@code-yeongyu/senpi 2026.9.10 → 2026.9.11

package/node_modules/@earendil-works/pi-ai/dist/api/devin-agent.lazy.js

@@ -0,0 +1,23 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { lazyApi } from "./lazy.js";
+/**
+ * Loads the devin-agent implementation through a variable specifier so bundlers
+ * (browser smoke, Bun compile) cannot follow the import into the Node-only
+ * Connect transport. The `.ts`/`.js` rewrite keeps the trick working from both
+ * source and built output.
+ */
+const importNodeOnlyApi = (specifier) => {
+    const runtimeSpecifier = import.meta.url.endsWith(".js") ? specifier.replace(/\.ts$/, ".js") : specifier;
+    return import(__rewriteRelativeImportExtension(runtimeSpecifier));
+};
+const loadDevinAgentModule = () => importNodeOnlyApi("./devin-agent.ts");
+export const devinAgentApi = () => lazyApi(loadDevinAgentModule);
+export { loadDevinAgentModule };
+//# sourceMappingURL=devin-agent.lazy.js.map

package/node_modules/@earendil-works/pi-ai/dist/api/devin-agent.lazy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-agent.lazy.js","sourceRoot":"","sources":["../../src/api/devin-agent.lazy.ts"],"names":[],"mappings":";;;;;;;;AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE;IACjE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,GAA6B,EAAE,CAC3D,iBAAiB,CAAC,kBAAkB,CAA6B,CAAC;AAEnE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { ProviderStreams } from \"../types.ts\";\nimport { lazyApi } from \"./lazy.ts\";\n\n/**\n * Loads the devin-agent implementation through a variable specifier so bundlers\n * (browser smoke, Bun compile) cannot follow the import into the Node-only\n * Connect transport. The `.ts`/`.js` rewrite keeps the trick working from both\n * source and built output.\n */\nconst importNodeOnlyApi = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\nconst loadDevinAgentModule = (): Promise<ProviderStreams> =>\n\timportNodeOnlyApi(\"./devin-agent.ts\") as Promise<ProviderStreams>;\n\nexport const devinAgentApi = () => lazyApi(loadDevinAgentModule);\nexport { loadDevinAgentModule };\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-callback.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Devin CLI OAuth loopback callback.
+ *
+ * Devin registers ONE redirect URI for the CLI, so the callback binds the fixed
+ * loopback port 59653 instead of an ephemeral one: a different port is rejected
+ * by the authorize page. The server is one-shot, validates the issued state
+ * before spending the code, and renders the shared OAuth result pages.
+ */
+import type { OAuthCredential } from "../types.ts";
+export declare const DEVIN_CALLBACK_PORT = 59653;
+export declare const DEVIN_CALLBACK_PATH = "/callback";
+export type DevinCallbackServer = {
+    callbackUrl: string;
+    close: () => void;
+    /** Hand the login to manual code entry unless a callback already claimed it. */
+    cancelWait: () => void;
+    waitForCredential: () => Promise<OAuthCredential | null>;
+};
+export declare function startDevinCallbackServer(input: {
+    state: string;
+    verifier: string;
+    signal: AbortSignal;
+    loginTimeoutMs: number;
+}): Promise<DevinCallbackServer>;
+//# sourceMappingURL=devin-callback.d.ts.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-callback.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/devin-callback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,MAAM,MAAM,mBAAmB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,gFAAgF;IAChF,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAaF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsG/B"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-callback.js

@@ -0,0 +1,124 @@
+/**
+ * Devin CLI OAuth loopback callback.
+ *
+ * Devin registers ONE redirect URI for the CLI, so the callback binds the fixed
+ * loopback port 59653 instead of an ephemeral one: a different port is rejected
+ * by the authorize page. The server is one-shot, validates the issued state
+ * before spending the code, and renders the shared OAuth result pages.
+ */
+import { createServer } from "node:http";
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+import { exchangeDevinAuthorizationCode } from "./devin-token.js";
+import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
+export const DEVIN_CALLBACK_PORT = 59653;
+export const DEVIN_CALLBACK_PATH = "/callback";
+function callbackHost() {
+    return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+}
+function sendHtml(response, status, html) {
+    response.statusCode = status;
+    response.setHeader("content-type", "text/html; charset=utf-8");
+    response.setHeader("cache-control", "no-store");
+    response.end(html);
+}
+export async function startDevinCallbackServer(input) {
+    if (input.signal.aborted)
+        throw new Error("Login cancelled");
+    const host = callbackHost();
+    let resolveCredential = () => { };
+    let rejectCredential = () => { };
+    const credential = new Promise((resolve, reject) => {
+        resolveCredential = resolve;
+        rejectCredential = reject;
+    });
+    let claimed = false;
+    let settled = false;
+    let timeout;
+    let onAbort;
+    const close = () => {
+        if (timeout)
+            clearTimeout(timeout);
+        if (onAbort)
+            input.signal.removeEventListener("abort", onAbort);
+        server.close();
+    };
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        close();
+        if ("credential" in result)
+            resolveCredential(result.credential);
+        else
+            rejectCredential(result.error);
+    };
+    const server = createServer((request, response) => {
+        void (async () => {
+            const requestUrl = new URL(request.url ?? "/", `http://${host}`);
+            if (request.method !== "GET" || requestUrl.pathname !== DEVIN_CALLBACK_PATH) {
+                sendHtml(response, 404, oauthErrorHtml("OAuth callback route not found."));
+                return;
+            }
+            if (claimed || settled) {
+                sendHtml(response, 409, oauthErrorHtml("This OAuth callback has already been used."));
+                return;
+            }
+            const oauthError = requestUrl.searchParams.get("error");
+            if (oauthError) {
+                const description = requestUrl.searchParams.get("error_description") ?? oauthError;
+                sendHtml(response, 400, oauthErrorHtml("Devin authorization was denied.", description));
+                finish({ error: new Error(`Devin authorization failed: ${description}`) });
+                return;
+            }
+            // The state guard runs before the code is spent: a forged callback must
+            // never reach the token endpoint.
+            const state = requestUrl.searchParams.get("state") ?? "";
+            if (state !== input.state) {
+                sendHtml(response, 400, oauthErrorHtml("Devin authorization state mismatch."));
+                finish({ error: new Error("Devin OAuth callback state mismatch") });
+                return;
+            }
+            const code = requestUrl.searchParams.get("code");
+            if (!code) {
+                sendHtml(response, 400, oauthErrorHtml("Devin returned no authorization code."));
+                return;
+            }
+            claimed = true;
+            try {
+                const result = await exchangeDevinAuthorizationCode(code, input.verifier, input.signal);
+                sendHtml(response, 200, oauthSuccessHtml("Signed in to Devin. You may now close this page."));
+                finish({ credential: result });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "Unknown token exchange error";
+                sendHtml(response, 502, oauthErrorHtml("Devin token exchange failed.", message));
+                finish({ error: error instanceof Error ? error : new Error(message) });
+            }
+        })();
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(DEVIN_CALLBACK_PORT, host, () => {
+            server.removeListener("error", reject);
+            resolve();
+        });
+    });
+    server.on("error", (error) => finish({ error }));
+    onAbort = () => finish({ error: new Error("Login cancelled") });
+    input.signal.addEventListener("abort", onAbort, { once: true });
+    if (input.signal.aborted) {
+        close();
+        throw new Error("Login cancelled");
+    }
+    timeout = setTimeout(() => finish({ error: new Error("Devin OAuth login timed out") }), input.loginTimeoutMs);
+    return {
+        callbackUrl: `http://${host}:${DEVIN_CALLBACK_PORT}${DEVIN_CALLBACK_PATH}`,
+        close,
+        cancelWait: () => {
+            if (!claimed)
+                finish({ credential: null });
+        },
+        waitForCredential: () => credential,
+    };
+}
+//# sourceMappingURL=devin-callback.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-callback.js","sourceRoot":"","sources":["../../../src/auth/oauth/devin-callback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAoC,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAU/C,SAAS,YAAY;IACpB,OAAO,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,WAAW,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAY;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACA,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,iBAAiB,GAAiD,GAAG,EAAE,GAAE,CAAC,CAAC;IAC/E,IAAI,gBAAgB,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1E,iBAAiB,GAAG,OAAO,CAAC;QAC5B,gBAAgB,GAAG,MAAM,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAkD,CAAC;IACvD,IAAI,OAAiC,CAAC;IAEtC,MAAM,KAAK,GAAG,GAAS,EAAE;QACxB,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,MAAiE,EAAQ,EAAE;QAC1F,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,EAAE,CAAC;QACR,IAAI,YAAY,IAAI,MAAM;YAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;YAC5D,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACzD,KAAK,CAAC,KAAK,IAAI,EAAE;YAChB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBAC7E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,iCAAiC,CAAC,CAAC,CAAC;gBAC3E,OAAO;YACR,CAAC;YACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACxB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,4CAA4C,CAAC,CAAC,CAAC;gBACtF,OAAO;YACR,CAAC;YAED,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,UAAU,CAAC;gBACnF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,iCAAiC,EAAE,WAAW,CAAC,CAAC,CAAC;gBACxF,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,+BAA+B,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3E,OAAO;YACR,CAAC;YAED,wEAAwE;YACxE,kCAAkC;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC3B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,qCAAqC,CAAC,CAAC,CAAC;gBAC/E,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBACjF,OAAO;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,kDAAkD,CAAC,CAAC,CAAC;gBAC9F,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC;gBACxF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjF,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9G,OAAO;QACN,WAAW,EAAE,UAAU,IAAI,IAAI,mBAAmB,GAAG,mBAAmB,EAAE;QAC1E,KAAK;QACL,UAAU,EAAE,GAAG,EAAE;YAChB,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,iBAAiB,EAAE,GAAG,EAAE,CAAC,UAAU;KACnC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Devin CLI OAuth loopback callback.\n *\n * Devin registers ONE redirect URI for the CLI, so the callback binds the fixed\n * loopback port 59653 instead of an ephemeral one: a different port is rejected\n * by the authorize page. The server is one-shot, validates the issued state\n * before spending the code, and renders the shared OAuth result pages.\n */\n\nimport { createServer, type Server, type ServerResponse } from \"node:http\";\nimport { getProviderEnvValue } from \"../../utils/provider-env.ts\";\nimport type { OAuthCredential } from \"../types.ts\";\nimport { exchangeDevinAuthorizationCode } from \"./devin-token.ts\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.ts\";\n\nexport const DEVIN_CALLBACK_PORT = 59653;\nexport const DEVIN_CALLBACK_PATH = \"/callback\";\n\nexport type DevinCallbackServer = {\n\tcallbackUrl: string;\n\tclose: () => void;\n\t/** Hand the login to manual code entry unless a callback already claimed it. */\n\tcancelWait: () => void;\n\twaitForCredential: () => Promise<OAuthCredential | null>;\n};\n\nfunction callbackHost(): string {\n\treturn getProviderEnvValue(\"PI_OAUTH_CALLBACK_HOST\") || \"127.0.0.1\";\n}\n\nfunction sendHtml(response: ServerResponse, status: number, html: string): void {\n\tresponse.statusCode = status;\n\tresponse.setHeader(\"content-type\", \"text/html; charset=utf-8\");\n\tresponse.setHeader(\"cache-control\", \"no-store\");\n\tresponse.end(html);\n}\n\nexport async function startDevinCallbackServer(input: {\n\tstate: string;\n\tverifier: string;\n\tsignal: AbortSignal;\n\tloginTimeoutMs: number;\n}): Promise<DevinCallbackServer> {\n\tif (input.signal.aborted) throw new Error(\"Login cancelled\");\n\tconst host = callbackHost();\n\tlet resolveCredential: (credential: OAuthCredential | null) => void = () => {};\n\tlet rejectCredential: (error: Error) => void = () => {};\n\tconst credential = new Promise<OAuthCredential | null>((resolve, reject) => {\n\t\tresolveCredential = resolve;\n\t\trejectCredential = reject;\n\t});\n\n\tlet claimed = false;\n\tlet settled = false;\n\tlet timeout: ReturnType<typeof setTimeout> | undefined;\n\tlet onAbort: (() => void) | undefined;\n\n\tconst close = (): void => {\n\t\tif (timeout) clearTimeout(timeout);\n\t\tif (onAbort) input.signal.removeEventListener(\"abort\", onAbort);\n\t\tserver.close();\n\t};\n\n\tconst finish = (result: { credential: OAuthCredential | null } | { error: Error }): void => {\n\t\tif (settled) return;\n\t\tsettled = true;\n\t\tclose();\n\t\tif (\"credential\" in result) resolveCredential(result.credential);\n\t\telse rejectCredential(result.error);\n\t};\n\n\tconst server: Server = createServer((request, response) => {\n\t\tvoid (async () => {\n\t\t\tconst requestUrl = new URL(request.url ?? \"/\", `http://${host}`);\n\t\t\tif (request.method !== \"GET\" || requestUrl.pathname !== DEVIN_CALLBACK_PATH) {\n\t\t\t\tsendHtml(response, 404, oauthErrorHtml(\"OAuth callback route not found.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (claimed || settled) {\n\t\t\t\tsendHtml(response, 409, oauthErrorHtml(\"This OAuth callback has already been used.\"));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst oauthError = requestUrl.searchParams.get(\"error\");\n\t\t\tif (oauthError) {\n\t\t\t\tconst description = requestUrl.searchParams.get(\"error_description\") ?? oauthError;\n\t\t\t\tsendHtml(response, 400, oauthErrorHtml(\"Devin authorization was denied.\", description));\n\t\t\t\tfinish({ error: new Error(`Devin authorization failed: ${description}`) });\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// The state guard runs before the code is spent: a forged callback must\n\t\t\t// never reach the token endpoint.\n\t\t\tconst state = requestUrl.searchParams.get(\"state\") ?? \"\";\n\t\t\tif (state !== input.state) {\n\t\t\t\tsendHtml(response, 400, oauthErrorHtml(\"Devin authorization state mismatch.\"));\n\t\t\t\tfinish({ error: new Error(\"Devin OAuth callback state mismatch\") });\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst code = requestUrl.searchParams.get(\"code\");\n\t\t\tif (!code) {\n\t\t\t\tsendHtml(response, 400, oauthErrorHtml(\"Devin returned no authorization code.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tclaimed = true;\n\n\t\t\ttry {\n\t\t\t\tconst result = await exchangeDevinAuthorizationCode(code, input.verifier, input.signal);\n\t\t\t\tsendHtml(response, 200, oauthSuccessHtml(\"Signed in to Devin. You may now close this page.\"));\n\t\t\t\tfinish({ credential: result });\n\t\t\t} catch (error) {\n\t\t\t\tconst message = error instanceof Error ? error.message : \"Unknown token exchange error\";\n\t\t\t\tsendHtml(response, 502, oauthErrorHtml(\"Devin token exchange failed.\", message));\n\t\t\t\tfinish({ error: error instanceof Error ? error : new Error(message) });\n\t\t\t}\n\t\t})();\n\t});\n\n\tawait new Promise<void>((resolve, reject) => {\n\t\tserver.once(\"error\", reject);\n\t\tserver.listen(DEVIN_CALLBACK_PORT, host, () => {\n\t\t\tserver.removeListener(\"error\", reject);\n\t\t\tresolve();\n\t\t});\n\t});\n\n\tserver.on(\"error\", (error) => finish({ error }));\n\tonAbort = () => finish({ error: new Error(\"Login cancelled\") });\n\tinput.signal.addEventListener(\"abort\", onAbort, { once: true });\n\tif (input.signal.aborted) {\n\t\tclose();\n\t\tthrow new Error(\"Login cancelled\");\n\t}\n\ttimeout = setTimeout(() => finish({ error: new Error(\"Devin OAuth login timed out\") }), input.loginTimeoutMs);\n\n\treturn {\n\t\tcallbackUrl: `http://${host}:${DEVIN_CALLBACK_PORT}${DEVIN_CALLBACK_PATH}`,\n\t\tclose,\n\t\tcancelWait: () => {\n\t\t\tif (!claimed) finish({ credential: null });\n\t\t},\n\t\twaitForCredential: () => credential,\n\t};\n}\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-token.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Devin (Cognition) CLI token exchange.
+ *
+ * Devin's CLI grant is deliberately non-standard: the authorization code is
+ * redeemed with a bare JSON body carrying only the code and the PKCE verifier
+ * (no client_id, no grant_type), and the response returns ONE opaque JWT in
+ * "token" that serves as both the access and the refresh credential. Expiry is
+ * read from the JWT itself because the response carries no expires_in.
+ */
+import type { OAuthCredential } from "../types.ts";
+export declare const DEVIN_TOKEN_URL = "https://api.devin.ai/auth/cli/token";
+export declare const DEVIN_API_ENDPOINT = "https://api.devin.ai";
+/** Devin issues long-lived CLI tokens; used when the JWT carries no usable exp. */
+export declare const DEVIN_FALLBACK_EXPIRY_MS = 31536000000;
+/** Builds the credential Devin's CLI stores: one token for access and refresh. */
+export declare function devinCredential(token: string): OAuthCredential;
+export declare function exchangeDevinAuthorizationCode(code: string, verifier: string, signal: AbortSignal): Promise<OAuthCredential>;
+//# sourceMappingURL=devin-token.d.ts.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-token.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/devin-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,eAAO,MAAM,eAAe,wCAAwC,CAAC;AACrE,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAEzD,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,cAAiB,CAAC;AAgCvD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAO9D;AAED,wBAAsB,8BAA8B,CACnD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,eAAe,CAAC,CA4C1B"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-token.js

@@ -0,0 +1,101 @@
+/**
+ * Devin (Cognition) CLI token exchange.
+ *
+ * Devin's CLI grant is deliberately non-standard: the authorization code is
+ * redeemed with a bare JSON body carrying only the code and the PKCE verifier
+ * (no client_id, no grant_type), and the response returns ONE opaque JWT in
+ * "token" that serves as both the access and the refresh credential. Expiry is
+ * read from the JWT itself because the response carries no expires_in.
+ */
+export const DEVIN_TOKEN_URL = "https://api.devin.ai/auth/cli/token";
+export const DEVIN_API_ENDPOINT = "https://api.devin.ai";
+/** Devin issues long-lived CLI tokens; used when the JWT carries no usable exp. */
+export const DEVIN_FALLBACK_EXPIRY_MS = 31_536_000_000;
+const TOKEN_EXCHANGE_TIMEOUT_MS = 30_000;
+function decodeJwtExpiry(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
+    try {
+        const parsed = JSON.parse(atob(padded));
+        const exp = parsed.exp;
+        if (typeof exp === "number" && Number.isFinite(exp) && exp > 0)
+            return Math.trunc(exp * 1000);
+    }
+    catch {
+        // A token whose payload is not readable JSON falls back to the fixed window.
+    }
+    return undefined;
+}
+function errorDetail(body) {
+    if (typeof body.error_description === "string")
+        return body.error_description;
+    if (typeof body.message === "string")
+        return body.message;
+    if (typeof body.error === "string")
+        return body.error;
+    if (body.error && typeof body.error === "object" && !Array.isArray(body.error)) {
+        const message = body.error.message;
+        if (typeof message === "string")
+            return message;
+    }
+    return undefined;
+}
+/** Builds the credential Devin's CLI stores: one token for access and refresh. */
+export function devinCredential(token) {
+    return {
+        type: "oauth",
+        access: token,
+        refresh: token,
+        expires: decodeJwtExpiry(token) ?? Date.now() + DEVIN_FALLBACK_EXPIRY_MS,
+    };
+}
+export async function exchangeDevinAuthorizationCode(code, verifier, signal) {
+    if (signal.aborted)
+        throw new Error("Login cancelled");
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    const timeout = setTimeout(() => controller.abort(new Error("Devin OAuth token exchange timed out")), TOKEN_EXCHANGE_TIMEOUT_MS);
+    let response;
+    let body = {};
+    try {
+        response = await fetch(DEVIN_TOKEN_URL, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/json" },
+            body: JSON.stringify({ code, code_verifier: verifier }),
+            signal: controller.signal,
+        });
+        try {
+            const parsed = (await response.json());
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                body = parsed;
+        }
+        catch {
+            if (response.ok)
+                throw new Error("Devin OAuth returned invalid JSON");
+        }
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw new Error("Login cancelled");
+        if (controller.signal.aborted)
+            throw new Error("Devin OAuth token exchange timed out");
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        signal.removeEventListener("abort", onAbort);
+    }
+    if (!response.ok) {
+        const detail = errorDetail(body);
+        throw new Error(`Devin OAuth token exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+    }
+    if (typeof body.token !== "string" || body.token.length === 0) {
+        throw new Error('Devin OAuth response carries no "token"');
+    }
+    return devinCredential(body.token);
+}
+//# sourceMappingURL=devin-token.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-token.js","sourceRoot":"","sources":["../../../src/auth/oauth/devin-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAIzC,SAAS,eAAe,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAe,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACR,6EAA6E;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB;IACpC,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACtD,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAI,IAAI,CAAC,KAAoB,CAAC,OAAO,CAAC;QACnD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC5C,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB;KACxE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,IAAY,EACZ,QAAgB,EAChB,MAAmB;IAEnB,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,EACzE,yBAAyB,CACzB,CAAC;IAEF,IAAI,QAAkB,CAAC;IACvB,IAAI,IAAI,GAAe,EAAE,CAAC;IAC1B,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;YACvD,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;YAClD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,MAAoB,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvF,MAAM,KAAK,CAAC;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Devin (Cognition) CLI token exchange.\n *\n * Devin's CLI grant is deliberately non-standard: the authorization code is\n * redeemed with a bare JSON body carrying only the code and the PKCE verifier\n * (no client_id, no grant_type), and the response returns ONE opaque JWT in\n * \"token\" that serves as both the access and the refresh credential. Expiry is\n * read from the JWT itself because the response carries no expires_in.\n */\n\nimport type { OAuthCredential } from \"../types.ts\";\n\nexport const DEVIN_TOKEN_URL = \"https://api.devin.ai/auth/cli/token\";\nexport const DEVIN_API_ENDPOINT = \"https://api.devin.ai\";\n\n/** Devin issues long-lived CLI tokens; used when the JWT carries no usable exp. */\nexport const DEVIN_FALLBACK_EXPIRY_MS = 31_536_000_000;\n\nconst TOKEN_EXCHANGE_TIMEOUT_MS = 30_000;\n\ntype JsonObject = Record<string, unknown>;\n\nfunction decodeJwtExpiry(token: string): number | undefined {\n\tconst payload = token.split(\".\")[1];\n\tif (!payload) return undefined;\n\tconst base64 = payload.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\");\n\tconst padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\ttry {\n\t\tconst parsed = JSON.parse(atob(padded)) as JsonObject;\n\t\tconst exp = parsed.exp;\n\t\tif (typeof exp === \"number\" && Number.isFinite(exp) && exp > 0) return Math.trunc(exp * 1000);\n\t} catch {\n\t\t// A token whose payload is not readable JSON falls back to the fixed window.\n\t}\n\treturn undefined;\n}\n\nfunction errorDetail(body: JsonObject): string | undefined {\n\tif (typeof body.error_description === \"string\") return body.error_description;\n\tif (typeof body.message === \"string\") return body.message;\n\tif (typeof body.error === \"string\") return body.error;\n\tif (body.error && typeof body.error === \"object\" && !Array.isArray(body.error)) {\n\t\tconst message = (body.error as JsonObject).message;\n\t\tif (typeof message === \"string\") return message;\n\t}\n\treturn undefined;\n}\n\n/** Builds the credential Devin's CLI stores: one token for access and refresh. */\nexport function devinCredential(token: string): OAuthCredential {\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess: token,\n\t\trefresh: token,\n\t\texpires: decodeJwtExpiry(token) ?? Date.now() + DEVIN_FALLBACK_EXPIRY_MS,\n\t};\n}\n\nexport async function exchangeDevinAuthorizationCode(\n\tcode: string,\n\tverifier: string,\n\tsignal: AbortSignal,\n): Promise<OAuthCredential> {\n\tif (signal.aborted) throw new Error(\"Login cancelled\");\n\tconst controller = new AbortController();\n\tconst onAbort = () => controller.abort(signal.reason);\n\tsignal.addEventListener(\"abort\", onAbort, { once: true });\n\tconst timeout = setTimeout(\n\t\t() => controller.abort(new Error(\"Devin OAuth token exchange timed out\")),\n\t\tTOKEN_EXCHANGE_TIMEOUT_MS,\n\t);\n\n\tlet response: Response;\n\tlet body: JsonObject = {};\n\ttry {\n\t\tresponse = await fetch(DEVIN_TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { accept: \"application/json\", \"content-type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({ code, code_verifier: verifier }),\n\t\t\tsignal: controller.signal,\n\t\t});\n\t\ttry {\n\t\t\tconst parsed = (await response.json()) as unknown;\n\t\t\tif (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) body = parsed as JsonObject;\n\t\t} catch {\n\t\t\tif (response.ok) throw new Error(\"Devin OAuth returned invalid JSON\");\n\t\t}\n\t} catch (error) {\n\t\tif (signal.aborted) throw new Error(\"Login cancelled\");\n\t\tif (controller.signal.aborted) throw new Error(\"Devin OAuth token exchange timed out\");\n\t\tthrow error;\n\t} finally {\n\t\tclearTimeout(timeout);\n\t\tsignal.removeEventListener(\"abort\", onAbort);\n\t}\n\n\tif (!response.ok) {\n\t\tconst detail = errorDetail(body);\n\t\tthrow new Error(`Devin OAuth token exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : \"\"}`);\n\t}\n\n\tif (typeof body.token !== \"string\" || body.token.length === 0) {\n\t\tthrow new Error('Devin OAuth response carries no \"token\"');\n\t}\n\n\treturn devinCredential(body.token);\n}\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Devin (Cognition) CLI OAuth flow.
+ *
+ * Mirrors the Devin CLI login: the authorize page at app.devin.ai redeems a
+ * PKCE S256 challenge against the fixed loopback redirect, and the resulting
+ * code is exchanged for a single long-lived CLI token. There is no refresh
+ * grant - Devin re-issues the token through a fresh login - so refresh returns
+ * the stored credential untouched.
+ *
+ * NOTE: the callback module uses node:http and is CLI-only, never browser.
+ */
+import type { OAuthAuth } from "../types.ts";
+export declare const devinOAuth: OAuthAuth;
+//# sourceMappingURL=devin.d.ts.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/devin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAA4C,MAAM,aAAa,CAAC;AA0FvF,eAAO,MAAM,UAAU,EAAE,SAWxB,CAAC"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin.js

@@ -0,0 +1,111 @@
+/**
+ * Devin (Cognition) CLI OAuth flow.
+ *
+ * Mirrors the Devin CLI login: the authorize page at app.devin.ai redeems a
+ * PKCE S256 challenge against the fixed loopback redirect, and the resulting
+ * code is exchanged for a single long-lived CLI token. There is no refresh
+ * grant - Devin re-issues the token through a fresh login - so refresh returns
+ * the stored credential untouched.
+ *
+ * NOTE: the callback module uses node:http and is CLI-only, never browser.
+ */
+import { startDevinCallbackServer } from "./devin-callback.js";
+import { DEVIN_API_ENDPOINT, exchangeDevinAuthorizationCode } from "./devin-token.js";
+import { generatePKCE } from "./pkce.js";
+const AUTHORIZE_URL = "https://app.devin.ai/auth/cli/continue";
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+function parseAuthorizationInput(input) {
+    const value = input.trim();
+    if (!value)
+        return undefined;
+    try {
+        return new URL(value).searchParams.get("code") ?? undefined;
+    }
+    catch {
+        // not a URL
+    }
+    if (value.includes("code="))
+        return new URLSearchParams(value).get("code") ?? undefined;
+    return value;
+}
+function authorizeUrl(input) {
+    const url = new URL(AUTHORIZE_URL);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        redirect_uri: input.redirectUri,
+        code_challenge: input.challenge,
+        code_challenge_method: "S256",
+        state: input.state,
+        prompt: "select_account",
+    }).toString();
+    return url.toString();
+}
+async function loginDevin(interaction) {
+    const { verifier, challenge } = await generatePKCE();
+    const state = crypto.randomUUID();
+    const callback = await startDevinCallbackServer({
+        state,
+        verifier,
+        signal: interaction.signal,
+        loginTimeoutMs: LOGIN_TIMEOUT_MS,
+    });
+    const manualAbort = new AbortController();
+    let manualInput;
+    let manualError;
+    try {
+        interaction.notify({
+            type: "progress",
+            message: `Listening for the Devin OAuth callback on ${callback.callbackUrl}`,
+        });
+        interaction.notify({
+            type: "auth_url",
+            url: authorizeUrl({ redirectUri: callback.callbackUrl, challenge, state }),
+            instructions: "Sign in to Devin in your browser. If the browser is on another machine, paste the final redirect URL here.",
+        });
+        const manualPromise = interaction
+            .prompt({
+            type: "manual_code",
+            message: "Complete sign-in in your browser, or paste the authorization code / redirect URL here:",
+            placeholder: callback.callbackUrl,
+            signal: manualAbort.signal,
+        })
+            .then((input) => {
+            manualInput = input;
+            callback.cancelWait();
+        })
+            .catch((error) => {
+            manualError = error instanceof Error ? error : new Error(String(error));
+            callback.cancelWait();
+        });
+        const credential = await callback.waitForCredential();
+        if (manualError)
+            throw manualError;
+        if (credential)
+            return credential;
+        await manualPromise;
+        if (manualError)
+            throw manualError;
+        const code = manualInput ? parseAuthorizationInput(manualInput) : undefined;
+        if (!code)
+            throw new Error("Missing authorization code");
+        interaction.notify({ type: "progress", message: "Exchanging the authorization code for a Devin token..." });
+        return await exchangeDevinAuthorizationCode(code, verifier, interaction.signal);
+    }
+    finally {
+        manualAbort.abort();
+        callback.close();
+    }
+}
+export const devinOAuth = {
+    name: "Devin",
+    isSubscription: true,
+    loginLabel: "Sign in with Devin",
+    login: loginDevin,
+    async refresh(credential, _signal) {
+        return credential;
+    },
+    async toAuth(credential) {
+        return { apiKey: credential.access, baseUrl: DEVIN_API_ENDPOINT };
+    },
+};
+//# sourceMappingURL=devin.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/devin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin.js","sourceRoot":"","sources":["../../../src/auth/oauth/devin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,SAAS,uBAAuB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACxF,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAgE;IACrF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QAChC,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,gBAAgB;KACxB,CAAC,CAAC,QAAQ,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,WAAoC;IAC7D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC/C,KAAK;QACL,QAAQ;QACR,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,cAAc,EAAE,gBAAgB;KAChC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;IAC1C,IAAI,WAA+B,CAAC;IACpC,IAAI,WAA8B,CAAC;IAEnC,IAAI,CAAC;QACJ,WAAW,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,6CAA6C,QAAQ,CAAC,WAAW,EAAE;SAC5E,CAAC,CAAC;QACH,WAAW,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC1E,YAAY,EACX,4GAA4G;SAC7G,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,WAAW;aAC/B,MAAM,CAAC;YACP,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,wFAAwF;YACjG,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,WAAW,CAAC,MAAM;SAC1B,CAAC;aACD,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,WAAW,GAAG,KAAK,CAAC;YACpB,QAAQ,CAAC,UAAU,EAAE,CAAC;QACvB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,WAAW,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,QAAQ,CAAC,UAAU,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QAEJ,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACtD,IAAI,WAAW;YAAE,MAAM,WAAW,CAAC;QACnC,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,MAAM,aAAa,CAAC;QACpB,IAAI,WAAW;YAAE,MAAM,WAAW,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzD,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;QAC5G,OAAO,MAAM,8BAA8B,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;YAAS,CAAC;QACV,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAc;IACpC,IAAI,EAAE,OAAO;IACb,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,oBAAoB;IAChC,KAAK,EAAE,UAAU;IACjB,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO;QAChC,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACnE,CAAC;CACD,CAAC","sourcesContent":["/**\n * Devin (Cognition) CLI OAuth flow.\n *\n * Mirrors the Devin CLI login: the authorize page at app.devin.ai redeems a\n * PKCE S256 challenge against the fixed loopback redirect, and the resulting\n * code is exchanged for a single long-lived CLI token. There is no refresh\n * grant - Devin re-issues the token through a fresh login - so refresh returns\n * the stored credential untouched.\n *\n * NOTE: the callback module uses node:http and is CLI-only, never browser.\n */\n\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { startDevinCallbackServer } from \"./devin-callback.ts\";\nimport { DEVIN_API_ENDPOINT, exchangeDevinAuthorizationCode } from \"./devin-token.ts\";\nimport { generatePKCE } from \"./pkce.ts\";\n\nconst AUTHORIZE_URL = \"https://app.devin.ai/auth/cli/continue\";\nconst LOGIN_TIMEOUT_MS = 5 * 60 * 1000;\n\nfunction parseAuthorizationInput(input: string): string | undefined {\n\tconst value = input.trim();\n\tif (!value) return undefined;\n\ttry {\n\t\treturn new URL(value).searchParams.get(\"code\") ?? undefined;\n\t} catch {\n\t\t// not a URL\n\t}\n\tif (value.includes(\"code=\")) return new URLSearchParams(value).get(\"code\") ?? undefined;\n\treturn value;\n}\n\nfunction authorizeUrl(input: { redirectUri: string; challenge: string; state: string }): string {\n\tconst url = new URL(AUTHORIZE_URL);\n\turl.search = new URLSearchParams({\n\t\tresponse_type: \"code\",\n\t\tredirect_uri: input.redirectUri,\n\t\tcode_challenge: input.challenge,\n\t\tcode_challenge_method: \"S256\",\n\t\tstate: input.state,\n\t\tprompt: \"select_account\",\n\t}).toString();\n\treturn url.toString();\n}\n\nasync function loginDevin(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst state = crypto.randomUUID();\n\tconst callback = await startDevinCallbackServer({\n\t\tstate,\n\t\tverifier,\n\t\tsignal: interaction.signal,\n\t\tloginTimeoutMs: LOGIN_TIMEOUT_MS,\n\t});\n\tconst manualAbort = new AbortController();\n\tlet manualInput: string | undefined;\n\tlet manualError: Error | undefined;\n\n\ttry {\n\t\tinteraction.notify({\n\t\t\ttype: \"progress\",\n\t\t\tmessage: `Listening for the Devin OAuth callback on ${callback.callbackUrl}`,\n\t\t});\n\t\tinteraction.notify({\n\t\t\ttype: \"auth_url\",\n\t\t\turl: authorizeUrl({ redirectUri: callback.callbackUrl, challenge, state }),\n\t\t\tinstructions:\n\t\t\t\t\"Sign in to Devin in your browser. If the browser is on another machine, paste the final redirect URL here.\",\n\t\t});\n\n\t\tconst manualPromise = interaction\n\t\t\t.prompt({\n\t\t\t\ttype: \"manual_code\",\n\t\t\t\tmessage: \"Complete sign-in in your browser, or paste the authorization code / redirect URL here:\",\n\t\t\t\tplaceholder: callback.callbackUrl,\n\t\t\t\tsignal: manualAbort.signal,\n\t\t\t})\n\t\t\t.then((input) => {\n\t\t\t\tmanualInput = input;\n\t\t\t\tcallback.cancelWait();\n\t\t\t})\n\t\t\t.catch((error) => {\n\t\t\t\tmanualError = error instanceof Error ? error : new Error(String(error));\n\t\t\t\tcallback.cancelWait();\n\t\t\t});\n\n\t\tconst credential = await callback.waitForCredential();\n\t\tif (manualError) throw manualError;\n\t\tif (credential) return credential;\n\n\t\tawait manualPromise;\n\t\tif (manualError) throw manualError;\n\t\tconst code = manualInput ? parseAuthorizationInput(manualInput) : undefined;\n\t\tif (!code) throw new Error(\"Missing authorization code\");\n\t\tinteraction.notify({ type: \"progress\", message: \"Exchanging the authorization code for a Devin token...\" });\n\t\treturn await exchangeDevinAuthorizationCode(code, verifier, interaction.signal);\n\t} finally {\n\t\tmanualAbort.abort();\n\t\tcallback.close();\n\t}\n}\n\nexport const devinOAuth: OAuthAuth = {\n\tname: \"Devin\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with Devin\",\n\tlogin: loginDevin,\n\tasync refresh(credential, _signal) {\n\t\treturn credential;\n\t},\n\tasync toAuth(credential) {\n\t\treturn { apiKey: credential.access, baseUrl: DEVIN_API_ENDPOINT };\n\t},\n};\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kimi-coding.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-coding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,SAAS,EAA4C,MAAM,aAAa,CAAC;AA8QvF,eAAO,MAAM,eAAe,EAAE,SAe7B,CAAC"}
+{"version":3,"file":"kimi-coding.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-coding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,SAAS,EAA4C,MAAM,aAAa,CAAC;AAkRvF,eAAO,MAAM,eAAe,EAAE,SAe7B,CAAC"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.js

@@ -8,6 +8,7 @@
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { sleep } from "../../utils/sleep.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+import { kimiCodeIdentityHeaders } from "./kimi-identity.js";
 const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
 const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
 const DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
@@ -51,6 +52,7 @@ async function startDeviceAuthorization(oauthHost, signal) {
     const response = await fetch(`${oauthHost}/api/oauth/device_authorization`, {
         method: "POST",
         headers: {
+            ...kimiCodeIdentityHeaders(),
             "Content-Type": "application/x-www-form-urlencoded",
             Accept: "application/json",
         },
@@ -118,6 +120,7 @@ async function pollForToken(oauthHost, device, signal) {
             const response = await fetch(`${oauthHost}/api/oauth/token`, {
                 method: "POST",
                 headers: {
+                    ...kimiCodeIdentityHeaders(),
                     "Content-Type": "application/x-www-form-urlencoded",
                     Accept: "application/json",
                 },
@@ -186,6 +189,7 @@ async function refreshToken(oauthHost, refreshTokenValue, signal) {
             response = await fetch(`${oauthHost}/api/oauth/token`, {
                 method: "POST",
                 headers: {
+                    ...kimiCodeIdentityHeaders(),
                     "Content-Type": "application/x-www-form-urlencoded",
                     Accept: "application/json",
                 },
@@ -242,7 +246,7 @@ export const kimiCodingOAuth = {
         return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
     },
     async toAuth(credential) {
-        return { headers: { Authorization: `Bearer ${credential.access}` } };
+        return { headers: { ...kimiCodeIdentityHeaders(), Authorization: `Bearer ${credential.access}` } };
     },
 };
 //# sourceMappingURL=kimi-coding.js.map