@aliyunrds/ctxdb 1.0.8-beta.3 → 1.0.8-beta.4

package/dist/opencode/index.js

@@ -1,10 +1,10 @@
 // <define:__CTXDB_DISTRIBUTION_MANIFEST__>
-var define_CTXDB_DISTRIBUTION_MANIFEST_default = { id: "public", packageName: "@aliyunrds/ctxdb", packageRegistry: null, capabilities: { interactiveLogin: false, managedCredentials: false } };
+var define_CTXDB_DISTRIBUTION_MANIFEST_default = { id: "public", packageName: "@aliyunrds/ctxdb", packageRegistry: null, capabilities: { interactiveLogin: false, managedCredentials: false, deviceFlow: true } };
 
 // src/config.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 
 // ../shared/src/graph-context.ts
 var GRAPH_CONTEXT_TAG = "graphrag";
@@ -435,8 +435,8 @@ function getMemoryImportance(memory) {
   };
   return defaults[cat] ?? 0.5;
 }
-function estimateTokens(text) {
-  return Math.ceil(text.length / CHARS_PER_TOKEN);
+function estimateTokens(text2) {
+  return Math.ceil(text2.length / CHARS_PER_TOKEN);
 }
 function rankMemories(memories, categoryOrder) {
   const orderMap = new Map(categoryOrder.map((cat, i) => [cat, i]));
@@ -690,9 +690,9 @@ function sanitizeRecallFailureReason(reason, secrets = []) {
 }
 function sanitizeTraceString(value, secrets) {
   let sanitized = value.replace(/authorization\s*[:=]\s*[^\r\n]*/gi, "Authorization: [REDACTED]").replace(/(api[_-]?key|access[_-]?token)\s*[:=]\s*[^\s,;]+/gi, "$1=[REDACTED]");
-  for (const secret of secrets) {
-    if (!secret) continue;
-    sanitized = sanitized.split(secret).join("[REDACTED]");
+  for (const secret2 of secrets) {
+    if (!secret2) continue;
+    sanitized = sanitized.split(secret2).join("[REDACTED]");
   }
   return sanitized;
 }
@@ -827,10 +827,568 @@ function isRecallTraceRecord(value) {
   const baseValid = record.schema_version === RECALL_TRACE_SCHEMA_VERSION && (record.type === "recall.start" || record.type === "recall.finish") && isIsoTimestamp(record.timestamp) && typeof record.recall_event_id === "string" && record.recall_event_id.length > 0 && (typeof record.session_id === "string" || record.session_id === null) && isRecallTraceAgent(record.agent) && (record.kind === "prompt" || record.kind === "warmup") && typeof record.query === "string" && isRecallTraceRequest(record.request);
   if (!baseValid) return false;
   if (record.type === "recall.start") return true;
+  if (record.type !== "recall.finish") return false;
   const selection = record.selection;
   return isNonNegativeFinite(record.duration_ms) && typeof record.outcome === "string" && TRACE_OUTCOMES.has(record.outcome) && (typeof record.failure_reason === "string" || record.failure_reason === null) && Array.isArray(record.returned_memories) && Array.isArray(record.returned_knowledge) && Boolean(selection) && Array.isArray(selection?.selected) && Array.isArray(selection?.excluded) && isNonNegativeFinite(selection?.token_estimate) && typeof record.recall_context === "string";
 }
 
+// ../shared/src/device-flow.ts
+import { setTimeout as delay } from "timers/promises";
+var DeviceFlowError = class extends Error {
+  code;
+  constructor(code) {
+    super(code === "service_unavailable" ? "ContextDB authentication service is unavailable. No automatic retry was performed; start a new login later if authorization could not be completed." : `ContextDB device authorization: ${code}. Start a new login if authorization could not be completed.`);
+    this.name = "DeviceFlowError";
+    this.code = code;
+  }
+};
+var invalid = () => new DeviceFlowError("invalid_response");
+var scopes = ["read_only", "read_write", "default"];
+var clientId = "ctxdb-cli";
+var grantType = "urn:ietf:params:oauth:grant-type:device_code";
+function normalizeCoreOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Invalid Core server origin");
+  }
+  const local = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || local && url.protocol === "http:")) throw new Error("Invalid Core server origin");
+  return url.origin;
+}
+var CoreDeviceClient = class {
+  baseUrl;
+  fetchImpl;
+  now;
+  sleep;
+  constructor(baseUrl, options = {}) {
+    this.baseUrl = normalizeCoreOrigin(baseUrl);
+    this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    this.now = options.now ?? Date.now;
+    this.sleep = options.sleep ?? ((ms, signal) => delay(ms, void 0, { signal }));
+  }
+  async login(options) {
+    const started = this.now();
+    const initial = await this.post("/v1/auth/device/authorize", { client_id: clientId }, options.signal);
+    if (!initial.ok) throw new DeviceFlowError("request_rejected");
+    const data = initial.data;
+    const requestId = text(data.request_id, 32), userCode = text(data.user_code, 9), code = text(data.device_code, 43);
+    if (!/^[0-9a-f]{32}$/.test(requestId) || !/^[0-9A-HJKMNP-TV-Z]{4}-[0-9A-HJKMNP-TV-Z]{4}$/.test(userCode) || !/^[A-Za-z0-9_-]{43}$/.test(code)) throw invalid();
+    const expiresIn = integer(data.expires_in, 1, 3600);
+    let interval = integer(data.interval, 1, 3600);
+    const deadline = started + expiresIn * 1e3;
+    options.onPrompt({ requestId, userCode, expiresIn, interval });
+    while (true) {
+      if (options.signal?.aborted) throw new DeviceFlowError("cancelled");
+      if (this.now() >= deadline) throw new DeviceFlowError("expired_token");
+      try {
+        await this.sleep(Math.min(interval * 1e3, deadline - this.now()), options.signal);
+      } catch {
+        throw new DeviceFlowError("cancelled");
+      }
+      if (this.now() >= deadline) throw new DeviceFlowError("expired_token");
+      const issuedAt = this.now();
+      const result = await this.post("/v1/auth/device/token", { grant_type: grantType, client_id: clientId, device_code: code }, options.signal);
+      if (result.ok) return loginResult(result.data, this.baseUrl, issuedAt, this.now());
+      const error = result.data.error;
+      if (error === "authorization_pending") continue;
+      if (error === "slow_down") {
+        interval = Math.max(interval + 5, integer(result.data.interval, 1, 3605));
+        continue;
+      }
+      if (error === "access_denied" || error === "expired_token" || error === "invalid_grant") throw new DeviceFlowError(error);
+      throw new DeviceFlowError("request_rejected");
+    }
+  }
+  async refresh(refreshToken, baseUrl) {
+    this.requireSameOrigin(baseUrl);
+    const result = await this.post("/v1/auth/token/refresh", { refresh_token: secret(refreshToken) });
+    if (!result.ok) throw new DeviceFlowError("request_rejected");
+    return credentialResult(result.data);
+  }
+  async revoke(refreshToken, baseUrl) {
+    this.requireSameOrigin(baseUrl);
+    const result = await this.post("/v1/auth/token/revoke", { refresh_token: secret(refreshToken) });
+    if (!result.ok) throw new DeviceFlowError("request_rejected");
+  }
+  requireSameOrigin(baseUrl) {
+    if (normalizeCoreOrigin(baseUrl) !== this.baseUrl) throw new Error("OAuth credential Core origin cannot change");
+  }
+  async post(path, body, signal) {
+    if (signal?.aborted) throw new DeviceFlowError("cancelled");
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(abort, 3e4);
+    timer.unref?.();
+    try {
+      const response = await this.fetchImpl(this.baseUrl + path, {
+        method: "POST",
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        redirect: "error",
+        credentials: "omit",
+        cache: "no-store",
+        signal: controller.signal
+      });
+      const box = await boundedJson(response);
+      if (!Number.isInteger(box.errorCode)) throw invalid();
+      const ok = response.ok && box.errorCode === 0;
+      const data = (!ok || path === "/v1/auth/token/revoke") && box.data == null ? {} : object(box.data);
+      if (!ok && response.status >= 500) throw new DeviceFlowError("service_unavailable");
+      return { ok, data };
+    } catch (error) {
+      if (signal?.aborted) throw new DeviceFlowError("cancelled");
+      if (error instanceof DeviceFlowError) throw error;
+      throw new DeviceFlowError("network_error");
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+function text(value, maximum) {
+  if (typeof value !== "string" || !value || value.length > maximum || /[\x00-\x1f\x7f]/.test(value)) throw invalid();
+  return value;
+}
+function integer(value, min, max) {
+  if (!Number.isSafeInteger(value) || value < min || value > max) throw invalid();
+  return value;
+}
+function secret(value) {
+  const token = text(value, 8192);
+  if (/\s/.test(token)) throw invalid();
+  return token;
+}
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid();
+  return value;
+}
+function credentialResult(data) {
+  if (data.token_type !== "Bearer" || !scopes.includes(data.scope)) throw invalid();
+  return {
+    access_token: secret(data.access_token),
+    refresh_token: secret(data.refresh_token),
+    token_type: "Bearer",
+    expires_in: integer(data.expires_in, 1, 3600),
+    session_id: text(data.session_id, 64),
+    scope: data.scope
+  };
+}
+function loginResult(data, baseUrl, issuedAt, now) {
+  const tokens = credentialResult(data), scope = tokens.scope;
+  if (data.client_id !== clientId || scope !== "default") throw invalid();
+  const expiresAt = issuedAt + tokens.expires_in * 1e3;
+  if (expiresAt <= now) throw invalid();
+  return {
+    baseUrl,
+    workspaceId: text(data.workspace_id, 64),
+    memberId: text(data.member_id, 64),
+    scope,
+    clientId,
+    sessionId: tokens.session_id,
+    accountDisplay: text(data.account_display, 256),
+    issuedAt,
+    expiresAt,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token
+  };
+}
+async function boundedJson(response) {
+  if (!response.body || Number(response.headers.get("content-length")) > 65536) throw invalid();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 65536) {
+        await reader.cancel();
+        throw invalid();
+      }
+      chunks.push(value);
+    }
+    try {
+      return object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+    } catch {
+      throw invalid();
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+// ../shared/src/oauth-credentials.ts
+import {
+  constants,
+  closeSync as closeSync2,
+  existsSync as existsSync2,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { join as join3 } from "path";
+import { setTimeout as delay2 } from "timers/promises";
+
+// ../shared/src/windows-private-storage.ts
+import { execFileSync } from "child_process";
+import { join as join2 } from "path";
+var SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$path = $env:CTXDB_PRIVATE_STORAGE_PATH
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$item = Get-Item -LiteralPath $path -Force
+if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse' }
+if ($env:CTXDB_PRIVATE_STORAGE_INITIALIZE -eq '1') {
+  if (-not $item.PSIsContainer) { throw 'not directory' }
+  $acl = [System.Security.AccessControl.DirectorySecurity]::new()
+  $acl.SetOwner($sid)
+  $acl.SetAccessRuleProtection($true, $false)
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+  $acl.AddAccessRule($rule)
+  Set-Acl -LiteralPath $path -AclObject $acl
+}
+$acl = Get-Acl -LiteralPath $path
+if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner' }
+$self = $false
+foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow') {
+    if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'other principal' }
+    if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $self = $true }
+  }
+}
+if (-not $self) { throw 'missing owner access' }
+Write-Output 'private'
+`;
+function checkWindowsPrivateStorage(path, initialize, run = execFileSync) {
+  const systemRoot = process.env.SystemRoot;
+  if (!systemRoot) throw new Error("Private Windows credential storage could not be verified.");
+  try {
+    const result = run(
+      join2(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")],
+      {
+        env: { ...process.env, CTXDB_PRIVATE_STORAGE_PATH: path, CTXDB_PRIVATE_STORAGE_INITIALIZE: initialize ? "1" : "0" },
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 1e4,
+        maxBuffer: 4096,
+        stdio: ["ignore", "pipe", "pipe"]
+      }
+    );
+    if (String(result).trim() !== "private") throw new Error();
+  } catch {
+    throw new Error("Private Windows credential storage could not be verified.");
+  }
+}
+
+// ../shared/src/oauth-credentials.ts
+var OAuthCredentialError = class extends Error {
+  code;
+  constructor(code) {
+    const messages = {
+      login_required: "OAuth session needs login; run ctxdb login for this profile.",
+      credential_busy: "OAuth credential is busy. If its previous process crashed, run ctxdb login for a new credential.",
+      invalid_profile: "OAuth credential does not belong to this profile.",
+      unsafe_storage: "OAuth credential storage is not private or is invalid."
+    };
+    super(messages[code]);
+    this.name = "OAuthCredentialError";
+    this.code = code;
+  }
+};
+var loginRequired = () => new OAuthCredentialError("login_required");
+var unsafe = () => new OAuthCredentialError("unsafe_storage");
+var OAuthSessionStore = class {
+  directory;
+  now;
+  lockWaitMs;
+  constructor(directory, options = {}) {
+    this.directory = directory;
+    this.now = options.now ?? Date.now;
+    this.lockWaitMs = options.lockWaitMs ?? 3e4;
+  }
+  saveLogin(profile, session) {
+    requireProfile(profile);
+    validateSession(session);
+    this.prepareDirectory();
+    const ref = randomBytes(16).toString("hex");
+    this.write(ref, { version: 1, profile, state: "ready", session });
+    return ref;
+  }
+  status(ref, profile) {
+    const record = this.read(ref, profile);
+    if (!record) return { state: this.isLoggedOut(ref) ? "logged_out" : "missing" };
+    const s = record.session;
+    return {
+      state: record.state,
+      profile,
+      baseUrl: s.baseUrl,
+      workspaceId: s.workspaceId,
+      memberId: s.memberId,
+      clientId: s.clientId,
+      scope: s.scope,
+      sessionId: s.sessionId,
+      accountDisplay: s.accountDisplay,
+      accessExpiresAt: s.expiresAt
+    };
+  }
+  async resolve(ref, profile, transport) {
+    const first = this.read(ref, profile);
+    if (!first || first.state === "reauth_required") throw loginRequired();
+    if (first.state === "ready" && !this.needsRefresh(first.session)) return authorization(first.session);
+    return this.withLock(ref, async () => {
+      const current = this.read(ref, profile);
+      if (!current || current.state !== "ready") throw loginRequired();
+      if (!this.needsRefresh(current.session)) return authorization(current.session);
+      const started = this.now();
+      this.write(ref, { ...current, state: "refreshing" });
+      try {
+        const response = await transport.refresh(current.session.refreshToken, current.session.baseUrl);
+        const next = rotated(current.session, response, started);
+        if (next.expiresAt <= this.now()) throw loginRequired();
+        this.write(ref, { ...current, state: "ready", session: next });
+        return authorization(next);
+      } catch {
+        if (!this.isLoggedOut(ref)) this.write(ref, { ...current, state: "reauth_required" });
+        throw loginRequired();
+      }
+    });
+  }
+  async logout(ref, profile, transport) {
+    const current = this.read(ref, profile);
+    let remoteRevoked = false;
+    try {
+      if (current) {
+        await transport.revoke(current.session.refreshToken, current.session.baseUrl);
+        remoteRevoked = true;
+      }
+    } catch {
+    } finally {
+      this.prepareDirectory();
+      this.atomicWrite(this.path(ref, ".logged-out"), "");
+      remove(this.path(ref));
+    }
+    return { remoteRevoked };
+  }
+  needsRefresh(session) {
+    const advance = Math.min(3e4, (session.expiresAt - session.issuedAt) / 2);
+    return this.now() >= session.expiresAt - advance;
+  }
+  path(ref, suffix = ".json") {
+    if (!/^[a-f0-9]{32}$/.test(ref)) throw unsafe();
+    return join3(this.directory, ref + suffix);
+  }
+  isLoggedOut(ref) {
+    return existsSync2(this.path(ref, ".logged-out"));
+  }
+  prepareDirectory() {
+    if (!existsSync2(this.directory)) {
+      mkdirSync2(join3(this.directory, ".."), { recursive: true, mode: 448 });
+      try {
+        mkdirSync2(this.directory, { mode: 448 });
+        if (process.platform === "win32") checkWindowsPrivateStorage(this.directory, true);
+      } catch (error) {
+        if (error.code !== "EEXIST") throw unsafe();
+      }
+    }
+    requirePrivate(this.directory, true);
+  }
+  read(ref, profile) {
+    requireProfile(profile);
+    if (this.isLoggedOut(ref)) return void 0;
+    const path = this.path(ref);
+    if (!existsSync2(path)) return void 0;
+    requirePrivate(this.directory, true);
+    requirePrivate(path, false);
+    const fd = openSync2(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    let text2;
+    try {
+      const stat = fstatSync(fd);
+      if (stat.size > 65536 || !stat.isFile()) throw unsafe();
+      text2 = readFileSync2(fd, "utf8");
+    } finally {
+      closeSync2(fd);
+    }
+    let doc;
+    try {
+      doc = JSON.parse(text2);
+    } catch {
+      throw unsafe();
+    }
+    if (!doc || doc.version !== 1 || !["ready", "refreshing", "reauth_required"].includes(doc.state)) throw unsafe();
+    if (doc.profile !== profile) throw new OAuthCredentialError("invalid_profile");
+    validateSession(doc.session);
+    return this.isLoggedOut(ref) ? void 0 : doc;
+  }
+  write(ref, doc) {
+    if (this.isLoggedOut(ref)) throw loginRequired();
+    this.atomicWrite(this.path(ref), JSON.stringify(doc));
+    if (this.isLoggedOut(ref)) {
+      remove(this.path(ref));
+      throw loginRequired();
+    }
+  }
+  atomicWrite(path, text2) {
+    this.prepareDirectory();
+    const temporary = path + "." + randomBytes(12).toString("hex") + ".tmp";
+    let fd;
+    try {
+      fd = openSync2(temporary, "wx", 384);
+      writeFileSync(fd, text2);
+      fsyncSync(fd);
+      closeSync2(fd);
+      fd = void 0;
+      renameSync2(temporary, path);
+      if (process.platform !== "win32") {
+        const dir = openSync2(this.directory, "r");
+        try {
+          fsyncSync(dir);
+        } finally {
+          closeSync2(dir);
+        }
+      }
+    } finally {
+      if (fd !== void 0) closeSync2(fd);
+      remove(temporary);
+    }
+  }
+  async withLock(ref, task) {
+    const path = this.path(ref, ".lock");
+    const deadline = Date.now() + this.lockWaitMs;
+    this.prepareDirectory();
+    while (true) {
+      let fd;
+      try {
+        fd = openSync2(path, "wx", 384);
+      } catch (error) {
+        if (error.code !== "EEXIST") throw unsafe();
+        if (Date.now() >= deadline) throw new OAuthCredentialError("credential_busy");
+        await delay2(25);
+        continue;
+      }
+      try {
+        writeFileSync(fd, String(process.pid));
+        fsyncSync(fd);
+      } catch {
+        closeSync2(fd);
+        remove(path);
+        throw unsafe();
+      }
+      closeSync2(fd);
+      try {
+        return await task();
+      } finally {
+        remove(path);
+      }
+    }
+  }
+};
+function requireProfile(profile) {
+  if (typeof profile !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("invalid_profile");
+}
+function requirePrivate(path, directory) {
+  const s = lstatSync(path);
+  if (s.isSymbolicLink() || (directory ? !s.isDirectory() : !s.isFile())) throw unsafe();
+  if (process.platform === "win32") {
+    try {
+      checkWindowsPrivateStorage(path, false);
+    } catch {
+      throw unsafe();
+    }
+    return;
+  }
+  if ((s.mode & 63) !== 0 || process.getuid && s.uid !== process.getuid()) throw unsafe();
+}
+function remove(path) {
+  try {
+    unlinkSync(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw unsafe();
+  }
+}
+function validateSession(s) {
+  if (!s || typeof s !== "object" || s.clientId !== "ctxdb-cli" || !["read_only", "read_write", "default"].includes(s.scope) || !Number.isSafeInteger(s.issuedAt) || !Number.isSafeInteger(s.expiresAt) || s.expiresAt - s.issuedAt < 1e3 || s.expiresAt - s.issuedAt > 36e5) throw unsafe();
+  for (const value of [s.workspaceId, s.memberId, s.sessionId, s.accountDisplay]) {
+    if (typeof value !== "string" || !value || value.length > 256 || /[\r\n\x00-\x1f]/.test(value)) throw unsafe();
+  }
+  for (const value of [s.accessToken, s.refreshToken]) {
+    if (typeof value !== "string" || !value || value.length > 8192 || /\s/.test(value)) throw unsafe();
+  }
+  let url;
+  try {
+    url = new URL(s.baseUrl);
+  } catch {
+    throw unsafe();
+  }
+  const loopback = ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || loopback && url.protocol === "http:")) throw unsafe();
+}
+function rotated(current, response, issuedAt) {
+  if (!response || response.token_type !== "Bearer" || response.session_id !== current.sessionId || response.scope !== current.scope || !Number.isSafeInteger(response.expires_in) || response.expires_in < 1 || response.expires_in > 3600 || response.refresh_token === current.refreshToken) throw loginRequired();
+  const next = {
+    ...current,
+    accessToken: response.access_token,
+    refreshToken: response.refresh_token,
+    issuedAt,
+    expiresAt: issuedAt + response.expires_in * 1e3
+  };
+  validateSession(next);
+  return next;
+}
+function authorization(session) {
+  return { scheme: "Bearer", value: session.accessToken, baseUrl: session.baseUrl, expiresAt: session.expiresAt };
+}
+
+// ../shared/src/oauth-profile.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join4, resolve } from "path";
+function oauthProfile(reference, configPath, profile, baseUrl) {
+  if (reference === void 0) return void 0;
+  if (typeof reference !== "string" || !/^[a-f0-9]{32}$/.test(reference) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(profile)) throw new OAuthCredentialError("unsafe_storage");
+  const path = resolve(configPath);
+  return {
+    reference,
+    profile,
+    configPath: path,
+    directory: join4(dirname2(path), "oauth-credentials"),
+    baseUrl: normalizeCoreOrigin(baseUrl)
+  };
+}
+var OAuthProfileProvider = class {
+  selected;
+  constructor(selected) {
+    this.selected = selected;
+  }
+  async resolve() {
+    const selected = this.selected;
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync3(selected.configPath, "utf8"));
+    } catch {
+      throw new OAuthCredentialError("login_required");
+    }
+    const profile = raw?.version === 2 ? raw.agents?.[selected.profile] : void 0;
+    if (!profile || !Object.hasOwn(profile, "oauth_credential_ref")) throw new OAuthCredentialError("login_required");
+    const current = oauthProfile(profile.oauth_credential_ref, selected.configPath, selected.profile, profile.base_url);
+    if (!current || current.baseUrl !== selected.baseUrl) throw new OAuthCredentialError("login_required");
+    const store = new OAuthSessionStore(current.directory);
+    const status = store.status(current.reference, current.profile);
+    if (!("baseUrl" in status) || typeof status.baseUrl !== "string" || normalizeCoreOrigin(status.baseUrl) !== current.baseUrl) throw new OAuthCredentialError("login_required");
+    return store.resolve(current.reference, current.profile, new CoreDeviceClient(current.baseUrl));
+  }
+};
+
 // src/distribution-capabilities.ts
 var PUBLIC_DISTRIBUTION = {
   id: "public",
@@ -838,7 +1396,8 @@ var PUBLIC_DISTRIBUTION = {
   packageRegistry: null,
   capabilities: {
     interactiveLogin: false,
-    managedCredentials: false
+    managedCredentials: false,
+    deviceFlow: true
   }
 };
 var DISTRIBUTION_MANIFEST = typeof define_CTXDB_DISTRIBUTION_MANIFEST_default === "undefined" ? PUBLIC_DISTRIBUTION : define_CTXDB_DISTRIBUTION_MANIFEST_default;
@@ -852,7 +1411,7 @@ var DEFAULT_KNOWLEDGE_TOP_K = 6;
 var DEFAULT_KB_CATALOG_INJECTION = "session_start";
 function defaultPath(env) {
   if (env.CTXDB_CONFIG_PATH) return env.CTXDB_CONFIG_PATH;
-  return join2(homedir2(), ".ctxdb", "ctxdb.json");
+  return join5(homedir2(), ".ctxdb", "ctxdb.json");
 }
 function coerceInt(v, fallback) {
   if (v === null || v === void 0 || v === "") return fallback;
@@ -874,9 +1433,9 @@ function coerceKbCatalogInjection(v) {
   return DEFAULT_KB_CATALOG_INJECTION;
 }
 function readRaw(path) {
-  if (!existsSync2(path)) return {};
+  if (!existsSync3(path)) return {};
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -912,11 +1471,11 @@ function applyDebugPolicy(cfg) {
   return cfg;
 }
 function managedCredential(path) {
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   if (process.platform !== "win32" && (statSync2(path).mode & 63) !== 0) {
     throw new Error(`credentials: ${path} must be owner-only (run chmod 600)`);
   }
-  const raw = JSON.parse(readFileSync2(path, "utf8"));
+  const raw = JSON.parse(readFileSync4(path, "utf8"));
   if (raw.version !== 1 || !raw.records || typeof raw.records !== "object") {
     throw new Error("credentials: unsupported credentials.json schema");
   }
@@ -971,16 +1530,21 @@ function loadOpencodeConfig(options = {}) {
     kbCatalogInjection: coerceKbCatalogInjection(section.kb_catalog_injection)
   };
   const managed = DISTRIBUTION_MANIFEST.capabilities.managedCredentials && options.managedCredentials !== false ? managedCredential(
-    options.credentialsPath ?? join2(dirname2(path), "credentials.json")
+    options.credentialsPath ?? join5(dirname3(path), "credentials.json")
   ) : null;
   if (managed) {
     cfg.apiKey = managed.apiKey;
     cfg.baseUrl = managed.baseUrl;
   }
-  return applyEnv(cfg, env);
+  applyEnv(cfg, env);
+  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
+    cfg.oauthCredential = oauthProfile(section.oauth_credential_ref, path, "opencode", cfg.baseUrl);
+  }
+  if (env.CTXDB_API_KEY || accessTokenFromEnv(env)) cfg.oauthCredential = void 0;
+  return cfg;
 }
 function isConfigured(cfg, env = process.env) {
-  return Boolean((accessTokenFromEnv(env) || cfg.apiKey) && cfg.baseUrl);
+  return Boolean((accessTokenFromEnv(env) || cfg.oauthCredential || cfg.apiKey) && cfg.baseUrl);
 }
 
 // src/http-client.ts
@@ -1001,20 +1565,26 @@ var HttpClient = class {
   accessToken;
   userAgent;
   fetchImpl;
+  oauthProvider;
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
     this.apiKey = opts.apiKey;
     this.accessToken = opts.accessToken ?? null;
+    this.oauthProvider = opts.oauthCredential ? new OAuthProfileProvider(opts.oauthCredential) : void 0;
     this.userAgent = opts.userAgent ?? "ctxdb-opencode-plugin/0.0.0";
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
-  headers(contentType) {
+  async headers(contentType) {
     const h = {
       "User-Agent": this.userAgent,
       Connection: "close"
     };
     if (this.accessToken) h.Authorization = `Bearer ${this.accessToken}`;
-    else if (this.apiKey) h.Authorization = `Token ${this.apiKey}`;
+    else if (this.oauthProvider) {
+      const authorization2 = await this.oauthProvider.resolve();
+      if (authorization2.baseUrl !== this.baseUrl) throw new Error("OAuth environment changed; reload this runtime.");
+      h.Authorization = `Bearer ${authorization2.value}`;
+    } else if (this.apiKey) h.Authorization = `Token ${this.apiKey}`;
     if (contentType) h["Content-Type"] = contentType;
     return h;
   }
@@ -1035,6 +1605,9 @@ var HttpClient = class {
     return this.request("POST", url, path, JSON.stringify(body), "application/json", options.timeoutMs);
   }
   async request(method, url, path, body, contentType, timeoutMs) {
+    const headers = await this.headers(contentType);
+    const bearer = headers.Authorization?.startsWith("Bearer ") ? headers.Authorization.slice(7) : void 0;
+    const safeText = (value) => bearer ? String(value).split(bearer).join("[REDACTED]") : String(value);
     const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), effectiveTimeout);
@@ -1043,41 +1616,42 @@ var HttpClient = class {
       try {
         resp = await this.fetchImpl(url, {
           method,
-          headers: this.headers(contentType),
+          headers,
           body,
-          signal: controller.signal
+          signal: controller.signal,
+          ...headers.Authorization?.startsWith("Bearer ") ? { redirect: "error" } : {}
         });
       } catch (err) {
         if (err?.name === "AbortError") {
           throw new CtxdbHttpError(path, null, `timeout after ${effectiveTimeout}ms`);
         }
-        throw new CtxdbHttpError(path, null, `network error: ${err?.message ?? err}`);
+        throw new CtxdbHttpError(path, null, `network error: ${safeText(err?.message ?? err)}`);
       }
       if (resp.status === 204) return {};
-      let text;
+      let text2;
       try {
-        text = await resp.text();
+        text2 = safeText(await resp.text());
       } catch (err) {
-        throw new CtxdbHttpError(path, resp.status, `body read failed: ${err?.message ?? err}`);
+        throw new CtxdbHttpError(path, resp.status, `body read failed: ${safeText(err?.message ?? err)}`);
       }
       if (!resp.ok) {
-        throw new CtxdbHttpError(path, resp.status, extractDetail(text) || `HTTP ${resp.status}`);
+        throw new CtxdbHttpError(path, resp.status, extractDetail(text2) || `HTTP ${resp.status}`);
       }
-      if (!text) return {};
+      if (!text2) return {};
       try {
-        return JSON.parse(text);
+        return JSON.parse(text2);
       } catch {
-        return text;
+        return text2;
       }
     } finally {
       clearTimeout(timer);
     }
   }
 };
-function extractDetail(text) {
-  if (!text) return "";
+function extractDetail(text2) {
+  if (!text2) return "";
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       for (const k of ["detail", "message", "error"]) {
         const v = parsed[k];
@@ -1087,7 +1661,7 @@ function extractDetail(text) {
     }
     return String(parsed);
   } catch {
-    return text;
+    return text2;
   }
 }
 
@@ -1470,6 +2044,7 @@ function buildRuntime(config, cwd, env = process.env) {
     http: new HttpClient({
       baseUrl: config.baseUrl,
       apiKey: config.apiKey,
+      oauthCredential: config.oauthCredential,
       accessToken: accessTokenFromEnv(env)
     }),
     sessionState: /* @__PURE__ */ new Map(),
@@ -1523,10 +2098,10 @@ async function buildHooks(input) {
   const hooks = {
     "chat.message": async (input2, output) => {
       try {
-        const text = extractTextPrompt(output.parts);
-        if (!text) return;
+        const text2 = extractTextPrompt(output.parts);
+        if (!text2) return;
         const s = touchSession(rt, input2.sessionID);
-        s.lastPrompt = text;
+        s.lastPrompt = text2;
       } catch (err) {
         logError(rt.config, "chat.message", err);
       }