Fix Codex setup with Claude JSON event arrays and Grok API-key authentication

[AojdevStudio]

Codex setup against pstack 1.3.0 fails at two provider boundaries. Claude Code 2.1.263 emits a JSON event array containing a successful terminal result, while parseClaude accepts only a single object. Grok models exits successfully, lists grok-4.6, and reports You are using XAI_API_KEY., while the preflight requires logged in. Preserve legacy result objects, terminal failure handling, exact model evidence, and authenticated live probes. Add regression coverage for both cases and verify the installed candidate from the real Codex surface. Optional Astra support overlaps PR #55; model extension routing will align with that work.

[mast-factory]

Type	bug — Two provider-boundary regressions reject valid Claude event-array results and valid Grok API-key authentication during Codex setup.
Route	Plan fix
Severity	🟠 high — The default setup probe set cannot complete for affected Codex users, so configuration is never activated.
Confidence	high — Both failures reproduce on main, and the open candidate fix exposes one additional fail-open preflight defect.
Effort	medium — The fix spans parser and preflight logic, regression fixtures, exact-model safeguards, and installed-surface verification.
Impact	high — A core setup workflow is blocked across two required provider probes with no permitted weaker-model fallback.
Next step	Plan a focused fix or rebase PR #59, add fail-closed Grok coverage, resolve overlap/conflicts, and complete installed Codex and Claude setup verification.

Understanding

This is a genuine two-part compatibility bug. On main (c8481f7), parseClaude parses one JSON value and immediately requires a non-array object (plugins/pstack/skills/poteto-mode/scripts/runner/parse-output.ts:64-76), so Claude Code 2.1.263's successful event array fails with claude emitted a non-object result. The parser should accept either the legacy object or the terminal type: "result" event in an array, while checking terminal failure before accepting partial text and preserving model/session/usage/cost extraction.

Grok preflight runs grok models, but preflightPassed requires /logged in/i plus model text (plugins/pstack/skills/poteto-mode/scripts/runner/run.ts:353-374). A successful response containing You are using XAI_API_KEY. and grok-4.6 is retried, then classified unauthenticated with exit 77; the model is not launched. Authentication should accept subscription login or the API-key signal, require boundary-aware evidence for the exact requested model, and reject every explicit error status before execution. The existing failed-preflight path already removes output, writes a receipt, and maps unavailable-model to exit 69.

PR #59 directly addresses both reported failures and preserves legacy Claude objects, but it is merge-conflicting and has a blocking fail-open case: at commit 60f1547, You are using XAI_API_KEY.\nmodel grok-4.6 is not supported passes preflight and launches Grok because only unauthenticated is rejected. Add a regression requiring exit 69 and no model-start marker. Its optional Astra/extension work overlaps open PR #55; issues #54 and #33 cover broader optional families, while merged PRs #16 and #39 provide relevant family-effort and rolling-Claude precedent. Do not expand this fix to unrelated model families by default.

Assumptions

• The issue's intended scope is the two provider-boundary defects; optional Astra/extension routing is separable overlap rather than required to prove the minimum fix.
• A Grok preflight is valid only when authentication is positively established, the exact requested model is present as a bounded token, and the response has no explicit unavailable/unauthenticated status.
• The previously observed Grok HTTP 402 is an external account-balance failure, not a repository defect, but it does not satisfy the required live merge gate.
• Current terminal-error behavior and the no-fallback/no-partial-configuration setup contract must remain unchanged.

Open questions

• Maintainers must decide whether PR fix(pstack): support Codex setup and current CLI output #59's optional Astra/extension changes should be retained after rebasing or split/deferred to avoid duplicating PR feat(pstack): support optional Sonnet Astra Luna and Terra families #55.

Reproduction

Repository-local reproduction on Linux from c8481f7 using Bun 1.4.2:

1. Passed a Claude JSON array containing init plus successful terminal result events to parseProviderOutput; it failed with claude emitted a non-object result.
2. Ran runLane against a fake grok models that exited 0 with You are using XAI_API_KEY. and exact grok-4.6; it performed two preflights, returned exit 77 / unauthenticated, and never launched the model.
3. Repeated on PR fix(pstack): support Codex setup and current CLI output #59 commit 60f1547: the Claude array parsed and the API-key availability response completed successfully.
4. On that candidate, changed preflight output to You are using XAI_API_KEY.\nmodel grok-4.6 is not supported; it incorrectly returned exit 0 / complete and created the model-start marker. Expected: exit 69 / unavailable-model, with no model launch.
5. bun test runner/parse-output.test.ts runner/run.test.ts exited successfully on both revisions, confirming current tests miss the reported main failures and PR fix(pstack): support Codex setup and current CLI output #59 misses the contradictory unsupported-model case. Successful installed /setup-pstack runs from both Codex and Claude surfaces remain required before merge.