@corbat-tech/coco 2.11.0 → 2.12.0

package/dist/cli/index.js

@@ -1027,12 +1027,16 @@ var init_anthropic = __esm({
           );
           const streamTimeout = this.config.timeout ?? 12e4;
           let lastActivityTime = Date.now();
-          const checkTimeout = () => {
+          const timeoutController = new AbortController();
+          const timeoutInterval = setInterval(() => {
             if (Date.now() - lastActivityTime > streamTimeout) {
-              throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+              clearInterval(timeoutInterval);
+              timeoutController.abort();
             }
-          };
-          const timeoutInterval = setInterval(checkTimeout, 5e3);
+          }, 5e3);
+          timeoutController.signal.addEventListener("abort", () => stream.controller.abort(), {
+            once: true
+          });
           try {
             let streamStopReason;
             for await (const event of stream) {
@@ -1053,6 +1057,9 @@ var init_anthropic = __esm({
           } finally {
             clearInterval(timeoutInterval);
           }
+          if (timeoutController.signal.aborted) {
+            throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+          }
         } catch (error) {
           throw this.handleError(error);
         }
@@ -1079,12 +1086,16 @@ var init_anthropic = __esm({
           let currentToolInputJson = "";
           const streamTimeout = this.config.timeout ?? 12e4;
           let lastActivityTime = Date.now();
-          const checkTimeout = () => {
+          const timeoutController = new AbortController();
+          const timeoutInterval = setInterval(() => {
             if (Date.now() - lastActivityTime > streamTimeout) {
-              throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+              clearInterval(timeoutInterval);
+              timeoutController.abort();
             }
-          };
-          const timeoutInterval = setInterval(checkTimeout, 5e3);
+          }, 5e3);
+          timeoutController.signal.addEventListener("abort", () => stream.controller.abort(), {
+            once: true
+          });
           try {
             let streamStopReason;
             for await (const event of stream) {
@@ -1169,6 +1180,9 @@ var init_anthropic = __esm({
           } finally {
             clearInterval(timeoutInterval);
           }
+          if (timeoutController.signal.aborted) {
+            throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+          }
         } catch (error) {
           throw this.handleError(error);
         }
@@ -1380,6 +1394,9 @@ var init_anthropic = __esm({
     };
   }
 });
+function needsResponsesApi(model) {
+  return model.includes("codex") || model.startsWith("gpt-5") || model.startsWith("o4-") || model.startsWith("o3-");
+}
 function createOpenAIProvider(config) {
   const provider = new OpenAIProvider();
   if (config) {
@@ -1407,7 +1424,7 @@ var init_openai = __esm({
   "src/providers/openai.ts"() {
     init_errors();
     init_retry();
-    DEFAULT_MODEL2 = "gpt-5.3-codex";
+    DEFAULT_MODEL2 = "gpt-5.4-codex";
     CONTEXT_WINDOWS2 = {
       // OpenAI models
       "gpt-4o": 128e3,
@@ -1430,6 +1447,7 @@ var init_openai = __esm({
       "gpt-5.2-instant": 4e5,
       "gpt-5.2-pro": 4e5,
       "gpt-5.3-codex": 4e5,
+      "gpt-5.4-codex": 4e5,
       // Kimi/Moonshot models
       "kimi-k2.5": 262144,
       "kimi-k2-0324": 131072,
@@ -1486,7 +1504,7 @@ var init_openai = __esm({
       "microsoft/Phi-4": 16384,
       // OpenRouter model IDs
       "anthropic/claude-opus-4-6": 2e5,
-      "openai/gpt-5.3-codex": 4e5,
+      "openai/gpt-5.4-codex": 4e5,
       "google/gemini-3-flash-preview": 1e6,
       "meta-llama/llama-3.3-70b-instruct": 128e3
     };
@@ -1580,9 +1598,12 @@ var init_openai = __esm({
        */
       async chat(messages, options) {
         this.ensureInitialized();
+        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+        if (needsResponsesApi(model)) {
+          return this.chatViaResponses(messages, options);
+        }
         return withRetry(async () => {
           try {
-            const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
             const supportsTemp = this.supportsTemperature(model);
             const response = await this.client.chat.completions.create({
               model,
@@ -1614,9 +1635,12 @@ var init_openai = __esm({
        */
       async chatWithTools(messages, options) {
         this.ensureInitialized();
+        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+        if (needsResponsesApi(model)) {
+          return this.chatWithToolsViaResponses(messages, options);
+        }
         return withRetry(async () => {
           try {
-            const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
             const supportsTemp = this.supportsTemperature(model);
             const extraBody = this.getExtraBody(model);
             const requestParams = {
@@ -1658,8 +1682,12 @@ var init_openai = __esm({
        */
       async *stream(messages, options) {
         this.ensureInitialized();
+        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+        if (needsResponsesApi(model)) {
+          yield* this.streamViaResponses(messages, options);
+          return;
+        }
         try {
-          const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
           const supportsTemp = this.supportsTemperature(model);
           const stream = await this.client.chat.completions.create({
             model,
@@ -1689,8 +1717,12 @@ var init_openai = __esm({
        */
       async *streamWithTools(messages, options) {
         this.ensureInitialized();
+        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+        if (needsResponsesApi(model)) {
+          yield* this.streamWithToolsViaResponses(messages, options);
+          return;
+        }
         try {
-          const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
           const supportsTemp = this.supportsTemperature(model);
           const extraBody = this.getExtraBody(model);
           const requestParams = {
@@ -1713,12 +1745,16 @@ var init_openai = __esm({
           const toolCallBuilders = /* @__PURE__ */ new Map();
           const streamTimeout = this.config.timeout ?? 12e4;
           let lastActivityTime = Date.now();
-          const checkTimeout = () => {
+          const timeoutController = new AbortController();
+          const timeoutInterval = setInterval(() => {
             if (Date.now() - lastActivityTime > streamTimeout) {
-              throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+              clearInterval(timeoutInterval);
+              timeoutController.abort();
             }
-          };
-          const timeoutInterval = setInterval(checkTimeout, 5e3);
+          }, 5e3);
+          timeoutController.signal.addEventListener("abort", () => stream.controller.abort(), {
+            once: true
+          });
           const providerName = this.name;
           const parseArguments = (builder) => {
             let input = {};
@@ -1822,6 +1858,9 @@ var init_openai = __esm({
           } finally {
             clearInterval(timeoutInterval);
           }
+          if (timeoutController.signal.aborted) {
+            throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+          }
         } catch (error) {
           throw this.handleError(error);
         }
@@ -2154,623 +2193,463 @@ var init_openai = __esm({
           cause: error instanceof Error ? error : void 0
         });
       }
-    };
-  }
-});
-async function requestDeviceCode(provider) {
-  const config = OAUTH_CONFIGS[provider];
-  if (!config) {
-    throw new Error(`OAuth not supported for provider: ${provider}`);
-  }
-  if (!config.deviceAuthEndpoint) {
-    throw new Error(
-      `Device code flow not supported for provider: ${provider}. Use browser OAuth instead.`
-    );
-  }
-  const body = new URLSearchParams({
-    client_id: config.clientId,
-    scope: config.scopes.join(" ")
-  });
-  if (provider === "openai") {
-    body.set("audience", "https://api.openai.com/v1");
-  }
-  const response = await fetch(config.deviceAuthEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      "User-Agent": "Corbat-Coco CLI",
-      Accept: "application/json"
-    },
-    body: body.toString()
-  });
-  if (!response.ok) {
-    const contentType2 = response.headers.get("content-type") || "";
-    const error = await response.text();
-    if (contentType2.includes("text/html") || error.includes("<!DOCTYPE") || error.includes("<html")) {
-      throw new Error(
-        "OAuth request blocked (possibly by Cloudflare).\n   This can happen due to network restrictions or rate limiting.\n   Please try:\n   1. Use an API key instead (recommended)\n   2. Wait a few minutes and try again\n   3. Try from a different network"
-      );
-    }
-    throw new Error(`Failed to request device code: ${error}`);
-  }
-  const contentType = response.headers.get("content-type") || "";
-  if (!contentType.includes("application/json")) {
-    const text13 = await response.text();
-    if (text13.includes("<!DOCTYPE") || text13.includes("<html")) {
-      throw new Error(
-        "OAuth service returned HTML instead of JSON.\n   The service may be temporarily unavailable.\n   Please use an API key instead, or try again later."
-      );
-    }
-  }
-  const data = await response.json();
-  return {
-    deviceCode: data.device_code,
-    userCode: data.user_code,
-    verificationUri: data.verification_uri || config.verificationUri || "",
-    verificationUriComplete: data.verification_uri_complete,
-    expiresIn: data.expires_in,
-    interval: data.interval || 5
-  };
-}
-async function pollForToken(provider, deviceCode, interval, expiresIn, onPoll) {
-  const config = OAUTH_CONFIGS[provider];
-  if (!config) {
-    throw new Error(`OAuth not supported for provider: ${provider}`);
-  }
-  const startTime = Date.now();
-  const expiresAt = startTime + expiresIn * 1e3;
-  while (Date.now() < expiresAt) {
-    await new Promise((resolve4) => setTimeout(resolve4, interval * 1e3));
-    if (onPoll) onPoll();
-    const body = new URLSearchParams({
-      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: config.clientId,
-      device_code: deviceCode
-    });
-    const response = await fetch(config.tokenEndpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: body.toString()
-    });
-    const data = await response.json();
-    if (data.access_token) {
-      return {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token,
-        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0,
-        tokenType: data.token_type || "Bearer"
-      };
-    }
-    if (data.error === "authorization_pending") {
-      continue;
-    } else if (data.error === "slow_down") {
-      interval += 5;
-      continue;
-    } else if (data.error === "expired_token") {
-      throw new Error("Device code expired. Please try again.");
-    } else if (data.error === "access_denied") {
-      throw new Error("Access denied by user.");
-    } else if (data.error) {
-      throw new Error(data.error_description || data.error);
-    }
-  }
-  throw new Error("Authentication timed out. Please try again.");
-}
-async function refreshAccessToken(provider, refreshToken) {
-  const config = OAUTH_CONFIGS[provider];
-  if (!config) {
-    throw new Error(`OAuth not supported for provider: ${provider}`);
-  }
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: config.clientId,
-    refresh_token: refreshToken
-  });
-  const response = await fetch(config.tokenEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: body.toString()
-  });
-  if (!response.ok) {
-    const error = await response.text();
-    throw new Error(`Token refresh failed: ${error}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token || refreshToken,
-    expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0,
-    tokenType: data.token_type
-  };
-}
-function getTokenStoragePath(provider) {
-  const home = process.env.HOME || process.env.USERPROFILE || "";
-  return path36.join(home, ".coco", "tokens", `${provider}.json`);
-}
-async function saveTokens(provider, tokens) {
-  const filePath = getTokenStoragePath(provider);
-  const dir = path36.dirname(filePath);
-  await fs34.mkdir(dir, { recursive: true, mode: 448 });
-  await fs34.writeFile(filePath, JSON.stringify(tokens, null, 2), { mode: 384 });
-}
-async function loadTokens(provider) {
-  const filePath = getTokenStoragePath(provider);
-  try {
-    const content = await fs34.readFile(filePath, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-async function deleteTokens(provider) {
-  const filePath = getTokenStoragePath(provider);
-  try {
-    await fs34.unlink(filePath);
-  } catch {
-  }
-}
-function isTokenExpired(tokens) {
-  if (!tokens.expiresAt) return false;
-  return Date.now() >= tokens.expiresAt - 5 * 60 * 1e3;
-}
-async function getValidAccessToken(provider) {
-  const config = OAUTH_CONFIGS[provider];
-  if (!config) return null;
-  const tokens = await loadTokens(provider);
-  if (!tokens) return null;
-  if (isTokenExpired(tokens)) {
-    if (tokens.refreshToken) {
-      try {
-        const newTokens = await refreshAccessToken(provider, tokens.refreshToken);
-        await saveTokens(provider, newTokens);
-        return { accessToken: newTokens.accessToken, isNew: true };
-      } catch {
-        await deleteTokens(provider);
-        return null;
+      // --- Responses API support (GPT-5+, Codex, o3, o4 models) ---
+      /**
+       * Simple chat via Responses API (no tools)
+       */
+      async chatViaResponses(messages, options) {
+        this.ensureInitialized();
+        return withRetry(async () => {
+          try {
+            const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+            const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
+            const response = await this.client.responses.create({
+              model,
+              input,
+              instructions: instructions ?? void 0,
+              max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
+              temperature: options?.temperature ?? this.config.temperature ?? 0,
+              store: false
+            });
+            return {
+              id: response.id,
+              content: response.output_text ?? "",
+              stopReason: response.status === "completed" ? "end_turn" : "max_tokens",
+              usage: {
+                inputTokens: response.usage?.input_tokens ?? 0,
+                outputTokens: response.usage?.output_tokens ?? 0
+              },
+              model: String(response.model)
+            };
+          } catch (error) {
+            throw this.handleError(error);
+          }
+        }, this.retryConfig);
       }
-    }
-    await deleteTokens(provider);
-    return null;
-  }
-  return { accessToken: tokens.accessToken, isNew: false };
-}
-function buildAuthorizationUrl(provider, redirectUri, codeChallenge, state) {
-  const config = OAUTH_CONFIGS[provider];
-  if (!config) {
-    throw new Error(`OAuth not supported for provider: ${provider}`);
-  }
-  const params = new URLSearchParams({
-    response_type: "code",
-    client_id: config.clientId,
-    redirect_uri: redirectUri,
-    scope: config.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  if (config.extraAuthParams) {
-    for (const [key, value] of Object.entries(config.extraAuthParams)) {
-      params.set(key, value);
-    }
-  }
-  return `${config.authorizationEndpoint}?${params.toString()}`;
-}
-async function exchangeCodeForTokens(provider, code, codeVerifier, redirectUri) {
-  const config = OAUTH_CONFIGS[provider];
-  if (!config) {
-    throw new Error(`OAuth not supported for provider: ${provider}`);
-  }
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: config.clientId,
-    code,
-    code_verifier: codeVerifier,
-    redirect_uri: redirectUri
-  });
-  const response = await fetch(config.tokenEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: body.toString()
-  });
-  if (!response.ok) {
-    const error = await response.text();
-    throw new Error(`Token exchange failed: ${error}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0,
-    tokenType: data.token_type || "Bearer"
-  };
-}
-var OAUTH_CONFIGS;
-var init_oauth = __esm({
-  "src/auth/oauth.ts"() {
-    OAUTH_CONFIGS = {
       /**
-       * OpenAI OAuth (ChatGPT Plus/Pro subscriptions)
-       * Uses the official Codex client ID (same as OpenCode, Codex CLI, etc.)
+       * Chat with tools via Responses API
        */
-      openai: {
-        provider: "openai",
-        clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-        authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
-        tokenEndpoint: "https://auth.openai.com/oauth/token",
-        deviceAuthEndpoint: "https://auth.openai.com/oauth/device/code",
-        verificationUri: "https://chatgpt.com/codex/device",
-        scopes: ["openid", "profile", "email", "offline_access"],
-        extraAuthParams: {
-          id_token_add_organizations: "true",
-          codex_cli_simplified_flow: "true",
-          originator: "opencode"
-        }
-      }
-      // NOTE: Gemini OAuth removed - Google's client ID is restricted to official apps
-      // Use API Key (https://aistudio.google.com/apikey) or gcloud ADC instead
-    };
-  }
-});
-function generateCodeVerifier(length = 64) {
-  const randomBytes2 = crypto.randomBytes(length);
-  return base64UrlEncode(randomBytes2);
-}
-function generateCodeChallenge(codeVerifier) {
-  const hash = crypto.createHash("sha256").update(codeVerifier).digest();
-  return base64UrlEncode(hash);
-}
-function generateState(length = 32) {
-  const randomBytes2 = crypto.randomBytes(length);
-  return base64UrlEncode(randomBytes2);
-}
-function base64UrlEncode(buffer) {
-  return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function generatePKCECredentials() {
-  const codeVerifier = generateCodeVerifier();
-  const codeChallenge = generateCodeChallenge(codeVerifier);
-  const state = generateState();
-  return {
-    codeVerifier,
-    codeChallenge,
-    state
-  };
-}
-var init_pkce = __esm({
-  "src/auth/pkce.ts"() {
-  }
-});
-function escapeHtml(unsafe) {
-  return unsafe.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
-}
-async function createCallbackServer(expectedState, timeout = 5 * 60 * 1e3, port = OAUTH_CALLBACK_PORT) {
-  let resolveResult;
-  let rejectResult;
-  const resultPromise = new Promise((resolve4, reject) => {
-    resolveResult = resolve4;
-    rejectResult = reject;
-  });
-  const server = http.createServer((req, res) => {
-    console.log(`   [OAuth] ${req.method} ${req.url?.split("?")[0]}`);
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "*");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-    if (!req.url?.startsWith("/auth/callback")) {
-      res.writeHead(404);
-      res.end("Not Found");
-      return;
-    }
-    try {
-      const url = new URL$1(req.url, `http://localhost`);
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      const errorDescription = url.searchParams.get("error_description");
-      if (error) {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(ERROR_HTML(errorDescription || error));
-        server.close();
-        rejectResult(new Error(errorDescription || error));
-        return;
-      }
-      if (!code || !state) {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(ERROR_HTML("Missing authorization code or state"));
-        server.close();
-        rejectResult(new Error("Missing authorization code or state"));
-        return;
-      }
-      if (state !== expectedState) {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(ERROR_HTML("State mismatch - possible CSRF attack"));
-        server.close();
-        rejectResult(new Error("State mismatch - possible CSRF attack"));
-        return;
+      async chatWithToolsViaResponses(messages, options) {
+        this.ensureInitialized();
+        return withRetry(async () => {
+          try {
+            const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+            const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
+            const tools = this.convertToolsForResponses(options.tools);
+            const response = await this.client.responses.create({
+              model,
+              input,
+              instructions: instructions ?? void 0,
+              tools,
+              max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
+              temperature: options?.temperature ?? this.config.temperature ?? 0,
+              store: false
+            });
+            let content = "";
+            const toolCalls = [];
+            for (const item of response.output) {
+              if (item.type === "message") {
+                for (const part of item.content) {
+                  if (part.type === "output_text") {
+                    content += part.text;
+                  }
+                }
+              } else if (item.type === "function_call") {
+                toolCalls.push({
+                  id: item.call_id,
+                  name: item.name,
+                  input: this.parseResponsesArguments(item.arguments)
+                });
+              }
+            }
+            return {
+              id: response.id,
+              content,
+              stopReason: toolCalls.length > 0 ? "tool_use" : "end_turn",
+              usage: {
+                inputTokens: response.usage?.input_tokens ?? 0,
+                outputTokens: response.usage?.output_tokens ?? 0
+              },
+              model: String(response.model),
+              toolCalls
+            };
+          } catch (error) {
+            throw this.handleError(error);
+          }
+        }, this.retryConfig);
       }
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end(SUCCESS_HTML);
-      server.close();
-      resolveResult({ code, state });
-    } catch (err) {
-      res.writeHead(500, { "Content-Type": "text/html" });
-      res.end(ERROR_HTML(String(err)));
-      server.close();
-      rejectResult(err instanceof Error ? err : new Error(String(err)));
-    }
-  });
-  const actualPort = await new Promise((resolve4, reject) => {
-    const errorHandler = (err) => {
-      if (err.code === "EADDRINUSE") {
-        console.log(`   Port ${port} is in use, trying alternative port...`);
-        server.removeListener("error", errorHandler);
-        server.listen(0, () => {
-          const address = server.address();
-          if (typeof address === "object" && address) {
-            resolve4(address.port);
-          } else {
-            reject(new Error("Failed to get server port"));
+      /**
+       * Stream via Responses API (no tools)
+       */
+      async *streamViaResponses(messages, options) {
+        this.ensureInitialized();
+        try {
+          const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+          const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
+          const stream = await this.client.responses.create({
+            model,
+            input,
+            instructions: instructions ?? void 0,
+            max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
+            temperature: options?.temperature ?? this.config.temperature ?? 0,
+            store: false,
+            stream: true
+          });
+          const streamTimeout = this.config.timeout ?? 12e4;
+          let lastActivityTime = Date.now();
+          const timeoutController = new AbortController();
+          const timeoutInterval = setInterval(() => {
+            if (Date.now() - lastActivityTime > streamTimeout) {
+              clearInterval(timeoutInterval);
+              timeoutController.abort();
+            }
+          }, 5e3);
+          timeoutController.signal.addEventListener(
+            "abort",
+            () => stream.controller?.abort(),
+            { once: true }
+          );
+          try {
+            for await (const event of stream) {
+              lastActivityTime = Date.now();
+              if (event.type === "response.output_text.delta") {
+                yield { type: "text", text: event.delta };
+              } else if (event.type === "response.completed") {
+                yield { type: "done", stopReason: "end_turn" };
+              }
+            }
+          } finally {
+            clearInterval(timeoutInterval);
           }
-        });
-      } else {
-        reject(err);
+          if (timeoutController.signal.aborted) {
+            throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+          }
+        } catch (error) {
+          throw this.handleError(error);
+        }
       }
-    };
-    server.on("error", errorHandler);
-    server.listen(port, () => {
-      server.removeListener("error", errorHandler);
-      const address = server.address();
-      if (typeof address === "object" && address) {
-        resolve4(address.port);
-      } else {
-        reject(new Error("Failed to get server port"));
+      /**
+       * Stream with tools via Responses API
+       *
+       * IMPORTANT: fnCallBuilders is keyed by output item ID (fc.id), NOT by
+       * call_id. The streaming events (function_call_arguments.delta/done) use
+       * item_id which references the output item's id field, not call_id.
+       */
+      async *streamWithToolsViaResponses(messages, options) {
+        this.ensureInitialized();
+        try {
+          const model = options?.model ?? this.config.model ?? DEFAULT_MODEL2;
+          const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
+          const tools = options.tools.length > 0 ? this.convertToolsForResponses(options.tools) : void 0;
+          const requestParams = {
+            model,
+            input,
+            instructions: instructions ?? void 0,
+            max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
+            temperature: options?.temperature ?? this.config.temperature ?? 0,
+            store: false,
+            stream: true
+          };
+          if (tools) {
+            requestParams.tools = tools;
+          }
+          const stream = await this.client.responses.create(
+            requestParams
+          );
+          const fnCallBuilders = /* @__PURE__ */ new Map();
+          const streamTimeout = this.config.timeout ?? 12e4;
+          let lastActivityTime = Date.now();
+          const timeoutController = new AbortController();
+          const timeoutInterval = setInterval(() => {
+            if (Date.now() - lastActivityTime > streamTimeout) {
+              clearInterval(timeoutInterval);
+              timeoutController.abort();
+            }
+          }, 5e3);
+          timeoutController.signal.addEventListener(
+            "abort",
+            () => stream.controller?.abort(),
+            { once: true }
+          );
+          try {
+            for await (const event of stream) {
+              lastActivityTime = Date.now();
+              switch (event.type) {
+                case "response.output_text.delta":
+                  yield { type: "text", text: event.delta };
+                  break;
+                case "response.output_item.added":
+                  if (event.item.type === "function_call") {
+                    const fc = event.item;
+                    const itemKey = fc.id ?? fc.call_id;
+                    fnCallBuilders.set(itemKey, {
+                      callId: fc.call_id,
+                      name: fc.name,
+                      arguments: ""
+                    });
+                    yield {
+                      type: "tool_use_start",
+                      toolCall: { id: fc.call_id, name: fc.name }
+                    };
+                  }
+                  break;
+                case "response.function_call_arguments.delta":
+                  {
+                    const builder = fnCallBuilders.get(event.item_id);
+                    if (builder) {
+                      builder.arguments += event.delta;
+                    }
+                  }
+                  break;
+                case "response.function_call_arguments.done":
+                  {
+                    const builder = fnCallBuilders.get(event.item_id);
+                    if (builder) {
+                      yield {
+                        type: "tool_use_end",
+                        toolCall: {
+                          id: builder.callId,
+                          name: builder.name,
+                          input: this.parseResponsesArguments(event.arguments)
+                        }
+                      };
+                      fnCallBuilders.delete(event.item_id);
+                    }
+                  }
+                  break;
+                case "response.completed":
+                  {
+                    for (const [, builder] of fnCallBuilders) {
+                      yield {
+                        type: "tool_use_end",
+                        toolCall: {
+                          id: builder.callId,
+                          name: builder.name,
+                          input: this.parseResponsesArguments(builder.arguments)
+                        }
+                      };
+                    }
+                    fnCallBuilders.clear();
+                    const hasToolCalls = event.response.output.some(
+                      (i) => i.type === "function_call"
+                    );
+                    yield {
+                      type: "done",
+                      stopReason: hasToolCalls ? "tool_use" : "end_turn"
+                    };
+                  }
+                  break;
+              }
+            }
+          } finally {
+            clearInterval(timeoutInterval);
+          }
+          if (timeoutController.signal.aborted) {
+            throw new Error(`Stream timeout: No response from LLM for ${streamTimeout / 1e3}s`);
+          }
+        } catch (error) {
+          throw this.handleError(error);
+        }
       }
-    });
+      // --- Responses API conversion helpers ---
+      /**
+       * Convert internal messages to Responses API input format.
+       *
+       * The Responses API uses a flat array of input items instead of the
+       * chat completions messages array.
+       */
+      convertToResponsesInput(messages, systemPrompt) {
+        const input = [];
+        let instructions = null;
+        if (systemPrompt) {
+          instructions = systemPrompt;
+        }
+        for (const msg of messages) {
+          if (msg.role === "system") {
+            instructions = (instructions ? instructions + "\n\n" : "") + this.contentToString(msg.content);
+          } else if (msg.role === "user") {
+            if (Array.isArray(msg.content) && msg.content.some((b) => b.type === "tool_result")) {
+              for (const block of msg.content) {
+                if (block.type === "tool_result") {
+                  const tr = block;
+                  input.push({
+                    type: "function_call_output",
+                    call_id: tr.tool_use_id,
+                    output: tr.content
+                  });
+                }
+              }
+            } else if (Array.isArray(msg.content) && msg.content.some((b) => b.type === "image")) {
+              const parts = [];
+              for (const block of msg.content) {
+                if (block.type === "text") {
+                  parts.push({ type: "input_text", text: block.text });
+                } else if (block.type === "image") {
+                  const imgBlock = block;
+                  parts.push({
+                    type: "input_image",
+                    image_url: `data:${imgBlock.source.media_type};base64,${imgBlock.source.data}`,
+                    detail: "auto"
+                  });
+                }
+              }
+              input.push({
+                role: "user",
+                content: parts
+              });
+            } else {
+              input.push({
+                role: "user",
+                content: this.contentToString(msg.content)
+              });
+            }
+          } else if (msg.role === "assistant") {
+            if (typeof msg.content === "string") {
+              input.push({ role: "assistant", content: msg.content });
+            } else if (Array.isArray(msg.content)) {
+              const textParts = [];
+              for (const block of msg.content) {
+                if (block.type === "text") {
+                  textParts.push(block.text);
+                } else if (block.type === "tool_use") {
+                  if (textParts.length > 0) {
+                    input.push({ role: "assistant", content: textParts.join("") });
+                    textParts.length = 0;
+                  }
+                  input.push({
+                    type: "function_call",
+                    call_id: block.id,
+                    name: block.name,
+                    arguments: JSON.stringify(block.input)
+                  });
+                }
+              }
+              if (textParts.length > 0) {
+                input.push({ role: "assistant", content: textParts.join("") });
+              }
+            }
+          }
+        }
+        return { input, instructions };
+      }
+      /**
+       * Convert tool definitions to Responses API FunctionTool format
+       */
+      convertToolsForResponses(tools) {
+        return tools.map((tool) => ({
+          type: "function",
+          name: tool.name,
+          description: tool.description ?? void 0,
+          parameters: tool.input_schema ?? null,
+          strict: false
+        }));
+      }
+      /**
+       * Parse tool call arguments with jsonrepair fallback (Responses API)
+       */
+      parseResponsesArguments(args) {
+        try {
+          return args ? JSON.parse(args) : {};
+        } catch {
+          try {
+            if (args) {
+              const repaired = jsonrepair(args);
+              return JSON.parse(repaired);
+            }
+          } catch {
+            console.error(`[${this.name}] Cannot parse tool arguments: ${args.slice(0, 200)}`);
+          }
+          return {};
+        }
+      }
+    };
+  }
+});
+async function requestDeviceCode(provider) {
+  const config = OAUTH_CONFIGS[provider];
+  if (!config) {
+    throw new Error(`OAuth not supported for provider: ${provider}`);
+  }
+  if (!config.deviceAuthEndpoint) {
+    throw new Error(
+      `Device code flow not supported for provider: ${provider}. Use browser OAuth instead.`
+    );
+  }
+  const body = new URLSearchParams({
+    client_id: config.clientId,
+    scope: config.scopes.join(" ")
   });
-  const timeoutId = setTimeout(() => {
-    server.close();
-    rejectResult(new Error("Authentication timed out. Please try again."));
-  }, timeout);
-  server.on("close", () => {
-    clearTimeout(timeoutId);
+  if (provider === "openai") {
+    body.set("audience", "https://api.openai.com/v1");
+  }
+  const response = await fetch(config.deviceAuthEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "User-Agent": "Corbat-Coco CLI",
+      Accept: "application/json"
+    },
+    body: body.toString()
   });
-  return { port: actualPort, resultPromise };
-}
-var OAUTH_CALLBACK_PORT, SUCCESS_HTML, ERROR_HTML;
-var init_callback_server = __esm({
-  "src/auth/callback-server.ts"() {
-    OAUTH_CALLBACK_PORT = 1455;
-    SUCCESS_HTML = `
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Authentication Successful</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body {
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
-      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-    }
-    .container {
-      background: white;
-      border-radius: 16px;
-      padding: 48px;
-      text-align: center;
-      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25);
-      max-width: 400px;
+  if (!response.ok) {
+    const contentType2 = response.headers.get("content-type") || "";
+    const error = await response.text();
+    if (contentType2.includes("text/html") || error.includes("<!DOCTYPE") || error.includes("<html")) {
+      throw new Error(
+        "OAuth request blocked (possibly by Cloudflare).\n   This can happen due to network restrictions or rate limiting.\n   Please try:\n   1. Use an API key instead (recommended)\n   2. Wait a few minutes and try again\n   3. Try from a different network"
+      );
     }
-    .checkmark {
-      width: 80px;
-      height: 80px;
-      margin: 0 auto 24px;
-      background: linear-gradient(135deg, #10b981 0%, #059669 100%);
-      border-radius: 50%;
-      display: flex;
-      align-items: center;
-      justify-content: center;
+    throw new Error(`Failed to request device code: ${error}`);
+  }
+  const contentType = response.headers.get("content-type") || "";
+  if (!contentType.includes("application/json")) {
+    const text13 = await response.text();
+    if (text13.includes("<!DOCTYPE") || text13.includes("<html")) {
+      throw new Error(
+        "OAuth service returned HTML instead of JSON.\n   The service may be temporarily unavailable.\n   Please use an API key instead, or try again later."
+      );
     }
-    .checkmark svg {
-      width: 40px;
-      height: 40px;
-      stroke: white;
-      stroke-width: 3;
-      fill: none;
-    }
-    h1 {
-      font-size: 24px;
-      font-weight: 600;
-      color: #1f2937;
-      margin-bottom: 12px;
-    }
-    p {
-      color: #6b7280;
-      font-size: 16px;
-      line-height: 1.5;
-    }
-    .brand {
-      margin-top: 24px;
-      padding-top: 24px;
-      border-top: 1px solid #e5e7eb;
-      color: #9ca3af;
-      font-size: 14px;
-    }
-    .brand strong {
-      color: #667eea;
-    }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <div class="checkmark">
-      <svg viewBox="0 0 24 24">
-        <path d="M20 6L9 17l-5-5" stroke-linecap="round" stroke-linejoin="round"/>
-      </svg>
-    </div>
-    <h1>Authentication Successful!</h1>
-    <p>You can close this window and return to your terminal.</p>
-    <div class="brand">
-      Powered by <strong>Corbat-Coco</strong>
-    </div>
-  </div>
-  <script>
-    // Auto-close after 3 seconds
-    setTimeout(() => window.close(), 3000);
-  </script>
-</body>
-</html>
-`;
-    ERROR_HTML = (error) => {
-      const safeError = escapeHtml(error);
-      return `
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Authentication Failed</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body {
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
-      background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-    }
-    .container {
-      background: white;
-      border-radius: 16px;
-      padding: 48px;
-      text-align: center;
-      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25);
-      max-width: 400px;
-    }
-    .icon {
-      width: 80px;
-      height: 80px;
-      margin: 0 auto 24px;
-      background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
-      border-radius: 50%;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-    }
-    .icon svg {
-      width: 40px;
-      height: 40px;
-      stroke: white;
-      stroke-width: 3;
-      fill: none;
-    }
-    h1 {
-      font-size: 24px;
-      font-weight: 600;
-      color: #1f2937;
-      margin-bottom: 12px;
-    }
-    p {
-      color: #6b7280;
-      font-size: 16px;
-      line-height: 1.5;
-    }
-    .error {
-      margin-top: 16px;
-      padding: 12px;
-      background: #fef2f2;
-      border-radius: 8px;
-      color: #dc2626;
-      font-family: monospace;
-      font-size: 14px;
-    }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <div class="icon">
-      <svg viewBox="0 0 24 24">
-        <path d="M18 6L6 18M6 6l12 12" stroke-linecap="round" stroke-linejoin="round"/>
-      </svg>
-    </div>
-    <h1>Authentication Failed</h1>
-    <p>Something went wrong. Please try again.</p>
-    <div class="error">${safeError}</div>
-  </div>
-</body>
-</html>
-`;
-    };
-  }
-});
-function detectWSL() {
-  if (process.env.WSL_DISTRO_NAME || process.env.WSLENV) return true;
-  try {
-    return /microsoft/i.test(readFileSync("/proc/version", "utf-8"));
-  } catch {
-    return false;
   }
+  const data = await response.json();
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: data.verification_uri || config.verificationUri || "",
+    verificationUriComplete: data.verification_uri_complete,
+    expiresIn: data.expires_in,
+    interval: data.interval || 5
+  };
 }
-var isWSL;
-var init_platform = __esm({
-  "src/utils/platform.ts"() {
-    isWSL = detectWSL();
-  }
-});
-async function requestGitHubDeviceCode() {
-  const response = await fetch(GITHUB_DEVICE_CODE_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json"
-    },
-    body: JSON.stringify({
-      client_id: COPILOT_CLIENT_ID,
-      scope: "read:user"
-    })
-  });
-  if (!response.ok) {
-    const error = await response.text();
-    throw new Error(`GitHub device code request failed: ${response.status} - ${error}`);
+async function pollForToken(provider, deviceCode, interval, expiresIn, onPoll) {
+  const config = OAUTH_CONFIGS[provider];
+  if (!config) {
+    throw new Error(`OAuth not supported for provider: ${provider}`);
   }
-  return await response.json();
-}
-async function pollGitHubForToken(deviceCode, interval, expiresIn, onPoll) {
-  const expiresAt = Date.now() + expiresIn * 1e3;
+  const startTime = Date.now();
+  const expiresAt = startTime + expiresIn * 1e3;
   while (Date.now() < expiresAt) {
     await new Promise((resolve4) => setTimeout(resolve4, interval * 1e3));
     if (onPoll) onPoll();
-    const response = await fetch(GITHUB_TOKEN_URL, {
+    const body = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: config.clientId,
+      device_code: deviceCode
+    });
+    const response = await fetch(config.tokenEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/json",
-        Accept: "application/json"
+        "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: JSON.stringify({
-        client_id: COPILOT_CLIENT_ID,
-        device_code: deviceCode,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-      })
+      body: body.toString()
     });
     const data = await response.json();
     if (data.access_token) {
-      return data.access_token;
+      return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0,
+        tokenType: data.token_type || "Bearer"
+      };
     }
     if (data.error === "authorization_pending") {
       continue;
@@ -2787,1625 +2666,1819 @@ async function pollGitHubForToken(deviceCode, interval, expiresIn, onPoll) {
   }
   throw new Error("Authentication timed out. Please try again.");
 }
-async function exchangeForCopilotToken(githubToken) {
-  const response = await fetch(COPILOT_TOKEN_URL, {
-    method: "GET",
+async function refreshAccessToken(provider, refreshToken) {
+  const config = OAUTH_CONFIGS[provider];
+  if (!config) {
+    throw new Error(`OAuth not supported for provider: ${provider}`);
+  }
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: config.clientId,
+    refresh_token: refreshToken
+  });
+  const response = await fetch(config.tokenEndpoint, {
+    method: "POST",
     headers: {
-      Authorization: `token ${githubToken}`,
-      Accept: "application/json",
-      "User-Agent": "Corbat-Coco/1.0"
-    }
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: body.toString()
   });
   if (!response.ok) {
     const error = await response.text();
-    if (response.status === 401) {
-      throw new CopilotAuthError(
-        "GitHub token is invalid or expired. Please re-authenticate with /provider copilot.",
-        true
-      );
-    }
-    if (response.status === 403) {
-      throw new CopilotAuthError(
-        "GitHub Copilot is not enabled for this account.\n   Please ensure you have an active Copilot subscription:\n   https://github.com/settings/copilot",
-        true
-      );
-    }
-    throw new Error(`Copilot token exchange failed: ${response.status} - ${error}`);
-  }
-  return await response.json();
-}
-function getCopilotBaseUrl(accountType) {
-  if (accountType && accountType in COPILOT_BASE_URLS) {
-    return COPILOT_BASE_URLS[accountType];
+    throw new Error(`Token refresh failed: ${error}`);
   }
-  return DEFAULT_COPILOT_BASE_URL;
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0,
+    tokenType: data.token_type
+  };
 }
-function getCopilotCredentialsPath() {
+function getTokenStoragePath(provider) {
   const home = process.env.HOME || process.env.USERPROFILE || "";
-  return path36.join(home, ".coco", "tokens", "copilot.json");
+  return path36.join(home, ".coco", "tokens", `${provider}.json`);
 }
-async function saveCopilotCredentials(creds) {
-  const filePath = getCopilotCredentialsPath();
-  const dir = path36.dirname(filePath);
+async function saveTokens(provider, tokens) {
+  const filePath = getTokenStoragePath(provider);
+  const dir = path36.dirname(filePath);
   await fs34.mkdir(dir, { recursive: true, mode: 448 });
-  await fs34.writeFile(filePath, JSON.stringify(creds, null, 2), { mode: 384 });
+  await fs34.writeFile(filePath, JSON.stringify(tokens, null, 2), { mode: 384 });
 }
-async function loadCopilotCredentials() {
+async function loadTokens(provider) {
+  const filePath = getTokenStoragePath(provider);
   try {
-    const content = await fs34.readFile(getCopilotCredentialsPath(), "utf-8");
-    const parsed = CopilotCredentialsSchema.safeParse(JSON.parse(content));
-    return parsed.success ? parsed.data : null;
+    const content = await fs34.readFile(filePath, "utf-8");
+    return JSON.parse(content);
   } catch {
     return null;
   }
 }
-async function deleteCopilotCredentials() {
+async function deleteTokens(provider) {
+  const filePath = getTokenStoragePath(provider);
   try {
-    await fs34.unlink(getCopilotCredentialsPath());
+    await fs34.unlink(filePath);
   } catch {
   }
 }
-function isCopilotTokenExpired(creds) {
-  if (!creds.copilotToken || !creds.copilotTokenExpiresAt) return true;
-  return Date.now() >= creds.copilotTokenExpiresAt - REFRESH_BUFFER_MS;
+function isTokenExpired(tokens) {
+  if (!tokens.expiresAt) return false;
+  return Date.now() >= tokens.expiresAt - 5 * 60 * 1e3;
 }
-async function getValidCopilotToken() {
-  const creds = await loadCopilotCredentials();
-  if (!creds) return null;
-  const envToken = process.env["GITHUB_TOKEN"] || process.env["GH_TOKEN"];
-  const githubToken = envToken || creds.githubToken;
-  if (!isCopilotTokenExpired(creds) && creds.copilotToken) {
-    return {
-      token: creds.copilotToken,
-      baseUrl: getCopilotBaseUrl(creds.accountType),
-      isNew: false
-    };
+async function getValidAccessToken(provider) {
+  const config = OAUTH_CONFIGS[provider];
+  if (!config) return null;
+  const tokens = await loadTokens(provider);
+  if (!tokens) return null;
+  if (isTokenExpired(tokens)) {
+    if (tokens.refreshToken) {
+      try {
+        const newTokens = await refreshAccessToken(provider, tokens.refreshToken);
+        await saveTokens(provider, newTokens);
+        return { accessToken: newTokens.accessToken, isNew: true };
+      } catch {
+        await deleteTokens(provider);
+        return null;
+      }
+    }
+    await deleteTokens(provider);
+    return null;
   }
-  try {
-    const copilotToken = await exchangeForCopilotToken(githubToken);
-    const updatedCreds = {
-      ...creds,
-      githubToken: creds.githubToken,
-      copilotToken: copilotToken.token,
-      copilotTokenExpiresAt: copilotToken.expires_at * 1e3,
-      accountType: copilotToken.annotations?.copilot_plan ?? creds.accountType
-    };
-    await saveCopilotCredentials(updatedCreds);
-    return {
-      token: copilotToken.token,
-      baseUrl: getCopilotBaseUrl(updatedCreds.accountType),
-      isNew: true
-    };
-  } catch (error) {
-    if (error instanceof CopilotAuthError && error.permanent) {
-      await deleteCopilotCredentials();
-      return null;
+  return { accessToken: tokens.accessToken, isNew: false };
+}
+function buildAuthorizationUrl(provider, redirectUri, codeChallenge, state) {
+  const config = OAUTH_CONFIGS[provider];
+  if (!config) {
+    throw new Error(`OAuth not supported for provider: ${provider}`);
+  }
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: config.clientId,
+    redirect_uri: redirectUri,
+    scope: config.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  if (config.extraAuthParams) {
+    for (const [key, value] of Object.entries(config.extraAuthParams)) {
+      params.set(key, value);
     }
-    throw error;
   }
+  return `${config.authorizationEndpoint}?${params.toString()}`;
 }
-var COPILOT_CLIENT_ID, GITHUB_DEVICE_CODE_URL, GITHUB_TOKEN_URL, COPILOT_TOKEN_URL, COPILOT_BASE_URLS, DEFAULT_COPILOT_BASE_URL, REFRESH_BUFFER_MS, CopilotAuthError, CopilotCredentialsSchema;
-var init_copilot = __esm({
-  "src/auth/copilot.ts"() {
-    COPILOT_CLIENT_ID = "Iv1.b507a08c87ecfe98";
-    GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-    GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-    COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
-    COPILOT_BASE_URLS = {
-      individual: "https://api.githubcopilot.com",
-      business: "https://api.business.githubcopilot.com",
-      enterprise: "https://api.enterprise.githubcopilot.com"
-    };
-    DEFAULT_COPILOT_BASE_URL = "https://api.githubcopilot.com";
-    REFRESH_BUFFER_MS = 6e4;
-    CopilotAuthError = class extends Error {
-      constructor(message, permanent) {
-        super(message);
-        this.permanent = permanent;
-        this.name = "CopilotAuthError";
+async function exchangeCodeForTokens(provider, code, codeVerifier, redirectUri) {
+  const config = OAUTH_CONFIGS[provider];
+  if (!config) {
+    throw new Error(`OAuth not supported for provider: ${provider}`);
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: config.clientId,
+    code,
+    code_verifier: codeVerifier,
+    redirect_uri: redirectUri
+  });
+  const response = await fetch(config.tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    const error = await response.text();
+    throw new Error(`Token exchange failed: ${error}`);
+  }
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0,
+    tokenType: data.token_type || "Bearer"
+  };
+}
+var OAUTH_CONFIGS;
+var init_oauth = __esm({
+  "src/auth/oauth.ts"() {
+    OAUTH_CONFIGS = {
+      /**
+       * OpenAI OAuth (ChatGPT Plus/Pro subscriptions)
+       * Uses the official Codex client ID (same as OpenCode, Codex CLI, etc.)
+       */
+      openai: {
+        provider: "openai",
+        clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+        authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
+        tokenEndpoint: "https://auth.openai.com/oauth/token",
+        deviceAuthEndpoint: "https://auth.openai.com/oauth/device/code",
+        verificationUri: "https://chatgpt.com/codex/device",
+        scopes: ["openid", "profile", "email", "offline_access"],
+        extraAuthParams: {
+          id_token_add_organizations: "true",
+          codex_cli_simplified_flow: "true",
+          originator: "opencode"
+        }
       }
+      // NOTE: Gemini OAuth removed - Google's client ID is restricted to official apps
+      // Use API Key (https://aistudio.google.com/apikey) or gcloud ADC instead
     };
-    CopilotCredentialsSchema = z.object({
-      githubToken: z.string().min(1),
-      copilotToken: z.string().optional(),
-      copilotTokenExpiresAt: z.number().optional(),
-      accountType: z.string().optional()
-    });
   }
 });
-function getOAuthProviderName(provider) {
-  if (provider === "codex") return "openai";
-  return provider;
+function generateCodeVerifier(length = 64) {
+  const randomBytes2 = crypto.randomBytes(length);
+  return base64UrlEncode(randomBytes2);
 }
-function getProviderDisplayInfo(provider) {
-  const oauthProvider = getOAuthProviderName(provider);
-  switch (oauthProvider) {
-    case "openai":
-      return {
-        name: "OpenAI",
-        emoji: "\u{1F7E2}",
-        authDescription: "Sign in with your ChatGPT account",
-        apiKeyUrl: "https://platform.openai.com/api-keys"
-      };
-    case "copilot":
-      return {
-        name: "GitHub Copilot",
-        emoji: "\u{1F419}",
-        authDescription: "Sign in with your GitHub account",
-        apiKeyUrl: "https://github.com/settings/copilot"
-      };
-    default:
-      return {
-        name: provider,
-        emoji: "\u{1F510}",
-        authDescription: "Sign in with your account",
-        apiKeyUrl: ""
-      };
-  }
+function generateCodeChallenge(codeVerifier) {
+  const hash = crypto.createHash("sha256").update(codeVerifier).digest();
+  return base64UrlEncode(hash);
 }
-function supportsOAuth(provider) {
-  if (provider === "copilot") return true;
-  const oauthProvider = getOAuthProviderName(provider);
-  return oauthProvider in OAUTH_CONFIGS;
+function generateState(length = 32) {
+  const randomBytes2 = crypto.randomBytes(length);
+  return base64UrlEncode(randomBytes2);
 }
-async function isOAuthConfigured(provider) {
-  if (provider === "copilot") {
-    const creds = await loadCopilotCredentials();
-    return creds !== null;
-  }
-  const oauthProvider = getOAuthProviderName(provider);
-  const tokens = await loadTokens(oauthProvider);
-  return tokens !== null;
+function base64UrlEncode(buffer) {
+  return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function printAuthUrl(url) {
-  try {
-    const parsed = new URL(url);
-    const maskedParams = new URLSearchParams(parsed.searchParams);
-    if (maskedParams.has("client_id")) {
-      const clientId = maskedParams.get("client_id");
-      maskedParams.set("client_id", clientId.slice(0, 8) + "...");
-    }
-    parsed.search = maskedParams.toString();
-    console.log(chalk2.cyan(`   ${parsed.toString()}`));
-  } catch {
-    console.log(chalk2.cyan("   [invalid URL]"));
+function generatePKCECredentials() {
+  const codeVerifier = generateCodeVerifier();
+  const codeChallenge = generateCodeChallenge(codeVerifier);
+  const state = generateState();
+  return {
+    codeVerifier,
+    codeChallenge,
+    state
+  };
+}
+var init_pkce = __esm({
+  "src/auth/pkce.ts"() {
   }
+});
+function escapeHtml(unsafe) {
+  return unsafe.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
 }
-async function openBrowser(url) {
-  let sanitizedUrl;
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-      return false;
-    }
-    sanitizedUrl = parsed.toString();
-  } catch {
-    return false;
-  }
-  const platform = process.platform;
-  try {
-    if (platform === "darwin") {
-      await execFileAsync("open", [sanitizedUrl]);
-    } else if (platform === "win32") {
-      await execFileAsync("rundll32", ["url.dll,FileProtocolHandler", sanitizedUrl]);
-    } else if (isWSL) {
-      await execFileAsync("cmd.exe", ["/c", "start", "", sanitizedUrl]);
-    } else {
-      await execFileAsync("xdg-open", [sanitizedUrl]);
+async function createCallbackServer(expectedState, timeout = 5 * 60 * 1e3, port = OAUTH_CALLBACK_PORT) {
+  let resolveResult;
+  let rejectResult;
+  const resultPromise = new Promise((resolve4, reject) => {
+    resolveResult = resolve4;
+    rejectResult = reject;
+  });
+  const server = http.createServer((req, res) => {
+    console.log(`   [OAuth] ${req.method} ${req.url?.split("?")[0]}`);
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "*");
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
     }
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function openBrowserFallback(url) {
-  let sanitizedUrl;
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-      return false;
+    if (!req.url?.startsWith("/auth/callback")) {
+      res.writeHead(404);
+      res.end("Not Found");
+      return;
     }
-    sanitizedUrl = parsed.toString();
-  } catch {
-    return false;
-  }
-  const platform = process.platform;
-  const commands2 = [];
-  if (platform === "darwin") {
-    commands2.push(
-      { cmd: "open", args: [sanitizedUrl] },
-      { cmd: "open", args: ["-a", "Safari", sanitizedUrl] },
-      { cmd: "open", args: ["-a", "Google Chrome", sanitizedUrl] }
-    );
-  } else if (platform === "win32") {
-    commands2.push({
-      cmd: "rundll32",
-      args: ["url.dll,FileProtocolHandler", sanitizedUrl]
-    });
-  } else if (isWSL) {
-    commands2.push(
-      { cmd: "cmd.exe", args: ["/c", "start", "", sanitizedUrl] },
-      { cmd: "powershell.exe", args: ["-Command", `Start-Process '${sanitizedUrl}'`] },
-      { cmd: "wslview", args: [sanitizedUrl] }
-    );
-  } else {
-    commands2.push(
-      { cmd: "xdg-open", args: [sanitizedUrl] },
-      { cmd: "sensible-browser", args: [sanitizedUrl] },
-      { cmd: "x-www-browser", args: [sanitizedUrl] },
-      { cmd: "gnome-open", args: [sanitizedUrl] },
-      { cmd: "firefox", args: [sanitizedUrl] },
-      { cmd: "chromium-browser", args: [sanitizedUrl] },
-      { cmd: "google-chrome", args: [sanitizedUrl] }
-    );
-  }
-  for (const { cmd, args } of commands2) {
     try {
-      await execFileAsync(cmd, args);
-      return true;
-    } catch {
-      continue;
-    }
-  }
-  return false;
-}
-async function runOAuthFlow(provider) {
-  if (provider === "copilot") {
-    return runCopilotDeviceFlow();
-  }
-  const oauthProvider = getOAuthProviderName(provider);
-  const config = OAUTH_CONFIGS[oauthProvider];
-  if (!config) {
-    p26.log.error(`OAuth not supported for provider: ${provider}`);
-    return null;
-  }
-  const displayInfo = getProviderDisplayInfo(provider);
-  console.log();
-  console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-  console.log(
-    chalk2.magenta("   \u2502 ") + chalk2.bold.white(`${displayInfo.emoji} ${displayInfo.name} Authentication`.padEnd(47)) + chalk2.magenta("\u2502")
-  );
-  console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
-  console.log();
-  const authOptions = [
-    {
-      value: "browser",
-      label: "\u{1F310} Sign in with browser",
-      hint: `${displayInfo.authDescription} (recommended)`
-    },
-    {
-      value: "api_key",
-      label: "\u{1F4CB} Paste API key manually",
-      hint: `Get from ${displayInfo.apiKeyUrl}`
+      const url = new URL$1(req.url, `http://localhost`);
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      if (error) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML(errorDescription || error));
+        server.close();
+        rejectResult(new Error(errorDescription || error));
+        return;
+      }
+      if (!code || !state) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML("Missing authorization code or state"));
+        server.close();
+        rejectResult(new Error("Missing authorization code or state"));
+        return;
+      }
+      if (state !== expectedState) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML("State mismatch - possible CSRF attack"));
+        server.close();
+        rejectResult(new Error("State mismatch - possible CSRF attack"));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end(SUCCESS_HTML);
+      server.close();
+      resolveResult({ code, state });
+    } catch (err) {
+      res.writeHead(500, { "Content-Type": "text/html" });
+      res.end(ERROR_HTML(String(err)));
+      server.close();
+      rejectResult(err instanceof Error ? err : new Error(String(err)));
     }
-  ];
-  const authMethod = await p26.select({
-    message: "Choose authentication method:",
-    options: authOptions
   });
-  if (p26.isCancel(authMethod)) return null;
-  if (authMethod === "browser") {
-    return runBrowserOAuthFlow(provider);
-  } else {
-    return runApiKeyFlow(provider);
-  }
-}
-async function isPortAvailable(port) {
-  const net = await import('net');
-  return new Promise((resolve4) => {
-    const server = net.createServer();
-    server.once("error", (err) => {
+  const actualPort = await new Promise((resolve4, reject) => {
+    const errorHandler = (err) => {
       if (err.code === "EADDRINUSE") {
-        resolve4({ available: false, processName: "another process" });
+        console.log(`   Port ${port} is in use, trying alternative port...`);
+        server.removeListener("error", errorHandler);
+        server.listen(0, () => {
+          const address = server.address();
+          if (typeof address === "object" && address) {
+            resolve4(address.port);
+          } else {
+            reject(new Error("Failed to get server port"));
+          }
+        });
       } else {
-        resolve4({ available: false });
+        reject(err);
+      }
+    };
+    server.on("error", errorHandler);
+    server.listen(port, () => {
+      server.removeListener("error", errorHandler);
+      const address = server.address();
+      if (typeof address === "object" && address) {
+        resolve4(address.port);
+      } else {
+        reject(new Error("Failed to get server port"));
       }
     });
-    server.once("listening", () => {
-      server.close();
-      resolve4({ available: true });
-    });
-    server.listen(port, "127.0.0.1");
   });
+  const timeoutId = setTimeout(() => {
+    server.close();
+    rejectResult(new Error("Authentication timed out. Please try again."));
+  }, timeout);
+  server.on("close", () => {
+    clearTimeout(timeoutId);
+  });
+  return { port: actualPort, resultPromise };
 }
-function getRequiredPort(provider) {
-  const oauthProvider = getOAuthProviderName(provider);
-  if (oauthProvider === "openai") return 1455;
-  return void 0;
-}
-async function runBrowserOAuthFlow(provider) {
-  const oauthProvider = getOAuthProviderName(provider);
-  const displayInfo = getProviderDisplayInfo(provider);
-  const config = OAUTH_CONFIGS[oauthProvider];
-  const requiredPort = getRequiredPort(provider);
-  if (requiredPort) {
-    console.log();
-    console.log(chalk2.dim("   Checking port availability..."));
-    const portCheck = await isPortAvailable(requiredPort);
-    if (!portCheck.available) {
-      console.log();
-      console.log(chalk2.yellow(`   \u26A0 Port ${requiredPort} is already in use`));
-      console.log();
-      console.log(
-        chalk2.dim(
-          `   ${displayInfo.name} OAuth requires port ${requiredPort}, which is currently occupied.`
-        )
-      );
-      console.log(chalk2.dim("   This usually means OpenCode or another coding tool is running."));
-      console.log();
-      console.log(chalk2.cyan("   To fix this:"));
-      console.log(chalk2.dim("   1. Close OpenCode/Codex CLI (if running)"));
-      console.log(
-        chalk2.dim("   2. Or use an API key instead (recommended if using multiple tools)")
-      );
-      console.log();
-      const fallbackOptions = [
-        {
-          value: "api_key",
-          label: "\u{1F4CB} Use API key instead",
-          hint: `Get from ${displayInfo.apiKeyUrl}`
-        },
-        {
-          value: "retry",
-          label: "\u{1F504} Retry (after closing other tools)",
-          hint: "Check port again"
-        }
-      ];
-      if (config?.deviceAuthEndpoint) {
-        fallbackOptions.push({
-          value: "device_code",
-          label: "\u{1F511} Try device code flow",
-          hint: "May be blocked by Cloudflare"
-        });
-      }
-      fallbackOptions.push({
-        value: "cancel",
-        label: "\u274C Cancel",
-        hint: ""
-      });
-      const fallback = await p26.select({
-        message: "What would you like to do?",
-        options: fallbackOptions
-      });
-      if (p26.isCancel(fallback) || fallback === "cancel") return null;
-      if (fallback === "api_key") {
-        return runApiKeyFlow(provider);
-      } else if (fallback === "device_code") {
-        return runDeviceCodeFlow(provider);
-      } else if (fallback === "retry") {
-        return runBrowserOAuthFlow(provider);
-      }
-      return null;
+var OAUTH_CALLBACK_PORT, SUCCESS_HTML, ERROR_HTML;
+var init_callback_server = __esm({
+  "src/auth/callback-server.ts"() {
+    OAUTH_CALLBACK_PORT = 1455;
+    SUCCESS_HTML = `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Authentication Successful</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
     }
-  }
-  console.log(chalk2.dim("   Starting authentication server..."));
-  try {
-    const pkce = generatePKCECredentials();
-    const { port, resultPromise } = await createCallbackServer(pkce.state);
-    const redirectUri = `http://localhost:${port}/auth/callback`;
-    const authUrl = buildAuthorizationUrl(
-      oauthProvider,
-      redirectUri,
-      pkce.codeChallenge,
-      pkce.state
-    );
-    console.log(chalk2.green(`   \u2713 Server ready on port ${port}`));
-    console.log();
-    console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-    console.log(
-      chalk2.magenta("   \u2502 ") + chalk2.bold.white(`${displayInfo.authDescription}`.padEnd(47)) + chalk2.magenta("\u2502")
-    );
-    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
-    console.log(
-      chalk2.magenta("   \u2502 ") + chalk2.dim("A browser window will open for you to sign in.") + chalk2.magenta("  \u2502")
-    );
-    console.log(
-      chalk2.magenta("   \u2502 ") + chalk2.dim("After signing in, you'll be redirected back.") + chalk2.magenta("    \u2502")
-    );
-    console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
-    console.log();
-    const openIt = await p26.confirm({
-      message: "Open browser to sign in?",
-      initialValue: true
-    });
-    if (p26.isCancel(openIt)) return null;
-    if (openIt) {
-      const opened = await openBrowser(authUrl);
-      if (opened) {
-        console.log(chalk2.green("   \u2713 Browser opened"));
-      } else {
-        const fallbackOpened = await openBrowserFallback(authUrl);
-        if (fallbackOpened) {
-          console.log(chalk2.green("   \u2713 Browser opened"));
-        } else {
-          console.log(chalk2.dim("   Could not open browser automatically."));
-          console.log(chalk2.dim("   Please open this URL manually:"));
-          console.log();
-          printAuthUrl(authUrl);
-          console.log();
-        }
-      }
-    } else {
-      console.log(chalk2.dim("   Please open this URL in your browser:"));
-      console.log();
-      printAuthUrl(authUrl);
-      console.log();
+    .container {
+      background: white;
+      border-radius: 16px;
+      padding: 48px;
+      text-align: center;
+      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25);
+      max-width: 400px;
     }
-    const spinner18 = p26.spinner();
-    spinner18.start("Waiting for you to sign in...");
-    const callbackResult = await resultPromise;
-    spinner18.stop(chalk2.green("\u2713 Authentication received!"));
-    console.log(chalk2.dim("   Exchanging code for tokens..."));
-    const tokens = await exchangeCodeForTokens(
-      oauthProvider,
-      callbackResult.code,
-      pkce.codeVerifier,
-      redirectUri
-    );
-    await saveTokens(oauthProvider, tokens);
-    console.log(chalk2.green("\n   \u2705 Authentication complete!\n"));
-    if (oauthProvider === "openai") {
-      console.log(chalk2.dim("   Your ChatGPT Plus/Pro subscription is now linked."));
+    .checkmark {
+      width: 80px;
+      height: 80px;
+      margin: 0 auto 24px;
+      background: linear-gradient(135deg, #10b981 0%, #059669 100%);
+      border-radius: 50%;
+      display: flex;
+      align-items: center;
+      justify-content: center;
     }
-    console.log(chalk2.dim("   Tokens are securely stored in ~/.coco/tokens/\n"));
-    return { tokens, accessToken: tokens.accessToken };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    console.log();
-    console.log(chalk2.yellow("   \u26A0 Browser authentication failed"));
-    const errorCategory = errorMsg.includes("timeout") || errorMsg.includes("Timeout") ? "Request timed out" : errorMsg.includes("network") || errorMsg.includes("ECONNREFUSED") || errorMsg.includes("fetch") ? "Network error" : errorMsg.includes("401") || errorMsg.includes("403") ? "Authorization denied" : errorMsg.includes("invalid_grant") || errorMsg.includes("invalid_client") ? "Invalid credentials" : "Authentication error (see debug logs for details)";
-    console.log(chalk2.dim(`   Error: ${errorCategory}`));
-    console.log();
-    const fallbackOptions = [];
-    if (config?.deviceAuthEndpoint) {
-      fallbackOptions.push({
-        value: "device_code",
-        label: "\u{1F511} Try device code flow",
-        hint: "Enter code manually in browser"
-      });
+    .checkmark svg {
+      width: 40px;
+      height: 40px;
+      stroke: white;
+      stroke-width: 3;
+      fill: none;
     }
-    fallbackOptions.push({
-      value: "api_key",
-      label: "\u{1F4CB} Use API key instead",
-      hint: `Get from ${displayInfo.apiKeyUrl}`
-    });
-    fallbackOptions.push({
-      value: "cancel",
-      label: "\u274C Cancel",
-      hint: ""
-    });
-    const fallback = await p26.select({
-      message: "What would you like to do?",
-      options: fallbackOptions
-    });
-    if (p26.isCancel(fallback) || fallback === "cancel") return null;
-    if (fallback === "device_code") {
-      return runDeviceCodeFlow(provider);
-    } else {
-      return runApiKeyFlow(provider);
+    h1 {
+      font-size: 24px;
+      font-weight: 600;
+      color: #1f2937;
+      margin-bottom: 12px;
     }
-  }
-}
-async function runDeviceCodeFlow(provider) {
-  const oauthProvider = getOAuthProviderName(provider);
-  const displayInfo = getProviderDisplayInfo(provider);
-  console.log();
-  console.log(chalk2.dim(`   Requesting device code from ${displayInfo.name}...`));
-  try {
-    const deviceCode = await requestDeviceCode(oauthProvider);
-    console.log();
-    console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-    console.log(
-      chalk2.magenta("   \u2502 ") + chalk2.bold.white("Enter this code in your browser:") + chalk2.magenta("               \u2502")
-    );
-    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
-    console.log(
-      chalk2.magenta("   \u2502       ") + chalk2.bold.cyan.bgBlack(` ${deviceCode.userCode} `) + chalk2.magenta("                            \u2502")
-    );
-    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
-    console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
-    console.log();
-    const verificationUrl = deviceCode.verificationUriComplete || deviceCode.verificationUri;
-    console.log(chalk2.cyan(`   \u2192 ${verificationUrl}`));
-    console.log();
-    const openIt = await p26.confirm({
-      message: "Open browser to sign in?",
-      initialValue: true
-    });
-    if (p26.isCancel(openIt)) return null;
-    if (openIt) {
-      const opened = await openBrowser(verificationUrl);
-      if (opened) {
-        console.log(chalk2.green("   \u2713 Browser opened"));
-      } else {
-        const fallbackOpened = await openBrowserFallback(verificationUrl);
-        if (fallbackOpened) {
-          console.log(chalk2.green("   \u2713 Browser opened"));
-        } else {
-          console.log(chalk2.dim("   Copy the URL above and paste it in your browser"));
-        }
-      }
+    p {
+      color: #6b7280;
+      font-size: 16px;
+      line-height: 1.5;
     }
-    console.log();
-    const spinner18 = p26.spinner();
-    spinner18.start("Waiting for you to sign in...");
-    let pollCount = 0;
-    const tokens = await pollForToken(
-      oauthProvider,
-      deviceCode.deviceCode,
-      deviceCode.interval,
-      deviceCode.expiresIn,
-      () => {
-        pollCount++;
-        const dots = ".".repeat(pollCount % 3 + 1);
-        spinner18.message(`Waiting for you to sign in${dots}`);
-      }
-    );
-    spinner18.stop(chalk2.green("\u2713 Signed in successfully!"));
-    await saveTokens(oauthProvider, tokens);
-    console.log(chalk2.green("\n   \u2705 Authentication complete!\n"));
-    if (oauthProvider === "openai") {
-      console.log(chalk2.dim("   Your ChatGPT Plus/Pro subscription is now linked."));
-    } else {
-      console.log(chalk2.dim(`   Your ${displayInfo.name} account is now linked.`));
+    .brand {
+      margin-top: 24px;
+      padding-top: 24px;
+      border-top: 1px solid #e5e7eb;
+      color: #9ca3af;
+      font-size: 14px;
     }
-    console.log(chalk2.dim("   Tokens are securely stored in ~/.coco/tokens/\n"));
-    return { tokens, accessToken: tokens.accessToken };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    if (errorMsg.includes("Cloudflare") || errorMsg.includes("blocked") || errorMsg.includes("HTML instead of JSON") || errorMsg.includes("not supported")) {
-      console.log();
-      console.log(chalk2.yellow("   \u26A0 Device code flow unavailable"));
-      console.log(chalk2.dim("   This can happen due to network restrictions."));
-      console.log();
-      const useFallback = await p26.confirm({
-        message: "Use API key instead?",
-        initialValue: true
-      });
-      if (p26.isCancel(useFallback) || !useFallback) return null;
-      return runApiKeyFlow(provider);
+    .brand strong {
+      color: #667eea;
     }
-    const deviceErrorCategory = errorMsg.includes("timeout") || errorMsg.includes("expired") ? "Device code expired" : errorMsg.includes("denied") || errorMsg.includes("access_denied") ? "Access denied by user" : "Unexpected error during device code authentication";
-    p26.log.error(chalk2.red(`   Authentication failed: ${deviceErrorCategory}`));
-    return null;
-  }
-}
-async function runApiKeyFlow(provider) {
-  if (provider === "copilot") {
-    throw new Error("runApiKeyFlow called with copilot \u2014 use runCopilotDeviceFlow() instead");
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="checkmark">
+      <svg viewBox="0 0 24 24">
+        <path d="M20 6L9 17l-5-5" stroke-linecap="round" stroke-linejoin="round"/>
+      </svg>
+    </div>
+    <h1>Authentication Successful!</h1>
+    <p>You can close this window and return to your terminal.</p>
+    <div class="brand">
+      Powered by <strong>Corbat-Coco</strong>
+    </div>
+  </div>
+  <script>
+    // Auto-close after 3 seconds
+    setTimeout(() => window.close(), 3000);
+  </script>
+</body>
+</html>
+`;
+    ERROR_HTML = (error) => {
+      const safeError = escapeHtml(error);
+      return `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Authentication Failed</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+      background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+    .container {
+      background: white;
+      border-radius: 16px;
+      padding: 48px;
+      text-align: center;
+      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25);
+      max-width: 400px;
+    }
+    .icon {
+      width: 80px;
+      height: 80px;
+      margin: 0 auto 24px;
+      background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
+      border-radius: 50%;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+    .icon svg {
+      width: 40px;
+      height: 40px;
+      stroke: white;
+      stroke-width: 3;
+      fill: none;
+    }
+    h1 {
+      font-size: 24px;
+      font-weight: 600;
+      color: #1f2937;
+      margin-bottom: 12px;
+    }
+    p {
+      color: #6b7280;
+      font-size: 16px;
+      line-height: 1.5;
+    }
+    .error {
+      margin-top: 16px;
+      padding: 12px;
+      background: #fef2f2;
+      border-radius: 8px;
+      color: #dc2626;
+      font-family: monospace;
+      font-size: 14px;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="icon">
+      <svg viewBox="0 0 24 24">
+        <path d="M18 6L6 18M6 6l12 12" stroke-linecap="round" stroke-linejoin="round"/>
+      </svg>
+    </div>
+    <h1>Authentication Failed</h1>
+    <p>Something went wrong. Please try again.</p>
+    <div class="error">${safeError}</div>
+  </div>
+</body>
+</html>
+`;
+    };
   }
-  const oauthProvider = getOAuthProviderName(provider);
-  const displayInfo = getProviderDisplayInfo(provider);
-  const apiKeysUrl = displayInfo.apiKeyUrl;
-  const keyPrefix = oauthProvider === "openai" ? "sk-" : oauthProvider === "gemini" ? "AI" : "";
-  const keyPrefixHint = keyPrefix ? ` (starts with '${keyPrefix}')` : "";
-  console.log();
-  console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-  console.log(
-    chalk2.magenta("   \u2502 ") + chalk2.bold.white(`\u{1F511} Get your ${displayInfo.name} API key:`.padEnd(47)) + chalk2.magenta("\u2502")
-  );
-  console.log(chalk2.magenta("   \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  console.log(
-    chalk2.magenta("   \u2502 ") + chalk2.dim("1. Sign in with your account") + chalk2.magenta("                   \u2502")
-  );
-  console.log(
-    chalk2.magenta("   \u2502 ") + chalk2.dim("2. Create a new API key") + chalk2.magenta("                        \u2502")
-  );
-  console.log(
-    chalk2.magenta("   \u2502 ") + chalk2.dim("3. Copy and paste it here") + chalk2.magenta("                      \u2502")
-  );
-  console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
-  console.log();
+});
+function detectWSL() {
+  if (process.env.WSL_DISTRO_NAME || process.env.WSLENV) return true;
   try {
-    const parsedUrl = new URL(apiKeysUrl);
-    parsedUrl.search = "";
-    console.log(chalk2.cyan(`   \u2192 ${parsedUrl.toString()}`));
+    return /microsoft/i.test(readFileSync("/proc/version", "utf-8"));
   } catch {
-    console.log(chalk2.cyan("   \u2192 [provider API keys page]"));
+    return false;
   }
-  console.log();
-  const openIt = await p26.confirm({
-    message: "Open browser to get API key?",
-    initialValue: true
+}
+var isWSL;
+var init_platform = __esm({
+  "src/utils/platform.ts"() {
+    isWSL = detectWSL();
+  }
+});
+async function requestGitHubDeviceCode() {
+  const response = await fetch(GITHUB_DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify({
+      client_id: COPILOT_CLIENT_ID,
+      scope: "read:user"
+    })
   });
-  if (p26.isCancel(openIt)) return null;
-  if (openIt) {
-    const opened = await openBrowser(apiKeysUrl);
-    if (opened) {
-      console.log(chalk2.green("   \u2713 Browser opened"));
-    } else {
-      const fallbackOpened = await openBrowserFallback(apiKeysUrl);
-      if (fallbackOpened) {
-        console.log(chalk2.green("   \u2713 Browser opened"));
-      } else {
-        console.log(chalk2.dim("   Copy the URL above and paste it in your browser"));
-      }
+  if (!response.ok) {
+    const error = await response.text();
+    throw new Error(`GitHub device code request failed: ${response.status} - ${error}`);
+  }
+  return await response.json();
+}
+async function pollGitHubForToken(deviceCode, interval, expiresIn, onPoll) {
+  const expiresAt = Date.now() + expiresIn * 1e3;
+  while (Date.now() < expiresAt) {
+    await new Promise((resolve4) => setTimeout(resolve4, interval * 1e3));
+    if (onPoll) onPoll();
+    const response = await fetch(GITHUB_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({
+        client_id: COPILOT_CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      })
+    });
+    const data = await response.json();
+    if (data.access_token) {
+      return data.access_token;
+    }
+    if (data.error === "authorization_pending") {
+      continue;
+    } else if (data.error === "slow_down") {
+      interval += 5;
+      continue;
+    } else if (data.error === "expired_token") {
+      throw new Error("Device code expired. Please try again.");
+    } else if (data.error === "access_denied") {
+      throw new Error("Access denied by user.");
+    } else if (data.error) {
+      throw new Error(data.error_description || data.error);
     }
   }
-  console.log();
-  const apiKey = await p26.password({
-    message: `Paste your ${displayInfo.name} API key${keyPrefixHint}:`,
-    validate: (value) => {
-      if (!value || value.length < 10) {
-        return "Please enter a valid API key";
-      }
-      if (keyPrefix && !value.startsWith(keyPrefix)) {
-        return `${displayInfo.name} API keys typically start with '${keyPrefix}'`;
-      }
-      return;
+  throw new Error("Authentication timed out. Please try again.");
+}
+async function exchangeForCopilotToken(githubToken) {
+  const response = await fetch(COPILOT_TOKEN_URL, {
+    method: "GET",
+    headers: {
+      Authorization: `token ${githubToken}`,
+      Accept: "application/json",
+      "User-Agent": "Corbat-Coco/1.0"
     }
   });
-  if (p26.isCancel(apiKey)) return null;
-  const tokens = {
-    accessToken: apiKey,
-    tokenType: "Bearer"
-  };
-  await saveTokens(oauthProvider, tokens);
-  console.log(chalk2.green("\n   \u2705 API key saved!\n"));
-  return { tokens, accessToken: apiKey };
-}
-async function runCopilotDeviceFlow() {
-  console.log();
-  console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-  console.log(
-    chalk2.magenta("   \u2502 ") + chalk2.bold.white("\u{1F419} GitHub Copilot Authentication".padEnd(47)) + chalk2.magenta("\u2502")
-  );
-  console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
-  console.log();
-  console.log(chalk2.dim("   Requires an active GitHub Copilot subscription."));
-  console.log(chalk2.dim("   https://github.com/settings/copilot"));
-  console.log();
-  try {
-    console.log(chalk2.dim("   Requesting device code from GitHub..."));
-    const deviceCode = await requestGitHubDeviceCode();
-    console.log();
-    console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-    console.log(
-      chalk2.magenta("   \u2502 ") + chalk2.bold.white("Enter this code in your browser:") + chalk2.magenta("               \u2502")
-    );
-    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
-    console.log(
-      chalk2.magenta("   \u2502       ") + chalk2.bold.cyan.bgBlack(` ${deviceCode.user_code} `) + chalk2.magenta("                            \u2502")
-    );
-    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
-    console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
-    console.log();
-    console.log(chalk2.cyan(`   \u2192 ${deviceCode.verification_uri}`));
-    console.log();
-    const openIt = await p26.confirm({
-      message: "Open browser to sign in?",
-      initialValue: true
-    });
-    if (p26.isCancel(openIt)) return null;
-    if (openIt) {
-      const opened = await openBrowser(deviceCode.verification_uri);
-      if (opened) {
-        console.log(chalk2.green("   \u2713 Browser opened"));
-      } else {
-        const fallbackOpened = await openBrowserFallback(deviceCode.verification_uri);
-        if (fallbackOpened) {
-          console.log(chalk2.green("   \u2713 Browser opened"));
-        } else {
-          console.log(chalk2.dim("   Copy the URL above and paste it in your browser"));
-        }
-      }
+  if (!response.ok) {
+    const error = await response.text();
+    if (response.status === 401) {
+      throw new CopilotAuthError(
+        "GitHub token is invalid or expired. Please re-authenticate with /provider copilot.",
+        true
+      );
     }
-    console.log();
-    const spinner18 = p26.spinner();
-    spinner18.start("Waiting for you to sign in on GitHub...");
-    let pollCount = 0;
-    const githubToken = await pollGitHubForToken(
-      deviceCode.device_code,
-      deviceCode.interval,
-      deviceCode.expires_in,
-      () => {
-        pollCount++;
-        const dots = ".".repeat(pollCount % 3 + 1);
-        spinner18.message(`Waiting for you to sign in on GitHub${dots}`);
-      }
-    );
-    spinner18.stop(chalk2.green("\u2713 GitHub authentication successful!"));
-    console.log(chalk2.dim("   Exchanging token for Copilot access..."));
-    const copilotToken = await exchangeForCopilotToken(githubToken);
-    const creds = {
-      githubToken,
-      copilotToken: copilotToken.token,
-      copilotTokenExpiresAt: copilotToken.expires_at * 1e3,
-      accountType: copilotToken.annotations?.copilot_plan
-    };
-    await saveCopilotCredentials(creds);
-    const planType = creds.accountType ?? "individual";
-    console.log(chalk2.green("\n   \u2705 GitHub Copilot authenticated!\n"));
-    console.log(chalk2.dim(`   Plan: ${planType}`));
-    console.log(chalk2.dim("   Credentials stored in ~/.coco/tokens/copilot.json\n"));
-    const tokens = {
-      accessToken: copilotToken.token,
-      tokenType: "Bearer",
-      expiresAt: copilotToken.expires_at * 1e3
-    };
-    return { tokens, accessToken: copilotToken.token };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    console.log();
-    if (errorMsg.includes("403") || errorMsg.includes("not enabled")) {
-      console.log(chalk2.red("   \u2717 GitHub Copilot is not enabled for this account."));
-      console.log(chalk2.dim("   Please ensure you have an active Copilot subscription:"));
-      console.log(chalk2.cyan("   \u2192 https://github.com/settings/copilot"));
-    } else if (errorMsg.includes("expired") || errorMsg.includes("timed out")) {
-      console.log(chalk2.yellow("   \u26A0 Authentication timed out. Please try again."));
-    } else if (errorMsg.includes("denied")) {
-      console.log(chalk2.yellow("   \u26A0 Access was denied."));
-    } else {
-      const category = errorMsg.includes("network") || errorMsg.includes("fetch") ? "Network error" : "Authentication error";
-      console.log(chalk2.red(`   \u2717 ${category}`));
+    if (response.status === 403) {
+      throw new CopilotAuthError(
+        "GitHub Copilot is not enabled for this account.\n   Please ensure you have an active Copilot subscription:\n   https://github.com/settings/copilot",
+        true
+      );
     }
-    console.log();
-    return null;
+    throw new Error(`Copilot token exchange failed: ${response.status} - ${error}`);
   }
+  return await response.json();
 }
-async function getOrRefreshOAuthToken(provider) {
-  if (provider === "copilot") {
-    const tokenResult = await getValidCopilotToken();
-    if (tokenResult) {
-      return { accessToken: tokenResult.token };
-    }
-    const flowResult2 = await runOAuthFlow(provider);
-    if (flowResult2) {
-      return { accessToken: flowResult2.accessToken };
-    }
-    return null;
-  }
-  const oauthProvider = getOAuthProviderName(provider);
-  const result = await getValidAccessToken(oauthProvider);
-  if (result) {
-    return { accessToken: result.accessToken };
-  }
-  const flowResult = await runOAuthFlow(provider);
-  if (flowResult) {
-    return { accessToken: flowResult.accessToken };
+function getCopilotBaseUrl(accountType) {
+  if (accountType && accountType in COPILOT_BASE_URLS) {
+    return COPILOT_BASE_URLS[accountType];
   }
-  return null;
+  return DEFAULT_COPILOT_BASE_URL;
 }
-var execFileAsync;
-var init_flow = __esm({
-  "src/auth/flow.ts"() {
-    init_oauth();
-    init_pkce();
-    init_callback_server();
-    init_platform();
-    init_copilot();
-    execFileAsync = promisify(execFile);
-  }
-});
-function getADCPath() {
+function getCopilotCredentialsPath() {
   const home = process.env.HOME || process.env.USERPROFILE || "";
-  if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
-    return process.env.GOOGLE_APPLICATION_CREDENTIALS;
-  }
-  return path36.join(home, ".config", "gcloud", "application_default_credentials.json");
+  return path36.join(home, ".coco", "tokens", "copilot.json");
 }
-async function isGcloudInstalled() {
+async function saveCopilotCredentials(creds) {
+  const filePath = getCopilotCredentialsPath();
+  const dir = path36.dirname(filePath);
+  await fs34.mkdir(dir, { recursive: true, mode: 448 });
+  await fs34.writeFile(filePath, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+async function loadCopilotCredentials() {
   try {
-    await execAsync("gcloud --version");
-    return true;
+    const content = await fs34.readFile(getCopilotCredentialsPath(), "utf-8");
+    const parsed = CopilotCredentialsSchema.safeParse(JSON.parse(content));
+    return parsed.success ? parsed.data : null;
   } catch {
-    return false;
+    return null;
   }
 }
-async function hasADCCredentials() {
-  const adcPath = getADCPath();
+async function deleteCopilotCredentials() {
   try {
-    await fs34.access(adcPath);
-    return true;
+    await fs34.unlink(getCopilotCredentialsPath());
   } catch {
-    return false;
   }
 }
-async function getADCAccessToken() {
+function isCopilotTokenExpired(creds) {
+  if (!creds.copilotToken || !creds.copilotTokenExpiresAt) return true;
+  return Date.now() >= creds.copilotTokenExpiresAt - REFRESH_BUFFER_MS;
+}
+async function getValidCopilotToken() {
+  const creds = await loadCopilotCredentials();
+  if (!creds) return null;
+  const envToken = process.env["GITHUB_TOKEN"] || process.env["GH_TOKEN"];
+  const githubToken = envToken || creds.githubToken;
+  if (!isCopilotTokenExpired(creds) && creds.copilotToken) {
+    return {
+      token: creds.copilotToken,
+      baseUrl: getCopilotBaseUrl(creds.accountType),
+      isNew: false
+    };
+  }
   try {
-    const { stdout } = await execAsync("gcloud auth application-default print-access-token", {
-      timeout: 1e4
-    });
-    const accessToken = stdout.trim();
-    if (!accessToken) return null;
-    const expiresAt = Date.now() + 55 * 60 * 1e3;
+    const copilotToken = await exchangeForCopilotToken(githubToken);
+    const updatedCreds = {
+      ...creds,
+      githubToken: creds.githubToken,
+      copilotToken: copilotToken.token,
+      copilotTokenExpiresAt: copilotToken.expires_at * 1e3,
+      accountType: copilotToken.annotations?.copilot_plan ?? creds.accountType
+    };
+    await saveCopilotCredentials(updatedCreds);
     return {
-      accessToken,
-      expiresAt
+      token: copilotToken.token,
+      baseUrl: getCopilotBaseUrl(updatedCreds.accountType),
+      isNew: true
     };
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes("not logged in") || message.includes("no application default credentials")) {
+    if (error instanceof CopilotAuthError && error.permanent) {
+      await deleteCopilotCredentials();
       return null;
     }
-    return null;
-  }
-}
-async function isADCConfigured() {
-  const hasCredentials = await hasADCCredentials();
-  if (!hasCredentials) return false;
-  const token = await getADCAccessToken();
-  return token !== null;
-}
-async function getCachedADCToken() {
-  if (cachedToken && cachedToken.expiresAt && Date.now() < cachedToken.expiresAt) {
-    return cachedToken;
+    throw error;
   }
-  cachedToken = await getADCAccessToken();
-  return cachedToken;
 }
-var execAsync, cachedToken;
-var init_gcloud = __esm({
-  "src/auth/gcloud.ts"() {
-    execAsync = promisify(exec);
-    cachedToken = null;
+var COPILOT_CLIENT_ID, GITHUB_DEVICE_CODE_URL, GITHUB_TOKEN_URL, COPILOT_TOKEN_URL, COPILOT_BASE_URLS, DEFAULT_COPILOT_BASE_URL, REFRESH_BUFFER_MS, CopilotAuthError, CopilotCredentialsSchema;
+var init_copilot = __esm({
+  "src/auth/copilot.ts"() {
+    COPILOT_CLIENT_ID = "Iv1.b507a08c87ecfe98";
+    GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+    GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+    COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+    COPILOT_BASE_URLS = {
+      individual: "https://api.githubcopilot.com",
+      business: "https://api.business.githubcopilot.com",
+      enterprise: "https://api.enterprise.githubcopilot.com"
+    };
+    DEFAULT_COPILOT_BASE_URL = "https://api.githubcopilot.com";
+    REFRESH_BUFFER_MS = 6e4;
+    CopilotAuthError = class extends Error {
+      constructor(message, permanent) {
+        super(message);
+        this.permanent = permanent;
+        this.name = "CopilotAuthError";
+      }
+    };
+    CopilotCredentialsSchema = z.object({
+      githubToken: z.string().min(1),
+      copilotToken: z.string().optional(),
+      copilotTokenExpiresAt: z.number().optional(),
+      accountType: z.string().optional()
+    });
   }
 });
-
-// src/auth/index.ts
-var init_auth = __esm({
-  "src/auth/index.ts"() {
-    init_oauth();
-    init_pkce();
-    init_callback_server();
-    init_flow();
-    init_copilot();
-    init_gcloud();
+function getOAuthProviderName(provider) {
+  if (provider === "codex") return "openai";
+  return provider;
+}
+function getProviderDisplayInfo(provider) {
+  const oauthProvider = getOAuthProviderName(provider);
+  switch (oauthProvider) {
+    case "openai":
+      return {
+        name: "OpenAI",
+        emoji: "\u{1F7E2}",
+        authDescription: "Sign in with your ChatGPT account",
+        apiKeyUrl: "https://platform.openai.com/api-keys"
+      };
+    case "copilot":
+      return {
+        name: "GitHub Copilot",
+        emoji: "\u{1F419}",
+        authDescription: "Sign in with your GitHub account",
+        apiKeyUrl: "https://github.com/settings/copilot"
+      };
+    default:
+      return {
+        name: provider,
+        emoji: "\u{1F510}",
+        authDescription: "Sign in with your account",
+        apiKeyUrl: ""
+      };
   }
-});
-
-// src/providers/codex.ts
-function parseJwtClaims(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3 || !parts[1]) return void 0;
+}
+function supportsOAuth(provider) {
+  if (provider === "copilot") return true;
+  const oauthProvider = getOAuthProviderName(provider);
+  return oauthProvider in OAUTH_CONFIGS;
+}
+async function isOAuthConfigured(provider) {
+  if (provider === "copilot") {
+    const creds = await loadCopilotCredentials();
+    return creds !== null;
+  }
+  const oauthProvider = getOAuthProviderName(provider);
+  const tokens = await loadTokens(oauthProvider);
+  return tokens !== null;
+}
+function printAuthUrl(url) {
   try {
-    return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    const parsed = new URL(url);
+    const maskedParams = new URLSearchParams(parsed.searchParams);
+    if (maskedParams.has("client_id")) {
+      const clientId = maskedParams.get("client_id");
+      maskedParams.set("client_id", clientId.slice(0, 8) + "...");
+    }
+    parsed.search = maskedParams.toString();
+    console.log(chalk2.cyan(`   ${parsed.toString()}`));
   } catch {
-    return void 0;
+    console.log(chalk2.cyan("   [invalid URL]"));
   }
 }
-function extractAccountId(accessToken) {
-  const claims = parseJwtClaims(accessToken);
-  if (!claims) return void 0;
-  const auth = claims["https://api.openai.com/auth"];
-  return claims["chatgpt_account_id"] || auth?.["chatgpt_account_id"] || claims["organizations"]?.[0]?.id;
+async function openBrowser(url) {
+  let sanitizedUrl;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      return false;
+    }
+    sanitizedUrl = parsed.toString();
+  } catch {
+    return false;
+  }
+  const platform = process.platform;
+  try {
+    if (platform === "darwin") {
+      await execFileAsync("open", [sanitizedUrl]);
+    } else if (platform === "win32") {
+      await execFileAsync("rundll32", ["url.dll,FileProtocolHandler", sanitizedUrl]);
+    } else if (isWSL) {
+      await execFileAsync("cmd.exe", ["/c", "start", "", sanitizedUrl]);
+    } else {
+      await execFileAsync("xdg-open", [sanitizedUrl]);
+    }
+    return true;
+  } catch {
+    return false;
+  }
 }
-function createCodexProvider(config) {
-  const provider = new CodexProvider();
-  if (config) {
-    provider.initialize(config).catch(() => {
+async function openBrowserFallback(url) {
+  let sanitizedUrl;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      return false;
+    }
+    sanitizedUrl = parsed.toString();
+  } catch {
+    return false;
+  }
+  const platform = process.platform;
+  const commands2 = [];
+  if (platform === "darwin") {
+    commands2.push(
+      { cmd: "open", args: [sanitizedUrl] },
+      { cmd: "open", args: ["-a", "Safari", sanitizedUrl] },
+      { cmd: "open", args: ["-a", "Google Chrome", sanitizedUrl] }
+    );
+  } else if (platform === "win32") {
+    commands2.push({
+      cmd: "rundll32",
+      args: ["url.dll,FileProtocolHandler", sanitizedUrl]
     });
+  } else if (isWSL) {
+    commands2.push(
+      { cmd: "cmd.exe", args: ["/c", "start", "", sanitizedUrl] },
+      { cmd: "powershell.exe", args: ["-Command", `Start-Process '${sanitizedUrl}'`] },
+      { cmd: "wslview", args: [sanitizedUrl] }
+    );
+  } else {
+    commands2.push(
+      { cmd: "xdg-open", args: [sanitizedUrl] },
+      { cmd: "sensible-browser", args: [sanitizedUrl] },
+      { cmd: "x-www-browser", args: [sanitizedUrl] },
+      { cmd: "gnome-open", args: [sanitizedUrl] },
+      { cmd: "firefox", args: [sanitizedUrl] },
+      { cmd: "chromium-browser", args: [sanitizedUrl] },
+      { cmd: "google-chrome", args: [sanitizedUrl] }
+    );
   }
-  return provider;
+  for (const { cmd, args } of commands2) {
+    try {
+      await execFileAsync(cmd, args);
+      return true;
+    } catch {
+      continue;
+    }
+  }
+  return false;
 }
-var CODEX_API_ENDPOINT, DEFAULT_MODEL3, CONTEXT_WINDOWS3, CodexProvider;
-var init_codex = __esm({
-  "src/providers/codex.ts"() {
-    init_errors();
-    init_auth();
-    CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
-    DEFAULT_MODEL3 = "gpt-5.3-codex";
-    CONTEXT_WINDOWS3 = {
-      "gpt-5.3-codex": 2e5,
-      "gpt-5.2-codex": 2e5,
-      "gpt-5-codex": 2e5,
-      "gpt-5.1-codex": 2e5,
-      "gpt-5": 2e5,
-      "gpt-5.2": 2e5,
-      "gpt-5.1": 2e5
-    };
-    CodexProvider = class {
-      id = "codex";
-      name = "OpenAI Codex (ChatGPT Plus/Pro)";
-      config = {};
-      accessToken = null;
-      accountId;
-      /**
-       * Initialize the provider with OAuth tokens
-       */
-      async initialize(config) {
-        this.config = config;
-        const tokenResult = await getValidAccessToken("openai");
-        if (tokenResult) {
-          this.accessToken = tokenResult.accessToken;
-          this.accountId = extractAccountId(tokenResult.accessToken);
-        } else if (config.apiKey) {
-          this.accessToken = config.apiKey;
-          this.accountId = extractAccountId(config.apiKey);
-        }
-        if (!this.accessToken) {
-          throw new ProviderError(
-            "No OAuth token found. Please run authentication first with: coco --provider openai",
-            { provider: this.id }
-          );
-        }
-      }
-      /**
-       * Ensure provider is initialized
-       */
-      ensureInitialized() {
-        if (!this.accessToken) {
-          throw new ProviderError("Provider not initialized", {
-            provider: this.id
-          });
-        }
+async function runOAuthFlow(provider) {
+  if (provider === "copilot") {
+    return runCopilotDeviceFlow();
+  }
+  const oauthProvider = getOAuthProviderName(provider);
+  const config = OAUTH_CONFIGS[oauthProvider];
+  if (!config) {
+    p26.log.error(`OAuth not supported for provider: ${provider}`);
+    return null;
+  }
+  const displayInfo = getProviderDisplayInfo(provider);
+  console.log();
+  console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+  console.log(
+    chalk2.magenta("   \u2502 ") + chalk2.bold.white(`${displayInfo.emoji} ${displayInfo.name} Authentication`.padEnd(47)) + chalk2.magenta("\u2502")
+  );
+  console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+  console.log();
+  const authOptions = [
+    {
+      value: "browser",
+      label: "\u{1F310} Sign in with browser",
+      hint: `${displayInfo.authDescription} (recommended)`
+    },
+    {
+      value: "api_key",
+      label: "\u{1F4CB} Paste API key manually",
+      hint: `Get from ${displayInfo.apiKeyUrl}`
+    }
+  ];
+  const authMethod = await p26.select({
+    message: "Choose authentication method:",
+    options: authOptions
+  });
+  if (p26.isCancel(authMethod)) return null;
+  if (authMethod === "browser") {
+    return runBrowserOAuthFlow(provider);
+  } else {
+    return runApiKeyFlow(provider);
+  }
+}
+async function isPortAvailable(port) {
+  const net = await import('net');
+  return new Promise((resolve4) => {
+    const server = net.createServer();
+    server.once("error", (err) => {
+      if (err.code === "EADDRINUSE") {
+        resolve4({ available: false, processName: "another process" });
+      } else {
+        resolve4({ available: false });
       }
-      /**
-       * Get context window size for a model
-       */
-      getContextWindow(model) {
-        const m = model ?? this.config.model ?? DEFAULT_MODEL3;
-        return CONTEXT_WINDOWS3[m] ?? 128e3;
-      }
-      /**
-       * Count tokens in text (approximate)
-       * Uses GPT-4 approximation: ~4 chars per token
-       */
-      countTokens(text13) {
-        return Math.ceil(text13.length / 4);
-      }
-      /**
-       * Check if provider is available (has valid OAuth tokens)
-       */
-      async isAvailable() {
-        try {
-          const tokenResult = await getValidAccessToken("openai");
-          return tokenResult !== null;
-        } catch {
-          return false;
-        }
-      }
-      /**
-       * Make a request to the Codex API
-       */
-      async makeRequest(body) {
-        this.ensureInitialized();
-        const headers = {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${this.accessToken}`
-        };
-        if (this.accountId) {
-          headers["ChatGPT-Account-Id"] = this.accountId;
+    });
+    server.once("listening", () => {
+      server.close();
+      resolve4({ available: true });
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+function getRequiredPort(provider) {
+  const oauthProvider = getOAuthProviderName(provider);
+  if (oauthProvider === "openai") return 1455;
+  return void 0;
+}
+async function runBrowserOAuthFlow(provider) {
+  const oauthProvider = getOAuthProviderName(provider);
+  const displayInfo = getProviderDisplayInfo(provider);
+  const config = OAUTH_CONFIGS[oauthProvider];
+  const requiredPort = getRequiredPort(provider);
+  if (requiredPort) {
+    console.log();
+    console.log(chalk2.dim("   Checking port availability..."));
+    const portCheck = await isPortAvailable(requiredPort);
+    if (!portCheck.available) {
+      console.log();
+      console.log(chalk2.yellow(`   \u26A0 Port ${requiredPort} is already in use`));
+      console.log();
+      console.log(
+        chalk2.dim(
+          `   ${displayInfo.name} OAuth requires port ${requiredPort}, which is currently occupied.`
+        )
+      );
+      console.log(chalk2.dim("   This usually means OpenCode or another coding tool is running."));
+      console.log();
+      console.log(chalk2.cyan("   To fix this:"));
+      console.log(chalk2.dim("   1. Close OpenCode/Codex CLI (if running)"));
+      console.log(
+        chalk2.dim("   2. Or use an API key instead (recommended if using multiple tools)")
+      );
+      console.log();
+      const fallbackOptions = [
+        {
+          value: "api_key",
+          label: "\u{1F4CB} Use API key instead",
+          hint: `Get from ${displayInfo.apiKeyUrl}`
+        },
+        {
+          value: "retry",
+          label: "\u{1F504} Retry (after closing other tools)",
+          hint: "Check port again"
         }
-        const response = await fetch(CODEX_API_ENDPOINT, {
-          method: "POST",
-          headers,
-          body: JSON.stringify(body)
+      ];
+      if (config?.deviceAuthEndpoint) {
+        fallbackOptions.push({
+          value: "device_code",
+          label: "\u{1F511} Try device code flow",
+          hint: "May be blocked by Cloudflare"
         });
-        if (!response.ok) {
-          const errorText = await response.text();
-          throw new ProviderError(`Codex API error: ${response.status} - ${errorText}`, {
-            provider: this.id,
-            statusCode: response.status
-          });
-        }
-        return response;
       }
-      /**
-       * Extract text content from a message
-       */
-      extractTextContent(msg) {
-        if (typeof msg.content === "string") {
-          return msg.content;
+      fallbackOptions.push({
+        value: "cancel",
+        label: "\u274C Cancel",
+        hint: ""
+      });
+      const fallback = await p26.select({
+        message: "What would you like to do?",
+        options: fallbackOptions
+      });
+      if (p26.isCancel(fallback) || fallback === "cancel") return null;
+      if (fallback === "api_key") {
+        return runApiKeyFlow(provider);
+      } else if (fallback === "device_code") {
+        return runDeviceCodeFlow(provider);
+      } else if (fallback === "retry") {
+        return runBrowserOAuthFlow(provider);
+      }
+      return null;
+    }
+  }
+  console.log(chalk2.dim("   Starting authentication server..."));
+  try {
+    const pkce = generatePKCECredentials();
+    const { port, resultPromise } = await createCallbackServer(pkce.state);
+    const redirectUri = `http://localhost:${port}/auth/callback`;
+    const authUrl = buildAuthorizationUrl(
+      oauthProvider,
+      redirectUri,
+      pkce.codeChallenge,
+      pkce.state
+    );
+    console.log(chalk2.green(`   \u2713 Server ready on port ${port}`));
+    console.log();
+    console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+    console.log(
+      chalk2.magenta("   \u2502 ") + chalk2.bold.white(`${displayInfo.authDescription}`.padEnd(47)) + chalk2.magenta("\u2502")
+    );
+    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
+    console.log(
+      chalk2.magenta("   \u2502 ") + chalk2.dim("A browser window will open for you to sign in.") + chalk2.magenta("  \u2502")
+    );
+    console.log(
+      chalk2.magenta("   \u2502 ") + chalk2.dim("After signing in, you'll be redirected back.") + chalk2.magenta("    \u2502")
+    );
+    console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+    console.log();
+    const openIt = await p26.confirm({
+      message: "Open browser to sign in?",
+      initialValue: true
+    });
+    if (p26.isCancel(openIt)) return null;
+    if (openIt) {
+      const opened = await openBrowser(authUrl);
+      if (opened) {
+        console.log(chalk2.green("   \u2713 Browser opened"));
+      } else {
+        const fallbackOpened = await openBrowserFallback(authUrl);
+        if (fallbackOpened) {
+          console.log(chalk2.green("   \u2713 Browser opened"));
+        } else {
+          console.log(chalk2.dim("   Could not open browser automatically."));
+          console.log(chalk2.dim("   Please open this URL manually:"));
+          console.log();
+          printAuthUrl(authUrl);
+          console.log();
         }
-        if (Array.isArray(msg.content)) {
-          return msg.content.map((part) => {
-            if (part.type === "text") return part.text;
-            if (part.type === "tool_result") return `Tool result: ${JSON.stringify(part.content)}`;
-            return "";
-          }).join("\n");
+      }
+    } else {
+      console.log(chalk2.dim("   Please open this URL in your browser:"));
+      console.log();
+      printAuthUrl(authUrl);
+      console.log();
+    }
+    const spinner18 = p26.spinner();
+    spinner18.start("Waiting for you to sign in...");
+    const callbackResult = await resultPromise;
+    spinner18.stop(chalk2.green("\u2713 Authentication received!"));
+    console.log(chalk2.dim("   Exchanging code for tokens..."));
+    const tokens = await exchangeCodeForTokens(
+      oauthProvider,
+      callbackResult.code,
+      pkce.codeVerifier,
+      redirectUri
+    );
+    await saveTokens(oauthProvider, tokens);
+    console.log(chalk2.green("\n   \u2705 Authentication complete!\n"));
+    if (oauthProvider === "openai") {
+      console.log(chalk2.dim("   Your ChatGPT Plus/Pro subscription is now linked."));
+    }
+    console.log(chalk2.dim("   Tokens are securely stored in ~/.coco/tokens/\n"));
+    return { tokens, accessToken: tokens.accessToken };
+  } catch (error) {
+    const errorMsg = error instanceof Error ? error.message : String(error);
+    console.log();
+    console.log(chalk2.yellow("   \u26A0 Browser authentication failed"));
+    const errorCategory = errorMsg.includes("timeout") || errorMsg.includes("Timeout") ? "Request timed out" : errorMsg.includes("network") || errorMsg.includes("ECONNREFUSED") || errorMsg.includes("fetch") ? "Network error" : errorMsg.includes("401") || errorMsg.includes("403") ? "Authorization denied" : errorMsg.includes("invalid_grant") || errorMsg.includes("invalid_client") ? "Invalid credentials" : "Authentication error (see debug logs for details)";
+    console.log(chalk2.dim(`   Error: ${errorCategory}`));
+    console.log();
+    const fallbackOptions = [];
+    if (config?.deviceAuthEndpoint) {
+      fallbackOptions.push({
+        value: "device_code",
+        label: "\u{1F511} Try device code flow",
+        hint: "Enter code manually in browser"
+      });
+    }
+    fallbackOptions.push({
+      value: "api_key",
+      label: "\u{1F4CB} Use API key instead",
+      hint: `Get from ${displayInfo.apiKeyUrl}`
+    });
+    fallbackOptions.push({
+      value: "cancel",
+      label: "\u274C Cancel",
+      hint: ""
+    });
+    const fallback = await p26.select({
+      message: "What would you like to do?",
+      options: fallbackOptions
+    });
+    if (p26.isCancel(fallback) || fallback === "cancel") return null;
+    if (fallback === "device_code") {
+      return runDeviceCodeFlow(provider);
+    } else {
+      return runApiKeyFlow(provider);
+    }
+  }
+}
+async function runDeviceCodeFlow(provider) {
+  const oauthProvider = getOAuthProviderName(provider);
+  const displayInfo = getProviderDisplayInfo(provider);
+  console.log();
+  console.log(chalk2.dim(`   Requesting device code from ${displayInfo.name}...`));
+  try {
+    const deviceCode = await requestDeviceCode(oauthProvider);
+    console.log();
+    console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+    console.log(
+      chalk2.magenta("   \u2502 ") + chalk2.bold.white("Enter this code in your browser:") + chalk2.magenta("               \u2502")
+    );
+    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
+    console.log(
+      chalk2.magenta("   \u2502       ") + chalk2.bold.cyan.bgBlack(` ${deviceCode.userCode} `) + chalk2.magenta("                            \u2502")
+    );
+    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
+    console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+    console.log();
+    const verificationUrl = deviceCode.verificationUriComplete || deviceCode.verificationUri;
+    console.log(chalk2.cyan(`   \u2192 ${verificationUrl}`));
+    console.log();
+    const openIt = await p26.confirm({
+      message: "Open browser to sign in?",
+      initialValue: true
+    });
+    if (p26.isCancel(openIt)) return null;
+    if (openIt) {
+      const opened = await openBrowser(verificationUrl);
+      if (opened) {
+        console.log(chalk2.green("   \u2713 Browser opened"));
+      } else {
+        const fallbackOpened = await openBrowserFallback(verificationUrl);
+        if (fallbackOpened) {
+          console.log(chalk2.green("   \u2713 Browser opened"));
+        } else {
+          console.log(chalk2.dim("   Copy the URL above and paste it in your browser"));
         }
-        return "";
       }
-      /**
-       * Convert messages to Codex Responses API format
-       * Codex uses a different format than Chat Completions:
-       * {
-       *   "input": [
-       *     { "type": "message", "role": "developer|user", "content": [{ "type": "input_text", "text": "..." }] },
-       *     { "type": "message", "role": "assistant", "content": [{ "type": "output_text", "text": "..." }] }
-       *   ]
-       * }
-       *
-       * IMPORTANT: User/developer messages use "input_text", assistant messages use "output_text"
-       */
-      convertMessagesToResponsesFormat(messages) {
-        return messages.map((msg) => {
-          const text13 = this.extractTextContent(msg);
-          const role = msg.role === "system" ? "developer" : msg.role;
-          const contentType = msg.role === "assistant" ? "output_text" : "input_text";
-          return {
-            type: "message",
-            role,
-            content: [{ type: contentType, text: text13 }]
-          };
-        });
+    }
+    console.log();
+    const spinner18 = p26.spinner();
+    spinner18.start("Waiting for you to sign in...");
+    let pollCount = 0;
+    const tokens = await pollForToken(
+      oauthProvider,
+      deviceCode.deviceCode,
+      deviceCode.interval,
+      deviceCode.expiresIn,
+      () => {
+        pollCount++;
+        const dots = ".".repeat(pollCount % 3 + 1);
+        spinner18.message(`Waiting for you to sign in${dots}`);
       }
-      /**
-       * Send a chat message using Codex Responses API format
-       */
-      async chat(messages, options) {
-        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL3;
-        const systemMsg = messages.find((m) => m.role === "system");
-        const instructions = systemMsg ? this.extractTextContent(systemMsg) : "You are a helpful coding assistant.";
-        const inputMessages = messages.filter((m) => m.role !== "system").map((msg) => this.convertMessagesToResponsesFormat([msg])[0]);
-        const body = {
-          model,
-          instructions,
-          input: inputMessages,
-          tools: [],
-          store: false,
-          stream: true
-          // Codex API requires streaming
-        };
-        const response = await this.makeRequest(body);
-        if (!response.body) {
-          throw new ProviderError("No response body from Codex API", {
-            provider: this.id
-          });
-        }
-        const reader = response.body.getReader();
-        const decoder = new TextDecoder();
-        let buffer = "";
-        let content = "";
-        let responseId = `codex-${Date.now()}`;
-        let inputTokens = 0;
-        let outputTokens = 0;
-        let status = "completed";
-        try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split("\n");
-            buffer = lines.pop() ?? "";
-            for (const line of lines) {
-              if (line.startsWith("data: ")) {
-                const data = line.slice(6).trim();
-                if (!data || data === "[DONE]") continue;
-                try {
-                  const parsed = JSON.parse(data);
-                  if (parsed.id) {
-                    responseId = parsed.id;
-                  }
-                  if (parsed.type === "response.output_text.delta" && parsed.delta) {
-                    content += parsed.delta;
-                  } else if (parsed.type === "response.completed" && parsed.response) {
-                    if (parsed.response.usage) {
-                      inputTokens = parsed.response.usage.input_tokens ?? 0;
-                      outputTokens = parsed.response.usage.output_tokens ?? 0;
-                    }
-                    status = parsed.response.status ?? "completed";
-                  } else if (parsed.type === "response.output_text.done" && parsed.text) {
-                    content = parsed.text;
-                  }
-                } catch {
-                }
-              }
-            }
-          }
-        } finally {
-          reader.releaseLock();
-        }
-        if (!content) {
-          throw new ProviderError("No response content from Codex API", {
-            provider: this.id
-          });
-        }
-        const stopReason = status === "completed" ? "end_turn" : status === "incomplete" ? "max_tokens" : "end_turn";
-        return {
-          id: responseId,
-          content,
-          stopReason,
-          model,
-          usage: {
-            inputTokens,
-            outputTokens
-          }
-        };
+    );
+    spinner18.stop(chalk2.green("\u2713 Signed in successfully!"));
+    await saveTokens(oauthProvider, tokens);
+    console.log(chalk2.green("\n   \u2705 Authentication complete!\n"));
+    if (oauthProvider === "openai") {
+      console.log(chalk2.dim("   Your ChatGPT Plus/Pro subscription is now linked."));
+    } else {
+      console.log(chalk2.dim(`   Your ${displayInfo.name} account is now linked.`));
+    }
+    console.log(chalk2.dim("   Tokens are securely stored in ~/.coco/tokens/\n"));
+    return { tokens, accessToken: tokens.accessToken };
+  } catch (error) {
+    const errorMsg = error instanceof Error ? error.message : String(error);
+    if (errorMsg.includes("Cloudflare") || errorMsg.includes("blocked") || errorMsg.includes("HTML instead of JSON") || errorMsg.includes("not supported")) {
+      console.log();
+      console.log(chalk2.yellow("   \u26A0 Device code flow unavailable"));
+      console.log(chalk2.dim("   This can happen due to network restrictions."));
+      console.log();
+      const useFallback = await p26.confirm({
+        message: "Use API key instead?",
+        initialValue: true
+      });
+      if (p26.isCancel(useFallback) || !useFallback) return null;
+      return runApiKeyFlow(provider);
+    }
+    const deviceErrorCategory = errorMsg.includes("timeout") || errorMsg.includes("expired") ? "Device code expired" : errorMsg.includes("denied") || errorMsg.includes("access_denied") ? "Access denied by user" : "Unexpected error during device code authentication";
+    p26.log.error(chalk2.red(`   Authentication failed: ${deviceErrorCategory}`));
+    return null;
+  }
+}
+async function runApiKeyFlow(provider) {
+  if (provider === "copilot") {
+    throw new Error("runApiKeyFlow called with copilot \u2014 use runCopilotDeviceFlow() instead");
+  }
+  const oauthProvider = getOAuthProviderName(provider);
+  const displayInfo = getProviderDisplayInfo(provider);
+  const apiKeysUrl = displayInfo.apiKeyUrl;
+  const keyPrefix = oauthProvider === "openai" ? "sk-" : oauthProvider === "gemini" ? "AI" : "";
+  const keyPrefixHint = keyPrefix ? ` (starts with '${keyPrefix}')` : "";
+  console.log();
+  console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+  console.log(
+    chalk2.magenta("   \u2502 ") + chalk2.bold.white(`\u{1F511} Get your ${displayInfo.name} API key:`.padEnd(47)) + chalk2.magenta("\u2502")
+  );
+  console.log(chalk2.magenta("   \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  console.log(
+    chalk2.magenta("   \u2502 ") + chalk2.dim("1. Sign in with your account") + chalk2.magenta("                   \u2502")
+  );
+  console.log(
+    chalk2.magenta("   \u2502 ") + chalk2.dim("2. Create a new API key") + chalk2.magenta("                        \u2502")
+  );
+  console.log(
+    chalk2.magenta("   \u2502 ") + chalk2.dim("3. Copy and paste it here") + chalk2.magenta("                      \u2502")
+  );
+  console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+  console.log();
+  try {
+    const parsedUrl = new URL(apiKeysUrl);
+    parsedUrl.search = "";
+    console.log(chalk2.cyan(`   \u2192 ${parsedUrl.toString()}`));
+  } catch {
+    console.log(chalk2.cyan("   \u2192 [provider API keys page]"));
+  }
+  console.log();
+  const openIt = await p26.confirm({
+    message: "Open browser to get API key?",
+    initialValue: true
+  });
+  if (p26.isCancel(openIt)) return null;
+  if (openIt) {
+    const opened = await openBrowser(apiKeysUrl);
+    if (opened) {
+      console.log(chalk2.green("   \u2713 Browser opened"));
+    } else {
+      const fallbackOpened = await openBrowserFallback(apiKeysUrl);
+      if (fallbackOpened) {
+        console.log(chalk2.green("   \u2713 Browser opened"));
+      } else {
+        console.log(chalk2.dim("   Copy the URL above and paste it in your browser"));
       }
-      /**
-       * Send a chat message with tool use
-       * Note: Codex Responses API tool support is complex; for now we delegate to chat()
-       * and return empty toolCalls. Full tool support can be added later.
-       */
-      async chatWithTools(messages, options) {
-        const response = await this.chat(messages, options);
-        return {
-          ...response,
-          toolCalls: []
-          // Tools not yet supported in Codex provider
-        };
+    }
+  }
+  console.log();
+  const apiKey = await p26.password({
+    message: `Paste your ${displayInfo.name} API key${keyPrefixHint}:`,
+    validate: (value) => {
+      if (!value || value.length < 10) {
+        return "Please enter a valid API key";
       }
-      /**
-       * Stream a chat response
-       * Note: True streaming with Codex Responses API is complex.
-       * For now, we make a non-streaming call and simulate streaming by emitting chunks.
-       */
-      async *stream(messages, options) {
-        const response = await this.chat(messages, options);
-        if (response.content) {
-          const content = response.content;
-          const chunkSize = 20;
-          for (let i = 0; i < content.length; i += chunkSize) {
-            const chunk = content.slice(i, i + chunkSize);
-            yield { type: "text", text: chunk };
-            if (i + chunkSize < content.length) {
-              await new Promise((resolve4) => setTimeout(resolve4, 5));
-            }
-          }
+      if (keyPrefix && !value.startsWith(keyPrefix)) {
+        return `${displayInfo.name} API keys typically start with '${keyPrefix}'`;
+      }
+      return;
+    }
+  });
+  if (p26.isCancel(apiKey)) return null;
+  const tokens = {
+    accessToken: apiKey,
+    tokenType: "Bearer"
+  };
+  await saveTokens(oauthProvider, tokens);
+  console.log(chalk2.green("\n   \u2705 API key saved!\n"));
+  return { tokens, accessToken: apiKey };
+}
+async function runCopilotDeviceFlow() {
+  console.log();
+  console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+  console.log(
+    chalk2.magenta("   \u2502 ") + chalk2.bold.white("\u{1F419} GitHub Copilot Authentication".padEnd(47)) + chalk2.magenta("\u2502")
+  );
+  console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+  console.log();
+  console.log(chalk2.dim("   Requires an active GitHub Copilot subscription."));
+  console.log(chalk2.dim("   https://github.com/settings/copilot"));
+  console.log();
+  try {
+    console.log(chalk2.dim("   Requesting device code from GitHub..."));
+    const deviceCode = await requestGitHubDeviceCode();
+    console.log();
+    console.log(chalk2.magenta("   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+    console.log(
+      chalk2.magenta("   \u2502 ") + chalk2.bold.white("Enter this code in your browser:") + chalk2.magenta("               \u2502")
+    );
+    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
+    console.log(
+      chalk2.magenta("   \u2502       ") + chalk2.bold.cyan.bgBlack(` ${deviceCode.user_code} `) + chalk2.magenta("                            \u2502")
+    );
+    console.log(chalk2.magenta("   \u2502                                                 \u2502"));
+    console.log(chalk2.magenta("   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+    console.log();
+    console.log(chalk2.cyan(`   \u2192 ${deviceCode.verification_uri}`));
+    console.log();
+    const openIt = await p26.confirm({
+      message: "Open browser to sign in?",
+      initialValue: true
+    });
+    if (p26.isCancel(openIt)) return null;
+    if (openIt) {
+      const opened = await openBrowser(deviceCode.verification_uri);
+      if (opened) {
+        console.log(chalk2.green("   \u2713 Browser opened"));
+      } else {
+        const fallbackOpened = await openBrowserFallback(deviceCode.verification_uri);
+        if (fallbackOpened) {
+          console.log(chalk2.green("   \u2713 Browser opened"));
+        } else {
+          console.log(chalk2.dim("   Copy the URL above and paste it in your browser"));
         }
-        yield { type: "done", stopReason: response.stopReason };
       }
-      /**
-       * Stream a chat response with tool use
-       * Note: Tools and true streaming with Codex Responses API are not yet implemented.
-       * For now, we delegate to stream() which uses non-streaming under the hood.
-       */
-      async *streamWithTools(messages, options) {
-        yield* this.stream(messages, options);
+    }
+    console.log();
+    const spinner18 = p26.spinner();
+    spinner18.start("Waiting for you to sign in on GitHub...");
+    let pollCount = 0;
+    const githubToken = await pollGitHubForToken(
+      deviceCode.device_code,
+      deviceCode.interval,
+      deviceCode.expires_in,
+      () => {
+        pollCount++;
+        const dots = ".".repeat(pollCount % 3 + 1);
+        spinner18.message(`Waiting for you to sign in on GitHub${dots}`);
       }
+    );
+    spinner18.stop(chalk2.green("\u2713 GitHub authentication successful!"));
+    console.log(chalk2.dim("   Exchanging token for Copilot access..."));
+    const copilotToken = await exchangeForCopilotToken(githubToken);
+    const creds = {
+      githubToken,
+      copilotToken: copilotToken.token,
+      copilotTokenExpiresAt: copilotToken.expires_at * 1e3,
+      accountType: copilotToken.annotations?.copilot_plan
+    };
+    await saveCopilotCredentials(creds);
+    const planType = creds.accountType ?? "individual";
+    console.log(chalk2.green("\n   \u2705 GitHub Copilot authenticated!\n"));
+    console.log(chalk2.dim(`   Plan: ${planType}`));
+    console.log(chalk2.dim("   Credentials stored in ~/.coco/tokens/copilot.json\n"));
+    const tokens = {
+      accessToken: copilotToken.token,
+      tokenType: "Bearer",
+      expiresAt: copilotToken.expires_at * 1e3
+    };
+    return { tokens, accessToken: copilotToken.token };
+  } catch (error) {
+    const errorMsg = error instanceof Error ? error.message : String(error);
+    console.log();
+    if (errorMsg.includes("403") || errorMsg.includes("not enabled")) {
+      console.log(chalk2.red("   \u2717 GitHub Copilot is not enabled for this account."));
+      console.log(chalk2.dim("   Please ensure you have an active Copilot subscription:"));
+      console.log(chalk2.cyan("   \u2192 https://github.com/settings/copilot"));
+    } else if (errorMsg.includes("expired") || errorMsg.includes("timed out")) {
+      console.log(chalk2.yellow("   \u26A0 Authentication timed out. Please try again."));
+    } else if (errorMsg.includes("denied")) {
+      console.log(chalk2.yellow("   \u26A0 Access was denied."));
+    } else {
+      const category = errorMsg.includes("network") || errorMsg.includes("fetch") ? "Network error" : "Authentication error";
+      console.log(chalk2.red(`   \u2717 ${category}`));
+    }
+    console.log();
+    return null;
+  }
+}
+async function getOrRefreshOAuthToken(provider) {
+  if (provider === "copilot") {
+    const tokenResult = await getValidCopilotToken();
+    if (tokenResult) {
+      return { accessToken: tokenResult.token };
+    }
+    const flowResult2 = await runOAuthFlow(provider);
+    if (flowResult2) {
+      return { accessToken: flowResult2.accessToken };
+    }
+    return null;
+  }
+  const oauthProvider = getOAuthProviderName(provider);
+  const result = await getValidAccessToken(oauthProvider);
+  if (result) {
+    return { accessToken: result.accessToken };
+  }
+  const flowResult = await runOAuthFlow(provider);
+  if (flowResult) {
+    return { accessToken: flowResult.accessToken };
+  }
+  return null;
+}
+var execFileAsync;
+var init_flow = __esm({
+  "src/auth/flow.ts"() {
+    init_oauth();
+    init_pkce();
+    init_callback_server();
+    init_platform();
+    init_copilot();
+    execFileAsync = promisify(execFile);
+  }
+});
+function getADCPath() {
+  const home = process.env.HOME || process.env.USERPROFILE || "";
+  if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {
+    return process.env.GOOGLE_APPLICATION_CREDENTIALS;
+  }
+  return path36.join(home, ".config", "gcloud", "application_default_credentials.json");
+}
+async function isGcloudInstalled() {
+  try {
+    await execAsync("gcloud --version");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function hasADCCredentials() {
+  const adcPath = getADCPath();
+  try {
+    await fs34.access(adcPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getADCAccessToken() {
+  try {
+    const { stdout } = await execAsync("gcloud auth application-default print-access-token", {
+      timeout: 1e4
+    });
+    const accessToken = stdout.trim();
+    if (!accessToken) return null;
+    const expiresAt = Date.now() + 55 * 60 * 1e3;
+    return {
+      accessToken,
+      expiresAt
     };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("not logged in") || message.includes("no application default credentials")) {
+      return null;
+    }
+    return null;
+  }
+}
+async function isADCConfigured() {
+  const hasCredentials = await hasADCCredentials();
+  if (!hasCredentials) return false;
+  const token = await getADCAccessToken();
+  return token !== null;
+}
+async function getCachedADCToken() {
+  if (cachedToken && cachedToken.expiresAt && Date.now() < cachedToken.expiresAt) {
+    return cachedToken;
+  }
+  cachedToken = await getADCAccessToken();
+  return cachedToken;
+}
+var execAsync, cachedToken;
+var init_gcloud = __esm({
+  "src/auth/gcloud.ts"() {
+    execAsync = promisify(exec);
+    cachedToken = null;
   }
 });
-function needsResponsesApi(model) {
-  return model.includes("codex") || model.startsWith("gpt-5") || model.startsWith("o4-") || model.startsWith("o3-");
+
+// src/auth/index.ts
+var init_auth = __esm({
+  "src/auth/index.ts"() {
+    init_oauth();
+    init_pkce();
+    init_callback_server();
+    init_flow();
+    init_copilot();
+    init_gcloud();
+  }
+});
+
+// src/providers/codex.ts
+function parseJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) return void 0;
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+  } catch {
+    return void 0;
+  }
 }
-function createCopilotProvider() {
-  return new CopilotProvider();
+function extractAccountId(accessToken) {
+  const claims = parseJwtClaims(accessToken);
+  if (!claims) return void 0;
+  const auth = claims["https://api.openai.com/auth"];
+  return claims["chatgpt_account_id"] || auth?.["chatgpt_account_id"] || claims["organizations"]?.[0]?.id;
 }
-var CONTEXT_WINDOWS4, DEFAULT_MODEL4, COPILOT_HEADERS, CopilotProvider;
-var init_copilot2 = __esm({
-  "src/providers/copilot.ts"() {
+function createCodexProvider(config) {
+  const provider = new CodexProvider();
+  if (config) {
+    provider.initialize(config).catch(() => {
+    });
+  }
+  return provider;
+}
+var CODEX_API_ENDPOINT, DEFAULT_MODEL3, CONTEXT_WINDOWS3, CodexProvider;
+var init_codex = __esm({
+  "src/providers/codex.ts"() {
     init_errors();
-    init_openai();
-    init_copilot();
-    init_retry();
-    CONTEXT_WINDOWS4 = {
-      // Claude models
-      "claude-sonnet-4.6": 2e5,
-      "claude-opus-4.6": 2e5,
-      "claude-sonnet-4.5": 2e5,
-      "claude-opus-4.5": 2e5,
-      "claude-haiku-4.5": 2e5,
-      // OpenAI models — chat/completions
-      "gpt-4.1": 1048576,
-      // OpenAI models — /responses API (Codex/GPT-5+)
-      "gpt-5.3-codex": 4e5,
-      "gpt-5.2-codex": 4e5,
-      "gpt-5.1-codex-max": 4e5,
-      "gpt-5.2": 4e5,
-      "gpt-5.1": 4e5,
-      // Google models
-      "gemini-3.1-pro-preview": 1e6,
-      "gemini-3-flash-preview": 1e6,
-      "gemini-2.5-pro": 1048576
-    };
-    DEFAULT_MODEL4 = "claude-sonnet-4.6";
-    COPILOT_HEADERS = {
-      "Copilot-Integration-Id": "vscode-chat",
-      "Editor-Version": "vscode/1.99.0",
-      "Editor-Plugin-Version": "copilot-chat/0.26.7",
-      "X-GitHub-Api-Version": "2025-04-01"
+    init_auth();
+    CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+    DEFAULT_MODEL3 = "gpt-5.4-codex";
+    CONTEXT_WINDOWS3 = {
+      "gpt-5.4-codex": 2e5,
+      "gpt-5.3-codex": 2e5,
+      "gpt-5.2-codex": 2e5,
+      "gpt-5-codex": 2e5,
+      "gpt-5.1-codex": 2e5,
+      "gpt-5": 2e5,
+      "gpt-5.2": 2e5,
+      "gpt-5.1": 2e5
     };
-    CopilotProvider = class extends OpenAIProvider {
-      baseUrl = "https://api.githubcopilot.com";
-      currentToken = null;
-      /** In-flight refresh promise to prevent concurrent token exchanges */
-      refreshPromise = null;
-      constructor() {
-        super("copilot", "GitHub Copilot");
-      }
+    CodexProvider = class {
+      id = "codex";
+      name = "OpenAI Codex (ChatGPT Plus/Pro)";
+      config = {};
+      accessToken = null;
+      accountId;
       /**
-       * Initialize the provider with Copilot credentials.
-       *
-       * Gets a valid Copilot API token (from cache or by refreshing),
-       * then creates an OpenAI client configured for the Copilot endpoint.
+       * Initialize the provider with OAuth tokens
        */
       async initialize(config) {
-        this.config = {
-          ...config,
-          model: config.model ?? DEFAULT_MODEL4
-        };
-        const tokenResult = await getValidCopilotToken();
+        this.config = config;
+        const tokenResult = await getValidAccessToken("openai");
         if (tokenResult) {
-          this.currentToken = tokenResult.token;
-          this.baseUrl = tokenResult.baseUrl;
+          this.accessToken = tokenResult.accessToken;
+          this.accountId = extractAccountId(tokenResult.accessToken);
         } else if (config.apiKey) {
-          this.currentToken = config.apiKey;
+          this.accessToken = config.apiKey;
+          this.accountId = extractAccountId(config.apiKey);
         }
-        if (!this.currentToken) {
+        if (!this.accessToken) {
           throw new ProviderError(
-            "No Copilot token found. Please authenticate with: coco --provider copilot",
+            "No OAuth token found. Please run authentication first with: coco --provider openai",
             { provider: this.id }
           );
         }
-        this.createCopilotClient();
-      }
-      /**
-       * Create the OpenAI client configured for Copilot API
-       */
-      createCopilotClient() {
-        this.client = new OpenAI({
-          apiKey: this.currentToken,
-          baseURL: this.config.baseUrl ?? this.baseUrl,
-          timeout: this.config.timeout ?? 12e4,
-          defaultHeaders: COPILOT_HEADERS
-        });
-      }
-      /**
-       * Refresh the Copilot token if expired.
-       *
-       * Uses a mutex so concurrent callers share a single in-flight token
-       * exchange. The slot is cleared inside the IIFE's finally block,
-       * which runs after all awaiting callers have resumed.
-       */
-      async refreshTokenIfNeeded() {
-        if (!this.refreshPromise) {
-          this.refreshPromise = (async () => {
-            try {
-              const tokenResult = await getValidCopilotToken();
-              if (tokenResult && tokenResult.isNew) {
-                this.currentToken = tokenResult.token;
-                this.baseUrl = tokenResult.baseUrl;
-                this.createCopilotClient();
-              }
-            } finally {
-              this.refreshPromise = null;
-            }
-          })();
-        }
-        await this.refreshPromise;
-      }
-      // --- Override public methods to add token refresh + Responses API routing ---
-      async chat(messages, options) {
-        await this.refreshTokenIfNeeded();
-        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-        if (needsResponsesApi(model)) {
-          return this.chatViaResponses(messages, options);
-        }
-        return super.chat(messages, options);
-      }
-      async chatWithTools(messages, options) {
-        await this.refreshTokenIfNeeded();
-        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-        if (needsResponsesApi(model)) {
-          return this.chatWithToolsViaResponses(messages, options);
-        }
-        return super.chatWithTools(messages, options);
-      }
-      // Note: Token is refreshed before the stream starts but NOT mid-stream.
-      // Copilot tokens last ~25 min. Very long streams may get a 401 mid-stream
-      // which surfaces as a ProviderError. The retry layer handles re-attempts.
-      async *stream(messages, options) {
-        await this.refreshTokenIfNeeded();
-        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-        if (needsResponsesApi(model)) {
-          yield* this.streamViaResponses(messages, options);
-          return;
-        }
-        yield* super.stream(messages, options);
-      }
-      async *streamWithTools(messages, options) {
-        await this.refreshTokenIfNeeded();
-        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-        if (needsResponsesApi(model)) {
-          yield* this.streamWithToolsViaResponses(messages, options);
-          return;
-        }
-        yield* super.streamWithTools(messages, options);
       }
-      // --- Responses API implementations ---
       /**
-       * Simple chat via Responses API (no tools)
-       */
-      async chatViaResponses(messages, options) {
-        this.ensureInitialized();
-        return withRetry(async () => {
-          try {
-            const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-            const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
-            const response = await this.client.responses.create({
-              model,
-              input,
-              instructions: instructions ?? void 0,
-              max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-              temperature: options?.temperature ?? this.config.temperature ?? 0,
-              store: false
-            });
-            return {
-              id: response.id,
-              content: response.output_text ?? "",
-              stopReason: response.status === "completed" ? "end_turn" : "max_tokens",
-              usage: {
-                inputTokens: response.usage?.input_tokens ?? 0,
-                outputTokens: response.usage?.output_tokens ?? 0
-              },
-              model: String(response.model)
-            };
-          } catch (error) {
-            throw this.handleError(error);
-          }
-        }, DEFAULT_RETRY_CONFIG);
+       * Ensure provider is initialized
+       */
+      ensureInitialized() {
+        if (!this.accessToken) {
+          throw new ProviderError("Provider not initialized", {
+            provider: this.id
+          });
+        }
       }
       /**
-       * Chat with tools via Responses API
+       * Get context window size for a model
        */
-      async chatWithToolsViaResponses(messages, options) {
-        this.ensureInitialized();
-        return withRetry(async () => {
-          try {
-            const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-            const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
-            const tools = this.convertToolsForResponses(options.tools);
-            const response = await this.client.responses.create({
-              model,
-              input,
-              instructions: instructions ?? void 0,
-              tools,
-              max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-              temperature: options?.temperature ?? this.config.temperature ?? 0,
-              store: false
-            });
-            let content = "";
-            const toolCalls = [];
-            for (const item of response.output) {
-              if (item.type === "message") {
-                for (const part of item.content) {
-                  if (part.type === "output_text") {
-                    content += part.text;
-                  }
-                }
-              } else if (item.type === "function_call") {
-                toolCalls.push({
-                  id: item.call_id,
-                  name: item.name,
-                  input: this.parseToolArguments(item.arguments)
-                });
-              }
-            }
-            return {
-              id: response.id,
-              content,
-              stopReason: response.status === "completed" ? "end_turn" : "tool_use",
-              usage: {
-                inputTokens: response.usage?.input_tokens ?? 0,
-                outputTokens: response.usage?.output_tokens ?? 0
-              },
-              model: String(response.model),
-              toolCalls
-            };
-          } catch (error) {
-            throw this.handleError(error);
-          }
-        }, DEFAULT_RETRY_CONFIG);
+      getContextWindow(model) {
+        const m = model ?? this.config.model ?? DEFAULT_MODEL3;
+        return CONTEXT_WINDOWS3[m] ?? 128e3;
       }
       /**
-       * Stream via Responses API (no tools)
+       * Count tokens in text (approximate)
+       * Uses GPT-4 approximation: ~4 chars per token
        */
-      async *streamViaResponses(messages, options) {
-        this.ensureInitialized();
+      countTokens(text13) {
+        return Math.ceil(text13.length / 4);
+      }
+      /**
+       * Check if provider is available (has valid OAuth tokens)
+       */
+      async isAvailable() {
         try {
-          const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-          const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
-          const stream = await this.client.responses.create({
-            model,
-            input,
-            instructions: instructions ?? void 0,
-            max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-            temperature: options?.temperature ?? this.config.temperature ?? 0,
-            store: false,
-            stream: true
-          });
-          for await (const event of stream) {
-            if (event.type === "response.output_text.delta") {
-              yield { type: "text", text: event.delta };
-            } else if (event.type === "response.completed") {
-              yield { type: "done", stopReason: "end_turn" };
-            }
-          }
-        } catch (error) {
-          throw this.handleError(error);
+          const tokenResult = await getValidAccessToken("openai");
+          return tokenResult !== null;
+        } catch {
+          return false;
         }
       }
       /**
-       * Stream with tools via Responses API
+       * Make a request to the Codex API
        */
-      async *streamWithToolsViaResponses(messages, options) {
+      async makeRequest(body) {
         this.ensureInitialized();
-        try {
-          const model = options?.model ?? this.config.model ?? DEFAULT_MODEL4;
-          const { input, instructions } = this.convertToResponsesInput(messages, options?.system);
-          const tools = this.convertToolsForResponses(options.tools);
-          const stream = await this.client.responses.create({
-            model,
-            input,
-            instructions: instructions ?? void 0,
-            tools,
-            max_output_tokens: options?.maxTokens ?? this.config.maxTokens ?? 8192,
-            temperature: options?.temperature ?? this.config.temperature ?? 0,
-            store: false,
-            stream: true
+        const headers = {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.accessToken}`
+        };
+        if (this.accountId) {
+          headers["ChatGPT-Account-Id"] = this.accountId;
+        }
+        const response = await fetch(CODEX_API_ENDPOINT, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body)
+        });
+        if (!response.ok) {
+          const errorText = await response.text();
+          throw new ProviderError(`Codex API error: ${response.status} - ${errorText}`, {
+            provider: this.id,
+            statusCode: response.status
           });
-          const fnCallBuilders = /* @__PURE__ */ new Map();
-          for await (const event of stream) {
-            switch (event.type) {
-              case "response.output_text.delta":
-                yield { type: "text", text: event.delta };
-                break;
-              case "response.output_item.added":
-                if (event.item.type === "function_call") {
-                  const fc = event.item;
-                  fnCallBuilders.set(fc.call_id, {
-                    callId: fc.call_id,
-                    name: fc.name,
-                    arguments: ""
-                  });
-                  yield {
-                    type: "tool_use_start",
-                    toolCall: { id: fc.call_id, name: fc.name }
-                  };
-                }
-                break;
-              case "response.function_call_arguments.delta":
-                {
-                  const builder = fnCallBuilders.get(event.item_id);
-                  if (builder) {
-                    builder.arguments += event.delta;
-                  }
-                }
-                break;
-              case "response.function_call_arguments.done":
-                {
-                  const builder = fnCallBuilders.get(event.item_id);
-                  if (builder) {
-                    yield {
-                      type: "tool_use_end",
-                      toolCall: {
-                        id: builder.callId,
-                        name: builder.name,
-                        input: this.parseToolArguments(event.arguments)
-                      }
-                    };
-                    fnCallBuilders.delete(event.item_id);
-                  }
-                }
-                break;
-              case "response.completed":
-                {
-                  for (const [, builder] of fnCallBuilders) {
-                    yield {
-                      type: "tool_use_end",
-                      toolCall: {
-                        id: builder.callId,
-                        name: builder.name,
-                        input: this.parseToolArguments(builder.arguments)
-                      }
-                    };
-                  }
-                  fnCallBuilders.clear();
-                  const hasToolCalls = event.response.output.some((i) => i.type === "function_call");
-                  yield {
-                    type: "done",
-                    stopReason: hasToolCalls ? "tool_use" : "end_turn"
-                  };
-                }
-                break;
-            }
-          }
-        } catch (error) {
-          throw this.handleError(error);
         }
+        return response;
+      }
+      /**
+       * Extract text content from a message
+       */
+      extractTextContent(msg) {
+        if (typeof msg.content === "string") {
+          return msg.content;
+        }
+        if (Array.isArray(msg.content)) {
+          return msg.content.map((part) => {
+            if (part.type === "text") return part.text;
+            if (part.type === "tool_result") return `Tool result: ${JSON.stringify(part.content)}`;
+            return "";
+          }).join("\n");
+        }
+        return "";
       }
-      // --- Responses API helpers ---
       /**
-       * Convert our internal messages to Responses API input format.
+       * Convert messages to Codex Responses API format
+       * Codex uses a different format than Chat Completions:
+       * {
+       *   "input": [
+       *     { "type": "message", "role": "developer|user", "content": [{ "type": "input_text", "text": "..." }] },
+       *     { "type": "message", "role": "assistant", "content": [{ "type": "output_text", "text": "..." }] }
+       *   ]
+       * }
        *
-       * The Responses API uses a flat array of input items (EasyInputMessage,
-       * function_call, function_call_output) instead of the chat completions
-       * messages array.
+       * IMPORTANT: User/developer messages use "input_text", assistant messages use "output_text"
        */
-      convertToResponsesInput(messages, systemPrompt) {
-        const input = [];
-        let instructions = null;
-        if (systemPrompt) {
-          instructions = systemPrompt;
+      convertMessagesToResponsesFormat(messages) {
+        return messages.map((msg) => {
+          const text13 = this.extractTextContent(msg);
+          const role = msg.role === "system" ? "developer" : msg.role;
+          const contentType = msg.role === "assistant" ? "output_text" : "input_text";
+          return {
+            type: "message",
+            role,
+            content: [{ type: contentType, text: text13 }]
+          };
+        });
+      }
+      /**
+       * Send a chat message using Codex Responses API format
+       */
+      async chat(messages, options) {
+        const model = options?.model ?? this.config.model ?? DEFAULT_MODEL3;
+        const systemMsg = messages.find((m) => m.role === "system");
+        const instructions = systemMsg ? this.extractTextContent(systemMsg) : "You are a helpful coding assistant.";
+        const inputMessages = messages.filter((m) => m.role !== "system").map((msg) => this.convertMessagesToResponsesFormat([msg])[0]);
+        const body = {
+          model,
+          instructions,
+          input: inputMessages,
+          tools: [],
+          store: false,
+          stream: true
+          // Codex API requires streaming
+        };
+        const response = await this.makeRequest(body);
+        if (!response.body) {
+          throw new ProviderError("No response body from Codex API", {
+            provider: this.id
+          });
         }
-        for (const msg of messages) {
-          if (msg.role === "system") {
-            instructions = (instructions ? instructions + "\n\n" : "") + this.contentToStr(msg.content);
-          } else if (msg.role === "user") {
-            if (Array.isArray(msg.content) && msg.content.some((b) => b.type === "tool_result")) {
-              for (const block of msg.content) {
-                if (block.type === "tool_result") {
-                  const tr = block;
-                  input.push({
-                    type: "function_call_output",
-                    call_id: tr.tool_use_id,
-                    output: tr.content
-                  });
-                }
-              }
-            } else {
-              input.push({
-                role: "user",
-                content: this.contentToStr(msg.content)
-              });
-            }
-          } else if (msg.role === "assistant") {
-            if (typeof msg.content === "string") {
-              input.push({
-                role: "assistant",
-                content: msg.content
-              });
-            } else if (Array.isArray(msg.content)) {
-              const textParts = [];
-              for (const block of msg.content) {
-                if (block.type === "text") {
-                  textParts.push(block.text);
-                } else if (block.type === "tool_use") {
-                  if (textParts.length > 0) {
-                    input.push({
-                      role: "assistant",
-                      content: textParts.join("")
-                    });
-                    textParts.length = 0;
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        let content = "";
+        let responseId = `codex-${Date.now()}`;
+        let inputTokens = 0;
+        let outputTokens = 0;
+        let status = "completed";
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop() ?? "";
+            for (const line of lines) {
+              if (line.startsWith("data: ")) {
+                const data = line.slice(6).trim();
+                if (!data || data === "[DONE]") continue;
+                try {
+                  const parsed = JSON.parse(data);
+                  if (parsed.id) {
+                    responseId = parsed.id;
                   }
-                  input.push({
-                    type: "function_call",
-                    call_id: block.id,
-                    name: block.name,
-                    arguments: JSON.stringify(block.input)
-                  });
+                  if (parsed.type === "response.output_text.delta" && parsed.delta) {
+                    content += parsed.delta;
+                  } else if (parsed.type === "response.completed" && parsed.response) {
+                    if (parsed.response.usage) {
+                      inputTokens = parsed.response.usage.input_tokens ?? 0;
+                      outputTokens = parsed.response.usage.output_tokens ?? 0;
+                    }
+                    status = parsed.response.status ?? "completed";
+                  } else if (parsed.type === "response.output_text.done" && parsed.text) {
+                    content = parsed.text;
+                  }
+                } catch {
                 }
               }
-              if (textParts.length > 0) {
-                input.push({
-                  role: "assistant",
-                  content: textParts.join("")
-                });
-              }
             }
           }
+        } finally {
+          reader.releaseLock();
         }
-        return { input, instructions };
+        if (!content) {
+          throw new ProviderError("No response content from Codex API", {
+            provider: this.id
+          });
+        }
+        const stopReason = status === "completed" ? "end_turn" : status === "incomplete" ? "max_tokens" : "end_turn";
+        return {
+          id: responseId,
+          content,
+          stopReason,
+          model,
+          usage: {
+            inputTokens,
+            outputTokens
+          }
+        };
       }
       /**
-       * Convert our tool definitions to Responses API FunctionTool format
+       * Send a chat message with tool use
+       * Note: Codex Responses API tool support is complex; for now we delegate to chat()
+       * and return empty toolCalls. Full tool support can be added later.
        */
-      convertToolsForResponses(tools) {
-        return tools.map((tool) => ({
-          type: "function",
-          name: tool.name,
-          description: tool.description ?? void 0,
-          parameters: tool.input_schema ?? null,
-          strict: false
-        }));
+      async chatWithTools(messages, options) {
+        const response = await this.chat(messages, options);
+        return {
+          ...response,
+          toolCalls: []
+          // Tools not yet supported in Codex provider
+        };
       }
       /**
-       * Parse tool call arguments with jsonrepair fallback
+       * Stream a chat response
+       * Note: True streaming with Codex Responses API is complex.
+       * For now, we make a non-streaming call and simulate streaming by emitting chunks.
        */
-      parseToolArguments(args) {
-        try {
-          return args ? JSON.parse(args) : {};
-        } catch {
-          try {
-            if (args) {
-              const repaired = jsonrepair(args);
-              return JSON.parse(repaired);
+      async *stream(messages, options) {
+        const response = await this.chat(messages, options);
+        if (response.content) {
+          const content = response.content;
+          const chunkSize = 20;
+          for (let i = 0; i < content.length; i += chunkSize) {
+            const chunk = content.slice(i, i + chunkSize);
+            yield { type: "text", text: chunk };
+            if (i + chunkSize < content.length) {
+              await new Promise((resolve4) => setTimeout(resolve4, 5));
             }
-          } catch {
-            console.error(`[${this.name}] Cannot parse tool arguments: ${args.slice(0, 200)}`);
           }
-          return {};
         }
+        yield { type: "done", stopReason: response.stopReason };
+      }
+      /**
+       * Stream a chat response with tool use
+       * Note: Tools and true streaming with Codex Responses API are not yet implemented.
+       * For now, we delegate to stream() which uses non-streaming under the hood.
+       */
+      async *streamWithTools(messages, options) {
+        yield* this.stream(messages, options);
+      }
+    };
+  }
+});
+function createCopilotProvider() {
+  return new CopilotProvider();
+}
+var CONTEXT_WINDOWS4, DEFAULT_MODEL4, COPILOT_HEADERS, CopilotProvider;
+var init_copilot2 = __esm({
+  "src/providers/copilot.ts"() {
+    init_errors();
+    init_openai();
+    init_copilot();
+    CONTEXT_WINDOWS4 = {
+      // Claude models
+      "claude-sonnet-4.6": 2e5,
+      "claude-opus-4.6": 2e5,
+      "claude-sonnet-4.5": 2e5,
+      "claude-opus-4.5": 2e5,
+      "claude-haiku-4.5": 2e5,
+      // OpenAI models — chat/completions
+      "gpt-4.1": 1048576,
+      // OpenAI models — /responses API (Codex/GPT-5+)
+      "gpt-5.4-codex": 4e5,
+      "gpt-5.3-codex": 4e5,
+      "gpt-5.2-codex": 4e5,
+      "gpt-5.1-codex-max": 4e5,
+      "gpt-5.2": 4e5,
+      "gpt-5.1": 4e5,
+      // Google models
+      "gemini-3.1-pro-preview": 1e6,
+      "gemini-3-flash-preview": 1e6,
+      "gemini-2.5-pro": 1048576
+    };
+    DEFAULT_MODEL4 = "claude-sonnet-4.6";
+    COPILOT_HEADERS = {
+      "Copilot-Integration-Id": "vscode-chat",
+      "Editor-Version": "vscode/1.99.0",
+      "Editor-Plugin-Version": "copilot-chat/0.26.7",
+      "X-GitHub-Api-Version": "2025-04-01"
+    };
+    CopilotProvider = class extends OpenAIProvider {
+      baseUrl = "https://api.githubcopilot.com";
+      currentToken = null;
+      /** In-flight refresh promise to prevent concurrent token exchanges */
+      refreshPromise = null;
+      constructor() {
+        super("copilot", "GitHub Copilot");
+      }
+      /**
+       * Initialize the provider with Copilot credentials.
+       *
+       * Gets a valid Copilot API token (from cache or by refreshing),
+       * then creates an OpenAI client configured for the Copilot endpoint.
+       */
+      async initialize(config) {
+        this.config = {
+          ...config,
+          model: config.model ?? DEFAULT_MODEL4
+        };
+        const tokenResult = await getValidCopilotToken();
+        if (tokenResult) {
+          this.currentToken = tokenResult.token;
+          this.baseUrl = tokenResult.baseUrl;
+        } else if (config.apiKey) {
+          this.currentToken = config.apiKey;
+        }
+        if (!this.currentToken) {
+          throw new ProviderError(
+            "No Copilot token found. Please authenticate with: coco --provider copilot",
+            { provider: this.id }
+          );
+        }
+        this.createCopilotClient();
+      }
+      /**
+       * Create the OpenAI client configured for Copilot API
+       */
+      createCopilotClient() {
+        this.client = new OpenAI({
+          apiKey: this.currentToken,
+          baseURL: this.config.baseUrl ?? this.baseUrl,
+          timeout: this.config.timeout ?? 12e4,
+          defaultHeaders: COPILOT_HEADERS
+        });
       }
       /**
-       * Convert message content to string
+       * Refresh the Copilot token if expired.
+       *
+       * Uses a mutex so concurrent callers share a single in-flight token
+       * exchange. The slot is cleared inside the IIFE's finally block,
+       * which runs after all awaiting callers have resumed.
        */
-      contentToStr(content) {
-        if (typeof content === "string") return content;
-        return content.filter((b) => b.type === "text").map((b) => b.text).join("");
+      async refreshTokenIfNeeded() {
+        if (!this.refreshPromise) {
+          this.refreshPromise = (async () => {
+            try {
+              const tokenResult = await getValidCopilotToken();
+              if (tokenResult && tokenResult.isNew) {
+                this.currentToken = tokenResult.token;
+                this.baseUrl = tokenResult.baseUrl;
+                this.createCopilotClient();
+              }
+            } finally {
+              this.refreshPromise = null;
+            }
+          })();
+        }
+        await this.refreshPromise;
+      }
+      // --- Override public methods to add token refresh ---
+      async chat(messages, options) {
+        await this.refreshTokenIfNeeded();
+        return super.chat(messages, options);
+      }
+      async chatWithTools(messages, options) {
+        await this.refreshTokenIfNeeded();
+        return super.chatWithTools(messages, options);
+      }
+      async *stream(messages, options) {
+        await this.refreshTokenIfNeeded();
+        yield* super.stream(messages, options);
+      }
+      async *streamWithTools(messages, options) {
+        await this.refreshTokenIfNeeded();
+        yield* super.streamWithTools(messages, options);
       }
       // --- Override metadata methods ---
       /**
@@ -4965,6 +5038,7 @@ var init_pricing = __esm({
       "claude-sonnet-4-20250514": { inputPerMillion: 3, outputPerMillion: 15, contextWindow: 2e5 },
       "claude-opus-4-20250514": { inputPerMillion: 15, outputPerMillion: 75, contextWindow: 2e5 },
       // OpenAI models
+      "gpt-5.4-codex": { inputPerMillion: 2, outputPerMillion: 8, contextWindow: 4e5 },
       "gpt-5.3-codex": { inputPerMillion: 2, outputPerMillion: 8, contextWindow: 4e5 },
       "gpt-5.2-codex": { inputPerMillion: 2, outputPerMillion: 8, contextWindow: 4e5 },
       "gpt-5.1-codex-max": { inputPerMillion: 3, outputPerMillion: 12, contextWindow: 4e5 },
@@ -5570,7 +5644,7 @@ function getDefaultModel(provider) {
     case "anthropic":
       return process.env["ANTHROPIC_MODEL"] ?? "claude-opus-4-6";
     case "openai":
-      return process.env["OPENAI_MODEL"] ?? "gpt-5.3-codex";
+      return process.env["OPENAI_MODEL"] ?? "gpt-5.4-codex";
     case "gemini":
       return process.env["GEMINI_MODEL"] ?? "gemini-3.1-pro-preview";
     case "kimi":
@@ -5582,7 +5656,7 @@ function getDefaultModel(provider) {
     case "ollama":
       return process.env["OLLAMA_MODEL"] ?? "llama3.1";
     case "codex":
-      return process.env["CODEX_MODEL"] ?? "gpt-5.3-codex";
+      return process.env["CODEX_MODEL"] ?? "gpt-5.4-codex";
     case "copilot":
       return process.env["COPILOT_MODEL"] ?? "claude-sonnet-4.6";
     case "groq":
@@ -5600,7 +5674,7 @@ function getDefaultModel(provider) {
     case "qwen":
       return process.env["QWEN_MODEL"] ?? "qwen-coder-plus";
     default:
-      return "gpt-5.3-codex";
+      return "gpt-5.4-codex";
   }
 }
 function getDefaultProvider() {
@@ -25665,13 +25739,20 @@ var PROVIDER_DEFINITIONS = {
     // Updated: March 2026 — from platform.openai.com/docs/models
     models: [
       {
-        id: "gpt-5.3-codex",
-        name: "GPT-5.3 Codex",
-        description: "Latest agentic coding model (Feb 2026)",
+        id: "gpt-5.4-codex",
+        name: "GPT-5.4 Codex",
+        description: "Latest agentic coding model (Mar 2026)",
         contextWindow: 4e5,
         maxOutputTokens: 128e3,
         recommended: true
       },
+      {
+        id: "gpt-5.3-codex",
+        name: "GPT-5.3 Codex",
+        description: "Previous agentic coding model (Feb 2026)",
+        contextWindow: 4e5,
+        maxOutputTokens: 128e3
+      },
       {
         id: "gpt-5.2-codex",
         name: "GPT-5.2 Codex",
@@ -25801,13 +25882,20 @@ var PROVIDER_DEFINITIONS = {
       },
       // OpenAI models (Codex/GPT-5+ use /responses API, others use /chat/completions)
       {
-        id: "gpt-5.3-codex",
-        name: "GPT-5.3 Codex",
-        description: "OpenAI's latest coding model via Copilot",
+        id: "gpt-5.4-codex",
+        name: "GPT-5.4 Codex",
+        description: "OpenAI's latest coding model via Copilot (Mar 2026)",
         contextWindow: 4e5,
         maxOutputTokens: 128e3,
         recommended: true
       },
+      {
+        id: "gpt-5.3-codex",
+        name: "GPT-5.3 Codex",
+        description: "OpenAI's previous coding model via Copilot",
+        contextWindow: 4e5,
+        maxOutputTokens: 128e3
+      },
       {
         id: "gpt-5.2-codex",
         name: "GPT-5.2 Codex",
@@ -25879,13 +25967,20 @@ var PROVIDER_DEFINITIONS = {
     },
     models: [
       {
-        id: "gpt-5.3-codex",
-        name: "GPT-5.3 Codex",
-        description: "Latest coding model via ChatGPT subscription (Feb 2026)",
+        id: "gpt-5.4-codex",
+        name: "GPT-5.4 Codex",
+        description: "Latest coding model via ChatGPT subscription (Mar 2026)",
         contextWindow: 2e5,
         maxOutputTokens: 128e3,
         recommended: true
       },
+      {
+        id: "gpt-5.3-codex",
+        name: "GPT-5.3 Codex",
+        description: "Previous coding model via ChatGPT subscription",
+        contextWindow: 2e5,
+        maxOutputTokens: 128e3
+      },
       {
         id: "gpt-5.2-codex",
         name: "GPT-5.2 Codex",
@@ -26302,9 +26397,9 @@ var PROVIDER_DEFINITIONS = {
         recommended: true
       },
       {
-        id: "openai/gpt-5.3-codex",
-        name: "GPT-5.3 Codex (via OR)",
-        description: "OpenAI's coding model \u2014 via OpenRouter",
+        id: "openai/gpt-5.4-codex",
+        name: "GPT-5.4 Codex (via OR)",
+        description: "OpenAI's latest coding model \u2014 via OpenRouter",
         contextWindow: 4e5,
         maxOutputTokens: 128e3
       },