@desplega.ai/agent-swarm 1.158.0 → 1.159.0

package/dist/{cli-tt9k8r35.js → cli-rfezr056.js}

@@ -8,348 +8,21 @@ import {
   getEnvApiKey,
   normalizeRadiusGatewayUrl,
   registerBundledOAuthFlowLoaders
-} from "./cli-aw1jwp1r.js";
+} from "./cli-gzyh0j0g.js";
 import {
-  init_zod
-} from "./cli-sd0mxa3c.js";
-import {
-  exports_external
-} from "./cli-w5e1d1vv.js";
+  oauthErrorHtml,
+  oauthSuccessHtml
+} from "./cli-rykfmgwg.js";
 import {
   getProviderEnvValue
 } from "./cli-btbzvq95.js";
 import {
   InMemoryCredentialStore
-} from "./cli-mcnhgnn1.js";
+} from "./cli-ykk5jaax.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
 
-// plugin/opencode-plugins/lib/memory-raters.ts
-function getMemoryRaterNames() {
-  return (process.env.MEMORY_RATERS ?? "implicit-citation,explicit-self").split(",").map((name) => name.trim()).filter(Boolean);
-}
-// src/be/memory/raters/llm.ts
-init_zod();
-
-// src/be/memory/raters/llm-client.ts
-var DEFAULT_TIMEOUT_MS = 30000;
-var PROMPT_TEMPLATE = `You are scoring the usefulness of one retrieved memory.
-
-Return ONLY a JSON object with these fields (no prose, no markdown):
-{
-  "score": number,        // 0 = misleading/unhelpful, 1 = highly useful
-  "reasoning": string     // 1..500 chars, why
-}
-
-QUERY:
-\${query}
-
-MEMORY:
-id: \${memoryId}
-name: \${memoryName}
-content: \${memoryContent}
-
-AGENT RESPONSE / SUMMARY:
-\${response}
-
-Score 0..1.`;
-var PLACEHOLDER_PREFIX = "$";
-var QUERY_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{query}`;
-var MEMORY_ID_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{memoryId}`;
-var MEMORY_NAME_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{memoryName}`;
-var MEMORY_CONTENT_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{memoryContent}`;
-var RESPONSE_PLACEHOLDER = `${PLACEHOLDER_PREFIX}{response}`;
-function buildPrompt(input) {
-  return PROMPT_TEMPLATE.replace(QUERY_PLACEHOLDER, input.query).replace(MEMORY_ID_PLACEHOLDER, input.memory.id).replace(MEMORY_NAME_PLACEHOLDER, input.memory.name).replace(MEMORY_CONTENT_PLACEHOLDER, input.memory.content).replace(RESPONSE_PLACEHOLDER, input.response);
-}
-function parseScoreAndReasoning(raw) {
-  if (typeof raw !== "string")
-    return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw.trim());
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object")
-    return null;
-  const obj = parsed;
-  const score = typeof obj.score === "number" ? obj.score : null;
-  const reasoning = typeof obj.reasoning === "string" ? obj.reasoning : null;
-  if (score == null || reasoning == null)
-    return null;
-  if (!Number.isFinite(score) || score < 0 || score > 1)
-    return null;
-  if (reasoning.length === 0 || reasoning.length > 500)
-    return null;
-  return { score, reasoning };
-}
-
-class ClaudeCliLlmRaterClient {
-  model;
-  timeoutMs;
-  constructor(opts = {}) {
-    this.model = opts.model ?? process.env.MEMORY_LLM_RATER_MODEL ?? "haiku";
-    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  }
-  async rate(input) {
-    const prompt = buildPrompt(input);
-    const tmpFile = `/tmp/llm-rater-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`;
-    let stdout = "";
-    try {
-      await Bun.write(tmpFile, prompt);
-      const proc = Bun.spawn(["bash", "-c", `cat "${tmpFile}" | claude -p --model ${this.model} --output-format json`], {
-        stdout: "pipe",
-        stderr: "pipe",
-        env: { ...process.env, SKIP_SESSION_SUMMARY: "1" }
-      });
-      const timeoutId = setTimeout(() => proc.kill(), this.timeoutMs);
-      stdout = await new Response(proc.stdout).text();
-      clearTimeout(timeoutId);
-    } catch (err) {
-      console.error("[memory-rater:llm] claude -p shell-out failed:", err.message);
-      return null;
-    } finally {
-      try {
-        await Bun.$`rm -f ${tmpFile}`.quiet();
-      } catch {}
-    }
-    let envelope;
-    try {
-      envelope = JSON.parse(stdout);
-    } catch {
-      return null;
-    }
-    return parseScoreAndReasoning(envelope.result);
-  }
-}
-
-// src/be/memory/raters/types.ts
-var REFERENCES_SOURCE_MAX_LENGTH = 512;
-var NUL_CHAR_CODE = 0;
-var DEL_CHAR_CODE = 127;
-var FIRST_PRINTABLE_ASCII = 32;
-function sanitizeReferencesSource(input) {
-  let stripped = "";
-  for (let i = 0;i < input.length; i++) {
-    const code = input.charCodeAt(i);
-    if (code === NUL_CHAR_CODE)
-      return null;
-    if (code < FIRST_PRINTABLE_ASCII || code === DEL_CHAR_CODE) {
-      continue;
-    }
-    stripped += input[i];
-  }
-  if (stripped.length === 0)
-    return null;
-  return stripped;
-}
-
-// src/be/memory/raters/llm.ts
-var LLM_RATER_WEIGHT = 0.8;
-var RatingSchema = exports_external.object({
-  id: exports_external.string().min(1),
-  score: exports_external.number().min(0).max(1),
-  reasoning: exports_external.string().min(1).max(500),
-  referencesSource: exports_external.string().min(1).max(REFERENCES_SOURCE_MAX_LENGTH).optional()
-});
-var SummaryWithRatingsSchema = exports_external.object({
-  summary: exports_external.string(),
-  ratings: exports_external.array(RatingSchema).default([])
-});
-var BASE_SUMMARIZE_PROMPT = `You are summarizing an AI agent's work session. Extract ONLY high-value learnings.
-
-DO NOT include:
-- Generic descriptions of what was done ("worked on task X")
-- Tool calls or file reads
-- Routine progress updates
-
-DO include (if present):
-- **Mistakes made and corrections** — what went wrong and what fixed it
-- **Discovered patterns** — reusable approaches, APIs, or codebase conventions
-- **Codebase knowledge** — important file paths, architecture decisions, gotchas
-- **Environment knowledge** — service URLs, config details, tool quirks
-- **Failed approaches** — what was tried and didn't work (and why)
-
-Format as a bulleted list of concrete, reusable facts. If the session was routine with no significant learnings, respond with exactly: "No significant learnings."`;
-
-class LlmRater {
-  client;
-  name = "llm";
-  constructor(client = new ClaudeCliLlmRaterClient) {
-    this.client = client;
-  }
-  async rate(ctx) {
-    const enriched = ctx;
-    if (enriched.retrievedMemoryIds.length === 0)
-      return [];
-    const memories = enriched.retrievedMemories;
-    if (!memories || memories.length === 0)
-      return [];
-    const events = [];
-    for (const memoryId of enriched.retrievedMemoryIds) {
-      const memory = memories.find((m) => m.id === memoryId);
-      if (!memory)
-        continue;
-      let result;
-      try {
-        result = await this.client.rate({
-          query: enriched.query ?? "",
-          memory,
-          response: enriched.response ?? enriched.evidence ?? ""
-        });
-      } catch (err) {
-        console.error(`[memory-rater:llm] client.rate threw for memoryId=${memoryId}:`, err.message);
-        continue;
-      }
-      if (!result)
-        continue;
-      events.push({
-        memoryId,
-        signal: 2 * result.score - 1,
-        weight: LLM_RATER_WEIGHT,
-        source: "",
-        reasoning: result.reasoning
-      });
-    }
-    return events;
-  }
-}
-function buildRatingsFromLlm(ratings, retrievals) {
-  const allowed = new Set(retrievals.map((r) => r.id));
-  const events = [];
-  for (const r of ratings) {
-    if (!allowed.has(r.id))
-      continue;
-    let cleanedReferencesSource;
-    if (r.referencesSource !== undefined) {
-      const cleaned = sanitizeReferencesSource(r.referencesSource);
-      if (cleaned !== null) {
-        cleanedReferencesSource = cleaned;
-      }
-    }
-    events.push({
-      memoryId: r.id,
-      signal: 2 * r.score - 1,
-      weight: LLM_RATER_WEIGHT,
-      source: "llm",
-      reasoning: r.reasoning,
-      ...cleanedReferencesSource !== undefined ? { referencesSource: cleanedReferencesSource } : {}
-    });
-  }
-  return events;
-}
-var RETRIEVAL_PROMPT_CONTENT_CAP = 600;
-function buildSummaryWithRatingsPrompt(basePrompt, retrievals) {
-  if (retrievals.length === 0)
-    return basePrompt;
-  const memoryBlock = retrievals.map((m, i) => {
-    const content = m.content.length > RETRIEVAL_PROMPT_CONTENT_CAP ? `${m.content.slice(0, RETRIEVAL_PROMPT_CONTENT_CAP)}…` : m.content;
-    return `Memory #${i + 1}
-  id: ${m.id}
-  name: ${m.name}
-  content: ${content}`;
-  }).join(`
-
-`);
-  return `${basePrompt}
-
-CRITICAL: Your entire response MUST be a single JSON object that conforms to the schema below. Do NOT wrap it in triple-backtick fences (no \`\`\`json or \`\`\`), do NOT add a prose preamble, do NOT add trailing commentary. Just the JSON object, nothing else.
-
-Schema:
-{
-  "summary": string,                        // your existing summary text
-  "ratings": [                              // one entry per memory you can score
-    {
-      "id": string,                         // memory id, copied from the list below
-      "score": number,                      // 0 = misleading/unhelpful, 1 = highly useful
-      "reasoning": string,                  // 1..500 chars, why
-      "referencesSource": string            // OPTIONAL — see note below
-    }
-  ]
-}
-
-Score ONLY memories present in the list below. Use the exact ids. Omit any you cannot evaluate.
-
-Optionally for each rating, if the memory clearly references a specific external source (a GitHub PR/issue, a Linear issue, a customer, a Slack thread, an AgentMail thread, etc.), include a \`referencesSource\` string using the convention "<source>:<identifier>" (e.g. "github:owner/repo#N", "linear:KEY-N", "customer:<slug>"). Any prefix is fine — pick what matches the source. Omit the field if no clear external source.
-
-Memories retrieved during this session:
-
-${memoryBlock}`;
-}
-function isLlmRaterEnabled() {
-  return getMemoryRaterNames().includes("llm");
-}
-function dedupeRetrievalsForRater(rows) {
-  const seenSchedules = new Set;
-  const out = [];
-  for (const row of rows) {
-    const scheduleId = row.scheduleId;
-    if (typeof scheduleId === "string" && scheduleId.length > 0) {
-      if (seenSchedules.has(scheduleId))
-        continue;
-      seenSchedules.add(scheduleId);
-    }
-    out.push(row);
-  }
-  return out;
-}
-async function fetchRetrievalsForTask(opts) {
-  const fetchFn = opts.fetchImpl ?? fetch;
-  try {
-    const url = `${opts.apiUrl}/api/memory/retrievals?taskId=${encodeURIComponent(opts.taskId)}`;
-    const res = await fetchFn(url, {
-      headers: {
-        "X-Agent-ID": opts.agentId,
-        ...opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {}
-      }
-    });
-    if (!res.ok) {
-      console.error(`[memory-rater:llm] GET /api/memory/retrievals failed: ${res.status} ${res.statusText}`);
-      return [];
-    }
-    const body = await res.json();
-    return body.results ?? [];
-  } catch (err) {
-    console.error("[memory-rater:llm] fetchRetrievalsForTask threw:", err.message);
-    return [];
-  }
-}
-async function postRatings(opts) {
-  if (opts.events.length === 0)
-    return { ok: true, status: 0 };
-  const fetchFn = opts.fetchImpl ?? fetch;
-  const events = opts.events.map((e) => ({
-    memoryId: e.memoryId,
-    signal: e.signal,
-    weight: e.weight,
-    source: e.source,
-    ...e.reasoning !== undefined ? { reasoning: e.reasoning } : {},
-    ...e.referencesSource !== undefined ? { referencesSource: e.referencesSource } : {},
-    ...opts.taskId ? { taskId: opts.taskId } : {}
-  }));
-  try {
-    const res = await fetchFn(`${opts.apiUrl}/api/memory/rate`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Agent-ID": opts.agentId,
-        ...opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {}
-      },
-      body: JSON.stringify({ events })
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      console.error(`[memory-rater:llm] POST /api/memory/rate failed: ${res.status} ${res.statusText} ${text.slice(0, 200)}`);
-    }
-    return { ok: res.ok, status: res.status };
-  } catch (err) {
-    console.error("[memory-rater:llm] postRatings threw:", err.message);
-    return { ok: false, status: 0 };
-  }
-}
-
 // src/utils/internal-ai/models.ts
 var DEFAULT_MODEL = {
   openrouter: "openrouter/deepseek/deepseek-v4.1-flash",
@@ -368,105 +41,135 @@ function parseModelStr(modelStr) {
   return [modelStr.slice(0, idx), modelStr.slice(idx + 1)];
 }
 
-// node_modules/@earendil-works/pi-ai/dist/auth/oauth/oauth-page.js
-var LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg>`;
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-function renderPage(options) {
-  const title = escapeHtml(options.title);
-  const heading = escapeHtml(options.heading);
-  const message = escapeHtml(options.message);
-  const details = options.details ? escapeHtml(options.details) : undefined;
-  return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${title}</title>
-  <style>
-    :root {
-      --text: #fafafa;
-      --text-dim: #a1a1aa;
-      --page-bg: #09090b;
-      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
-      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
-    }
-    * { box-sizing: border-box; }
-    html { color-scheme: dark; }
-    body {
-      margin: 0;
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      padding: 24px;
-      background: var(--page-bg);
-      color: var(--text);
-      font-family: var(--font-sans);
-      text-align: center;
-    }
-    main {
-      width: 100%;
-      max-width: 560px;
-      display: flex;
-      flex-direction: column;
-      align-items: center;
-      justify-content: center;
-    }
-    .logo {
-      width: 72px;
-      height: 72px;
-      display: block;
-      margin-bottom: 24px;
-    }
-    h1 {
-      margin: 0 0 10px;
-      font-size: 28px;
-      line-height: 1.15;
-      font-weight: 650;
-      color: var(--text);
-    }
-    p {
-      margin: 0;
-      line-height: 1.7;
-      color: var(--text-dim);
-      font-size: 15px;
-    }
-    .details {
-      margin-top: 16px;
-      font-family: var(--font-mono);
-      font-size: 13px;
-      color: var(--text-dim);
-      white-space: pre-wrap;
-      word-break: break-word;
-    }
-  </style>
-</head>
-<body>
-  <main>
-    <div class="logo">${LOGO_SVG}</div>
-    <h1>${heading}</h1>
-    <p>${message}</p>
-    ${details ? `<div class="details">${details}</div>` : ""}
-  </main>
-</body>
-</html>`;
-}
-function oauthSuccessHtml(message) {
-  return renderPage({
-    title: "Authentication successful",
-    heading: "Authentication successful",
-    message
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/callback-server.js
+import { createServer } from "node:http";
+function sendPage(response, status, html) {
+  response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+  response.end(html);
+}
+async function startOAuthCallbackServer(options) {
+  const { providerName, signal } = options;
+  if (signal?.aborted)
+    throw new Error("Login cancelled");
+  let resolveWait = () => {};
+  let rejectWait = () => {};
+  const waitPromise = new Promise((resolve, reject) => {
+    resolveWait = resolve;
+    rejectWait = reject;
+  });
+  waitPromise.catch(() => {
+    return;
   });
+  let claimed = false;
+  let settled = false;
+  let timer;
+  const onAbort = () => finish({ error: new Error("Login cancelled") });
+  const finish = (result) => {
+    if (settled)
+      return;
+    settled = true;
+    if (timer)
+      clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+    if ("error" in result)
+      rejectWait(result.error);
+    else
+      resolveWait(result.value);
+  };
+  const server = createServer((request, response) => {
+    (async () => {
+      const url = new URL(request.url ?? "/", "http://localhost");
+      if (request.method !== "GET" || url.pathname !== options.path) {
+        sendPage(response, 404, oauthErrorHtml("Callback route not found."));
+        return;
+      }
+      if (options.state !== undefined && url.searchParams.get("state") !== options.state) {
+        sendPage(response, 400, oauthErrorHtml("State mismatch."));
+        return;
+      }
+      if (claimed || settled) {
+        sendPage(response, 409, oauthErrorHtml("This sign-in has already been handled."));
+        return;
+      }
+      const error = url.searchParams.get("error");
+      if (error) {
+        const description = url.searchParams.get("error_description") ?? error;
+        sendPage(response, 400, oauthErrorHtml(`${providerName} authorization failed.`, description));
+        finish({ error: new Error(`${providerName} authorization failed: ${description}`) });
+        return;
+      }
+      const code = url.searchParams.get("code");
+      if (!code) {
+        sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
+        return;
+      }
+      claimed = true;
+      try {
+        const value = await options.complete(code);
+        sendPage(response, 200, oauthSuccessHtml(`Signed in to ${providerName}. You may now close this page.`));
+        finish({ value });
+      } catch (error2) {
+        const failure = error2 instanceof Error ? error2 : new Error(String(error2));
+        sendPage(response, 502, oauthErrorHtml(`${providerName} sign-in failed.`, failure.message));
+        finish({ error: failure });
+      }
+    })();
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, options.host, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    server.close();
+    throw new Error("OAuth callback server did not bind to TCP");
+  }
+  server.on("error", (error) => finish({ error }));
+  signal?.addEventListener("abort", onAbort, { once: true });
+  if (options.timeoutMs !== undefined) {
+    timer = setTimeout(() => finish({ error: new Error(`${providerName} sign-in timed out`) }), options.timeoutMs);
+  }
+  const redirectHost = options.redirectHost ?? options.host;
+  return {
+    redirectUri: `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${options.path}`,
+    wait: () => waitPromise,
+    cancel: () => {
+      if (!claimed)
+        finish({ value: undefined });
+    },
+    close: () => {
+      finish({ error: new Error("OAuth callback server closed") });
+      server.close();
+    }
+  };
 }
-function oauthErrorHtml(message, details) {
-  return renderPage({
-    title: "Authentication failed",
-    heading: "Authentication failed",
-    message,
-    details
+async function waitForCallbackOrManualInput(interaction, callback, prompt) {
+  const manualAbort = new AbortController;
+  let manualError;
+  const manual = interaction.prompt({ type: "manual_code", ...prompt, signal: manualAbort.signal }).then((input) => {
+    callback?.cancel();
+    return input;
+  }).catch((error) => {
+    manualError = error instanceof Error ? error : new Error(String(error));
+    callback?.cancel();
+    return;
   });
+  try {
+    const value = await callback?.wait();
+    if (manualError)
+      throw manualError;
+    if (value !== undefined)
+      return { type: "callback", value };
+    const input = await manual;
+    if (manualError)
+      throw manualError;
+    return { type: "manual", input: input ?? "" };
+  } finally {
+    manualAbort.abort();
+  }
 }
 
 // node_modules/@earendil-works/pi-ai/dist/auth/oauth/pkce.js
@@ -489,8 +192,6 @@ async function generatePKCE() {
 }
 
 // node_modules/@earendil-works/pi-ai/dist/auth/oauth/anthropic.js
-var nodeApis = null;
-var nodeApisPromise = null;
 var decode = (s) => atob(s);
 var CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -500,20 +201,6 @@ var CALLBACK_PORT = 53692;
 var CALLBACK_PATH = "/callback";
 var REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
 var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-async function getNodeApis() {
-  if (nodeApis)
-    return nodeApis;
-  if (!nodeApisPromise) {
-    if (typeof process === "undefined" || !process.versions?.node && !process.versions?.bun) {
-      throw new Error("Anthropic OAuth is only available in Node.js environments");
-    }
-    nodeApisPromise = import("node:http").then((httpModule) => ({
-      createServer: httpModule.createServer
-    }));
-  }
-  nodeApis = await nodeApisPromise;
-  return nodeApis;
-}
 function parseAuthorizationInput(input) {
   const value = input.trim();
   if (!value)
@@ -556,68 +243,6 @@ function formatErrorDetails(error) {
   }
   return String(error);
 }
-async function startCallbackServer(expectedState) {
-  const { createServer } = await getNodeApis();
-  return new Promise((resolve, reject) => {
-    let settleWait;
-    const waitForCodePromise = new Promise((resolveWait) => {
-      let settled = false;
-      settleWait = (value) => {
-        if (settled)
-          return;
-        settled = true;
-        resolveWait(value);
-      };
-    });
-    const server = createServer((req, res) => {
-      try {
-        const url = new URL(req.url || "", "http://localhost");
-        if (url.pathname !== CALLBACK_PATH) {
-          res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(oauthErrorHtml("Callback route not found."));
-          return;
-        }
-        const code = url.searchParams.get("code");
-        const state = url.searchParams.get("state");
-        const error = url.searchParams.get("error");
-        if (error) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(oauthErrorHtml("Anthropic authentication did not complete.", `Error: ${error}`));
-          return;
-        }
-        if (!code || !state) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(oauthErrorHtml("Missing code or state parameter."));
-          return;
-        }
-        if (state !== expectedState) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(oauthErrorHtml("State mismatch."));
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(oauthSuccessHtml("Anthropic authentication completed. You can close this window."));
-        settleWait?.({ code, state });
-      } catch {
-        res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
-        res.end("Internal error");
-      }
-    });
-    server.on("error", (err) => {
-      reject(err);
-    });
-    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
-      resolve({
-        server,
-        redirectUri: REDIRECT_URI,
-        cancelWait: () => {
-          settleWait?.(null);
-        },
-        waitForCode: () => waitForCodePromise
-      });
-    });
-  });
-}
 async function postJson(url, body, signal) {
   const response = await fetch(url, {
     method: "POST",
@@ -658,21 +283,22 @@ async function exchangeAuthorizationCode(code, state, verifier, redirectUri, sig
     type: "oauth",
     refresh: tokenData.refresh_token,
     access: tokenData.access_token,
-    expires: Date.now() + tokenData.expires_in * 1000 - 300000
+    expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000
   };
 }
 async function loginAnthropic(interaction) {
   const { verifier, challenge } = await generatePKCE();
-  const server = await startCallbackServer(verifier);
-  const manualAbort = new AbortController;
-  const onAbort = () => server.cancelWait();
-  interaction.signal.addEventListener("abort", onAbort, { once: true });
-  if (interaction.signal.aborted)
-    onAbort();
-  let code;
-  let state;
-  let manualInput;
-  let manualError;
+  const callback = await startOAuthCallbackServer({
+    providerName: "Anthropic",
+    host: CALLBACK_HOST,
+    port: CALLBACK_PORT,
+    path: CALLBACK_PATH,
+    state: verifier,
+    complete: async (code) => code,
+    signal: interaction.signal
+  }).catch(() => {
+    return;
+  });
   try {
     const authParams = new URLSearchParams({
       code: "true",
@@ -689,53 +315,27 @@ async function loginAnthropic(interaction) {
       url: `${AUTHORIZE_URL}?${authParams.toString()}`,
       instructions: "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here."
     });
-    const manualPromise = interaction.prompt({
-      type: "manual_code",
+    const result = await waitForCallbackOrManualInput(interaction, callback, {
       message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
-      placeholder: REDIRECT_URI,
-      signal: manualAbort.signal
-    }).then((input) => {
-      manualInput = input;
-      server.cancelWait();
-    }).catch((error) => {
-      manualError = error instanceof Error ? error : new Error(String(error));
-      server.cancelWait();
+      placeholder: REDIRECT_URI
     });
-    const result = await server.waitForCode();
-    if (manualError)
-      throw manualError;
-    if (result?.code) {
-      code = result.code;
-      state = result.state;
-    } else if (manualInput) {
-      const parsed = parseAuthorizationInput(manualInput);
+    let code;
+    let state = verifier;
+    if (result.type === "callback") {
+      code = result.value;
+    } else {
+      const parsed = parseAuthorizationInput(result.input);
       if (parsed.state && parsed.state !== verifier)
         throw new Error("OAuth state mismatch");
       code = parsed.code;
       state = parsed.state ?? verifier;
     }
-    if (!code) {
-      await manualPromise;
-      if (manualError)
-        throw manualError;
-      if (manualInput) {
-        const parsed = parseAuthorizationInput(manualInput);
-        if (parsed.state && parsed.state !== verifier)
-          throw new Error("OAuth state mismatch");
-        code = parsed.code;
-        state = parsed.state ?? verifier;
-      }
-    }
     if (!code)
       throw new Error("Missing authorization code");
-    if (!state)
-      throw new Error("Missing OAuth state");
     interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
-    return exchangeAuthorizationCode(code, state, verifier, REDIRECT_URI, interaction.signal);
+    return await exchangeAuthorizationCode(code, state, verifier, REDIRECT_URI, interaction.signal);
   } finally {
-    interaction.signal.removeEventListener("abort", onAbort);
-    manualAbort.abort();
-    server.server.close();
+    callback?.close();
   }
 }
 async function refreshAnthropicToken(refreshToken, signal) {
@@ -759,7 +359,7 @@ async function refreshAnthropicToken(refreshToken, signal) {
     type: "oauth",
     refresh: data.refresh_token,
     access: data.access_token,
-    expires: Date.now() + data.expires_in * 1000 - 300000
+    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000
   };
 }
 var anthropicOAuth = {
@@ -1577,22 +1177,258 @@ var metaOAuth = {
   }
 };
 
+// node_modules/@earendil-works/pi-ai/dist/auth/oauth/openai-chatgpt.js
+import { randomBytes } from "node:crypto";
+import { createServer as createServer2 } from "node:http";
+var DYNAMIC_CLIENT_ID = "dynamic_agent_client";
+var AGENT_NAME_HINT = "Pi";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var AUTHORIZE_URL2 = "https://auth.openai.com/api/accounts/authorize";
+var TOKEN_URL2 = "https://auth.openai.com/api/accounts/oauth/token";
+var RESOURCE = "https://api.openai.com/v1";
+var CALLBACK_HOST2 = getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+var CALLBACK_PORT2 = 1455;
+var CALLBACK_PATH2 = "/auth/callback";
+var REDIRECT_URI2 = `http://127.0.0.1:${CALLBACK_PORT2}${CALLBACK_PATH2}`;
+var DIRECT_TOKEN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPE = `openid profile email offline_access resource.invoke ${DIRECT_TOKEN_SCOPE}`;
+var EXPIRY_MARGIN_MS = 3 * 60 * 1000;
+function randomValue() {
+  return randomBytes(32).toString("base64url");
+}
+function authorizationResultFromCallback(url, expectedState) {
+  const code = url.searchParams.get("code");
+  if (!code)
+    throw new Error("Missing authorization code");
+  const state = url.searchParams.get("state");
+  if (!state)
+    throw new Error("Missing OAuth state");
+  if (state !== expectedState)
+    throw new Error("OAuth state mismatch");
+  const clientId = url.searchParams.get("client_id")?.trim();
+  if (!clientId)
+    throw new Error("OpenAI OAuth registration callback did not contain an issued client ID");
+  return { code, clientId };
+}
+function authorizationResultFromManualInput(input, expectedState) {
+  let url;
+  try {
+    url = new URL(input.trim());
+  } catch {
+    throw new Error("Paste the full callback URL from the browser");
+  }
+  const expected = new URL(REDIRECT_URI2);
+  if (url.origin !== expected.origin || url.pathname !== expected.pathname) {
+    throw new Error(`The pasted callback URL must start with ${REDIRECT_URI2}`);
+  }
+  const error = url.searchParams.get("error");
+  if (error)
+    throw new Error(`ChatGPT authorization failed: ${error}`);
+  return authorizationResultFromCallback(url, expectedState);
+}
+function sendHtml(response, status, body) {
+  response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+  response.end(body);
+}
+function startCallbackServer(expectedState) {
+  return new Promise((resolve, reject) => {
+    let resolveResult;
+    let rejectResult;
+    const result = new Promise((resolveAuthorization, rejectAuthorization) => {
+      resolveResult = resolveAuthorization;
+      rejectResult = rejectAuthorization;
+    });
+    const server = createServer2((request, response) => {
+      try {
+        const url = new URL(request.url || "", REDIRECT_URI2);
+        if (url.pathname !== CALLBACK_PATH2) {
+          sendHtml(response, 404, oauthErrorHtml("Callback route not found."));
+          return;
+        }
+        const error = url.searchParams.get("error");
+        if (error) {
+          sendHtml(response, 400, oauthErrorHtml("ChatGPT was not connected.", `Error: ${error}`));
+          rejectResult(new Error(`ChatGPT authorization failed: ${error}`));
+          return;
+        }
+        let authorizationResult;
+        try {
+          authorizationResult = authorizationResultFromCallback(url, expectedState);
+        } catch (error2) {
+          const message = error2 instanceof Error ? error2.message : "Invalid callback";
+          sendHtml(response, 400, oauthErrorHtml(message));
+          return;
+        }
+        sendHtml(response, 200, oauthSuccessHtml("ChatGPT authentication completed. You can close this window."));
+        resolveResult(authorizationResult);
+      } catch {
+        sendHtml(response, 500, oauthErrorHtml("Internal error while processing the callback."));
+      }
+    });
+    server.once("error", reject);
+    server.listen(CALLBACK_PORT2, CALLBACK_HOST2, () => {
+      server.removeListener("error", reject);
+      server.on("error", rejectResult);
+      resolve({ server, result });
+    });
+  });
+}
+async function requestToken(body, signal) {
+  const response = await fetch(TOKEN_URL2, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body,
+    signal
+  });
+  if (!response.ok) {
+    const responseBody = await response.text().catch(() => "");
+    throw new Error(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`);
+  }
+  const data = await response.json();
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw new Error("OpenAI OAuth token response must be an object");
+  }
+  return data;
+}
+function requireTokenString(value, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(`OpenAI OAuth token response has invalid ${field}`);
+  }
+  return value;
+}
+function credentialFromTokenResponse(token, clientId) {
+  const access = requireTokenString(token.access_token, "access_token");
+  const refresh = requireTokenString(token.refresh_token, "refresh_token");
+  const scope = requireTokenString(token.scope, "scope");
+  if (typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0) {
+    throw new Error("OpenAI OAuth token response has invalid expires_in");
+  }
+  const scopes = scope.trim().split(/\s+/).filter(Boolean);
+  if (!scopes.includes(DIRECT_TOKEN_SCOPE)) {
+    throw new Error(`OpenAI OAuth grant did not include ${DIRECT_TOKEN_SCOPE}`);
+  }
+  return {
+    type: "oauth",
+    access,
+    refresh,
+    expires: Date.now() + token.expires_in * 1000 - EXPIRY_MARGIN_MS,
+    clientId,
+    scopes
+  };
+}
+async function exchangeAuthorizationCode2(code, verifier, clientId, signal) {
+  const token = await requestToken(new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: clientId,
+    code,
+    code_verifier: verifier,
+    redirect_uri: REDIRECT_URI2,
+    resource: RESOURCE
+  }), signal);
+  if (typeof token.id_token !== "string" || token.id_token.trim().length === 0) {
+    throw new Error("OpenAI OAuth token response did not contain an ID token");
+  }
+  return credentialFromTokenResponse(token, clientId);
+}
+async function refreshAccessToken(credential, signal) {
+  const clientId = credential.clientId;
+  if (typeof clientId !== "string" || clientId.trim().length === 0) {
+    throw new Error("Stored OpenAI OAuth credential does not contain an issued client ID; reconnect ChatGPT");
+  }
+  const token = await requestToken(new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: clientId,
+    refresh_token: credential.refresh,
+    resource: RESOURCE
+  }), signal);
+  return credentialFromTokenResponse(token, clientId);
+}
+function agentHostId(deviceId) {
+  if (!deviceId || !UUID_PATTERN.test(deviceId)) {
+    throw new Error("Sign in with ChatGPT requires a device ID (UUID) for this installation");
+  }
+  return `urn:uuid:${deviceId.toLowerCase()}`;
+}
+async function loginOpenAIChatGPT(interaction, options) {
+  const hostId = agentHostId(options?.getDeviceId?.());
+  const { verifier, challenge } = await generatePKCE();
+  const state = randomValue();
+  const nonce = randomValue();
+  let callback;
+  try {
+    callback = await startCallbackServer(state);
+  } catch (error) {
+    interaction.notify({
+      type: "info",
+      message: `Could not listen on ${REDIRECT_URI2}; paste the final redirect URL to continue. ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+  const authorizationUrl = new URL(AUTHORIZE_URL2);
+  authorizationUrl.search = new URLSearchParams({
+    client_id: DYNAMIC_CLIENT_ID,
+    agent_name_hint: AGENT_NAME_HINT,
+    ext_agent_host_id: hostId,
+    response_type: "code",
+    redirect_uri: REDIRECT_URI2,
+    resource: RESOURCE,
+    scope: SCOPE,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    nonce
+  }).toString();
+  interaction.notify({
+    type: "auth_url",
+    url: authorizationUrl.toString(),
+    instructions: "Complete sign-in in your browser. If the callback does not complete, paste the final redirect URL here."
+  });
+  const manualAbort = new AbortController;
+  const manualCode = interaction.prompt({
+    type: "manual_code",
+    message: "Complete login in your browser, or paste the final redirect URL here:",
+    placeholder: REDIRECT_URI2,
+    signal: AbortSignal.any([manualAbort.signal, interaction.signal])
+  }).then((input) => authorizationResultFromManualInput(input, state));
+  try {
+    const result = await (callback ? Promise.race([callback.result, manualCode]) : manualCode);
+    interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
+    return await exchangeAuthorizationCode2(result.code, verifier, result.clientId, interaction.signal);
+  } catch (error) {
+    if (interaction.signal.aborted)
+      throw new Error("Login cancelled");
+    throw error;
+  } finally {
+    manualAbort.abort();
+    callback?.server.close();
+    callback?.server.closeAllConnections();
+  }
+}
+var openaiChatGPTOAuth = {
+  name: "OpenAI (ChatGPT subscription)",
+  isSubscription: true,
+  loginLabel: "Sign in with ChatGPT",
+  login: loginOpenAIChatGPT,
+  refresh: refreshAccessToken,
+  async toAuth(credential) {
+    return { apiKey: credential.access };
+  }
+};
+
 // node_modules/@earendil-works/pi-ai/dist/auth/oauth/openai-codex.js
 var _randomBytes = null;
-var _http = null;
 if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
   import("node:crypto").then((m) => {
     _randomBytes = m.randomBytes;
   });
-  import("node:http").then((m) => {
-    _http = m;
-  });
 }
 var CLIENT_ID5 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTH_BASE_URL = "https://auth.openai.com";
-var AUTHORIZE_URL2 = `${AUTH_BASE_URL}/oauth/authorize`;
-var TOKEN_URL2 = `${AUTH_BASE_URL}/oauth/token`;
-var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
+var AUTHORIZE_URL3 = `${AUTH_BASE_URL}/oauth/authorize`;
+var TOKEN_URL3 = `${AUTH_BASE_URL}/oauth/token`;
+var REDIRECT_URI3 = "http://localhost:1455/auth/callback";
 var DEVICE_USER_CODE_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`;
 var DEVICE_TOKEN_URL2 = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
 var DEVICE_VERIFICATION_URI = `${AUTH_BASE_URL}/codex/device`;
@@ -1600,7 +1436,7 @@ var DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
 var DEVICE_CODE_TIMEOUT_SECONDS2 = 900;
 var OPENAI_CODEX_BROWSER_LOGIN_METHOD = "browser";
 var OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD = "device_code";
-var SCOPE = "openid profile email offline_access";
+var SCOPE2 = "openid profile email offline_access";
 var JWT_CLAIM_PATH = "https://api.openai.com/auth";
 function getCallbackHost() {
   return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
@@ -1673,8 +1509,8 @@ async function readTokenResponse(response, operation) {
     expires: Date.now() + json.expires_in * 1000
   };
 }
-async function exchangeAuthorizationCode2(code, verifier, redirectUri, signal) {
-  const response = await fetchWithLoginCancellation(TOKEN_URL2, {
+async function exchangeAuthorizationCode3(code, verifier, redirectUri, signal) {
+  const response = await fetchWithLoginCancellation(TOKEN_URL3, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
@@ -1688,10 +1524,10 @@ async function exchangeAuthorizationCode2(code, verifier, redirectUri, signal) {
   });
   return readTokenResponse(response, "exchange");
 }
-async function refreshAccessToken(refreshToken2, signal) {
+async function refreshAccessToken2(refreshToken2, signal) {
   let response;
   try {
-    response = await fetch(TOKEN_URL2, {
+    response = await fetch(TOKEN_URL3, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams({
@@ -1787,11 +1623,11 @@ async function pollOpenAICodexDeviceAuth(device, signal) {
 async function createAuthorizationFlow(originator = "pi") {
   const { verifier, challenge } = await generatePKCE();
   const state = createState();
-  const url = new URL(AUTHORIZE_URL2);
+  const url = new URL(AUTHORIZE_URL3);
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", CLIENT_ID5);
-  url.searchParams.set("redirect_uri", REDIRECT_URI2);
-  url.searchParams.set("scope", SCOPE);
+  url.searchParams.set("redirect_uri", REDIRECT_URI3);
+  url.searchParams.set("scope", SCOPE2);
   url.searchParams.set("code_challenge", challenge);
   url.searchParams.set("code_challenge_method", "S256");
   url.searchParams.set("state", state);
@@ -1800,75 +1636,6 @@ async function createAuthorizationFlow(originator = "pi") {
   url.searchParams.set("originator", originator);
   return { verifier, state, url: url.toString() };
 }
-function startLocalOAuthServer(state) {
-  if (!_http) {
-    throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
-  }
-  let settleWait;
-  const waitForCodePromise = new Promise((resolve) => {
-    let settled = false;
-    settleWait = (value) => {
-      if (settled)
-        return;
-      settled = true;
-      resolve(value);
-    };
-  });
-  const server = _http.createServer((req, res) => {
-    try {
-      const url = new URL(req.url || "", "http://localhost");
-      if (url.pathname !== "/auth/callback") {
-        res.statusCode = 404;
-        res.setHeader("Content-Type", "text/html; charset=utf-8");
-        res.end(oauthErrorHtml("Callback route not found."));
-        return;
-      }
-      if (url.searchParams.get("state") !== state) {
-        res.statusCode = 400;
-        res.setHeader("Content-Type", "text/html; charset=utf-8");
-        res.end(oauthErrorHtml("State mismatch."));
-        return;
-      }
-      const code = url.searchParams.get("code");
-      if (!code) {
-        res.statusCode = 400;
-        res.setHeader("Content-Type", "text/html; charset=utf-8");
-        res.end(oauthErrorHtml("Missing authorization code."));
-        return;
-      }
-      res.statusCode = 200;
-      res.setHeader("Content-Type", "text/html; charset=utf-8");
-      res.end(oauthSuccessHtml("OpenAI authentication completed. You can close this window."));
-      settleWait?.({ code });
-    } catch {
-      res.statusCode = 500;
-      res.setHeader("Content-Type", "text/html; charset=utf-8");
-      res.end(oauthErrorHtml("Internal error while processing OAuth callback."));
-    }
-  });
-  return new Promise((resolve) => {
-    server.listen(1455, getCallbackHost(), () => {
-      resolve({
-        close: () => server.close(),
-        cancelWait: () => {
-          settleWait?.(null);
-        },
-        waitForCode: () => waitForCodePromise
-      });
-    }).on("error", (_err) => {
-      settleWait?.(null);
-      resolve({
-        close: () => {
-          try {
-            server.close();
-          } catch {}
-        },
-        cancelWait: () => {},
-        waitForCode: async () => null
-      });
-    });
-  });
-}
 function getAccountId(accessToken) {
   const payload = decodeJwt(accessToken);
   const auth = payload?.[JWT_CLAIM_PATH];
@@ -1889,7 +1656,7 @@ function credentialsFromToken(token) {
   };
 }
 async function exchangeAuthorizationCodeForCredentials(code, verifier, redirectUri, signal) {
-  return credentialsFromToken(await exchangeAuthorizationCode2(code, verifier, redirectUri, signal));
+  return credentialsFromToken(await exchangeAuthorizationCode3(code, verifier, redirectUri, signal));
 }
 async function loginOpenAICodexDeviceCode(interaction) {
   const device = await startOpenAICodexDeviceAuth(interaction.signal);
@@ -1905,66 +1672,45 @@ async function loginOpenAICodexDeviceCode(interaction) {
 }
 async function loginOpenAICodex(interaction) {
   const { verifier, state, url } = await createAuthorizationFlow();
-  const server = await startLocalOAuthServer(state);
-  const manualAbort = new AbortController;
-  const onAbort = () => server.cancelWait();
-  interaction.signal.addEventListener("abort", onAbort, { once: true });
-  if (interaction.signal.aborted)
-    onAbort();
-  let code;
-  let manualCode;
-  let manualError;
+  const callback = await startOAuthCallbackServer({
+    providerName: "OpenAI",
+    host: getCallbackHost(),
+    port: 1455,
+    path: "/auth/callback",
+    state,
+    complete: async (code) => code,
+    signal: interaction.signal
+  }).catch(() => {
+    return;
+  });
   interaction.notify({
     type: "auth_url",
     url,
     instructions: "A browser window should open. Complete login to finish."
   });
   try {
-    const manualPromise = interaction.prompt({
-      type: "manual_code",
+    const result = await waitForCallbackOrManualInput(interaction, callback, {
       message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
-      placeholder: REDIRECT_URI2,
-      signal: manualAbort.signal
-    }).then((input) => {
-      manualCode = input;
-      server.cancelWait();
-    }).catch((error) => {
-      manualError = error instanceof Error ? error : new Error(String(error));
-      server.cancelWait();
+      placeholder: REDIRECT_URI3
     });
-    const result = await server.waitForCode();
-    if (manualError)
-      throw manualError;
-    if (result?.code) {
-      code = result.code;
-    } else if (manualCode) {
-      const parsed = parseAuthorizationInput2(manualCode);
+    let code;
+    if (result.type === "callback") {
+      code = result.value;
+    } else {
+      const parsed = parseAuthorizationInput2(result.input);
       if (parsed.state && parsed.state !== state)
         throw new Error("State mismatch");
       code = parsed.code;
     }
-    if (!code) {
-      await manualPromise;
-      if (manualError)
-        throw manualError;
-      if (manualCode) {
-        const parsed = parseAuthorizationInput2(manualCode);
-        if (parsed.state && parsed.state !== state)
-          throw new Error("State mismatch");
-        code = parsed.code;
-      }
-    }
     if (!code)
       throw new Error("Missing authorization code");
-    return exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI2, interaction.signal);
+    return await exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI3, interaction.signal);
   } finally {
-    interaction.signal.removeEventListener("abort", onAbort);
-    manualAbort.abort();
-    server.close();
+    callback?.close();
   }
 }
 async function refreshOpenAICodexToken(refreshToken2, signal) {
-  return credentialsFromToken(await refreshAccessToken(refreshToken2, signal));
+  return credentialsFromToken(await refreshAccessToken2(refreshToken2, signal));
 }
 var openaiCodexOAuth = {
   name: "OpenAI (ChatGPT Plus/Pro)",
@@ -1993,20 +1739,13 @@ var openaiCodexOAuth = {
 };
 
 // node_modules/@earendil-works/pi-ai/dist/auth/oauth/openrouter.js
-import { createServer } from "node:http";
-var AUTHORIZE_URL3 = "https://openrouter.ai/auth";
-var TOKEN_URL3 = "https://openrouter.ai/api/v1/auth/keys";
+var AUTHORIZE_URL4 = "https://openrouter.ai/auth";
+var TOKEN_URL4 = "https://openrouter.ai/api/v1/auth/keys";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 var TOKEN_EXCHANGE_TIMEOUT_MS = 30000;
 function getCallbackHost2() {
   return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
 }
-function sendHtml(response, status, html) {
-  response.statusCode = status;
-  response.setHeader("content-type", "text/html; charset=utf-8");
-  response.setHeader("cache-control", "no-store");
-  response.end(html);
-}
 function parseAuthorizationInput3(input) {
   const value = input.trim();
   if (!value)
@@ -2033,7 +1772,7 @@ function errorDetail2(body) {
   }
   return;
 }
-async function exchangeAuthorizationCode3(code, verifier, signal) {
+async function exchangeAuthorizationCode4(code, verifier, signal) {
   if (signal.aborted)
     throw new Error("Login cancelled");
   const controller = new AbortController;
@@ -2043,7 +1782,7 @@ async function exchangeAuthorizationCode3(code, verifier, signal) {
   let response;
   let body = {};
   try {
-    response = await fetch(TOKEN_URL3, {
+    response = await fetch(TOKEN_URL4, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json" },
       body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: "S256" }),
@@ -2081,153 +1820,45 @@ async function exchangeAuthorizationCode3(code, verifier, signal) {
     expires: Number.MAX_SAFE_INTEGER
   };
 }
-async function startCallbackServer2(callbackPath, verifier, signal) {
-  if (signal.aborted)
-    throw new Error("Login cancelled");
-  const callbackHost = getCallbackHost2();
-  let resolveCredential = () => {};
-  let rejectCredential = () => {};
-  const credential = new Promise((resolve, reject) => {
-    resolveCredential = resolve;
-    rejectCredential = reject;
-  });
-  let server;
-  let claimed = false;
-  let settled = false;
-  let timeout;
-  let onAbort;
-  const close = () => {
-    if (timeout)
-      clearTimeout(timeout);
-    if (onAbort)
-      signal.removeEventListener("abort", onAbort);
-    server.close();
-  };
-  const finish = (result) => {
-    if (settled)
-      return;
-    settled = true;
-    close();
-    if ("credential" in result)
-      resolveCredential(result.credential);
-    else
-      rejectCredential(result.error);
-  };
-  server = createServer((request, response) => {
-    (async () => {
-      const requestUrl = new URL(request.url ?? "/", `http://${callbackHost}`);
-      if (request.method !== "GET" || requestUrl.pathname !== callbackPath) {
-        sendHtml(response, 404, oauthErrorHtml("OAuth callback route not found."));
-        return;
-      }
-      if (claimed || settled) {
-        sendHtml(response, 409, oauthErrorHtml("This OAuth callback has already been used."));
-        return;
-      }
-      const oauthError = requestUrl.searchParams.get("error");
-      if (oauthError) {
-        const description = requestUrl.searchParams.get("error_description") ?? oauthError;
-        sendHtml(response, 400, oauthErrorHtml("OpenRouter authorization was denied.", description));
-        finish({ error: new Error(`OpenRouter authorization failed: ${description}`) });
-        return;
-      }
-      const code = requestUrl.searchParams.get("code");
-      if (!code) {
-        sendHtml(response, 400, oauthErrorHtml("OpenRouter returned no authorization code."));
-        return;
-      }
-      claimed = true;
-      try {
-        const result = await exchangeAuthorizationCode3(code, verifier, signal);
-        sendHtml(response, 200, oauthSuccessHtml("Signed in to OpenRouter. You may now close this page."));
-        finish({ credential: result });
-      } catch (error) {
-        const message = error instanceof Error ? error.message : "Unknown token exchange error";
-        sendHtml(response, 502, oauthErrorHtml("OpenRouter key exchange failed.", message));
-        finish({ error: error instanceof Error ? error : new Error(message) });
-      }
-    })();
-  });
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, callbackHost, () => {
-      server.removeListener("error", reject);
-      resolve();
-    });
-  });
-  server.on("error", (error) => finish({ error }));
-  onAbort = () => finish({ error: new Error("Login cancelled") });
-  signal.addEventListener("abort", onAbort, { once: true });
-  if (signal.aborted) {
-    close();
-    throw new Error("Login cancelled");
-  }
-  timeout = setTimeout(() => finish({ error: new Error("OpenRouter OAuth login timed out") }), LOGIN_TIMEOUT_MS);
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    close();
-    throw new Error("Could not determine the OpenRouter OAuth callback port");
-  }
-  return {
-    callbackUrl: `http://${callbackHost}:${address.port}${callbackPath}`,
-    close,
-    cancelWait: () => {
-      if (!claimed)
-        finish({ credential: null });
-    },
-    waitForCredential: () => credential
-  };
-}
 async function loginOpenRouter(interaction) {
   const { verifier, challenge } = await generatePKCE();
-  const callbackPath = `/oauth/callback/${crypto.randomUUID()}`;
-  const callback = await startCallbackServer2(callbackPath, verifier, interaction.signal);
-  const manualAbort = new AbortController;
-  let manualInput;
-  let manualError;
+  const callback = await startOAuthCallbackServer({
+    providerName: "OpenRouter",
+    host: getCallbackHost2(),
+    port: 0,
+    path: `/oauth/callback/${crypto.randomUUID()}`,
+    complete: (code) => exchangeAuthorizationCode4(code, verifier, interaction.signal),
+    signal: interaction.signal,
+    timeoutMs: LOGIN_TIMEOUT_MS
+  });
   try {
-    const authorizeUrl = new URL(AUTHORIZE_URL3);
+    const authorizeUrl = new URL(AUTHORIZE_URL4);
     authorizeUrl.search = new URLSearchParams({
-      callback_url: callback.callbackUrl,
+      callback_url: callback.redirectUri,
       code_challenge: challenge,
       code_challenge_method: "S256"
     }).toString();
     interaction.notify({
       type: "progress",
-      message: `Listening for OpenRouter OAuth callback on ${callback.callbackUrl}`
+      message: `Listening for OpenRouter OAuth callback on ${callback.redirectUri}`
     });
     interaction.notify({
       type: "auth_url",
       url: authorizeUrl.toString(),
       instructions: "Complete sign-in in your browser. If the browser is on another machine, paste the final redirect URL here."
     });
-    const manualPromise = interaction.prompt({
-      type: "manual_code",
+    const result = await waitForCallbackOrManualInput(interaction, callback, {
       message: "Complete sign-in in your browser, or paste the authorization code / redirect URL here:",
-      placeholder: callback.callbackUrl,
-      signal: manualAbort.signal
-    }).then((input) => {
-      manualInput = input;
-      callback.cancelWait();
-    }).catch((error) => {
-      manualError = error instanceof Error ? error : new Error(String(error));
-      callback.cancelWait();
+      placeholder: callback.redirectUri
     });
-    const credential = await callback.waitForCredential();
-    if (manualError)
-      throw manualError;
-    if (credential)
-      return credential;
-    await manualPromise;
-    if (manualError)
-      throw manualError;
-    const code = manualInput ? parseAuthorizationInput3(manualInput) : undefined;
+    if (result.type === "callback")
+      return result.value;
+    const code = parseAuthorizationInput3(result.input);
     if (!code)
       throw new Error("Missing authorization code");
     interaction.notify({ type: "progress", message: "Exchanging authorization code for an API key..." });
-    return await exchangeAuthorizationCode3(code, verifier, interaction.signal);
+    return await exchangeAuthorizationCode4(code, verifier, interaction.signal);
   } finally {
-    manualAbort.abort();
     callback.close();
   }
 }
@@ -2244,16 +1875,10 @@ var openRouterOAuth = {
 };
 
 // node_modules/@earendil-works/pi-ai/dist/auth/oauth/radius.js
-var _http2 = null;
-if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
-  import("node:http").then((m) => {
-    _http2 = m;
-  });
-}
-var CALLBACK_HOST2 = "127.0.0.1";
-var CALLBACK_PORT2 = 1456;
-var CALLBACK_PATH2 = "/oauth/callback";
-var REDIRECT_URI3 = `http://${CALLBACK_HOST2}:${CALLBACK_PORT2}${CALLBACK_PATH2}`;
+var CALLBACK_HOST3 = "127.0.0.1";
+var CALLBACK_PORT3 = 1456;
+var CALLBACK_PATH3 = "/oauth/callback";
+var REDIRECT_URI4 = `http://${CALLBACK_HOST3}:${CALLBACK_PORT3}${CALLBACK_PATH3}`;
 var TOKEN_EXPIRY_SKEW_MS = 60000;
 var LOGIN_METHOD_BROWSER = "browser";
 var LOGIN_METHOD_DEVICE_CODE = "device-code";
@@ -2327,69 +1952,6 @@ async function requestOAuthToken(gateway, body, signal) {
     scope: data.scope
   };
 }
-function startOAuthCallbackServer(expectedState, signal) {
-  if (!_http2) {
-    throw new Error("Radius OAuth is only available in Node.js environments");
-  }
-  let settle = () => {};
-  let settled = false;
-  const wait = new Promise((resolve) => {
-    settle = resolve;
-  });
-  const finish = (code) => {
-    if (settled) {
-      return;
-    }
-    settled = true;
-    signal.removeEventListener("abort", onAbort);
-    settle(code);
-  };
-  const onAbort = () => finish(null);
-  signal.addEventListener("abort", onAbort, { once: true });
-  const sendPage = (response, status, html) => {
-    response.statusCode = status;
-    response.setHeader("content-type", "text/html; charset=utf-8");
-    response.end(html);
-  };
-  const server = _http2.createServer((request, response) => {
-    const url = new URL(request.url ?? "/", REDIRECT_URI3);
-    if (url.pathname !== CALLBACK_PATH2) {
-      sendPage(response, 404, oauthErrorHtml("Callback route not found."));
-      return;
-    }
-    if (url.searchParams.get("state") !== expectedState) {
-      sendPage(response, 400, oauthErrorHtml("OAuth state mismatch."));
-      return;
-    }
-    const error = url.searchParams.get("error");
-    if (error) {
-      sendPage(response, 400, oauthErrorHtml(url.searchParams.get("error_description") ?? error));
-      finish(null);
-      return;
-    }
-    const code = url.searchParams.get("code");
-    if (!code) {
-      sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
-      return;
-    }
-    sendPage(response, 200, oauthSuccessHtml("Signed in to Radius. You may now close this page."));
-    finish(code);
-  });
-  return new Promise((resolve) => {
-    server.listen(CALLBACK_PORT2, CALLBACK_HOST2, () => {
-      resolve({
-        waitForCode: () => wait,
-        close: () => {
-          finish(null);
-          server.close();
-        }
-      });
-    }).once("error", () => {
-      finish(null);
-      resolve({ waitForCode: async () => null, close: () => {} });
-    });
-  });
-}
 async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
   const { verifier, challenge } = await generatePKCE();
   const state = crypto.randomUUID();
@@ -2397,37 +1959,41 @@ async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
   authorizeUrl.search = new URLSearchParams({
     response_type: "code",
     client_id: OAUTH_CLIENT_ID,
-    redirect_uri: REDIRECT_URI3,
+    redirect_uri: REDIRECT_URI4,
     scope: OAUTH_SCOPE,
     code_challenge: challenge,
     code_challenge_method: "S256",
     handoff: "url",
     state
   }).toString();
-  const callbackServer = await startOAuthCallbackServer(state, interaction.signal);
-  interaction.notify({ type: "progress", message: `Listening for OAuth callback on ${REDIRECT_URI3}` });
+  const callback = await startOAuthCallbackServer({
+    providerName: "Radius",
+    host: CALLBACK_HOST3,
+    port: CALLBACK_PORT3,
+    path: CALLBACK_PATH3,
+    state,
+    complete: (code) => requestOAuthToken(gateway, new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: OAUTH_CLIENT_ID,
+      redirect_uri: REDIRECT_URI4,
+      code,
+      code_verifier: verifier
+    }), interaction.signal),
+    signal: interaction.signal
+  });
+  interaction.notify({ type: "progress", message: `Listening for OAuth callback on ${REDIRECT_URI4}` });
   interaction.notify({
     type: "auth_url",
     url: authorizeUrl.toString(),
     instructions: "Continue in your browser."
   });
   try {
-    const code = await callbackServer.waitForCode();
-    if (!code) {
-      if (interaction.signal.aborted) {
-        throw new Error("Login cancelled");
-      }
+    const credential = await callback.wait();
+    if (!credential)
       throw new Error("OAuth callback did not complete.");
-    }
-    return await requestOAuthToken(gateway, new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: OAUTH_CLIENT_ID,
-      redirect_uri: REDIRECT_URI3,
-      code,
-      code_verifier: verifier
-    }), interaction.signal);
+    return credential;
   } finally {
-    callbackServer.close();
+    callback.close();
   }
 }
 async function requestDeviceAuthorization(gateway, signal) {
@@ -2719,6 +2285,7 @@ function registerBunOAuthFlows() {
   registerBundledOAuthFlowLoaders({
     anthropic: () => anthropicOAuth,
     openaiCodex: () => openaiCodexOAuth,
+    openaiChatGPT: () => openaiChatGPTOAuth,
     githubCopilot: () => githubCopilotOAuth,
     openrouter: () => openRouterOAuth,
     kimiCoding: () => kimiCodingOAuth,
@@ -2825,4 +2392,4 @@ async function resolveCredential(opts = {}) {
   return null;
 }
 
-export { DEFAULT_MODEL, parseModelStr, resolveCredential, getMemoryRaterNames, REFERENCES_SOURCE_MAX_LENGTH, sanitizeReferencesSource, SummaryWithRatingsSchema, BASE_SUMMARIZE_PROMPT, LlmRater, buildRatingsFromLlm, buildSummaryWithRatingsPrompt, isLlmRaterEnabled, dedupeRetrievalsForRater, fetchRetrievalsForTask, postRatings };
+export { DEFAULT_MODEL, parseModelStr, resolveCredential };