@agentdocumentformat/cli 0.7.8 → 0.8.0

package/dist/chunks/{chunk-XYV3VCIX.mjs → chunk-JZFONJSL.mjs}

@@ -4,14 +4,39 @@ import { dirname as __adfDirname } from 'node:path';
 const require = __adfCreateRequire(import.meta.url);
 const __filename = __adfFileURLToPath(import.meta.url);
 const __dirname = __adfDirname(__filename);
-import {
-  require_token_error
-} from "./chunk-KWFOS5WC.mjs";
 import {
   __commonJS,
   __require
 } from "./chunk-M2RX3S2T.mjs";
 
+// node_modules/@vercel/oidc/dist/token-error.js
+var require_token_error = __commonJS({
+  "node_modules/@vercel/oidc/dist/token-error.js"(exports, module) {
+    "use strict";
+    var __defProp = Object.defineProperty, __getOwnPropDesc = Object.getOwnPropertyDescriptor, __getOwnPropNames = Object.getOwnPropertyNames, __hasOwnProp = Object.prototype.hasOwnProperty, __export = (target, all) => {
+      for (var name in all)
+        __defProp(target, name, { get: all[name], enumerable: !0 });
+    }, __copyProps = (to, from, except, desc) => {
+      if (from && typeof from == "object" || typeof from == "function")
+        for (let key of __getOwnPropNames(from))
+          !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+      return to;
+    }, __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: !0 }), mod), token_error_exports = {};
+    __export(token_error_exports, {
+      VercelOidcTokenError: () => VercelOidcTokenError
+    });
+    module.exports = __toCommonJS(token_error_exports);
+    var VercelOidcTokenError = class extends Error {
+      constructor(message, cause) {
+        super(message), this.name = "VercelOidcTokenError", this.cause = cause;
+      }
+      toString() {
+        return this.cause ? `${this.name}: ${this.message}: ${this.cause}` : `${this.name}: ${this.message}`;
+      }
+    };
+  }
+});
+
 // node_modules/@vercel/oidc/dist/token-io.js
 var require_token_io = __commonJS({
   "node_modules/@vercel/oidc/dist/token-io.js"(exports, module) {
@@ -121,13 +146,13 @@ var require_auth_config = __commonJS({
       let authPath = getAuthConfigPath(), authDir = path.dirname(authPath);
       fs.existsSync(authDir) || fs.mkdirSync(authDir, { mode: 504, recursive: !0 }), fs.writeFileSync(authPath, JSON.stringify(config, null, 2), { mode: 384 });
     }
-    function isValidAccessToken(authConfig) {
+    function isValidAccessToken(authConfig, expirationBufferMs = 0) {
       if (!authConfig.token)
         return !1;
       if (typeof authConfig.expiresAt != "number")
         return !0;
-      let nowInSeconds = Math.floor(Date.now() / 1e3);
-      return authConfig.expiresAt >= nowInSeconds;
+      let nowInSeconds = Math.floor(Date.now() / 1e3), bufferInSeconds = expirationBufferMs / 1e3;
+      return authConfig.expiresAt >= nowInSeconds + bufferInSeconds;
     }
   }
 });
@@ -191,6 +216,38 @@ var require_oauth = __commonJS({
   }
 });
 
+// node_modules/@vercel/oidc/dist/auth-errors.js
+var require_auth_errors = __commonJS({
+  "node_modules/@vercel/oidc/dist/auth-errors.js"(exports, module) {
+    "use strict";
+    var __defProp = Object.defineProperty, __getOwnPropDesc = Object.getOwnPropertyDescriptor, __getOwnPropNames = Object.getOwnPropertyNames, __hasOwnProp = Object.prototype.hasOwnProperty, __export = (target, all) => {
+      for (var name in all)
+        __defProp(target, name, { get: all[name], enumerable: !0 });
+    }, __copyProps = (to, from, except, desc) => {
+      if (from && typeof from == "object" || typeof from == "function")
+        for (let key of __getOwnPropNames(from))
+          !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+      return to;
+    }, __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: !0 }), mod), auth_errors_exports = {};
+    __export(auth_errors_exports, {
+      AccessTokenMissingError: () => AccessTokenMissingError,
+      RefreshAccessTokenFailedError: () => RefreshAccessTokenFailedError
+    });
+    module.exports = __toCommonJS(auth_errors_exports);
+    var AccessTokenMissingError = class extends Error {
+      constructor() {
+        super(
+          "No authentication found. Please log in with the Vercel CLI (vercel login)."
+        ), this.name = "AccessTokenMissingError";
+      }
+    }, RefreshAccessTokenFailedError = class extends Error {
+      constructor(cause) {
+        super("Failed to refresh authentication token.", { cause }), this.name = "RefreshAccessTokenFailedError";
+      }
+    };
+  }
+});
+
 // node_modules/@vercel/oidc/dist/token-util.js
 var require_token_util = __commonJS({
   "node_modules/@vercel/oidc/dist/token-util.js"(exports, module) {
@@ -214,40 +271,40 @@ var require_token_util = __commonJS({
       assertVercelOidcTokenResponse: () => assertVercelOidcTokenResponse,
       findProjectInfo: () => findProjectInfo,
       getTokenPayload: () => getTokenPayload,
-      getVercelCliToken: () => getVercelCliToken,
       getVercelDataDir: () => getVercelDataDir,
       getVercelOidcToken: () => getVercelOidcToken,
+      getVercelToken: () => getVercelToken,
       isExpired: () => isExpired,
       loadToken: () => loadToken,
       saveToken: () => saveToken
     });
     module.exports = __toCommonJS(token_util_exports);
-    var path = __toESM(__require("path")), fs = __toESM(__require("fs")), import_token_error = require_token_error(), import_token_io = require_token_io(), import_auth_config = require_auth_config(), import_oauth = require_oauth();
+    var path = __toESM(__require("path")), fs = __toESM(__require("fs")), import_token_error = require_token_error(), import_token_io = require_token_io(), import_auth_config = require_auth_config(), import_oauth = require_oauth(), import_auth_errors = require_auth_errors();
     function getVercelDataDir() {
       let vercelFolder = "com.vercel.cli", dataDir = (0, import_token_io.getUserDataDir)();
       return dataDir ? path.join(dataDir, vercelFolder) : null;
     }
-    async function getVercelCliToken() {
+    async function getVercelToken(options) {
       let authConfig = (0, import_auth_config.readAuthConfig)();
-      if (!authConfig)
-        return null;
-      if ((0, import_auth_config.isValidAccessToken)(authConfig))
-        return authConfig.token || null;
+      if (!authConfig?.token)
+        throw new import_auth_errors.AccessTokenMissingError();
+      if ((0, import_auth_config.isValidAccessToken)(authConfig, options?.expirationBufferMs))
+        return authConfig.token;
       if (!authConfig.refreshToken)
-        return (0, import_auth_config.writeAuthConfig)({}), null;
+        throw (0, import_auth_config.writeAuthConfig)({}), new import_auth_errors.RefreshAccessTokenFailedError("No refresh token available");
       try {
         let tokenResponse = await (0, import_oauth.refreshTokenRequest)({
           refresh_token: authConfig.refreshToken
         }), [tokensError, tokens] = await (0, import_oauth.processTokenResponse)(tokenResponse);
         if (tokensError || !tokens)
-          return (0, import_auth_config.writeAuthConfig)({}), null;
+          throw (0, import_auth_config.writeAuthConfig)({}), new import_auth_errors.RefreshAccessTokenFailedError(tokensError);
         let updatedConfig = {
           token: tokens.access_token,
           expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
         };
-        return tokens.refresh_token && (updatedConfig.refreshToken = tokens.refresh_token), (0, import_auth_config.writeAuthConfig)(updatedConfig), updatedConfig.token ?? null;
-      } catch {
-        return (0, import_auth_config.writeAuthConfig)({}), null;
+        return tokens.refresh_token && (updatedConfig.refreshToken = tokens.refresh_token), (0, import_auth_config.writeAuthConfig)(updatedConfig), updatedConfig.token;
+      } catch (error) {
+        throw (0, import_auth_config.writeAuthConfig)({}), error instanceof import_auth_errors.AccessTokenMissingError || error instanceof import_auth_errors.RefreshAccessTokenFailedError ? error : new import_auth_errors.RefreshAccessTokenFailedError(error);
       }
     }
     async function getVercelOidcToken(authToken, projectId, teamId) {
@@ -325,12 +382,14 @@ var require_token_util = __commonJS({
       );
       return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
     }
-    function isExpired(token) {
-      return token.exp * 1e3 < Date.now();
+    function isExpired(token, bufferMs = 0) {
+      return token.exp * 1e3 < Date.now() + bufferMs;
     }
   }
 });
 
 export {
+  require_token_error,
+  require_auth_errors,
   require_token_util
 };

package/dist/chunks/chunk-KDDVQKCG.mjs

@@ -0,0 +1,65 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __commonJS
+} from "./chunk-M2RX3S2T.mjs";
+
+// node_modules/fast-deep-equal/es6/index.js
+var require_es6 = __commonJS({
+  "node_modules/fast-deep-equal/es6/index.js"(exports, module) {
+    "use strict";
+    module.exports = function equal(a, b) {
+      if (a === b) return !0;
+      if (a && b && typeof a == "object" && typeof b == "object") {
+        if (a.constructor !== b.constructor) return !1;
+        var length, i, keys;
+        if (Array.isArray(a)) {
+          if (length = a.length, length != b.length) return !1;
+          for (i = length; i-- !== 0; )
+            if (!equal(a[i], b[i])) return !1;
+          return !0;
+        }
+        if (a instanceof Map && b instanceof Map) {
+          if (a.size !== b.size) return !1;
+          for (i of a.entries())
+            if (!b.has(i[0])) return !1;
+          for (i of a.entries())
+            if (!equal(i[1], b.get(i[0]))) return !1;
+          return !0;
+        }
+        if (a instanceof Set && b instanceof Set) {
+          if (a.size !== b.size) return !1;
+          for (i of a.entries())
+            if (!b.has(i[0])) return !1;
+          return !0;
+        }
+        if (ArrayBuffer.isView(a) && ArrayBuffer.isView(b)) {
+          if (length = a.length, length != b.length) return !1;
+          for (i = length; i-- !== 0; )
+            if (a[i] !== b[i]) return !1;
+          return !0;
+        }
+        if (a.constructor === RegExp) return a.source === b.source && a.flags === b.flags;
+        if (a.valueOf !== Object.prototype.valueOf) return a.valueOf() === b.valueOf();
+        if (a.toString !== Object.prototype.toString) return a.toString() === b.toString();
+        if (keys = Object.keys(a), length = keys.length, length !== Object.keys(b).length) return !1;
+        for (i = length; i-- !== 0; )
+          if (!Object.prototype.hasOwnProperty.call(b, keys[i])) return !1;
+        for (i = length; i-- !== 0; ) {
+          var key = keys[i];
+          if (!equal(a[key], b[key])) return !1;
+        }
+        return !0;
+      }
+      return a !== a && b !== b;
+    };
+  }
+});
+
+export {
+  require_es6
+};

package/dist/chunks/chunk-KRPKWOMB.mjs

@@ -0,0 +1,290 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  startCallbackServer
+} from "./chunk-2NAP2ZF7.mjs";
+import {
+  createSubscriptionTokenStore
+} from "./chunk-C2S64Y6F.mjs";
+import {
+  __require
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/main/providers/chatgpt-subscription/auth-manager.ts
+import crypto from "crypto";
+
+// src/main/providers/chatgpt-subscription/token-store.ts
+var store = createSubscriptionTokenStore("chatgpt-subscription");
+function readTokens() {
+  return store.readTokens();
+}
+function writeTokens(tokens) {
+  store.writeTokens(tokens);
+}
+function clearTokens() {
+  store.clearTokens();
+}
+function noteSignIn(accountId) {
+  store.signedIn(accountId);
+}
+
+// src/main/providers/chatgpt-subscription/auth-manager.ts
+var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", AUTH_URL = "https://auth.openai.com/oauth/authorize", TOKEN_URL = "https://auth.openai.com/oauth/token", SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke", REFRESH_BUFFER_MS = 300 * 1e3, RELAY_FLOW_TTL_MS = 600 * 1e3;
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateCodeVerifier() {
+  let bytes = crypto.getRandomValues(new Uint8Array(64));
+  return base64url(Buffer.from(bytes));
+}
+function generateCodeChallenge(verifier) {
+  let hash = crypto.createHash("sha256").update(verifier).digest();
+  return base64url(hash);
+}
+function generateState() {
+  return base64url(Buffer.from(crypto.getRandomValues(new Uint8Array(32))));
+}
+function decodeJwtPayload(token) {
+  let parts = token.split(".");
+  if (parts.length < 2) return {};
+  try {
+    let payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+    return JSON.parse(payload);
+  } catch {
+    return {};
+  }
+}
+function chatgptAccountIdFromJwt(token) {
+  if (!token) return "";
+  let claims = decodeJwtPayload(token), auth = claims["https://api.openai.com/auth"], id = (auth && typeof auth == "object" ? auth.chatgpt_account_id : void 0) ?? claims.chatgpt_account_id;
+  return typeof id == "string" ? id : "";
+}
+async function openExternal(url) {
+  try {
+    let electron = __require("electron");
+    if (electron.shell?.openExternal) {
+      await electron.shell.openExternal(url);
+      return;
+    }
+  } catch {
+  }
+  console.log(`[ChatGPT Auth] Open this URL to sign in: ${url}`);
+}
+function assertLoopbackRedirect(redirectUri) {
+  let parsed;
+  try {
+    parsed = new URL(redirectUri);
+  } catch {
+    throw new Error(`Invalid redirectUri: ${redirectUri}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    throw new Error("redirectUri must be an http(s) URL");
+  if (!["localhost", "127.0.0.1", "[::1]", "::1"].includes(parsed.hostname))
+    throw new Error("redirectUri must target localhost \u2014 the OAuth callback runs on the machine with the browser");
+}
+var ChatGptAuthManager = class {
+  refreshPromise = null;
+  cachedTokens = null;
+  email;
+  activeAuthFlow = null;
+  relayFlows = /* @__PURE__ */ new Map();
+  constructor() {
+    this.syncFromDisk();
+  }
+  /**
+   * Re-read the token file, picking up writes from other processes.
+   *
+   * Each surface has its own file (see subscription-token-store), but several
+   * processes can share one — e.g. an installed and a dev Studio, or a CLI
+   * next to its daemon — and OpenAI rotates the refresh token on every
+   * refresh, so acting on a cached copy can invalidate a sibling's session. Always reading is what prevents that; the file is
+   * well under a kilobyte and this runs once per LLM request.
+   */
+  syncFromDisk() {
+    let tokens = readTokens();
+    return tokens?.access_token !== this.cachedTokens?.access_token && (this.email = void 0), this.cachedTokens = tokens, tokens;
+  }
+  persist(tokens) {
+    writeTokens(tokens), this.cachedTokens = tokens;
+  }
+  async startAuthFlow() {
+    await (await this.startAuthFlowDetached()).completion;
+  }
+  async startAuthFlowDetached() {
+    if (this.activeAuthFlow) return this.activeAuthFlow;
+    let codeVerifier = generateCodeVerifier(), codeChallenge = generateCodeChallenge(codeVerifier), state = generateState(), server = await startCallbackServer(), redirectUri = `http://localhost:${server.port}/auth/callback`, params = new URLSearchParams({
+      client_id: CLIENT_ID,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      state,
+      scope: SCOPE,
+      id_token_add_organizations: "true",
+      codex_cli_simplified_flow: "true",
+      originator: "adf_studio"
+    }), authUrl = `${AUTH_URL}?${params.toString()}`;
+    await openExternal(authUrl);
+    let completion = (async () => {
+      try {
+        let result = await server.waitForCallback();
+        if (result.state !== state)
+          throw new Error("OAuth state mismatch \u2014 possible CSRF attack");
+        await this.exchangeCode(result.code, codeVerifier, redirectUri);
+      } finally {
+        server.close(), this.activeAuthFlow = null;
+      }
+    })();
+    return this.activeAuthFlow = { authUrl, callbackPort: server.port, completion }, this.activeAuthFlow;
+  }
+  /**
+   * Begin a sign-in whose OAuth callback lands on the *caller's* machine rather
+   * than on this process.
+   *
+   * The loopback flow assumes the browser and the token store share a host.
+   * That breaks for a daemon on a remote box: `http://localhost:1455` in the
+   * user's browser reaches their laptop, not the daemon. Here the daemon keeps
+   * the PKCE verifier, the caller runs its own callback server, and the caller
+   * posts the code back via `completeRelayAuthFlow`.
+   */
+  startRelayAuthFlow(redirectUri) {
+    assertLoopbackRedirect(redirectUri), this.pruneRelayFlows();
+    let codeVerifier = generateCodeVerifier(), state = generateState(), flowId = base64url(Buffer.from(crypto.getRandomValues(new Uint8Array(24)))), expiresAt = Date.now() + RELAY_FLOW_TTL_MS, params = new URLSearchParams({
+      client_id: CLIENT_ID,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      code_challenge: generateCodeChallenge(codeVerifier),
+      code_challenge_method: "S256",
+      state,
+      scope: SCOPE,
+      id_token_add_organizations: "true",
+      codex_cli_simplified_flow: "true",
+      originator: "adf_studio"
+    });
+    return this.relayFlows.set(flowId, { codeVerifier, state, redirectUri, expiresAt }), { flowId, authUrl: `${AUTH_URL}?${params.toString()}`, state, expiresAt };
+  }
+  /** Finish a relay flow with the code the caller's callback server received. */
+  async completeRelayAuthFlow(flowId, code, state) {
+    this.pruneRelayFlows();
+    let flow = this.relayFlows.get(flowId);
+    if (!flow)
+      throw new Error("Unknown or expired auth flow \u2014 start sign-in again");
+    if (this.relayFlows.delete(flowId), state !== flow.state)
+      throw new Error("OAuth state mismatch \u2014 possible CSRF attack");
+    await this.exchangeCode(code, flow.codeVerifier, flow.redirectUri);
+  }
+  pruneRelayFlows() {
+    let now = Date.now();
+    for (let [id, flow] of this.relayFlows)
+      flow.expiresAt <= now && this.relayFlows.delete(id);
+  }
+  /** Trade an authorization code for tokens and persist them. */
+  async exchangeCode(code, codeVerifier, redirectUri) {
+    let tokenResponse = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    if (!tokenResponse.ok) {
+      let body = await tokenResponse.text();
+      throw new Error(`Token exchange failed (${tokenResponse.status}): ${body}`);
+    }
+    let tokenData = await tokenResponse.json();
+    tokenData.id_token && (this.email = decodeJwtPayload(tokenData.id_token).email);
+    let accountId = chatgptAccountIdFromJwt(tokenData.access_token) || chatgptAccountIdFromJwt(tokenData.id_token);
+    console.log(`[ChatGPT Auth] signed in: email=${this.email}, chatgpt_account_id=${accountId || "(missing)"}`), this.persist({
+      access_token: tokenData.access_token,
+      refresh_token: tokenData.refresh_token,
+      expires_at: Date.now() + tokenData.expires_in * 1e3,
+      account_id: accountId
+    }), noteSignIn(accountId);
+  }
+  async getValidAccessToken() {
+    let tokens = this.syncFromDisk();
+    if (!tokens)
+      throw new Error("Not authenticated \u2014 sign in first");
+    return Date.now() + REFRESH_BUFFER_MS < tokens.expires_at ? tokens.access_token : this.refreshPromise ? this.refreshPromise : (this.refreshPromise = this.refreshIfStillNeeded(tokens).finally(() => {
+      this.refreshPromise = null;
+    }), this.refreshPromise);
+  }
+  getAccountId() {
+    let tokens = this.syncFromDisk();
+    return chatgptAccountIdFromJwt(tokens?.access_token) || tokens?.account_id || void 0;
+  }
+  /**
+   * Re-check the file after winning the in-process refresh lock.
+   *
+   * OpenAI rotates the refresh token on every refresh, so if Studio refreshed
+   * while this call queued, our copy is already dead and spending it would both
+   * fail here and be pointless. Adopt the newer set instead.
+   */
+  async refreshIfStillNeeded(tokens) {
+    let fresh = this.syncFromDisk();
+    return fresh && Date.now() + REFRESH_BUFFER_MS < fresh.expires_at ? fresh.access_token : this.refreshTokens(fresh ?? tokens);
+  }
+  async refreshTokens(tokens) {
+    let data, rejected = !1;
+    try {
+      let response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: CLIENT_ID,
+          grant_type: "refresh_token",
+          refresh_token: tokens.refresh_token
+        })
+      });
+      if (!response.ok)
+        throw rejected = response.status === 400 || response.status === 401, new Error(`Token refresh failed (${response.status})`);
+      data = await response.json();
+    } catch (err) {
+      let fresh = this.syncFromDisk();
+      if (fresh && fresh.refresh_token !== tokens.refresh_token && Date.now() + REFRESH_BUFFER_MS < fresh.expires_at)
+        return fresh.access_token;
+      throw rejected ? (clearTokens(), this.cachedTokens = null, this.email = void 0, new Error("Session expired \u2014 please sign in again")) : new Error(`Could not refresh the session (${err instanceof Error ? err.message : String(err)}) \u2014 still signed in, try again`);
+    }
+    if (data.id_token) {
+      let claims = decodeJwtPayload(data.id_token);
+      this.email = claims.email;
+    }
+    return this.persist({
+      access_token: data.access_token,
+      refresh_token: data.refresh_token,
+      expires_at: Date.now() + data.expires_in * 1e3,
+      account_id: chatgptAccountIdFromJwt(data.access_token) || chatgptAccountIdFromJwt(data.id_token) || tokens.account_id
+    }), data.access_token;
+  }
+  getAuthStatus() {
+    let tokens = this.syncFromDisk();
+    return tokens ? {
+      authenticated: !0,
+      email: this.email,
+      expiresAt: tokens.expires_at
+    } : { authenticated: !1 };
+  }
+  isAuthenticated() {
+    return this.syncFromDisk() !== null;
+  }
+  logout() {
+    clearTokens(), this.cachedTokens = null, this.email = void 0, this.refreshPromise = null, this.relayFlows.clear();
+  }
+}, instance = null;
+function getChatGptAuthManager() {
+  return instance || (instance = new ChatGptAuthManager()), instance;
+}
+
+export {
+  readTokens,
+  chatgptAccountIdFromJwt,
+  getChatGptAuthManager
+};

package/dist/chunks/{chunk-G6PH7RPW.mjs → chunk-LCMANRYY.mjs}

@@ -7,7 +7,7 @@ const __dirname = __adfDirname(__filename);
 import {
   AGENT_DEFAULTS,
   DEFAULT_TOOLS
-} from "./chunk-CD3ATSXE.mjs";
+} from "./chunk-NZO5O4VN.mjs";
 
 // src/shared/constants/adf-defaults.ts
 var ADF_VERSION = "0.2", DOCS_GUIDES_URL = "https://raw.githubusercontent.com/christianbalevski/adf/main/docs/guides", ADF_SKILLS_REGISTRY_URL = "https://raw.githubusercontent.com/christianbalevski/adf/main/skills/registry.json", PROVIDER_TYPES = [
@@ -16,7 +16,8 @@ var ADF_VERSION = "0.2", DOCS_GUIDES_URL = "https://raw.githubusercontent.com/ch
   { type: "openai-compatible", label: "OpenAI Compatible", placeholder: { apiKey: "Optional", model: "e.g. llama-3-8b" } },
   { type: "openrouter", label: "OpenRouter", placeholder: { apiKey: "sk-or-...", model: "e.g. anthropic/claude-sonnet-4" } },
   { type: "chatgpt-subscription", label: "ChatGPT Subscription", placeholder: { apiKey: "OAuth \u2014 click Sign In", model: "e.g. gpt-5.6-sol" } },
-  { type: "grok-subscription", label: "Grok Subscription", placeholder: { apiKey: "OAuth \u2014 click Sign In", model: "e.g. grok-4.5" } }
+  { type: "grok-subscription", label: "Grok Subscription", placeholder: { apiKey: "OAuth \u2014 click Sign In", model: "e.g. grok-4.5" } },
+  { type: "claude-subscription", label: "Claude Subscription", placeholder: { apiKey: "Claude Code sign-in \u2014 click Sign In", model: "e.g. claude-sonnet-5-5" } }
 ], DEFAULT_AGENT_CONFIG = {
   adf_version: ADF_VERSION,
   name: "Untitled Agent",
@@ -28,7 +29,6 @@ var ADF_VERSION = "0.2", DOCS_GUIDES_URL = "https://raw.githubusercontent.com/ch
     provider: "",
     model_id: "",
     temperature: 0.7,
-    max_tokens: 4096,
     vision: !1
   },
   instructions: "",

package/dist/chunks/{chunk-ZESQMP66.mjs → chunk-LGL6ML37.mjs}

@@ -8,7 +8,7 @@ import {
   classifyRedirectTarget,
   parseBracedExpansion,
   unsupportedDevTargetMessage
-} from "./chunk-5W7KES6P.mjs";
+} from "./chunk-UZPDETEU.mjs";
 import {
   resolveWithDefault
 } from "./chunk-ESP3VNMX.mjs";
@@ -21,7 +21,7 @@ import {
   getCommand,
   notifyToolCallObservers,
   shellReadFile
-} from "./chunk-HSBV6YFU.mjs";
+} from "./chunk-YRMKSHW3.mjs";
 
 // src/main/tools/shell/executor/pipeline-executor.ts
 function vfsPath(p) {
@@ -147,7 +147,7 @@ async function executeCommand(cmd, stdin, ctx) {
   for (let r of redirects) {
     if (r.type === "in" && r.target !== void 0) {
       let [redirectContent, redirectErr] = await shellReadFile(ctx.toolRegistry, ctx.workspace, vfsPath(r.target));
-      if (redirectErr)
+      if (redirectErr !== null)
         return err(`${name}: ${redirectErr}`);
       stdin = redirectContent;
     }