@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/chunk-UWCZY52R.js

@@ -0,0 +1,766 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  ReadlineWizardIO
+} from "./chunk-GZFVDR44.js";
+import {
+  NEXUS_API_URL_ARG,
+  emitNexusResult,
+  failNexus,
+  nexusLoginSummary,
+  runNexusLogin,
+  terminalSafe,
+  writeDeviceCodeApproved,
+  writeDeviceCodeInterrupted,
+  writeDeviceCodePending,
+  writeDeviceCodePrompt
+} from "./chunk-GRU74UE4.js";
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine,
+  isHumanOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/login.ts
+import { WHOAMI_ROLE_IDS } from "@cleocode/contracts/llm/system-of-use.js";
+import { NEXUS_LOGIN_TARGET } from "@cleocode/contracts/nexus-account.js";
+
+// packages/cleo/src/cli/lib/nexus-first-run-cli.ts
+var STEP_LINES = {
+  link: "Linking this project to Cleo Nexus...",
+  backup: "Backing it up (encrypted)...",
+  restore: "Restoring its backup from Cleo Nexus...",
+  projects: "Looking up your Cleo Nexus projects..."
+};
+function consentOf(args, env = process.env, tty = process.stdin.isTTY === true && process.stderr.isTTY === true) {
+  if (args["yes"] === true) return "yes";
+  const ci = (env["CI"] ?? "") !== "" && env["CI"] !== "false";
+  if (ci) return "never";
+  return tty ? "prompt" : "unattended";
+}
+async function runNexusFirstRunCli(args, login) {
+  const { nexusFirstRunResult, runNexusFirstRun } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-first-run.js"
+  );
+  const consent = consentOf(args);
+  const io = consent === "prompt" ? new ReadlineWizardIO(process.stdin, process.stderr) : null;
+  try {
+    return await runNexusFirstRun({
+      apiUrl: login.apiUrl,
+      consent,
+      ...io ? {
+        confirm: (question, defaultYes) => io.confirm(question, defaultYes)
+      } : {},
+      deviceId: login.device?.deviceId ?? null,
+      readOnly: args["read-only"] === true,
+      onStep: (step) => process.stderr.write(`${STEP_LINES[step]}
+`)
+    });
+  } catch (err) {
+    return nexusFirstRunResult("skipped", {
+      reason: "the guided first run failed",
+      warnings: [
+        {
+          code: "W_NEXUS_FIRST_RUN_FAILED",
+          message: err instanceof Error ? err.message : String(err)
+        }
+      ]
+    });
+  } finally {
+    io?.close();
+  }
+}
+function projectLine(p) {
+  const where = p.onThisDevice ? "already on this machine" : p.hasBackup === false ? "no backup yet" : p.lastSyncAt ? `last sync ${p.lastSyncAt}` : "backed up";
+  const command = p.restoreByNameCommand ?? p.restoreCommand;
+  return `  ${p.name} (${where})${command ? `: ${command}` : ""}`;
+}
+function projectsBlock(r) {
+  if (r.projects.length === 0) {
+    return r.warnings.length > 0 ? " Your Cleo Nexus projects could not be listed (see warnings)." : " This account has no Cleo Nexus projects yet: run `cleo login nexus` inside a CLEO project to link and back it up.";
+  }
+  return [
+    " Your Cleo Nexus projects (run a restore inside the folder it belongs in, e.g. a clone of its repository):",
+    ...r.projects.map(projectLine)
+  ].join("\n");
+}
+function nexusFirstRunSummary(login, r) {
+  const signedIn = nexusLoginSummary(login);
+  const name = r.link?.label ? `"${r.link.label}"` : "this project";
+  switch (r.state) {
+    case "backed-up": {
+      const snap = r.backup?.snapshot;
+      const what = r.backup?.status === "up-to-date" ? `the cloud already holds this state (snapshot ${snap?.checkpointId ?? "none"})` : `snapshot ${snap?.checkpointId ?? "unknown"}, ${snap?.rows ?? 0} rows`;
+      return `Signed in, linked, backed up. ${signedIn} Project ${name} is linked and backed up (${what}).`;
+    }
+    case "restored": {
+      const what = r.restore?.status === "up-to-date" ? "this copy already held its newest backup" : `snapshot ${r.restore?.snapshot?.checkpointId ?? "unknown"}, ${r.restore?.tables ?? 0} tables verified${r.restore?.safetyBackup ? `; the previous state is saved at ${r.restore.safetyBackup}` : ""}`;
+      return `Signed in, restored, linked. ${signedIn} Project ${name} was restored from Cleo Nexus (${what}).`;
+    }
+    case "restore-failed":
+      return r.choices.length > 0 ? `${signedIn} This copy has rows it never synced, so the backup was not restored. Choose one:
+${r.choices.map((c) => `  ${c.command}  (${c.effect})`).join("\n")}` : `${signedIn} Restoring this project's backup failed (see warnings). Next: ${r.nextCommand}`;
+    case "link-failed":
+      return `${signedIn} Linking this project failed (see warnings). Next: ${r.nextCommand}`;
+    case "backup-failed":
+      return `${signedIn} Project ${name} is linked, but the backup failed (see warnings). Next: ${r.nextCommand}`;
+    case "offered":
+      return r.offer === "restore" ? `${signedIn} Cleo Nexus holds a backup of this project that this copy never synced. To restore it here: ${r.nextCommand}` : `${signedIn} This project is not linked to Cleo Nexus. To link and back it up: ${r.nextCommand}`;
+    case "declined":
+      return r.offer === "restore" ? `${signedIn} Not restored. To restore its backup later: ${r.nextCommand}` : `${signedIn} Not linked. To link and back up later: ${r.nextCommand}`;
+    case "projects":
+      return `${signedIn}${projectsBlock(r)}`;
+    default:
+      return signedIn;
+  }
+}
+async function runNexusLoginCommand(args, operation, openBrowser) {
+  let login;
+  try {
+    login = await runNexusLogin(args, openBrowser);
+  } catch (err) {
+    failNexus(err, operation);
+  }
+  const firstRun = await runNexusFirstRunCli(args, login);
+  for (const w of firstRun.warnings)
+    process.stderr.write(`warning: ${terminalSafe(w.message)} (${w.code})
+`);
+  if (!isHumanOutput()) {
+    if (firstRun.nextCommand) process.stderr.write(`next: ${firstRun.nextCommand}
+`);
+    for (const c of firstRun.choices) process.stderr.write(`choice: ${c.command}  (${c.effect})
+`);
+  }
+  emitNexusResult(
+    { ...login, firstRun },
+    nexusFirstRunSummary(login, firstRun),
+    "login",
+    operation
+  );
+}
+
+// packages/cleo/src/cli/commands/llm-login.ts
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
+import { addCredential } from "@cleocode/core/llm/credentials-store.js";
+import {
+  DeviceCodeAuthError,
+  DeviceCodeTimeoutError,
+  getKimiCodeDeviceCodeConfig,
+  pollForToken,
+  startDeviceCodeFlow
+} from "@cleocode/core/llm/oauth/device-code.js";
+import {
+  buildAuthorizationUrl,
+  exchangePkceCode,
+  generatePkcePair,
+  parseAuthorizationInput,
+  refreshPkceToken
+} from "@cleocode/core/llm/oauth/pkce.js";
+import { getKimiCodeMshHeaders } from "@cleocode/core/llm/provider-registry/builtin/kimi-code.js";
+import { getProviderProfile, listProviders } from "@cleocode/core/llm/provider-registry/index.js";
+function _errorResult(code, message, meta) {
+  return { success: false, error: { code, codeName: code, message }, meta };
+}
+async function runLlmLogin(provider, opts) {
+  const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+  const profile = await getProviderProfile(provider);
+  const oauthMode = profile?.oauth?.mode;
+  if (provider === "kimi-code" || oauthMode === "device-code") {
+    return _runKimiCodeLogin(opts, meta);
+  }
+  if (oauthMode === "pkce") {
+    return _runPkceLogin(profile.name, profile.oauth, opts, meta);
+  }
+  return _errorResult(
+    "E_NOT_IMPLEMENTED",
+    `OAuth login for '${provider}' is not yet wired. ${await _supportedOauthProvidersHint()} For any other provider, add an API key with 'cleo llm add <provider> --api-key-stdin'.`,
+    meta
+  );
+}
+async function _supportedOauthProvidersHint() {
+  try {
+    const profiles = await listProviders();
+    const oauthable = profiles.flatMap((p) => p.oauth ? [`'${p.name}' (${p.oauth.mode})`] : []);
+    return oauthable.length > 0 ? `Providers with OAuth login: ${oauthable.join(", ")}.` : "No providers currently expose OAuth login.";
+  } catch {
+    return "Providers with OAuth login: 'anthropic' (pkce), 'openai' (pkce), 'kimi-code' (device-code).";
+  }
+}
+async function _runPkceLogin(provider, oauthCfg, opts, meta) {
+  const { codeVerifier, codeChallenge } = await generatePkcePair();
+  const state = _generateState();
+  const isHeadless = opts.headless || process.env["CLEO_HEADLESS"] === "1";
+  const fixedPort = isHeadless ? null : _parseFixedLoopbackPort(oauthCfg.redirectUri);
+  const isNonLoopbackPasteBack = !isHeadless && fixedPort === null && !_isLoopbackUri(oauthCfg.redirectUri);
+  const effectiveHeadless = isHeadless || isNonLoopbackPasteBack;
+  const port = effectiveHeadless ? 0 : fixedPort ?? await _findFreePort();
+  const randomRedirect = `http://localhost:${port}/callback`;
+  const redirectUri = effectiveHeadless ? oauthCfg.redirectUri ?? "http://localhost" : fixedPort != null ? oauthCfg.redirectUri ?? randomRedirect : randomRedirect;
+  const authUrl = buildAuthorizationUrl({
+    authorizationEndpoint: oauthCfg.authorizationEndpoint ?? "",
+    clientId: oauthCfg.clientId,
+    redirectUri,
+    scope: oauthCfg.scope ?? "",
+    codeChallenge,
+    state,
+    extraParams: oauthCfg.extraAuthParams
+  });
+  let code;
+  if (effectiveHeadless) {
+    try {
+      code = await _headlessPkceFlow(provider, authUrl, state);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return _errorResult("E_PKCE_INVALID_CALLBACK", msg, meta);
+    }
+  } else {
+    const result = await _localCallbackPkceFlow(provider, authUrl, state, port);
+    if ("error" in result) {
+      return { success: false, error: result.error, meta };
+    }
+    code = result.code;
+  }
+  let tokens;
+  try {
+    tokens = await exchangePkceCode({
+      provider,
+      clientId: oauthCfg.clientId,
+      code,
+      codeVerifier,
+      redirectUri,
+      tokenEndpoint: oauthCfg.tokenEndpoint,
+      state,
+      bodyFormat: oauthCfg.tokenBodyFormat
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return _errorResult("E_PKCE_EXCHANGE_FAILED", `PKCE code exchange failed: ${msg}`, meta);
+  }
+  process.stderr.write("\r  Authorization approved.              \n\n");
+  const label = opts.label ?? "oauth-login";
+  const expiresAt = typeof tokens.expiresIn === "number" ? Date.now() + tokens.expiresIn * 1e3 : void 0;
+  const oauthExtraHeaders = provider === "anthropic" ? { "anthropic-beta": "oauth-2025-04-20" } : void 0;
+  try {
+    await addCredential({
+      provider,
+      label,
+      authType: "oauth",
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt,
+      priority: 10,
+      source: "oauth-pkce",
+      ...oauthExtraHeaders ? { extraHeaders: oauthExtraHeaders } : {}
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return _errorResult(
+      "E_CREDENTIAL_STORE_FAILED",
+      `Failed to store credential in pool: ${msg}`,
+      meta
+    );
+  }
+  return {
+    success: true,
+    data: { provider, label, expiresIn: tokens.expiresIn },
+    meta
+  };
+}
+function _parseFixedLoopbackPort(redirectUri) {
+  if (!redirectUri) return null;
+  try {
+    const u = new URL(redirectUri);
+    const isLoopback = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+    if (!isLoopback || !u.port) return null;
+    const port = Number(u.port);
+    return Number.isInteger(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
+}
+function _isLoopbackUri(redirectUri) {
+  if (!redirectUri) return false;
+  try {
+    const u = new URL(redirectUri);
+    return u.hostname === "localhost" || u.hostname === "127.0.0.1";
+  } catch {
+    return false;
+  }
+}
+async function _headlessPkceFlow(provider, authUrl, expectedState) {
+  process.stderr.write(
+    `
+  Provider: ${provider}
+  Open this URL in your browser to authorize:
+
+  ${authUrl}
+
+  After approving, paste the full redirect URL (\u2026?code=\u2026&state=\u2026) or the code shown:
+  `
+  );
+  return new Promise((resolve, reject) => {
+    process.stdin.setEncoding("utf8");
+    process.stdin.once("data", (chunk) => {
+      process.stdin.pause();
+      const parsed = parseAuthorizationInput(String(chunk));
+      if (!parsed.code) {
+        reject(new Error('Pasted input is missing the authorization "code" parameter'));
+        return;
+      }
+      if (parsed.state && parsed.state !== expectedState) {
+        reject(new Error("OAuth state mismatch \u2014 pasted redirect does not match this login"));
+        return;
+      }
+      resolve(parsed.code);
+    });
+    process.stdin.resume();
+  });
+}
+async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
+  return new Promise((resolve) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      res.writeHead(200, { "Content-Type": "text/html" });
+      if (error) {
+        res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
+        server.close();
+        resolve({
+          error: {
+            code: "E_PKCE_AUTH_DENIED",
+            codeName: "E_PKCE_AUTH_DENIED",
+            message: `OAuth authorization denied for '${provider}': ${error}`
+          }
+        });
+        return;
+      }
+      if (!code || state !== expectedState) {
+        res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
+        server.close();
+        resolve({
+          error: {
+            code: "E_PKCE_INVALID_CALLBACK",
+            codeName: "E_PKCE_INVALID_CALLBACK",
+            message: "OAuth callback received invalid code or state mismatch"
+          }
+        });
+        return;
+      }
+      res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
+      server.close();
+      resolve({ code });
+    });
+    server.listen(port, "localhost", () => {
+      process.stderr.write("\n");
+      process.stderr.write(`  Provider: ${provider}
+`);
+      process.stderr.write(`  Open this URL to authorize (or it will open automatically):
+
+`);
+      process.stderr.write(`  ${authUrl}
+
+`);
+      process.stderr.write(`  Waiting for authorization callback...
+`);
+      _tryOpenBrowser(authUrl);
+    });
+  });
+}
+async function _runKimiCodeLogin(opts, meta) {
+  const cfg = getKimiCodeDeviceCodeConfig();
+  let startResp;
+  try {
+    startResp = await startDeviceCodeFlow(cfg);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return _errorResult(
+      "E_DEVICE_CODE_START_FAILED",
+      `Failed to initiate Kimi Code device-code OAuth flow: ${msg}`,
+      meta
+    );
+  }
+  writeDeviceCodePrompt(startResp, "Kimi Code");
+  let tokenResp;
+  try {
+    tokenResp = await pollForToken(cfg, startResp, { onPending: writeDeviceCodePending });
+  } catch (err) {
+    writeDeviceCodeInterrupted();
+    if (err instanceof DeviceCodeTimeoutError) {
+      return _errorResult("E_DEVICE_CODE_TIMEOUT", err.message, meta);
+    }
+    if (err instanceof DeviceCodeAuthError) {
+      return _errorResult("E_DEVICE_CODE_AUTH_FAILED", err.message, meta);
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return _errorResult(
+      "E_DEVICE_CODE_POLL_FAILED",
+      `Polling for Kimi Code device-code token failed: ${msg}`,
+      meta
+    );
+  }
+  writeDeviceCodeApproved("Kimi Code");
+  const label = opts.label ?? "oauth-login";
+  const expiresAt = typeof tokenResp.expiresIn === "number" ? Date.now() + tokenResp.expiresIn * 1e3 : void 0;
+  try {
+    await addCredential({
+      provider: "kimi-code",
+      label,
+      authType: "oauth",
+      accessToken: tokenResp.accessToken,
+      refreshToken: tokenResp.refreshToken,
+      expiresAt,
+      priority: 10,
+      source: "oauth-device-code",
+      // The six mandatory X-Msh-* headers must be carried alongside the token
+      // so every transport that picks this credential sends them automatically.
+      extraHeaders: getKimiCodeMshHeaders()
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return _errorResult(
+      "E_CREDENTIAL_STORE_FAILED",
+      `Failed to store Kimi Code credential in pool: ${msg}`,
+      meta
+    );
+  }
+  return {
+    success: true,
+    data: {
+      provider: "kimi-code",
+      label,
+      expiresIn: tokenResp.expiresIn
+    },
+    meta
+  };
+}
+function _generateState() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function _findFreePort() {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.listen(0, "localhost", () => {
+      const addr = srv.address();
+      if (!addr || typeof addr === "string") {
+        srv.close();
+        reject(new Error("Could not determine callback port"));
+        return;
+      }
+      const port = addr.port;
+      srv.close(() => resolve(port));
+    });
+    srv.on("error", reject);
+  });
+}
+var UNSAFE_OPEN_URL = /^-|[\u0000-\u0020\u007f-\u009f\s]/;
+function _tryOpenBrowser(url) {
+  if (UNSAFE_OPEN_URL.test(url)) return;
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// packages/cleo/src/cli/commands/login.ts
+async function providerRegistry() {
+  const mod = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/provider-registry/index.js"
+  );
+  return {
+    getProviderProfile: mod.getProviderProfile,
+    listProviders: mod.listProviders
+  };
+}
+var AUTH_METHODS = ["oauth", "api_key"];
+async function readApiKeyFromStdin() {
+  if (process.stdin.isTTY) return "";
+  process.stdin.setEncoding("utf-8");
+  let buf = "";
+  for await (const chunk of process.stdin) {
+    buf += chunk;
+  }
+  return buf.replace(/\r?\n$/, "").trim();
+}
+function makeOAuthAcquirer(label) {
+  return async (provider) => {
+    const result = await runLlmLogin(provider, label ? { label } : {});
+    if (!result.success || !result.data) {
+      const message = result.error?.message ?? `OAuth login failed for '${provider}'.`;
+      throw new Error(message);
+    }
+    return {
+      label: result.data.label,
+      ...result.data.expiresIn != null ? { expiresIn: result.data.expiresIn } : {}
+    };
+  };
+}
+function parseRole(raw) {
+  if (typeof raw !== "string" || raw === "") return void 0;
+  if (WHOAMI_ROLE_IDS.includes(raw)) return raw;
+  throw new Error(`Invalid --role '${raw}'. Valid roles: ${WHOAMI_ROLE_IDS.join(", ")}.`);
+}
+async function runLoginFrontDoor(args) {
+  const { runFrontDoorLogin } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/onboarding/front-door.js"
+  );
+  const flags = await resolveFlags(args);
+  const acquirer = makeOAuthAcquirer(flags.label);
+  return runFrontDoorLogin(
+    flags.provider,
+    {
+      ...flags.authMode !== void 0 ? { authMode: flags.authMode } : {},
+      ...flags.token !== void 0 ? { token: flags.token } : {},
+      ...flags.model !== void 0 ? { model: flags.model } : {},
+      ...flags.role !== void 0 ? { role: flags.role } : {},
+      ...flags.label !== void 0 ? { label: flags.label } : {}
+    },
+    acquirer
+  );
+}
+async function resolveFlags(args) {
+  const out = {};
+  const labelArg = typeof args["label"] === "string" && args["label"] ? args["label"] : void 0;
+  if (labelArg) out.label = labelArg;
+  out.model = typeof args["model"] === "string" && args["model"] ? args["model"] : void 0;
+  out.role = parseRole(args["role"]);
+  const registry = await providerRegistry();
+  const io = new ReadlineWizardIO(process.stdin, process.stderr);
+  try {
+    out.provider = await resolveProvider(args, registry, io);
+    out.authMode = await resolveAuthMethod(args, out.provider, registry, io);
+    if (out.authMode === "api_key") {
+      out.token = await resolveRequiredApiKey(args, io);
+    }
+  } finally {
+    io.close();
+  }
+  return out;
+}
+async function resolveProvider(args, registry, io) {
+  const provider = typeof args["provider"] === "string" ? args["provider"] : "";
+  if (provider) return provider;
+  if (!process.stdin.isTTY) {
+    throw new Error(
+      "No --provider supplied and stdin is not a TTY. Pass `--provider <name>` (e.g. anthropic, openai, gemini)."
+    );
+  }
+  const profiles = await registry.listProviders();
+  const names = profiles.map((p) => p.name).sort();
+  return io.select("Which provider do you want to log in to?", names);
+}
+async function resolveAuthMethod(args, provider, registry, io) {
+  const authArg = typeof args["auth"] === "string" ? args["auth"] : "";
+  if (authArg === "oauth" || authArg === "api_key") return authArg;
+  if (authArg !== "") throw new Error(`Invalid --auth '${authArg}'. Valid: oauth | api_key.`);
+  const supportsOAuth = Boolean((await registry.getProviderProfile(provider))?.oauth);
+  if (!process.stdin.isTTY) {
+    return hasApiKeyFlag(args) ? "api_key" : supportsOAuth ? "oauth" : "api_key";
+  }
+  if (supportsOAuth) return io.select("How do you want to authenticate?", AUTH_METHODS);
+  return "api_key";
+}
+async function resolveRequiredApiKey(args, io) {
+  const token = await resolveApiKey(args, io);
+  if (!token) {
+    throw new Error(
+      "No API key supplied. Pass `--api-key-stdin` (recommended), `--api-key <value>`, or run interactively to be prompted."
+    );
+  }
+  return token;
+}
+async function resolveApiKey(args, io) {
+  if (args["api-key-stdin"] === true) {
+    return readApiKeyFromStdin();
+  }
+  if (typeof args["api-key"] === "string" && args["api-key"]) {
+    return args["api-key"];
+  }
+  if (process.stdin.isTTY) {
+    return (await io.secret("API key (input hidden):")).trim();
+  }
+  return "";
+}
+function hasApiKeyFlag(args) {
+  return args["api-key-stdin"] === true || typeof args["api-key"] === "string" && args["api-key"] !== "";
+}
+var NEXUS_PICKER_LABEL = "Cleo Nexus account";
+function loginPickerOptions(providerNames) {
+  return [NEXUS_PICKER_LABEL, ...[...providerNames].sort()];
+}
+var LLM_ONLY_FLAGS = ["api-key", "api-key-stdin", "model", "role", "auth", "label"];
+function nonInteractiveLoginTarget(args, operation) {
+  if (operation !== "login.run") return void 0;
+  const llmIntent = LLM_ONLY_FLAGS.some((f) => args[f] !== void 0 && args[f] !== false);
+  return llmIntent ? void 0 : NEXUS_LOGIN_TARGET;
+}
+async function resolveLoginTarget(args, operation) {
+  const given = typeof args["provider"] === "string" ? args["provider"] : "";
+  if (given) return given;
+  if (!process.stdin.isTTY) return nonInteractiveLoginTarget(args, operation);
+  const names = (await (await providerRegistry()).listProviders()).map((p) => p.name);
+  const io = new ReadlineWizardIO(process.stdin, process.stderr);
+  try {
+    const choice = await io.select("What do you want to log in to?", loginPickerOptions(names));
+    return choice === NEXUS_PICKER_LABEL ? NEXUS_LOGIN_TARGET : choice;
+  } finally {
+    io.close();
+  }
+}
+async function runLoginCommand(args, operation) {
+  let target;
+  try {
+    target = await resolveLoginTarget(args, operation);
+  } catch (err) {
+    failLogin(err, operation);
+  }
+  if (target === NEXUS_LOGIN_TARGET) {
+    await runNexusLoginCommand(args, operation, _tryOpenBrowser);
+    return;
+  }
+  let result;
+  try {
+    result = await runLoginFrontDoor(target ? { ...args, provider: target } : args);
+  } catch (err) {
+    failLogin(err, operation);
+  }
+  emitLoginResult(result, operation);
+}
+function failLogin(err, operation) {
+  cliError(
+    err instanceof Error ? err.message : String(err),
+    1,
+    { name: "E_LOGIN_FAILED" },
+    { operation }
+  );
+  process.exit(1);
+}
+function emitLoginResult(result, operation) {
+  if (!result.validated) {
+    emitLoginFailure(result, operation);
+    return;
+  }
+  if (isHumanOutput()) {
+    humanLine(
+      `Logged in to ${result.provider} as '${result.accountLabel}' \u2014 bound ${result.profileName ?? "default"} \u2192 ${result.provider}/${result.modelId}.`
+    );
+  } else {
+    cliOutput(result, { command: "login", operation });
+  }
+}
+function emitLoginFailure(result, operation) {
+  const failed = result.steps.find((s) => s.status === "failed");
+  cliError(
+    failed?.detail ?? "Onboarding login did not complete.",
+    failed?.code ?? 1,
+    { name: failed?.code ?? "E_ONBOARDING_INCOMPLETE", details: { steps: result.steps } },
+    { operation }
+  );
+  process.exit(1);
+}
+var LOGIN_ARGS = {
+  provider: {
+    type: "positional",
+    description: "What to log in to: 'nexus' (Cleo Nexus account) or an LLM provider (anthropic | openai | codex | gemini | kimi-code | \u2026).",
+    required: false
+  },
+  "api-url": NEXUS_API_URL_ARG,
+  browser: {
+    type: "boolean",
+    description: "Open the verification URL in a browser (nexus). --no-browser only prints it (SSH, containers).",
+    default: true
+  },
+  "read-only": {
+    type: "boolean",
+    description: "nexus: enrol this machine with the read-only device profile (account, devices and project reads only). Refused with CLEO_NEXUS_DEVICE=0."
+  },
+  name: {
+    type: "string",
+    description: "nexus: device name shown on cleocode.dev (default: OS, arch and a short id; never the hostname). Ignored with CLEO_NEXUS_DEVICE=0."
+  },
+  yes: {
+    type: "boolean",
+    description: "nexus: inside a CLEO project this machine has not linked, link it and take the first encrypted backup without asking (or, when Cleo Nexus already backs it up from another device and this copy never synced, restore that backup here). Without it a terminal is asked; a non-interactive run outside CI (an agent) links and backs up unattended but never restores unasked; CI only prints the next command."
+  },
+  auth: {
+    type: "string",
+    description: "Auth method: 'oauth' (browser) or 'api_key'. Inferred from the provider when omitted."
+  },
+  "api-key": {
+    type: "string",
+    description: "(DEPRECATED \u2014 visible to `ps`/shell history) API key for the api_key path. Prefer --api-key-stdin."
+  },
+  "api-key-stdin": {
+    type: "boolean",
+    description: "(recommended) Read the API key from piped stdin instead of a flag."
+  },
+  model: {
+    type: "string",
+    description: "Model id to bind (default: the latest catalog model for the provider)."
+  },
+  role: {
+    type: "string",
+    description: `Bind the model to a specific role instead of the global default. Valid: ${WHOAMI_ROLE_IDS.join(" | ")}.`
+  },
+  label: {
+    type: "string",
+    description: "Credential label (default: 'oauth-login')."
+  },
+  json: {
+    type: "boolean",
+    description: "Output the result as a JSON LAFS envelope."
+  }
+};
+var loginCommand = defineCommand({
+  meta: {
+    name: "login",
+    // ONE quoted literal, no backticks: the manifest generator's DESC_RE
+    // captures only the first plain string literal (concatenations + backticks
+    // truncate the `cleo --help` text mid-sentence).
+    description: "Log in to a Cleo Nexus account (cleo login nexus: device code, --api-url, --no-browser) or to an LLM provider, binding a usable profile in one step. The picker lists the Cleo Nexus account first, then the providers. Without a terminal and no target, cleo login signs in to Cleo Nexus (an agent needs no extra word). After a Cleo Nexus sign-in inside an unlinked CLEO project it links the project and backs it up: a terminal is asked, --yes or a non-interactive run (an agent) does it, a restore over this copy is never done unasked, and CI only prints the next command; outside a project it lists your projects with the cleo cloud restore command for each. For a provider it picks an auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json."
+  },
+  args: LOGIN_ARGS,
+  async run({ args }) {
+    await runLoginCommand(args, "login.run");
+  }
+});
+
+export {
+  makeOAuthAcquirer,
+  runLoginFrontDoor,
+  NEXUS_PICKER_LABEL,
+  loginPickerOptions,
+  nonInteractiveLoginTarget,
+  runLoginCommand,
+  emitLoginResult,
+  LOGIN_ARGS,
+  loginCommand
+};
+//# sourceMappingURL=chunk-UWCZY52R.js.map