@desplega.ai/agent-swarm 1.152.2 → 1.153.0

package/dist/cli-7g9s78jf.js

@@ -0,0 +1,2827 @@
+import {
+  getValidCodexOAuth,
+  persistCodexOAuth
+} from "./cli-e7d20cty.js";
+import {
+  GITHUB_COPILOT_MODELS,
+  builtinModels,
+  getEnvApiKey,
+  normalizeRadiusGatewayUrl,
+  registerBundledOAuthFlowLoaders
+} from "./cli-d6hk10xx.js";
+import {
+  init_zod
+} from "./cli-sd0mxa3c.js";
+import {
+  exports_external
+} from "./cli-w5e1d1vv.js";
+import {
+  getProviderEnvValue
+} from "./cli-btbzvq95.js";
+import {
+  InMemoryCredentialStore
+} from "./cli-mcnhgnn1.js";
+import {
+  __require
+} from "./cli-bc05qbss.js";
+
+// src/be/memory/raters/llm.ts
+init_zod();
+
+// src/be/memory/raters/llm-client.ts
+var DEFAULT_TIMEOUT_MS = 30000;
+var PROMPT_TEMPLATE = `You are scoring the usefulness of one retrieved memory.
+
+Return ONLY a JSON object with these fields (no prose, no markdown):
+{
+  "score": number,        // 0 = misleading/unhelpful, 1 = highly useful
+  "reasoning": string     // 1..500 chars, why
+}
+
+QUERY:
+\${query}
+
+MEMORY:
+id: \${memoryId}
+name: \${memoryName}
+content: \${memoryContent}
+
+AGENT RESPONSE / SUMMARY:
+\${response}
+
+Score 0..1.`;
+var PLACEHOLDER_PREFIX = "$";
+var QUERY_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{query}`;
+var MEMORY_ID_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{memoryId}`;
+var MEMORY_NAME_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{memoryName}`;
+var MEMORY_CONTENT_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{memoryContent}`;
+var RESPONSE_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{response}`;
+function buildPrompt(input) {
+  return PROMPT_TEMPLATE.replace(QUERY_PLACEHOLDER, input.query).replace(MEMORY_ID_PLACEHOLDER, input.memory.id).replace(MEMORY_NAME_PLACEHOLDER, input.memory.name).replace(MEMORY_CONTENT_PLACEHOLDER, input.memory.content).replace(RESPONSE_PLACEHOLDER, input.response);
+}
+function parseScoreAndReasoning(raw) {
+  if (typeof raw !== "string")
+    return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.trim());
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object")
+    return null;
+  const obj = parsed;
+  const score = typeof obj.score === "number" ? obj.score : null;
+  const reasoning = typeof obj.reasoning === "string" ? obj.reasoning : null;
+  if (score == null || reasoning == null)
+    return null;
+  if (!Number.isFinite(score) || score < 0 || score > 1)
+    return null;
+  if (reasoning.length === 0 || reasoning.length > 500)
+    return null;
+  return { score, reasoning };
+}
+
+class ClaudeCliLlmRaterClient {
+  model;
+  timeoutMs;
+  constructor(opts = {}) {
+    this.model = opts.model ?? process.env.MEMORY_LLM_RATER_MODEL ?? "haiku";
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  }
+  async rate(input) {
+    const prompt = buildPrompt(input);
+    const tmpFile = `/tmp/llm-rater-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`;
+    let stdout = "";
+    try {
+      await Bun.write(tmpFile, prompt);
+      const proc = Bun.spawn(["bash", "-c", `cat "${tmpFile}" | claude -p --model ${this.model} --output-format json`], {
+        stdout: "pipe",
+        stderr: "pipe",
+        env: { ...process.env, SKIP_SESSION_SUMMARY: "1" }
+      });
+      const timeoutId = setTimeout(() => proc.kill(), this.timeoutMs);
+      stdout = await new Response(proc.stdout).text();
+      clearTimeout(timeoutId);
+    } catch (err) {
+      console.error("[memory-rater:llm] claude -p shell-out failed:", err.message);
+      return null;
+    } finally {
+      try {
+        await Bun.$`rm -f ${tmpFile}`.quiet();
+      } catch {}
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(stdout);
+    } catch {
+      return null;
+    }
+    return parseScoreAndReasoning(envelope.result);
+  }
+}
+
+// src/be/memory/raters/types.ts
+var REFERENCES_SOURCE_MAX_LENGTH = 512;
+var NUL_CHAR_CODE = 0;
+var DEL_CHAR_CODE = 127;
+var FIRST_PRINTABLE_ASCII = 32;
+function sanitizeReferencesSource(input) {
+  let stripped = "";
+  for (let i = 0;i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    if (code === NUL_CHAR_CODE)
+      return null;
+    if (code < FIRST_PRINTABLE_ASCII || code === DEL_CHAR_CODE) {
+      continue;
+    }
+    stripped += input[i];
+  }
+  if (stripped.length === 0)
+    return null;
+  return stripped;
+}
+
+// src/be/memory/raters/llm.ts
+var LLM_RATER_WEIGHT = 0.8;
+var RatingSchema = exports_external.object({
+  id: exports_external.string().min(1),
+  score: exports_external.number().min(0).max(1),
+  reasoning: exports_external.string().min(1).max(500),
+  referencesSource: exports_external.string().min(1).max(REFERENCES_SOURCE_MAX_LENGTH).optional()
+});
+var SummaryWithRatingsSchema = exports_external.object({
+  summary: exports_external.string(),
+  ratings: exports_external.array(RatingSchema).default([])
+});
+var BASE_SUMMARIZE_PROMPT = `You are summarizing an AI agent's work session. Extract ONLY high-value learnings.
+
+DO NOT include:
+- Generic descriptions of what was done ("worked on task X")
+- Tool calls or file reads
+- Routine progress updates
+
+DO include (if present):
+- **Mistakes made and corrections** — what went wrong and what fixed it
+- **Discovered patterns** — reusable approaches, APIs, or codebase conventions
+- **Codebase knowledge** — important file paths, architecture decisions, gotchas
+- **Environment knowledge** — service URLs, config details, tool quirks
+- **Failed approaches** — what was tried and didn't work (and why)
+
+Format as a bulleted list of concrete, reusable facts. If the session was routine with no significant learnings, respond with exactly: "No significant learnings."`;
+
+class LlmRater {
+  client;
+  name = "llm";
+  constructor(client = new ClaudeCliLlmRaterClient) {
+    this.client = client;
+  }
+  async rate(ctx) {
+    const enriched = ctx;
+    if (enriched.retrievedMemoryIds.length === 0)
+      return [];
+    const memories = enriched.retrievedMemories;
+    if (!memories || memories.length === 0)
+      return [];
+    const events = [];
+    for (const memoryId of enriched.retrievedMemoryIds) {
+      const memory = memories.find((m) => m.id === memoryId);
+      if (!memory)
+        continue;
+      let result;
+      try {
+        result = await this.client.rate({
+          query: enriched.query ?? "",
+          memory,
+          response: enriched.response ?? enriched.evidence ?? ""
+        });
+      } catch (err) {
+        console.error(`[memory-rater:llm] client.rate threw for memoryId=${memoryId}:`, err.message);
+        continue;
+      }
+      if (!result)
+        continue;
+      events.push({
+        memoryId,
+        signal: 2 * result.score - 1,
+        weight: LLM_RATER_WEIGHT,
+        source: "",
+        reasoning: result.reasoning
+      });
+    }
+    return events;
+  }
+}
+function buildRatingsFromLlm(ratings, retrievals) {
+  const allowed = new Set(retrievals.map((r) => r.id));
+  const events = [];
+  for (const r of ratings) {
+    if (!allowed.has(r.id))
+      continue;
+    let cleanedReferencesSource;
+    if (r.referencesSource !== undefined) {
+      const cleaned = sanitizeReferencesSource(r.referencesSource);
+      if (cleaned !== null) {
+        cleanedReferencesSource = cleaned;
+      }
+    }
+    events.push({
+      memoryId: r.id,
+      signal: 2 * r.score - 1,
+      weight: LLM_RATER_WEIGHT,
+      source: "llm",
+      reasoning: r.reasoning,
+      ...cleanedReferencesSource !== undefined ? { referencesSource: cleanedReferencesSource } : {}
+    });
+  }
+  return events;
+}
+var RETRIEVAL_PROMPT_CONTENT_CAP = 600;
+function buildSummaryWithRatingsPrompt(basePrompt, retrievals) {
+  if (retrievals.length === 0)
+    return basePrompt;
+  const memoryBlock = retrievals.map((m, i) => {
+    const content = m.content.length > RETRIEVAL_PROMPT_CONTENT_CAP ? `${m.content.slice(0, RETRIEVAL_PROMPT_CONTENT_CAP)}…` : m.content;
+    return `Memory #${i + 1}
+  id: ${m.id}
+  name: ${m.name}
+  content: ${content}`;
+  }).join(`
+
+`);
+  return `${basePrompt}
+
+CRITICAL: Your entire response MUST be a single JSON object that conforms to the schema below. Do NOT wrap it in triple-backtick fences (no \`\`\`json or \`\`\`), do NOT add a prose preamble, do NOT add trailing commentary. Just the JSON object, nothing else.
+
+Schema:
+{
+  "summary": string,                        // your existing summary text
+  "ratings": [                              // one entry per memory you can score
+    {
+      "id": string,                         // memory id, copied from the list below
+      "score": number,                      // 0 = misleading/unhelpful, 1 = highly useful
+      "reasoning": string,                  // 1..500 chars, why
+      "referencesSource": string            // OPTIONAL — see note below
+    }
+  ]
+}
+
+Score ONLY memories present in the list below. Use the exact ids. Omit any you cannot evaluate.
+
+Optionally for each rating, if the memory clearly references a specific external source (a GitHub PR/issue, a Linear issue, a customer, a Slack thread, an AgentMail thread, etc.), include a \`referencesSource\` string using the convention "<source>:<identifier>" (e.g. "github:owner/repo#N", "linear:KEY-N", "customer:<slug>"). Any prefix is fine — pick what matches the source. Omit the field if no clear external source.
+
+Memories retrieved during this session:
+
+${memoryBlock}`;
+}
+function isLlmRaterEnabled() {
+  const raw = process.env.MEMORY_RATERS;
+  if (!raw || raw.trim() === "")
+    return false;
+  return raw.split(",").map((s) => s.trim()).includes("llm");
+}
+function dedupeRetrievalsForRater(rows) {
+  const seenSchedules = new Set;
+  const out = [];
+  for (const row of rows) {
+    const scheduleId = row.scheduleId;
+    if (typeof scheduleId === "string" && scheduleId.length > 0) {
+      if (seenSchedules.has(scheduleId))
+        continue;
+      seenSchedules.add(scheduleId);
+    }
+    out.push(row);
+  }
+  return out;
+}
+async function fetchRetrievalsForTask(opts) {
+  const fetchFn = opts.fetchImpl ?? fetch;
+  try {
+    const url = `${opts.apiUrl}/api/memory/retrievals?taskId=${encodeURIComponent(opts.taskId)}`;
+    const res = await fetchFn(url, {
+      headers: {
+        "X-Agent-ID": opts.agentId,
+        ...opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {}
+      }
+    });
+    if (!res.ok) {
+      console.error(`[memory-rater:llm] GET /api/memory/retrievals failed: ${res.status} ${res.statusText}`);
+      return [];
+    }
+    const body = await res.json();
+    return body.results ?? [];
+  } catch (err) {
+    console.error("[memory-rater:llm] fetchRetrievalsForTask threw:", err.message);
+    return [];
+  }
+}
+async function postRatings(opts) {
+  if (opts.events.length === 0)
+    return { ok: true, status: 0 };
+  const fetchFn = opts.fetchImpl ?? fetch;
+  const events = opts.events.map((e) => ({
+    memoryId: e.memoryId,
+    signal: e.signal,
+    weight: e.weight,
+    source: e.source,
+    ...e.reasoning !== undefined ? { reasoning: e.reasoning } : {},
+    ...e.referencesSource !== undefined ? { referencesSource: e.referencesSource } : {},
+    ...opts.taskId ? { taskId: opts.taskId } : {}
+  }));
+  try {
+    const res = await fetchFn(`${opts.apiUrl}/api/memory/rate`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Agent-ID": opts.agentId,
+        ...opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {}
+      },
+      body: JSON.stringify({ events })
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      console.error(`[memory-rater:llm] POST /api/memory/rate failed: ${res.status} ${res.statusText} ${text.slice(0, 200)}`);
+    }
+    return { ok: res.ok, status: res.status };
+  } catch (err) {
+    console.error("[memory-rater:llm] postRatings threw:", err.message);
+    return { ok: false, status: 0 };
+  }
+}
+
+// src/utils/internal-ai/models.ts
+var DEFAULT_MODEL = {
+  openrouter: "openrouter/deepseek/deepseek-v4.1-flash",
+  anthropic: "anthropic/claude-haiku-4-5",
+  openai: "openai/gpt-6-luna",
+  "openai-codex": "openai-codex/gpt-6-luna",
+  "claude-cli": "haiku"
+};
+function resolveModelString(kind) {
+  return process.env.MEMORY_RATER_MODEL ?? DEFAULT_MODEL[kind];
+}
+function parseModelStr(modelStr) {
+  const idx = modelStr.indexOf("/");
+  if (idx < 0)
+    throw new Error(`invalid model string (no '/'): ${modelStr}`);
+  return [modelStr.slice(0, idx), modelStr.slice(idx + 1)];
+}
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/oauth-page.js
+var LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg>`;
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function renderPage(options) {
+  const title = escapeHtml(options.title);
+  const heading = escapeHtml(options.heading);
+  const message = escapeHtml(options.message);
+  const details = options.details ? escapeHtml(options.details) : undefined;
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>
+    :root {
+      --text: #fafafa;
+      --text-dim: #a1a1aa;
+      --page-bg: #09090b;
+      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+    }
+    * { box-sizing: border-box; }
+    html { color-scheme: dark; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      background: var(--page-bg);
+      color: var(--text);
+      font-family: var(--font-sans);
+      text-align: center;
+    }
+    main {
+      width: 100%;
+      max-width: 560px;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+    }
+    .logo {
+      width: 72px;
+      height: 72px;
+      display: block;
+      margin-bottom: 24px;
+    }
+    h1 {
+      margin: 0 0 10px;
+      font-size: 28px;
+      line-height: 1.15;
+      font-weight: 650;
+      color: var(--text);
+    }
+    p {
+      margin: 0;
+      line-height: 1.7;
+      color: var(--text-dim);
+      font-size: 15px;
+    }
+    .details {
+      margin-top: 16px;
+      font-family: var(--font-mono);
+      font-size: 13px;
+      color: var(--text-dim);
+      white-space: pre-wrap;
+      word-break: break-word;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="logo">${LOGO_SVG}</div>
+    <h1>${heading}</h1>
+    <p>${message}</p>
+    ${details ? `<div class="details">${details}</div>` : ""}
+  </main>
+</body>
+</html>`;
+}
+function oauthSuccessHtml(message) {
+  return renderPage({
+    title: "Authentication successful",
+    heading: "Authentication successful",
+    message
+  });
+}
+function oauthErrorHtml(message, details) {
+  return renderPage({
+    title: "Authentication failed",
+    heading: "Authentication failed",
+    message,
+    details
+  });
+}
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/pkce.js
+function base64urlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generatePKCE() {
+  const verifierBytes = new Uint8Array(32);
+  crypto.getRandomValues(verifierBytes);
+  const verifier = base64urlEncode(verifierBytes);
+  const encoder = new TextEncoder;
+  const data = encoder.encode(verifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
+  return { verifier, challenge };
+}
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/anthropic.js
+var nodeApis = null;
+var nodeApisPromise = null;
+var decode = (s) => atob(s);
+var CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+var CALLBACK_HOST = getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+var CALLBACK_PORT = 53692;
+var CALLBACK_PATH = "/callback";
+var REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+async function getNodeApis() {
+  if (nodeApis)
+    return nodeApis;
+  if (!nodeApisPromise) {
+    if (typeof process === "undefined" || !process.versions?.node && !process.versions?.bun) {
+      throw new Error("Anthropic OAuth is only available in Node.js environments");
+    }
+    nodeApisPromise = import("node:http").then((httpModule) => ({
+      createServer: httpModule.createServer
+    }));
+  }
+  nodeApis = await nodeApisPromise;
+  return nodeApis;
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value)
+    return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? undefined,
+      state: url.searchParams.get("state") ?? undefined
+    };
+  } catch {}
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    return { code, state };
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? undefined,
+      state: params.get("state") ?? undefined
+    };
+  }
+  return { code: value };
+}
+function formatErrorDetails(error) {
+  if (error instanceof Error) {
+    const details = [`${error.name}: ${error.message}`];
+    const errorWithCode = error;
+    if (errorWithCode.code)
+      details.push(`code=${errorWithCode.code}`);
+    if (typeof errorWithCode.errno !== "undefined")
+      details.push(`errno=${String(errorWithCode.errno)}`);
+    if (typeof error.cause !== "undefined") {
+      details.push(`cause=${formatErrorDetails(error.cause)}`);
+    }
+    if (error.stack) {
+      details.push(`stack=${error.stack}`);
+    }
+    return details.join("; ");
+  }
+  return String(error);
+}
+async function startCallbackServer(expectedState) {
+  const { createServer } = await getNodeApis();
+  return new Promise((resolve, reject) => {
+    let settleWait;
+    const waitForCodePromise = new Promise((resolveWait) => {
+      let settled = false;
+      settleWait = (value) => {
+        if (settled)
+          return;
+        settled = true;
+        resolveWait(value);
+      };
+    });
+    const server = createServer((req, res) => {
+      try {
+        const url = new URL(req.url || "", "http://localhost");
+        if (url.pathname !== CALLBACK_PATH) {
+          res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(oauthErrorHtml("Callback route not found."));
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+        const error = url.searchParams.get("error");
+        if (error) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(oauthErrorHtml("Anthropic authentication did not complete.", `Error: ${error}`));
+          return;
+        }
+        if (!code || !state) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(oauthErrorHtml("Missing code or state parameter."));
+          return;
+        }
+        if (state !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(oauthErrorHtml("State mismatch."));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(oauthSuccessHtml("Anthropic authentication completed. You can close this window."));
+        settleWait?.({ code, state });
+      } catch {
+        res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("Internal error");
+      }
+    });
+    server.on("error", (err) => {
+      reject(err);
+    });
+    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+      resolve({
+        server,
+        redirectUri: REDIRECT_URI,
+        cancelWait: () => {
+          settleWait?.(null);
+        },
+        waitForCode: () => waitForCodePromise
+      });
+    });
+  });
+}
+async function postJson(url, body, signal) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.any([signal, AbortSignal.timeout(30000)])
+  });
+  const responseBody = await response.text();
+  if (!response.ok) {
+    throw new Error(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`);
+  }
+  return responseBody;
+}
+async function exchangeAuthorizationCode(code, state, verifier, redirectUri, signal) {
+  let responseBody;
+  try {
+    responseBody = await postJson(TOKEN_URL, {
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      state,
+      redirect_uri: redirectUri,
+      code_verifier: verifier
+    }, signal);
+  } catch (error) {
+    throw new Error(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; response_type=authorization_code; details=${formatErrorDetails(error)}`);
+  }
+  let tokenData;
+  try {
+    tokenData = JSON.parse(responseBody);
+  } catch (error) {
+    throw new Error(`Token exchange returned invalid JSON. url=${TOKEN_URL}; body=${responseBody}; details=${formatErrorDetails(error)}`);
+  }
+  return {
+    type: "oauth",
+    refresh: tokenData.refresh_token,
+    access: tokenData.access_token,
+    expires: Date.now() + tokenData.expires_in * 1000 - 300000
+  };
+}
+async function loginAnthropic(interaction) {
+  const { verifier, challenge } = await generatePKCE();
+  const server = await startCallbackServer(verifier);
+  const manualAbort = new AbortController;
+  const onAbort = () => server.cancelWait();
+  interaction.signal.addEventListener("abort", onAbort, { once: true });
+  if (interaction.signal.aborted)
+    onAbort();
+  let code;
+  let state;
+  let manualInput;
+  let manualError;
+  try {
+    const authParams = new URLSearchParams({
+      code: "true",
+      client_id: CLIENT_ID,
+      response_type: "code",
+      redirect_uri: REDIRECT_URI,
+      scope: SCOPES,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state: verifier
+    });
+    interaction.notify({
+      type: "auth_url",
+      url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+      instructions: "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here."
+    });
+    const manualPromise = interaction.prompt({
+      type: "manual_code",
+      message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
+      placeholder: REDIRECT_URI,
+      signal: manualAbort.signal
+    }).then((input) => {
+      manualInput = input;
+      server.cancelWait();
+    }).catch((error) => {
+      manualError = error instanceof Error ? error : new Error(String(error));
+      server.cancelWait();
+    });
+    const result = await server.waitForCode();
+    if (manualError)
+      throw manualError;
+    if (result?.code) {
+      code = result.code;
+      state = result.state;
+    } else if (manualInput) {
+      const parsed = parseAuthorizationInput(manualInput);
+      if (parsed.state && parsed.state !== verifier)
+        throw new Error("OAuth state mismatch");
+      code = parsed.code;
+      state = parsed.state ?? verifier;
+    }
+    if (!code) {
+      await manualPromise;
+      if (manualError)
+        throw manualError;
+      if (manualInput) {
+        const parsed = parseAuthorizationInput(manualInput);
+        if (parsed.state && parsed.state !== verifier)
+          throw new Error("OAuth state mismatch");
+        code = parsed.code;
+        state = parsed.state ?? verifier;
+      }
+    }
+    if (!code)
+      throw new Error("Missing authorization code");
+    if (!state)
+      throw new Error("Missing OAuth state");
+    interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
+    return exchangeAuthorizationCode(code, state, verifier, REDIRECT_URI, interaction.signal);
+  } finally {
+    interaction.signal.removeEventListener("abort", onAbort);
+    manualAbort.abort();
+    server.server.close();
+  }
+}
+async function refreshAnthropicToken(refreshToken, signal) {
+  let responseBody;
+  try {
+    responseBody = await postJson(TOKEN_URL, {
+      grant_type: "refresh_token",
+      client_id: CLIENT_ID,
+      refresh_token: refreshToken
+    }, signal);
+  } catch (error) {
+    throw new Error(`Anthropic token refresh request failed. url=${TOKEN_URL}; details=${formatErrorDetails(error)}`);
+  }
+  let data;
+  try {
+    data = JSON.parse(responseBody);
+  } catch (error) {
+    throw new Error(`Anthropic token refresh returned invalid JSON. url=${TOKEN_URL}; body=${responseBody}; details=${formatErrorDetails(error)}`);
+  }
+  return {
+    type: "oauth",
+    refresh: data.refresh_token,
+    access: data.access_token,
+    expires: Date.now() + data.expires_in * 1000 - 300000
+  };
+}
+var anthropicOAuth = {
+  name: "Anthropic (Claude Pro/Max)",
+  isSubscription: true,
+  login: loginAnthropic,
+  refresh: (credential, signal) => refreshAnthropicToken(credential.refresh, signal),
+  async toAuth(credential) {
+    return { apiKey: credential.access };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/utils/sleep.js
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    signal.throwIfAborted();
+    const onAbort = () => {
+      clearTimeout(timeout);
+      reject(signal.reason);
+    };
+    const timeout = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/device-code.js
+var CANCEL_MESSAGE = "Login cancelled";
+var TIMEOUT_MESSAGE = "Device flow timed out";
+var SLOW_DOWN_TIMEOUT_MESSAGE = "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.";
+var MINIMUM_INTERVAL_MS = 1000;
+var DEFAULT_POLL_INTERVAL_SECONDS = 5;
+var SLOW_DOWN_INTERVAL_INCREMENT_MS = 5000;
+function abortableSleep(ms, signal, cancelMessage) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new Error(cancelMessage));
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timeout);
+      reject(new Error(cancelMessage));
+    };
+    const timeout = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function pollOAuthDeviceCodeFlow(options) {
+  const deadline = typeof options.expiresInSeconds === "number" ? Date.now() + options.expiresInSeconds * 1000 : Number.POSITIVE_INFINITY;
+  let intervalMs = Math.max(MINIMUM_INTERVAL_MS, Math.floor((options.intervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS) * 1000));
+  let slowDownResponses = 0;
+  if (options.waitBeforeFirstPoll) {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs > 0) {
+      await abortableSleep(Math.min(intervalMs, remainingMs), options.signal, CANCEL_MESSAGE);
+    }
+  }
+  while (Date.now() < deadline) {
+    if (options.signal.aborted) {
+      throw new Error(CANCEL_MESSAGE);
+    }
+    const result = await options.poll();
+    if (result.status === "complete") {
+      return result.value;
+    }
+    if (result.status === "failed") {
+      throw new Error(result.message);
+    }
+    if (result.status === "slow_down") {
+      slowDownResponses += 1;
+      intervalMs = typeof result.intervalSeconds === "number" && Number.isFinite(result.intervalSeconds) && result.intervalSeconds > 0 ? Math.max(MINIMUM_INTERVAL_MS, Math.floor(result.intervalSeconds * 1000)) : Math.max(MINIMUM_INTERVAL_MS, intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS);
+    }
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) {
+      break;
+    }
+    await abortableSleep(Math.min(intervalMs, remainingMs), options.signal, CANCEL_MESSAGE);
+  }
+  throw new Error(slowDownResponses > 0 ? SLOW_DOWN_TIMEOUT_MESSAGE : TIMEOUT_MESSAGE);
+}
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/github-copilot.js
+var decode2 = (s) => atob(s);
+var CLIENT_ID2 = decode2("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+var COPILOT_HEADERS = {
+  "User-Agent": "GitHubCopilotChat/0.35.0",
+  "Editor-Version": "vscode/1.107.0",
+  "Editor-Plugin-Version": "copilot-chat/0.35.0",
+  "Copilot-Integration-Id": "vscode-chat"
+};
+var COPILOT_API_VERSION = "2026-06-01";
+function normalizeDomain(input) {
+  const trimmed = input.trim();
+  if (!trimmed)
+    return null;
+  try {
+    const url = trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+    return url.hostname;
+  } catch {
+    return null;
+  }
+}
+function getUrls(domain) {
+  return {
+    deviceCodeUrl: `https://${domain}/login/device/code`,
+    accessTokenUrl: `https://${domain}/login/oauth/access_token`,
+    copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`
+  };
+}
+function getBaseUrlFromToken(token) {
+  const match = token.match(/proxy-ep=([^;]+)/);
+  if (!match)
+    return null;
+  const proxyHost = match[1];
+  const apiHost = proxyHost.replace(/^proxy\./, "api.");
+  return `https://${apiHost}`;
+}
+function getGitHubCopilotBaseUrl(token, enterpriseDomain) {
+  if (token) {
+    const urlFromToken = getBaseUrlFromToken(token);
+    if (urlFromToken)
+      return urlFromToken;
+  }
+  if (enterpriseDomain)
+    return `https://copilot-api.${enterpriseDomain}`;
+  return "https://api.individual.githubcopilot.com";
+}
+function asRecord(value) {
+  return value && typeof value === "object" ? value : undefined;
+}
+function parseGitHubCopilotModelCatalog(raw, allowPolicyFallback) {
+  const data = asRecord(raw)?.data;
+  if (!Array.isArray(data)) {
+    throw new Error("Invalid Copilot models response");
+  }
+  const accountModels = data.flatMap((rawItem) => {
+    const item = asRecord(rawItem);
+    const id = item?.id;
+    if (!item || typeof id !== "string")
+      return [];
+    const capabilities = asRecord(item.capabilities);
+    const supports = asRecord(capabilities?.supports);
+    if (supports?.tool_calls === false)
+      return [];
+    return [
+      {
+        id,
+        pickerEnabled: item.model_picker_enabled === true,
+        policyState: asRecord(item.policy)?.state
+      }
+    ];
+  });
+  const pickerModelIds = accountModels.filter((model) => model.pickerEnabled && model.policyState !== "disabled").map((model) => model.id);
+  const usePolicyFallback = allowPolicyFallback && pickerModelIds.length === 0;
+  const availableModelIds = pickerModelIds.length > 0 || !allowPolicyFallback ? pickerModelIds : accountModels.filter((model) => model.policyState === "enabled").map((model) => model.id);
+  const policyModelIds = accountModels.filter((model) => model.policyState === "unconfigured" && Object.hasOwn(GITHUB_COPILOT_MODELS, model.id) && (model.pickerEnabled || usePolicyFallback)).map((model) => model.id);
+  return { availableModelIds, policyModelIds };
+}
+async function fetchWithRateLimitRetry(url, init, signal, retryPolicy) {
+  const retryBudgetSignal = retryPolicy.maxRetries > 0 && retryPolicy.maxElapsedMs > 0 ? AbortSignal.timeout(retryPolicy.maxElapsedMs) : undefined;
+  const requestSignal = retryBudgetSignal ? AbortSignal.any([signal, retryBudgetSignal]) : signal;
+  const retryDeadline = retryBudgetSignal ? Date.now() + retryPolicy.maxElapsedMs : undefined;
+  for (let retry = 0;; retry++) {
+    const response = await fetch(url, {
+      ...init,
+      signal: AbortSignal.any([requestSignal, AbortSignal.timeout(5000)])
+    });
+    if (response.status !== 429 || retry === retryPolicy.maxRetries)
+      return response;
+    const retryAfter = response.headers.get("retry-after");
+    let delayMs = 500 * 2 ** retry;
+    if (retryAfter) {
+      const seconds = Number.parseFloat(retryAfter);
+      delayMs = Number.isNaN(seconds) ? Date.parse(retryAfter) - Date.now() : seconds * 1000;
+      if (!Number.isFinite(delayMs))
+        return response;
+    }
+    delayMs = Math.max(0, delayMs);
+    if (retryDeadline !== undefined && delayMs >= retryDeadline - Date.now())
+      return response;
+    await response.body?.cancel();
+    await sleep(delayMs, requestSignal);
+  }
+}
+async function fetchGitHubCopilotModels(copilotToken, enterpriseDomain, signal, retryPolicy) {
+  const baseUrl = getGitHubCopilotBaseUrl(copilotToken, enterpriseDomain);
+  const allowPolicyFallback = baseUrl === "https://api.individual.githubcopilot.com";
+  const response = await fetchWithRateLimitRetry(`${baseUrl}/models`, {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${copilotToken}`,
+      ...COPILOT_HEADERS,
+      "X-GitHub-Api-Version": COPILOT_API_VERSION
+    }
+  }, signal, retryPolicy);
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}: ${await response.text()}`);
+  }
+  return parseGitHubCopilotModelCatalog(await response.json(), allowPolicyFallback);
+}
+async function fetchJson(url, init) {
+  const response = await fetch(url, init);
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`${response.status} ${response.statusText}: ${text}`);
+  }
+  return response.json();
+}
+async function startDeviceFlow(domain, signal) {
+  const urls = getUrls(domain);
+  const data = await fetchJson(urls.deviceCodeUrl, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+      "User-Agent": "GitHubCopilotChat/0.35.0"
+    },
+    body: new URLSearchParams({
+      client_id: CLIENT_ID2,
+      scope: "read:user"
+    }),
+    signal
+  });
+  if (!data || typeof data !== "object") {
+    throw new Error("Invalid device code response");
+  }
+  const deviceCode = data.device_code;
+  const userCode = data.user_code;
+  const verificationUri = data.verification_uri;
+  const interval = data.interval;
+  const expiresIn = data.expires_in;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || interval !== undefined && typeof interval !== "number" || typeof expiresIn !== "number") {
+    throw new Error("Invalid device code response fields");
+  }
+  let parsedUri;
+  try {
+    parsedUri = new URL(verificationUri);
+  } catch {
+    throw new Error("Untrusted verification_uri in device code response");
+  }
+  if (parsedUri.protocol !== "https:" && parsedUri.protocol !== "http:") {
+    throw new Error("Untrusted verification_uri in device code response");
+  }
+  return {
+    device_code: deviceCode,
+    user_code: userCode,
+    verification_uri: parsedUri.href,
+    interval,
+    expires_in: expiresIn
+  };
+}
+async function pollForGitHubAccessToken(domain, device, signal) {
+  const urls = getUrls(domain);
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.interval,
+    expiresInSeconds: device.expires_in,
+    waitBeforeFirstPoll: true,
+    signal,
+    poll: async () => {
+      const raw = await fetchJson(urls.accessTokenUrl, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/x-www-form-urlencoded",
+          "User-Agent": "GitHubCopilotChat/0.35.0"
+        },
+        body: new URLSearchParams({
+          client_id: CLIENT_ID2,
+          device_code: device.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        }),
+        signal
+      });
+      if (raw && typeof raw === "object" && typeof raw.access_token === "string") {
+        return { status: "complete", value: raw.access_token };
+      }
+      if (raw && typeof raw === "object" && typeof raw.error === "string") {
+        const { error, error_description: description, interval } = raw;
+        if (error === "authorization_pending") {
+          return { status: "pending" };
+        }
+        if (error === "slow_down") {
+          return { status: "slow_down", intervalSeconds: typeof interval === "number" ? interval : undefined };
+        }
+        const descriptionSuffix = description ? `: ${description}` : "";
+        return { status: "failed", message: `Device flow failed: ${error}${descriptionSuffix}` };
+      }
+      return { status: "failed", message: "Invalid device token response" };
+    }
+  });
+}
+async function refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, signal) {
+  const domain = enterpriseDomain || "github.com";
+  const urls = getUrls(domain);
+  const raw = await fetchJson(urls.copilotTokenUrl, {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${refreshToken}`,
+      ...COPILOT_HEADERS
+    },
+    signal
+  });
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid Copilot token response");
+  }
+  const token = raw.token;
+  const expiresAt = raw.expires_at;
+  if (typeof token !== "string" || typeof expiresAt !== "number") {
+    throw new Error("Invalid Copilot token response fields");
+  }
+  return {
+    type: "oauth",
+    refresh: refreshToken,
+    access: token,
+    expires: expiresAt * 1000 - 5 * 60 * 1000,
+    enterpriseUrl: enterpriseDomain
+  };
+}
+async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, signal) {
+  const credentials = await refreshGitHubCopilotAccessToken(refreshToken, enterpriseDomain, signal);
+  const { availableModelIds } = await fetchGitHubCopilotModels(credentials.access, enterpriseDomain, signal, {
+    maxRetries: 0,
+    maxElapsedMs: 0
+  });
+  return {
+    ...credentials,
+    availableModelIds
+  };
+}
+async function enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal) {
+  const baseUrl = getGitHubCopilotBaseUrl(token, enterpriseDomain);
+  const url = `${baseUrl}/models/${modelId}/policy`;
+  let response;
+  try {
+    response = await fetchWithRateLimitRetry(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        ...COPILOT_HEADERS,
+        "openai-intent": "chat-policy",
+        "x-interaction-type": "chat-policy"
+      },
+      body: JSON.stringify({ state: "enabled" })
+    }, signal, { maxRetries: 2, maxElapsedMs: 5000 });
+  } catch (error) {
+    if (signal.aborted)
+      throw error;
+    return false;
+  }
+  if (response.status === 429) {
+    throw new Error(`${response.status} ${response.statusText}: ${await response.text()}`);
+  }
+  return response.ok;
+}
+async function enableGitHubCopilotModels(token, modelIds, enterpriseDomain, signal) {
+  const enabledModelIds = [];
+  for (const modelId of modelIds) {
+    try {
+      if (await enableGitHubCopilotModel(token, modelId, enterpriseDomain, signal)) {
+        enabledModelIds.push(modelId);
+      }
+    } catch (error) {
+      if (signal.aborted)
+        throw error;
+      break;
+    }
+  }
+  return enabledModelIds;
+}
+async function loginGitHubCopilot(interaction) {
+  const input = await interaction.prompt({
+    type: "text",
+    message: "GitHub Enterprise URL/domain (blank for github.com)",
+    placeholder: "company.ghe.com"
+  });
+  if (interaction.signal.aborted)
+    throw new Error("Login cancelled");
+  const trimmed = input.trim();
+  const enterpriseDomain = normalizeDomain(input);
+  if (trimmed && !enterpriseDomain)
+    throw new Error("Invalid GitHub Enterprise URL/domain");
+  const domain = enterpriseDomain || "github.com";
+  const device = await startDeviceFlow(domain, interaction.signal);
+  interaction.notify({
+    type: "device_code",
+    userCode: device.user_code,
+    verificationUri: device.verification_uri,
+    intervalSeconds: device.interval,
+    expiresInSeconds: device.expires_in
+  });
+  const githubAccessToken = await pollForGitHubAccessToken(domain, device, interaction.signal);
+  const credentials = await refreshGitHubCopilotAccessToken(githubAccessToken, enterpriseDomain ?? undefined, interaction.signal);
+  const models = await fetchGitHubCopilotModels(credentials.access, enterpriseDomain ?? undefined, interaction.signal, {
+    maxRetries: 2,
+    maxElapsedMs: 5000
+  });
+  let enabledModelIds = [];
+  if (models.policyModelIds.length > 0) {
+    interaction.notify({ type: "progress", message: "Enabling models..." });
+    enabledModelIds = await enableGitHubCopilotModels(credentials.access, models.policyModelIds, enterpriseDomain ?? undefined, interaction.signal);
+  }
+  return {
+    ...credentials,
+    availableModelIds: [...new Set([...models.availableModelIds, ...enabledModelIds])]
+  };
+}
+function copilotEnterpriseDomain(credential) {
+  const enterpriseUrl = credential.enterpriseUrl;
+  if (typeof enterpriseUrl !== "string" || !enterpriseUrl)
+    return;
+  return normalizeDomain(enterpriseUrl) ?? undefined;
+}
+var githubCopilotOAuth = {
+  name: "GitHub Copilot",
+  isSubscription: true,
+  login: loginGitHubCopilot,
+  refresh: (credential, signal) => refreshGitHubCopilotToken(credential.refresh, copilotEnterpriseDomain(credential), signal),
+  async toAuth(credential) {
+    return {
+      apiKey: credential.access,
+      baseUrl: getGitHubCopilotBaseUrl(credential.access, copilotEnterpriseDomain(credential))
+    };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.js
+var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+var DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
+var DEFAULT_POLL_INTERVAL_SECONDS2 = 5;
+var REQUEST_TIMEOUT_MS = 30 * 1000;
+var REFRESH_MAX_RETRIES = 3;
+function getOauthHost() {
+  const override = getProviderEnvValue("KIMI_CODE_OAUTH_HOST") || getProviderEnvValue("KIMI_OAUTH_HOST");
+  return (override || DEFAULT_OAUTH_HOST).replace(/\/+$/, "");
+}
+function requestSignal(signal) {
+  return AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);
+}
+function formUrlEncode(fields) {
+  return new URLSearchParams(fields).toString();
+}
+async function readJson(response) {
+  try {
+    const json = await response.json();
+    return json && typeof json === "object" ? json : null;
+  } catch {
+    return null;
+  }
+}
+function trustedHttpUrl(value) {
+  if (typeof value !== "string" || !value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+      return null;
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+async function startDeviceAuthorization(oauthHost, signal) {
+  const response = await fetch(`${oauthHost}/api/oauth/device_authorization`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: formUrlEncode({ client_id: CLIENT_ID3 }),
+    signal: requestSignal(signal)
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`Kimi Code device authorization failed with status ${response.status}${text ? `: ${text}` : ""}`);
+  }
+  const json = await readJson(response);
+  const deviceCode = json?.device_code;
+  const userCode = json?.user_code;
+  const verificationUri = json?.verification_uri;
+  const verificationUriComplete = json?.verification_uri_complete;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof verificationUriComplete !== "string" || !trustedHttpUrl(verificationUriComplete) || !trustedHttpUrl(verificationUri)) {
+    throw new Error(`Invalid Kimi Code device authorization response: ${JSON.stringify(json)}`);
+  }
+  const interval = json?.interval;
+  const expiresIn = json?.expires_in;
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete,
+    intervalSeconds: typeof interval === "number" && Number.isFinite(interval) && interval > 0 ? interval : DEFAULT_POLL_INTERVAL_SECONDS2,
+    expiresInSeconds: typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : DEVICE_CODE_TIMEOUT_SECONDS
+  };
+}
+function parseTokenResponse(json, operation) {
+  const accessToken = json?.access_token;
+  const refreshToken = json?.refresh_token;
+  const expiresIn = json?.expires_in;
+  if (typeof accessToken !== "string" || !accessToken || typeof refreshToken !== "string" || !refreshToken || typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error(`Kimi Code token ${operation} response missing fields: ${JSON.stringify(json)}`);
+  }
+  return {
+    access: accessToken,
+    refresh: refreshToken,
+    expires: Date.now() + expiresIn * 1000
+  };
+}
+async function pollForToken(oauthHost, device, signal) {
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds,
+    waitBeforeFirstPoll: true,
+    signal,
+    poll: async () => {
+      const response = await fetch(`${oauthHost}/api/oauth/token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: formUrlEncode({
+          client_id: CLIENT_ID3,
+          device_code: device.deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        }),
+        signal: requestSignal(signal)
+      });
+      if (response.status >= 500) {
+        const text = await response.text().catch(() => "");
+        return {
+          status: "failed",
+          message: `Kimi Code device token request failed with status ${response.status}${text ? `: ${text}` : ""}`
+        };
+      }
+      const json = await readJson(response);
+      if (response.ok && typeof json?.access_token === "string") {
+        try {
+          return { status: "complete", value: parseTokenResponse(json, "poll") };
+        } catch (error2) {
+          return { status: "failed", message: error2 instanceof Error ? error2.message : String(error2) };
+        }
+      }
+      const error = json?.error;
+      const description = typeof json?.error_description === "string" ? `: ${json.error_description}` : "";
+      if (error === "authorization_pending") {
+        return { status: "pending" };
+      }
+      if (error === "slow_down") {
+        const interval = json?.interval;
+        return {
+          status: "slow_down",
+          intervalSeconds: typeof interval === "number" && interval > 0 ? interval : undefined
+        };
+      }
+      if (error === "expired_token") {
+        return { status: "failed", message: "Kimi Code device authorization expired. Please restart login." };
+      }
+      if (error === "access_denied") {
+        return { status: "failed", message: "Kimi Code login was denied." };
+      }
+      return {
+        status: "failed",
+        message: `Kimi Code device token request failed (status ${response.status})${typeof error === "string" ? `: ${error}${description}` : ""}`
+      };
+    }
+  });
+}
+function isRetryableRefreshFailure(response) {
+  return response.status === 429 || response.status >= 500;
+}
+async function refreshToken(oauthHost, refreshTokenValue, signal) {
+  let lastError;
+  for (let attempt = 0;attempt <= REFRESH_MAX_RETRIES; attempt++) {
+    if (attempt > 0) {
+      await sleep(1000 * 2 ** (attempt - 1), signal);
+    }
+    if (signal.aborted) {
+      throw new Error("Kimi Code token refresh aborted");
+    }
+    let response;
+    try {
+      response = await fetch(`${oauthHost}/api/oauth/token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: formUrlEncode({
+          client_id: CLIENT_ID3,
+          grant_type: "refresh_token",
+          refresh_token: refreshTokenValue
+        }),
+        signal: requestSignal(signal)
+      });
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+      continue;
+    }
+    const json = await readJson(response);
+    if (response.ok) {
+      return parseTokenResponse(json, "refresh");
+    }
+    if (response.status === 401 || response.status === 403 || json?.error === "invalid_grant") {
+      const description = typeof json?.error_description === "string" ? `: ${json.error_description}` : "";
+      throw new Error(`Kimi Code token refresh unauthorized (status ${response.status})${description}`);
+    }
+    if (isRetryableRefreshFailure(response) && attempt < REFRESH_MAX_RETRIES) {
+      lastError = new Error(`Kimi Code token refresh failed with status ${response.status}`);
+      continue;
+    }
+    const text = JSON.stringify(json);
+    throw new Error(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : ""}`);
+  }
+  throw lastError ?? new Error("Kimi Code token refresh failed");
+}
+async function loginKimiCoding(interaction) {
+  const oauthHost = getOauthHost();
+  const device = await startDeviceAuthorization(oauthHost, interaction.signal);
+  interaction.notify({
+    type: "device_code",
+    userCode: device.userCode,
+    verificationUri: device.verificationUriComplete,
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds
+  });
+  const token = await pollForToken(oauthHost, device, interaction.signal);
+  return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
+}
+var kimiCodingOAuth = {
+  name: "Kimi Code (subscription)",
+  isSubscription: true,
+  loginLabel: "Sign in with Kimi Code",
+  login: loginKimiCoding,
+  refresh: async (credential, signal) => {
+    const token = await refreshToken(getOauthHost(), credential.refresh, signal);
+    return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
+  },
+  async toAuth(credential) {
+    return { headers: { Authorization: `Bearer ${credential.access}` } };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/meta.js
+var CLIENT_ID4 = "1031625952748946";
+var AUTH_HOST = "https://auth.meta.com";
+var DEVICE_AUTHORIZATION_URL = `${AUTH_HOST}/oidc/device/authorization/`;
+var DEVICE_TOKEN_URL = `${AUTH_HOST}/oidc/device/token/`;
+var API_KEY_MINT_URL = "https://api.meta.ai/muse-code/key";
+var API_KEY_LIFETIME_MS = 24 * 60 * 60 * 1000;
+var REQUEST_TIMEOUT_MS2 = 30 * 1000;
+function requestSignal2(signal) {
+  return AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS2), signal]);
+}
+async function readJson2(response) {
+  try {
+    const json = await response.json();
+    return json && typeof json === "object" ? json : null;
+  } catch {
+    return null;
+  }
+}
+function errorDetail(json) {
+  for (const key of ["error_description", "detail", "message", "error"]) {
+    const value = json?.[key];
+    if (typeof value === "string" && value.trim())
+      return `: ${value.trim()}`;
+  }
+  return "";
+}
+function trustedHttpUrl2(value) {
+  if (typeof value !== "string" || !value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+      return null;
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+function positiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
+async function startDeviceAuthorization2(signal) {
+  const response = await fetch(DEVICE_AUTHORIZATION_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({ client_id: CLIENT_ID4 }).toString(),
+    signal: requestSignal2(signal)
+  });
+  const json = await readJson2(response);
+  if (!response.ok) {
+    throw new Error(`Meta device authorization failed with status ${response.status}${errorDetail(json)}`);
+  }
+  const deviceCode = json?.device_code;
+  const userCode = json?.user_code;
+  const verificationUri = trustedHttpUrl2(json?.verification_uri_complete) ?? trustedHttpUrl2(json?.verification_uri);
+  if (typeof deviceCode !== "string" || !deviceCode || typeof userCode !== "string" || !userCode || !verificationUri) {
+    throw new Error(`Invalid Meta device authorization response: ${JSON.stringify(json)}`);
+  }
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    intervalSeconds: positiveNumber(json?.interval),
+    expiresInSeconds: positiveNumber(json?.expires_in)
+  };
+}
+async function pollForIdentityToken(device, signal) {
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds,
+    waitBeforeFirstPoll: true,
+    signal,
+    poll: async () => {
+      const response = await fetch(DEVICE_TOKEN_URL, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: device.deviceCode,
+          client_id: CLIENT_ID4
+        }).toString(),
+        signal: requestSignal2(signal)
+      });
+      const json = await readJson2(response);
+      if (response.ok && typeof json?.access_token === "string" && json.access_token) {
+        return { status: "complete", value: json.access_token };
+      }
+      switch (json?.error) {
+        case "authorization_pending":
+          return { status: "pending" };
+        case "slow_down":
+          return { status: "slow_down", intervalSeconds: positiveNumber(json?.interval) };
+        case "access_denied":
+          return { status: "failed", message: "Meta login was denied." };
+        case "expired_token":
+          return { status: "failed", message: "Meta device authorization expired. Please restart login." };
+        default:
+          return {
+            status: "failed",
+            message: `Meta device token request failed with status ${response.status}${errorDetail(json)}`
+          };
+      }
+    }
+  });
+}
+async function mintApiKey(identityToken, signal) {
+  const response = await fetch(API_KEY_MINT_URL, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${identityToken}`,
+      "Content-Type": "application/json",
+      "x-api-version": "1.0.0"
+    },
+    body: "{}",
+    signal: requestSignal2(signal)
+  });
+  const json = await readJson2(response);
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`Meta session expired (status ${response.status}). Run \`/login meta\` to sign in again.${errorDetail(json)}`);
+  }
+  if (!response.ok) {
+    throw new Error(`Meta API key mint failed with status ${response.status}${errorDetail(json)}`);
+  }
+  const apiKey = json?.api_key;
+  if (typeof apiKey !== "string" || !apiKey) {
+    const actionUrl = trustedHttpUrl2(json?.action_url);
+    throw new Error(`Meta did not issue an API key.${actionUrl ? ` Complete setup at ${actionUrl}` : ""}`);
+  }
+  return { type: "oauth", refresh: identityToken, access: apiKey, expires: Date.now() + API_KEY_LIFETIME_MS };
+}
+async function loginMeta(interaction) {
+  try {
+    const device = await startDeviceAuthorization2(interaction.signal);
+    interaction.notify({
+      type: "device_code",
+      userCode: device.userCode,
+      verificationUri: device.verificationUri,
+      intervalSeconds: device.intervalSeconds,
+      expiresInSeconds: device.expiresInSeconds
+    });
+    const identityToken = await pollForIdentityToken(device, interaction.signal);
+    interaction.notify({ type: "progress", message: "Enabling Meta Model API access..." });
+    return await mintApiKey(identityToken, interaction.signal);
+  } catch (e) {
+    if (interaction.signal.aborted)
+      throw new Error("Login cancelled");
+    throw e;
+  }
+}
+var metaOAuth = {
+  name: "Meta (Muse subscription)",
+  isSubscription: true,
+  loginLabel: "Sign in with Meta",
+  login: loginMeta,
+  refresh: (credential, signal) => mintApiKey(credential.refresh, signal),
+  async toAuth(credential) {
+    return { apiKey: credential.access };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/openai-codex.js
+var _randomBytes = null;
+var _http = null;
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+  import("node:crypto").then((m) => {
+    _randomBytes = m.randomBytes;
+  });
+  import("node:http").then((m) => {
+    _http = m;
+  });
+}
+var CLIENT_ID5 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var AUTH_BASE_URL = "https://auth.openai.com";
+var AUTHORIZE_URL2 = `${AUTH_BASE_URL}/oauth/authorize`;
+var TOKEN_URL2 = `${AUTH_BASE_URL}/oauth/token`;
+var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
+var DEVICE_USER_CODE_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`;
+var DEVICE_TOKEN_URL2 = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
+var DEVICE_VERIFICATION_URI = `${AUTH_BASE_URL}/codex/device`;
+var DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
+var DEVICE_CODE_TIMEOUT_SECONDS2 = 900;
+var OPENAI_CODEX_BROWSER_LOGIN_METHOD = "browser";
+var OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD = "device_code";
+var SCOPE = "openid profile email offline_access";
+var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+function getCallbackHost() {
+  return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+}
+function createState() {
+  if (!_randomBytes) {
+    throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
+  }
+  return _randomBytes(16).toString("hex");
+}
+function parseAuthorizationInput2(input) {
+  const value = input.trim();
+  if (!value)
+    return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? undefined,
+      state: url.searchParams.get("state") ?? undefined
+    };
+  } catch {}
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    return { code, state };
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? undefined,
+      state: params.get("state") ?? undefined
+    };
+  }
+  return { code: value };
+}
+function decodeJwt(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+      return null;
+    const payload = parts[1] ?? "";
+    const decoded = atob(payload);
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+async function fetchWithLoginCancellation(input, init) {
+  try {
+    return await fetch(input, init);
+  } catch (error) {
+    if (init.signal?.aborted) {
+      throw new Error("Login cancelled");
+    }
+    throw error;
+  }
+}
+async function readTokenResponse(response, operation) {
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`OpenAI Codex token ${operation} failed (${response.status}): ${text || response.statusText}`);
+  }
+  const rawJson = await response.json();
+  const json = rawJson;
+  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    throw new Error(`OpenAI Codex token ${operation} response missing fields: ${JSON.stringify(json)}`);
+  }
+  return {
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1000
+  };
+}
+async function exchangeAuthorizationCode2(code, verifier, redirectUri, signal) {
+  const response = await fetchWithLoginCancellation(TOKEN_URL2, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID5,
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri
+    }),
+    signal
+  });
+  return readTokenResponse(response, "exchange");
+}
+async function refreshAccessToken(refreshToken2, signal) {
+  let response;
+  try {
+    response = await fetch(TOKEN_URL2, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken2,
+        client_id: CLIENT_ID5
+      }),
+      signal
+    });
+  } catch (error) {
+    throw new Error(`OpenAI Codex token refresh error: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return readTokenResponse(response, "refresh");
+}
+async function startOpenAICodexDeviceAuth(signal) {
+  const response = await fetchWithLoginCancellation(DEVICE_USER_CODE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_id: CLIENT_ID5 }),
+    signal
+  });
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new Error("OpenAI Codex device code login is not enabled for this server. Use browser login or verify the server URL.");
+    }
+    const responseBody = await response.text().catch(() => "");
+    throw new Error(`OpenAI Codex device code request failed with status ${response.status}${responseBody ? `: ${responseBody}` : ""}`);
+  }
+  const rawJson = await response.json();
+  const json = rawJson;
+  const intervalSeconds = typeof json?.interval === "string" ? Number(json.interval.trim()) : json?.interval;
+  if (!json?.device_auth_id || !json.user_code || typeof intervalSeconds !== "number" || !Number.isFinite(intervalSeconds) || intervalSeconds < 0) {
+    throw new Error(`Invalid OpenAI Codex device code response: ${JSON.stringify(json)}`);
+  }
+  return {
+    deviceAuthId: json.device_auth_id,
+    userCode: json.user_code,
+    intervalSeconds
+  };
+}
+async function pollOpenAICodexDeviceAuth(device, signal) {
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS2,
+    signal,
+    poll: async () => {
+      const response = await fetchWithLoginCancellation(DEVICE_TOKEN_URL2, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          device_auth_id: device.deviceAuthId,
+          user_code: device.userCode
+        }),
+        signal
+      });
+      if (response.ok) {
+        const rawJson = await response.json();
+        const json = rawJson;
+        if (!json?.authorization_code || !json.code_verifier) {
+          return {
+            status: "failed",
+            message: `Invalid OpenAI Codex device auth token response: ${JSON.stringify(json)}`
+          };
+        }
+        return {
+          status: "complete",
+          value: { authorizationCode: json.authorization_code, codeVerifier: json.code_verifier }
+        };
+      }
+      if (response.status === 403 || response.status === 404) {
+        return { status: "pending" };
+      }
+      const responseBody = await response.text().catch(() => "");
+      let errorCode;
+      try {
+        const json = JSON.parse(responseBody);
+        const error = json?.error;
+        errorCode = typeof error === "object" ? error?.code : error;
+      } catch {}
+      if (errorCode === "deviceauth_authorization_pending") {
+        return { status: "pending" };
+      }
+      if (errorCode === "slow_down") {
+        return { status: "slow_down" };
+      }
+      return {
+        status: "failed",
+        message: `OpenAI Codex device auth failed with status ${response.status}${responseBody ? `: ${responseBody}` : ""}`
+      };
+    }
+  });
+}
+async function createAuthorizationFlow(originator = "pi") {
+  const { verifier, challenge } = await generatePKCE();
+  const state = createState();
+  const url = new URL(AUTHORIZE_URL2);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", CLIENT_ID5);
+  url.searchParams.set("redirect_uri", REDIRECT_URI2);
+  url.searchParams.set("scope", SCOPE);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", state);
+  url.searchParams.set("id_token_add_organizations", "true");
+  url.searchParams.set("codex_cli_simplified_flow", "true");
+  url.searchParams.set("originator", originator);
+  return { verifier, state, url: url.toString() };
+}
+function startLocalOAuthServer(state) {
+  if (!_http) {
+    throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
+  }
+  let settleWait;
+  const waitForCodePromise = new Promise((resolve) => {
+    let settled = false;
+    settleWait = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      resolve(value);
+    };
+  });
+  const server = _http.createServer((req, res) => {
+    try {
+      const url = new URL(req.url || "", "http://localhost");
+      if (url.pathname !== "/auth/callback") {
+        res.statusCode = 404;
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        res.end(oauthErrorHtml("Callback route not found."));
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.statusCode = 400;
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        res.end(oauthErrorHtml("State mismatch."));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      if (!code) {
+        res.statusCode = 400;
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        res.end(oauthErrorHtml("Missing authorization code."));
+        return;
+      }
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(oauthSuccessHtml("OpenAI authentication completed. You can close this window."));
+      settleWait?.({ code });
+    } catch {
+      res.statusCode = 500;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(oauthErrorHtml("Internal error while processing OAuth callback."));
+    }
+  });
+  return new Promise((resolve) => {
+    server.listen(1455, getCallbackHost(), () => {
+      resolve({
+        close: () => server.close(),
+        cancelWait: () => {
+          settleWait?.(null);
+        },
+        waitForCode: () => waitForCodePromise
+      });
+    }).on("error", (_err) => {
+      settleWait?.(null);
+      resolve({
+        close: () => {
+          try {
+            server.close();
+          } catch {}
+        },
+        cancelWait: () => {},
+        waitForCode: async () => null
+      });
+    });
+  });
+}
+function getAccountId(accessToken) {
+  const payload = decodeJwt(accessToken);
+  const auth = payload?.[JWT_CLAIM_PATH];
+  const accountId = auth?.chatgpt_account_id;
+  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+}
+function credentialsFromToken(token) {
+  const accountId = getAccountId(token.access);
+  if (!accountId) {
+    throw new Error("Failed to extract accountId from token");
+  }
+  return {
+    type: "oauth",
+    access: token.access,
+    refresh: token.refresh,
+    expires: token.expires,
+    accountId
+  };
+}
+async function exchangeAuthorizationCodeForCredentials(code, verifier, redirectUri, signal) {
+  return credentialsFromToken(await exchangeAuthorizationCode2(code, verifier, redirectUri, signal));
+}
+async function loginOpenAICodexDeviceCode(interaction) {
+  const device = await startOpenAICodexDeviceAuth(interaction.signal);
+  interaction.notify({
+    type: "device_code",
+    userCode: device.userCode,
+    verificationUri: DEVICE_VERIFICATION_URI,
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS2
+  });
+  const code = await pollOpenAICodexDeviceAuth(device, interaction.signal);
+  return exchangeAuthorizationCodeForCredentials(code.authorizationCode, code.codeVerifier, DEVICE_REDIRECT_URI, interaction.signal);
+}
+async function loginOpenAICodex(interaction) {
+  const { verifier, state, url } = await createAuthorizationFlow();
+  const server = await startLocalOAuthServer(state);
+  const manualAbort = new AbortController;
+  const onAbort = () => server.cancelWait();
+  interaction.signal.addEventListener("abort", onAbort, { once: true });
+  if (interaction.signal.aborted)
+    onAbort();
+  let code;
+  let manualCode;
+  let manualError;
+  interaction.notify({
+    type: "auth_url",
+    url,
+    instructions: "A browser window should open. Complete login to finish."
+  });
+  try {
+    const manualPromise = interaction.prompt({
+      type: "manual_code",
+      message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
+      placeholder: REDIRECT_URI2,
+      signal: manualAbort.signal
+    }).then((input) => {
+      manualCode = input;
+      server.cancelWait();
+    }).catch((error) => {
+      manualError = error instanceof Error ? error : new Error(String(error));
+      server.cancelWait();
+    });
+    const result = await server.waitForCode();
+    if (manualError)
+      throw manualError;
+    if (result?.code) {
+      code = result.code;
+    } else if (manualCode) {
+      const parsed = parseAuthorizationInput2(manualCode);
+      if (parsed.state && parsed.state !== state)
+        throw new Error("State mismatch");
+      code = parsed.code;
+    }
+    if (!code) {
+      await manualPromise;
+      if (manualError)
+        throw manualError;
+      if (manualCode) {
+        const parsed = parseAuthorizationInput2(manualCode);
+        if (parsed.state && parsed.state !== state)
+          throw new Error("State mismatch");
+        code = parsed.code;
+      }
+    }
+    if (!code)
+      throw new Error("Missing authorization code");
+    return exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI2, interaction.signal);
+  } finally {
+    interaction.signal.removeEventListener("abort", onAbort);
+    manualAbort.abort();
+    server.close();
+  }
+}
+async function refreshOpenAICodexToken(refreshToken2, signal) {
+  return credentialsFromToken(await refreshAccessToken(refreshToken2, signal));
+}
+var openaiCodexOAuth = {
+  name: "OpenAI (ChatGPT Plus/Pro)",
+  isSubscription: true,
+  async login(interaction) {
+    const method = await interaction.prompt({
+      type: "select",
+      message: "Select OpenAI Codex login method:",
+      options: [
+        { id: OPENAI_CODEX_BROWSER_LOGIN_METHOD, label: "Browser login (default)" },
+        { id: OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD, label: "Device code login (headless)" }
+      ]
+    });
+    if (method === OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD) {
+      return loginOpenAICodexDeviceCode(interaction);
+    }
+    if (method !== OPENAI_CODEX_BROWSER_LOGIN_METHOD) {
+      throw new Error(`Unknown OpenAI Codex login method: ${method}`);
+    }
+    return loginOpenAICodex(interaction);
+  },
+  refresh: (credential, signal) => refreshOpenAICodexToken(credential.refresh, signal),
+  async toAuth(credential) {
+    return { apiKey: credential.access };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/openrouter.js
+import { createServer } from "node:http";
+var AUTHORIZE_URL3 = "https://openrouter.ai/auth";
+var TOKEN_URL3 = "https://openrouter.ai/api/v1/auth/keys";
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+var TOKEN_EXCHANGE_TIMEOUT_MS = 30000;
+function getCallbackHost2() {
+  return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+}
+function sendHtml(response, status, html) {
+  response.statusCode = status;
+  response.setHeader("content-type", "text/html; charset=utf-8");
+  response.setHeader("cache-control", "no-store");
+  response.end(html);
+}
+function parseAuthorizationInput3(input) {
+  const value = input.trim();
+  if (!value)
+    return;
+  try {
+    return new URL(value).searchParams.get("code") ?? undefined;
+  } catch {}
+  if (value.includes("code=")) {
+    return new URLSearchParams(value).get("code") ?? undefined;
+  }
+  return value;
+}
+function errorDetail2(body) {
+  if (typeof body.error_description === "string")
+    return body.error_description;
+  if (typeof body.message === "string")
+    return body.message;
+  if (typeof body.error === "string")
+    return body.error;
+  if (body.error && typeof body.error === "object" && !Array.isArray(body.error)) {
+    const message = body.error.message;
+    if (typeof message === "string")
+      return message;
+  }
+  return;
+}
+async function exchangeAuthorizationCode3(code, verifier, signal) {
+  if (signal.aborted)
+    throw new Error("Login cancelled");
+  const controller = new AbortController;
+  const onAbort = () => controller.abort(signal.reason);
+  signal.addEventListener("abort", onAbort, { once: true });
+  const timeout = setTimeout(() => controller.abort(new Error("OpenRouter OAuth token exchange timed out")), TOKEN_EXCHANGE_TIMEOUT_MS);
+  let response;
+  let body = {};
+  try {
+    response = await fetch(TOKEN_URL3, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: "S256" }),
+      signal: controller.signal
+    });
+    try {
+      const parsed = await response.json();
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+        body = parsed;
+    } catch {
+      if (response.ok)
+        throw new Error("OpenRouter OAuth returned invalid JSON");
+    }
+  } catch (error) {
+    if (signal.aborted)
+      throw new Error("Login cancelled");
+    if (controller.signal.aborted)
+      throw new Error("OpenRouter OAuth token exchange timed out");
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener("abort", onAbort);
+  }
+  if (!response.ok) {
+    const detail = errorDetail2(body);
+    throw new Error(`OpenRouter OAuth key exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+  }
+  if (typeof body.key !== "string" || body.key.length === 0) {
+    throw new Error('OpenRouter OAuth response carries no "key"');
+  }
+  return {
+    type: "oauth",
+    access: body.key,
+    refresh: "",
+    expires: Number.MAX_SAFE_INTEGER
+  };
+}
+async function startCallbackServer2(callbackPath, verifier, signal) {
+  if (signal.aborted)
+    throw new Error("Login cancelled");
+  const callbackHost = getCallbackHost2();
+  let resolveCredential = () => {};
+  let rejectCredential = () => {};
+  const credential = new Promise((resolve, reject) => {
+    resolveCredential = resolve;
+    rejectCredential = reject;
+  });
+  let server;
+  let claimed = false;
+  let settled = false;
+  let timeout;
+  let onAbort;
+  const close = () => {
+    if (timeout)
+      clearTimeout(timeout);
+    if (onAbort)
+      signal.removeEventListener("abort", onAbort);
+    server.close();
+  };
+  const finish = (result) => {
+    if (settled)
+      return;
+    settled = true;
+    close();
+    if ("credential" in result)
+      resolveCredential(result.credential);
+    else
+      rejectCredential(result.error);
+  };
+  server = createServer((request, response) => {
+    (async () => {
+      const requestUrl = new URL(request.url ?? "/", `http://${callbackHost}`);
+      if (request.method !== "GET" || requestUrl.pathname !== callbackPath) {
+        sendHtml(response, 404, oauthErrorHtml("OAuth callback route not found."));
+        return;
+      }
+      if (claimed || settled) {
+        sendHtml(response, 409, oauthErrorHtml("This OAuth callback has already been used."));
+        return;
+      }
+      const oauthError = requestUrl.searchParams.get("error");
+      if (oauthError) {
+        const description = requestUrl.searchParams.get("error_description") ?? oauthError;
+        sendHtml(response, 400, oauthErrorHtml("OpenRouter authorization was denied.", description));
+        finish({ error: new Error(`OpenRouter authorization failed: ${description}`) });
+        return;
+      }
+      const code = requestUrl.searchParams.get("code");
+      if (!code) {
+        sendHtml(response, 400, oauthErrorHtml("OpenRouter returned no authorization code."));
+        return;
+      }
+      claimed = true;
+      try {
+        const result = await exchangeAuthorizationCode3(code, verifier, signal);
+        sendHtml(response, 200, oauthSuccessHtml("Signed in to OpenRouter. You may now close this page."));
+        finish({ credential: result });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown token exchange error";
+        sendHtml(response, 502, oauthErrorHtml("OpenRouter key exchange failed.", message));
+        finish({ error: error instanceof Error ? error : new Error(message) });
+      }
+    })();
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, callbackHost, () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  server.on("error", (error) => finish({ error }));
+  onAbort = () => finish({ error: new Error("Login cancelled") });
+  signal.addEventListener("abort", onAbort, { once: true });
+  if (signal.aborted) {
+    close();
+    throw new Error("Login cancelled");
+  }
+  timeout = setTimeout(() => finish({ error: new Error("OpenRouter OAuth login timed out") }), LOGIN_TIMEOUT_MS);
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    close();
+    throw new Error("Could not determine the OpenRouter OAuth callback port");
+  }
+  return {
+    callbackUrl: `http://${callbackHost}:${address.port}${callbackPath}`,
+    close,
+    cancelWait: () => {
+      if (!claimed)
+        finish({ credential: null });
+    },
+    waitForCredential: () => credential
+  };
+}
+async function loginOpenRouter(interaction) {
+  const { verifier, challenge } = await generatePKCE();
+  const callbackPath = `/oauth/callback/${crypto.randomUUID()}`;
+  const callback = await startCallbackServer2(callbackPath, verifier, interaction.signal);
+  const manualAbort = new AbortController;
+  let manualInput;
+  let manualError;
+  try {
+    const authorizeUrl = new URL(AUTHORIZE_URL3);
+    authorizeUrl.search = new URLSearchParams({
+      callback_url: callback.callbackUrl,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    }).toString();
+    interaction.notify({
+      type: "progress",
+      message: `Listening for OpenRouter OAuth callback on ${callback.callbackUrl}`
+    });
+    interaction.notify({
+      type: "auth_url",
+      url: authorizeUrl.toString(),
+      instructions: "Complete sign-in in your browser. If the browser is on another machine, paste the final redirect URL here."
+    });
+    const manualPromise = interaction.prompt({
+      type: "manual_code",
+      message: "Complete sign-in in your browser, or paste the authorization code / redirect URL here:",
+      placeholder: callback.callbackUrl,
+      signal: manualAbort.signal
+    }).then((input) => {
+      manualInput = input;
+      callback.cancelWait();
+    }).catch((error) => {
+      manualError = error instanceof Error ? error : new Error(String(error));
+      callback.cancelWait();
+    });
+    const credential = await callback.waitForCredential();
+    if (manualError)
+      throw manualError;
+    if (credential)
+      return credential;
+    await manualPromise;
+    if (manualError)
+      throw manualError;
+    const code = manualInput ? parseAuthorizationInput3(manualInput) : undefined;
+    if (!code)
+      throw new Error("Missing authorization code");
+    interaction.notify({ type: "progress", message: "Exchanging authorization code for an API key..." });
+    return await exchangeAuthorizationCode3(code, verifier, interaction.signal);
+  } finally {
+    manualAbort.abort();
+    callback.close();
+  }
+}
+var openRouterOAuth = {
+  name: "OpenRouter OAuth",
+  loginLabel: "Sign in with OpenRouter",
+  login: loginOpenRouter,
+  async refresh(credential, _signal) {
+    return credential;
+  },
+  async toAuth(credential) {
+    return { apiKey: credential.access };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/radius.js
+var _http2 = null;
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+  import("node:http").then((m) => {
+    _http2 = m;
+  });
+}
+var CALLBACK_HOST2 = "127.0.0.1";
+var CALLBACK_PORT2 = 1456;
+var CALLBACK_PATH2 = "/oauth/callback";
+var REDIRECT_URI3 = `http://${CALLBACK_HOST2}:${CALLBACK_PORT2}${CALLBACK_PATH2}`;
+var TOKEN_EXPIRY_SKEW_MS = 60000;
+var LOGIN_METHOD_BROWSER = "browser";
+var LOGIN_METHOD_DEVICE_CODE = "device-code";
+var OAUTH_CLIENT_ID = "pi-gateway";
+var OAUTH_SCOPE = "gateway offline_access";
+var OAUTH_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+async function loadRadiusOAuthDiscovery(gateway, signal) {
+  const response = await fetch(new URL("/v1/oauth", gateway), {
+    headers: { accept: "application/json" },
+    signal
+  });
+  if (!response.ok) {
+    throw new Error(`Could not load Radius OAuth config from ${gateway}: ${response.status} ${await response.text()}`);
+  }
+  const discovery = await response.json();
+  if (typeof discovery.authorizationEndpoint !== "string") {
+    throw new Error(`Invalid Radius OAuth config from ${gateway}`);
+  }
+  return { authorizationEndpoint: discovery.authorizationEndpoint };
+}
+
+class OAuthResponseError extends Error {
+  status;
+  oauthError;
+  constructor(status, oauthError, description, message) {
+    const detail = oauthError ? description ? `${oauthError}: ${description}` : oauthError : description || String(status);
+    super(`${message}: ${detail}`);
+    this.status = status;
+    this.oauthError = oauthError;
+  }
+}
+async function readOAuthResponseError(response, message) {
+  const text = await response.text().catch(() => "");
+  let oauthError;
+  let description;
+  if (text) {
+    try {
+      const data = JSON.parse(text);
+      oauthError = typeof data.error === "string" ? data.error : undefined;
+      description = typeof data.error_description === "string" ? data.error_description : undefined;
+    } catch {
+      description = text;
+    }
+  }
+  return new OAuthResponseError(response.status, oauthError, description, message);
+}
+async function requestOAuthToken(gateway, body, signal) {
+  let response;
+  try {
+    response = await fetch(new URL("/v1/oauth/token", gateway), {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+      body,
+      signal
+    });
+  } catch (error) {
+    if (signal.aborted) {
+      throw new Error("Login cancelled");
+    }
+    throw error;
+  }
+  if (!response.ok) {
+    throw await readOAuthResponseError(response, "Radius OAuth token request failed");
+  }
+  const data = await response.json();
+  return {
+    type: "oauth",
+    access: data.access_token,
+    refresh: data.refresh_token,
+    expires: Date.now() + data.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,
+    scope: data.scope
+  };
+}
+function startOAuthCallbackServer(expectedState, signal) {
+  if (!_http2) {
+    throw new Error("Radius OAuth is only available in Node.js environments");
+  }
+  let settle = () => {};
+  let settled = false;
+  const wait = new Promise((resolve) => {
+    settle = resolve;
+  });
+  const finish = (code) => {
+    if (settled) {
+      return;
+    }
+    settled = true;
+    signal.removeEventListener("abort", onAbort);
+    settle(code);
+  };
+  const onAbort = () => finish(null);
+  signal.addEventListener("abort", onAbort, { once: true });
+  const sendPage = (response, status, html) => {
+    response.statusCode = status;
+    response.setHeader("content-type", "text/html; charset=utf-8");
+    response.end(html);
+  };
+  const server = _http2.createServer((request, response) => {
+    const url = new URL(request.url ?? "/", REDIRECT_URI3);
+    if (url.pathname !== CALLBACK_PATH2) {
+      sendPage(response, 404, oauthErrorHtml("Callback route not found."));
+      return;
+    }
+    if (url.searchParams.get("state") !== expectedState) {
+      sendPage(response, 400, oauthErrorHtml("OAuth state mismatch."));
+      return;
+    }
+    const error = url.searchParams.get("error");
+    if (error) {
+      sendPage(response, 400, oauthErrorHtml(url.searchParams.get("error_description") ?? error));
+      finish(null);
+      return;
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+      sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
+      return;
+    }
+    sendPage(response, 200, oauthSuccessHtml("Signed in to Radius. You may now close this page."));
+    finish(code);
+  });
+  return new Promise((resolve) => {
+    server.listen(CALLBACK_PORT2, CALLBACK_HOST2, () => {
+      resolve({
+        waitForCode: () => wait,
+        close: () => {
+          finish(null);
+          server.close();
+        }
+      });
+    }).once("error", () => {
+      finish(null);
+      resolve({ waitForCode: async () => null, close: () => {} });
+    });
+  });
+}
+async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
+  const { verifier, challenge } = await generatePKCE();
+  const state = crypto.randomUUID();
+  const authorizeUrl = new URL(authorizationEndpoint);
+  authorizeUrl.search = new URLSearchParams({
+    response_type: "code",
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: REDIRECT_URI3,
+    scope: OAUTH_SCOPE,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    handoff: "url",
+    state
+  }).toString();
+  const callbackServer = await startOAuthCallbackServer(state, interaction.signal);
+  interaction.notify({ type: "progress", message: `Listening for OAuth callback on ${REDIRECT_URI3}` });
+  interaction.notify({
+    type: "auth_url",
+    url: authorizeUrl.toString(),
+    instructions: "Continue in your browser."
+  });
+  try {
+    const code = await callbackServer.waitForCode();
+    if (!code) {
+      if (interaction.signal.aborted) {
+        throw new Error("Login cancelled");
+      }
+      throw new Error("OAuth callback did not complete.");
+    }
+    return await requestOAuthToken(gateway, new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: OAUTH_CLIENT_ID,
+      redirect_uri: REDIRECT_URI3,
+      code,
+      code_verifier: verifier
+    }), interaction.signal);
+  } finally {
+    callbackServer.close();
+  }
+}
+async function requestDeviceAuthorization(gateway, signal) {
+  let response;
+  try {
+    response = await fetch(new URL("/v1/oauth/device", gateway), {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ client_id: OAUTH_CLIENT_ID, scope: OAUTH_SCOPE }),
+      signal
+    });
+  } catch (error) {
+    if (signal.aborted) {
+      throw new Error("Login cancelled");
+    }
+    throw error;
+  }
+  if (!response.ok) {
+    throw await readOAuthResponseError(response, "Radius OAuth device authorization failed");
+  }
+  const data = await response.json();
+  if (!data.device_code || !data.user_code || !data.verification_uri || !data.expires_in) {
+    throw new Error("Radius OAuth device authorization response is missing required fields");
+  }
+  return {
+    device_code: data.device_code,
+    user_code: data.user_code,
+    verification_uri: data.verification_uri,
+    expires_in: data.expires_in,
+    interval: data.interval
+  };
+}
+async function loginWithDeviceCode(gateway, interaction) {
+  const device = await requestDeviceAuthorization(gateway, interaction.signal);
+  interaction.notify({
+    type: "device_code",
+    userCode: device.user_code,
+    verificationUri: device.verification_uri,
+    intervalSeconds: device.interval,
+    expiresInSeconds: device.expires_in
+  });
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.interval,
+    expiresInSeconds: device.expires_in,
+    signal: interaction.signal,
+    poll: async () => {
+      try {
+        const credentials = await requestOAuthToken(gateway, new URLSearchParams({
+          grant_type: OAUTH_DEVICE_CODE_GRANT_TYPE,
+          client_id: OAUTH_CLIENT_ID,
+          device_code: device.device_code
+        }), interaction.signal);
+        return { status: "complete", value: credentials };
+      } catch (error) {
+        if (!(error instanceof OAuthResponseError)) {
+          throw error;
+        }
+        switch (error.oauthError) {
+          case "authorization_pending":
+            return { status: "pending" };
+          case "slow_down":
+            return { status: "slow_down" };
+          case "expired_token":
+            return { status: "failed", message: "Device authorization expired." };
+          case "access_denied":
+            return { status: "failed", message: "Device authorization was denied." };
+          default:
+            throw error;
+        }
+      }
+    }
+  });
+}
+function createRadiusOAuth(options) {
+  const gateway = normalizeRadiusGatewayUrl(options.gateway);
+  return {
+    name: options.name,
+    async login(interaction) {
+      const loginMethod = await interaction.prompt({
+        type: "select",
+        message: `Sign in to ${options.name}:`,
+        options: [
+          { id: LOGIN_METHOD_BROWSER, label: "Sign in with browser (recommended)" },
+          {
+            id: LOGIN_METHOD_DEVICE_CODE,
+            label: "Sign in with device code (when signing in from another device)"
+          }
+        ]
+      });
+      if (loginMethod === LOGIN_METHOD_DEVICE_CODE) {
+        return loginWithDeviceCode(gateway, interaction);
+      }
+      if (loginMethod === LOGIN_METHOD_BROWSER) {
+        const discovery = await loadRadiusOAuthDiscovery(gateway, interaction.signal);
+        return loginWithBrowser(gateway, discovery.authorizationEndpoint, interaction);
+      }
+      throw new Error(`Unknown ${options.name} sign-in method: ${loginMethod}`);
+    },
+    async refresh(credential, signal) {
+      const refreshed = await requestOAuthToken(gateway, new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: OAUTH_CLIENT_ID,
+        refresh_token: credential.refresh
+      }), signal);
+      return refreshed;
+    },
+    async toAuth(credential) {
+      return { apiKey: credential.access };
+    }
+  };
+}
+
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/xai.js
+var XAI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var XAI_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+var XAI_DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+var XAI_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+var REFRESH_SKEW_MS = 5 * 60 * 1000;
+var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
+function requiredString(body, field) {
+  const value = body[field];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`Invalid xAI OAuth response field: ${field}`);
+  }
+  return value;
+}
+function positiveNumber2(body, field) {
+  const value = body[field];
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    throw new Error(`Invalid xAI OAuth response field: ${field}`);
+  }
+  return value;
+}
+function validateVerificationUri(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error("Untrusted verification URI in xAI OAuth response");
+  }
+  if (url.protocol !== "https:") {
+    throw new Error("Untrusted verification URI in xAI OAuth response");
+  }
+  return url.href;
+}
+async function postForm(url, fields, signal) {
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams(fields),
+      signal
+    });
+  } catch (error) {
+    if (signal.aborted) {
+      throw new Error("Login cancelled");
+    }
+    throw error;
+  }
+  let body;
+  try {
+    const parsed = await response.json();
+    body = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    if (signal.aborted) {
+      throw new Error("Login cancelled");
+    }
+    throw new Error(`xAI OAuth returned invalid JSON (HTTP ${response.status})`);
+  }
+  return {
+    ok: response.ok,
+    status: response.status,
+    body
+  };
+}
+function requestFailure(action, response) {
+  const error = typeof response.body.error === "string" ? response.body.error : undefined;
+  const description = typeof response.body.error_description === "string" ? response.body.error_description : undefined;
+  const detail = [error, description].filter(Boolean).join(": ");
+  return new Error(`xAI OAuth ${action} failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+}
+function parseDeviceCode(body) {
+  const interval = body.interval;
+  const intervalSeconds = typeof interval === "number" && Number.isFinite(interval) && interval > 0 ? interval : undefined;
+  const verificationUriComplete = typeof body.verification_uri_complete === "string" && body.verification_uri_complete.length > 0 ? validateVerificationUri(body.verification_uri_complete) : undefined;
+  return {
+    deviceCode: requiredString(body, "device_code"),
+    userCode: requiredString(body, "user_code"),
+    verificationUri: validateVerificationUri(requiredString(body, "verification_uri")),
+    verificationUriComplete,
+    intervalSeconds,
+    expiresInSeconds: positiveNumber2(body, "expires_in")
+  };
+}
+function credentialsFromTokenResponse(body, previousRefreshToken) {
+  const access = requiredString(body, "access_token");
+  const refresh = body.refresh_token === undefined && previousRefreshToken ? previousRefreshToken : requiredString(body, "refresh_token");
+  const expiresInSeconds = body.expires_in === undefined ? DEFAULT_TOKEN_LIFETIME_SECONDS : positiveNumber2(body, "expires_in");
+  return {
+    type: "oauth",
+    access,
+    refresh,
+    expires: Date.now() + expiresInSeconds * 1000 - REFRESH_SKEW_MS
+  };
+}
+async function requestDeviceCode(signal) {
+  const response = await postForm(XAI_DEVICE_CODE_URL, {
+    client_id: XAI_CLIENT_ID,
+    scope: XAI_SCOPE,
+    referrer: "pi"
+  }, signal);
+  if (!response.ok) {
+    throw requestFailure("device authorization", response);
+  }
+  return parseDeviceCode(response.body);
+}
+async function pollForTokens(device, signal) {
+  return pollOAuthDeviceCodeFlow({
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds,
+    waitBeforeFirstPoll: true,
+    signal,
+    poll: async () => {
+      const response = await postForm(XAI_TOKEN_URL, {
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        client_id: XAI_CLIENT_ID,
+        device_code: device.deviceCode
+      }, signal);
+      if (response.ok) {
+        return { status: "complete", value: credentialsFromTokenResponse(response.body) };
+      }
+      const error = response.body.error;
+      if (error === "authorization_pending") {
+        return { status: "pending" };
+      }
+      if (error === "slow_down") {
+        const interval = response.body.interval;
+        return { status: "slow_down", intervalSeconds: typeof interval === "number" ? interval : undefined };
+      }
+      if (error === "access_denied" || error === "authorization_denied") {
+        return { status: "failed", message: "xAI device authorization was denied" };
+      }
+      if (error === "expired_token") {
+        return { status: "failed", message: "xAI device code expired" };
+      }
+      return { status: "failed", message: requestFailure("device token polling", response).message };
+    }
+  });
+}
+async function loginXai(interaction) {
+  const device = await requestDeviceCode(interaction.signal);
+  interaction.notify({
+    type: "device_code",
+    userCode: device.userCode,
+    verificationUri: device.verificationUriComplete ?? device.verificationUri,
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds
+  });
+  return pollForTokens(device, interaction.signal);
+}
+async function refreshXaiToken(refreshToken2, signal) {
+  const response = await postForm(XAI_TOKEN_URL, {
+    grant_type: "refresh_token",
+    client_id: XAI_CLIENT_ID,
+    refresh_token: refreshToken2
+  }, signal);
+  if (!response.ok) {
+    throw requestFailure("token refresh", response);
+  }
+  return credentialsFromTokenResponse(response.body, refreshToken2);
+}
+var xaiOAuth = {
+  name: "xAI (Grok/X subscription)",
+  isSubscription: true,
+  loginLabel: "Sign in with SuperGrok or X Premium",
+  login: loginXai,
+  refresh: (credential, signal) => refreshXaiToken(credential.refresh, signal),
+  async toAuth(credential) {
+    return { apiKey: credential.access };
+  }
+};
+
+// node_modules/@earendil-works/pi-ai/dist/bun-oauth.js
+function registerBunOAuthFlows() {
+  registerBundledOAuthFlowLoaders({
+    anthropic: () => anthropicOAuth,
+    openaiCodex: () => openaiCodexOAuth,
+    githubCopilot: () => githubCopilotOAuth,
+    openrouter: () => openRouterOAuth,
+    kimiCoding: () => kimiCodingOAuth,
+    meta: () => metaOAuth,
+    xai: () => xaiOAuth,
+    radius: createRadiusOAuth
+  });
+}
+
+// src/utils/internal-ai/credentials.ts
+registerBunOAuthFlows();
+var resolveOAuthApiKey = async (providerId, credentials) => {
+  const input = credentials[providerId];
+  if (!input)
+    return null;
+  const store = new InMemoryCredentialStore;
+  const initial = { ...input, type: "oauth" };
+  await store.modify(providerId, async () => initial);
+  const models = builtinModels({ credentials: store });
+  const resolved = await models.getAuth(providerId);
+  const apiKey = resolved?.auth.apiKey;
+  if (!apiKey)
+    return null;
+  const current = await store.read(providerId);
+  const changed = current?.type === "oauth" && (current.access !== initial.access || current.refresh !== initial.refresh || current.expires !== initial.expires);
+  return {
+    apiKey,
+    newCredentials: changed && current?.type === "oauth" ? current : undefined
+  };
+};
+async function resolveCredential(opts = {}) {
+  const env = opts.env ?? process.env;
+  const getEnvKey = opts._getEnvApiKey ?? getEnvApiKey;
+  const getCodex = opts._getValidCodexOAuth ?? getValidCodexOAuth;
+  const getOAuth = opts._getOAuthApiKey ?? resolveOAuthApiKey;
+  const persistCodex = opts._persistCodexOAuth ?? persistCodexOAuth;
+  const openrouterKey = env.OPENROUTER_API_KEY ?? getEnvKey("openrouter");
+  if (openrouterKey) {
+    return {
+      kind: "openrouter",
+      apiKey: openrouterKey,
+      modelDefault: resolveModelString("openrouter")
+    };
+  }
+  const anthropicKey = env.ANTHROPIC_API_KEY ?? getEnvKey("anthropic");
+  if (anthropicKey) {
+    return {
+      kind: "anthropic",
+      apiKey: anthropicKey,
+      modelDefault: resolveModelString("anthropic")
+    };
+  }
+  const openaiKey = env.OPENAI_API_KEY ?? getEnvKey("openai");
+  if (openaiKey) {
+    return {
+      kind: "openai",
+      apiKey: openaiKey,
+      modelDefault: resolveModelString("openai")
+    };
+  }
+  if (opts.apiUrl && opts.apiKey) {
+    try {
+      const codexCreds = await getCodex(opts.apiUrl, opts.apiKey);
+      if (codexCreds) {
+        const credMap = {
+          "openai-codex": {
+            access: codexCreds.access,
+            refresh: codexCreds.refresh,
+            expires: codexCreds.expires
+          }
+        };
+        const oauthResult = await getOAuth("openai-codex", credMap);
+        if (oauthResult) {
+          if (oauthResult.newCredentials) {
+            const updated = oauthResult.newCredentials;
+            try {
+              await persistCodex(opts.apiUrl, opts.apiKey, {
+                access: String(updated.access),
+                refresh: String(updated.refresh),
+                expires: Number(updated.expires),
+                accountId: codexCreds.accountId
+              });
+            } catch (err) {
+              console.error(`internal-ai: persistCodexOAuth failed (callerTag=${opts.callerTag ?? "<unset>"}):`, err);
+            }
+          }
+          return {
+            kind: "openai-codex",
+            apiKey: oauthResult.apiKey,
+            modelDefault: resolveModelString("openai-codex")
+          };
+        }
+      }
+    } catch (err) {
+      console.error(`internal-ai: codex OAuth probe failed (callerTag=${opts.callerTag ?? "<unset>"}):`, err);
+    }
+  }
+  if (env.AGENT_SWARM_CLAUDE_OAUTH_TOKEN || env.CLAUDE_CODE_OAUTH_TOKEN) {
+    return {
+      kind: "claude-cli",
+      modelDefault: resolveModelString("claude-cli")
+    };
+  }
+  return null;
+}
+
+export { REFERENCES_SOURCE_MAX_LENGTH, sanitizeReferencesSource, SummaryWithRatingsSchema, BASE_SUMMARIZE_PROMPT, LlmRater, buildRatingsFromLlm, buildSummaryWithRatingsPrompt, isLlmRaterEnabled, dedupeRetrievalsForRater, fetchRetrievalsForTask, postRatings, DEFAULT_MODEL, parseModelStr, resolveCredential };