Add Codex workflow modes, structured operations, and OAuth reconnect fixes

.gitignore

@@ -3,3 +3,4 @@ dist/
 releases/
 .env
 *.log
+WORKING/

README.md

@@ -98,6 +98,9 @@ DevSpace gives ChatGPT tools to:
 - discover local agent skills from your skill folders
 - show tool cards and optional change summaries in ChatGPT Apps-compatible hosts
 
+DevSpace also bundles a small set of built-in workflow and engineering skills in `skills/core/`.
+Their structure is inspired by [alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills), which is released under the MIT license.
+
 ## Mental Model
 
 DevSpace is remote access to selected local folders.

docs/chatgpt-coding-workflow.md

@@ -81,8 +81,10 @@ Skills are enabled by default for coding-agent workflows.
 
 DevSpace discovers skills from:
 
+- built-in DevSpace skills in `skills/core`
+- workspace-local skills in `skills/local`
+- workspace-installed skills in `skills/installed`
 - `DEVSPACE_AGENT_DIR`, which defaults to `~/.codex`
-- project `.pi/skills`
 - optional paths from `DEVSPACE_SKILL_PATHS`
 
 When `open_workspace` returns matching skills, the model should read the
@@ -95,6 +97,8 @@ Skill paths may be outside the workspace. DevSpace only permits reading:
 
 Set `DEVSPACE_SKILLS=0` to hide skills from workspace output.
 
+The built-in skill layout is inspired by [alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) under the MIT license, with DevSpace-specific adaptations for MCP workflow commands and local coding tasks.
+
 ## Tool Names
 
 Short names are the default:

docs/configuration.md

@@ -34,6 +34,7 @@ npx @waishnav/devspace config set publicBaseUrl https://devspace.example.com
 | `PORT` | Local port. Defaults to `7676`. |
 | `DEVSPACE_ALLOWED_ROOTS` | Comma-separated local roots that workspaces may open. |
 | `DEVSPACE_PUBLIC_BASE_URL` | Public origin for the server, without `/mcp`. |
+| `DEVSPACE_TUNNEL` | Optional automatic tunnel mode. Currently supports `cloudflare` when explicitly enabled. |
 | `DEVSPACE_ALLOWED_HOSTS` | Optional Host header allowlist override. |
 | `DEVSPACE_OAUTH_OWNER_TOKEN` | Owner password for OAuth approval. Must be at least 16 characters. |
 | `DEVSPACE_WORKTREE_ROOT` | Directory for managed Git worktrees. Defaults to `~/.devspace/worktrees`. |
@@ -49,6 +50,11 @@ DevSpace uses a single-user OAuth approval flow.
 | `DEVSPACE_OAUTH_REFRESH_TOKEN_TTL_SECONDS` | `2592000` |
 | `DEVSPACE_OAUTH_SCOPES` | `devspace` |
 | `DEVSPACE_OAUTH_ALLOWED_REDIRECT_HOSTS` | `chatgpt.com,localhost,127.0.0.1` |
+| `DEVSPACE_OAUTH_STATE_PATH` | `$DEVSPACE_STATE_DIR/oauth.json` |
+
+Registered OAuth clients and refresh token hashes are persisted in
+`$DEVSPACE_STATE_DIR/oauth.json` by default. Access tokens and authorization
+codes remain in memory only.
 
 MCP clients discover metadata from:
 
@@ -73,6 +79,30 @@ MCP clients discover metadata from:
 | `minimal` | Default. Disables dedicated search and list tools. Clients use the shell tool with `rg`, `grep`, `find`, `ls`, or `tree` for inspection. |
 | `full` | Enables dedicated `grep`, `glob`, and `ls` tools. |
 
+`DEVSPACE_SHELL_MODE` controls shell execution policy.
+
+| Value | Behavior |
+| --- | --- |
+| `full` | Default. Preserves the current shell behavior. |
+| `read-only` | Allows only single-command inspection workflows such as `rg`, `git status`, `find`, or `ls`. Blocks shell control operators and mutating commands. |
+| `off` | Disables shell execution entirely. |
+
+## Tunnel Modes
+
+DevSpace keeps the existing manual `publicBaseUrl` flow by default. Automatic
+Cloudflare quick tunnel mode is opt-in only.
+
+Enable it explicitly with one of:
+
+```bash
+npx @waishnav/devspace serve --tunnel
+DEVSPACE_TUNNEL=cloudflare npx @waishnav/devspace serve
+```
+
+Or set `"tunnel": "cloudflare"` in `~/.devspace/config.json`.
+
+Use `--no-tunnel` to override configured tunnel mode for one run.
+
 ## Widgets
 
 `DEVSPACE_WIDGETS` controls ChatGPT Apps iframe usage.

docs/gotchas.md

@@ -196,7 +196,9 @@ DEVSPACE_SKILLS=1 npx @waishnav/devspace serve
 DevSpace looks in:
 
 - `DEVSPACE_AGENT_DIR`, defaulting to `~/.codex`
-- project `.pi/skills`
+- `skills/local`
+- `skills/installed`
+- `skills/core`
 - `DEVSPACE_SKILL_PATHS`
 
 If a skill appears in `open_workspace`, the model must read that skill's

docs/setup.md

@@ -11,8 +11,8 @@ projects through DevSpace.
 - Bash, including Git Bash or WSL on Windows
 - a public HTTPS URL that forwards to the local DevSpace server
 
-DevSpace does not create the public tunnel for you. Use Cloudflare Tunnel,
-ngrok, Pinggy, Tailscale Funnel, or your own HTTPS reverse proxy.
+DevSpace does not create the public tunnel for you by default. Use Cloudflare
+Tunnel, ngrok, Pinggy, Tailscale Funnel, or your own HTTPS reverse proxy.
 
 ## Install And Configure
 
@@ -95,6 +95,22 @@ npx @waishnav/devspace config set publicBaseUrl https://devspace.example.com
 npx @waishnav/devspace serve
 ```
 
+If you explicitly want DevSpace to open a Cloudflare quick tunnel for a single
+run, opt in with:
+
+```bash
+npx @waishnav/devspace serve --tunnel
+```
+
+Or:
+
+```bash
+DEVSPACE_TUNNEL=cloudflare npx @waishnav/devspace serve
+```
+
+This mode requires an existing `cloudflared` binary and does not replace the
+default manual public URL workflow.
+
 ## Approve The Client
 
 When ChatGPT, Claude, or another MCP client connects, DevSpace shows an Owner