@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/auth/types.d.ts

@@ -6,11 +6,51 @@ export interface OAuthCredentials {
     refresh: string;
     expires: number;
 }
-export type SubscriptionProvider = "anthropic-subscription" | "openai-codex";
+export type SubscriptionProvider = "anthropic-subscription" | "openai-codex" | "gemini-cli" | "zai-coding" | "kimi-coding" | "deepseek-coding";
+export type OAuthSubscriptionProvider = "anthropic-subscription" | "openai-codex";
+export type CodingPlanKeySubscriptionProvider = "zai-coding" | "kimi-coding";
+export type ExternalCliSubscriptionProvider = "gemini-cli";
+export type UnavailableSubscriptionProvider = "deepseek-coding";
+export type DirectAccountProvider = "anthropic-api" | "openai-api" | "deepseek-api" | "zai-api" | "moonshot-api";
+export type AccountCredentialProvider = SubscriptionProvider | DirectAccountProvider;
+export declare const SUBSCRIPTION_PROVIDER_IDS: readonly ["anthropic-subscription", "openai-codex", "gemini-cli", "zai-coding", "kimi-coding", "deepseek-coding"];
+export declare const OAUTH_SUBSCRIPTION_PROVIDER_IDS: readonly ["anthropic-subscription", "openai-codex"];
+export declare const CODING_PLAN_KEY_SUBSCRIPTION_PROVIDER_IDS: readonly ["zai-coding", "kimi-coding"];
+export declare const EXTERNAL_CLI_SUBSCRIPTION_PROVIDER_IDS: readonly ["gemini-cli"];
+export declare const UNAVAILABLE_SUBSCRIPTION_PROVIDER_IDS: readonly ["deepseek-coding"];
+export declare const DIRECT_ACCOUNT_PROVIDER_IDS: readonly ["anthropic-api", "openai-api", "deepseek-api", "zai-api", "moonshot-api"];
+export declare const ACCOUNT_CREDENTIAL_PROVIDER_IDS: readonly ["anthropic-subscription", "openai-codex", "gemini-cli", "zai-coding", "kimi-coding", "deepseek-coding", "anthropic-api", "openai-api", "deepseek-api", "zai-api", "moonshot-api"];
+export declare function isSubscriptionProvider(value: unknown): value is SubscriptionProvider;
+export declare function isOAuthSubscriptionProvider(value: unknown): value is OAuthSubscriptionProvider;
+export declare function isCodingPlanKeySubscriptionProvider(value: unknown): value is CodingPlanKeySubscriptionProvider;
+export declare function isExternalCliSubscriptionProvider(value: unknown): value is ExternalCliSubscriptionProvider;
+export declare function isUnavailableSubscriptionProvider(value: unknown): value is UnavailableSubscriptionProvider;
+export declare function isAccountCredentialProvider(value: unknown): value is AccountCredentialProvider;
+export declare const DIRECT_ACCOUNT_PROVIDER_ENV: Record<DirectAccountProvider, string>;
 /** Maps subscription provider IDs to their model provider short names. */
 export declare const SUBSCRIPTION_PROVIDER_MAP: Record<SubscriptionProvider, string>;
+export declare const CODING_PLAN_PROVIDER_BASE_URL: Record<CodingPlanKeySubscriptionProvider, string>;
+export type SubscriptionProviderAuthMode = "oauth" | "external-cli" | "coding-plan-key" | "unavailable";
+export type SubscriptionProviderBillingMode = "subscription-coding-plan" | "subscription-coding-cli";
+export type SubscriptionProviderAvailability = "available" | "external" | "unavailable";
+export interface SubscriptionProviderMetadata {
+    providerId: SubscriptionProvider;
+    displayName: string;
+    selectionIds: readonly string[];
+    allowedClient: string;
+    billingMode: SubscriptionProviderBillingMode;
+    authMode: SubscriptionProviderAuthMode;
+    availability: SubscriptionProviderAvailability;
+    setupHint: string;
+    directProviderId?: DirectAccountProvider;
+    defaultBaseUrl?: string;
+    probePath?: string;
+    availabilityReason?: string;
+}
+export declare const SUBSCRIPTION_PROVIDER_METADATA: Record<SubscriptionProvider, SubscriptionProviderMetadata>;
+export declare function getSubscriptionProviderMetadata(provider: SubscriptionProvider): SubscriptionProviderMetadata;
 export interface StoredCredentials {
-    provider: SubscriptionProvider;
+    provider: AccountCredentialProvider;
     credentials: OAuthCredentials;
     createdAt: number;
     updatedAt: number;

package/packages/agent/src/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,GAAG,cAAc,CAAC;AAE7E,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAG1E,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAC5B,wBAAwB,GACxB,cAAc,GACd,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,iBAAiB,CAAC;AAEtB,MAAM,MAAM,yBAAyB,GACjC,wBAAwB,GACxB,cAAc,CAAC;AAEnB,MAAM,MAAM,iCAAiC,GAAG,YAAY,GAAG,aAAa,CAAC;AAE7E,MAAM,MAAM,+BAA+B,GAAG,YAAY,CAAC;AAE3D,MAAM,MAAM,+BAA+B,GAAG,iBAAiB,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,YAAY,GACZ,cAAc,GACd,SAAS,GACT,cAAc,CAAC;AAEnB,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B,eAAO,MAAM,yBAAyB,mHAOc,CAAC;AAErD,eAAO,MAAM,+BAA+B,qDAGa,CAAC;AAE1D,eAAO,MAAM,yCAAyC,wCAGW,CAAC;AAElE,eAAO,MAAM,sCAAsC,yBAEY,CAAC;AAEhE,eAAO,MAAM,qCAAqC,8BAEa,CAAC;AAEhE,eAAO,MAAM,2BAA2B,qFAMa,CAAC;AAEtD,eAAO,MAAM,+BAA+B,6LAGa,CAAC;AAE1D,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,oBAAoB,CAE/B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAIpC;AAED,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iCAAiC,CAI5C;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,+BAA+B,CAI1C;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,+BAA+B,CAI1C;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAIpC;AAED,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,qBAAqB,EACrB,MAAM,CAOP,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAO1E,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAChD,iCAAiC,EACjC,MAAM,CAIP,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC,OAAO,GACP,cAAc,GACd,iBAAiB,GACjB,aAAa,CAAC;AAElB,MAAM,MAAM,+BAA+B,GACvC,0BAA0B,GAC1B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,gCAAgC,GACxC,WAAW,GACX,UAAU,GACV,aAAa,CAAC;AAElB,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,oBAAoB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,+BAA+B,CAAC;IAC7C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,YAAY,EAAE,gCAAgC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,8BAA8B,EAAE,MAAM,CACjD,oBAAoB,EACpB,4BAA4B,CA4EpB,CAAC;AAEX,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,oBAAoB,GAC7B,4BAA4B,CAE9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/packages/agent/src/auth/types.js

@@ -1,8 +1,149 @@
 /**
  * Subscription auth types for eliza.
  */
+export const SUBSCRIPTION_PROVIDER_IDS = [
+    "anthropic-subscription",
+    "openai-codex",
+    "gemini-cli",
+    "zai-coding",
+    "kimi-coding",
+    "deepseek-coding",
+];
+export const OAUTH_SUBSCRIPTION_PROVIDER_IDS = [
+    "anthropic-subscription",
+    "openai-codex",
+];
+export const CODING_PLAN_KEY_SUBSCRIPTION_PROVIDER_IDS = [
+    "zai-coding",
+    "kimi-coding",
+];
+export const EXTERNAL_CLI_SUBSCRIPTION_PROVIDER_IDS = [
+    "gemini-cli",
+];
+export const UNAVAILABLE_SUBSCRIPTION_PROVIDER_IDS = [
+    "deepseek-coding",
+];
+export const DIRECT_ACCOUNT_PROVIDER_IDS = [
+    "anthropic-api",
+    "openai-api",
+    "deepseek-api",
+    "zai-api",
+    "moonshot-api",
+];
+export const ACCOUNT_CREDENTIAL_PROVIDER_IDS = [
+    ...SUBSCRIPTION_PROVIDER_IDS,
+    ...DIRECT_ACCOUNT_PROVIDER_IDS,
+];
+export function isSubscriptionProvider(value) {
+    return SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isOAuthSubscriptionProvider(value) {
+    return OAUTH_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isCodingPlanKeySubscriptionProvider(value) {
+    return CODING_PLAN_KEY_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isExternalCliSubscriptionProvider(value) {
+    return EXTERNAL_CLI_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isUnavailableSubscriptionProvider(value) {
+    return UNAVAILABLE_SUBSCRIPTION_PROVIDER_IDS.includes(value);
+}
+export function isAccountCredentialProvider(value) {
+    return ACCOUNT_CREDENTIAL_PROVIDER_IDS.includes(value);
+}
+export const DIRECT_ACCOUNT_PROVIDER_ENV = {
+    "anthropic-api": "ANTHROPIC_API_KEY",
+    "openai-api": "OPENAI_API_KEY",
+    "deepseek-api": "DEEPSEEK_API_KEY",
+    "zai-api": "ZAI_API_KEY",
+    "moonshot-api": "MOONSHOT_API_KEY",
+};
 /** Maps subscription provider IDs to their model provider short names. */
 export const SUBSCRIPTION_PROVIDER_MAP = {
     "anthropic-subscription": "anthropic",
-    "openai-codex": "openai",
+    "openai-codex": "codex-cli",
+    "gemini-cli": "gemini-cli",
+    "zai-coding": "zai-coding",
+    "kimi-coding": "kimi-coding",
+    "deepseek-coding": "deepseek-coding",
+};
+export const CODING_PLAN_PROVIDER_BASE_URL = {
+    "zai-coding": "https://api.z.ai/api/coding/paas/v4",
+    "kimi-coding": "https://api.kimi.com/coding/v1",
+};
+export const SUBSCRIPTION_PROVIDER_METADATA = {
+    "anthropic-subscription": {
+        providerId: "anthropic-subscription",
+        displayName: "Claude Subscription",
+        selectionIds: ["anthropic-subscription"],
+        allowedClient: "Claude Code CLI",
+        billingMode: "subscription-coding-cli",
+        authMode: "oauth",
+        availability: "available",
+        setupHint: "Sign in through the app or run claude auth login.",
+        directProviderId: "anthropic-api",
+    },
+    "openai-codex": {
+        providerId: "openai-codex",
+        displayName: "OpenAI Codex",
+        selectionIds: ["openai-subscription"],
+        allowedClient: "Codex CLI / Codex-backed provider",
+        billingMode: "subscription-coding-cli",
+        authMode: "oauth",
+        availability: "available",
+        setupHint: "Sign in through the app or run codex login.",
+        directProviderId: "openai-api",
+    },
+    "gemini-cli": {
+        providerId: "gemini-cli",
+        displayName: "Gemini CLI",
+        selectionIds: ["gemini-subscription"],
+        allowedClient: "Gemini CLI",
+        billingMode: "subscription-coding-cli",
+        authMode: "external-cli",
+        availability: "external",
+        setupHint: "Run gemini auth login; tokens are not imported into API env vars.",
+    },
+    "zai-coding": {
+        providerId: "zai-coding",
+        displayName: "z.ai Coding Plan",
+        selectionIds: ["zai-coding-subscription"],
+        allowedClient: "z.ai Coding endpoint",
+        billingMode: "subscription-coding-plan",
+        authMode: "coding-plan-key",
+        availability: "available",
+        setupHint: "Add a z.ai Coding Plan credential for the dedicated coding endpoint.",
+        directProviderId: "zai-api",
+        defaultBaseUrl: CODING_PLAN_PROVIDER_BASE_URL["zai-coding"],
+        probePath: "/models",
+    },
+    "kimi-coding": {
+        providerId: "kimi-coding",
+        displayName: "Kimi Code",
+        selectionIds: ["kimi-coding-subscription"],
+        allowedClient: "Kimi Code endpoint",
+        billingMode: "subscription-coding-plan",
+        authMode: "coding-plan-key",
+        availability: "available",
+        setupHint: "Add a Kimi Code credential for the dedicated coding endpoint.",
+        directProviderId: "moonshot-api",
+        defaultBaseUrl: CODING_PLAN_PROVIDER_BASE_URL["kimi-coding"],
+        probePath: "/models",
+    },
+    "deepseek-coding": {
+        providerId: "deepseek-coding",
+        displayName: "DeepSeek Coding Plan",
+        selectionIds: ["deepseek-coding-subscription"],
+        allowedClient: "Unavailable",
+        billingMode: "subscription-coding-plan",
+        authMode: "unavailable",
+        availability: "unavailable",
+        setupHint: "Use the DeepSeek direct API-key provider if you have API billing.",
+        directProviderId: "deepseek-api",
+        availabilityReason: "No first-party DeepSeek coding subscription surface is available to integrate without substituting general API billing.",
+    },
 };
+export function getSubscriptionProviderMetadata(provider) {
+    return SUBSCRIPTION_PROVIDER_METADATA[provider];
+}

package/packages/agent/src/auth/vendor/pi-oauth/anthropic-login.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Anthropic OAuth (Claude Pro/Max) — authorization code + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ *
+ * Anthropic's OAuth uses a fixed redirect URI on `console.anthropic.com`
+ * that displays the auth code on completion — there's no loopback
+ * listener. The flow surfaces an `authUrl` plus a `submitCode()` hook
+ * the UI / CLI calls once the user has copied the code.
+ */
+export interface AnthropicOAuthCredentials {
+    refresh: string;
+    access: string;
+    expires: number;
+}
+/**
+ * Programmatic Anthropic OAuth flow.
+ *
+ * `authUrl` is ready immediately. The caller MUST eventually call
+ * either `submitCode(code)` (after the user has pasted the
+ * `code#state` blob from the redirect page) or `cancel()`. The
+ * `completion` promise rejects if the flow is cancelled.
+ */
+export interface AnthropicOAuthFlowHandle {
+    authUrl: string;
+    /** Pass `code#state` from the redirect page. */
+    submitCode: (code: string) => void;
+    /** Resolves with credentials once `submitCode` lands and the token exchange succeeds. */
+    completion: Promise<AnthropicOAuthCredentials>;
+    cancel: (reason?: string) => void;
+}
+/**
+ * Start an Anthropic OAuth flow. Returns immediately with the auth
+ * URL and a `submitCode` hook. The token exchange happens inside
+ * `completion` once the caller submits the code.
+ */
+export declare function startAnthropicOAuthFlowRaw(): Promise<AnthropicOAuthFlowHandle>;
+/**
+ * @param onAuthUrl - Receives the browser authorization URL
+ * @param onPromptCode - Resolves with pasted code (format: code#state)
+ *
+ * Thin compatibility wrapper around `startAnthropicOAuthFlowRaw` for
+ * the CLI entrypoint and any older callers. New code should use
+ * `startAnthropicOAuthFlowRaw` (or the higher-level
+ * `startAnthropicOAuthFlow` in `auth/oauth-flow.ts`) directly.
+ */
+export declare function loginAnthropic(onAuthUrl: (url: string) => void, onPromptCode: () => Promise<string>): Promise<AnthropicOAuthCredentials>;
+export declare function refreshAnthropicToken(refreshToken: string): Promise<AnthropicOAuthCredentials>;
+//# sourceMappingURL=anthropic-login.d.ts.map

package/packages/agent/src/auth/vendor/pi-oauth/anthropic-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-login.d.ts","sourceRoot":"","sources":["../../../../../../../src/auth/vendor/pi-oauth/anthropic-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,yFAAyF;IACzF,UAAU,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,wBAAwB,CAAC,CA6DpF;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAMpC;AAED,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,yBAAyB,CAAC,CAwBpC"}

package/packages/agent/src/auth/vendor/pi-oauth/anthropic-login.js

@@ -0,0 +1,113 @@
+/**
+ * Anthropic OAuth (Claude Pro/Max) — authorization code + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ *
+ * Anthropic's OAuth uses a fixed redirect URI on `console.anthropic.com`
+ * that displays the auth code on completion — there's no loopback
+ * listener. The flow surfaces an `authUrl` plus a `submitCode()` hook
+ * the UI / CLI calls once the user has copied the code.
+ */
+import { generatePKCE } from "./pkce.js";
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
+const REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
+const SCOPES = "org:create_api_key user:profile user:inference";
+/**
+ * Start an Anthropic OAuth flow. Returns immediately with the auth
+ * URL and a `submitCode` hook. The token exchange happens inside
+ * `completion` once the caller submits the code.
+ */
+export async function startAnthropicOAuthFlowRaw() {
+    const { verifier, challenge } = await generatePKCE();
+    const authParams = new URLSearchParams({
+        code: "true",
+        client_id: CLIENT_ID,
+        response_type: "code",
+        redirect_uri: REDIRECT_URI,
+        scope: SCOPES,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state: verifier,
+    });
+    const authUrl = `${AUTHORIZE_URL}?${authParams.toString()}`;
+    let resolveCode = null;
+    let rejectCode = null;
+    const codePromise = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    const completion = (async () => {
+        const authCode = await codePromise;
+        const splits = authCode.split("#");
+        const code = splits[0];
+        const state = splits[1];
+        const tokenResponse = await fetch(TOKEN_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "authorization_code",
+                client_id: CLIENT_ID,
+                code,
+                state,
+                redirect_uri: REDIRECT_URI,
+                code_verifier: verifier,
+            }),
+        });
+        if (!tokenResponse.ok) {
+            const errText = await tokenResponse.text();
+            throw new Error(`Token exchange failed: ${errText}`);
+        }
+        const tokenData = (await tokenResponse.json());
+        const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;
+        return {
+            refresh: tokenData.refresh_token,
+            access: tokenData.access_token,
+            expires: expiresAt,
+        };
+    })();
+    return {
+        authUrl,
+        submitCode: (code) => resolveCode?.(code),
+        completion,
+        cancel: (reason = "Cancelled") => rejectCode?.(new Error(reason)),
+    };
+}
+/**
+ * @param onAuthUrl - Receives the browser authorization URL
+ * @param onPromptCode - Resolves with pasted code (format: code#state)
+ *
+ * Thin compatibility wrapper around `startAnthropicOAuthFlowRaw` for
+ * the CLI entrypoint and any older callers. New code should use
+ * `startAnthropicOAuthFlowRaw` (or the higher-level
+ * `startAnthropicOAuthFlow` in `auth/oauth-flow.ts`) directly.
+ */
+export async function loginAnthropic(onAuthUrl, onPromptCode) {
+    const handle = await startAnthropicOAuthFlowRaw();
+    onAuthUrl(handle.authUrl);
+    const code = await onPromptCode();
+    handle.submitCode(code);
+    return handle.completion;
+}
+export async function refreshAnthropicToken(refreshToken) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "refresh_token",
+            client_id: CLIENT_ID,
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!response.ok) {
+        const errText = await response.text();
+        throw new Error(`Anthropic token refresh failed: ${errText}`);
+    }
+    const data = (await response.json());
+    return {
+        refresh: data.refresh_token,
+        access: data.access_token,
+        expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+    };
+}

package/packages/agent/src/auth/vendor/pi-oauth/openai-codex-login.d.ts

@@ -0,0 +1,26 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) — local callback on :1455 + PKCE.
+ * Inlined OAuth flow (MIT) — vendored to avoid a runtime dependency.
+ */
+export interface OpenAiCodexOAuthCredentials {
+    access: string;
+    refresh: string;
+    expires: number;
+    accountId: string;
+}
+export interface OAuthPrompt {
+    message: string;
+    placeholder?: string;
+}
+export declare function loginOpenAICodex(options: {
+    onAuth: (info: {
+        url: string;
+        instructions?: string;
+    }) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    originator?: string;
+}): Promise<OpenAiCodexOAuthCredentials>;
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OpenAiCodexOAuthCredentials>;
+//# sourceMappingURL=openai-codex-login.d.ts.map

package/packages/agent/src/auth/vendor/pi-oauth/openai-codex-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-codex-login.d.ts","sourceRoot":"","sources":["../../../../../../../src/auth/vendor/pi-oauth/openai-codex-login.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAsCH,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAgRD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAmFvC;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,2BAA2B,CAAC,CAetC"}