@imdigitalashish/zpi 0.1.1

package/dist/core/auth-storage.js

@@ -0,0 +1,394 @@
+/**
+ * Credential storage for API keys and OAuth tokens.
+ * Handles loading, saving, and refreshing credentials from auth.json.
+ *
+ * Uses file locking to prevent race conditions when multiple pi instances
+ * try to refresh tokens simultaneously.
+ */
+import { getEnvApiKey, getOAuthApiKey, getOAuthProvider, getOAuthProviders, } from "@mariozechner/pi-ai";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import lockfile from "proper-lockfile";
+import { getAgentDir } from "../config.js";
+import { resolveConfigValue } from "./resolve-config-value.js";
+export class FileAuthStorageBackend {
+    authPath;
+    constructor(authPath = join(getAgentDir(), "auth.json")) {
+        this.authPath = authPath;
+    }
+    ensureParentDir() {
+        const dir = dirname(this.authPath);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+    }
+    ensureFileExists() {
+        if (!existsSync(this.authPath)) {
+            writeFileSync(this.authPath, "{}", "utf-8");
+            chmodSync(this.authPath, 0o600);
+        }
+    }
+    withLock(fn) {
+        this.ensureParentDir();
+        this.ensureFileExists();
+        let release;
+        try {
+            release = lockfile.lockSync(this.authPath, { realpath: false });
+            const current = existsSync(this.authPath) ? readFileSync(this.authPath, "utf-8") : undefined;
+            const { result, next } = fn(current);
+            if (next !== undefined) {
+                writeFileSync(this.authPath, next, "utf-8");
+                chmodSync(this.authPath, 0o600);
+            }
+            return result;
+        }
+        finally {
+            if (release) {
+                release();
+            }
+        }
+    }
+    async withLockAsync(fn) {
+        this.ensureParentDir();
+        this.ensureFileExists();
+        let release;
+        let lockCompromised = false;
+        let lockCompromisedError;
+        const throwIfCompromised = () => {
+            if (lockCompromised) {
+                throw lockCompromisedError ?? new Error("Auth storage lock was compromised");
+            }
+        };
+        try {
+            release = await lockfile.lock(this.authPath, {
+                retries: {
+                    retries: 10,
+                    factor: 2,
+                    minTimeout: 100,
+                    maxTimeout: 10000,
+                    randomize: true,
+                },
+                stale: 30000,
+                onCompromised: (err) => {
+                    lockCompromised = true;
+                    lockCompromisedError = err;
+                },
+            });
+            throwIfCompromised();
+            const current = existsSync(this.authPath) ? readFileSync(this.authPath, "utf-8") : undefined;
+            const { result, next } = await fn(current);
+            throwIfCompromised();
+            if (next !== undefined) {
+                writeFileSync(this.authPath, next, "utf-8");
+                chmodSync(this.authPath, 0o600);
+            }
+            throwIfCompromised();
+            return result;
+        }
+        finally {
+            if (release) {
+                try {
+                    await release();
+                }
+                catch {
+                    // Ignore unlock errors when lock is compromised.
+                }
+            }
+        }
+    }
+}
+export class InMemoryAuthStorageBackend {
+    value;
+    withLock(fn) {
+        const { result, next } = fn(this.value);
+        if (next !== undefined) {
+            this.value = next;
+        }
+        return result;
+    }
+    async withLockAsync(fn) {
+        const { result, next } = await fn(this.value);
+        if (next !== undefined) {
+            this.value = next;
+        }
+        return result;
+    }
+}
+/**
+ * Credential storage backed by a JSON file.
+ */
+export class AuthStorage {
+    storage;
+    data = {};
+    runtimeOverrides = new Map();
+    fallbackResolver;
+    loadError = null;
+    errors = [];
+    constructor(storage) {
+        this.storage = storage;
+        this.reload();
+    }
+    static create(authPath) {
+        return new AuthStorage(new FileAuthStorageBackend(authPath ?? join(getAgentDir(), "auth.json")));
+    }
+    static fromStorage(storage) {
+        return new AuthStorage(storage);
+    }
+    static inMemory(data = {}) {
+        const storage = new InMemoryAuthStorageBackend();
+        storage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));
+        return AuthStorage.fromStorage(storage);
+    }
+    /**
+     * Set a runtime API key override (not persisted to disk).
+     * Used for CLI --api-key flag.
+     */
+    setRuntimeApiKey(provider, apiKey) {
+        this.runtimeOverrides.set(provider, apiKey);
+    }
+    /**
+     * Remove a runtime API key override.
+     */
+    removeRuntimeApiKey(provider) {
+        this.runtimeOverrides.delete(provider);
+    }
+    /**
+     * Set a fallback resolver for API keys not found in auth.json or env vars.
+     * Used for custom provider keys from models.json.
+     */
+    setFallbackResolver(resolver) {
+        this.fallbackResolver = resolver;
+    }
+    recordError(error) {
+        const normalizedError = error instanceof Error ? error : new Error(String(error));
+        this.errors.push(normalizedError);
+    }
+    parseStorageData(content) {
+        if (!content) {
+            return {};
+        }
+        return JSON.parse(content);
+    }
+    /**
+     * Reload credentials from storage.
+     */
+    reload() {
+        let content;
+        try {
+            this.storage.withLock((current) => {
+                content = current;
+                return { result: undefined };
+            });
+            this.data = this.parseStorageData(content);
+            this.loadError = null;
+        }
+        catch (error) {
+            this.loadError = error;
+            this.recordError(error);
+        }
+    }
+    persistProviderChange(provider, credential) {
+        if (this.loadError) {
+            return;
+        }
+        try {
+            this.storage.withLock((current) => {
+                const currentData = this.parseStorageData(current);
+                const merged = { ...currentData };
+                if (credential) {
+                    merged[provider] = credential;
+                }
+                else {
+                    delete merged[provider];
+                }
+                return { result: undefined, next: JSON.stringify(merged, null, 2) };
+            });
+        }
+        catch (error) {
+            this.recordError(error);
+        }
+    }
+    /**
+     * Get credential for a provider.
+     */
+    get(provider) {
+        return this.data[provider] ?? undefined;
+    }
+    /**
+     * Set credential for a provider.
+     */
+    set(provider, credential) {
+        this.data[provider] = credential;
+        this.persistProviderChange(provider, credential);
+    }
+    /**
+     * Remove credential for a provider.
+     */
+    remove(provider) {
+        delete this.data[provider];
+        this.persistProviderChange(provider, undefined);
+    }
+    /**
+     * List all providers with credentials.
+     */
+    list() {
+        return Object.keys(this.data);
+    }
+    /**
+     * Check if credentials exist for a provider in auth.json.
+     */
+    has(provider) {
+        return provider in this.data;
+    }
+    /**
+     * Check if any form of auth is configured for a provider.
+     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
+     */
+    hasAuth(provider) {
+        if (this.runtimeOverrides.has(provider))
+            return true;
+        if (this.data[provider])
+            return true;
+        if (getEnvApiKey(provider))
+            return true;
+        if (this.fallbackResolver?.(provider))
+            return true;
+        return false;
+    }
+    /**
+     * Get all credentials (for passing to getOAuthApiKey).
+     */
+    getAll() {
+        return { ...this.data };
+    }
+    drainErrors() {
+        const drained = [...this.errors];
+        this.errors = [];
+        return drained;
+    }
+    /**
+     * Login to an OAuth provider.
+     */
+    async login(providerId, callbacks) {
+        const provider = getOAuthProvider(providerId);
+        if (!provider) {
+            throw new Error(`Unknown OAuth provider: ${providerId}`);
+        }
+        const credentials = await provider.login(callbacks);
+        this.set(providerId, { type: "oauth", ...credentials });
+    }
+    /**
+     * Logout from a provider.
+     */
+    logout(provider) {
+        this.remove(provider);
+    }
+    /**
+     * Refresh OAuth token with backend locking to prevent race conditions.
+     * Multiple pi instances may try to refresh simultaneously when tokens expire.
+     */
+    async refreshOAuthTokenWithLock(providerId) {
+        const provider = getOAuthProvider(providerId);
+        if (!provider) {
+            return null;
+        }
+        const result = await this.storage.withLockAsync(async (current) => {
+            const currentData = this.parseStorageData(current);
+            this.data = currentData;
+            this.loadError = null;
+            const cred = currentData[providerId];
+            if (cred?.type !== "oauth") {
+                return { result: null };
+            }
+            if (Date.now() < cred.expires) {
+                return { result: { apiKey: provider.getApiKey(cred), newCredentials: cred } };
+            }
+            const oauthCreds = {};
+            for (const [key, value] of Object.entries(currentData)) {
+                if (value.type === "oauth") {
+                    oauthCreds[key] = value;
+                }
+            }
+            const refreshed = await getOAuthApiKey(providerId, oauthCreds);
+            if (!refreshed) {
+                return { result: null };
+            }
+            const merged = {
+                ...currentData,
+                [providerId]: { type: "oauth", ...refreshed.newCredentials },
+            };
+            this.data = merged;
+            this.loadError = null;
+            return { result: refreshed, next: JSON.stringify(merged, null, 2) };
+        });
+        return result;
+    }
+    /**
+     * Get API key for a provider.
+     * Priority:
+     * 1. Runtime override (CLI --api-key)
+     * 2. API key from auth.json
+     * 3. OAuth token from auth.json (auto-refreshed with locking)
+     * 4. Environment variable
+     * 5. Fallback resolver (models.json custom providers)
+     */
+    async getApiKey(providerId) {
+        // Runtime override takes highest priority
+        const runtimeKey = this.runtimeOverrides.get(providerId);
+        if (runtimeKey) {
+            return runtimeKey;
+        }
+        const cred = this.data[providerId];
+        if (cred?.type === "api_key") {
+            return resolveConfigValue(cred.key);
+        }
+        if (cred?.type === "oauth") {
+            const provider = getOAuthProvider(providerId);
+            if (!provider) {
+                // Unknown OAuth provider, can't get API key
+                return undefined;
+            }
+            // Check if token needs refresh
+            const needsRefresh = Date.now() >= cred.expires;
+            if (needsRefresh) {
+                // Use locked refresh to prevent race conditions
+                try {
+                    const result = await this.refreshOAuthTokenWithLock(providerId);
+                    if (result) {
+                        return result.apiKey;
+                    }
+                }
+                catch (error) {
+                    this.recordError(error);
+                    // Refresh failed - re-read file to check if another instance succeeded
+                    this.reload();
+                    const updatedCred = this.data[providerId];
+                    if (updatedCred?.type === "oauth" && Date.now() < updatedCred.expires) {
+                        // Another instance refreshed successfully, use those credentials
+                        return provider.getApiKey(updatedCred);
+                    }
+                    // Refresh truly failed - return undefined so model discovery skips this provider
+                    // User can /login to re-authenticate (credentials preserved for retry)
+                    return undefined;
+                }
+            }
+            else {
+                // Token not expired, use current access token
+                return provider.getApiKey(cred);
+            }
+        }
+        // Fall back to environment variable
+        const envKey = getEnvApiKey(providerId);
+        if (envKey)
+            return envKey;
+        // Fall back to custom resolver (e.g., models.json custom providers)
+        return this.fallbackResolver?.(providerId) ?? undefined;
+    }
+    /**
+     * Get all registered OAuth providers
+     */
+    getOAuthProviders() {
+        return getOAuthProviders();
+    }
+}
+//# sourceMappingURL=auth-storage.js.map

package/dist/core/auth-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAIjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAyB/D,MAAM,OAAO,sBAAsB;IACd,QAAQ;IAA5B,YAAoB,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,EAAE;wBAArD,QAAQ;IAA8C,CAAC;IAEnE,eAAe,GAAS;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IAAA,CACD;IAEO,gBAAgB,GAAS;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IAAA,CACD;IAED,QAAQ,CAAI,EAAkD,EAAK;QAClE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IAAA,CACD;IAED,KAAK,CAAC,aAAa,CAAI,EAA2D,EAAc;QAC/F,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC;YAChC,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QAAA,CACD,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAC5C,OAAO,EAAE;oBACR,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,CAAC;oBACT,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,IAAI;iBACf;gBACD,KAAK,EAAE,KAAK;gBACZ,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;oBACvB,eAAe,GAAG,IAAI,CAAC;oBACvB,oBAAoB,GAAG,GAAG,CAAC;gBAAA,CAC3B;aACD,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IAAA,CACD;CACD;AAED,MAAM,OAAO,0BAA0B;IAC9B,KAAK,CAAqB;IAElC,QAAQ,CAAI,EAAkD,EAAK;QAClE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,aAAa,CAAI,EAA2D,EAAc;QAC/F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IAOK,OAAO;IAN3B,IAAI,GAAoB,EAAE,CAAC;IAC3B,gBAAgB,GAAwB,IAAI,GAAG,EAAE,CAAC;IAClD,gBAAgB,CAA4C;IAC5D,SAAS,GAAiB,IAAI,CAAC;IAC/B,MAAM,GAAY,EAAE,CAAC;IAE7B,YAA4B,OAA2B,EAAE;uBAA7B,OAAO;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;IAAA,CACd;IAED,MAAM,CAAC,MAAM,CAAC,QAAiB,EAAe;QAC7C,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAAA,CACjG;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B,EAAe;QAC5D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CAChC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE,EAAe;QACxD,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CACxC;IAED;;;OAGG;IACH,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAQ;QACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAAA,CAC5C;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAgB,EAAQ;QAC3C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAA,CACvC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAkD,EAAQ;QAC7E,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IAAA,CACjC;IAEO,WAAW,CAAC,KAAc,EAAQ;QACzC,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAAA,CAClC;IAEO,gBAAgB,CAAC,OAA2B,EAAmB;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAAA,CAC9C;IAED;;OAEG;IACH,MAAM,GAAS;QACd,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAAA,CAC7B,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,GAAG,KAAc,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IAAA,CACD;IAEO,qBAAqB,CAAC,QAAgB,EAAE,UAAsC,EAAQ;QAC7F,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC;gBACnD,IAAI,UAAU,EAAE,CAAC;oBAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACP,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAAA,CACpE,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IAAA,CACD;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB,EAA8B;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAAA,CACxC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB,EAAE,UAA0B,EAAQ;QACvD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QACjC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAAA,CACjD;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,EAAQ;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAAA,CAChD;IAED;;OAEG;IACH,IAAI,GAAa;QAChB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAA,CAC9B;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB,EAAW;QAC9B,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAAA,CAC7B;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB,EAAW;QAClC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,KAAK,CAAC;IAAA,CACb;IAED;;OAEG;IACH,MAAM,GAAoB;QACzB,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAAA,CACxB;IAED,WAAW,GAAY;QACtB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IAAA,CACf;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,UAA2B,EAAE,SAA8B,EAAiB;QACvF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;IAAA,CACxD;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,EAAQ;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAA,CACtB;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACtC,UAA2B,EAC4C;QACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;YACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YAEtB,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/E,CAAC;YAED,MAAM,UAAU,GAAqC,EAAE,CAAC;YACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACzB,CAAC;YACF,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,MAAM,MAAM,GAAoB;gBAC/B,GAAG,WAAW;gBACd,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,cAAc,EAAE;aAC5D,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAAA,CACpE,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAAA,CACd;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,EAA+B;QAChE,0CAA0C;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,4CAA4C;gBAC5C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,+BAA+B;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;YAEhD,IAAI,YAAY,EAAE,CAAC;gBAClB,gDAAgD;gBAChD,IAAI,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;oBAChE,IAAI,MAAM,EAAE,CAAC;wBACZ,OAAO,MAAM,CAAC,MAAM,CAAC;oBACtB,CAAC;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACxB,uEAAuE;oBACvE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACd,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAE1C,IAAI,WAAW,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;wBACvE,iEAAiE;wBACjE,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;oBACxC,CAAC;oBAED,iFAAiF;oBACjF,uEAAuE;oBACvE,OAAO,SAAS,CAAC;gBAClB,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,8CAA8C;gBAC9C,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACF,CAAC;QAED,oCAAoC;QACpC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,oEAAoE;QACpE,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IAAA,CACxD;IAED;;OAEG;IACH,iBAAiB,GAAG;QACnB,OAAO,iBAAiB,EAAE,CAAC;IAAA,CAC3B;CACD","sourcesContent":["/**\r\n * Credential storage for API keys and OAuth tokens.\r\n * Handles loading, saving, and refreshing credentials from auth.json.\r\n *\r\n * Uses file locking to prevent race conditions when multiple pi instances\r\n * try to refresh tokens simultaneously.\r\n */\r\n\r\nimport {\r\n\tgetEnvApiKey,\r\n\tgetOAuthApiKey,\r\n\tgetOAuthProvider,\r\n\tgetOAuthProviders,\r\n\ttype OAuthCredentials,\r\n\ttype OAuthLoginCallbacks,\r\n\ttype OAuthProviderId,\r\n} from \"@mariozechner/pi-ai\";\r\nimport { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\r\nimport { dirname, join } from \"path\";\r\nimport lockfile from \"proper-lockfile\";\r\nimport { getAgentDir } from \"../config.js\";\r\nimport { resolveConfigValue } from \"./resolve-config-value.js\";\r\n\r\nexport type ApiKeyCredential = {\r\n\ttype: \"api_key\";\r\n\tkey: string;\r\n};\r\n\r\nexport type OAuthCredential = {\r\n\ttype: \"oauth\";\r\n} & OAuthCredentials;\r\n\r\nexport type AuthCredential = ApiKeyCredential | OAuthCredential;\r\n\r\nexport type AuthStorageData = Record<string, AuthCredential>;\r\n\r\ntype LockResult<T> = {\r\n\tresult: T;\r\n\tnext?: string;\r\n};\r\n\r\nexport interface AuthStorageBackend {\r\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\r\n\twithLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;\r\n}\r\n\r\nexport class FileAuthStorageBackend implements AuthStorageBackend {\r\n\tconstructor(private authPath: string = join(getAgentDir(), \"auth.json\")) {}\r\n\r\n\tprivate ensureParentDir(): void {\r\n\t\tconst dir = dirname(this.authPath);\r\n\t\tif (!existsSync(dir)) {\r\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\r\n\t\t}\r\n\t}\r\n\r\n\tprivate ensureFileExists(): void {\r\n\t\tif (!existsSync(this.authPath)) {\r\n\t\t\twriteFileSync(this.authPath, \"{}\", \"utf-8\");\r\n\t\t\tchmodSync(this.authPath, 0o600);\r\n\t\t}\r\n\t}\r\n\r\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\r\n\t\tthis.ensureParentDir();\r\n\t\tthis.ensureFileExists();\r\n\r\n\t\tlet release: (() => void) | undefined;\r\n\t\ttry {\r\n\t\t\trelease = lockfile.lockSync(this.authPath, { realpath: false });\r\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\r\n\t\t\tconst { result, next } = fn(current);\r\n\t\t\tif (next !== undefined) {\r\n\t\t\t\twriteFileSync(this.authPath, next, \"utf-8\");\r\n\t\t\t\tchmodSync(this.authPath, 0o600);\r\n\t\t\t}\r\n\t\t\treturn result;\r\n\t\t} finally {\r\n\t\t\tif (release) {\r\n\t\t\t\trelease();\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n\r\n\tasync withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T> {\r\n\t\tthis.ensureParentDir();\r\n\t\tthis.ensureFileExists();\r\n\r\n\t\tlet release: (() => Promise<void>) | undefined;\r\n\t\tlet lockCompromised = false;\r\n\t\tlet lockCompromisedError: Error | undefined;\r\n\t\tconst throwIfCompromised = () => {\r\n\t\t\tif (lockCompromised) {\r\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\r\n\t\t\t}\r\n\t\t};\r\n\r\n\t\ttry {\r\n\t\t\trelease = await lockfile.lock(this.authPath, {\r\n\t\t\t\tretries: {\r\n\t\t\t\t\tretries: 10,\r\n\t\t\t\t\tfactor: 2,\r\n\t\t\t\t\tminTimeout: 100,\r\n\t\t\t\t\tmaxTimeout: 10000,\r\n\t\t\t\t\trandomize: true,\r\n\t\t\t\t},\r\n\t\t\t\tstale: 30000,\r\n\t\t\t\tonCompromised: (err) => {\r\n\t\t\t\t\tlockCompromised = true;\r\n\t\t\t\t\tlockCompromisedError = err;\r\n\t\t\t\t},\r\n\t\t\t});\r\n\r\n\t\t\tthrowIfCompromised();\r\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\r\n\t\t\tconst { result, next } = await fn(current);\r\n\t\t\tthrowIfCompromised();\r\n\t\t\tif (next !== undefined) {\r\n\t\t\t\twriteFileSync(this.authPath, next, \"utf-8\");\r\n\t\t\t\tchmodSync(this.authPath, 0o600);\r\n\t\t\t}\r\n\t\t\tthrowIfCompromised();\r\n\t\t\treturn result;\r\n\t\t} finally {\r\n\t\t\tif (release) {\r\n\t\t\t\ttry {\r\n\t\t\t\t\tawait release();\r\n\t\t\t\t} catch {\r\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n}\r\n\r\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\r\n\tprivate value: string | undefined;\r\n\r\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\r\n\t\tconst { result, next } = fn(this.value);\r\n\t\tif (next !== undefined) {\r\n\t\t\tthis.value = next;\r\n\t\t}\r\n\t\treturn result;\r\n\t}\r\n\r\n\tasync withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T> {\r\n\t\tconst { result, next } = await fn(this.value);\r\n\t\tif (next !== undefined) {\r\n\t\t\tthis.value = next;\r\n\t\t}\r\n\t\treturn result;\r\n\t}\r\n}\r\n\r\n/**\r\n * Credential storage backed by a JSON file.\r\n */\r\nexport class AuthStorage {\r\n\tprivate data: AuthStorageData = {};\r\n\tprivate runtimeOverrides: Map<string, string> = new Map();\r\n\tprivate fallbackResolver?: (provider: string) => string | undefined;\r\n\tprivate loadError: Error | null = null;\r\n\tprivate errors: Error[] = [];\r\n\r\n\tprivate constructor(private storage: AuthStorageBackend) {\r\n\t\tthis.reload();\r\n\t}\r\n\r\n\tstatic create(authPath?: string): AuthStorage {\r\n\t\treturn new AuthStorage(new FileAuthStorageBackend(authPath ?? join(getAgentDir(), \"auth.json\")));\r\n\t}\r\n\r\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\r\n\t\treturn new AuthStorage(storage);\r\n\t}\r\n\r\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\r\n\t\tconst storage = new InMemoryAuthStorageBackend();\r\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\r\n\t\treturn AuthStorage.fromStorage(storage);\r\n\t}\r\n\r\n\t/**\r\n\t * Set a runtime API key override (not persisted to disk).\r\n\t * Used for CLI --api-key flag.\r\n\t */\r\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\r\n\t\tthis.runtimeOverrides.set(provider, apiKey);\r\n\t}\r\n\r\n\t/**\r\n\t * Remove a runtime API key override.\r\n\t */\r\n\tremoveRuntimeApiKey(provider: string): void {\r\n\t\tthis.runtimeOverrides.delete(provider);\r\n\t}\r\n\r\n\t/**\r\n\t * Set a fallback resolver for API keys not found in auth.json or env vars.\r\n\t * Used for custom provider keys from models.json.\r\n\t */\r\n\tsetFallbackResolver(resolver: (provider: string) => string | undefined): void {\r\n\t\tthis.fallbackResolver = resolver;\r\n\t}\r\n\r\n\tprivate recordError(error: unknown): void {\r\n\t\tconst normalizedError = error instanceof Error ? error : new Error(String(error));\r\n\t\tthis.errors.push(normalizedError);\r\n\t}\r\n\r\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\r\n\t\tif (!content) {\r\n\t\t\treturn {};\r\n\t\t}\r\n\t\treturn JSON.parse(content) as AuthStorageData;\r\n\t}\r\n\r\n\t/**\r\n\t * Reload credentials from storage.\r\n\t */\r\n\treload(): void {\r\n\t\tlet content: string | undefined;\r\n\t\ttry {\r\n\t\t\tthis.storage.withLock((current) => {\r\n\t\t\t\tcontent = current;\r\n\t\t\t\treturn { result: undefined };\r\n\t\t\t});\r\n\t\t\tthis.data = this.parseStorageData(content);\r\n\t\t\tthis.loadError = null;\r\n\t\t} catch (error) {\r\n\t\t\tthis.loadError = error as Error;\r\n\t\t\tthis.recordError(error);\r\n\t\t}\r\n\t}\r\n\r\n\tprivate persistProviderChange(provider: string, credential: AuthCredential | undefined): void {\r\n\t\tif (this.loadError) {\r\n\t\t\treturn;\r\n\t\t}\r\n\r\n\t\ttry {\r\n\t\t\tthis.storage.withLock((current) => {\r\n\t\t\t\tconst currentData = this.parseStorageData(current);\r\n\t\t\t\tconst merged: AuthStorageData = { ...currentData };\r\n\t\t\t\tif (credential) {\r\n\t\t\t\t\tmerged[provider] = credential;\r\n\t\t\t\t} else {\r\n\t\t\t\t\tdelete merged[provider];\r\n\t\t\t\t}\r\n\t\t\t\treturn { result: undefined, next: JSON.stringify(merged, null, 2) };\r\n\t\t\t});\r\n\t\t} catch (error) {\r\n\t\t\tthis.recordError(error);\r\n\t\t}\r\n\t}\r\n\r\n\t/**\r\n\t * Get credential for a provider.\r\n\t */\r\n\tget(provider: string): AuthCredential | undefined {\r\n\t\treturn this.data[provider] ?? undefined;\r\n\t}\r\n\r\n\t/**\r\n\t * Set credential for a provider.\r\n\t */\r\n\tset(provider: string, credential: AuthCredential): void {\r\n\t\tthis.data[provider] = credential;\r\n\t\tthis.persistProviderChange(provider, credential);\r\n\t}\r\n\r\n\t/**\r\n\t * Remove credential for a provider.\r\n\t */\r\n\tremove(provider: string): void {\r\n\t\tdelete this.data[provider];\r\n\t\tthis.persistProviderChange(provider, undefined);\r\n\t}\r\n\r\n\t/**\r\n\t * List all providers with credentials.\r\n\t */\r\n\tlist(): string[] {\r\n\t\treturn Object.keys(this.data);\r\n\t}\r\n\r\n\t/**\r\n\t * Check if credentials exist for a provider in auth.json.\r\n\t */\r\n\thas(provider: string): boolean {\r\n\t\treturn provider in this.data;\r\n\t}\r\n\r\n\t/**\r\n\t * Check if any form of auth is configured for a provider.\r\n\t * Unlike getApiKey(), this doesn't refresh OAuth tokens.\r\n\t */\r\n\thasAuth(provider: string): boolean {\r\n\t\tif (this.runtimeOverrides.has(provider)) return true;\r\n\t\tif (this.data[provider]) return true;\r\n\t\tif (getEnvApiKey(provider)) return true;\r\n\t\tif (this.fallbackResolver?.(provider)) return true;\r\n\t\treturn false;\r\n\t}\r\n\r\n\t/**\r\n\t * Get all credentials (for passing to getOAuthApiKey).\r\n\t */\r\n\tgetAll(): AuthStorageData {\r\n\t\treturn { ...this.data };\r\n\t}\r\n\r\n\tdrainErrors(): Error[] {\r\n\t\tconst drained = [...this.errors];\r\n\t\tthis.errors = [];\r\n\t\treturn drained;\r\n\t}\r\n\r\n\t/**\r\n\t * Login to an OAuth provider.\r\n\t */\r\n\tasync login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void> {\r\n\t\tconst provider = getOAuthProvider(providerId);\r\n\t\tif (!provider) {\r\n\t\t\tthrow new Error(`Unknown OAuth provider: ${providerId}`);\r\n\t\t}\r\n\r\n\t\tconst credentials = await provider.login(callbacks);\r\n\t\tthis.set(providerId, { type: \"oauth\", ...credentials });\r\n\t}\r\n\r\n\t/**\r\n\t * Logout from a provider.\r\n\t */\r\n\tlogout(provider: string): void {\r\n\t\tthis.remove(provider);\r\n\t}\r\n\r\n\t/**\r\n\t * Refresh OAuth token with backend locking to prevent race conditions.\r\n\t * Multiple pi instances may try to refresh simultaneously when tokens expire.\r\n\t */\r\n\tprivate async refreshOAuthTokenWithLock(\r\n\t\tproviderId: OAuthProviderId,\r\n\t): Promise<{ apiKey: string; newCredentials: OAuthCredentials } | null> {\r\n\t\tconst provider = getOAuthProvider(providerId);\r\n\t\tif (!provider) {\r\n\t\t\treturn null;\r\n\t\t}\r\n\r\n\t\tconst result = await this.storage.withLockAsync(async (current) => {\r\n\t\t\tconst currentData = this.parseStorageData(current);\r\n\t\t\tthis.data = currentData;\r\n\t\t\tthis.loadError = null;\r\n\r\n\t\t\tconst cred = currentData[providerId];\r\n\t\t\tif (cred?.type !== \"oauth\") {\r\n\t\t\t\treturn { result: null };\r\n\t\t\t}\r\n\r\n\t\t\tif (Date.now() < cred.expires) {\r\n\t\t\t\treturn { result: { apiKey: provider.getApiKey(cred), newCredentials: cred } };\r\n\t\t\t}\r\n\r\n\t\t\tconst oauthCreds: Record<string, OAuthCredentials> = {};\r\n\t\t\tfor (const [key, value] of Object.entries(currentData)) {\r\n\t\t\t\tif (value.type === \"oauth\") {\r\n\t\t\t\t\toauthCreds[key] = value;\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tconst refreshed = await getOAuthApiKey(providerId, oauthCreds);\r\n\t\t\tif (!refreshed) {\r\n\t\t\t\treturn { result: null };\r\n\t\t\t}\r\n\r\n\t\t\tconst merged: AuthStorageData = {\r\n\t\t\t\t...currentData,\r\n\t\t\t\t[providerId]: { type: \"oauth\", ...refreshed.newCredentials },\r\n\t\t\t};\r\n\t\t\tthis.data = merged;\r\n\t\t\tthis.loadError = null;\r\n\t\t\treturn { result: refreshed, next: JSON.stringify(merged, null, 2) };\r\n\t\t});\r\n\r\n\t\treturn result;\r\n\t}\r\n\r\n\t/**\r\n\t * Get API key for a provider.\r\n\t * Priority:\r\n\t * 1. Runtime override (CLI --api-key)\r\n\t * 2. API key from auth.json\r\n\t * 3. OAuth token from auth.json (auto-refreshed with locking)\r\n\t * 4. Environment variable\r\n\t * 5. Fallback resolver (models.json custom providers)\r\n\t */\r\n\tasync getApiKey(providerId: string): Promise<string | undefined> {\r\n\t\t// Runtime override takes highest priority\r\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\r\n\t\tif (runtimeKey) {\r\n\t\t\treturn runtimeKey;\r\n\t\t}\r\n\r\n\t\tconst cred = this.data[providerId];\r\n\r\n\t\tif (cred?.type === \"api_key\") {\r\n\t\t\treturn resolveConfigValue(cred.key);\r\n\t\t}\r\n\r\n\t\tif (cred?.type === \"oauth\") {\r\n\t\t\tconst provider = getOAuthProvider(providerId);\r\n\t\t\tif (!provider) {\r\n\t\t\t\t// Unknown OAuth provider, can't get API key\r\n\t\t\t\treturn undefined;\r\n\t\t\t}\r\n\r\n\t\t\t// Check if token needs refresh\r\n\t\t\tconst needsRefresh = Date.now() >= cred.expires;\r\n\r\n\t\t\tif (needsRefresh) {\r\n\t\t\t\t// Use locked refresh to prevent race conditions\r\n\t\t\t\ttry {\r\n\t\t\t\t\tconst result = await this.refreshOAuthTokenWithLock(providerId);\r\n\t\t\t\t\tif (result) {\r\n\t\t\t\t\t\treturn result.apiKey;\r\n\t\t\t\t\t}\r\n\t\t\t\t} catch (error) {\r\n\t\t\t\t\tthis.recordError(error);\r\n\t\t\t\t\t// Refresh failed - re-read file to check if another instance succeeded\r\n\t\t\t\t\tthis.reload();\r\n\t\t\t\t\tconst updatedCred = this.data[providerId];\r\n\r\n\t\t\t\t\tif (updatedCred?.type === \"oauth\" && Date.now() < updatedCred.expires) {\r\n\t\t\t\t\t\t// Another instance refreshed successfully, use those credentials\r\n\t\t\t\t\t\treturn provider.getApiKey(updatedCred);\r\n\t\t\t\t\t}\r\n\r\n\t\t\t\t\t// Refresh truly failed - return undefined so model discovery skips this provider\r\n\t\t\t\t\t// User can /login to re-authenticate (credentials preserved for retry)\r\n\t\t\t\t\treturn undefined;\r\n\t\t\t\t}\r\n\t\t\t} else {\r\n\t\t\t\t// Token not expired, use current access token\r\n\t\t\t\treturn provider.getApiKey(cred);\r\n\t\t\t}\r\n\t\t}\r\n\r\n\t\t// Fall back to environment variable\r\n\t\tconst envKey = getEnvApiKey(providerId);\r\n\t\tif (envKey) return envKey;\r\n\r\n\t\t// Fall back to custom resolver (e.g., models.json custom providers)\r\n\t\treturn this.fallbackResolver?.(providerId) ?? undefined;\r\n\t}\r\n\r\n\t/**\r\n\t * Get all registered OAuth providers\r\n\t */\r\n\tgetOAuthProviders() {\r\n\t\treturn getOAuthProviders();\r\n\t}\r\n}\r\n"]}

package/dist/core/bash-executor.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bash command execution with streaming support and cancellation.
+ *
+ * This module provides a unified bash execution implementation used by:
+ * - AgentSession.executeBash() for interactive and RPC modes
+ * - Direct calls from modes that need bash execution
+ */
+import type { BashOperations } from "./tools/bash.js";
+export interface BashExecutorOptions {
+    /** Callback for streaming output chunks (already sanitized) */
+    onChunk?: (chunk: string) => void;
+    /** AbortSignal for cancellation */
+    signal?: AbortSignal;
+}
+export interface BashResult {
+    /** Combined stdout + stderr output (sanitized, possibly truncated) */
+    output: string;
+    /** Process exit code (undefined if killed/cancelled) */
+    exitCode: number | undefined;
+    /** Whether the command was cancelled via signal */
+    cancelled: boolean;
+    /** Whether the output was truncated */
+    truncated: boolean;
+    /** Path to temp file containing full output (if output exceeded truncation threshold) */
+    fullOutputPath?: string;
+}
+/**
+ * Execute a bash command with optional streaming and cancellation support.
+ *
+ * Features:
+ * - Streams sanitized output via onChunk callback
+ * - Writes large output to temp file for later retrieval
+ * - Supports cancellation via AbortSignal
+ * - Sanitizes output (strips ANSI, removes binary garbage, normalizes newlines)
+ * - Truncates output if it exceeds the default max bytes
+ *
+ * @param command - The bash command to execute
+ * @param options - Optional streaming callback and abort signal
+ * @returns Promise resolving to execution result
+ */
+export declare function executeBash(command: string, options?: BashExecutorOptions): Promise<BashResult>;
+/**
+ * Execute a bash command using custom BashOperations.
+ * Used for remote execution (SSH, containers, etc.).
+ */
+export declare function executeBashWithOperations(command: string, cwd: string, operations: BashOperations, options?: BashExecutorOptions): Promise<BashResult>;
+//# sourceMappingURL=bash-executor.d.ts.map

package/dist/core/bash-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-executor.d.ts","sourceRoot":"","sources":["../../src/core/bash-executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,MAAM,WAAW,mBAAmB;IACnC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,mCAAmC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IAC1B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAwH/F;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAsFrB","sourcesContent":["/**\r\n * Bash command execution with streaming support and cancellation.\r\n *\r\n * This module provides a unified bash execution implementation used by:\r\n * - AgentSession.executeBash() for interactive and RPC modes\r\n * - Direct calls from modes that need bash execution\r\n */\r\n\r\nimport { randomBytes } from \"node:crypto\";\r\nimport { createWriteStream, type WriteStream } from \"node:fs\";\r\nimport { tmpdir } from \"node:os\";\r\nimport { join } from \"node:path\";\r\nimport { type ChildProcess, spawn } from \"child_process\";\r\nimport stripAnsi from \"strip-ansi\";\r\nimport { getShellConfig, getShellEnv, killProcessTree, sanitizeBinaryOutput } from \"../utils/shell.js\";\r\nimport type { BashOperations } from \"./tools/bash.js\";\r\nimport { DEFAULT_MAX_BYTES, truncateTail } from \"./tools/truncate.js\";\r\n\r\n// ============================================================================\r\n// Types\r\n// ============================================================================\r\n\r\nexport interface BashExecutorOptions {\r\n\t/** Callback for streaming output chunks (already sanitized) */\r\n\tonChunk?: (chunk: string) => void;\r\n\t/** AbortSignal for cancellation */\r\n\tsignal?: AbortSignal;\r\n}\r\n\r\nexport interface BashResult {\r\n\t/** Combined stdout + stderr output (sanitized, possibly truncated) */\r\n\toutput: string;\r\n\t/** Process exit code (undefined if killed/cancelled) */\r\n\texitCode: number | undefined;\r\n\t/** Whether the command was cancelled via signal */\r\n\tcancelled: boolean;\r\n\t/** Whether the output was truncated */\r\n\ttruncated: boolean;\r\n\t/** Path to temp file containing full output (if output exceeded truncation threshold) */\r\n\tfullOutputPath?: string;\r\n}\r\n\r\n// ============================================================================\r\n// Implementation\r\n// ============================================================================\r\n\r\n/**\r\n * Execute a bash command with optional streaming and cancellation support.\r\n *\r\n * Features:\r\n * - Streams sanitized output via onChunk callback\r\n * - Writes large output to temp file for later retrieval\r\n * - Supports cancellation via AbortSignal\r\n * - Sanitizes output (strips ANSI, removes binary garbage, normalizes newlines)\r\n * - Truncates output if it exceeds the default max bytes\r\n *\r\n * @param command - The bash command to execute\r\n * @param options - Optional streaming callback and abort signal\r\n * @returns Promise resolving to execution result\r\n */\r\nexport function executeBash(command: string, options?: BashExecutorOptions): Promise<BashResult> {\r\n\treturn new Promise((resolve, reject) => {\r\n\t\tconst { shell, args } = getShellConfig();\r\n\t\tconst child: ChildProcess = spawn(shell, [...args, command], {\r\n\t\t\tdetached: true,\r\n\t\t\tenv: getShellEnv(),\r\n\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\r\n\t\t});\r\n\r\n\t\t// Track sanitized output for truncation\r\n\t\tconst outputChunks: string[] = [];\r\n\t\tlet outputBytes = 0;\r\n\t\tconst maxOutputBytes = DEFAULT_MAX_BYTES * 2;\r\n\r\n\t\t// Temp file for large output\r\n\t\tlet tempFilePath: string | undefined;\r\n\t\tlet tempFileStream: WriteStream | undefined;\r\n\t\tlet totalBytes = 0;\r\n\r\n\t\t// Handle abort signal\r\n\t\tconst abortHandler = () => {\r\n\t\t\tif (child.pid) {\r\n\t\t\t\tkillProcessTree(child.pid);\r\n\t\t\t}\r\n\t\t};\r\n\r\n\t\tif (options?.signal) {\r\n\t\t\tif (options.signal.aborted) {\r\n\t\t\t\t// Already aborted, don't even start\r\n\t\t\t\tchild.kill();\r\n\t\t\t\tresolve({\r\n\t\t\t\t\toutput: \"\",\r\n\t\t\t\t\texitCode: undefined,\r\n\t\t\t\t\tcancelled: true,\r\n\t\t\t\t\ttruncated: false,\r\n\t\t\t\t});\r\n\t\t\t\treturn;\r\n\t\t\t}\r\n\t\t\toptions.signal.addEventListener(\"abort\", abortHandler, { once: true });\r\n\t\t}\r\n\r\n\t\tconst decoder = new TextDecoder();\r\n\r\n\t\tconst handleData = (data: Buffer) => {\r\n\t\t\ttotalBytes += data.length;\r\n\r\n\t\t\t// Sanitize once at the source: strip ANSI, replace binary garbage, normalize newlines\r\n\t\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\r\n\r\n\t\t\t// Start writing to temp file if exceeds threshold\r\n\t\t\tif (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {\r\n\t\t\t\tconst id = randomBytes(8).toString(\"hex\");\r\n\t\t\t\ttempFilePath = join(tmpdir(), `pi-bash-${id}.log`);\r\n\t\t\t\ttempFileStream = createWriteStream(tempFilePath);\r\n\t\t\t\t// Write already-buffered chunks to temp file\r\n\t\t\t\tfor (const chunk of outputChunks) {\r\n\t\t\t\t\ttempFileStream.write(chunk);\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tif (tempFileStream) {\r\n\t\t\t\ttempFileStream.write(text);\r\n\t\t\t}\r\n\r\n\t\t\t// Keep rolling buffer of sanitized text\r\n\t\t\toutputChunks.push(text);\r\n\t\t\toutputBytes += text.length;\r\n\t\t\twhile (outputBytes > maxOutputBytes && outputChunks.length > 1) {\r\n\t\t\t\tconst removed = outputChunks.shift()!;\r\n\t\t\t\toutputBytes -= removed.length;\r\n\t\t\t}\r\n\r\n\t\t\t// Stream to callback if provided\r\n\t\t\tif (options?.onChunk) {\r\n\t\t\t\toptions.onChunk(text);\r\n\t\t\t}\r\n\t\t};\r\n\r\n\t\tchild.stdout?.on(\"data\", handleData);\r\n\t\tchild.stderr?.on(\"data\", handleData);\r\n\r\n\t\tchild.on(\"close\", (code) => {\r\n\t\t\t// Clean up abort listener\r\n\t\t\tif (options?.signal) {\r\n\t\t\t\toptions.signal.removeEventListener(\"abort\", abortHandler);\r\n\t\t\t}\r\n\r\n\t\t\tif (tempFileStream) {\r\n\t\t\t\ttempFileStream.end();\r\n\t\t\t}\r\n\r\n\t\t\t// Combine buffered chunks for truncation (already sanitized)\r\n\t\t\tconst fullOutput = outputChunks.join(\"\");\r\n\t\t\tconst truncationResult = truncateTail(fullOutput);\r\n\r\n\t\t\t// code === null means killed (cancelled)\r\n\t\t\tconst cancelled = code === null;\r\n\r\n\t\t\tresolve({\r\n\t\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\r\n\t\t\t\texitCode: cancelled ? undefined : code,\r\n\t\t\t\tcancelled,\r\n\t\t\t\ttruncated: truncationResult.truncated,\r\n\t\t\t\tfullOutputPath: tempFilePath,\r\n\t\t\t});\r\n\t\t});\r\n\r\n\t\tchild.on(\"error\", (err) => {\r\n\t\t\t// Clean up abort listener\r\n\t\t\tif (options?.signal) {\r\n\t\t\t\toptions.signal.removeEventListener(\"abort\", abortHandler);\r\n\t\t\t}\r\n\r\n\t\t\tif (tempFileStream) {\r\n\t\t\t\ttempFileStream.end();\r\n\t\t\t}\r\n\r\n\t\t\treject(err);\r\n\t\t});\r\n\t});\r\n}\r\n\r\n/**\r\n * Execute a bash command using custom BashOperations.\r\n * Used for remote execution (SSH, containers, etc.).\r\n */\r\nexport async function executeBashWithOperations(\r\n\tcommand: string,\r\n\tcwd: string,\r\n\toperations: BashOperations,\r\n\toptions?: BashExecutorOptions,\r\n): Promise<BashResult> {\r\n\tconst outputChunks: string[] = [];\r\n\tlet outputBytes = 0;\r\n\tconst maxOutputBytes = DEFAULT_MAX_BYTES * 2;\r\n\r\n\tlet tempFilePath: string | undefined;\r\n\tlet tempFileStream: WriteStream | undefined;\r\n\tlet totalBytes = 0;\r\n\r\n\tconst decoder = new TextDecoder();\r\n\r\n\tconst onData = (data: Buffer) => {\r\n\t\ttotalBytes += data.length;\r\n\r\n\t\t// Sanitize: strip ANSI, replace binary garbage, normalize newlines\r\n\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\r\n\r\n\t\t// Start writing to temp file if exceeds threshold\r\n\t\tif (totalBytes > DEFAULT_MAX_BYTES && !tempFilePath) {\r\n\t\t\tconst id = randomBytes(8).toString(\"hex\");\r\n\t\t\ttempFilePath = join(tmpdir(), `pi-bash-${id}.log`);\r\n\t\t\ttempFileStream = createWriteStream(tempFilePath);\r\n\t\t\tfor (const chunk of outputChunks) {\r\n\t\t\t\ttempFileStream.write(chunk);\r\n\t\t\t}\r\n\t\t}\r\n\r\n\t\tif (tempFileStream) {\r\n\t\t\ttempFileStream.write(text);\r\n\t\t}\r\n\r\n\t\t// Keep rolling buffer\r\n\t\toutputChunks.push(text);\r\n\t\toutputBytes += text.length;\r\n\t\twhile (outputBytes > maxOutputBytes && outputChunks.length > 1) {\r\n\t\t\tconst removed = outputChunks.shift()!;\r\n\t\t\toutputBytes -= removed.length;\r\n\t\t}\r\n\r\n\t\t// Stream to callback\r\n\t\tif (options?.onChunk) {\r\n\t\t\toptions.onChunk(text);\r\n\t\t}\r\n\t};\r\n\r\n\ttry {\r\n\t\tconst result = await operations.exec(command, cwd, {\r\n\t\t\tonData,\r\n\t\t\tsignal: options?.signal,\r\n\t\t});\r\n\r\n\t\tif (tempFileStream) {\r\n\t\t\ttempFileStream.end();\r\n\t\t}\r\n\r\n\t\tconst fullOutput = outputChunks.join(\"\");\r\n\t\tconst truncationResult = truncateTail(fullOutput);\r\n\t\tconst cancelled = options?.signal?.aborted ?? false;\r\n\r\n\t\treturn {\r\n\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\r\n\t\t\texitCode: cancelled ? undefined : (result.exitCode ?? undefined),\r\n\t\t\tcancelled,\r\n\t\t\ttruncated: truncationResult.truncated,\r\n\t\t\tfullOutputPath: tempFilePath,\r\n\t\t};\r\n\t} catch (err) {\r\n\t\tif (tempFileStream) {\r\n\t\t\ttempFileStream.end();\r\n\t\t}\r\n\r\n\t\t// Check if it was an abort\r\n\t\tif (options?.signal?.aborted) {\r\n\t\t\tconst fullOutput = outputChunks.join(\"\");\r\n\t\t\tconst truncationResult = truncateTail(fullOutput);\r\n\t\t\treturn {\r\n\t\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\r\n\t\t\t\texitCode: undefined,\r\n\t\t\t\tcancelled: true,\r\n\t\t\t\ttruncated: truncationResult.truncated,\r\n\t\t\t\tfullOutputPath: tempFilePath,\r\n\t\t\t};\r\n\t\t}\r\n\r\n\t\tthrow err;\r\n\t}\r\n}\r\n"]}