@asobacloud/nehanda 0.0.0-stage → 0.2.0

package/lib/anthropicHeaders.mjs

@@ -0,0 +1,8 @@
+export const ANTHROPIC_OAUTH_BETA = 'oauth-2025-04-20'
+
+export function subscriptionStyleHeaders(bearerSecret) {
+  return {
+    Authorization: `Bearer ${bearerSecret}`,
+    'anthropic-beta': ANTHROPIC_OAUTH_BETA,
+  }
+}

package/lib/app.mjs

@@ -0,0 +1,313 @@
+// Ink-based terminal UI — ported from claude-code/components/LogoV2/, messages/, PromptInput/
+import React, { useState, useEffect, useRef, useCallback } from 'react'
+import { render, Box, Text, useApp, useStdout } from 'ink'
+import TextInput from 'ink-text-input'
+import { marked } from 'marked'
+import TerminalRenderer from 'marked-terminal'
+import chalk from 'chalk'
+
+const e = React.createElement
+
+// Figures — claude-code/constants/figures.ts
+const BLACK_CIRCLE = process.platform === 'darwin' ? '\u23FA' : '\u25CF'
+const TICK = '\u2713'
+const CROSS = '\u2717'
+const BULLET = '\u2219'
+
+// ── Markdown rendering ───────────────────────────────────────
+marked.setOptions({
+  renderer: new TerminalRenderer({
+    code: chalk.yellow,
+    codespan: chalk.yellow,
+    strong: chalk.bold,
+    em: chalk.italic,
+    heading: chalk.bold.cyan,
+    hr: () => chalk.dim('\u2500'.repeat(50)),
+    listitem: text => `  ${chalk.dim('\u2022')} ${text}`,
+    paragraph: text => text + '\n',
+    link: (href, title, text) => `${text} ${chalk.dim.underline(href)}`,
+  })
+})
+
+function renderMd(text) {
+  if (!text) return ''
+  try { return marked(text).replace(/\n{3,}/g, '\n\n').trimEnd() }
+  catch { return text }
+}
+
+// ── Cape Town skyline — Table Mountain, Lion's Head, city lights ──
+function CapeTownSkyline() {
+  return e(Box, { flexDirection: 'column', alignItems: 'center' },
+    e(Text, {},
+      e(Text, { dimColor: true }, '       \u2726  '),
+      e(Text, { color: 'yellow' }, '\u2600'),
+    ),
+    e(Text, {},
+      e(Text, { color: '#cc785c' }, '  \u2584\u2584\u2584\u2584\u2584\u2584\u2584\u2584\u2584\u2584'),
+      e(Text, { dimColor: true }, '  \u2726 '),
+      e(Text, { color: '#cc785c' }, '\u25B2'),
+    ),
+    e(Text, {},
+      e(Text, { color: '#cc785c' }, '  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u258C   \u259F\u258A'),
+    ),
+    e(Text, {},
+      e(Text, { color: '#cc785c' }, ' \u259F\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2584\u2588\u2588\u258A\u2596'),
+    ),
+    e(Text, {},
+      e(Text, { color: '#8a6040' }, ' \u2591\u2592\u2588\u2592\u2591\u2593\u2588\u2593\u2591\u2592\u2588\u2592\u2591\u2593\u2588\u2593\u2591'),
+    ),
+  )
+}
+
+// ── Welcome Banner — from claude-code LogoV2/LogoV2.tsx ──
+function WelcomeBanner({ version, provider, wireModel, cwd, permissionMode, bare }) {
+  let cols = 80
+  try { cols = process.stdout.columns || 80 } catch {}
+
+  const modelLine = `${wireModel}${bare ? ' [bare]' : ''}`
+  const cwdDisplay = cwd.startsWith(process.env.HOME || '~')
+    ? '~' + cwd.slice((process.env.HOME || '~').length)
+    : cwd
+
+  const bannerWidth = Math.min(cols, 80)
+  const leftWidth = Math.floor(bannerWidth * 0.4)
+  const rightWidth = bannerWidth - leftWidth - 3
+
+  return e(Box, {
+    flexDirection: 'column', borderStyle: 'single', borderColor: '#cc785c',
+    width: bannerWidth, marginBottom: 1,
+  },
+    e(Box, { flexDirection: 'row', paddingX: 1 },
+      // Left panel
+      e(Box, { flexDirection: 'column', width: leftWidth, alignItems: 'center', paddingY: 1 },
+        e(Text, { bold: true, color: '#cc785c' }, 'Welcome to ona!'),
+        e(CapeTownSkyline, {}),
+        e(Text, { dimColor: true }, modelLine),
+        e(Text, { dimColor: true }, cwdDisplay),
+      ),
+      // Separator
+      e(Box, { width: 1, borderStyle: 'single', borderColor: '#cc785c',
+        borderTop: false, borderBottom: false, borderRight: false, borderLeft: true }),
+      // Right panel
+      e(Box, { flexDirection: 'column', width: rightWidth, paddingLeft: 1, paddingY: 1 },
+        e(Text, { bold: true, color: '#cc785c' }, 'Tips for getting started'),
+        e(Text, { dimColor: true }, 'Run /init to create an Ona.md file with instructions'),
+        e(Text, { dimColor: true }, 'Use /help to see available commands'),
+        e(Text, { dimColor: true }, 'Use /model to switch models'),
+        e(Box, { marginTop: 1 },
+          e(Text, { bold: true }, 'Recent activity'),
+        ),
+        e(Text, { dimColor: true }, 'No recent activity'),
+      ),
+    ),
+  )
+}
+
+// ── Slash commands ───────────────────────────────────────────
+const SLASH_COMMANDS = [
+  { name: '/phase', desc: 'Current SDLC phase' },
+  { name: '/plan', desc: 'Plan status' },
+  { name: '/code', desc: 'Implement plan' },
+  { name: '/test', desc: 'Run tests' },
+  { name: '/verify', desc: 'Coverage report' },
+  { name: '/done', desc: 'Complete workflow' },
+  { name: '/init', desc: 'Create Ona.md' },
+  { name: '/diff', desc: 'Uncommitted changes' },
+  { name: '/cost', desc: 'Token usage' },
+  { name: '/doctor', desc: 'Diagnostics' },
+  { name: '/permissions', desc: 'Permission rules' },
+  { name: '/pr-comments', desc: 'PR comments' },
+  { name: '/compact', desc: 'Compact conversation' },
+  { name: '/team', desc: 'Manage teams' },
+  { name: '/model', desc: 'Change model' },
+  { name: '/login', desc: 'Authenticate' },
+  { name: '/logout', desc: 'Clear credentials' },
+  { name: '/status', desc: 'Auth status' },
+  { name: '/config', desc: 'Settings' },
+  { name: '/clear', desc: 'New conversation' },
+  { name: '/exit', desc: 'Quit' },
+  { name: '/help', desc: 'All commands' },
+]
+
+// ── Message — from claude-code messages/*.tsx ────────────────
+function MessageView({ msg }) {
+  if (msg.role === 'user') {
+    return e(Box, { marginLeft: 0, flexDirection: 'row' },
+      e(Text, { bold: true, color: '#cc785c' }, '\u276F '),
+      e(Box, { flexShrink: 1 }, e(Text, { wrap: 'wrap' }, msg.text))
+    )
+  }
+  if (msg.role === 'assistant') {
+    return e(Box, { flexDirection: 'column' },
+      e(Text, {}, renderMd(msg.text))
+    )
+  }
+  if (msg.role === 'tool_start') {
+    return e(Box, { marginLeft: 1 },
+      e(Text, { color: '#cc785c' }, `${BLACK_CIRCLE} `),
+      e(Text, { bold: true }, msg.toolName),
+    )
+  }
+  if (msg.role === 'tool_result') {
+    const icon = msg.isError
+      ? e(Text, { color: 'red' }, `${CROSS} `)
+      : e(Text, { color: 'green' }, `${TICK} `)
+    const preview = (msg.text || '').split('\n')[0].slice(0, 120)
+    return e(Box, { marginLeft: 2 }, icon, e(Text, { dimColor: true }, preview))
+  }
+  if (msg.role === 'system') {
+    return e(Box, { marginLeft: 1 }, e(Text, { dimColor: true }, msg.text))
+  }
+  return null
+}
+
+// ── Spinner — from claude-code Spinner/SpinnerGlyph.tsx ──────
+const SPINNER_FRAMES = ['\u280B', '\u2819', '\u2839', '\u2838', '\u283C', '\u2834', '\u2826', '\u2827', '\u2807', '\u280F']
+
+function Spinner({ label }) {
+  const [frame, setFrame] = useState(0)
+  useEffect(() => {
+    const t = setInterval(() => setFrame(f => (f + 1) % SPINNER_FRAMES.length), 80)
+    return () => clearInterval(t)
+  }, [])
+  return e(Box, { marginLeft: 1 },
+    e(Text, { color: '#cc785c' }, SPINNER_FRAMES[frame] + ' '),
+    e(Text, { dimColor: true }, label || 'Thinking\u2026'),
+  )
+}
+
+// ── Slash menu ──────────────────────────────────────────────
+function SlashMenu({ filter }) {
+  const matches = SLASH_COMMANDS.filter(c => c.name.startsWith(filter) || c.name.includes(filter))
+  if (!matches.length) return null
+  return e(Box, { flexDirection: 'column', marginLeft: 2 },
+    ...matches.map((c, i) =>
+      e(Box, { key: String(i) },
+        e(Text, { color: 'cyan' }, c.name.padEnd(14)),
+        e(Text, { dimColor: true }, c.desc),
+      )
+    )
+  )
+}
+
+// ── Ask prompt ──────────────────────────────────────────────
+function AskPrompt({ question, onAnswer }) {
+  const [value, setValue] = useState('')
+  return e(Box, { flexDirection: 'column' },
+    e(Box, { marginLeft: 1 }, e(Text, { dimColor: true }, question)),
+    e(Box, { marginLeft: 1 },
+      e(Text, { color: '#cc785c' }, '\u276F '),
+      e(TextInput, { value, onChange: setValue, onSubmit: useCallback(v => onAnswer(v.trim()), [onAnswer]) }),
+    ),
+  )
+}
+
+// ── Input ───────────────────────────────────────────────────
+function PromptInputArea({ onSubmit, isLoading }) {
+  const [value, setValue] = useState('')
+  const showSlashMenu = value.startsWith('/') && !value.includes(' ')
+
+  const handleSubmit = useCallback((v) => {
+    if (!v.trim()) return
+    setValue('')
+    onSubmit(v.trim())
+  }, [onSubmit])
+
+  if (isLoading) return null
+
+  let cols = 80
+  try { cols = process.stdout.columns || 80 } catch {}
+
+  return e(Box, { flexDirection: 'column' },
+    e(Text, { dimColor: true }, '\u2500'.repeat(cols)),
+    showSlashMenu ? e(SlashMenu, { filter: value }) : null,
+    e(Box, { paddingX: 1 },
+      e(Text, { bold: true, color: '#cc785c' }, '\u276F '),
+      e(TextInput, { value, onChange: setValue, onSubmit: handleSubmit }),
+    )
+  )
+}
+
+// ── Footer — from claude-code PromptInput/PromptInputFooter.tsx ──
+function Footer({ phase, model, permissionMode }) {
+  return e(Box, { marginTop: 1 },
+    e(Text, { dimColor: true }, '? for shortcuts'),
+  )
+}
+
+// ── Main App ────────────────────────────────────────────────
+export function App({ config, onUserInput, onExit }) {
+  const { exit } = useApp()
+  const [messages, setMessages] = useState([])
+  const [isLoading, setIsLoading] = useState(false)
+  const [streamText, setStreamText] = useState('')
+  const [askState, setAskState] = useState(null)
+
+  const ref = useRef({ setMessages, setIsLoading, setStreamText, messages, setAskState })
+  ref.current.messages = messages
+  useEffect(() => {
+    if (config._bridge) {
+      config._bridge.setMessages = setMessages
+      config._bridge.setIsLoading = setIsLoading
+      config._bridge.setStreamText = setStreamText
+      config._bridge.setAskState = setAskState
+      config._bridge.getMessages = () => ref.current.messages
+      config._bridge.exit = () => { exit(); onExit?.() }
+    }
+  }, [config._bridge, exit, onExit])
+
+  const handleSubmit = useCallback((text) => {
+    setMessages(prev => [...prev, { role: 'user', text }])
+    onUserInput(text)
+  }, [onUserInput])
+
+  const handleAskAnswer = useCallback((answer) => {
+    if (askState?.resolve) askState.resolve(answer)
+    setAskState(null)
+  }, [askState])
+
+  return e(Box, { flexDirection: 'column' },
+    e(WelcomeBanner, {
+      version: config.version,
+      provider: config.provider,
+      wireModel: config.wireModel,
+      cwd: config.cwd || process.cwd(),
+      permissionMode: config.permissionMode || 'default',
+      bare: config.bare,
+    }),
+
+    ...messages.map((msg, i) => e(MessageView, { key: String(i), msg })),
+
+    streamText ? e(Box, {}, e(Text, {}, streamText)) : null,
+    isLoading ? e(Spinner, { label: 'Thinking\u2026' }) : null,
+    askState ? e(AskPrompt, { question: askState.question, onAnswer: handleAskAnswer }) : null,
+    !askState ? e(Box, {}, e(PromptInputArea, { onSubmit: handleSubmit, isLoading })) : null,
+    e(Footer, { phase: config.phase || 'idle', model: config.wireModel, permissionMode: config.permissionMode || 'default' }),
+  )
+}
+
+// ── Render entry point ──────────────────────────────────────
+export function startApp(config) {
+  const bridge = {}
+  config._bridge = bridge
+
+  const instance = render(
+    e(App, { config, onUserInput: config.onUserInput, onExit: config.onExit }),
+    { exitOnCtrlC: true }
+  )
+
+  return {
+    bridge, instance,
+    addMessage(msg) { bridge.setMessages?.(prev => [...prev, msg]) },
+    startLoading() { bridge.setIsLoading?.(true); bridge.setStreamText?.('') },
+    stopLoading() { bridge.setIsLoading?.(false) },
+    updateStream(text) { bridge.setStreamText?.(text) },
+    clearStream() { bridge.setStreamText?.('') },
+    addSystemMessage(text) { bridge.setMessages?.(prev => [...prev, { role: 'system', text }]) },
+    addToolStart(toolName) { bridge.setMessages?.(prev => [...prev, { role: 'tool_start', toolName }]) },
+    addToolResult(toolName, text, isError) { bridge.setMessages?.(prev => [...prev, { role: 'tool_result', toolName, text, isError }]) },
+    addAssistantMessage(text) { bridge.setMessages?.(prev => [...prev, { role: 'assistant', text }]) },
+    askUser(question) { return new Promise(resolve => { bridge.setAskState?.({ question, resolve: (ans) => { bridge.setMessages?.(prev => [...prev, { role: 'system', text: `${question} ${ans}` }]); resolve(ans) } }) }) },
+    exit() { bridge.exit?.() }
+  }
+}

package/lib/auth.mjs

@@ -0,0 +1,255 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import http from 'node:http'
+import { randomBytes, createHash } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { secureAuthPath } from './paths.mjs'
+
+function nonempty(s) {
+  if (typeof s !== 'string') return ''
+  const t = s.trim()
+  return t.length ? t : ''
+}
+
+export function getAuthPreference() {
+  const v = nonempty(process.env.ONA_AUTH_PREFERENCE).toLowerCase()
+  if (v === 'subscription' || v === 'oauth' || v === 'bearer') return 'subscription'
+  if (v === 'api_key' || v === 'console' || v === 'key') return 'api_key'
+  return 'auto'
+}
+
+/** §2.7 — Anthropic credential resolution (no secrets in SQLite). */
+export function resolveAnthropicCredentials(ctx) {
+  const { bareMode = false, apiKeyHelper = null } = ctx
+  const pref = getAuthPreference()
+
+  if (bareMode) {
+    const key = nonempty(process.env.ANTHROPIC_API_KEY)
+    if (key) return { mode: 'api_key', secret: key, source: 'ANTHROPIC_API_KEY', bare: true }
+    if (apiKeyHelper) {
+      const h = runApiKeyHelper(apiKeyHelper)
+      if (h) return { mode: 'api_key', secret: h, source: 'apiKeyHelper', bare: true }
+    }
+    return { mode: 'none', source: 'none', bare: true }
+  }
+
+  const envBearer = envBearerWithSource()
+  const envKey = nonempty(process.env.ANTHROPIC_API_KEY)
+  const fileCred = readSecureAuthFile()
+
+  if (pref === 'subscription') {
+    if (envBearer.token) return { mode: 'bearer', secret: envBearer.token, source: envBearer.source, bare: false }
+    if (fileCred?.bearerToken) return { mode: 'bearer', secret: fileCred.bearerToken, source: 'secure_file_bearer', bare: false }
+    return { mode: 'none', source: 'none_subscription_preference', bare: false }
+  }
+
+  if (pref === 'api_key') {
+    if (envKey) return { mode: 'api_key', secret: envKey, source: 'ANTHROPIC_API_KEY', bare: false }
+    if (fileCred?.apiKey) return { mode: 'api_key', secret: fileCred.apiKey, source: 'secure_file_api_key', bare: false }
+    if (apiKeyHelper) {
+      const h = runApiKeyHelper(apiKeyHelper)
+      if (h) return { mode: 'api_key', secret: h, source: 'apiKeyHelper', bare: false }
+    }
+    return { mode: 'none', source: 'none_api_key_preference', bare: false }
+  }
+
+  // auto: bearer env → API key env → secure file bearer → secure file API key → claude code keychain → helper
+  if (envBearer.token) return { mode: 'bearer', secret: envBearer.token, source: envBearer.source, bare: false }
+  if (envKey) return { mode: 'api_key', secret: envKey, source: 'ANTHROPIC_API_KEY', bare: false }
+  if (fileCred?.bearerToken) return { mode: 'bearer', secret: fileCred.bearerToken, source: 'secure_file_bearer', bare: false }
+  if (fileCred?.apiKey) return { mode: 'api_key', secret: fileCred.apiKey, source: 'secure_file_api_key', bare: false }
+  // Try Claude Code's existing OAuth credentials (keychain or plaintext)
+  const ccToken = readClaudeCodeOAuthToken()
+  if (ccToken) return { mode: 'bearer', secret: ccToken, source: 'claude_code_oauth', bare: false }
+  if (apiKeyHelper) {
+    const h = runApiKeyHelper(apiKeyHelper)
+    if (h) return { mode: 'api_key', secret: h, source: 'apiKeyHelper', bare: false }
+  }
+  return { mode: 'none', source: 'none', bare: false }
+}
+
+function envBearerWithSource() {
+  const a = nonempty(process.env.ANTHROPIC_AUTH_TOKEN)
+  if (a) return { token: a, source: 'ANTHROPIC_AUTH_TOKEN' }
+  const c = nonempty(process.env.CLAUDE_CODE_OAUTH_TOKEN)
+  if (c) return { token: c, source: 'CLAUDE_CODE_OAUTH_TOKEN' }
+  return { token: '', source: '' }
+}
+
+export function authStatusSummary(ctx) {
+  const pref = getAuthPreference()
+  const c = resolveAnthropicCredentials(ctx)
+  const also = computeAlsoConfiguredHints(c, pref)
+  if (c.mode === 'none') {
+    return { ok: false, kind: 'none', source: c.source, preference: pref, oauth_beta_header: false, alsoConfigured: also }
+  }
+  const subscriptionStyle = c.mode === 'bearer'
+  return { ok: true, kind: subscriptionStyle ? 'oauth_bearer' : 'api_key', source: c.source, preference: pref, oauth_beta_header: subscriptionStyle, alsoConfigured: also }
+}
+
+function computeAlsoConfiguredHints(active, pref) {
+  const envBearer = !!(nonempty(process.env.ANTHROPIC_AUTH_TOKEN) || nonempty(process.env.CLAUDE_CODE_OAUTH_TOKEN))
+  const envKey = !!nonempty(process.env.ANTHROPIC_API_KEY)
+  const file = readSecureAuthFile()
+  const fileB = !!file?.bearerToken
+  const fileK = !!file?.apiKey
+  const ignored = []
+  if (active.mode === 'bearer') {
+    if (envKey) ignored.push('ANTHROPIC_API_KEY in env (export ONA_AUTH_PREFERENCE=api_key to prefer it)')
+    if (fileK) ignored.push('apiKey in ~/.ona/secure (not used while bearer wins)')
+  }
+  if (active.mode === 'api_key') {
+    if (envBearer) ignored.push('bearer env vars present but not chosen')
+    if (fileB) ignored.push('bearer in ~/.ona/secure (not used while API key wins)')
+  }
+  if (active.mode === 'none') {
+    if (pref === 'subscription' && (envKey || fileK)) ignored.push('API key present but ONA_AUTH_PREFERENCE=subscription requires a bearer token')
+    if (pref === 'api_key' && (envBearer || fileB)) ignored.push('Bearer token present but ONA_AUTH_PREFERENCE=api_key ignores it')
+  }
+  return { envBearer, envApiKey: envKey, secureFileBearer: fileB, secureFileApiKey: fileK, ignoredHints: ignored }
+}
+
+export function saveSecureCredentials({ apiKey, bearerToken, zhipuApiKey }) {
+  const p = secureAuthPath()
+  const prev = readSecureAuthFile() || {}
+  const next = { ...prev }
+  if (apiKey !== undefined) { if (apiKey === '') delete next.apiKey; else next.apiKey = apiKey }
+  if (bearerToken !== undefined) { if (bearerToken === '') delete next.bearerToken; else next.bearerToken = bearerToken }
+  if (zhipuApiKey !== undefined) { if (zhipuApiKey === '') delete next.zhipuApiKey; else next.zhipuApiKey = zhipuApiKey }
+  fs.writeFileSync(p, JSON.stringify(next, null, 0), { mode: 0o600 })
+}
+
+export function resolveZhipuApiKey() {
+  const fromEnv = nonempty(process.env.ZAI_API_KEY)
+  if (fromEnv) return fromEnv
+  const file = readSecureAuthFile()
+  return nonempty(file?.zhipuApiKey) || ''
+}
+
+export function clearSecureCredentials() {
+  try { fs.unlinkSync(secureAuthPath()) } catch { /* ignore */ }
+}
+
+function readSecureAuthFile() {
+  try {
+    const raw = fs.readFileSync(secureAuthPath(), 'utf8')
+    const j = JSON.parse(raw)
+    return { apiKey: nonempty(j.apiKey), bearerToken: nonempty(j.bearerToken), zhipuApiKey: nonempty(j.zhipuApiKey) }
+  } catch { return null }
+}
+
+/** Read OAuth token from Claude Code's secure storage (keychain or ~/.claude/.credentials.json). */
+function readClaudeCodeOAuthToken() {
+  // Try macOS Keychain first
+  if (process.platform === 'darwin') {
+    try {
+      const username = nonempty(process.env.USER) || require('os').userInfo().username
+      const r = spawnSync('security', ['find-generic-password', '-a', username, '-w', '-s', 'Claude Code-credentials'], { encoding: 'utf8', timeout: 5000 })
+      if (!r.error && r.status === 0 && r.stdout) {
+        const data = JSON.parse(r.stdout.trim())
+        const token = nonempty(data?.claudeAiOauth?.accessToken)
+        if (token) return token
+      }
+    } catch { /* fall through to plaintext */ }
+  }
+  // Try plaintext fallback at ~/.claude/.credentials.json
+  try {
+    const home = process.env.CLAUDE_CONFIG_DIR || path.join(process.env.HOME || '', '.claude')
+    const raw = fs.readFileSync(path.join(home, '.credentials.json'), 'utf8')
+    const data = JSON.parse(raw)
+    return nonempty(data?.claudeAiOauth?.accessToken) || ''
+  } catch { return '' }
+}
+
+function runApiKeyHelper(cmd) {
+  if (!cmd || typeof cmd !== 'string') return ''
+  const r = spawnSync(cmd, { shell: true, encoding: 'utf8', timeout: 30_000 })
+  if (r.error || r.status !== 0) return ''
+  return nonempty(r.stdout || '')
+}
+
+/** §2.7 A3 — Browser PKCE OAuth flow. */
+export async function interactiveOAuthLogin(io) {
+  const authUrl = process.env.ANTHROPIC_OAUTH_AUTHORIZATION_URL || 'https://console.anthropic.com/oauth/authorize'
+  const tokenUrl = process.env.ANTHROPIC_OAUTH_TOKEN_URL || 'https://console.anthropic.com/oauth/token'
+  const clientId = process.env.ANTHROPIC_OAUTH_CLIENT_ID || 'ona-sdlc-repl'
+
+  const verifier = randomBytes(32).toString('base64url')
+  const challenge = createHash('sha256').update(verifier).digest('base64url')
+  const state = randomBytes(16).toString('hex')
+
+  const server = http.createServer()
+  const port = await new Promise((resolve, reject) => {
+    server.listen(0, '127.0.0.1', () => resolve(server.address().port))
+    server.on('error', reject)
+  })
+
+  const redirectUri = `http://127.0.0.1:${port}/callback`
+  const params = new URLSearchParams({
+    response_type: 'code',
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    scope: 'user:inference',
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+  })
+
+  const fullUrl = `${authUrl}?${params}`
+  io.println(`Open this URL in your browser to authenticate:\n${fullUrl}`)
+
+  try {
+    const { exec } = await import('node:child_process')
+    const openCmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open'
+    exec(`${openCmd} "${fullUrl}"`)
+  } catch { /* user will open manually */ }
+
+  io.println('Waiting for OAuth callback...')
+
+  const code = await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => { server.close(); reject(new Error('OAuth timeout (120s)')) }, 120_000)
+    server.on('request', (req, res) => {
+      const u = new URL(req.url, `http://127.0.0.1:${port}`)
+      if (u.pathname !== '/callback') { res.writeHead(404); res.end(); return }
+      const returnedState = u.searchParams.get('state')
+      const returnedCode = u.searchParams.get('code')
+      const err = u.searchParams.get('error')
+      if (err) {
+        res.writeHead(200, { 'Content-Type': 'text/html' })
+        res.end('<h1>Authentication failed</h1><p>You can close this tab.</p>')
+        clearTimeout(timeout); server.close(); reject(new Error(`OAuth error: ${err}`)); return
+      }
+      if (returnedState !== state) {
+        res.writeHead(400, { 'Content-Type': 'text/html' })
+        res.end('<h1>State mismatch</h1>'); clearTimeout(timeout); server.close(); reject(new Error('State mismatch')); return
+      }
+      res.writeHead(200, { 'Content-Type': 'text/html' })
+      res.end('<h1>Authentication successful</h1><p>You can close this tab and return to ona.</p>')
+      clearTimeout(timeout); server.close(); resolve(returnedCode)
+    })
+  })
+
+  const tokenResp = await fetch(tokenUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      code_verifier: verifier,
+    }),
+  })
+
+  if (!tokenResp.ok) {
+    const txt = await tokenResp.text()
+    throw new Error(`Token exchange failed (${tokenResp.status}): ${txt.slice(0, 500)}`)
+  }
+
+  const tokenData = await tokenResp.json()
+  const accessToken = tokenData.access_token
+  if (!accessToken) throw new Error('No access_token in token response')
+
+  saveSecureCredentials({ bearerToken: accessToken })
+  io.println('OAuth login successful. Bearer token saved to secure storage.')
+}