@cleocode/cleo 2026.5.68 → 2026.5.70

package/dist/cli/index.js

@@ -1565,6 +1565,13 @@ var init_branch_lock = __esm({
   }
 });
 
+// packages/contracts/src/credentials.ts
+var init_credentials = __esm({
+  "packages/contracts/src/credentials.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/engine-result.ts
 var init_engine_result = __esm({
   "packages/contracts/src/engine-result.ts"() {
@@ -1781,6 +1788,13 @@ var init_lafs = __esm({
   }
 });
 
+// packages/contracts/src/llm/plugin-llm.ts
+var init_plugin_llm = __esm({
+  "packages/contracts/src/llm/plugin-llm.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/operations/admin.ts
 var init_admin = __esm({
   "packages/contracts/src/operations/admin.ts"() {
@@ -2743,6 +2757,7 @@ var init_src2 = __esm({
     init_acceptance_gate_schema();
     init_attachment_schema();
     init_branch_lock();
+    init_credentials();
     init_engine_result();
     init_errors();
     init_evidence_record_schema();
@@ -2750,6 +2765,7 @@ var init_src2 = __esm({
     init_facade();
     init_graph();
     init_lafs();
+    init_plugin_llm();
     init_operations();
     init_nexus_scope_map();
     init_params();
@@ -16779,8 +16795,9 @@ import {
   generateMemoryBridgeContent,
   getBrainDb,
   getBrainNativeDb,
-  resolveAnthropicApiKey,
-  resolveAnthropicApiKeySource,
+  OAUTH_STATUS_PROVIDERS,
+  resolveCredentials,
+  resolveProviderStatus,
   typedAll
 } from "@cleocode/core/internal";
 import {
@@ -17271,8 +17288,22 @@ var init_memory2 = __esm({
             }
             // T791 — LLM extraction backend status
             case "llm-status": {
-              const resolvedSource = resolveAnthropicApiKeySource();
-              const extractionEnabled = resolveAnthropicApiKey() !== null;
+              const _anthropicCred = resolveCredentials("anthropic");
+              const extractionEnabled = _anthropicCred.apiKey !== null;
+              const resolvedSource = (() => {
+                switch (_anthropicCred.source) {
+                  case "env":
+                    return "env";
+                  case "claude-creds":
+                    return "oauth";
+                  case "global-config":
+                  case "project-config":
+                    return "config";
+                  default:
+                    return "none";
+                }
+              })();
+              const providers = OAUTH_STATUS_PROVIDERS.map(resolveProviderStatus);
               let lastExtractionRun = null;
               try {
                 await getBrainDb(projectRoot);
@@ -17297,7 +17328,8 @@ var init_memory2 = __esm({
                     resolvedSource,
                     extractionEnabled,
                     lastExtractionRun,
-                    testCommand: "cleo memory reflect --json"
+                    testCommand: "cleo memory reflect --json",
+                    providers
                   }
                 },
                 "query",
@@ -34309,7 +34341,7 @@ var backup_inspect_exports = {};
 __export(backup_inspect_exports, {
   backupInspectSubCommand: () => backupInspectSubCommand
 });
-import crypto from "node:crypto";
+import crypto2 from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -34357,7 +34389,7 @@ function verifyManifestHash(raw, manifest) {
   const intObj = obj["integrity"];
   intObj["manifestHash"] = "";
   const forHashing = JSON.stringify(obj);
-  const computed = crypto.createHash("sha256").update(forHashing).digest("hex");
+  const computed = crypto2.createHash("sha256").update(forHashing).digest("hex");
   return computed === expectedHash;
 }
 function fmtBytes(bytes) {
@@ -34574,7 +34606,7 @@ var backup_exports = {};
 __export(backup_exports, {
   backupCommand: () => backupCommand
 });
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 import readline from "node:readline";
@@ -34628,7 +34660,7 @@ function sha256OfMachineKey(cleoHome) {
   if (!fs2.existsSync(keyPath)) {
     return "0".repeat(64);
   }
-  return crypto2.createHash("sha256").update(fs2.readFileSync(keyPath)).digest("hex");
+  return crypto3.createHash("sha256").update(fs2.readFileSync(keyPath)).digest("hex");
 }
 var addCommand2, listCommand4, exportCommand, importCommand, backupCommand;
 var init_backup = __esm({
@@ -44164,28 +44196,210 @@ var init_llm_cost = __esm({
 });
 
 // packages/cleo/src/cli/commands/llm-login.ts
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
 import { addCredential } from "@cleocode/core/llm/credentials-store.js";
 import {
   DeviceCodeAuthError,
   DeviceCodeTimeoutError,
-  getAnthropicDeviceCodeConfig,
+  getKimiCodeDeviceCodeConfig,
   pollForToken,
   startDeviceCodeFlow
 } from "@cleocode/core/llm/oauth/device-code.js";
+import {
+  buildAuthorizationUrl,
+  exchangePkceCode,
+  generatePkcePair,
+  refreshPkceToken
+} from "@cleocode/core/llm/oauth/pkce.js";
+import { getKimiCodeMshHeaders } from "@cleocode/core/llm/provider-registry/builtin/kimi-code.js";
+import { getProviderProfile } from "@cleocode/core/llm/provider-registry/index.js";
 async function runLlmLogin(provider, opts) {
   const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
-  if (provider !== "anthropic") {
+  const profile = await getProviderProfile(provider);
+  const oauthMode = profile?.oauth?.mode;
+  if (provider === "kimi-code" || oauthMode === "device-code") {
+    return _runKimiCodeLogin(opts, meta);
+  }
+  if (oauthMode === "pkce") {
+    return _runPkceLogin(provider, profile.oauth, opts, meta);
+  }
+  return {
+    success: false,
+    error: {
+      code: "E_NOT_IMPLEMENTED",
+      codeName: "E_NOT_IMPLEMENTED",
+      message: `OAuth login for '${provider}' is not yet wired. Supported providers: 'anthropic' (PKCE), 'kimi-code' (device-code). To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+    },
+    meta
+  };
+}
+async function _runPkceLogin(provider, oauthCfg, opts, meta) {
+  const { codeVerifier, codeChallenge } = await generatePkcePair();
+  const state = _generateState();
+  const isHeadless = opts.headless || process.env["CLEO_HEADLESS"] === "1";
+  const port = isHeadless ? 0 : await _findFreePort();
+  const redirectUri = isHeadless ? oauthCfg.redirectUri ?? "http://localhost" : `http://localhost:${port}/callback`;
+  const authUrl = buildAuthorizationUrl({
+    authorizationEndpoint: oauthCfg.authorizationEndpoint ?? "",
+    clientId: oauthCfg.clientId,
+    redirectUri,
+    scope: oauthCfg.scope ?? "",
+    codeChallenge,
+    state
+  });
+  let code;
+  if (isHeadless) {
+    code = await _headlessPkceFlow(provider, authUrl);
+  } else {
+    const result = await _localCallbackPkceFlow(provider, authUrl, state, port);
+    if ("error" in result) {
+      return { success: false, error: result.error, meta };
+    }
+    code = result.code;
+  }
+  let tokens;
+  try {
+    tokens = await exchangePkceCode({
+      provider,
+      clientId: oauthCfg.clientId,
+      code,
+      codeVerifier,
+      redirectUri,
+      tokenEndpoint: oauthCfg.tokenEndpoint
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
     return {
       success: false,
       error: {
-        code: "E_NOT_IMPLEMENTED",
-        codeName: "E_NOT_IMPLEMENTED",
-        message: `OAuth device-code login for '${provider}' is not yet wired. 'anthropic' is the only supported provider in the current MVP. To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+        code: "E_PKCE_EXCHANGE_FAILED",
+        codeName: "E_PKCE_EXCHANGE_FAILED",
+        message: `PKCE code exchange failed: ${msg}`
       },
       meta
     };
   }
-  const cfg = getAnthropicDeviceCodeConfig();
+  process.stderr.write("\r  Authorization approved.              \n\n");
+  const label = opts.label ?? "oauth-login";
+  const expiresAt = typeof tokens.expiresIn === "number" ? Date.now() + tokens.expiresIn * 1e3 : void 0;
+  try {
+    await addCredential({
+      provider,
+      label,
+      authType: "oauth",
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt,
+      priority: 10,
+      source: "oauth-pkce",
+      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_CREDENTIAL_STORE_FAILED",
+        codeName: "E_CREDENTIAL_STORE_FAILED",
+        message: `Failed to store credential in pool: ${msg}`
+      },
+      meta
+    };
+  }
+  return {
+    success: true,
+    data: { provider, label, expiresIn: tokens.expiresIn },
+    meta
+  };
+}
+async function _headlessPkceFlow(provider, authUrl) {
+  process.stderr.write("\n");
+  process.stderr.write(`  Provider: ${provider}
+`);
+  process.stderr.write(`  Open this URL in your browser to authorize:
+
+`);
+  process.stderr.write(`  ${authUrl}
+
+`);
+  process.stderr.write(
+    `  After approving, paste the full redirect URL (http://localhost?code=\u2026&state=\u2026):
+  `
+  );
+  return new Promise((resolve7, reject) => {
+    let buf = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.once("data", (chunk) => {
+      buf += String(chunk).trim();
+      try {
+        const url = new URL(buf);
+        const code = url.searchParams.get("code");
+        if (!code) {
+          reject(new Error('Redirect URL is missing the "code" parameter'));
+          return;
+        }
+        resolve7(code);
+      } catch {
+        reject(new Error(`Invalid redirect URL: ${buf}`));
+      }
+    });
+  });
+}
+async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
+  return new Promise((resolve7) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      res.writeHead(200, { "Content-Type": "text/html" });
+      if (error) {
+        res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
+        server.close();
+        resolve7({
+          error: {
+            code: "E_PKCE_AUTH_DENIED",
+            codeName: "E_PKCE_AUTH_DENIED",
+            message: `OAuth authorization denied for '${provider}': ${error}`
+          }
+        });
+        return;
+      }
+      if (!code || state !== expectedState) {
+        res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
+        server.close();
+        resolve7({
+          error: {
+            code: "E_PKCE_INVALID_CALLBACK",
+            codeName: "E_PKCE_INVALID_CALLBACK",
+            message: "OAuth callback received invalid code or state mismatch"
+          }
+        });
+        return;
+      }
+      res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
+      server.close();
+      resolve7({ code });
+    });
+    server.listen(port, "localhost", () => {
+      process.stderr.write("\n");
+      process.stderr.write(`  Provider: ${provider}
+`);
+      process.stderr.write(`  Open this URL to authorize (or it will open automatically):
+
+`);
+      process.stderr.write(`  ${authUrl}
+
+`);
+      process.stderr.write(`  Waiting for authorization callback...
+`);
+      _tryOpenBrowser(authUrl);
+    });
+  });
+}
+async function _runKimiCodeLogin(opts, meta) {
+  const cfg = getKimiCodeDeviceCodeConfig();
   let startResp;
   try {
     startResp = await startDeviceCodeFlow(cfg);
@@ -44196,7 +44410,7 @@ async function runLlmLogin(provider, opts) {
       error: {
         code: "E_DEVICE_CODE_START_FAILED",
         codeName: "E_DEVICE_CODE_START_FAILED",
-        message: `Failed to initiate device-code OAuth flow: ${msg}`
+        message: `Failed to initiate Kimi Code device-code OAuth flow: ${msg}`
       },
       meta
     };
@@ -44210,7 +44424,7 @@ async function runLlmLogin(provider, opts) {
 `);
   process.stderr.write("\n");
   process.stderr.write(
-    `  Waiting for authorization (up to ${Math.round(startResp.expiresIn / 60)} min)...
+    `  Waiting for Kimi Code authorization (up to ${Math.round(startResp.expiresIn / 60)} min)...
 `
   );
   let tokenResp;
@@ -44250,17 +44464,17 @@ async function runLlmLogin(provider, opts) {
       error: {
         code: "E_DEVICE_CODE_POLL_FAILED",
         codeName: "E_DEVICE_CODE_POLL_FAILED",
-        message: `Polling for device code token failed: ${msg}`
+        message: `Polling for Kimi Code device-code token failed: ${msg}`
       },
       meta
     };
   }
-  process.stderr.write("\r  Authorization approved.              \n\n");
+  process.stderr.write("\r  Kimi Code authorization approved.              \n\n");
   const label = opts.label ?? "oauth-login";
   const expiresAt = typeof tokenResp.expiresIn === "number" ? Date.now() + tokenResp.expiresIn * 1e3 : void 0;
   try {
     await addCredential({
-      provider: "anthropic",
+      provider: "kimi-code",
       label,
       authType: "oauth",
       accessToken: tokenResp.accessToken,
@@ -44268,7 +44482,9 @@ async function runLlmLogin(provider, opts) {
       expiresAt,
       priority: 10,
       source: "oauth-device-code",
-      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+      // The six mandatory X-Msh-* headers must be carried alongside the token
+      // so every transport that picks this credential sends them automatically.
+      extraHeaders: getKimiCodeMshHeaders()
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -44277,7 +44493,7 @@ async function runLlmLogin(provider, opts) {
       error: {
         code: "E_CREDENTIAL_STORE_FAILED",
         codeName: "E_CREDENTIAL_STORE_FAILED",
-        message: `Failed to store credential in pool: ${msg}`
+        message: `Failed to store Kimi Code credential in pool: ${msg}`
       },
       meta
     };
@@ -44285,13 +44501,40 @@ async function runLlmLogin(provider, opts) {
   return {
     success: true,
     data: {
-      provider: "anthropic",
+      provider: "kimi-code",
       label,
       expiresIn: tokenResp.expiresIn
     },
     meta
   };
 }
+function _generateState() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function _findFreePort() {
+  return new Promise((resolve7, reject) => {
+    const srv = createServer();
+    srv.listen(0, "localhost", () => {
+      const addr = srv.address();
+      if (!addr || typeof addr === "string") {
+        srv.close();
+        reject(new Error("Could not determine callback port"));
+        return;
+      }
+      const port = addr.port;
+      srv.close(() => resolve7(port));
+    });
+    srv.on("error", reject);
+  });
+}
+function _tryOpenBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    spawn(cmd, [url], { detached: true, stdio: "ignore" }).unref();
+  } catch {
+  }
+}
 var init_llm_login = __esm({
   "packages/cleo/src/cli/commands/llm-login.ts"() {
     "use strict";
@@ -58641,7 +58884,7 @@ var web_exports = {};
 __export(web_exports, {
   webCommand: () => webCommand
 });
-import { execFileSync as execFileSync4, spawn } from "node:child_process";
+import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_process";
 import { mkdir as mkdir3, open, readFile as readFile5, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join24 } from "node:path";
 import { CleoError as CleoError12, formatError as formatError9, getCleoHome as getCleoHome2 } from "@cleocode/core";
@@ -58718,7 +58961,7 @@ Logs: ${logFile}`
     }
   }
   const logFileHandle = await open(logFile, "a");
-  const serverProcess = spawn("node", [webIndexPath], {
+  const serverProcess = spawn2("node", [webIndexPath], {
     cwd: studioDir,
     env: {
       ...process.env,
@@ -58817,7 +59060,7 @@ var init_web = __esm({
           }
           try {
             if (process.platform === "win32") {
-              spawn("taskkill", ["/PID", String(status.pid), "/T"], { stdio: "ignore" });
+              spawn2("taskkill", ["/PID", String(status.pid), "/T"], { stdio: "ignore" });
             } else {
               process.kill(status.pid, "SIGTERM");
             }
@@ -58830,7 +59073,7 @@ var init_web = __esm({
           if (isProcessRunning(status.pid)) {
             try {
               if (process.platform === "win32") {
-                spawn("taskkill", ["/PID", String(status.pid), "/F", "/T"], { stdio: "ignore" });
+                spawn2("taskkill", ["/PID", String(status.pid), "/F", "/T"], { stdio: "ignore" });
               } else {
                 process.kill(status.pid, "SIGKILL");
               }
@@ -58869,7 +59112,7 @@ var init_web = __esm({
           if (status.running && status.pid) {
             try {
               if (process.platform === "win32") {
-                spawn("taskkill", ["/PID", String(status.pid), "/T"], { stdio: "ignore" });
+                spawn2("taskkill", ["/PID", String(status.pid), "/T"], { stdio: "ignore" });
               } else {
                 process.kill(status.pid, "SIGTERM");
               }
@@ -58882,7 +59125,7 @@ var init_web = __esm({
             if (isProcessRunning(status.pid)) {
               try {
                 if (process.platform === "win32") {
-                  spawn("taskkill", ["/PID", String(status.pid), "/F", "/T"], { stdio: "ignore" });
+                  spawn2("taskkill", ["/PID", String(status.pid), "/F", "/T"], { stdio: "ignore" });
                 } else {
                   process.kill(status.pid, "SIGKILL");
                 }
@@ -58931,11 +59174,11 @@ var init_web = __esm({
           const platform = process.platform;
           try {
             if (platform === "linux") {
-              spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+              spawn2("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
             } else if (platform === "darwin") {
-              spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
+              spawn2("open", [url], { detached: true, stdio: "ignore" }).unref();
             } else if (platform === "win32") {
-              spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
+              spawn2("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
             }
           } catch {
           }