@cleocode/cleo 2026.6.2 → 2026.6.3

package/dist/cli/index.js

@@ -55892,7 +55892,7 @@ import {
   refreshPkceToken
 } from "@cleocode/core/llm/oauth/pkce.js";
 import { getKimiCodeMshHeaders } from "@cleocode/core/llm/provider-registry/builtin/kimi-code.js";
-import { getProviderProfile } from "@cleocode/core/llm/provider-registry/index.js";
+import { getProviderProfile, listProviders } from "@cleocode/core/llm/provider-registry/index.js";
 async function runLlmLogin(provider, opts) {
   const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
   const profile = await getProviderProfile(provider);
@@ -55901,31 +55901,43 @@ async function runLlmLogin(provider, opts) {
     return _runKimiCodeLogin(opts, meta);
   }
   if (oauthMode === "pkce") {
-    return _runPkceLogin(provider, profile.oauth, opts, meta);
+    return _runPkceLogin(profile.name, profile.oauth, opts, meta);
   }
   return {
     success: false,
     error: {
       code: "E_NOT_IMPLEMENTED",
       codeName: "E_NOT_IMPLEMENTED",
-      message: `OAuth login for '${provider}' is not yet wired. Supported providers: 'anthropic' (PKCE), 'kimi-code' (device-code). To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+      message: `OAuth login for '${provider}' is not yet wired. ${await _supportedOauthProvidersHint()} For any other provider, add an API key with 'cleo llm add <provider> --api-key-stdin'.`
     },
     meta
   };
 }
+async function _supportedOauthProvidersHint() {
+  try {
+    const profiles = await listProviders();
+    const oauthable = profiles.flatMap((p) => p.oauth ? [`'${p.name}' (${p.oauth.mode})`] : []);
+    return oauthable.length > 0 ? `Providers with OAuth login: ${oauthable.join(", ")}.` : "No providers currently expose OAuth login.";
+  } catch {
+    return "Providers with OAuth login: 'anthropic' (pkce), 'openai' (pkce), 'kimi-code' (device-code).";
+  }
+}
 async function _runPkceLogin(provider, oauthCfg, opts, meta) {
   const { codeVerifier, codeChallenge } = await generatePkcePair();
   const state = _generateState();
   const isHeadless = opts.headless || process.env["CLEO_HEADLESS"] === "1";
-  const port = isHeadless ? 0 : await _findFreePort();
-  const redirectUri = isHeadless ? oauthCfg.redirectUri ?? "http://localhost" : `http://localhost:${port}/callback`;
+  const fixedPort = isHeadless ? null : _parseFixedLoopbackPort(oauthCfg.redirectUri);
+  const port = isHeadless ? 0 : fixedPort ?? await _findFreePort();
+  const randomRedirect = `http://localhost:${port}/callback`;
+  const redirectUri = isHeadless ? oauthCfg.redirectUri ?? "http://localhost" : fixedPort != null ? oauthCfg.redirectUri ?? randomRedirect : randomRedirect;
   const authUrl = buildAuthorizationUrl({
     authorizationEndpoint: oauthCfg.authorizationEndpoint ?? "",
     clientId: oauthCfg.clientId,
     redirectUri,
     scope: oauthCfg.scope ?? "",
     codeChallenge,
-    state
+    state,
+    extraParams: oauthCfg.extraAuthParams
   });
   let code;
   if (isHeadless) {
@@ -55962,6 +55974,7 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
   process.stderr.write("\r  Authorization approved.              \n\n");
   const label = opts.label ?? "oauth-login";
   const expiresAt = typeof tokens.expiresIn === "number" ? Date.now() + tokens.expiresIn * 1e3 : void 0;
+  const oauthExtraHeaders = provider === "anthropic" ? { "anthropic-beta": "oauth-2025-04-20" } : void 0;
   try {
     await addCredential({
       provider,
@@ -55972,7 +55985,7 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
       expiresAt,
       priority: 10,
       source: "oauth-pkce",
-      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+      ...oauthExtraHeaders ? { extraHeaders: oauthExtraHeaders } : {}
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -55992,6 +56005,18 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
     meta
   };
 }
+function _parseFixedLoopbackPort(redirectUri) {
+  if (!redirectUri) return null;
+  try {
+    const u = new URL(redirectUri);
+    const isLoopback = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+    if (!isLoopback || !u.port) return null;
+    const port = Number(u.port);
+    return Number.isInteger(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
+}
 async function _headlessPkceFlow(provider, authUrl) {
   process.stderr.write("\n");
   process.stderr.write(`  Provider: ${provider}
@@ -56278,11 +56303,11 @@ __export(llm_exports, {
 });
 import { pushWarning as pushWarning7 } from "@cleocode/core";
 async function getListProviders() {
-  const { listProviders } = await import(
+  const { listProviders: listProviders2 } = await import(
     /* webpackIgnore: true */
     "@cleocode/core/llm/provider-registry"
   );
-  return listProviders;
+  return listProviders2;
 }
 async function readApiKeyFromStdin() {
   if (process.stdin.isTTY) return "";
@@ -56593,8 +56618,8 @@ var init_llm3 = __esm({
         }
       },
       async run() {
-        const listProviders = await getListProviders();
-        const profiles = await listProviders();
+        const listProviders2 = await getListProviders();
+        const profiles = await listProviders2();
         const providers = profiles.map((p) => ({
           name: p.name,
           displayName: p.displayName,
@@ -56654,12 +56679,12 @@ var init_llm3 = __esm({
     loginCommand = defineCommand({
       meta: {
         name: "login",
-        description: "Authenticate with a provider via OAuth device-code flow. Supported providers: anthropic (MVP). Prints the verification URL and user code, then polls until the user approves."
+        description: "Authenticate an LLM provider via OAuth. PKCE (browser): anthropic, openai/codex. Device-code: kimi-code. Example: `cleo llm login openai`. For any other provider use `cleo llm add <provider> --api-key-stdin`. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
       },
       args: {
         provider: {
           type: "positional",
-          description: "Provider to authenticate with (e.g. anthropic)",
+          description: "Provider to authenticate: anthropic | openai | codex | kimi-code",
           required: true
         },
         label: {