@aetherai/aether 0.0.7 → 0.0.9

package/dist/CLI/packages/core/src/qwen/aetherOAuth2.js

@@ -1,678 +0,0 @@
-/**
- * @license
- * Copyright 2025 Qwen
- * SPDX-License-Identifier: Apache-2.0
- */
-import crypto from 'crypto';
-import path from 'node:path';
-import { promises as fs } from 'node:fs';
-import * as os from 'os';
-import open from 'open';
-import { EventEmitter } from 'events';
-import { randomUUID } from 'node:crypto';
-import { formatFetchErrorForUser } from '../utils/fetch.js';
-import { createDebugLogger } from '../utils/debugLogger.js';
-import { SharedTokenManager, TokenManagerError, TokenError, } from './aetherSharedTokenManager.js';
-const debugLogger = createDebugLogger('AETHER_OAUTH');
-// OAuth Endpoints
-const AETHER_OAUTH_BASE_URL = 'https://chat.aether.dev';
-const AETHER_OAUTH_DEVICE_CODE_ENDPOINT = `${AETHER_OAUTH_BASE_URL}/api/v1/oauth2/device/code`;
-const AETHER_OAUTH_TOKEN_ENDPOINT = `${AETHER_OAUTH_BASE_URL}/api/v1/oauth2/token`;
-// OAuth Client Configuration
-const AETHER_OAUTH_CLIENT_ID = 'f0304373b74a44d2b584a3fb70ca9e56';
-const AETHER_OAUTH_SCOPE = 'openid profile email model.completion';
-const AETHER_OAUTH_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
-// File System Configuration
-const AETHER_DIR = '.aether';
-const AETHER_CREDENTIAL_FILENAME = 'oauth_creds.json';
-/**
- * PKCE (Proof Key for Code Exchange) utilities
- * Implements RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
- */
-/**
- * Generate a random code verifier for PKCE
- * @returns A random string of 43-128 characters
- */
-export function generateCodeVerifier() {
-    return crypto.randomBytes(32).toString('base64url');
-}
-/**
- * Generate a code challenge from a code verifier using SHA-256
- * @param codeVerifier The code verifier string
- * @returns The code challenge string
- */
-export function generateCodeChallenge(codeVerifier) {
-    const hash = crypto.createHash('sha256');
-    hash.update(codeVerifier);
-    return hash.digest('base64url');
-}
-/**
- * Generate PKCE code verifier and challenge pair
- * @returns Object containing code_verifier and code_challenge
- */
-export function generatePKCEPair() {
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = generateCodeChallenge(codeVerifier);
-    return { code_verifier: codeVerifier, code_challenge: codeChallenge };
-}
-/**
- * Convert object to URL-encoded form data
- * @param data The object to convert
- * @returns URL-encoded string
- */
-function objectToUrlEncoded(data) {
-    return Object.keys(data)
-        .map((key) => `${encodeURIComponent(key)}=${encodeURIComponent(data[key])}`)
-        .join('&');
-}
-/**
- * Custom error class to indicate that credentials should be cleared
- * This is thrown when a 400 error occurs during token refresh, indicating
- * that the refresh token is expired or invalid
- */
-export class CredentialsClearRequiredError extends Error {
-    originalError;
-    constructor(message, originalError) {
-        super(message);
-        this.originalError = originalError;
-        this.name = 'CredentialsClearRequiredError';
-    }
-}
-/**
- * Type guard to check if device authorization was successful
- */
-export function isDeviceAuthorizationSuccess(response) {
-    return 'device_code' in response;
-}
-/**
- * Type guard to check if device token response was successful
- */
-export function isDeviceTokenSuccess(response) {
-    return ('access_token' in response &&
-        response.access_token !== null &&
-        response.access_token !== undefined &&
-        typeof response.access_token === 'string' &&
-        response.access_token.length > 0);
-}
-/**
- * Type guard to check if device token response is pending
- */
-export function isDeviceTokenPending(response) {
-    return ('status' in response &&
-        response.status === 'pending');
-}
-/**
- * Type guard to check if response is an error
- */
-export function isErrorResponse(response) {
-    return 'error' in response;
-}
-/**
- * Aether OAuth2 client implementation
- */
-export class AetherOAuth2Client {
-    credentials = {};
-    sharedManager;
-    constructor() {
-        this.sharedManager = SharedTokenManager.getInstance();
-    }
-    setCredentials(credentials) {
-        this.credentials = credentials;
-    }
-    getCredentials() {
-        return this.credentials;
-    }
-    async getAccessToken() {
-        try {
-            // Always use shared manager for consistency - this prevents race conditions
-            // between local credential state and shared state
-            const credentials = await this.sharedManager.getValidCredentials(this);
-            return { token: credentials.access_token };
-        }
-        catch (error) {
-            debugLogger.warn('Failed to get access token from shared manager:', error);
-            // Don't use fallback to local credentials to prevent race conditions
-            // All token management should go through SharedTokenManager for consistency
-            // This ensures single source of truth and prevents cross-session issues
-            return { token: undefined };
-        }
-    }
-    async requestDeviceAuthorization(options) {
-        const bodyData = {
-            client_id: AETHER_OAUTH_CLIENT_ID,
-            scope: options.scope,
-            code_challenge: options.code_challenge,
-            code_challenge_method: options.code_challenge_method,
-        };
-        const response = await fetch(AETHER_OAUTH_DEVICE_CODE_ENDPOINT, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-                Accept: 'application/json',
-                'x-request-id': randomUUID(),
-            },
-            body: objectToUrlEncoded(bodyData),
-        });
-        if (!response.ok) {
-            const errorData = await response.text();
-            throw new Error(`Device authorization failed: ${response.status} ${response.statusText}. Response: ${errorData}`);
-        }
-        const result = (await response.json());
-        debugLogger.debug('Device authorization result:', result);
-        // Check if the response indicates success
-        if (!isDeviceAuthorizationSuccess(result)) {
-            const errorData = result;
-            throw new Error(`Device authorization failed: ${errorData?.error || 'Unknown error'} - ${errorData?.error_description || 'No details provided'}`);
-        }
-        return result;
-    }
-    async pollDeviceToken(options) {
-        const bodyData = {
-            grant_type: AETHER_OAUTH_GRANT_TYPE,
-            client_id: AETHER_OAUTH_CLIENT_ID,
-            device_code: options.device_code,
-            code_verifier: options.code_verifier,
-        };
-        const response = await fetch(AETHER_OAUTH_TOKEN_ENDPOINT, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-                Accept: 'application/json',
-            },
-            body: objectToUrlEncoded(bodyData),
-        });
-        if (!response.ok) {
-            // Read response body as text first (can only be read once)
-            const responseText = await response.text();
-            // Try to parse as JSON to check for OAuth RFC 8628 standard errors
-            let errorData = null;
-            try {
-                errorData = JSON.parse(responseText);
-            }
-            catch (_parseError) {
-                // If JSON parsing fails, use text response
-                const error = new Error(`Device token poll failed: ${response.status} ${response.statusText}. Response: ${responseText}`);
-                error.status = response.status;
-                throw error;
-            }
-            // According to OAuth RFC 8628, handle standard polling responses
-            if (response.status === 400 &&
-                errorData.error === 'authorization_pending') {
-                // User has not yet approved the authorization request. Continue polling.
-                return { status: 'pending' };
-            }
-            if (response.status === 429 && errorData.error === 'slow_down') {
-                // Client is polling too frequently. Return pending with slowDown flag.
-                return {
-                    status: 'pending',
-                    slowDown: true,
-                };
-            }
-            // Handle other 400 errors (access_denied, expired_token, etc.) as real errors
-            // For other errors, throw with proper error information
-            const error = new Error(`Device token poll failed: ${errorData.error || 'Unknown error'} - ${errorData.error_description}`);
-            error.status = response.status;
-            throw error;
-        }
-        return (await response.json());
-    }
-    async refreshAccessToken() {
-        if (!this.credentials.refresh_token) {
-            throw new Error('No refresh token available');
-        }
-        const bodyData = {
-            grant_type: 'refresh_token',
-            refresh_token: this.credentials.refresh_token,
-            client_id: AETHER_OAUTH_CLIENT_ID,
-        };
-        const response = await fetch(AETHER_OAUTH_TOKEN_ENDPOINT, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-                Accept: 'application/json',
-            },
-            body: objectToUrlEncoded(bodyData),
-        });
-        if (!response.ok) {
-            const errorData = await response.text();
-            // Handle 400 errors which might indicate refresh token expiry
-            if (response.status === 400) {
-                await clearAetherCredentials();
-                throw new CredentialsClearRequiredError("Refresh token expired or invalid. Please use '/auth' to re-authenticate.", { status: response.status, response: errorData });
-            }
-            throw new Error(`Token refresh failed: ${response.status} ${response.statusText}. Response: ${errorData}`);
-        }
-        const responseData = (await response.json());
-        // Check if the response indicates success
-        if (isErrorResponse(responseData)) {
-            const errorData = responseData;
-            throw new Error(`Token refresh failed: ${errorData?.error || 'Unknown error'} - ${errorData?.error_description || 'No details provided'}`);
-        }
-        // Handle successful response
-        const tokenData = responseData;
-        const tokens = {
-            access_token: tokenData.access_token,
-            token_type: tokenData.token_type,
-            // Use new refresh token if provided, otherwise preserve existing one
-            refresh_token: tokenData.refresh_token || this.credentials.refresh_token,
-            resource_url: tokenData.resource_url, // Include resource_url if provided
-            expiry_date: Date.now() + tokenData.expires_in * 1000,
-        };
-        this.setCredentials(tokens);
-        // Note: File caching is now handled by SharedTokenManager
-        // to prevent cross-session token invalidation issues
-        return responseData;
-    }
-}
-export var AetherOAuth2Event;
-(function (AetherOAuth2Event) {
-    AetherOAuth2Event["AuthUri"] = "auth-uri";
-    AetherOAuth2Event["AuthProgress"] = "auth-progress";
-    AetherOAuth2Event["AuthCancel"] = "auth-cancel";
-})(AetherOAuth2Event || (AetherOAuth2Event = {}));
-export const aetherOAuth2Event = AetherOAuth2Event;
-/**
- * Global event emitter instance for aetherOAuth2 authentication events
- */
-export const aetherOAuth2Events = new EventEmitter();
-export async function getaetherOAuthClient(config, options) {
-    const client = new AetherOAuth2Client();
-    // Use shared token manager to get valid credentials with cross-session synchronization
-    const sharedManager = SharedTokenManager.getInstance();
-    try {
-        // Try to get valid credentials from shared cache first
-        const credentials = await sharedManager.getValidCredentials(client);
-        client.setCredentials(credentials);
-        return client;
-    }
-    catch (error) {
-        // Handle specific token manager errors
-        if (error instanceof TokenManagerError) {
-            switch (error.type) {
-                case TokenError.NO_REFRESH_TOKEN:
-                    debugLogger.debug('No refresh token available, proceeding with device flow');
-                    break;
-                case TokenError.REFRESH_FAILED:
-                    debugLogger.debug('Token refresh failed, proceeding with device flow');
-                    break;
-                case TokenError.NETWORK_ERROR:
-                    debugLogger.warn('Network error during token refresh, trying device flow');
-                    break;
-                default:
-                    debugLogger.warn('Token manager error:', error.message);
-            }
-        }
-        if (options?.requireCachedCredentials) {
-            throw new Error('Aether OAuth credentials expired. Please use /auth to re-authenticate with aether-oauth.');
-        }
-        // If we couldn't obtain valid credentials via SharedTokenManager, fall back to
-        // interactive device authorization (unless explicitly forbidden above).
-        const result = await authWithQwenDeviceFlow(client, config);
-        if (!result.success) {
-            // Only emit timeout event if the failure reason is actually timeout
-            // Other error types (401, 429, etc.) have already emitted their specific events
-            if (result.reason === 'timeout') {
-                aetherOAuth2Events.emit(AetherOAuth2Event.AuthProgress, 'timeout', 'Authentication timed out. Please try again or select a different authentication method.');
-            }
-            // Use detailed error message if available, otherwise use default based on reason
-            const errorMessage = result.message ||
-                (() => {
-                    switch (result.reason) {
-                        case 'timeout':
-                            return 'Aether OAuth authentication timed out';
-                        case 'cancelled':
-                            return 'Aether OAuth authentication was cancelled by user';
-                        case 'rate_limit':
-                            return 'Too many request for Aether OAuth authentication, please try again later.';
-                        case 'error':
-                        default:
-                            return 'Aether OAuth authentication failed';
-                    }
-                })();
-            throw new Error(errorMessage);
-        }
-        return client;
-    }
-}
-/**
- * Displays a formatted box with OAuth device authorization URL.
- * Uses process.stderr.write() to ensure the auth URL is always visible to users,
- * especially in non-interactive mode. Using stderr prevents corruption of
- * structured JSON output (which goes to stdout) and follows the standard Unix
- * convention of user-facing messages to stderr.
- */
-function showFallbackMessage(verificationUriComplete) {
-    const title = 'Aether OAuth Device Authorization';
-    const url = verificationUriComplete;
-    const minWidth = 70;
-    const maxWidth = 80;
-    const boxWidth = Math.min(Math.max(title.length + 4, minWidth), maxWidth);
-    // Calculate the width needed for the box (account for padding)
-    const contentWidth = boxWidth - 4; // Subtract 2 spaces and 2 border chars
-    // Helper to wrap text to fit within box width
-    const wrapText = (text, width) => {
-        // For URLs, break at any character if too long
-        if (text.startsWith('http://') || text.startsWith('https://')) {
-            const lines = [];
-            for (let i = 0; i < text.length; i += width) {
-                lines.push(text.substring(i, i + width));
-            }
-            return lines;
-        }
-        // For regular text, break at word boundaries
-        const words = text.split(' ');
-        const lines = [];
-        let currentLine = '';
-        for (const word of words) {
-            if (currentLine.length + word.length + 1 <= width) {
-                currentLine += (currentLine ? ' ' : '') + word;
-            }
-            else {
-                if (currentLine) {
-                    lines.push(currentLine);
-                }
-                currentLine = word.length > width ? word.substring(0, width) : word;
-            }
-        }
-        if (currentLine) {
-            lines.push(currentLine);
-        }
-        return lines;
-    };
-    // Build the box borders with title centered in top border
-    // Format: +--- Title ---+
-    const titleWithSpaces = ' ' + title + ' ';
-    const totalDashes = boxWidth - 2 - titleWithSpaces.length; // Subtract corners and title
-    const leftDashes = Math.floor(totalDashes / 2);
-    const rightDashes = totalDashes - leftDashes;
-    const topBorder = '+' +
-        '-'.repeat(leftDashes) +
-        titleWithSpaces +
-        '-'.repeat(rightDashes) +
-        '+';
-    const emptyLine = '|' + ' '.repeat(boxWidth - 2) + '|';
-    const bottomBorder = '+' + '-'.repeat(boxWidth - 2) + '+';
-    // Build content lines
-    const instructionLines = wrapText('Please visit the following URL in your browser to authorize:', contentWidth);
-    const urlLines = wrapText(url, contentWidth);
-    const waitingLine = 'Waiting for authorization to complete...';
-    // Write the box
-    process.stderr.write('\n' + topBorder + '\n');
-    process.stderr.write(emptyLine + '\n');
-    // Write instructions
-    for (const line of instructionLines) {
-        process.stderr.write('| ' + line + ' '.repeat(contentWidth - line.length) + ' |\n');
-    }
-    process.stderr.write(emptyLine + '\n');
-    // Write URL
-    for (const line of urlLines) {
-        process.stderr.write('| ' + line + ' '.repeat(contentWidth - line.length) + ' |\n');
-    }
-    process.stderr.write(emptyLine + '\n');
-    // Write waiting message
-    process.stderr.write('| ' + waitingLine + ' '.repeat(contentWidth - waitingLine.length) + ' |\n');
-    process.stderr.write(emptyLine + '\n');
-    process.stderr.write(bottomBorder + '\n\n');
-}
-async function authWithQwenDeviceFlow(client, config) {
-    let isCancelled = false;
-    // Set up cancellation listener
-    const cancelHandler = () => {
-        isCancelled = true;
-    };
-    aetherOAuth2Events.once(AetherOAuth2Event.AuthCancel, cancelHandler);
-    // Helper to check cancellation and return appropriate result
-    const checkCancellation = () => {
-        if (!isCancelled) {
-            return null;
-        }
-        const message = 'Authentication cancelled by user.';
-        debugLogger.debug('\n' + message);
-        aetherOAuth2Events.emit(AetherOAuth2Event.AuthProgress, 'error', message);
-        return { success: false, reason: 'cancelled', message };
-    };
-    // Helper to emit auth progress events
-    const emitAuthProgress = (status, message) => {
-        aetherOAuth2Events.emit(AetherOAuth2Event.AuthProgress, status, message);
-    };
-    // Helper to handle browser launch with error handling
-    const launchBrowser = async (url) => {
-        try {
-            const childProcess = await open(url);
-            // IMPORTANT: Attach an error handler to the returned child process.
-            // Without this, if `open` fails to spawn a process (e.g., `xdg-open` is not found
-            // in a minimal Docker container), it will emit an unhandled 'error' event,
-            // causing the entire Node.js process to crash.
-            if (childProcess) {
-                childProcess.on('error', (err) => {
-                    debugLogger.debug('Browser launch failed:', err.message || err);
-                });
-            }
-        }
-        catch (err) {
-            debugLogger.debug('Failed to open browser:', err instanceof Error ? err.message : 'Unknown error');
-        }
-    };
-    try {
-        // Generate PKCE code verifier and challenge
-        const { code_verifier, code_challenge } = generatePKCEPair();
-        // Request device authorization
-        const deviceAuth = await client.requestDeviceAuthorization({
-            scope: AETHER_OAUTH_SCOPE,
-            code_challenge,
-            code_challenge_method: 'S256',
-        });
-        // Ensure we have a successful authorization response
-        if (!isDeviceAuthorizationSuccess(deviceAuth)) {
-            const errorData = deviceAuth;
-            throw new Error(`Device authorization failed: ${errorData?.error || 'Unknown error'} - ${errorData?.error_description || 'No details provided'}`);
-        }
-        // Emit device authorization event for UI integration immediately
-        aetherOAuth2Events.emit(AetherOAuth2Event.AuthUri, deviceAuth);
-        if (config.isBrowserLaunchSuppressed() || !config.isInteractive()) {
-            showFallbackMessage(deviceAuth.verification_uri_complete);
-        }
-        // Try to open browser if not suppressed
-        if (!config.isBrowserLaunchSuppressed()) {
-            await launchBrowser(deviceAuth.verification_uri_complete);
-        }
-        emitAuthProgress('polling', 'Waiting for authorization...');
-        debugLogger.debug('Waiting for authorization...\n');
-        // Poll for the token
-        let pollInterval = 2000; // 2 seconds, can be increased if slow_down is received
-        const maxAttempts = Math.ceil(deviceAuth.expires_in / (pollInterval / 1000));
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            // Check if authentication was cancelled
-            const cancellationResult = checkCancellation();
-            if (cancellationResult) {
-                return cancellationResult;
-            }
-            try {
-                debugLogger.debug('polling for token...');
-                const tokenResponse = await client.pollDeviceToken({
-                    device_code: deviceAuth.device_code,
-                    code_verifier,
-                });
-                // Check if the response is successful and contains token data
-                if (isDeviceTokenSuccess(tokenResponse)) {
-                    const tokenData = tokenResponse;
-                    // Convert to AetherCredentials format
-                    const credentials = {
-                        access_token: tokenData.access_token, // Safe to assert as non-null due to isDeviceTokenSuccess check
-                        refresh_token: tokenData.refresh_token || undefined,
-                        token_type: tokenData.token_type,
-                        resource_url: tokenData.resource_url,
-                        expiry_date: tokenData.expires_in
-                            ? Date.now() + tokenData.expires_in * 1000
-                            : undefined,
-                    };
-                    client.setCredentials(credentials);
-                    // Cache the new tokens
-                    await cacheAetherCredentials(credentials);
-                    // IMPORTANT:
-                    // SharedTokenManager maintains an in-memory cache and throttles file checks.
-                    // If we only write the creds file here, a subsequent `getaetherOAuthClient()`
-                    // call in the same process (within the throttle window) may not re-read the
-                    // updated file and could incorrectly re-trigger device auth.
-                    // Clearing the cache forces the next call to reload from disk.
-                    try {
-                        SharedTokenManager.getInstance().clearCache();
-                    }
-                    catch {
-                        // In unit tests we sometimes mock SharedTokenManager.getInstance() with a
-                        // minimal stub; cache invalidation is best-effort and should not break auth.
-                    }
-                    emitAuthProgress('success', 'Authentication successful! Access token obtained.');
-                    debugLogger.debug('Authentication successful! Access token obtained.');
-                    return { success: true };
-                }
-                // Check if the response is pending
-                if (isDeviceTokenPending(tokenResponse)) {
-                    const pendingData = tokenResponse;
-                    // Handle slow_down error by increasing poll interval
-                    if (pendingData.slowDown) {
-                        pollInterval = Math.min(pollInterval * 1.5, 10000); // Increase by 50%, max 10 seconds
-                        debugLogger.debug(`\nServer requested to slow down, increasing poll interval to ${pollInterval}ms'`);
-                    }
-                    else {
-                        pollInterval = 2000; // Reset to default interval
-                    }
-                    emitAuthProgress('polling', `Polling... (attempt ${attempt + 1}/${maxAttempts})`);
-                    // Wait with cancellation check every 100ms
-                    await new Promise((resolve) => {
-                        const checkInterval = 100; // Check every 100ms
-                        let elapsedTime = 0;
-                        const intervalId = setInterval(() => {
-                            elapsedTime += checkInterval;
-                            // Check for cancellation during wait
-                            if (isCancelled) {
-                                clearInterval(intervalId);
-                                resolve();
-                                return;
-                            }
-                            // Complete wait when interval is reached
-                            if (elapsedTime >= pollInterval) {
-                                clearInterval(intervalId);
-                                resolve();
-                                return;
-                            }
-                        }, checkInterval);
-                    });
-                    // Check for cancellation after waiting
-                    const cancellationResult = checkCancellation();
-                    if (cancellationResult) {
-                        return cancellationResult;
-                    }
-                    continue;
-                }
-                // Handle error response
-                if (isErrorResponse(tokenResponse)) {
-                    const errorData = tokenResponse;
-                    throw new Error(`Token polling failed: ${errorData?.error || 'Unknown error'} - ${errorData?.error_description || 'No details provided'}`);
-                }
-            }
-            catch (error) {
-                // Extract error information
-                const errorMessage = error instanceof Error ? error.message : String(error);
-                const statusCode = error instanceof Error
-                    ? error.status
-                    : null;
-                // Helper function to handle error and stop polling
-                const handleError = (reason, message, eventType = 'error') => {
-                    emitAuthProgress(eventType, message);
-                    return { success: false, reason, message };
-                };
-                // Check for cancellation first
-                const cancellationResult = checkCancellation();
-                if (cancellationResult) {
-                    return cancellationResult;
-                }
-                // Handle credential caching failures - stop polling immediately
-                if (errorMessage.includes('Failed to cache credentials')) {
-                    return handleError('error', errorMessage);
-                }
-                // Handle 401 Unauthorized - device code expired or invalid
-                if (errorMessage.includes('401') || statusCode === 401) {
-                    return handleError('error', 'Device code expired or invalid, please restart the authorization process.');
-                }
-                // Handle 429 Too Many Requests - rate limiting
-                if (errorMessage.includes('429') || statusCode === 429) {
-                    return handleError('rate_limit', 'Too many requests. The server is rate limiting our requests. Please select a different authentication method or try again later.', 'rate_limit');
-                }
-                const message = `Error polling for token: ${errorMessage}`;
-                emitAuthProgress('error', message);
-                await new Promise((resolve) => setTimeout(resolve, pollInterval));
-            }
-        }
-        const timeoutMessage = 'Authorization timeout, please restart the process.';
-        emitAuthProgress('timeout', timeoutMessage);
-        return { success: false, reason: 'timeout', message: timeoutMessage };
-    }
-    catch (error) {
-        const fullErrorMessage = formatFetchErrorForUser(error, {
-            url: AETHER_OAUTH_BASE_URL,
-        });
-        const message = `Device authorization flow failed: ${fullErrorMessage}`;
-        emitAuthProgress('error', message);
-        return { success: false, reason: 'error', message };
-    }
-    finally {
-        // Clean up event listener
-        aetherOAuth2Events.off(AetherOAuth2Event.AuthCancel, cancelHandler);
-    }
-}
-async function cacheAetherCredentials(credentials) {
-    const filePath = getQwenCachedCredentialPath();
-    try {
-        await fs.mkdir(path.dirname(filePath), { recursive: true });
-        const credString = JSON.stringify(credentials, null, 2);
-        await fs.writeFile(filePath, credString);
-    }
-    catch (error) {
-        // Handle file system errors (e.g., EACCES permission denied)
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        const errorCode = error instanceof Error && 'code' in error
-            ? error.code
-            : undefined;
-        if (errorCode === 'EACCES') {
-            throw new Error(`Failed to cache credentials: Permission denied (EACCES). Current user has no permission to access \`${filePath}\`. Please check permissions.`);
-        }
-        // Throw error for other file system failures
-        throw new Error(`Failed to cache credentials: error when creating folder \`${path.dirname(filePath)}\` and writing to \`${filePath}\`. ${errorMessage}. Please check permissions.`);
-    }
-}
-/**
- * Clear cached Qwen credentials from disk
- * This is useful when credentials have expired or need to be reset
- */
-export async function clearAetherCredentials() {
-    try {
-        const filePath = getQwenCachedCredentialPath();
-        await fs.unlink(filePath);
-        debugLogger.debug('Cached Qwen credentials cleared successfully.');
-    }
-    catch (error) {
-        // If file doesn't exist or can't be deleted, we consider it cleared
-        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
-            // File doesn't exist, already cleared
-            return;
-        }
-        // Log other errors but don't throw - clearing credentials should be non-critical
-        debugLogger.warn('Warning: Failed to clear cached Qwen credentials:', error);
-    }
-    finally {
-        // Also clear SharedTokenManager in-memory cache to prevent stale credentials
-        // from being reused within the same process after the file is removed.
-        try {
-            SharedTokenManager.getInstance().clearCache();
-        }
-        catch {
-            // Best-effort; don't fail credential clearing if SharedTokenManager is mocked.
-        }
-    }
-}
-function getQwenCachedCredentialPath() {
-    return path.join(os.homedir(), AETHER_DIR, AETHER_CREDENTIAL_FILENAME);
-}
-export const clearCachedCredentialFile = clearAetherCredentials;
-//# sourceMappingURL=aetherOAuth2.js.map