@cortexkit/opencode-openai-auth 1.4.0 → 1.6.0

package/dist/bin.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import{c as _0}from"./index-1tdnrt68.js";import{Cb as I0,Fa as j0,Ga as E,Ha as O,Ia as v,kb as A0,ta as k0,ua as f,va as o}from"./index-vy729a0b.js";import{cd as R0,jd as m,kd as L,md as c,nd as q0}from"./index-brbqqer5.js";import"./index-ag04nyv7.js";import{Je as e,Pe as Y0,Qe as C0,Te as w0}from"./index-wgwze391.js";import"./index-5230x6s8.js";import"./index-d98f1xdp.js";import{spawn as P0}from"node:child_process";var M=4096,S0=1048576;class t{buffer=Buffer.alloc(M);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push(G){if(G.length>=M){if(G.length>M||this.length>0)this.truncated=!0;G.copy(this.buffer,0,G.length-M),this.start=0,this.length=M;return}let b=Math.max(0,this.length+G.length-M);if(b>0)this.truncated=!0;this.start=(this.start+b)%M,this.length-=b;let z=(this.start+this.length)%M,K=Math.min(G.length,M-z);if(G.copy(this.buffer,z,0,K),K<G.length)G.copy(this.buffer,0,K);this.length+=G.length}toString(){let G=Buffer.alloc(this.length),b=Math.min(this.length,M-this.start);if(this.buffer.copy(G,0,this.start,this.start+b),b<this.length)this.buffer.copy(G,b,0,this.length-b);let z=0;while(z<G.length){let K=G[z];if(K===void 0||(K&192)!==128)break;z++}return G.subarray(z).toString("utf8")}}var A={run(G,b,z={}){return new Promise((K)=>{let J=performance.now(),Q=z.timeoutMs??15000,$=new t,q=[],U=0,Z=!1,D=!1,W=!1,F;try{F=P0(G,[...b],{env:z.env??process.env,windowsHide:!0,windowsVerbatimArguments:z.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{K({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-J});return}let x=Q>0?setTimeout(()=>{W=!0,F.kill("SIGTERM")},Q):void 0;F.stdout?.on("data",(j)=>{let R=S0-U,V=Math.min(R,j.length);if(V>0)q.push(j.subarray(0,V)),U+=V;if(j.length>R)Z=!0,F.kill("SIGTERM")}),F.stderr?.on("data",(j)=>$.push(j));let X=!1,B=(j,R)=>{if(X)return;if(X=!0,x)clearTimeout(x);K({exitCode:D?1:Z?1:j??1,stdout:Buffer.concat(q,U).toString("utf8"),stderr:$.toString(),stderrTruncated:$.didTruncate,...D?{spawnError:!0}:{},signal:R??null,timedOut:W,durationMs:performance.now()-J})};F.once("error",()=>{if(D=!0,F.pid===void 0)B(null,null)}),F.once("close",(j,R)=>B(j,R))})}};function g(G,b,z,K,J,Q=15000){if(b==="win32"&&/\.(cmd|bat)$/i.test(z)){if(/["%!\r\n]/.test(z)||K.some(($)=>!/^[a-zA-Z0-9@:/._+-]+$/.test($)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return G.run("cmd.exe",["/d","/s","/c",`""${z}" ${K.join(" ")}"`],{env:J,timeoutMs:Q,windowsVerbatimArguments:!0})}return G.run(z,K,{env:J,timeoutMs:Q})}var y0="Pi install failed; run pi install after checking your npm connection.";function v0(G){let b=Buffer.from(G,"utf8");if(b.length<=M)return G;let z=b.length-M;while(z<b.length){let K=b[z];if(K===void 0||(K&192)!==128)break;z++}return b.subarray(z).toString("utf8")}function E0(G){let b=G.indexOf(`
-`);return b<0?"":G.slice(b+1)}class d extends Error{step="pi-install";exitCode;signal;stderrTail;constructor(G){super(y0);this.name="SetupCommandError",this.exitCode=G.exitCode,this.signal=G.signal;let b=G.stderrTruncated?E0(G.stderrTail):G.stderrTail,z=e(b);this.stderrTail=v0(typeof z==="string"?z:"")}}var f0={opencode:"OpenCode",pi:"Pi"},g0={enrolled:"connected to the vault","not-enrolled":"not connected",unknown:"unknown, check with ck auth status"};function G0({host:G,outcome:b}){return`${f0[G]}: ${g0[b]}`}var d0=new WeakMap;function b0(G,b){if(typeof G!=="object"&&typeof G!=="function"||!G)return;d0.set(G,Object.freeze(b.map((z)=>Object.freeze({...z}))))}import{accessSync as p0,constants as l0,existsSync as a0,readFileSync as i0,realpathSync as s0,statSync as r0}from"node:fs";import{mkdtemp as n0,rm as o0}from"node:fs/promises";import{tmpdir as t0}from"node:os";import{join as e0}from"node:path";import{parse as G2}from"jsonc-parser";import{homedir as m0}from"node:os";import{posix as c0,win32 as h0}from"node:path";import{fileURLToPath as u0}from"node:url";function N(G={}){let b=G.env??process.env,z=G.platform??process.platform,K=z==="win32"?h0:c0,J=G.home??(z==="win32"?b.USERPROFILE:b.HOME)??m0(),Q=G.cwd??process.cwd(),$=(D)=>K.resolve(Q,D),q=b.OPENCODE_CONFIG_DIR?.trim(),U=b.XDG_CONFIG_HOME?.trim(),Z=b.PI_CODING_AGENT_DIR?.trim()||K.join(J,".pi","agent");if(Z==="~")Z=J;else if(/^~[/\\]/.test(Z))Z=K.join(J,Z.slice(2));if(Z.startsWith("file://"))Z=u0(Z);return{env:b,platform:z,path:K,home:J,cwd:Q,opencode:q?$(q):U?K.join($(U),"opencode"):K.join(J,".config","opencode"),pi:$(Z)}}function h(G,b){try{return r0(G)[b]()}catch{return!1}}var _={exists:a0,isFile:(G)=>h(G,"isFile"),isDirectory:(G)=>h(G,"isDirectory"),isExecutable(G){try{return p0(G,l0.X_OK),h(G,"isFile")}catch{return!1}},readText:(G)=>i0(G,"utf8"),realpath:s0};function k(G,b={}){let{env:z,platform:K,path:J,cwd:Q}=N(b),$=b.fs??_,q=Object.entries(z).find(([Z])=>K==="win32"?Z.toUpperCase()==="PATH":Z==="PATH")?.[1]??"",U=K==="win32"?[".exe",".cmd",".bat",""]:[""];for(let Z of q.split(K==="win32"?";":":")){let D=Z.trim().replace(/^"|"$/g,"");if(!D)continue;for(let W of U){let F=J.resolve(Q,D,G+W);if(K==="win32"?$.isFile(F):$.isExecutable(F))return F}}return null}function z0(G={}){let{platform:b,home:z,env:K,path:J}=N(G);if(b==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",J.join(z,"Applications","OpenCode.app"),J.join(z,"Applications","OpenCode Beta.app")];if(b==="win32"){let Q=K.LOCALAPPDATA||J.join(z,"AppData","Local");return[J.join(Q,"Programs","opencode"),J.join(Q,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",J.join(z,".local","share","applications","opencode.desktop")]}function u(G,b){let z=b.fs??_,{path:K}=N(b);try{let J=z.readText(G);if(J.length>65536)return G;let Q=[...J.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!Q.length)Q.push(...J.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let $=Q.at(-1)?.[1];if($){let q=K.join(K.dirname(G),...$.split(/[/\\]+/));if(z.isFile(q))return z.realpath(q)}return z.realpath(G)}catch{return G}}function b2(G,b){let z=b.fs??_,{path:K}=N(b),J=K.dirname(u(G,b));for(;;){try{let $=JSON.parse(z.readText(K.join(J,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes($.name))return"2";if($.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test($.version??"")?"2":"1"}catch{}let Q=K.dirname(J);if(Q===J)return null;J=Q}}function J0(G={}){let b=k("opencode",G),z=k("opencode2",G),K=b&&z&&u(b,G)===u(z,G),J=G.fs??_,{path:Q,opencode:$}=N(G),q="1";for(let Z of["jsonc","json"]){let D=Q.join($,`opencode.${Z}`);if(!J.exists(D))continue;try{if(Object.hasOwn(G2(J.readText(D))??{},"plugins"))q="2"}catch{}break}let U=b?b2(b,G)??(K?"2":q):null;if(z&&U==="1"&&!K)return"ambiguous";return z||K?"2":U??q}async function p(G,b={}){let z=b.fs??_,{env:K,platform:J,opencode:Q,pi:$}=N(b),q=b.runner??A,U=k("opencode",b)??k("opencode2",b),Z=k("pi",b),D=k("ck",b),W=async(B)=>{if(!B)return null;let j;try{j=await n0(e0(t0(),"common-auth-setup-version-"));let R={...K,HOME:j,USERPROFILE:j,XDG_CONFIG_HOME:j,XDG_DATA_HOME:j,XDG_STATE_HOME:j,XDG_CACHE_HOME:j,OPENCODE_CONFIG_DIR:j,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:j},V=await g(q,J,B,["--version"],R,2000);return V.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(V.stdout)?.[0]??null:null}catch{return null}finally{if(j)await o0(j,{recursive:!0,force:!0}).catch(()=>{})}},F=!1;if(D&&z.exists(G.vault.connectionFile))try{(await(b.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000})).close(),F=!0}catch{F=!1}let[x,X]=await Promise.all([W(U),W(Z)]);return{opencode:{installed:z.isDirectory(Q)||z0(b).some((B)=>z.exists(B))||U!==null,executable:U,version:x,directory:Q,generation:J0(b)},pi:{installed:Z!==null||z.isDirectory($),executable:Z,version:X,directory:$},claustrum:{available:F,executable:D}}}import{setTimeout as U2}from"node:timers/promises";import{writeEnrollmentTokenFile as W2}from"@cortexkit/claustrum-client";var z2=45000,K0=new Set(["opencode","litecode","opencode2","pi"]),J2=new Set(["node","bun"]),K2=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function Q2(G){return[...G.matchAll(/"([^"]*)"|(\S+)/g)].map((b)=>b[1]??b[2]??"")}function Q0(G){return(G.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var Z2=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),$2=new Set(["-e","--eval","-p","--print"]);function q2(G,b){for(let z=0;z<b.length;z++){let K=b[z]??"";if(K==="--")return b[z+1];if($2.has(K))return;if(K.startsWith("-")){if(!K.includes("=")&&Z2.has(K))z++;continue}if(G==="bun"&&K==="run")continue;return K}return}function Z0(G){let[b,...z]=Q2(G);if(b===void 0)return null;let K=Q0(b);if(K0.has(K))return K;if(!J2.has(K))return null;let J=q2(K,z);if(J===void 0)return null;let Q=Q0(J);if(K0.has(Q))return Q;return K2.test(J)?"pi":null}class Y extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor(G){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=G.step,this.exitCode=G.exitCode,this.signal=G.signal,this.timedOut=G.timedOut,this.durationMs=G.durationMs}get refusalText(){let G=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${G} after ${Math.round(this.durationMs)} ms.`}}class T extends Error{activeHosts;constructor(G){let b=G.map((z)=>({pid:z.pid,command:Z0(z.command)??"host"}));super(`OpenCode or Pi processes are currently running:
+import{c as f0}from"./index-79y7w9bz.js";import{Db as E0,Ga as N0,Ha as E,Ia as Y,Ja as v,lb as v0,ua as S0,va as f,wa as e}from"./index-k5anexvs.js";import{dd as y0,jd as j0,ld as h,md as L,od as d,pd as D0}from"./index-ge60xry3.js";import"./index-8xq099qf.js";import{Le as b0,Re as w0,Se as I0,Ve as P0}from"./index-b0ty9qam.js";import"./index-7nmdsmpp.js";import"./index-ya9c5e4m.js";import{spawn as h0}from"node:child_process";var N=4096,d0=1048576;class G0{buffer=Buffer.alloc(N);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push(G){if(G.length>=N){if(G.length>N||this.length>0)this.truncated=!0;G.copy(this.buffer,0,G.length-N),this.start=0,this.length=N;return}let b=Math.max(0,this.length+G.length-N);if(b>0)this.truncated=!0;this.start=(this.start+b)%N,this.length-=b;let z=(this.start+this.length)%N,Z=Math.min(G.length,N-z);if(G.copy(this.buffer,z,0,Z),Z<G.length)G.copy(this.buffer,0,Z);this.length+=G.length}toString(){let G=Buffer.alloc(this.length),b=Math.min(this.length,N-this.start);if(this.buffer.copy(G,0,this.start,this.start+b),b<this.length)this.buffer.copy(G,b,0,this.length-b);let z=0;while(z<G.length){let Z=G[z];if(Z===void 0||(Z&192)!==128)break;z++}return G.subarray(z).toString("utf8")}}var I={run(G,b,z={}){return new Promise((Z)=>{let J=performance.now(),$=z.timeoutMs??15000,K=new G0,W=[],j=0,Q=!1,D=!1,U=!1,V;try{V=h0(G,[...b],{env:z.env??process.env,windowsHide:!0,windowsVerbatimArguments:z.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{Z({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-J});return}let x=$>0?setTimeout(()=>{U=!0,V.kill("SIGTERM")},$):void 0;V.stdout?.on("data",(F)=>{let k=d0-j,q=Math.min(k,F.length);if(q>0)W.push(F.subarray(0,q)),j+=q;if(F.length>k)Q=!0,V.kill("SIGTERM")}),V.stderr?.on("data",(F)=>K.push(F));let X=!1,B=(F,k)=>{if(X)return;if(X=!0,x)clearTimeout(x);Z({exitCode:D?1:Q?1:F??1,stdout:Buffer.concat(W,j).toString("utf8"),stderr:K.toString(),stderrTruncated:K.didTruncate,...D?{spawnError:!0}:{},signal:k??null,timedOut:U,durationMs:performance.now()-J})};V.once("error",()=>{if(D=!0,V.pid===void 0)B(null,null)}),V.once("close",(F,k)=>B(F,k))})}};function g(G,b,z,Z,J,$=15000){if(b==="win32"&&/\.(cmd|bat)$/i.test(z)){if(/["%!\r\n]/.test(z)||Z.some((K)=>!/^[a-zA-Z0-9@:/._+-]+$/.test(K)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return G.run("cmd.exe",["/d","/s","/c",`""${z}" ${Z.join(" ")}"`],{env:J,timeoutMs:$,windowsVerbatimArguments:!0})}return G.run(z,Z,{env:J,timeoutMs:$})}var c0="Pi install failed; run pi install after checking your npm connection.";function u0(G){let b=Buffer.from(G,"utf8");if(b.length<=N)return G;let z=b.length-N;while(z<b.length){let Z=b[z];if(Z===void 0||(Z&192)!==128)break;z++}return b.subarray(z).toString("utf8")}function p0(G){let b=G.indexOf(`
+`);return b<0?"":G.slice(b+1)}class m extends Error{step="pi-install";exitCode;signal;stderrTail;constructor(G){super(c0);this.name="SetupCommandError",this.exitCode=G.exitCode,this.signal=G.signal;let b=G.stderrTruncated?p0(G.stderrTail):G.stderrTail,z=b0(b);this.stderrTail=u0(typeof z==="string"?z:"")}}var l0={opencode:"OpenCode",pi:"Pi"},a0={enrolled:"connected to the vault","not-enrolled":"not connected",unknown:"unknown, check with ck auth status"};function z0({host:G,outcome:b}){return`${l0[G]}: ${a0[b]}`}var i0=new WeakMap;function J0(G,b){if(typeof G!=="object"&&typeof G!=="function"||!G)return;i0.set(G,Object.freeze(b.map((z)=>Object.freeze({...z}))))}import{accessSync as t0,constants as e0,existsSync as G1,readFileSync as b1,realpathSync as z1,statSync as J1}from"node:fs";import{mkdtemp as Z1,rm as $1}from"node:fs/promises";import{tmpdir as Q1}from"node:os";import{join as K1}from"node:path";import{parse as q1}from"jsonc-parser";import{homedir as s0}from"node:os";import{posix as r0,win32 as n0}from"node:path";import{fileURLToPath as o0}from"node:url";function R(G={}){let b=G.env??process.env,z=G.platform??process.platform,Z=z==="win32"?n0:r0,J=G.home??(z==="win32"?b.USERPROFILE:b.HOME)??s0(),$=G.cwd??process.cwd(),K=(D)=>Z.resolve($,D),W=b.OPENCODE_CONFIG_DIR?.trim(),j=b.XDG_CONFIG_HOME?.trim(),Q=b.PI_CODING_AGENT_DIR?.trim()||Z.join(J,".pi","agent");if(Q==="~")Q=J;else if(/^~[/\\]/.test(Q))Q=Z.join(J,Q.slice(2));if(Q.startsWith("file://"))Q=o0(Q);return{env:b,platform:z,path:Z,home:J,cwd:$,opencode:W?K(W):j?Z.join(K(j),"opencode"):Z.join(J,".config","opencode"),pi:K(Q)}}function c(G,b){try{return J1(G)[b]()}catch{return!1}}var _={exists:G1,isFile:(G)=>c(G,"isFile"),isDirectory:(G)=>c(G,"isDirectory"),isExecutable(G){try{return t0(G,e0.X_OK),c(G,"isFile")}catch{return!1}},readText:(G)=>b1(G,"utf8"),realpath:z1};function w(G,b={}){let{env:z,platform:Z,path:J,cwd:$}=R(b),K=b.fs??_,W=Object.entries(z).find(([Q])=>Z==="win32"?Q.toUpperCase()==="PATH":Q==="PATH")?.[1]??"",j=Z==="win32"?[".exe",".cmd",".bat",""]:[""];for(let Q of W.split(Z==="win32"?";":":")){let D=Q.trim().replace(/^"|"$/g,"");if(!D)continue;for(let U of j){let V=J.resolve($,D,G+U);if(Z==="win32"?K.isFile(V):K.isExecutable(V))return V}}return null}function Z0(G={}){let{platform:b,home:z,env:Z,path:J}=R(G);if(b==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",J.join(z,"Applications","OpenCode.app"),J.join(z,"Applications","OpenCode Beta.app")];if(b==="win32"){let $=Z.LOCALAPPDATA||J.join(z,"AppData","Local");return[J.join($,"Programs","opencode"),J.join($,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",J.join(z,".local","share","applications","opencode.desktop")]}function u(G,b){let z=b.fs??_,{path:Z}=R(b);try{let J=z.readText(G);if(J.length>65536)return G;let $=[...J.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!$.length)$.push(...J.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let K=$.at(-1)?.[1];if(K){let W=Z.join(Z.dirname(G),...K.split(/[/\\]+/));if(z.isFile(W))return z.realpath(W)}return z.realpath(G)}catch{return G}}function x1(G,b){let z=b.fs??_,{path:Z}=R(b),J=Z.dirname(u(G,b));for(;;){try{let K=JSON.parse(z.readText(Z.join(J,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes(K.name))return"2";if(K.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test(K.version??"")?"2":"1"}catch{}let $=Z.dirname(J);if($===J)return null;J=$}}function $0(G={}){let b=w("opencode",G),z=w("opencode2",G),Z=b&&z&&u(b,G)===u(z,G),J=G.fs??_,{path:$,opencode:K}=R(G),W="1";for(let Q of["jsonc","json"]){let D=$.join(K,`opencode.${Q}`);if(!J.exists(D))continue;try{if(Object.hasOwn(q1(J.readText(D))??{},"plugins"))W="2"}catch{}break}let j=b?x1(b,G)??(Z?"2":W):null;if(z&&j==="1"&&!Z)return"ambiguous";return z||Z?"2":j??W}async function p(G,b={}){let z=b.fs??_,{env:Z,platform:J,opencode:$,pi:K}=R(b),W=b.runner??I,j=w("opencode",b)??w("opencode2",b),Q=w("pi",b),D=w("ck",b),U=async(B)=>{if(!B)return null;let F;try{F=await Z1(K1(Q1(),"common-auth-setup-version-"));let k={...Z,HOME:F,USERPROFILE:F,XDG_CONFIG_HOME:F,XDG_DATA_HOME:F,XDG_STATE_HOME:F,XDG_CACHE_HOME:F,OPENCODE_CONFIG_DIR:F,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:F},q=await g(W,J,B,["--version"],k,2000);return q.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(q.stdout)?.[0]??null:null}catch{return null}finally{if(F)await $1(F,{recursive:!0,force:!0}).catch(()=>{})}},V=!1;if(D&&z.exists(G.vault.connectionFile))try{(await(b.connect??h)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000})).close(),V=!0}catch{V=!1}let[x,X]=await Promise.all([U(j),U(Q)]);return{opencode:{installed:z.isDirectory($)||Z0(b).some((B)=>z.exists(B))||j!==null,executable:j,version:x,directory:$,generation:$0(b)},pi:{installed:Q!==null||z.isDirectory(K),executable:Q,version:X,directory:K},claustrum:{available:V,executable:D}}}import{setTimeout as Y1}from"node:timers/promises";import{writeEnrollmentTokenFile as B1}from"@cortexkit/claustrum-client";var Q0=45000,l=new Set(["opencode","litecode","opencode2","pi"]),q0=new Set(["node","bun"]),U1=[...l,...q0].map((G)=>`Name LIKE '${G}%'`).join(" OR "),W1=`$ErrorActionPreference = 'Stop'; $rows = @(Get-CimInstance Win32_Process -Filter "${U1}" | Select-Object Name,ProcessId,CommandLine); ConvertTo-Json -Compress -Depth 3 -InputObject @{ complete = $true; processes = $rows }`,X1=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function j1(G){return[...G.matchAll(/"([^"]*)"|(\S+)/g)].map((b)=>b[1]??b[2]??"")}function K0(G){return(G.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var D1=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),V1=new Set(["-e","--eval","-p","--print"]);function F1(G,b){for(let z=0;z<b.length;z++){let Z=b[z]??"";if(Z==="--")return b[z+1];if(V1.has(Z))return;if(Z.startsWith("-")){if(!Z.includes("=")&&D1.has(Z))z++;continue}if(G==="bun"&&Z==="run")continue;return Z}return}function x0(G){let[b,...z]=j1(G);if(b===void 0)return null;let Z=K0(b);if(l.has(Z))return Z;if(!q0.has(Z))return null;let J=F1(Z,z);if(J===void 0)return null;let $=K0(J);if(l.has($))return $;return X1.test(J)?"pi":null}class H extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor(G){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=G.step,this.exitCode=G.exitCode,this.signal=G.signal,this.timedOut=G.timedOut,this.durationMs=G.durationMs}get refusalText(){let G=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${G} after ${Math.round(this.durationMs)} ms.`}}class T extends Error{activeHosts;constructor(G){let b=G.map((z)=>({pid:z.pid,command:x0(z.command)??"host"}));super(`OpenCode or Pi processes are currently running:
 ${b.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
 `)}
 
-Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=b,this.name="ProcessFenceViolationError"}}async function l(G=A,b={}){let z=(b.platform??process.platform)==="win32",K=b.selfPid??process.pid,J={step:z?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},Q=async($,q,U,Z)=>{let D=performance.now();J={step:$,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let W=await G.run(q,U,{env:b.env,timeoutMs:Z});return J={step:$,exitCode:W.exitCode,signal:W.signal??null,timedOut:W.timedOut??!1,durationMs:W.durationMs??performance.now()-D},W}finally{if(J.exitCode===null)J.durationMs=performance.now()-D;b.onStep?.({...J})}};try{let $=await Q(z?"tasklist":"ps",z?"tasklist.exe":"ps",z?["/fo","csv","/nh"]:["-eo","pid,command"]);if($.exitCode!==0)throw new Y(J);let q=[];for(let Z of $.stdout.split(/\r?\n/)){let D=Z.trim();if(!D)continue;let W,F;if(z){let x=/^"([^"]+)","(\d+)"(?:,|$)/.exec(D);if(!x)throw new Y(J);F=x[1]??"",W=Number(x[2])}else{let x=/^(\d+)\s+(.+)$/.exec(D);if(!x){if(/^PID\s+COMMAND$/i.test(D))continue;throw new Y(J)}W=Number(x[1]),F=x[2]??""}if(!Number.isSafeInteger(W)||W<0)throw new Y(J);q.push({pid:W,command:F})}if(!q.length)throw new Y(J);let U=q.filter((Z)=>Z.pid!==K&&/^(?:node|bun)\.exe$/i.test(Z.command));if(z&&U.length&&b.inspectRuntimes!==!1){let Z=await Q("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],z2);if(Z.exitCode!==0)throw new Y(J);let D=JSON.parse(Z.stdout||"null"),W=D===null?[]:Array.isArray(D)?D:[D],F=new Map;for(let x of W){if(!x||typeof x!=="object"||!("ProcessId"in x)||!("CommandLine"in x)||!Number.isSafeInteger(x.ProcessId))throw new Y(J);if(typeof x.CommandLine==="string")F.set(Number(x.ProcessId),x.CommandLine);else if(U.some((X)=>X.pid===x.ProcessId))throw new Y(J)}for(let x of U)x.command=F.get(x.pid)??""}return q}catch($){if($ instanceof Y)throw $;throw new Y(J)}}function S(G=A,b={}){let z=b.selfPid??process.pid,K=(J)=>J.pid!==z&&Z0(J.command)!==null;return{async listRunningHosts(J){return(await l(G,{...b,env:J})).filter(K)},async previewRunningHosts(J){let Q=await l(G,{...b,env:J,inspectRuntimes:!1}),$=(b.platform??process.platform)==="win32";return{hosts:Q.filter(K),uncheckedRuntimes:$?Q.filter((q)=>q.pid!==z&&/^(?:node|bun)\.exe$/i.test(q.command)).length:0}}}}async function y(G,b){let z=await G.listRunningHosts(b);if(z.length)throw new T(z)}var $0="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.";class I extends Error{}async function U0(G,b,z,K,J){let{name:Q,paths:$}=G.vault.hosts[b],q=L($);await J();let U=await(z.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw new I("Claustrum connection failed; start ck and rerun setup.")});try{let Z=new q0({proposedName:Q,paths:q,client:{enrollPropose:async(W)=>{return await J(),U.enrollPropose(W)},enrollPoll:async(W)=>{return await J(),U.enrollPoll(W)}},writeTokenFile:async(W,F)=>{await J(),await W2(W,F)}}),D;for(let W=0;W<300;W++){await J();let F=await Z.reconcile();if(F.state==="approved"){O(K,`Connected ${b} to Claustrum.`);return}if(F.state!=="pending"&&F.state!=="busy")throw new I("Claustrum enrollment refused; inspect its status with ck before rerunning setup.");if(F.state==="pending"&&F.requestId&&F.requestId!==D){if(!/^[a-zA-Z0-9_-]+$/.test(F.requestId))throw new I("Invalid enrollment request id.");D=F.requestId,O(K,"Waiting for approval. In another terminal, run:"),O(K,`  ck auth enroll approve --request-id ${F.requestId} --name ${Q}`),O(K,`Enrollment files: ${q.statePath}, ${q.tokenPath}`)}await(z.wait??U2)(1000)}throw new I("Claustrum approval is still pending; approve with ck and rerun setup.")}catch(Z){if(Z instanceof T||Z instanceof Y)throw Z;if(Z instanceof I)throw new I($0);throw Error($0)}finally{U.close()}}async function W0(G,b){let z=new Set(b);for(;;){let K=await v(G,[...["opencode","pi"].map((J)=>({value:J,label:`[${z.has(J)?"x":" "}] ${J==="opencode"?"OpenCode":"Pi"}`,hint:b.includes(J)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(K===null)return null;if(K==="done")return[...z];if(z.has(K))z.delete(K);else z.add(K)}}import{applyEdits as a,createScanner as H2,findNodeAtLocation as M2,modify as D0,parse as N2,parseTree as R2}from"jsonc-parser";import{randomUUID as x2}from"node:crypto";import{mkdir as D2,open as F2,rename as V2,stat as X2,unlink as j2}from"node:fs/promises";import{basename as O2,dirname as B2,join as Y2}from"node:path";import{setTimeout as C2}from"node:timers/promises";async function x0(G,b,z={}){let K=(z.platform??process.platform)==="win32",J=B2(G);await D2(J,{recursive:!0});let Q;if(!K)try{Q=(await X2(G)).mode&4095}catch(U){if(U.code!=="ENOENT")throw U}let $=Y2(J,`.${O2(G)}.${(z.stageName??x2)()}.tmp`),q=!1;try{let U=await F2($,"wx",Q??438);q=!0;try{if(await U.writeFile(b,"utf8"),Q!==void 0)await U.chmod(Q)}finally{await U.close()}let Z=z.now??(()=>performance.now()),D=Z();for(let W=0;;W++){await z.beforeRename?.();try{await(z.rename??V2)($,G),q=!1;return}catch(F){let x=F.code,X=2000-(Z()-D);if(!K||!["EPERM","EBUSY","EACCES"].includes(x??"")||X<=0||W>=40)throw Error(`Unable to replace host config ${G}. Close editors or other programs using the file, then rerun setup.`);await(z.wait??C2)(Math.min(X,25*2**Math.min(W,2)))}}}finally{if(q)await j2($).catch(()=>{})}}function F0(G){let b=typeof G==="string"?G:Array.isArray(G)?G[0]:G&&typeof G==="object"&&("package"in G)?G.package:null;if(typeof b!=="string")return null;let z=b.indexOf("@",b.startsWith("@")?1:0);return z<0?b:b.slice(0,z)}function V0(G,b,z){let K=R2(G),J=K&&M2(K,[b]),Q=J?.children??[],$=Q[z];if(!$||!J)throw Error("Invalid plugin array edit.");let q=[{offset:$.offset,length:$.length,content:""}],U=(Z,D)=>{let W=H2(G.slice(Z,D),!0);if(W.scan(),G[Z+W.getTokenOffset()]===",")q.push({offset:Z+W.getTokenOffset(),length:1,content:""})};if(z===Q.length-1){let Z=Q[z-1];if(Z)U(Z.offset+Z.length,$.offset);U($.offset+$.length,J.offset+J.length-1)}else U($.offset+$.length,Q[z+1]?.offset??$.offset+$.length);return a(G,q)}function X0(G,b,z,K){let J=[],Q=N2(G,J,{allowTrailingComma:!0});if(J.length||!Q||typeof Q!=="object"||Array.isArray(Q))throw Error("Invalid OpenCode config; refusing to overwrite it.");let $={formattingOptions:{insertSpaces:!/^\t+/m.test(G),tabSize:/^([ ]+)"/m.exec(G)?.[1]?.length??2,eol:G.includes(`\r
+Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=b,this.name="ProcessFenceViolationError"}}async function a(G=I,b={}){let z=(b.platform??process.platform)==="win32",Z=b.selfPid??process.pid,J={step:z?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},$=async(K,W,j,Q)=>{let D=performance.now();J={step:K,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let U=await G.run(W,j,{env:b.env,timeoutMs:Q});return J={step:K,exitCode:U.exitCode,signal:U.signal??null,timedOut:U.timedOut??!1,durationMs:U.durationMs??performance.now()-D},U}finally{if(J.exitCode===null)J.durationMs=performance.now()-D;b.onStep?.({...J})}};try{if(z&&b.hostImagesOnly){let Q=await $("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",W1],Q0);if(Q.exitCode!==0)throw new H(J);let D=JSON.parse(Q.stdout);if(!D||typeof D!=="object"||!("complete"in D)||D.complete!==!0||!("processes"in D))throw new H(J);let U=D.processes,V=U===null?[]:Array.isArray(U)?U:[U],x=[];for(let X of V){if(!X||typeof X!=="object"||!("Name"in X)||typeof X.Name!=="string"||!("ProcessId"in X)||!Number.isSafeInteger(X.ProcessId)||X.ProcessId<0||!("CommandLine"in X))throw new H(J);let B=X.ProcessId;if(!/^(?:node|bun)\.exe$/i.test(X.Name))x.push({pid:B,command:X.Name});else if(typeof X.CommandLine==="string")x.push({pid:B,command:X.CommandLine});else if(B!==Z)throw new H(J)}return x}let K=await $(z?"tasklist":"ps",z?"tasklist.exe":"ps",z?["/fo","csv","/nh"]:["-eo","pid,command"]);if(K.exitCode!==0)throw new H(J);let W=[];for(let Q of K.stdout.split(/\r?\n/)){let D=Q.trim();if(!D)continue;let U,V;if(z){let x=/^"([^"]+)","(\d+)"(?:,|$)/.exec(D);if(!x)throw new H(J);V=x[1]??"",U=Number(x[2])}else{let x=/^(\d+)\s+(.+)$/.exec(D);if(!x){if(/^PID\s+COMMAND$/i.test(D))continue;throw new H(J)}U=Number(x[1]),V=x[2]??""}if(!Number.isSafeInteger(U)||U<0)throw new H(J);W.push({pid:U,command:V})}if(!W.length)throw new H(J);let j=W.filter((Q)=>Q.pid!==Z&&/^(?:node|bun)\.exe$/i.test(Q.command));if(z&&j.length&&b.inspectRuntimes!==!1){let Q=await $("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],Q0);if(Q.exitCode!==0)throw new H(J);let D=JSON.parse(Q.stdout||"null"),U=D===null?[]:Array.isArray(D)?D:[D],V=new Map;for(let x of U){if(!x||typeof x!=="object"||!("ProcessId"in x)||!("CommandLine"in x)||!Number.isSafeInteger(x.ProcessId))throw new H(J);if(typeof x.CommandLine==="string")V.set(Number(x.ProcessId),x.CommandLine);else if(j.some((X)=>X.pid===x.ProcessId))throw new H(J)}for(let x of j)x.command=V.get(x.pid)??""}return W}catch(K){if(K instanceof H)throw K;throw new H(J)}}function S(G=I,b={}){let z=b.selfPid??process.pid,Z=(J)=>J.pid!==z&&x0(J.command)!==null;return{async listRunningHosts(J){return(await a(G,{...b,env:J,hostImagesOnly:!0})).filter(Z)},async previewRunningHosts(J){let $=await a(G,{...b,env:J,inspectRuntimes:!1}),K=(b.platform??process.platform)==="win32";return{hosts:$.filter(Z),uncheckedRuntimes:K?$.filter((W)=>W.pid!==z&&/^(?:node|bun)\.exe$/i.test(W.command)).length:0}}}}async function P(G,b){let z=await G.listRunningHosts(b);if(z.length)throw new T(z)}var H1="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.",V0='This Claustrum vault is too old to connect plugins. Run ck upgrade to move to Claustrum v0.2.0 or newer (read "Upgrading from v0.1.3" in its release notes first), or run setup without --claustrum to use local accounts.',F0=300000,U0=1000,W0=[1000,2000,4000,8000,16000,30000];function i(G){return G&&/^[a-z][a-z0-9_]{0,63}$/.test(G)?G:"unknown"}class A extends Error{reason;lastErrorCode;constructor(G,b){super(G);if(this.name="HostNotEnrolledError",this.reason=b.reason,b.lastErrorCode!==void 0)this.lastErrorCode=i(b.lastErrorCode)}}function X0(G,b){return`ck auth enroll approve --request-id ${G} --name ${b}`}async function Y0(G,b,z,Z,J){let{name:$,paths:K}=G.vault.hosts[b],W=L(K);await J();let j=await(z.connect??h)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw new A("Claustrum connection failed; start ck and rerun setup.",{reason:"connection-failed"})}),Q=z.now??(()=>performance.now()),D=z.wait??Y1;try{let U=new D0({proposedName:$,paths:W,client:j,writeTokenFile:async(q,O)=>{await J(),await B1(q,O)}});Y(Z,`Asking the vault to connect ${$}…`);let V=Q()+F0,x,X,B,F=0;for(;;){await J();let q=await U.reconcile();if(q.state==="approved"){Y(Z,`Connected ${b} to Claustrum.`);return}if(q.state==="unavailable"&&q.code===j0)throw new A(V0,{reason:"unsupported-vault",lastErrorCode:q.code});if(q.state!=="pending"&&q.state!=="busy")throw new A("Claustrum enrollment refused; inspect its status with ck before rerunning setup.",{reason:"refused",..."code"in q&&{lastErrorCode:q.code}});let O=U0;if(q.state==="busy")X="busy";else if(q.retryCode)X=q.retryCode;if(q.state==="pending"&&q.requestId){if(F=0,q.requestId!==x){if(!/^[a-zA-Z0-9_-]+$/.test(q.requestId))throw new A("Invalid enrollment request id.",{reason:"invalid-request"});x=q.requestId,Y(Z,"Waiting for approval. In another terminal, run:"),Y(Z,`  ${X0(q.requestId,$)}`),Y(Z,`Enrollment files: ${W.statePath}, ${W.tokenPath}`)}}else if(q.state==="pending"&&q.retryCode){O=W0[Math.min(F,W0.length-1)]??U0,F++;let C=i(q.retryCode);if(C!==B)B=C,Y(Z,`The vault has not created the request yet (${C}); retrying.`)}let M=V-Q();if(M<=0)break;await D(Math.min(O,M))}if(x)throw new A(`Claustrum approval is still pending. In another terminal, run: ${X0(x,$)} and then rerun setup.`,{reason:"approval-pending",...X!==void 0&&{lastErrorCode:X}});let k=i(X);throw new A(`The vault never created the enrollment request (last error: ${k}). Check that ck is running, then rerun setup.`,{reason:"request-not-created",lastErrorCode:k})}catch(U){if(U instanceof T||U instanceof H||U instanceof A)throw U;let V=U?.code;throw new A(H1,{reason:"incomplete",...typeof V==="string"&&{lastErrorCode:V}})}finally{j.close()}}async function B0(G,b){let z=new Set(b);for(;;){let Z=await v(G,[...["opencode","pi"].map((J)=>({value:J,label:`[${z.has(J)?"x":" "}] ${J==="opencode"?"OpenCode":"Pi"}`,hint:b.includes(J)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(Z===null)return null;if(Z==="done")return[...z];if(z.has(Z))z.delete(Z);else z.add(Z)}}import{applyEdits as s,createScanner as T1,findNodeAtLocation as L1,modify as O0,parse as y1,parseTree as S1}from"jsonc-parser";import{randomUUID as O1}from"node:crypto";import{mkdir as M1,open as k1,rename as C1,stat as N1,unlink as R1}from"node:fs/promises";import{basename as A1,dirname as w1,join as I1}from"node:path";import{setTimeout as _1}from"node:timers/promises";async function H0(G,b,z={}){let Z=(z.platform??process.platform)==="win32",J=w1(G);await M1(J,{recursive:!0});let $;if(!Z)try{$=(await N1(G)).mode&4095}catch(j){if(j.code!=="ENOENT")throw j}let K=I1(J,`.${A1(G)}.${(z.stageName??O1)()}.tmp`),W=!1;try{let j=await k1(K,"wx",$??438);W=!0;try{if(await j.writeFile(b,"utf8"),$!==void 0)await j.chmod($)}finally{await j.close()}let Q=z.now??(()=>performance.now()),D=Q();for(let U=0;;U++){await z.beforeRename?.();try{await(z.rename??C1)(K,G),W=!1;return}catch(V){let x=V.code,X=2000-(Q()-D);if(!Z||!["EPERM","EBUSY","EACCES"].includes(x??"")||X<=0||U>=40)throw Error(`Unable to replace host config ${G}. Close editors or other programs using the file, then rerun setup.`);await(z.wait??_1)(Math.min(X,25*2**Math.min(U,2)))}}}finally{if(W)await R1(K).catch(()=>{})}}function M0(G){let b=typeof G==="string"?G:Array.isArray(G)?G[0]:G&&typeof G==="object"&&("package"in G)?G.package:null;if(typeof b!=="string")return null;let z=b.indexOf("@",b.startsWith("@")?1:0);return z<0?b:b.slice(0,z)}function k0(G,b,z){let Z=S1(G),J=Z&&L1(Z,[b]),$=J?.children??[],K=$[z];if(!K||!J)throw Error("Invalid plugin array edit.");let W=[{offset:K.offset,length:K.length,content:""}],j=(Q,D)=>{let U=T1(G.slice(Q,D),!0);if(U.scan(),G[Q+U.getTokenOffset()]===",")W.push({offset:Q+U.getTokenOffset(),length:1,content:""})};if(z===$.length-1){let Q=$[z-1];if(Q)j(Q.offset+Q.length,K.offset);j(K.offset+K.length,J.offset+J.length-1)}else j(K.offset+K.length,$[z+1]?.offset??K.offset+K.length);return s(G,W)}function C0(G,b,z,Z){let J=[],$=y1(G,J,{allowTrailingComma:!0});if(J.length||!$||typeof $!=="object"||Array.isArray($))throw Error("Invalid OpenCode config; refusing to overwrite it.");let K={formattingOptions:{insertSpaces:!/^\t+/m.test(G),tabSize:/^([ ]+)"/m.exec(G)?.[1]?.length??2,eol:G.includes(`\r
 `)?`\r
 `:`
-`}},q=G,U=Q[b];if(U!==void 0&&!Array.isArray(U))throw Error(`OpenCode ${b} must be an array.`);let Z=Array.isArray(U)?[...U]:[],D=Z.flatMap((x,X)=>F0(x)===z?[X]:[]),W=`${z}@${K}`;if(!D.length)q=a(q,D0(q,U===void 0?[b]:[b,Z.length],U===void 0?[W]:W,$));else{let x=D[0],X=Z[x],B=Array.isArray(X)?[W,...X.slice(1)]:X&&typeof X==="object"?{...X,package:W}:W;if(JSON.stringify(X)!==JSON.stringify(B))q=a(q,D0(q,[b,x],B,$));for(let j of D.slice(1).reverse())q=V0(q,b,j)}let F=b==="plugin"?"plugins":"plugin";if(Array.isArray(Q[F])){let x=Q[F];for(let X=x.length-1;X>=0;X--)if(F0(x[X])===z)q=V0(q,F,X)}return q}function i(G,b,z={}){let K=z.fs??_,{path:J,opencode:Q}=N(z),$=b==="2"?"plugins":"plugin";return(b==="2"?["opencode"]:["opencode","tui"]).map((U)=>{let Z=J.join(Q,`${U}.jsonc`),D=J.join(Q,`${U}.json`),W=K.exists(Z)?Z:K.exists(D)?D:Z,F=K.exists(W),x=F?K.readText(W):`${JSON.stringify({$schema:`https://opencode.ai/${U==="tui"?"tui":"config"}.json`},null,2)}
-`,X=X0(x,$,G.packages.opencode,G.version);return{path:W,content:X,changed:!F||X!==x}})}async function s(G,b){for(let z of G){if(!z.changed)continue;await b?.(),await x0(z.path,z.content,{beforeRename:b})}}async function r(G,b,z={}){let{platform:K,env:J}=N(z),Q=await g(z.runner??A,K,b,["install",`npm:${G.packages.pi}@${G.version}`],J);if(Q.exitCode!==0||Q.timedOut)throw new d({exitCode:Q.spawnError?null:Q.exitCode,signal:Q.signal??null,stderrTail:Q.stderr,stderrTruncated:Q.stderrTruncated??!1})}var O0="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function k2(G){let b={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let z of G)if(z==="--yes")b.yes=!0;else if(z==="--dry-run")b.dryRun=!0;else if(z==="--claustrum")b.claustrum=!0;else if(z==="--no-claustrum")b.noClaustrum=!0;else if(z==="--login")b.login=!0;else if(/^--opencode=(1|2|both)$/.test(z))b.opencode=z.slice(11);else throw Error(`Unknown setup argument: ${z}`);if(b.claustrum&&b.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(b.login&&b.claustrum)throw Error("--login and --claustrum cannot be used together.");return b}function w2(G){for(let b of Object.values(G.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(b))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(G.version))throw Error("Setup requires a concrete package version.");for(let b of Object.values(G.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(b.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function A2(G,b,z){let K=[];for(let J of b){let Q=z.get(J)??"not-enrolled";if(Q==="unknown"){let{name:$,paths:q}=G.vault.hosts[J],U=await c(L(q),$).catch(()=>"unreadable");if(U==="vault")Q="enrolled";else if(U==="local")Q="not-enrolled"}K.push({host:J,outcome:Q})}return K}async function n(G,b=[],z={}){let K=k2(b);w2(G);let J=z.terminal??j0(),Q=await p(G,z);O(J,`${G.displayName} setup`);for(let[V,H]of[["OpenCode",Q.opencode],["Pi",Q.pi]])O(J,`${V}: ${H.installed?`found (version ${H.version??"unknown"})`:"not found"} — ${H.directory}`);O(J,`Claustrum: ${Q.claustrum.available?"available":"not available"}`);let $=Q.pi.installed&&!Q.pi.executable;if($)O(J,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let q=["opencode","pi"].filter((V)=>Q[V].installed&&!(V==="pi"&&$)),U=K.yes||K.dryRun&&!E(J);if(!U&&!E(J))throw Error("Setup requires a TTY or --yes.");let Z=U?q:await W0(J,q)??[],D=K.opencode??(Q.opencode.generation==="ambiguous"?"1":Q.opencode.generation);if(Z.includes("opencode")&&!K.opencode&&Q.opencode.generation==="ambiguous"){if(U||!E(J))throw Error(O0);let V=await v(J,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(V===null)return{hosts:[],dryRun:K.dryRun,mode:"local",detection:Q};D=V}if(!Z.length)return O(J,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:Z,dryRun:K.dryRun,mode:"local",detection:Q};let{env:W,platform:F}=N(z),x=z.fence??S(z.runner??A,{platform:F}),X=async()=>{try{await y(x,W)}catch(V){if(V instanceof Y)O(J,V.refusalText);throw V}};if(O(J,"Checking that OpenCode and Pi are not running…"),K.dryRun)try{let V=x.previewRunningHosts?await x.previewRunningHosts(W):{hosts:await x.listRunningHosts(W),uncheckedRuntimes:0},H=V.hosts;if(V.uncheckedRuntimes>0)O(J,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let C=new Set(new T(H).activeHosts.map((w)=>w.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let w of C)O(J,`${w} is running; setup will ask you to quit it.`)}catch(V){if(O(J,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),V instanceof Y)O(J,V.refusalText)}else await X();if(K.claustrum&&!Q.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let B=Boolean(K.claustrum);if(!B&&!K.login&&!K.noClaustrum&&!U&&Q.claustrum.available&&E(J)){let V=await v(J,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(V===null)return O(J,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:K.dryRun,mode:"local",detection:Q};B=V===!0}let j=B?"claustrum":"local",R=Z.includes("opencode")?i(G,D,z):[];if(K.dryRun){O(J,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let V of Z){if(G.beforeSignIn)O(J,`Would run beforeSignIn(${V}, ${j}).`);if(B){let H=L(G.vault.hosts[V].paths);O(J,`Would Connect ${V}: write ${H.statePath} and ${H.tokenPath}; wait for ck auth enroll approve.`)}else O(J,`Would sign in locally for ${V}.`);if(G.beforeRegister)O(J,`Would run beforeRegister(${V}, ${j}).`)}for(let V of R)O(J,`${V.changed?"Would write":"Unchanged"} ${V.path}:
-${V.content}`);if(Z.includes("pi"))O(J,`Would run ${Q.pi.executable} install npm:${G.packages.pi}@${G.version}`);for(let V of Z)O(J,`Would migrate ${V} using the plugin callback (provider-specific writes).`)}else{let V={opencodeGeneration:D,mode:j,hosts:Object.freeze([...Z]),piAgentDir:Q.pi.directory},H=new Map;try{for(let C of Z){if(await X(),await G.beforeSignIn?.(C,V),await X(),B){H.set(C,"unknown");try{await U0(G,C,z,J,X)}catch(w){if(w instanceof I)H.set(C,"not-enrolled");throw w}H.set(C,"enrolled")}else await G.signInLocal(C,V);if(await X(),await G.beforeRegister?.(C,j,V),await X(),C==="opencode")await s(R,X);else await r(G,Q.pi.executable,z);await X(),await G.migrate(C,V)}}catch(C){if(H.size===0)throw C;try{let w=await A2(G,Z,H);b0(C,w);for(let L0 of w)O(J,G0(L0))}catch{}throw C}}return O(J,`${K.dryRun?"Planned":"Configured"} ${G.displayName} for ${Z.join(", ")} (${j}).`),O(J,`Next: ${Z.includes("opencode")?"start OpenCode":"start Pi"} and run ${G.slashCommand}.`),{hosts:Z,dryRun:K.dryRun,mode:j,detection:Q}}import{basename as S2}from"node:path";import{resolveClaustrumConnectionPath as y2}from"@cortexkit/claustrum-client";var B0={name:"@cortexkit/pi-openai-auth",version:"1.4.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.23.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.12.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};import{homedir as _2}from"node:os";import{join as H0}from"node:path";function T2(){return process.env.PI_AGENT_DIR?.trim()||H0(_2(),".pi","agent")}function M0(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||H0(T2(),Y0)}function L2(G=M0()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||C0(G)}function N0(G=M0()){return{configPath:G,statePath:L2(G)}}var P={name:"@cortexkit/opencode-openai-auth",version:"1.4.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/opencode"},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{"opencode-openai-auth":"./dist/bin.js"},exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./tui":{types:"./dist/tui.d.ts",import:"./src/tui/entry.mjs"},"./tui-prefs":{types:"./dist/tui-preferences.d.ts",import:"./dist/tui-preferences.js"},"./server":{types:"./dist/v2/server.d.ts",import:"./dist/v2/server.js"}},"oc-plugin":["server","tui"],engines:{bun:"1.3.14"},files:["dist","src/tui/entry.mjs","src/tui-compiled","README.md","LICENSE"],scripts:{build:"rm -rf dist && bun build src/index.ts src/v2/server.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts src/bin.ts --root src --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/private-files --external jsonc-parser --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types && bun run build:tui","build:tui":"bun scripts/build-tui.ts","build:types":"cd ../core && bun run build && cd ../opencode && tsdown --config tsdown.config.ts --config-loader native","build:dev":"rm -rf dist && tsc -p tsconfig.build.json",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},peerDependencies:{"@opencode-ai/plugin":"*","@opencode/plugin":">=2.0.21"},peerDependenciesMeta:{"@opencode/plugin":{optional:!0}},devDependencies:{"@ai-sdk/openai":"3.0.88","@cortexkit/common-auth":"^0.23.0","@cortexkit/openai-auth-core":"workspace:*","@opencode/plugin":"2.0.32"},dependencies:{"@cortexkit/claustrum-client":"^0.12.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0","@opentui/core":">=0.6.1","@opentui/solid":">=0.6.1",ai:"^7.0.143","jsonc-parser":"^3.3.1","solid-js":"1.9.12"}};function T0(G={}){let b=G.print??console.log,z=G.fence??S(),K={opencode:{stateDir:o(A0().statePath),host:"opencode"},pi:{stateDir:o(N0().statePath),host:"pi"}},J=async(Q)=>{if(await c(L(K[Q]),f(Q))!=="local")throw Error(`${Q} is enrolled in Claustrum or its enrollment is unreadable. Disconnect it from the vault before using local sign-in.`)};return{packages:{opencode:P.name,pi:B0.name},version:P.version,displayName:"OpenAI Auth",slashCommand:"/openai",vault:{connectionFile:y2(),hosts:{opencode:{name:f("opencode"),paths:K.opencode},pi:{name:f("pi"),paths:K.pi}}},async beforeRegister(Q,$){if($==="claustrum"){if(b(`Allow this host to read OpenAI accounts with:
-  ck auth grant --principal enrolled:${f(Q)} --selector-kind category --selector ${k0.category} --operation read`),Q==="opencode")b("Then run opencode auth login and choose ChatGPT accounts in the vault to activate vault routing without local sign-in.");return}await J(Q)},async signInLocal(Q,$){if(await J(Q),Q==="pi"){b("Start Pi and run /login openai-codex to sign in with Pi itself.");return}if($.opencodeGeneration!=="1"){let j=S2(k("opencode2",G.io)??k("opencode",G.io)??"opencode");b(`In OpenCode 2, run ${j} auth login openai and choose "ChatGPT (openai-auth pool, browser)" or "ChatGPT (openai-auth pool, headless)" to sign in to the account pool and activate it.`)}if($.opencodeGeneration==="2")return;if(I0(process.env))throw Error("Unset OPENCODE_AUTH_CONTENT before local setup sign-in.");let q=_0(),U={path:{id:"openai"}};if(await q.get(U)!==void 0){b("OpenCode already has an OpenAI login. Use opencode auth login to change it.");return}let Z=G.beginLogin??R0,D=new AbortController,W=Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY||process.platform==="linux"&&!process.env.DISPLAY&&!process.env.WAYLAND_DISPLAY),F={version:P.version,signal:D.signal},x,X=!W;try{x=await Z({...F,headless:W})}catch(j){if(W)throw j;X=!1,b("Browser callback unavailable; using device-code sign-in."),x=await Z({version:P.version,headless:!0})}if(X){if(!(G.openBrowser??w0)(x.url))D.abort(),await x.completion.catch(()=>{}),b("Browser unavailable; using device-code sign-in."),x=await Z({version:P.version,headless:!0})}b(`${x.url}
-${x.instructions}`);let B=await x.completion;await y(z),await J(Q),await q.set({...U,body:{type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires,...B.accountId?{accountId:B.accountId}:{}}}),b("Signed in to OpenCode. The first plugin start adopts this login into the account pool.")},async migrate(Q){b(`${Q}: account migration runs on first plugin start; setup leaves existing credentials unchanged.`)}}}if(process.argv[2]!=="setup")console.log("Usage: opencode-openai-auth setup [options]");else try{await n(T0(),process.argv.slice(3))}catch(G){console.error(G instanceof Error?G.message:String(G)),process.exitCode=1}
+`}},W=G,j=$[b];if(j!==void 0&&!Array.isArray(j))throw Error(`OpenCode ${b} must be an array.`);let Q=Array.isArray(j)?[...j]:[],D=Q.flatMap((x,X)=>M0(x)===z?[X]:[]),U=`${z}@${Z}`;if(!D.length)W=s(W,O0(W,j===void 0?[b]:[b,Q.length],j===void 0?[U]:U,K));else{let x=D[0],X=Q[x],B=Array.isArray(X)?[U,...X.slice(1)]:X&&typeof X==="object"?{...X,package:U}:U;if(JSON.stringify(X)!==JSON.stringify(B))W=s(W,O0(W,[b,x],B,K));for(let F of D.slice(1).reverse())W=k0(W,b,F)}let V=b==="plugin"?"plugins":"plugin";if(Array.isArray($[V])){let x=$[V];for(let X=x.length-1;X>=0;X--)if(M0(x[X])===z)W=k0(W,V,X)}return W}function r(G,b,z={}){let Z=z.fs??_,{path:J,opencode:$}=R(z),K=b==="2"?"plugins":"plugin";return(b==="2"?["opencode"]:["opencode","tui"]).map((j)=>{let Q=J.join($,`${j}.jsonc`),D=J.join($,`${j}.json`),U=Z.exists(Q)?Q:Z.exists(D)?D:Q,V=Z.exists(U),x=V?Z.readText(U):`${JSON.stringify({$schema:`https://opencode.ai/${j==="tui"?"tui":"config"}.json`},null,2)}
+`,X=C0(x,K,G.packages.opencode,G.version);return{path:U,content:X,changed:!V||X!==x}})}async function n(G,b){for(let z of G){if(!z.changed)continue;await b?.(),await H0(z.path,z.content,{beforeRename:b})}}async function o(G,b,z={}){let{platform:Z,env:J}=R(z),$=await g(z.runner??I,Z,b,["install",`npm:${G.packages.pi}@${G.version}`],J);if($.exitCode!==0||$.timedOut)throw new m({exitCode:$.spawnError?null:$.exitCode,signal:$.signal??null,stderrTail:$.stderr,stderrTruncated:$.stderrTruncated??!1})}var R0="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function P1(G){let b={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let z of G)if(z==="--yes")b.yes=!0;else if(z==="--dry-run")b.dryRun=!0;else if(z==="--claustrum")b.claustrum=!0;else if(z==="--no-claustrum")b.noClaustrum=!0;else if(z==="--login")b.login=!0;else if(/^--opencode=(1|2|both)$/.test(z))b.opencode=z.slice(11);else throw Error(`Unknown setup argument: ${z}`);if(b.claustrum&&b.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(b.login&&b.claustrum)throw Error("--login and --claustrum cannot be used together.");return b}function v1(G){for(let b of Object.values(G.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(b))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(G.version))throw Error("Setup requires a concrete package version.");for(let b of Object.values(G.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(b.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function E1(G,b,z){let Z=[];for(let J of b){let $=z.get(J)??"not-enrolled";if($==="unknown"){let{name:K,paths:W}=G.vault.hosts[J],j=await d(L(W),K).catch(()=>"unreadable");if(j==="vault")$="enrolled";else if(j==="local")$="not-enrolled"}Z.push({host:J,outcome:$})}return Z}async function t(G,b=[],z={}){let Z=P1(b);v1(G);let J=z.terminal??N0(),$=await p(G,z);Y(J,`${G.displayName} setup`);for(let[q,O]of[["OpenCode",$.opencode],["Pi",$.pi]])Y(J,`${q}: ${O.installed?`found (version ${O.version??"unknown"})`:"not found"} — ${O.directory}`);Y(J,`Claustrum: ${$.claustrum.available?"available":"not available"}`);let K=$.pi.installed&&!$.pi.executable;if(K)Y(J,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let W=["opencode","pi"].filter((q)=>$[q].installed&&!(q==="pi"&&K)),j=Z.yes||Z.dryRun&&!E(J);if(!j&&!E(J))throw Error("Setup requires a TTY or --yes.");let Q=j?W:await B0(J,W)??[],D=Z.opencode??($.opencode.generation==="ambiguous"?"1":$.opencode.generation);if(Q.includes("opencode")&&!Z.opencode&&$.opencode.generation==="ambiguous"){if(j||!E(J))throw Error(R0);let q=await v(J,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(q===null)return{hosts:[],dryRun:Z.dryRun,mode:"local",detection:$};D=q}if(!Q.length)return Y(J,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:Q,dryRun:Z.dryRun,mode:"local",detection:$};let{env:U,platform:V}=R(z),x=z.fence??S(z.runner??I,{platform:V}),X=async()=>{try{await P(x,U)}catch(q){if(q instanceof H)Y(J,q.refusalText);throw q}};if(Y(J,"Checking that OpenCode and Pi are not running…"),Z.dryRun)try{let q=x.previewRunningHosts?await x.previewRunningHosts(U):{hosts:await x.listRunningHosts(U),uncheckedRuntimes:0},O=q.hosts;if(q.uncheckedRuntimes>0)Y(J,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let M=new Set(new T(O).activeHosts.map((C)=>C.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let C of M)Y(J,`${C} is running; setup will ask you to quit it.`)}catch(q){if(Y(J,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),q instanceof H)Y(J,q.refusalText)}else await X();if(Z.claustrum&&!$.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let B=Boolean(Z.claustrum);if(!B&&!Z.login&&!Z.noClaustrum&&!j&&$.claustrum.available&&E(J)){let q=await v(J,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(q===null)return Y(J,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:Z.dryRun,mode:"local",detection:$};B=q===!0}let F=B?"claustrum":"local",k=Q.includes("opencode")?r(G,D,z):[];if(Z.dryRun){Y(J,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let q of Q){if(G.beforeSignIn)Y(J,`Would run beforeSignIn(${q}, ${F}).`);if(B){let O=L(G.vault.hosts[q].paths);Y(J,`Would Connect ${q}: write ${O.statePath} and ${O.tokenPath}; wait for ck auth enroll approve.`)}else Y(J,`Would sign in locally for ${q}.`);if(G.beforeRegister)Y(J,`Would run beforeRegister(${q}, ${F}).`)}for(let q of k)Y(J,`${q.changed?"Would write":"Unchanged"} ${q.path}:
+${q.content}`);if(Q.includes("pi"))Y(J,`Would run ${$.pi.executable} install npm:${G.packages.pi}@${G.version}`);for(let q of Q)Y(J,`Would migrate ${q} using the plugin callback (provider-specific writes).`)}else{let q={opencodeGeneration:D,mode:F,hosts:Object.freeze([...Q]),piAgentDir:$.pi.directory},O=new Map;try{for(let M of Q){if(await X(),await G.beforeSignIn?.(M,q),await X(),B){O.set(M,"unknown");try{await Y0(G,M,z,J,X)}catch(C){if(C instanceof A)O.set(M,"not-enrolled");throw C}O.set(M,"enrolled")}else await G.signInLocal(M,q);if(await X(),await G.beforeRegister?.(M,F,q),await X(),M==="opencode")await n(k,X);else await o(G,$.pi.executable,z);await X(),await G.migrate(M,q)}}catch(M){if(O.size===0)throw M;try{let C=await E1(G,Q,O);J0(M,C);for(let m0 of C)Y(J,z0(m0))}catch{}throw M}}return Y(J,`${Z.dryRun?"Planned":"Configured"} ${G.displayName} for ${Q.join(", ")} (${F}).`),Y(J,`Next: ${Q.includes("opencode")?"start OpenCode":"start Pi"} and run ${G.slashCommand}.`),{hosts:Q,dryRun:Z.dryRun,mode:F,detection:$}}import{basename as c1}from"node:path";import{resolveClaustrumConnectionPath as u1}from"@cortexkit/claustrum-client";var A0={name:"@cortexkit/pi-openai-auth",version:"1.6.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.26.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.13.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};import{homedir as g1}from"node:os";import{join as _0}from"node:path";function m1(){return process.env.PI_AGENT_DIR?.trim()||_0(g1(),".pi","agent")}function T0(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||_0(m1(),w0)}function h1(G=T0()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||I0(G)}function L0(G=T0()){return{configPath:G,statePath:h1(G)}}var y={name:"@cortexkit/opencode-openai-auth",version:"1.6.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/opencode"},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{"opencode-openai-auth":"./dist/bin.js"},exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./tui":{types:"./dist/tui.d.ts",import:"./src/tui/entry.mjs"},"./tui-prefs":{types:"./dist/tui-preferences.d.ts",import:"./dist/tui-preferences.js"},"./server":{types:"./dist/v2/server.d.ts",import:"./dist/v2/server.js"}},"oc-plugin":["server","tui"],engines:{bun:"1.3.14"},files:["dist","src/tui/entry.mjs","src/tui-compiled","README.md","LICENSE"],scripts:{build:"rm -rf dist && bun build src/index.ts src/v2/server.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts src/bin.ts --root src --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/private-files --external jsonc-parser --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types && bun run build:tui","build:tui":"bun scripts/build-tui.ts","build:types":"cd ../core && bun run build && cd ../opencode && tsdown --config tsdown.config.ts --config-loader native","build:dev":"rm -rf dist && tsc -p tsconfig.build.json",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},peerDependencies:{"@opencode-ai/plugin":"*","@opencode/plugin":">=2.0.21"},peerDependenciesMeta:{"@opencode/plugin":{optional:!0}},devDependencies:{"@ai-sdk/openai":"3.0.88","@cortexkit/common-auth":"^0.26.0","@cortexkit/openai-auth-core":"workspace:*","@opencode/plugin":"2.0.32"},dependencies:{"@cortexkit/claustrum-client":"^0.13.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0","@opentui/core":">=0.6.1","@opentui/solid":">=0.6.1",ai:"^7.0.143","jsonc-parser":"^3.3.1","solid-js":"1.9.12"}};function g0(G={}){let b=G.print??console.log,z=G.fence??S(),Z={opencode:{stateDir:e(v0().statePath),host:"opencode"},pi:{stateDir:e(L0().statePath),host:"pi"}},J=async($)=>{if(await d(L(Z[$]),f($))!=="local")throw Error(`${$} is enrolled in Claustrum or its enrollment is unreadable. Disconnect it from the vault before using local sign-in.`)};return{packages:{opencode:y.name,pi:A0.name},version:y.version,displayName:"OpenAI Auth",slashCommand:"/openai",vault:{connectionFile:u1(),hosts:{opencode:{name:f("opencode"),paths:Z.opencode},pi:{name:f("pi"),paths:Z.pi}}},async beforeRegister($,K){if(K==="claustrum"){if(b(`Allow this host to read OpenAI accounts with:
+  ck auth grant --principal enrolled:${f($)} --selector-kind category --selector ${S0.category} --operation read`),$==="opencode")b("Then run opencode auth login and choose ChatGPT accounts in the vault to activate vault routing without local sign-in.");return}await J($)},async signInLocal($,K){if(await J($),$==="pi"){b("Start Pi and run /login openai-codex to sign in with Pi itself.");return}if(K.opencodeGeneration!=="1"){let F=c1(w("opencode2",G.io)??w("opencode",G.io)??"opencode");b(`In OpenCode 2, run ${F} auth login openai and choose "ChatGPT (openai-auth pool, browser)" or "ChatGPT (openai-auth pool, headless)" to sign in to the account pool and activate it.`)}if(K.opencodeGeneration==="2")return;if(E0(process.env))throw Error("Unset OPENCODE_AUTH_CONTENT before local setup sign-in.");let W=f0(),j={path:{id:"openai"}};if(await W.get(j)!==void 0){b("OpenCode already has an OpenAI login. Use opencode auth login to change it.");return}let Q=G.beginLogin??y0,D=new AbortController,U=Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY||process.platform==="linux"&&!process.env.DISPLAY&&!process.env.WAYLAND_DISPLAY),V={version:y.version,signal:D.signal},x,X=!U;try{x=await Q({...V,headless:U})}catch(F){if(U)throw F;X=!1,b("Browser callback unavailable; using device-code sign-in."),x=await Q({version:y.version,headless:!0})}if(X){if(!(G.openBrowser??P0)(x.url))D.abort(),await x.completion.catch(()=>{}),b("Browser unavailable; using device-code sign-in."),x=await Q({version:y.version,headless:!0})}b(`${x.url}
+${x.instructions}`);let B=await x.completion;await P(z),await J($),await W.set({...j,body:{type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires,...B.accountId?{accountId:B.accountId}:{}}}),b("Signed in to OpenCode. The first plugin start adopts this login into the account pool.")},async migrate($){b(`${$}: account migration runs on first plugin start; setup leaves existing credentials unchanged.`)}}}if(process.argv[2]!=="setup")console.log("Usage: opencode-openai-auth setup [options]");else try{await t(g0(),process.argv.slice(3))}catch(G){console.error(G instanceof Error?G.message:String(G)),process.exitCode=1}

package/dist/{codex-request-hw0XcldE.d.ts → codex-request-D_In8uaR.d.ts}

@@ -1,8 +1,8 @@
-import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-DphbMQce.js";
-import { _t as QuotaMap } from "./sidebar-state-pTd9gg9W.js";
+import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-D22uj0OB.js";
+import { _t as QuotaMap } from "./sidebar-state-Bb9L9oPq.js";
 import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import "@cortexkit/private-files";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -191,7 +191,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -238,12 +238,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -278,7 +278,7 @@ type RefreshFileLockOptions = {
 /** Filesystem leases share wall time across all callers and processes. */
 declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -310,7 +310,7 @@ interface LockEnvironment {
   }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -345,11 +345,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -372,7 +372,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -588,7 +588,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -624,7 +624,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -667,7 +667,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -678,7 +678,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -741,7 +741,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -785,13 +785,26 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
   configPath: string;
   statePath: string;
   quota: QuotaCodec;
+  /**
+   * Opt in to detached, coalesced quota publication, with any `quota` codec.
+   * Each accepted observation is queued whole for its row and binding, and
+   * the queue is applied in arrival order through `quota.merge` under the
+   * store locks, so the codec's own merge decides which fields a newer or
+   * older reading replaces. Accepted readings appear in read/load
+   * immediately, merged the same way; the returned promise still rejects
+   * current-row refusals before queueing. Await dispose or close at shutdown
+   * to drain.
+   */
+  coalesceQuota?: boolean;
+  /** Bounded quota drain on close/dispose, in milliseconds; defaults to 1,000. */
+  quotaDrainTimeoutMs?: number;
   /**
    * The codec of the provider state kept beside each row's credential (see
    * `ProviderStateCodec`). Without it no row shows a provider state, and
@@ -965,19 +978,23 @@ interface PoolStore {
   }>;
   refresh(id: string, provider: ProviderRefresh, options?: RefreshOptions): Promise<RefreshOutcome>;
   recordQuota(id: string, attribution: Attribution, observation: unknown): Promise<void>;
+  /** Drain opted-in quota publication; subsequent coalesced readings refuse. Idempotent. */
+  close(): Promise<void>;
+  /** Same bounded quota drain as close(). Does not wait for provider pull hooks. */
+  dispose(): Promise<void>;
   /** Fires a pull for a row admission refused for want of a reading. */
   requestReading(id: string): void;
   /** Resolves once every pull fired so far has settled. */
   pullsSettled(): Promise<void>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
 /** Where a dropped field is reported. Names only, never values. */
 interface SeamLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
 /**
  * What a plugin's login hands back. `ready` adds the account now. `pending`
  * means the user must finish somewhere else (a browser, a device code):
@@ -1097,7 +1114,7 @@ interface BeginAccountLoginResult {
  */
 declare function beginAccountLogin(opts: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/watch.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/watch.d.ts
 /**
  * How a host currently learns about changes, for logs and status displays.
  * `watching`: a watch was accepted and is open, so polling is reduced to a
@@ -1151,7 +1168,7 @@ interface ScopedWatchSource {
   }): ScopedWatchHandle;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
 /**
  * A held-open `usage.watch` stream. `closed` resolves when insula ends the
  * stream (STREAM_END at shutdown, or a reply that ends it) or after `stop()`,
@@ -1175,7 +1192,7 @@ interface InsulaUsageTransport {
   watchUsage?(onNotice: (body: Uint8Array) => void): InsulaUsageWatch;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
 /**
  * `watchScoped` is present from claustrum-client 0.12.0. Hosts detect it at
  * run time and keep polling without it.
@@ -1280,7 +1297,7 @@ interface KeptReceiptState {
   readonly since: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1299,7 +1316,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1347,6 +1364,12 @@ interface VaultRosterFile {
   rows: VaultRosterRow[];
   declined: DeclinedAccount[];
 }
+interface ReorderVaultRosterResult {
+  /** The route id order now on disk. */
+  ids: string[];
+  /** `unchanged` when the roster was already in this order; nothing was written. */
+  outcome: 'reordered' | 'unchanged';
+}
 /**
  * The receipt fields a quota or profile observation must carry to say which
  * send (credential and account) it came from. Pass the
@@ -1354,7 +1377,7 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.d.ts
 /**
  * How a started consumer learns about changes, for logs and status displays.
  * `insula` is present when the consumer was given an insula source. Never
@@ -1365,7 +1388,7 @@ interface ClaustrumWatchState {
   readonly insula?: WatchMode;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.26.0+edd79cef82a5b402/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -1610,6 +1633,8 @@ declare class OpenAiVault {
     ok: boolean;
     error?: string;
   }>>;
+  /** Reorders this host's vault roster without touching its local accounts. */
+  reorder(routeIds: readonly string[]): Promise<ReorderVaultRosterResult>;
   /** Declines a vault account: it stays listed and never routes until accepted. */
   decline(routeId: string): Promise<void>;
   accept(routeId: string): Promise<void>;
@@ -1644,7 +1669,7 @@ declare class OpenAiVault {
 }
 //#endregion
 //#region ../core/dist/vault-account-menu.d.ts
-type MenuVault = Pick<OpenAiVault, 'authority' | 'refresh' | 'status' | 'identities' | 'routes' | 'pollQuota' | 'snapshot'>;
+type MenuVault = Pick<OpenAiVault, 'authority' | 'refresh' | 'status' | 'identities' | 'routes' | 'pollQuota' | 'snapshot' | 'reorder'>;
 //#endregion
 //#region ../core/dist/commands.d.ts
 /**