@ashx-j/lunr-dev 0.2.13-dev.1.1

package/dist/core/grok-cli-auth.js

@@ -0,0 +1,327 @@
+/**
+ * Official Grok CLI SuperGrok session (`~/.grok/auth.json`).
+ *
+ * lunR and Grok CLI share xAI client `b1a00492-073a-47ea-816f-4c329264a828`.
+ * xAI rotates refresh tokens and revokes the family on reuse, so this module
+ * must never write a rotated-out refresh back over a newer one.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import lockfile from "proper-lockfile";
+export const XAI_PROVIDER_ID = "xai";
+/** Same client as packages/ai/src/auth/oauth/xai.ts `XAI_CLIENT_ID`. */
+export const XAI_GROK_CLI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+/** Matches packages/ai/src/auth/oauth/xai.ts `REFRESH_SKEW_MS`. */
+const REFRESH_SKEW_MS = 5 * 60 * 1000;
+const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf-8", mode: 0o600 };
+export function grokHomeDir(grokHome) {
+    if (grokHome)
+        return grokHome;
+    const fromEnv = process.env.GROK_HOME?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return join(homedir(), ".grok");
+}
+export function grokAuthPath(grokHome) {
+    return join(grokHomeDir(grokHome), "auth.json");
+}
+export function grokOidcEntryKey(clientId = XAI_GROK_CLI_CLIENT_ID) {
+    return `https://auth.x.ai::${clientId}`;
+}
+export function parseGrokExpiresAt(value) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        return value < 1e12 ? Math.round(value * 1000) : Math.round(value);
+    }
+    if (typeof value === "string" && value.trim()) {
+        const numeric = Number(value);
+        if (Number.isFinite(numeric) && numeric > 0) {
+            return numeric < 1e12 ? Math.round(numeric * 1000) : Math.round(numeric);
+        }
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+/** Grok CLI deserializes `expires_at` as RFC3339, not epoch ms. */
+export function formatGrokExpiresAt(expires) {
+    return new Date(expires).toISOString();
+}
+export function grokEntryToOAuth(entry) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+        return undefined;
+    const record = entry;
+    const access = typeof record.key === "string" ? record.key : undefined;
+    const refresh = typeof record.refresh_token === "string" ? record.refresh_token : undefined;
+    const expires = parseGrokExpiresAt(record.expires_at);
+    if (!access || !refresh || expires === undefined)
+        return undefined;
+    return { type: "oauth", access, refresh, expires };
+}
+export function readGrokCliXaiOAuth(options = {}) {
+    try {
+        const raw = readFileSync(grokAuthPath(options.grokHome), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return undefined;
+        return grokEntryToOAuth(parsed[grokOidcEntryKey()]);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function hasGrokCliXaiAuth(options = {}) {
+    return readGrokCliXaiOAuth(options) !== undefined;
+}
+/**
+ * Pick the live SuperGrok session.
+ *
+ * lunR stores `expires` 5 minutes early. Grok CLI stores the server expiry.
+ * A raw `>=` compare therefore treats a just-rotated lunR token as older than
+ * the still-unrotated Grok file and writes the dead refresh back. When both
+ * look live and the refresh tokens differ, keep lunR; `modify` retries Grok
+ * only after `invalid_grant`.
+ */
+export function chooseXaiOAuth(lunr, grok) {
+    if (lunr?.type === "api_key")
+        return lunr;
+    const lunrOAuth = lunr?.type === "oauth" ? lunr : undefined;
+    if (lunrOAuth && grok) {
+        if (lunrOAuth.refresh === grok.refresh) {
+            return grok.expires >= lunrOAuth.expires ? grok : lunrOAuth;
+        }
+        const now = Date.now();
+        const lunrLive = now < lunrOAuth.expires;
+        const grokLive = now < grok.expires;
+        if (grokLive && !lunrLive)
+            return grok;
+        if (lunrLive && !grokLive)
+            return lunrOAuth;
+        if (!lunrLive && !grokLive)
+            return grok.expires >= lunrOAuth.expires ? grok : lunrOAuth;
+        return lunrOAuth;
+    }
+    return grok ?? lunrOAuth ?? lunr;
+}
+function oauthRefreshFailed(error) {
+    const parts = [];
+    let current = error;
+    const seen = new Set();
+    while (current && typeof current === "object" && !seen.has(current)) {
+        seen.add(current);
+        if (current instanceof Error) {
+            parts.push(current.message);
+            current = current.cause;
+            continue;
+        }
+        break;
+    }
+    const chain = parts.join(" ");
+    if (/timed out|aborted|cancelled|ECONN|ENOTFOUND|network/i.test(chain))
+        return false;
+    return /invalid_grant|refresh token revoked/i.test(chain);
+}
+function shouldAdopt(lunr, chosen) {
+    if (!chosen || chosen.type !== "oauth")
+        return false;
+    if (!lunr || lunr.type !== "oauth")
+        return true;
+    return lunr.access !== chosen.access || lunr.refresh !== chosen.refresh;
+}
+function writeAuthFileAtomic(authPath, contents) {
+    const tmp = `${authPath}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, contents, AUTH_FILE_WRITE_OPTIONS);
+    try {
+        chmodSync(tmp, 0o600);
+    }
+    catch {
+        // mode bits are best-effort on Windows.
+    }
+    try {
+        if (process.platform === "win32" && existsSync(authPath)) {
+            writeFileSync(authPath, contents, AUTH_FILE_WRITE_OPTIONS);
+            chmodSync(authPath, 0o600);
+            return;
+        }
+        renameSync(tmp, authPath);
+        try {
+            chmodSync(authPath, 0o600);
+        }
+        catch {
+            // mode bits are best-effort on Windows.
+        }
+    }
+    finally {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // tmp already renamed, or never created.
+        }
+    }
+}
+function acquireGrokLock(authPath) {
+    const maxAttempts = 10;
+    const delayMs = 20;
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            return lockfile.lockSync(authPath, { realpath: false, stale: 120_000 });
+        }
+        catch (error) {
+            const code = typeof error === "object" && error !== null && "code" in error
+                ? String(error.code)
+                : undefined;
+            if (code !== "ELOCKED" || attempt === maxAttempts) {
+                throw error;
+            }
+            lastError = error;
+            const start = Date.now();
+            while (Date.now() - start < delayMs) {
+                // Sleep synchronously to match AuthStorage.
+            }
+        }
+    }
+    throw lastError ?? new Error("Failed to acquire Grok CLI auth lock");
+}
+export function writeGrokCliXaiOAuth(credential, options = {}) {
+    const authPath = grokAuthPath(options.grokHome);
+    if (options.onlyIfFileExists !== false && !existsSync(authPath))
+        return false;
+    const dir = dirname(authPath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (!existsSync(authPath)) {
+        writeAuthFileAtomic(authPath, "{}\n");
+    }
+    let release;
+    try {
+        release = acquireGrokLock(authPath);
+        let data = {};
+        try {
+            const parsed = JSON.parse(readFileSync(authPath, "utf-8"));
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                data = parsed;
+            }
+            else {
+                return false;
+            }
+        }
+        catch {
+            // Never replace a corrupt Grok file with a single-entry stub.
+            return false;
+        }
+        const key = grokOidcEntryKey();
+        const previous = data[key] && typeof data[key] === "object" && !Array.isArray(data[key])
+            ? data[key]
+            : {};
+        const existing = grokEntryToOAuth(previous);
+        if (existing &&
+            existing.refresh !== credential.refresh &&
+            existing.expires > credential.expires + REFRESH_SKEW_MS) {
+            // Disk already has a newer family (usually a later `grok login`).
+            return false;
+        }
+        data[key] = {
+            ...previous,
+            key: credential.access,
+            refresh_token: credential.refresh,
+            expires_at: formatGrokExpiresAt(credential.expires),
+        };
+        writeAuthFileAtomic(authPath, `${JSON.stringify(data, null, 2)}\n`);
+        return true;
+    }
+    finally {
+        if (release) {
+            try {
+                release();
+            }
+            catch {
+                // Unlock is best-effort.
+            }
+        }
+    }
+}
+export function wrapXaiGrokCliCredentials(store, options = {}) {
+    const grokHome = options.grokHome;
+    return {
+        async read(providerId) {
+            const stored = await store.read(providerId);
+            if (providerId !== XAI_PROVIDER_ID)
+                return stored;
+            if (stored?.type === "api_key")
+                return stored;
+            const grok = readGrokCliXaiOAuth({ grokHome });
+            const chosen = chooseXaiOAuth(stored, grok);
+            if (shouldAdopt(stored, chosen) && chosen?.type === "oauth") {
+                try {
+                    await store.modify(providerId, async (current) => {
+                        if (current?.type === "api_key")
+                            return undefined;
+                        const latestGrok = readGrokCliXaiOAuth({ grokHome });
+                        const latestChosen = chooseXaiOAuth(current, latestGrok);
+                        if (shouldAdopt(current, latestChosen) && latestChosen?.type === "oauth") {
+                            return latestChosen;
+                        }
+                        return undefined;
+                    });
+                }
+                catch {
+                    // Read still returns the live Grok token if persist fails.
+                }
+            }
+            return chosen;
+        },
+        async list() {
+            const entries = new Map((await store.list()).map((entry) => [entry.providerId, entry]));
+            if (!entries.has(XAI_PROVIDER_ID) && hasGrokCliXaiAuth({ grokHome })) {
+                entries.set(XAI_PROVIDER_ID, { providerId: XAI_PROVIDER_ID, type: "oauth" });
+            }
+            return [...entries.values()];
+        },
+        modify(providerId, fn) {
+            if (providerId !== XAI_PROVIDER_ID)
+                return store.modify(providerId, fn);
+            return store.modify(providerId, async (lunrCurrent) => {
+                if (lunrCurrent?.type === "api_key")
+                    return fn(lunrCurrent);
+                const grok = readGrokCliXaiOAuth({ grokHome });
+                const chosen = chooseXaiOAuth(lunrCurrent, grok);
+                let next;
+                try {
+                    next = await fn(chosen);
+                }
+                catch (error) {
+                    const retryGrok = readGrokCliXaiOAuth({ grokHome });
+                    const canRetry = oauthRefreshFailed(error) &&
+                        retryGrok &&
+                        !(chosen?.type === "oauth" && retryGrok.refresh === chosen.refresh);
+                    if (!canRetry)
+                        throw error;
+                    try {
+                        next = await fn(retryGrok);
+                    }
+                    catch {
+                        throw error;
+                    }
+                }
+                // `undefined` means "leave the lunR row unchanged". Adopting `chosen`
+                // here wrote a rotated-out Grok refresh over a just-rotated lunR token.
+                if (next?.type === "oauth") {
+                    try {
+                        writeGrokCliXaiOAuth(next, { grokHome, onlyIfFileExists: true });
+                    }
+                    catch {
+                        // lunR persist still happens; Grok file update is best-effort.
+                    }
+                }
+                return next;
+            });
+        },
+        delete(providerId) {
+            return store.delete(providerId);
+        },
+    };
+}
+//# sourceMappingURL=grok-cli-auth.js.map

package/dist/core/grok-cli-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-cli-auth.js","sourceRoot":"","sources":["../../src/core/grok-cli-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AAEvC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAC7E,mEAAmE;AACnE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAE5E,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAU;IACtD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAAA,CAChC;AAED,MAAM,UAAU,YAAY,CAAC,QAAiB,EAAU;IACvD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AAAA,CAChD;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAQ,GAAW,sBAAsB,EAAU;IACnF,OAAO,sBAAsB,QAAQ,EAAE,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAsB;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAU;IAC5D,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAAA,CACvC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAA+B;IAC7E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,CACnD;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAA0B,EAAE,EAA+B;IACrG,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,OAAO,gBAAgB,CAAE,MAAkC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAA0B,EAAE,EAAW;IAC/E,OAAO,mBAAmB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;AAAA,CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,IAA4B,EAC5B,IAAiC,EACR;IACzB,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;AAAA,CACjC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAW;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,SAAS;QACV,CAAC;QACD,MAAM;IACP,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,CAC1D;AAED,SAAS,WAAW,CAAC,IAA4B,EAAE,MAA8B,EAAW;IAC3F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;AAAA,CACxE;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,QAAgB,EAAQ;IACtE,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC3D,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACtD,IAAI,CAAC;QACJ,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,wCAAwC;IACzC,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YAC3D,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC;YACJ,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,wCAAwC;QACzC,CAAC;IACF,CAAC;YAAS,CAAC;QACV,IAAI,CAAC;YACJ,UAAU,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACR,yCAAyC;QAC1C,CAAC;IACF,CAAC;AAAA,CACD;AAED,SAAS,eAAe,CAAC,QAAgB,EAAc;IACtD,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC;YACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;gBAC7D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBACnD,MAAM,KAAK,CAAC;YACb,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;gBACrC,4CAA4C;YAC7C,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAO,SAAmB,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAAA,CAChF;AAED,MAAM,UAAU,oBAAoB,CACnC,UAA2B,EAC3B,OAAO,GAAsD,EAAE,EACrD;IACV,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAY,CAAC;YACtE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,IAAI,GAAG,MAAiC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,8DAA8D;YAC9D,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GACb,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,CAAC,CAAE,IAAI,CAAC,GAAG,CAA6B;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IACC,QAAQ;YACR,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;YACvC,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,eAAe,EACtD,CAAC;YACF,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG;YACX,GAAG,QAAQ;YACX,GAAG,EAAE,UAAU,CAAC,MAAM;YACtB,aAAa,EAAE,UAAU,CAAC,OAAO;YACjC,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,OAAO,CAAC;SACnD,CAAC;QACF,mBAAmB,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,EAAE,CAAC;YACX,CAAC;YAAC,MAAM,CAAC;gBACR,yBAAyB;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;AAAA,CACD;AAED,MAAM,UAAU,yBAAyB,CACxC,KAAsB,EACtB,OAAO,GAA0B,EAAE,EACjB;IAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAmC;YAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,UAAU,KAAK,eAAe;gBAAE,OAAO,MAAM,CAAC;YAClD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;YAC9C,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACJ,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;wBACjD,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;4BAAE,OAAO,SAAS,CAAC;wBAClD,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;wBACrD,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;wBACzD,IAAI,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;4BAC1E,OAAO,YAAY,CAAC;wBACrB,CAAC;wBACD,OAAO,SAAS,CAAC;oBAAA,CACjB,CAAC,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACR,2DAA2D;gBAC5D,CAAC;YACF,CAAC;YACD,OAAO,MAAM,CAAC;QAAA,CACd;QACD,KAAK,CAAC,IAAI,GAAuC;YAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAAA,CAC7B;QACD,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE;YACtB,IAAI,UAAU,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;gBACtD,IAAI,WAAW,EAAE,IAAI,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;gBAC5D,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACjD,IAAI,IAA4B,CAAC;gBACjC,IAAI,CAAC;oBACJ,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACpD,MAAM,QAAQ,GACb,kBAAkB,CAAC,KAAK,CAAC;wBACzB,SAAS;wBACT,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC;oBACrE,IAAI,CAAC,QAAQ;wBAAE,MAAM,KAAK,CAAC;oBAC3B,IAAI,CAAC;wBACJ,IAAI,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC5B,CAAC;oBAAC,MAAM,CAAC;wBACR,MAAM,KAAK,CAAC;oBACb,CAAC;gBACF,CAAC;gBACD,sEAAsE;gBACtE,wEAAwE;gBACxE,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACJ,oBAAoB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClE,CAAC;oBAAC,MAAM,CAAC;wBACR,+DAA+D;oBAChE,CAAC;gBACF,CAAC;gBACD,OAAO,IAAI,CAAC;YAAA,CACZ,CAAC,CAAC;QAAA,CACH;QACD,MAAM,CAAC,UAAkB,EAAiB;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAAA,CAChC;KACD,CAAC;AAAA,CACF","sourcesContent":["/**\n * Official Grok CLI SuperGrok session (`~/.grok/auth.json`).\n *\n * lunR and Grok CLI share xAI client `b1a00492-073a-47ea-816f-4c329264a828`.\n * xAI rotates refresh tokens and revokes the family on reuse, so this module\n * must never write a rotated-out refresh back over a newer one.\n */\n\nimport { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport type { Credential, CredentialInfo, CredentialStore, OAuthCredential } from \"@ashx-j/lunr-ai\";\nimport lockfile from \"proper-lockfile\";\n\nexport const XAI_PROVIDER_ID = \"xai\";\n/** Same client as packages/ai/src/auth/oauth/xai.ts `XAI_CLIENT_ID`. */\nexport const XAI_GROK_CLI_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\";\n/** Matches packages/ai/src/auth/oauth/xai.ts `REFRESH_SKEW_MS`. */\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\n\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\nexport function grokHomeDir(grokHome?: string): string {\n\tif (grokHome) return grokHome;\n\tconst fromEnv = process.env.GROK_HOME?.trim();\n\tif (fromEnv) return fromEnv;\n\treturn join(homedir(), \".grok\");\n}\n\nexport function grokAuthPath(grokHome?: string): string {\n\treturn join(grokHomeDir(grokHome), \"auth.json\");\n}\n\nexport function grokOidcEntryKey(clientId: string = XAI_GROK_CLI_CLIENT_ID): string {\n\treturn `https://auth.x.ai::${clientId}`;\n}\n\nexport function parseGrokExpiresAt(value: unknown): number | undefined {\n\tif (typeof value === \"number\" && Number.isFinite(value) && value > 0) {\n\t\treturn value < 1e12 ? Math.round(value * 1000) : Math.round(value);\n\t}\n\tif (typeof value === \"string\" && value.trim()) {\n\t\tconst numeric = Number(value);\n\t\tif (Number.isFinite(numeric) && numeric > 0) {\n\t\t\treturn numeric < 1e12 ? Math.round(numeric * 1000) : Math.round(numeric);\n\t\t}\n\t\tconst parsed = Date.parse(value);\n\t\tif (Number.isFinite(parsed)) return parsed;\n\t}\n\treturn undefined;\n}\n\n/** Grok CLI deserializes `expires_at` as RFC3339, not epoch ms. */\nexport function formatGrokExpiresAt(expires: number): string {\n\treturn new Date(expires).toISOString();\n}\n\nexport function grokEntryToOAuth(entry: unknown): OAuthCredential | undefined {\n\tif (!entry || typeof entry !== \"object\" || Array.isArray(entry)) return undefined;\n\tconst record = entry as Record<string, unknown>;\n\tconst access = typeof record.key === \"string\" ? record.key : undefined;\n\tconst refresh = typeof record.refresh_token === \"string\" ? record.refresh_token : undefined;\n\tconst expires = parseGrokExpiresAt(record.expires_at);\n\tif (!access || !refresh || expires === undefined) return undefined;\n\treturn { type: \"oauth\", access, refresh, expires };\n}\n\nexport function readGrokCliXaiOAuth(options: { grokHome?: string } = {}): OAuthCredential | undefined {\n\ttry {\n\t\tconst raw = readFileSync(grokAuthPath(options.grokHome), \"utf-8\");\n\t\tconst parsed = JSON.parse(raw) as unknown;\n\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return undefined;\n\t\treturn grokEntryToOAuth((parsed as Record<string, unknown>)[grokOidcEntryKey()]);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function hasGrokCliXaiAuth(options: { grokHome?: string } = {}): boolean {\n\treturn readGrokCliXaiOAuth(options) !== undefined;\n}\n\n/**\n * Pick the live SuperGrok session.\n *\n * lunR stores `expires` 5 minutes early. Grok CLI stores the server expiry.\n * A raw `>=` compare therefore treats a just-rotated lunR token as older than\n * the still-unrotated Grok file and writes the dead refresh back. When both\n * look live and the refresh tokens differ, keep lunR; `modify` retries Grok\n * only after `invalid_grant`.\n */\nexport function chooseXaiOAuth(\n\tlunr: Credential | undefined,\n\tgrok: OAuthCredential | undefined,\n): Credential | undefined {\n\tif (lunr?.type === \"api_key\") return lunr;\n\tconst lunrOAuth = lunr?.type === \"oauth\" ? lunr : undefined;\n\tif (lunrOAuth && grok) {\n\t\tif (lunrOAuth.refresh === grok.refresh) {\n\t\t\treturn grok.expires >= lunrOAuth.expires ? grok : lunrOAuth;\n\t\t}\n\t\tconst now = Date.now();\n\t\tconst lunrLive = now < lunrOAuth.expires;\n\t\tconst grokLive = now < grok.expires;\n\t\tif (grokLive && !lunrLive) return grok;\n\t\tif (lunrLive && !grokLive) return lunrOAuth;\n\t\tif (!lunrLive && !grokLive) return grok.expires >= lunrOAuth.expires ? grok : lunrOAuth;\n\t\treturn lunrOAuth;\n\t}\n\treturn grok ?? lunrOAuth ?? lunr;\n}\n\nfunction oauthRefreshFailed(error: unknown): boolean {\n\tconst parts: string[] = [];\n\tlet current: unknown = error;\n\tconst seen = new Set<unknown>();\n\twhile (current && typeof current === \"object\" && !seen.has(current)) {\n\t\tseen.add(current);\n\t\tif (current instanceof Error) {\n\t\t\tparts.push(current.message);\n\t\t\tcurrent = current.cause;\n\t\t\tcontinue;\n\t\t}\n\t\tbreak;\n\t}\n\tconst chain = parts.join(\" \");\n\tif (/timed out|aborted|cancelled|ECONN|ENOTFOUND|network/i.test(chain)) return false;\n\treturn /invalid_grant|refresh token revoked/i.test(chain);\n}\n\nfunction shouldAdopt(lunr: Credential | undefined, chosen: Credential | undefined): boolean {\n\tif (!chosen || chosen.type !== \"oauth\") return false;\n\tif (!lunr || lunr.type !== \"oauth\") return true;\n\treturn lunr.access !== chosen.access || lunr.refresh !== chosen.refresh;\n}\n\nfunction writeAuthFileAtomic(authPath: string, contents: string): void {\n\tconst tmp = `${authPath}.${process.pid}.${Date.now()}.tmp`;\n\twriteFileSync(tmp, contents, AUTH_FILE_WRITE_OPTIONS);\n\ttry {\n\t\tchmodSync(tmp, 0o600);\n\t} catch {\n\t\t// mode bits are best-effort on Windows.\n\t}\n\ttry {\n\t\tif (process.platform === \"win32\" && existsSync(authPath)) {\n\t\t\twriteFileSync(authPath, contents, AUTH_FILE_WRITE_OPTIONS);\n\t\t\tchmodSync(authPath, 0o600);\n\t\t\treturn;\n\t\t}\n\t\trenameSync(tmp, authPath);\n\t\ttry {\n\t\t\tchmodSync(authPath, 0o600);\n\t\t} catch {\n\t\t\t// mode bits are best-effort on Windows.\n\t\t}\n\t} finally {\n\t\ttry {\n\t\t\tunlinkSync(tmp);\n\t\t} catch {\n\t\t\t// tmp already renamed, or never created.\n\t\t}\n\t}\n}\n\nfunction acquireGrokLock(authPath: string): () => void {\n\tconst maxAttempts = 10;\n\tconst delayMs = 20;\n\tlet lastError: unknown;\n\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\ttry {\n\t\t\treturn lockfile.lockSync(authPath, { realpath: false, stale: 120_000 });\n\t\t} catch (error) {\n\t\t\tconst code =\n\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t: undefined;\n\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tlastError = error;\n\t\t\tconst start = Date.now();\n\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t// Sleep synchronously to match AuthStorage.\n\t\t\t}\n\t\t}\n\t}\n\tthrow (lastError as Error) ?? new Error(\"Failed to acquire Grok CLI auth lock\");\n}\n\nexport function writeGrokCliXaiOAuth(\n\tcredential: OAuthCredential,\n\toptions: { grokHome?: string; onlyIfFileExists?: boolean } = {},\n): boolean {\n\tconst authPath = grokAuthPath(options.grokHome);\n\tif (options.onlyIfFileExists !== false && !existsSync(authPath)) return false;\n\n\tconst dir = dirname(authPath);\n\tif (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });\n\tif (!existsSync(authPath)) {\n\t\twriteAuthFileAtomic(authPath, \"{}\\n\");\n\t}\n\n\tlet release: (() => void) | undefined;\n\ttry {\n\t\trelease = acquireGrokLock(authPath);\n\t\tlet data: Record<string, unknown> = {};\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(readFileSync(authPath, \"utf-8\")) as unknown;\n\t\t\tif (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n\t\t\t\tdata = parsed as Record<string, unknown>;\n\t\t\t} else {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t} catch {\n\t\t\t// Never replace a corrupt Grok file with a single-entry stub.\n\t\t\treturn false;\n\t\t}\n\t\tconst key = grokOidcEntryKey();\n\t\tconst previous =\n\t\t\tdata[key] && typeof data[key] === \"object\" && !Array.isArray(data[key])\n\t\t\t\t? (data[key] as Record<string, unknown>)\n\t\t\t\t: {};\n\t\tconst existing = grokEntryToOAuth(previous);\n\t\tif (\n\t\t\texisting &&\n\t\t\texisting.refresh !== credential.refresh &&\n\t\t\texisting.expires > credential.expires + REFRESH_SKEW_MS\n\t\t) {\n\t\t\t// Disk already has a newer family (usually a later `grok login`).\n\t\t\treturn false;\n\t\t}\n\t\tdata[key] = {\n\t\t\t...previous,\n\t\t\tkey: credential.access,\n\t\t\trefresh_token: credential.refresh,\n\t\t\texpires_at: formatGrokExpiresAt(credential.expires),\n\t\t};\n\t\twriteAuthFileAtomic(authPath, `${JSON.stringify(data, null, 2)}\\n`);\n\t\treturn true;\n\t} finally {\n\t\tif (release) {\n\t\t\ttry {\n\t\t\t\trelease();\n\t\t\t} catch {\n\t\t\t\t// Unlock is best-effort.\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport function wrapXaiGrokCliCredentials(\n\tstore: CredentialStore,\n\toptions: { grokHome?: string } = {},\n): CredentialStore {\n\tconst grokHome = options.grokHome;\n\treturn {\n\t\tasync read(providerId: string): Promise<Credential | undefined> {\n\t\t\tconst stored = await store.read(providerId);\n\t\t\tif (providerId !== XAI_PROVIDER_ID) return stored;\n\t\t\tif (stored?.type === \"api_key\") return stored;\n\t\t\tconst grok = readGrokCliXaiOAuth({ grokHome });\n\t\t\tconst chosen = chooseXaiOAuth(stored, grok);\n\t\t\tif (shouldAdopt(stored, chosen) && chosen?.type === \"oauth\") {\n\t\t\t\ttry {\n\t\t\t\t\tawait store.modify(providerId, async (current) => {\n\t\t\t\t\t\tif (current?.type === \"api_key\") return undefined;\n\t\t\t\t\t\tconst latestGrok = readGrokCliXaiOAuth({ grokHome });\n\t\t\t\t\t\tconst latestChosen = chooseXaiOAuth(current, latestGrok);\n\t\t\t\t\t\tif (shouldAdopt(current, latestChosen) && latestChosen?.type === \"oauth\") {\n\t\t\t\t\t\t\treturn latestChosen;\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn undefined;\n\t\t\t\t\t});\n\t\t\t\t} catch {\n\t\t\t\t\t// Read still returns the live Grok token if persist fails.\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn chosen;\n\t\t},\n\t\tasync list(): Promise<readonly CredentialInfo[]> {\n\t\t\tconst entries = new Map((await store.list()).map((entry) => [entry.providerId, entry]));\n\t\t\tif (!entries.has(XAI_PROVIDER_ID) && hasGrokCliXaiAuth({ grokHome })) {\n\t\t\t\tentries.set(XAI_PROVIDER_ID, { providerId: XAI_PROVIDER_ID, type: \"oauth\" });\n\t\t\t}\n\t\t\treturn [...entries.values()];\n\t\t},\n\t\tmodify(providerId, fn) {\n\t\t\tif (providerId !== XAI_PROVIDER_ID) return store.modify(providerId, fn);\n\t\t\treturn store.modify(providerId, async (lunrCurrent) => {\n\t\t\t\tif (lunrCurrent?.type === \"api_key\") return fn(lunrCurrent);\n\t\t\t\tconst grok = readGrokCliXaiOAuth({ grokHome });\n\t\t\t\tconst chosen = chooseXaiOAuth(lunrCurrent, grok);\n\t\t\t\tlet next: Credential | undefined;\n\t\t\t\ttry {\n\t\t\t\t\tnext = await fn(chosen);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst retryGrok = readGrokCliXaiOAuth({ grokHome });\n\t\t\t\t\tconst canRetry =\n\t\t\t\t\t\toauthRefreshFailed(error) &&\n\t\t\t\t\t\tretryGrok &&\n\t\t\t\t\t\t!(chosen?.type === \"oauth\" && retryGrok.refresh === chosen.refresh);\n\t\t\t\t\tif (!canRetry) throw error;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tnext = await fn(retryGrok);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\t// `undefined` means \"leave the lunR row unchanged\". Adopting `chosen`\n\t\t\t\t// here wrote a rotated-out Grok refresh over a just-rotated lunR token.\n\t\t\t\tif (next?.type === \"oauth\") {\n\t\t\t\t\ttry {\n\t\t\t\t\t\twriteGrokCliXaiOAuth(next, { grokHome, onlyIfFileExists: true });\n\t\t\t\t\t} catch {\n\t\t\t\t\t\t// lunR persist still happens; Grok file update is best-effort.\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn next;\n\t\t\t});\n\t\t},\n\t\tdelete(providerId: string): Promise<void> {\n\t\t\treturn store.delete(providerId);\n\t\t},\n\t};\n}\n"]}

package/dist/core/http-dispatcher.d.ts

@@ -0,0 +1,22 @@
+export declare const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300000;
+export declare const HTTP_IDLE_TIMEOUT_CHOICES: readonly [{
+    readonly label: "30 sec";
+    readonly timeoutMs: 30000;
+}, {
+    readonly label: "1 min";
+    readonly timeoutMs: 60000;
+}, {
+    readonly label: "2 min";
+    readonly timeoutMs: 120000;
+}, {
+    readonly label: "5 min";
+    readonly timeoutMs: 300000;
+}, {
+    readonly label: "disabled";
+    readonly timeoutMs: 0;
+}];
+export declare function parseHttpIdleTimeoutMs(value: unknown): number | undefined;
+export declare function formatHttpIdleTimeoutMs(timeoutMs: number): string;
+export declare function applyHttpProxySettings(httpProxy: string | undefined): void;
+export declare function configureHttpDispatcher(timeoutMs?: number): void;
+//# sourceMappingURL=http-dispatcher.d.ts.map

package/dist/core/http-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-dispatcher.d.ts","sourceRoot":"","sources":["../../src/core/http-dispatcher.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAEpD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;EAM5B,CAAC;AAKX,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAgBzE;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMjE;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAK1E;AA+BD,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAqC,GAAG,IAAI,CA2B9F","sourcesContent":["import { EventEmitter } from \"node:events\";\nimport * as undici from \"undici\";\n\nexport const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;\n\nexport const HTTP_IDLE_TIMEOUT_CHOICES = [\n\t{ label: \"30 sec\", timeoutMs: 30_000 },\n\t{ label: \"1 min\", timeoutMs: 60_000 },\n\t{ label: \"2 min\", timeoutMs: 120_000 },\n\t{ label: \"5 min\", timeoutMs: 300_000 },\n\t{ label: \"disabled\", timeoutMs: 0 },\n] as const;\n\nconst originalGlobalFetch = globalThis.fetch;\nlet installedGlobalFetch: typeof globalThis.fetch | undefined;\n\nexport function parseHttpIdleTimeoutMs(value: unknown): number | undefined {\n\tif (typeof value === \"string\") {\n\t\tconst trimmed = value.trim();\n\t\tif (trimmed.toLowerCase() === \"disabled\") {\n\t\t\treturn 0;\n\t\t}\n\t\tif (trimmed.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn parseHttpIdleTimeoutMs(Number(trimmed));\n\t}\n\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n\t\treturn undefined;\n\t}\n\treturn Math.floor(value);\n}\n\nexport function formatHttpIdleTimeoutMs(timeoutMs: number): string {\n\tconst choice = HTTP_IDLE_TIMEOUT_CHOICES.find((item) => item.timeoutMs === timeoutMs);\n\tif (choice) {\n\t\treturn choice.label;\n\t}\n\treturn `${timeoutMs / 1000} sec`;\n}\n\nexport function applyHttpProxySettings(httpProxy: string | undefined): void {\n\tconst proxy = httpProxy?.trim();\n\tif (!proxy) return;\n\tprocess.env.HTTP_PROXY ??= proxy;\n\tprocess.env.HTTPS_PROXY ??= proxy;\n}\n\nconst ignoreUndiciDispatcherError = (_error: unknown): void => {};\n\n// Undici can emit an internal Client \"error\" while terminating a mid-stream\n// fetch body. The body stream still rejects through reader.read(); this listener\n// only prevents EventEmitter's unhandled \"error\" special case from crashing pi.\nfunction withUndiciErrorListener<T extends undici.Dispatcher>(dispatcher: T): T {\n\tif (dispatcher instanceof EventEmitter) {\n\t\tEventEmitter.prototype.on.call(dispatcher, \"error\", ignoreUndiciDispatcherError);\n\t}\n\treturn dispatcher;\n}\n\nfunction createUndiciClient(origin: string | URL, options: object): undici.Dispatcher {\n\treturn withUndiciErrorListener(new undici.Client(origin, options as undici.Client.Options));\n}\n\nfunction createUndiciOriginDispatcher(origin: string | URL, options: object): undici.Dispatcher {\n\tconst dispatcherOptions = options as undici.Pool.Options;\n\tif (dispatcherOptions.connections === 1) {\n\t\treturn createUndiciClient(origin, dispatcherOptions);\n\t}\n\treturn withUndiciErrorListener(\n\t\tnew undici.Pool(origin, {\n\t\t\t...dispatcherOptions,\n\t\t\tfactory: createUndiciClient,\n\t\t}),\n\t);\n}\n\nexport function configureHttpDispatcher(timeoutMs: number = DEFAULT_HTTP_IDLE_TIMEOUT_MS): void {\n\tconst normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);\n\tif (normalizedTimeoutMs === undefined) {\n\t\tthrow new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);\n\t}\n\tconst dispatcher = withUndiciErrorListener(\n\t\tnew undici.EnvHttpProxyAgent({\n\t\t\tallowH2: false,\n\t\t\tbodyTimeout: normalizedTimeoutMs,\n\t\t\theadersTimeout: normalizedTimeoutMs,\n\t\t\tclientFactory: createUndiciClient,\n\t\t\tfactory: createUndiciOriginDispatcher,\n\t\t}),\n\t);\n\tundici.setGlobalDispatcher(dispatcher);\n\t// Keep fetch and the dispatcher on the same undici implementation. Node 26.0's\n\t// bundled fetch can otherwise consume compressed responses through npm undici's\n\t// dispatcher without decompressing them, causing response.json() failures.\n\t// If a caller replaced fetch after module load, preserve that deliberate override.\n\tconst shouldInstallGlobals =\n\t\tinstalledGlobalFetch === undefined\n\t\t\t? globalThis.fetch === originalGlobalFetch\n\t\t\t: globalThis.fetch === installedGlobalFetch;\n\tif (shouldInstallGlobals) {\n\t\tundici.install?.();\n\t\tinstalledGlobalFetch = globalThis.fetch;\n\t}\n}\n"]}

package/dist/core/http-dispatcher.js

@@ -0,0 +1,91 @@
+import { EventEmitter } from "node:events";
+import * as undici from "undici";
+export const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;
+export const HTTP_IDLE_TIMEOUT_CHOICES = [
+    { label: "30 sec", timeoutMs: 30_000 },
+    { label: "1 min", timeoutMs: 60_000 },
+    { label: "2 min", timeoutMs: 120_000 },
+    { label: "5 min", timeoutMs: 300_000 },
+    { label: "disabled", timeoutMs: 0 },
+];
+const originalGlobalFetch = globalThis.fetch;
+let installedGlobalFetch;
+export function parseHttpIdleTimeoutMs(value) {
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (trimmed.toLowerCase() === "disabled") {
+            return 0;
+        }
+        if (trimmed.length === 0) {
+            return undefined;
+        }
+        return parseHttpIdleTimeoutMs(Number(trimmed));
+    }
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        return undefined;
+    }
+    return Math.floor(value);
+}
+export function formatHttpIdleTimeoutMs(timeoutMs) {
+    const choice = HTTP_IDLE_TIMEOUT_CHOICES.find((item) => item.timeoutMs === timeoutMs);
+    if (choice) {
+        return choice.label;
+    }
+    return `${timeoutMs / 1000} sec`;
+}
+export function applyHttpProxySettings(httpProxy) {
+    const proxy = httpProxy?.trim();
+    if (!proxy)
+        return;
+    process.env.HTTP_PROXY ??= proxy;
+    process.env.HTTPS_PROXY ??= proxy;
+}
+const ignoreUndiciDispatcherError = (_error) => { };
+// Undici can emit an internal Client "error" while terminating a mid-stream
+// fetch body. The body stream still rejects through reader.read(); this listener
+// only prevents EventEmitter's unhandled "error" special case from crashing pi.
+function withUndiciErrorListener(dispatcher) {
+    if (dispatcher instanceof EventEmitter) {
+        EventEmitter.prototype.on.call(dispatcher, "error", ignoreUndiciDispatcherError);
+    }
+    return dispatcher;
+}
+function createUndiciClient(origin, options) {
+    return withUndiciErrorListener(new undici.Client(origin, options));
+}
+function createUndiciOriginDispatcher(origin, options) {
+    const dispatcherOptions = options;
+    if (dispatcherOptions.connections === 1) {
+        return createUndiciClient(origin, dispatcherOptions);
+    }
+    return withUndiciErrorListener(new undici.Pool(origin, {
+        ...dispatcherOptions,
+        factory: createUndiciClient,
+    }));
+}
+export function configureHttpDispatcher(timeoutMs = DEFAULT_HTTP_IDLE_TIMEOUT_MS) {
+    const normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);
+    if (normalizedTimeoutMs === undefined) {
+        throw new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);
+    }
+    const dispatcher = withUndiciErrorListener(new undici.EnvHttpProxyAgent({
+        allowH2: false,
+        bodyTimeout: normalizedTimeoutMs,
+        headersTimeout: normalizedTimeoutMs,
+        clientFactory: createUndiciClient,
+        factory: createUndiciOriginDispatcher,
+    }));
+    undici.setGlobalDispatcher(dispatcher);
+    // Keep fetch and the dispatcher on the same undici implementation. Node 26.0's
+    // bundled fetch can otherwise consume compressed responses through npm undici's
+    // dispatcher without decompressing them, causing response.json() failures.
+    // If a caller replaced fetch after module load, preserve that deliberate override.
+    const shouldInstallGlobals = installedGlobalFetch === undefined
+        ? globalThis.fetch === originalGlobalFetch
+        : globalThis.fetch === installedGlobalFetch;
+    if (shouldInstallGlobals) {
+        undici.install?.();
+        installedGlobalFetch = globalThis.fetch;
+    }
+}
+//# sourceMappingURL=http-dispatcher.js.map

package/dist/core/http-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-dispatcher.js","sourceRoot":"","sources":["../../src/core/http-dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;IACrC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;IACtC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;IACtC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE;CAC1B,CAAC;AAEX,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC;AAC7C,IAAI,oBAAyD,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAsB;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAAA,CACzB;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAU;IAClE,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtF,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,SAAS,GAAG,IAAI,MAAM,CAAC;AAAA,CACjC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAA6B,EAAQ;IAC3E,MAAM,KAAK,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC;AAAA,CAClC;AAED,MAAM,2BAA2B,GAAG,CAAC,MAAe,EAAQ,EAAE,CAAC,EAAC,CAAC,CAAC;AAElE,4EAA4E;AAC5E,iFAAiF;AACjF,gFAAgF;AAChF,SAAS,uBAAuB,CAA8B,UAAa,EAAK;IAC/E,IAAI,UAAU,YAAY,YAAY,EAAE,CAAC;QACxC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,kBAAkB,CAAC,MAAoB,EAAE,OAAe,EAAqB;IACrF,OAAO,uBAAuB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAgC,CAAC,CAAC,CAAC;AAAA,CAC5F;AAED,SAAS,4BAA4B,CAAC,MAAoB,EAAE,OAAe,EAAqB;IAC/F,MAAM,iBAAiB,GAAG,OAA8B,CAAC;IACzD,IAAI,iBAAiB,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,uBAAuB,CAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QACvB,GAAG,iBAAiB;QACpB,OAAO,EAAE,kBAAkB;KAC3B,CAAC,CACF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAS,GAAW,4BAA4B,EAAQ;IAC/F,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CACzC,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC5B,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,mBAAmB;QAChC,cAAc,EAAE,mBAAmB;QACnC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,4BAA4B;KACrC,CAAC,CACF,CAAC;IACF,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvC,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,oBAAoB,GACzB,oBAAoB,KAAK,SAAS;QACjC,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,mBAAmB;QAC1C,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,oBAAoB,CAAC;IAC9C,IAAI,oBAAoB,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC;IACzC,CAAC;AAAA,CACD","sourcesContent":["import { EventEmitter } from \"node:events\";\nimport * as undici from \"undici\";\n\nexport const DEFAULT_HTTP_IDLE_TIMEOUT_MS = 300_000;\n\nexport const HTTP_IDLE_TIMEOUT_CHOICES = [\n\t{ label: \"30 sec\", timeoutMs: 30_000 },\n\t{ label: \"1 min\", timeoutMs: 60_000 },\n\t{ label: \"2 min\", timeoutMs: 120_000 },\n\t{ label: \"5 min\", timeoutMs: 300_000 },\n\t{ label: \"disabled\", timeoutMs: 0 },\n] as const;\n\nconst originalGlobalFetch = globalThis.fetch;\nlet installedGlobalFetch: typeof globalThis.fetch | undefined;\n\nexport function parseHttpIdleTimeoutMs(value: unknown): number | undefined {\n\tif (typeof value === \"string\") {\n\t\tconst trimmed = value.trim();\n\t\tif (trimmed.toLowerCase() === \"disabled\") {\n\t\t\treturn 0;\n\t\t}\n\t\tif (trimmed.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn parseHttpIdleTimeoutMs(Number(trimmed));\n\t}\n\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n\t\treturn undefined;\n\t}\n\treturn Math.floor(value);\n}\n\nexport function formatHttpIdleTimeoutMs(timeoutMs: number): string {\n\tconst choice = HTTP_IDLE_TIMEOUT_CHOICES.find((item) => item.timeoutMs === timeoutMs);\n\tif (choice) {\n\t\treturn choice.label;\n\t}\n\treturn `${timeoutMs / 1000} sec`;\n}\n\nexport function applyHttpProxySettings(httpProxy: string | undefined): void {\n\tconst proxy = httpProxy?.trim();\n\tif (!proxy) return;\n\tprocess.env.HTTP_PROXY ??= proxy;\n\tprocess.env.HTTPS_PROXY ??= proxy;\n}\n\nconst ignoreUndiciDispatcherError = (_error: unknown): void => {};\n\n// Undici can emit an internal Client \"error\" while terminating a mid-stream\n// fetch body. The body stream still rejects through reader.read(); this listener\n// only prevents EventEmitter's unhandled \"error\" special case from crashing pi.\nfunction withUndiciErrorListener<T extends undici.Dispatcher>(dispatcher: T): T {\n\tif (dispatcher instanceof EventEmitter) {\n\t\tEventEmitter.prototype.on.call(dispatcher, \"error\", ignoreUndiciDispatcherError);\n\t}\n\treturn dispatcher;\n}\n\nfunction createUndiciClient(origin: string | URL, options: object): undici.Dispatcher {\n\treturn withUndiciErrorListener(new undici.Client(origin, options as undici.Client.Options));\n}\n\nfunction createUndiciOriginDispatcher(origin: string | URL, options: object): undici.Dispatcher {\n\tconst dispatcherOptions = options as undici.Pool.Options;\n\tif (dispatcherOptions.connections === 1) {\n\t\treturn createUndiciClient(origin, dispatcherOptions);\n\t}\n\treturn withUndiciErrorListener(\n\t\tnew undici.Pool(origin, {\n\t\t\t...dispatcherOptions,\n\t\t\tfactory: createUndiciClient,\n\t\t}),\n\t);\n}\n\nexport function configureHttpDispatcher(timeoutMs: number = DEFAULT_HTTP_IDLE_TIMEOUT_MS): void {\n\tconst normalizedTimeoutMs = parseHttpIdleTimeoutMs(timeoutMs);\n\tif (normalizedTimeoutMs === undefined) {\n\t\tthrow new Error(`Invalid HTTP idle timeout: ${String(timeoutMs)}`);\n\t}\n\tconst dispatcher = withUndiciErrorListener(\n\t\tnew undici.EnvHttpProxyAgent({\n\t\t\tallowH2: false,\n\t\t\tbodyTimeout: normalizedTimeoutMs,\n\t\t\theadersTimeout: normalizedTimeoutMs,\n\t\t\tclientFactory: createUndiciClient,\n\t\t\tfactory: createUndiciOriginDispatcher,\n\t\t}),\n\t);\n\tundici.setGlobalDispatcher(dispatcher);\n\t// Keep fetch and the dispatcher on the same undici implementation. Node 26.0's\n\t// bundled fetch can otherwise consume compressed responses through npm undici's\n\t// dispatcher without decompressing them, causing response.json() failures.\n\t// If a caller replaced fetch after module load, preserve that deliberate override.\n\tconst shouldInstallGlobals =\n\t\tinstalledGlobalFetch === undefined\n\t\t\t? globalThis.fetch === originalGlobalFetch\n\t\t\t: globalThis.fetch === installedGlobalFetch;\n\tif (shouldInstallGlobals) {\n\t\tundici.install?.();\n\t\tinstalledGlobalFetch = globalThis.fetch;\n\t}\n}\n"]}

package/dist/core/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Core modules shared between all run modes.
+ */
+export { AgentSession, type AgentSessionConfig, type AgentSessionEvent, type AgentSessionEventListener, type ModelCycleResult, type PromptOptions, type SessionStats, } from "./agent-session.ts";
+export { AgentSessionRuntime, type CreateAgentSessionRuntimeFactory, type CreateAgentSessionRuntimeResult, createAgentSessionRuntime, } from "./agent-session-runtime.ts";
+export { type AgentSessionRuntimeDiagnostic, type AgentSessionServices, type CreateAgentSessionFromServicesOptions, type CreateAgentSessionServicesOptions, createAgentSessionFromServices, createAgentSessionServices, } from "./agent-session-services.ts";
+export { type BashExecutorOptions, type BashResult, executeBashWithOperations } from "./bash-executor.ts";
+export type { CompactionResult } from "./compaction/index.ts";
+export { createEventBus, type EventBus, type EventBusController } from "./event-bus.ts";
+export { areExperimentalFeaturesEnabled } from "./experimental.ts";
+export { type AgentEndEvent, type AgentSettledEvent, type AgentStartEvent, type AgentToolResult, type AgentToolUpdateCallback, type BeforeAgentStartEvent, type BeforeAgentStartEventResult, type BuildSystemPromptOptions, type ContextEvent, defineTool, discoverAndLoadExtensions, type ExecOptions, type ExecResult, type Extension, type ExtensionAPI, type ExtensionCommandContext, type ExtensionContext, type ExtensionError, type ExtensionEvent, type ExtensionFactory, type ExtensionFlag, type ExtensionHandler, ExtensionRunner, type ExtensionShortcut, type ExtensionUIContext, type InlineExtension, type LoadExtensionsResult, type MessageRenderer, type RegisteredCommand, type SessionBeforeCompactEvent, type SessionBeforeForkEvent, type SessionBeforeSwitchEvent, type SessionBeforeTreeEvent, type SessionCompactEvent, type SessionShutdownEvent, type SessionStartEvent, type SessionTreeEvent, type ToolCallEvent, type ToolCallEventResult, type ToolDefinition, type ToolRenderResultOptions, type ToolResultEvent, type TurnEndEvent, type TurnStartEvent, type WorkingIndicatorOptions, } from "./extensions/index.ts";
+export { createSyntheticSourceInfo } from "./source-info.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACN,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,mBAAmB,EACnB,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,yBAAyB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,qCAAqC,EAC1C,KAAK,iCAAiC,EACtC,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,UAAU,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,YAAY,EACjB,UAAU,EACV,yBAAyB,EACzB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,uBAAuB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["/**\n * Core modules shared between all run modes.\n */\n\nexport {\n\tAgentSession,\n\ttype AgentSessionConfig,\n\ttype AgentSessionEvent,\n\ttype AgentSessionEventListener,\n\ttype ModelCycleResult,\n\ttype PromptOptions,\n\ttype SessionStats,\n} from \"./agent-session.ts\";\nexport {\n\tAgentSessionRuntime,\n\ttype CreateAgentSessionRuntimeFactory,\n\ttype CreateAgentSessionRuntimeResult,\n\tcreateAgentSessionRuntime,\n} from \"./agent-session-runtime.ts\";\nexport {\n\ttype AgentSessionRuntimeDiagnostic,\n\ttype AgentSessionServices,\n\ttype CreateAgentSessionFromServicesOptions,\n\ttype CreateAgentSessionServicesOptions,\n\tcreateAgentSessionFromServices,\n\tcreateAgentSessionServices,\n} from \"./agent-session-services.ts\";\nexport { type BashExecutorOptions, type BashResult, executeBashWithOperations } from \"./bash-executor.ts\";\nexport type { CompactionResult } from \"./compaction/index.ts\";\nexport { createEventBus, type EventBus, type EventBusController } from \"./event-bus.ts\";\nexport { areExperimentalFeaturesEnabled } from \"./experimental.ts\";\n// Extensions system\nexport {\n\ttype AgentEndEvent,\n\ttype AgentSettledEvent,\n\ttype AgentStartEvent,\n\ttype AgentToolResult,\n\ttype AgentToolUpdateCallback,\n\ttype BeforeAgentStartEvent,\n\ttype BeforeAgentStartEventResult,\n\ttype BuildSystemPromptOptions,\n\ttype ContextEvent,\n\tdefineTool,\n\tdiscoverAndLoadExtensions,\n\ttype ExecOptions,\n\ttype ExecResult,\n\ttype Extension,\n\ttype ExtensionAPI,\n\ttype ExtensionCommandContext,\n\ttype ExtensionContext,\n\ttype ExtensionError,\n\ttype ExtensionEvent,\n\ttype ExtensionFactory,\n\ttype ExtensionFlag,\n\ttype ExtensionHandler,\n\tExtensionRunner,\n\ttype ExtensionShortcut,\n\ttype ExtensionUIContext,\n\ttype InlineExtension,\n\ttype LoadExtensionsResult,\n\ttype MessageRenderer,\n\ttype RegisteredCommand,\n\ttype SessionBeforeCompactEvent,\n\ttype SessionBeforeForkEvent,\n\ttype SessionBeforeSwitchEvent,\n\ttype SessionBeforeTreeEvent,\n\ttype SessionCompactEvent,\n\ttype SessionShutdownEvent,\n\ttype SessionStartEvent,\n\ttype SessionTreeEvent,\n\ttype ToolCallEvent,\n\ttype ToolCallEventResult,\n\ttype ToolDefinition,\n\ttype ToolRenderResultOptions,\n\ttype ToolResultEvent,\n\ttype TurnEndEvent,\n\ttype TurnStartEvent,\n\ttype WorkingIndicatorOptions,\n} from \"./extensions/index.ts\";\nexport { createSyntheticSourceInfo } from \"./source-info.ts\";\n"]}

package/dist/core/index.js

@@ -0,0 +1,13 @@
+/**
+ * Core modules shared between all run modes.
+ */
+export { AgentSession, } from "./agent-session.js";
+export { AgentSessionRuntime, createAgentSessionRuntime, } from "./agent-session-runtime.js";
+export { createAgentSessionFromServices, createAgentSessionServices, } from "./agent-session-services.js";
+export { executeBashWithOperations } from "./bash-executor.js";
+export { createEventBus } from "./event-bus.js";
+export { areExperimentalFeaturesEnabled } from "./experimental.js";
+// Extensions system
+export { defineTool, discoverAndLoadExtensions, ExtensionRunner, } from "./extensions/index.js";
+export { createSyntheticSourceInfo } from "./source-info.js";
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACN,YAAY,GAOZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,mBAAmB,EAGnB,yBAAyB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAA6C,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,OAAO,EAAE,cAAc,EAA0C,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,oBAAoB;AACpB,OAAO,EAUN,UAAU,EACV,yBAAyB,EAYzB,eAAe,GAuBf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["/**\n * Core modules shared between all run modes.\n */\n\nexport {\n\tAgentSession,\n\ttype AgentSessionConfig,\n\ttype AgentSessionEvent,\n\ttype AgentSessionEventListener,\n\ttype ModelCycleResult,\n\ttype PromptOptions,\n\ttype SessionStats,\n} from \"./agent-session.ts\";\nexport {\n\tAgentSessionRuntime,\n\ttype CreateAgentSessionRuntimeFactory,\n\ttype CreateAgentSessionRuntimeResult,\n\tcreateAgentSessionRuntime,\n} from \"./agent-session-runtime.ts\";\nexport {\n\ttype AgentSessionRuntimeDiagnostic,\n\ttype AgentSessionServices,\n\ttype CreateAgentSessionFromServicesOptions,\n\ttype CreateAgentSessionServicesOptions,\n\tcreateAgentSessionFromServices,\n\tcreateAgentSessionServices,\n} from \"./agent-session-services.ts\";\nexport { type BashExecutorOptions, type BashResult, executeBashWithOperations } from \"./bash-executor.ts\";\nexport type { CompactionResult } from \"./compaction/index.ts\";\nexport { createEventBus, type EventBus, type EventBusController } from \"./event-bus.ts\";\nexport { areExperimentalFeaturesEnabled } from \"./experimental.ts\";\n// Extensions system\nexport {\n\ttype AgentEndEvent,\n\ttype AgentSettledEvent,\n\ttype AgentStartEvent,\n\ttype AgentToolResult,\n\ttype AgentToolUpdateCallback,\n\ttype BeforeAgentStartEvent,\n\ttype BeforeAgentStartEventResult,\n\ttype BuildSystemPromptOptions,\n\ttype ContextEvent,\n\tdefineTool,\n\tdiscoverAndLoadExtensions,\n\ttype ExecOptions,\n\ttype ExecResult,\n\ttype Extension,\n\ttype ExtensionAPI,\n\ttype ExtensionCommandContext,\n\ttype ExtensionContext,\n\ttype ExtensionError,\n\ttype ExtensionEvent,\n\ttype ExtensionFactory,\n\ttype ExtensionFlag,\n\ttype ExtensionHandler,\n\tExtensionRunner,\n\ttype ExtensionShortcut,\n\ttype ExtensionUIContext,\n\ttype InlineExtension,\n\ttype LoadExtensionsResult,\n\ttype MessageRenderer,\n\ttype RegisteredCommand,\n\ttype SessionBeforeCompactEvent,\n\ttype SessionBeforeForkEvent,\n\ttype SessionBeforeSwitchEvent,\n\ttype SessionBeforeTreeEvent,\n\ttype SessionCompactEvent,\n\ttype SessionShutdownEvent,\n\ttype SessionStartEvent,\n\ttype SessionTreeEvent,\n\ttype ToolCallEvent,\n\ttype ToolCallEventResult,\n\ttype ToolDefinition,\n\ttype ToolRenderResultOptions,\n\ttype ToolResultEvent,\n\ttype TurnEndEvent,\n\ttype TurnStartEvent,\n\ttype WorkingIndicatorOptions,\n} from \"./extensions/index.ts\";\nexport { createSyntheticSourceInfo } from \"./source-info.ts\";\n"]}

package/dist/core/injected-prompt.d.ts

@@ -0,0 +1,20 @@
+/**
+ * lunr: detect injected prompts (/swarm, /research, /goal) so the transcript can
+ * render them collapsed instead of dumping the full multi-line prompt verbatim.
+ *
+ * These prompts become plain {role:"user"} messages (PromptOptions.source is not
+ * persisted), so detection is keyed on stable markers that already exist in the
+ * prompt bodies: the `[SWARM MODE]` / `[DEEP RESEARCH]` literal prefixes and the
+ * goal extension's `<!-- pi-goal-prompt:… -->` HTML comment. This is render-time
+ * only — the model still receives the full prompt unchanged, and old session
+ * transcripts are cleaned up retroactively with no schema migration.
+ */
+export type InjectedPromptKind = "swarm" | "research" | "goal";
+export interface InjectedPromptInfo {
+    kind: InjectedPromptKind;
+    /** One-line summary extracted from the prompt body (task / question / objective). */
+    summary: string;
+}
+export declare function detectInjectedPrompt(text: string): InjectedPromptInfo | undefined;
+export declare const INJECTED_PROMPT_LABELS: Record<InjectedPromptKind, string>;
+//# sourceMappingURL=injected-prompt.d.ts.map

package/dist/core/injected-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injected-prompt.d.ts","sourceRoot":"","sources":["../../src/core/injected-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;CAChB;AA+BD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAoBjF;AAED,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIrE,CAAC","sourcesContent":["/**\n * lunr: detect injected prompts (/swarm, /research, /goal) so the transcript can\n * render them collapsed instead of dumping the full multi-line prompt verbatim.\n *\n * These prompts become plain {role:\"user\"} messages (PromptOptions.source is not\n * persisted), so detection is keyed on stable markers that already exist in the\n * prompt bodies: the `[SWARM MODE]` / `[DEEP RESEARCH]` literal prefixes and the\n * goal extension's `<!-- pi-goal-prompt:… -->` HTML comment. This is render-time\n * only — the model still receives the full prompt unchanged, and old session\n * transcripts are cleaned up retroactively with no schema migration.\n */\n\nexport type InjectedPromptKind = \"swarm\" | \"research\" | \"goal\";\n\nexport interface InjectedPromptInfo {\n\tkind: InjectedPromptKind;\n\t/** One-line summary extracted from the prompt body (task / question / objective). */\n\tsummary: string;\n}\n\nfunction firstNonEmptyLine(text: string): string | undefined {\n\tfor (const raw of text.split(/\\r?\\n/)) {\n\t\tconst line = raw.trim();\n\t\tif (line) return line;\n\t}\n\treturn undefined;\n}\n\n/** Extract the value following a `Label:` prefix on the first line, else undefined. */\nfunction extractAfterLabel(text: string, label: string): string | undefined {\n\tconst idx = text.indexOf(label);\n\tif (idx === -1) return undefined;\n\tconst rest = text.slice(idx + label.length).split(/\\r?\\n/)[0] ?? \"\";\n\tconst trimmed = rest.trim();\n\treturn trimmed || undefined;\n}\n\n/** Extract the contents of a `<goal_objective>…</goal_objective>` block. */\nfunction extractGoalObjective(text: string): string | undefined {\n\tconst open = text.indexOf(\"<goal_objective>\");\n\tif (open === -1) return undefined;\n\tconst close = text.indexOf(\"</goal_objective>\", open);\n\tif (close === -1) return undefined;\n\tconst inner = text.slice(open + \"<goal_objective>\".length, close);\n\tconst trimmed = inner.trim();\n\t// Unescape the minimal XML escaping the goal prompt builder applies.\n\treturn trimmed.replace(/&amp;/g, \"&\").replace(/&lt;/g, \"<\").replace(/&gt;/g, \">\").trim() || undefined;\n}\n\nexport function detectInjectedPrompt(text: string): InjectedPromptInfo | undefined {\n\tif (!text) return undefined;\n\n\tif (text.startsWith(\"[SWARM MODE]\")) {\n\t\tconst summary = extractAfterLabel(text, \"Task:\") ?? firstNonEmptyLine(text.slice(\"[SWARM MODE]\".length).trim());\n\t\treturn { kind: \"swarm\", summary: summary ?? \"swarm task\" };\n\t}\n\n\tif (text.startsWith(\"[DEEP RESEARCH]\")) {\n\t\tconst summary =\n\t\t\textractAfterLabel(text, \"Question:\") ?? firstNonEmptyLine(text.slice(\"[DEEP RESEARCH]\".length).trim());\n\t\treturn { kind: \"research\", summary: summary ?? \"research question\" };\n\t}\n\n\tif (text.includes(\"pi-goal-prompt:\")) {\n\t\tconst objective = extractGoalObjective(text);\n\t\treturn { kind: \"goal\", summary: objective ?? \"goal\" };\n\t}\n\n\treturn undefined;\n}\n\nexport const INJECTED_PROMPT_LABELS: Record<InjectedPromptKind, string> = {\n\tswarm: \"swarm\",\n\tresearch: \"research\",\n\tgoal: \"goal\",\n};\n"]}