void companion.close().finally(() => { process.exitCode = 0 })
+    }
+    process.once("SIGINT", stop)
+    process.once("SIGTERM", stop)
+  })

apps/supercode-cli/server/src/cli/main.ts

@@ -9,6 +9,7 @@ import { theme } from "./utils/tui"
 import { supercodeInit } from "./commands/ai/init"
 import { skillCommand } from "./commands/skill"
 import { renderWelcome } from "./utils/welcome"
+import { novaCommand } from "./commands/nova"
 
 process.on("unhandledRejection", (reason) => {
   try {
@@ -33,13 +34,14 @@ async function main() {
     .addCommand(loginCommand)
     .addCommand(supercodeInit)
     .addCommand(skillCommand)
+    .addCommand(novaCommand)
 
   program.action(async () => {
     renderWelcome(version)
     program.help()
   })
 
-  program.parse()
+  await program.parseAsync()
 }
 
 main().catch((err) => {

apps/supercode-cli/server/src/lib/auth.ts

@@ -9,6 +9,7 @@ const clientUrl = process.env.CLIENT_URL || "http://localhost:3000"
 const isProduction = serverUrl.startsWith("https://")
 const novaOrigins = [
   "https://nova.supercodeai.tech",
+  "http://nova.localhost:3000",
   "http://nova.localhost:3003",
 ]