@bubblebrain-ai/bubble 0.0.1

package/dist/memory/usage.js

@@ -0,0 +1,38 @@
+import { MemoryDatabase } from "./db.js";
+import { existsSync, readFileSync } from "node:fs";
+const CITATION_BLOCK_RE = /<oai-mem-citation>[\s\S]*?<citation_entries>([\s\S]*?)<\/citation_entries>[\s\S]*?<\/oai-mem-citation>/g;
+const SESSION_RE = /session:\s*([^\n]+)/i;
+export function recordMemoryCitations(cwd, text) {
+    const sessionFiles = [];
+    for (const match of text.matchAll(CITATION_BLOCK_RE)) {
+        const entries = match[1] ?? "";
+        for (const line of entries.split("\n")) {
+            const session = line.match(SESSION_RE)?.[1]?.trim();
+            if (session)
+                sessionFiles.push(session);
+            const citedPath = parseCitedPath(line);
+            if (citedPath && existsSync(citedPath)) {
+                const content = readFileSync(citedPath, "utf-8");
+                const citedSession = content.match(SESSION_RE)?.[1]?.trim();
+                if (citedSession)
+                    sessionFiles.push(citedSession);
+            }
+        }
+    }
+    if (sessionFiles.length === 0)
+        return 0;
+    const db = new MemoryDatabase(cwd);
+    try {
+        return db.recordUsage(sessionFiles);
+    }
+    finally {
+        db.close();
+    }
+}
+function parseCitedPath(line) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return undefined;
+    const path = trimmed.split("|", 1)[0]?.replace(/:\d+(?:-\d+)?$/, "");
+    return path && path.startsWith("/") ? path : undefined;
+}

package/dist/model-catalog.d.ts

@@ -0,0 +1,20 @@
+import type { ReasoningEffort } from "./types.js";
+export interface BuiltinProviderDefinition {
+    id: string;
+    name: string;
+    baseURL: string;
+    supportsOAuth?: boolean;
+}
+export interface BuiltinModelDefinition {
+    id: string;
+    name: string;
+    providerId: string;
+    reasoningLevels: ReasoningEffort[];
+    contextWindow?: number;
+}
+export declare const BUILTIN_PROVIDERS: BuiltinProviderDefinition[];
+export declare const BUILTIN_MODELS: BuiltinModelDefinition[];
+export declare function listBuiltinModels(providerId: string): BuiltinModelDefinition[];
+export declare function getBuiltinModel(providerId: string, modelId: string): BuiltinModelDefinition | undefined;
+export declare function getBuiltinProvider(providerId: string): BuiltinProviderDefinition | undefined;
+export declare function getModelContextWindow(providerId: string, modelId: string): number | undefined;

package/dist/model-catalog.js

@@ -0,0 +1,99 @@
+export const BUILTIN_PROVIDERS = [
+    { id: "openrouter", name: "OpenRouter", baseURL: "https://openrouter.ai/api/v1" },
+    { id: "openai", name: "OpenAI", baseURL: "https://api.openai.com/v1", supportsOAuth: true },
+    { id: "openai-codex", name: "OpenAI Codex (ChatGPT)", baseURL: "https://chatgpt.com/backend-api" },
+    { id: "deepseek", name: "DeepSeek", baseURL: "https://api.deepseek.com" },
+    { id: "google", name: "Google", baseURL: "https://generativelanguage.googleapis.com/v1beta/openai" },
+    { id: "zhipuai", name: "Zhipu AI", baseURL: "https://open.bigmodel.cn/api/paas/v4" },
+    { id: "zhipuai-coding-plan", name: "Zhipu AI Coding Plan", baseURL: "https://open.bigmodel.cn/api/coding/paas/v4" },
+    { id: "zai", name: "Z.AI", baseURL: "https://api.z.ai/api/paas/v4" },
+    { id: "zai-coding-plan", name: "Z.AI Coding Plan", baseURL: "https://api.z.ai/api/coding/paas/v4" },
+    { id: "moonshot-cn", name: "Moonshot (国内 platform.moonshot.cn)", baseURL: "https://api.moonshot.cn/v1" },
+    { id: "moonshot-intl", name: "Moonshot (海外 platform.moonshot.ai)", baseURL: "https://api.moonshot.ai/v1" },
+    { id: "kimi-for-coding", name: "Kimi for Coding", baseURL: "https://api.kimi.com/coding/v1" },
+    { id: "groq", name: "Groq", baseURL: "https://api.groq.com/openai/v1" },
+    { id: "together", name: "Together AI", baseURL: "https://api.together.xyz/v1" },
+    { id: "fireworks", name: "Fireworks", baseURL: "https://api.fireworks.ai/inference/v1" },
+    { id: "local", name: "Local (OpenAI-compatible)", baseURL: "http://localhost:11434/v1" },
+];
+const ALL_OPENAI_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
+const GPT51_LEVELS = ["off", "low", "medium", "high"];
+const GPT51_CODEX_MAX_LEVELS = ["off", "low", "medium", "high", "xhigh"];
+const GPT51_CODEX_MINI_LEVELS = ["off", "medium", "high"];
+const OPENAI_CHAT_LEVELS = ["off"];
+const TOGGLE_THINKING_LEVELS = ["off", "medium"];
+const DEEPSEEK_V4_LEVELS = ["high", "max"];
+export const BUILTIN_MODELS = [
+    { id: "gpt-5.4", name: "gpt-5.4", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.4-mini", name: "gpt-5.4-mini", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.3-codex", name: "gpt-5.3-codex", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.3-codex-spark", name: "gpt-5.3-codex-spark", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.2-codex", name: "gpt-5.2-codex", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.2", name: "gpt-5.2", providerId: "openai-codex", reasoningLevels: ALL_OPENAI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.1-codex-max", name: "gpt-5.1-codex-max", providerId: "openai-codex", reasoningLevels: GPT51_CODEX_MAX_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.1-codex-mini", name: "gpt-5.1-codex-mini", providerId: "openai-codex", reasoningLevels: GPT51_CODEX_MINI_LEVELS, contextWindow: 272000 },
+    { id: "gpt-5.1", name: "gpt-5.1", providerId: "openai-codex", reasoningLevels: GPT51_LEVELS, contextWindow: 272000 },
+    { id: "gpt-4o", name: "gpt-4o", providerId: "openai", reasoningLevels: OPENAI_CHAT_LEVELS, contextWindow: 128000 },
+    { id: "gpt-4o-mini", name: "gpt-4o-mini", providerId: "openai", reasoningLevels: OPENAI_CHAT_LEVELS, contextWindow: 128000 },
+    { id: "o1-preview", name: "o1-preview", providerId: "openai", reasoningLevels: ["off", "low", "medium", "high"], contextWindow: 128000 },
+    { id: "o1-mini", name: "o1-mini", providerId: "openai", reasoningLevels: ["off", "low", "medium", "high"], contextWindow: 128000 },
+    { id: "gpt-4-turbo", name: "gpt-4-turbo", providerId: "openai", reasoningLevels: OPENAI_CHAT_LEVELS, contextWindow: 128000 },
+    { id: "deepseek-v4-flash", name: "deepseek-v4-flash", providerId: "deepseek", reasoningLevels: DEEPSEEK_V4_LEVELS, contextWindow: 1048576 },
+    { id: "deepseek-v4-pro", name: "deepseek-v4-pro", providerId: "deepseek", reasoningLevels: DEEPSEEK_V4_LEVELS, contextWindow: 1048576 },
+    { id: "gemini-2.5-pro-preview-03-25", name: "gemini-2.5-pro-preview-03-25", providerId: "google", reasoningLevels: ["off", "low", "high"], contextWindow: 128000 },
+    { id: "gemini-2.0-flash-001", name: "gemini-2.0-flash-001", providerId: "google", reasoningLevels: ["off"], contextWindow: 128000 },
+    { id: "gemini-1.5-pro-latest", name: "gemini-1.5-pro-latest", providerId: "google", reasoningLevels: ["off"], contextWindow: 128000 },
+    { id: "glm-5.1", name: "GLM-5.1", providerId: "zhipuai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
+    { id: "glm-4.7", name: "GLM-4.7", providerId: "zhipuai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-4.6", name: "GLM-4.6", providerId: "zhipuai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-5.1", name: "GLM-5.1", providerId: "zhipuai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
+    { id: "glm-4.7", name: "GLM-4.7", providerId: "zhipuai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-4.6", name: "GLM-4.6", providerId: "zhipuai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-5.1", name: "GLM-5.1", providerId: "zai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
+    { id: "glm-4.7", name: "GLM-4.7", providerId: "zai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-4.6", name: "GLM-4.6", providerId: "zai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-5-turbo", name: "GLM-5-Turbo", providerId: "zai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
+    { id: "glm-4.7", name: "GLM-4.7", providerId: "zai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
+    { id: "glm-4.6", name: "GLM-4.6", providerId: "zai-coding-plan", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
+    { id: "kimi-k2.6", name: "Kimi K2.6", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "k2.6-code-preview", name: "Kimi K2.6 Code Preview", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2.5", name: "Kimi K2.5", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2-turbo-preview", name: "Kimi K2 Turbo", providerId: "moonshot-cn", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "kimi-k2-0905-preview", name: "Kimi K2 0905", providerId: "moonshot-cn", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "kimi-k2-thinking", name: "Kimi K2 Thinking", providerId: "moonshot-cn", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2.6", name: "Kimi K2.6", providerId: "moonshot-intl", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "k2.6-code-preview", name: "Kimi K2.6 Code Preview", providerId: "moonshot-intl", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2.5", name: "Kimi K2.5", providerId: "moonshot-intl", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2-turbo-preview", name: "Kimi K2 Turbo", providerId: "moonshot-intl", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "kimi-k2-0905-preview", name: "Kimi K2 0905", providerId: "moonshot-intl", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "kimi-k2-thinking", name: "Kimi K2 Thinking", providerId: "moonshot-intl", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2.6", name: "Kimi K2.6", providerId: "kimi-for-coding", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "k2.6-code-preview", name: "Kimi K2.6 Code Preview", providerId: "kimi-for-coding", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "kimi-k2-turbo-preview", name: "Kimi K2 Turbo", providerId: "kimi-for-coding", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "kimi-k2-0905-preview", name: "Kimi K2 0905", providerId: "kimi-for-coding", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "kimi-k2-thinking", name: "Kimi K2 Thinking", providerId: "kimi-for-coding", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 256000 },
+    { id: "llama-3.3-70b-versatile", name: "llama-3.3-70b-versatile", providerId: "groq", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "mixtral-8x7b-32768", name: "mixtral-8x7b-32768", providerId: "groq", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "gemma-2-9b-it", name: "gemma-2-9b-it", providerId: "groq", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "meta-llama/Llama-3.3-70B-Instruct-Turbo", name: "meta-llama/Llama-3.3-70B-Instruct-Turbo", providerId: "together", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "Qwen/Qwen2.5-72B-Instruct", name: "Qwen/Qwen2.5-72B-Instruct", providerId: "together", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "accounts/fireworks/models/kimi-k2p6", name: "Kimi K2.6", providerId: "fireworks", reasoningLevels: ["off"], contextWindow: 256000 },
+    { id: "llama3.1", name: "llama3.1", providerId: "local", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "qwen2.5", name: "qwen2.5", providerId: "local", reasoningLevels: ["off"], contextWindow: 32768 },
+    { id: "deepseek-coder-v2", name: "deepseek-coder-v2", providerId: "local", reasoningLevels: ["off"], contextWindow: 32768 },
+];
+export function listBuiltinModels(providerId) {
+    return BUILTIN_MODELS.filter((model) => model.providerId === providerId);
+}
+export function getBuiltinModel(providerId, modelId) {
+    return BUILTIN_MODELS.find((model) => model.providerId === providerId && model.id === modelId)
+        || (providerId === "openai"
+            ? BUILTIN_MODELS.find((model) => model.providerId === "openai-codex" && model.id === modelId)
+            : undefined);
+}
+export function getBuiltinProvider(providerId) {
+    return BUILTIN_PROVIDERS.find((provider) => provider.id === providerId);
+}
+export function getModelContextWindow(providerId, modelId) {
+    return getBuiltinModel(providerId, modelId)?.contextWindow;
+}

package/dist/model-config.d.ts

@@ -0,0 +1,32 @@
+/**
+ * models.json loader.
+ *
+ * Users can define providers, API keys, base URLs, and custom models
+ * in ~/.bubble/models.json.
+ */
+import type { ModelInfo } from "./provider-registry.js";
+export interface ProviderModelConfig {
+    baseURL?: string;
+    apiKey?: string;
+    models?: Array<{
+        id: string;
+        name?: string;
+    }>;
+}
+export interface ModelsConfig {
+    providers: Record<string, ProviderModelConfig>;
+}
+export declare class ModelConfig {
+    private data?;
+    private loadError?;
+    constructor();
+    private load;
+    getLoadError(): string | undefined;
+    getPath(): string;
+    getProviderConfig(providerId: string): ProviderModelConfig | undefined;
+    getAllProviders(): Record<string, ProviderModelConfig>;
+    hasProvider(providerId: string): boolean;
+    getCustomModels(providerId: string): ModelInfo[];
+    getApiKey(providerId: string): string | undefined;
+    getBaseURL(providerId: string): string | undefined;
+}

package/dist/model-config.js

@@ -0,0 +1,59 @@
+/**
+ * models.json loader.
+ *
+ * Users can define providers, API keys, base URLs, and custom models
+ * in ~/.bubble/models.json.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+const MODELS_PATH = join(homedir(), ".bubble", "models.json");
+export class ModelConfig {
+    data;
+    loadError;
+    constructor() {
+        this.load();
+    }
+    load() {
+        if (!existsSync(MODELS_PATH))
+            return;
+        try {
+            const raw = readFileSync(MODELS_PATH, "utf-8");
+            this.data = JSON.parse(raw);
+        }
+        catch (err) {
+            this.loadError = err.message;
+        }
+    }
+    getLoadError() {
+        return this.loadError;
+    }
+    getPath() {
+        return MODELS_PATH;
+    }
+    getProviderConfig(providerId) {
+        return this.data?.providers?.[providerId];
+    }
+    getAllProviders() {
+        return this.data?.providers ?? {};
+    }
+    hasProvider(providerId) {
+        return !!this.data?.providers?.[providerId];
+    }
+    getCustomModels(providerId) {
+        const cfg = this.data?.providers?.[providerId];
+        if (!cfg?.models)
+            return [];
+        return cfg.models.map((m) => ({
+            id: m.id,
+            name: m.name || m.id,
+            providerId,
+        }));
+    }
+    getApiKey(providerId) {
+        return this.data?.providers?.[providerId]?.apiKey;
+    }
+    getBaseURL(providerId) {
+        return this.data?.providers?.[providerId]?.baseURL;
+    }
+}

package/dist/model-pricing.d.ts

@@ -0,0 +1,23 @@
+import type { TokenUsage } from "./types.js";
+export interface ModelPricing {
+    providerId: string;
+    modelId: string;
+    currency: "USD";
+    inputCacheHitPerMillion: number;
+    inputCacheMissPerMillion: number;
+    outputPerMillion: number;
+    effectiveUntil?: string;
+    original?: {
+        inputCacheHitPerMillion: number;
+        inputCacheMissPerMillion: number;
+        outputPerMillion: number;
+    };
+}
+export interface UsageCost {
+    currency: "USD";
+    cost: number;
+    estimated: boolean;
+}
+export declare const MODEL_PRICING: ModelPricing[];
+export declare function getModelPricing(providerId: string, modelId: string): ModelPricing | undefined;
+export declare function calculateUsageCost(providerId: string, modelId: string, usage: TokenUsage): UsageCost | undefined;

package/dist/model-pricing.js

@@ -0,0 +1,46 @@
+export const MODEL_PRICING = [
+    {
+        providerId: "deepseek",
+        modelId: "deepseek-v4-flash",
+        currency: "USD",
+        inputCacheHitPerMillion: 0.028,
+        inputCacheMissPerMillion: 0.14,
+        outputPerMillion: 0.28,
+    },
+    {
+        providerId: "deepseek",
+        modelId: "deepseek-v4-pro",
+        currency: "USD",
+        inputCacheHitPerMillion: 0.03625,
+        inputCacheMissPerMillion: 0.435,
+        outputPerMillion: 0.87,
+        effectiveUntil: "2026-05-05T15:59:00Z",
+        original: {
+            inputCacheHitPerMillion: 0.145,
+            inputCacheMissPerMillion: 1.74,
+            outputPerMillion: 3.48,
+        },
+    },
+];
+export function getModelPricing(providerId, modelId) {
+    return MODEL_PRICING.find((item) => item.providerId === providerId && item.modelId === modelId);
+}
+export function calculateUsageCost(providerId, modelId, usage) {
+    const pricing = getModelPricing(providerId, modelId);
+    if (!pricing)
+        return undefined;
+    const hasCacheBreakdown = typeof usage.promptCacheHitTokens === "number"
+        || typeof usage.promptCacheMissTokens === "number";
+    const hit = usage.promptCacheHitTokens ?? 0;
+    const miss = hasCacheBreakdown
+        ? usage.promptCacheMissTokens ?? Math.max(0, usage.promptTokens - hit)
+        : usage.promptTokens;
+    const cost = (hit / 1_000_000) * pricing.inputCacheHitPerMillion
+        + (miss / 1_000_000) * pricing.inputCacheMissPerMillion
+        + (usage.completionTokens / 1_000_000) * pricing.outputPerMillion;
+    return {
+        currency: pricing.currency,
+        cost,
+        estimated: !hasCacheBreakdown,
+    };
+}

package/dist/oauth/index.d.ts

@@ -0,0 +1,3 @@
+export { AuthStorage } from "./storage.js";
+export { loginOpenAICodex, refreshOpenAICodex, type OpenAICodexLoginCallbacks } from "./openai-codex.js";
+export type { OAuthTokens, OAuthCredentials } from "./types.js";

package/dist/oauth/index.js

@@ -0,0 +1,2 @@
+export { AuthStorage } from "./storage.js";
+export { loginOpenAICodex, refreshOpenAICodex } from "./openai-codex.js";

package/dist/oauth/openai-codex.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OpenAI Codex OAuth login (PKCE + local callback).
+ */
+import type { OAuthTokens } from "./types.js";
+export interface OpenAICodexLoginCallbacks {
+    onStatus: (message: string) => void;
+}
+export declare function loginOpenAICodex(callbacks?: OpenAICodexLoginCallbacks): Promise<OAuthTokens>;
+export declare function refreshOpenAICodex(refreshToken: string): Promise<OAuthTokens>;

package/dist/oauth/openai-codex.js

@@ -0,0 +1,173 @@
+/**
+ * OpenAI Codex OAuth login (PKCE + local callback).
+ */
+import { createServer } from "node:http";
+import { exec } from "node:child_process";
+import { randomBytes, createHash } from "node:crypto";
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTH_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const REDIRECT_URI = "http://localhost:1455/auth/callback";
+const SCOPE = "openid profile email offline_access";
+function generatePKCE() {
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+    return { codeVerifier, codeChallenge };
+}
+function generateState() {
+    return randomBytes(16).toString("hex");
+}
+function openBrowser(url) {
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    exec(`${cmd} ${JSON.stringify(url)}`, () => {
+        // ignore errors; we show manual fallback in UI
+    });
+}
+async function startCallbackServer(port, timeoutMs, onStatus) {
+    return new Promise((resolve, reject) => {
+        let resolved = false;
+        const server = createServer((req, res) => {
+            try {
+                const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
+                onStatus?.(`Received callback request: ${req.url}`);
+                if (url.pathname === "/auth/callback") {
+                    const code = url.searchParams.get("code");
+                    const state = url.searchParams.get("state");
+                    const error = url.searchParams.get("error");
+                    const errorDesc = url.searchParams.get("error_description");
+                    if (error) {
+                        res.writeHead(400, { "Content-Type": "text/html" });
+                        res.end(`<html><body><h1>Authorization failed</h1><p>${errorDesc || error}</p></body></html>`);
+                        if (!resolved) {
+                            resolved = true;
+                            server.close(() => reject(new Error(`OAuth error: ${errorDesc || error}`)));
+                        }
+                        return;
+                    }
+                    if (code) {
+                        res.writeHead(200, { "Content-Type": "text/html" });
+                        res.end(`<html><body><h1>Authorization successful</h1><p>You can close this window and return to the terminal.</p></body></html>`);
+                        if (!resolved) {
+                            resolved = true;
+                            server.close(() => resolve({ code, state: state || "" }));
+                        }
+                        return;
+                    }
+                }
+                res.writeHead(404);
+                res.end("Not found");
+            }
+            catch {
+                res.writeHead(500);
+                res.end("Error");
+            }
+        });
+        server.listen(port, "127.0.0.1", () => {
+            onStatus?.(`Local server listening on http://127.0.0.1:${port}`);
+        });
+        setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                server.close(() => reject(new Error(`OAuth login timed out after ${timeoutMs / 1000}s`)));
+            }
+        }, timeoutMs);
+    });
+}
+function parseJWT(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+        return JSON.parse(payload);
+    }
+    catch {
+        return null;
+    }
+}
+function extractAccountId(idToken) {
+    if (!idToken)
+        return undefined;
+    const claims = parseJWT(idToken);
+    const auth = claims?.["https://api.openai.com/auth"];
+    return auth?.chatgpt_account_id || auth?.account_id || claims?.sub;
+}
+export async function loginOpenAICodex(callbacks) {
+    callbacks?.onStatus("Starting OpenAI Codex OAuth login...");
+    const pkce = generatePKCE();
+    const state = generateState();
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: CLIENT_ID,
+        redirect_uri: REDIRECT_URI,
+        scope: SCOPE,
+        code_challenge: pkce.codeChallenge,
+        code_challenge_method: "S256",
+        state,
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+    });
+    const authUrl = `${AUTH_URL}?${params.toString()}`;
+    callbacks?.onStatus("Starting local callback server on port 1455...");
+    const serverPromise = startCallbackServer(1455, 5 * 60 * 1000, callbacks?.onStatus);
+    callbacks?.onStatus("Opening browser for authorization...");
+    openBrowser(authUrl);
+    callbacks?.onStatus(`If your browser didn't open, copy this URL manually:\n${authUrl}`);
+    callbacks?.onStatus("Waiting for authorization (timeout: 5min)...");
+    const { code, state: returnedState } = await serverPromise;
+    if (returnedState !== state) {
+        throw new Error("OAuth state mismatch. Possible CSRF attack.");
+    }
+    callbacks?.onStatus("Exchanging authorization code for tokens...");
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: REDIRECT_URI,
+            client_id: CLIENT_ID,
+            code_verifier: pkce.codeVerifier,
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "Unknown error");
+        throw new Error(`Token exchange failed: ${response.status} ${response.statusText} - ${text}`);
+    }
+    const data = (await response.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    const accountId = extractAccountId(data.id_token);
+    callbacks?.onStatus("Login successful!");
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt,
+        idToken: data.id_token,
+        accountId,
+    };
+}
+export async function refreshOpenAICodex(refreshToken) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: CLIENT_ID,
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "Unknown error");
+        throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${text}`);
+    }
+    const data = (await response.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    const accountId = extractAccountId(data.id_token);
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token || refreshToken,
+        expiresAt,
+        idToken: data.id_token,
+        accountId,
+    };
+}

package/dist/oauth/storage.d.ts

@@ -0,0 +1,18 @@
+/**
+ * OAuth credential storage in ~/.bubble/auth.json
+ */
+import type { OAuthCredentials } from "./types.js";
+export declare class AuthStorage {
+    private data;
+    constructor();
+    private load;
+    private save;
+    getPath(): string;
+    get(providerId: string): OAuthCredentials | undefined;
+    set(providerId: string, creds: OAuthCredentials): void;
+    remove(providerId: string): void;
+    has(providerId: string): boolean;
+    isExpired(providerId: string, graceMs?: number): boolean;
+    getAccessToken(providerId: string): string | undefined;
+    list(): string[];
+}

package/dist/oauth/storage.js

@@ -0,0 +1,60 @@
+/**
+ * OAuth credential storage in ~/.bubble/auth.json
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+const AUTH_PATH = join(homedir(), ".bubble", "auth.json");
+export class AuthStorage {
+    data = {};
+    constructor() {
+        this.load();
+    }
+    load() {
+        if (!existsSync(AUTH_PATH))
+            return;
+        try {
+            const raw = readFileSync(AUTH_PATH, "utf-8");
+            const parsed = JSON.parse(raw);
+            this.data = parsed;
+        }
+        catch {
+            this.data = {};
+        }
+    }
+    save() {
+        const dir = dirname(AUTH_PATH);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(AUTH_PATH, JSON.stringify(this.data, null, 2) + "\n", { mode: 0o600 });
+    }
+    getPath() {
+        return AUTH_PATH;
+    }
+    get(providerId) {
+        return this.data[providerId];
+    }
+    set(providerId, creds) {
+        this.data[providerId] = creds;
+        this.save();
+    }
+    remove(providerId) {
+        delete this.data[providerId];
+        this.save();
+    }
+    has(providerId) {
+        return !!this.data[providerId];
+    }
+    isExpired(providerId, graceMs = 5 * 60 * 1000) {
+        const creds = this.data[providerId];
+        if (!creds)
+            return true;
+        return Date.now() >= creds.expiresAt - graceMs;
+    }
+    getAccessToken(providerId) {
+        return this.data[providerId]?.accessToken;
+    }
+    list() {
+        return Object.keys(this.data);
+    }
+}

package/dist/oauth/types.d.ts

@@ -0,0 +1,15 @@
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    idToken?: string;
+    accountId?: string;
+}
+export interface OAuthCredentials {
+    type: "oauth";
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    idToken?: string;
+    accountId?: string;
+}

package/dist/oauth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/orchestrator/default-hooks.d.ts

@@ -0,0 +1,2 @@
+import type { TurnHooks } from "./hooks.js";
+export declare function createDefaultHooks(): TurnHooks[];