@kenkaiiii/gg-core 5.1.2 → 5.3.0

package/dist/chunk-IFKGCWX2.js

@@ -0,0 +1,1795 @@
+import {
+  getAppPaths
+} from "./chunk-KQJNZC6A.js";
+
+// src/auth-storage.ts
+import fs4 from "fs/promises";
+import crypto5 from "crypto";
+
+// src/oauth/anthropic.ts
+import crypto2 from "crypto";
+
+// src/oauth/pkce.ts
+function base64urlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generatePKCE() {
+  const verifierBytes = new Uint8Array(32);
+  crypto.getRandomValues(verifierBytes);
+  const verifier = base64urlEncode(verifierBytes);
+  const data = new TextEncoder().encode(verifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
+  return { verifier, challenge };
+}
+
+// src/claude-code-version.ts
+import fs2 from "fs/promises";
+import path2 from "path";
+
+// src/logger.ts
+import fs from "fs";
+import path from "path";
+import { randomBytes } from "crypto";
+var MAX_BYTES = 10 * 1024 * 1024;
+var fd = null;
+var sessionId = "";
+var appName = "app";
+var cleanups = [];
+function rotateIfNeeded(filePath) {
+  try {
+    const st = fs.statSync(filePath);
+    if (st.size < MAX_BYTES) return;
+    const rotated = `${filePath}.1`;
+    try {
+      fs.unlinkSync(rotated);
+    } catch {
+    }
+    fs.renameSync(filePath, rotated);
+  } catch {
+  }
+}
+function openLog(filePath, name) {
+  if (fd !== null) return false;
+  appName = name;
+  try {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
+  } catch {
+  }
+  rotateIfNeeded(filePath);
+  try {
+    fd = fs.openSync(filePath, "a");
+  } catch {
+    return false;
+  }
+  sessionId = randomBytes(4).toString("hex");
+  try {
+    fs.writeSync(fd, "\n");
+  } catch {
+  }
+  return true;
+}
+function getSessionId() {
+  return sessionId;
+}
+function isLoggerOpen() {
+  return fd !== null;
+}
+function log(level, category, message, data) {
+  if (fd === null) return;
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  let line = `[${ts}] [sid=${sessionId}] [${level}] [${category}] ${message}`;
+  if (data) {
+    const pairs = Object.entries(data).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
+    if (pairs) line += ` ${pairs}`;
+  }
+  line += "\n";
+  try {
+    fs.writeSync(fd, line);
+  } catch {
+  }
+}
+function registerLogCleanup(fn) {
+  cleanups.push(fn);
+}
+function closeLogger(opts) {
+  if (fd === null) return;
+  if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
+  try {
+    fs.closeSync(fd);
+  } catch {
+  }
+  fd = null;
+  for (const unsub of cleanups) unsub();
+  cleanups = [];
+}
+
+// src/claude-code-version.ts
+var NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 3e3;
+var FALLBACK_VERSION = "2.1.88";
+var memoryCache = null;
+var inflight = null;
+function cachePath() {
+  return path2.join(getAppPaths().agentDir, "claude-code-version.json");
+}
+async function readDiskCache() {
+  try {
+    const raw = await fs2.readFile(cachePath(), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.version === "string" && typeof parsed.fetchedAt === "number") {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function writeDiskCache(data) {
+  try {
+    await fs2.mkdir(getAppPaths().agentDir, { recursive: true, mode: 448 });
+    await fs2.writeFile(cachePath(), JSON.stringify(data), { mode: 384 });
+  } catch (err) {
+    log(
+      "WARN",
+      "claude-code-version",
+      `Failed to write cache: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function fetchLatest() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(NPM_LATEST_URL, { signal: controller.signal });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (typeof data.version === "string" && /^\d/.test(data.version)) {
+      return data.version;
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function getClaudeCodeVersion() {
+  if (memoryCache && Date.now() < memoryCache.expiresAt) {
+    return memoryCache.version;
+  }
+  if (inflight) return inflight;
+  inflight = (async () => {
+    const disk = await readDiskCache();
+    const diskFresh = disk && Date.now() - disk.fetchedAt < CACHE_TTL_MS;
+    if (disk && diskFresh) {
+      memoryCache = { version: disk.version, expiresAt: Date.now() + CACHE_TTL_MS };
+      return disk.version;
+    }
+    const fetched = await fetchLatest();
+    if (fetched) {
+      await writeDiskCache({ version: fetched, fetchedAt: Date.now() });
+      memoryCache = { version: fetched, expiresAt: Date.now() + CACHE_TTL_MS };
+      return fetched;
+    }
+    const resolved = disk?.version ?? FALLBACK_VERSION;
+    memoryCache = { version: resolved, expiresAt: Date.now() + 5 * 60 * 1e3 };
+    log(
+      "WARN",
+      "claude-code-version",
+      `Failed to fetch latest Claude Code version; using ${resolved}`
+    );
+    return resolved;
+  })();
+  try {
+    return await inflight;
+  } finally {
+    inflight = null;
+  }
+}
+async function getClaudeCliUserAgent() {
+  const version = await getClaudeCodeVersion();
+  return `claude-cli/${version} (external, cli)`;
+}
+
+// src/oauth/anthropic.ts
+var CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var TOKEN_URLS = [
+  "https://platform.claude.com/v1/oauth/token",
+  "https://console.anthropic.com/v1/oauth/token"
+];
+var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+async function postTokenRequest(body, label) {
+  const encoded = JSON.stringify(body);
+  const headers = {
+    "Content-Type": "application/json",
+    "User-Agent": await getClaudeCliUserAgent(),
+    "anthropic-beta": "oauth-2025-04-20"
+  };
+  let lastError = null;
+  for (const url of TOKEN_URLS) {
+    let response;
+    try {
+      response = await fetch(url, { method: "POST", headers, body: encoded });
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      continue;
+    }
+    if (response.ok) {
+      return await response.json();
+    }
+    const text = await response.text();
+    if (response.status >= 400 && response.status < 500) {
+      throw new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
+    }
+    lastError = new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
+  }
+  throw lastError ?? new Error(`Anthropic ${label} failed: all endpoints unreachable`);
+}
+function toCredentials(data) {
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
+  };
+}
+async function loginAnthropic(callbacks) {
+  const { verifier, challenge } = await generatePKCE();
+  const state = crypto2.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLIENT_ID,
+    response_type: "code",
+    redirect_uri: REDIRECT_URI,
+    scope: SCOPES,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${AUTHORIZE_URL}?${params}`;
+  callbacks.onOpenUrl(authUrl);
+  const raw = await callbacks.onPromptCode("Paste the code from the browser (format: code#state):");
+  const parts = raw.trim().split("#");
+  if (parts.length !== 2 || !parts[0] || parts[1] !== state) {
+    throw new Error("Invalid code or state mismatch. Please try again.");
+  }
+  return exchangeAnthropicCode(parts[0], parts[1], verifier);
+}
+async function exchangeAnthropicCode(code, state, verifier) {
+  const data = await postTokenRequest(
+    {
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      state,
+      redirect_uri: REDIRECT_URI,
+      code_verifier: verifier
+    },
+    "token exchange"
+  );
+  return toCredentials(data);
+}
+async function refreshAnthropicToken(refreshToken) {
+  const data = await postTokenRequest(
+    {
+      grant_type: "refresh_token",
+      client_id: CLIENT_ID,
+      refresh_token: refreshToken
+    },
+    "token refresh"
+  );
+  return toCredentials(data);
+}
+
+// src/oauth/openai.ts
+import http from "http";
+import crypto3 from "crypto";
+var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
+var TOKEN_URL = "https://auth.openai.com/oauth/token";
+var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
+var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+async function loginOpenAI(callbacks) {
+  const { verifier, challenge } = await generatePKCE();
+  const state = crypto3.randomBytes(16).toString("hex");
+  const url = new URL(AUTHORIZE_URL2);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", CLIENT_ID2);
+  url.searchParams.set("redirect_uri", REDIRECT_URI2);
+  url.searchParams.set("scope", SCOPE);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", state);
+  url.searchParams.set("prompt", "login");
+  url.searchParams.set("id_token_add_organizations", "true");
+  url.searchParams.set("codex_cli_simplified_flow", "true");
+  url.searchParams.set("originator", "ggcoder");
+  let code;
+  try {
+    code = await loginWithServer(url.toString(), state, callbacks);
+  } catch {
+    callbacks.onOpenUrl(url.toString());
+    const raw = await callbacks.onPromptCode(
+      "Could not start local server. Paste the callback URL or code from the browser:"
+    );
+    const parsed = parseAuthorizationInput(raw);
+    if (!parsed.code) {
+      throw new Error("No authorization code found in input.");
+    }
+    code = parsed.code;
+  }
+  const creds = await exchangeOpenAICode(code, verifier);
+  const accountId = getAccountId(creds.accessToken);
+  if (!accountId) {
+    throw new Error("Failed to extract accountId from OpenAI token.");
+  }
+  creds.accountId = accountId;
+  return creds;
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value) return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? void 0,
+      state: url.searchParams.get("state") ?? void 0
+    };
+  } catch {
+  }
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    return { code, state };
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0
+    };
+  }
+  return { code: value };
+}
+function decodeJwt(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const decoded = atob(parts[1]);
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function getAccountId(accessToken) {
+  const payload = decodeJwt(accessToken);
+  const auth = payload?.[JWT_CLAIM_PATH];
+  const accountId = auth?.chatgpt_account_id;
+  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+}
+async function loginWithServer(authUrl, expectedState, callbacks) {
+  return new Promise((resolve, reject) => {
+    let receivedCode = null;
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url || "", "http://localhost");
+      if (url.pathname !== "/auth/callback") {
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+      }
+      if (url.searchParams.get("state") !== expectedState) {
+        res.statusCode = 400;
+        res.end("State mismatch");
+        return;
+      }
+      receivedCode = url.searchParams.get("code");
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
+      server.close();
+    });
+    server.on("error", (err) => {
+      reject(err);
+    });
+    server.listen(1455, "127.0.0.1", () => {
+      callbacks.onOpenUrl(authUrl);
+      callbacks.onStatus("Waiting for browser callback...");
+    });
+    const timeout = setTimeout(() => {
+      if (!receivedCode) {
+        server.close();
+      }
+    }, 12e4);
+    timeout.unref();
+    server.on("close", () => {
+      clearTimeout(timeout);
+      if (receivedCode) {
+        resolve(receivedCode);
+      } else {
+        reject(new Error("Server closed without receiving code"));
+      }
+    });
+  });
+}
+async function exchangeOpenAICode(code, verifier) {
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID2,
+      code,
+      redirect_uri: REDIRECT_URI2,
+      code_verifier: verifier
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`OpenAI token exchange failed (${response.status}): ${text}`);
+  }
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + data.expires_in * 1e3
+  };
+}
+async function refreshOpenAIToken(refreshToken) {
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID2
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`OpenAI token refresh failed (${response.status}): ${text}`);
+  }
+  const data = await response.json();
+  const creds = {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + data.expires_in * 1e3
+  };
+  const accountId = getAccountId(creds.accessToken);
+  if (accountId) {
+    creds.accountId = accountId;
+  }
+  return creds;
+}
+
+// src/oauth/gemini.ts
+import http2 from "http";
+import crypto4 from "crypto";
+var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
+var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
+var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
+var DEFAULT_CLIENT_SECRET = "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";
+var AUTHORIZE_URL3 = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_URL2 = "https://oauth2.googleapis.com/token";
+var CODE_ASSIST_BASE_URL = "https://cloudcode-pa.googleapis.com";
+var CODE_ASSIST_API_VERSION = "v1internal";
+var CODE_ASSIST_POST_RETRIES = 3;
+var CODE_ASSIST_POST_RETRY_DELAY_MS = 100;
+var SCOPE2 = [
+  "https://www.googleapis.com/auth/cloud-platform",
+  "https://www.googleapis.com/auth/userinfo.email",
+  "https://www.googleapis.com/auth/userinfo.profile"
+].join(" ");
+var USER_TIER_FREE = "free-tier";
+var USER_TIER_LEGACY = "legacy-tier";
+var USER_TIER_STANDARD = "standard-tier";
+var VALIDATION_REQUIRED_REASON = "VALIDATION_REQUIRED";
+var VPC_SC_REASON = "SECURITY_POLICY_VIOLATED";
+var CodeAssistHttpError = class extends Error {
+  status;
+  body;
+  constructor(label, status, body) {
+    super(`Gemini Code Assist ${label} failed (${status}): ${body}`);
+    this.name = "CodeAssistHttpError";
+    this.status = status;
+    this.body = body;
+  }
+};
+async function loginGemini(callbacks) {
+  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
+  const { verifier, challenge } = await generatePKCE();
+  const state = crypto4.randomBytes(32).toString("hex");
+  const redirectUri = await getLoopbackRedirectUri();
+  const url = new URL(AUTHORIZE_URL3);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("scope", SCOPE2);
+  url.searchParams.set("access_type", "offline");
+  url.searchParams.set("prompt", "consent");
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", state);
+  let code;
+  try {
+    code = await loginWithServer2(url.toString(), redirectUri, state, callbacks);
+  } catch {
+    callbacks.onOpenUrl(url.toString());
+    const raw = await callbacks.onPromptCode(
+      "Could not start local server. Paste the callback URL or code from the browser:"
+    );
+    const parsed = parseAuthorizationInput2(raw);
+    if (!parsed.code) {
+      throw new Error("No authorization code found in input.");
+    }
+    if (parsed.state && parsed.state !== state) {
+      throw new Error("Invalid state. Please try again.");
+    }
+    code = parsed.code;
+  }
+  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret);
+  callbacks.onStatus("Setting up Gemini Code Assist access...");
+  const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
+  return {
+    ...creds,
+    projectId
+  };
+}
+async function refreshGeminiToken(refreshToken) {
+  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
+  const data = await postTokenRequest2({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId,
+    client_secret: clientSecret
+  });
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token ?? refreshToken,
+    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
+  };
+}
+function getGeminiOAuthClientCredentials() {
+  const clientId = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
+  const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
+  return { clientId, clientSecret };
+}
+async function getLoopbackRedirectUri() {
+  return new Promise((resolve, reject) => {
+    const server = http2.createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      server.close(() => {
+        if (addr && typeof addr === "object") {
+          resolve(`http://127.0.0.1:${addr.port}/oauth2callback`);
+        } else {
+          reject(new Error("Failed to allocate OAuth callback port."));
+        }
+      });
+    });
+    server.on("error", reject);
+  });
+}
+function parseAuthorizationInput2(input) {
+  const value = input.trim();
+  if (!value) return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? void 0,
+      state: url.searchParams.get("state") ?? void 0
+    };
+  } catch {
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0
+    };
+  }
+  return { code: value };
+}
+async function loginWithServer2(authUrl, redirectUri, expectedState, callbacks) {
+  const redirect = new URL(redirectUri);
+  const port = Number(redirect.port);
+  return new Promise((resolve, reject) => {
+    let receivedCode = null;
+    const server = http2.createServer((req, res) => {
+      const url = new URL(req.url || "", redirect.origin);
+      if (url.pathname !== redirect.pathname) {
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+      }
+      if (url.searchParams.get("state") !== expectedState) {
+        res.statusCode = 400;
+        res.end("State mismatch");
+        return;
+      }
+      receivedCode = url.searchParams.get("code");
+      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
+      server.close();
+    });
+    server.on("error", (err) => reject(err));
+    server.listen(port, "127.0.0.1", () => {
+      callbacks.onOpenUrl(authUrl);
+      callbacks.onStatus("Waiting for browser callback...");
+    });
+    const timeout = setTimeout(() => {
+      if (!receivedCode) server.close();
+    }, 12e4);
+    timeout.unref();
+    server.on("close", () => {
+      clearTimeout(timeout);
+      if (receivedCode) {
+        resolve(receivedCode);
+      } else {
+        reject(new Error("Server closed without receiving code."));
+      }
+    });
+  });
+}
+async function exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret) {
+  const data = await postTokenRequest2({
+    grant_type: "authorization_code",
+    client_id: clientId,
+    client_secret: clientSecret,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: verifier
+  });
+  if (!data.refresh_token) {
+    throw new Error("Gemini OAuth did not return a refresh token. Please try login again.");
+  }
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
+  };
+}
+async function postTokenRequest2(body) {
+  const response = await fetch(TOKEN_URL2, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(body)
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Gemini token request failed (${response.status}): ${text}`);
+  }
+  return await response.json();
+}
+async function setupCodeAssistProject(accessToken, callbacks) {
+  const envProject = process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID;
+  if (envProject && /^\d+$/.test(envProject)) {
+    throw new Error("GOOGLE_CLOUD_PROJECT must be a project ID, not a numeric project number.");
+  }
+  const coreMetadata = {
+    ideType: "IDE_UNSPECIFIED",
+    platform: "PLATFORM_UNSPECIFIED",
+    pluginType: "GEMINI"
+  };
+  const projectMetadata = {
+    ...coreMetadata,
+    ...envProject ? { duetProject: envProject } : {}
+  };
+  let loadRes;
+  while (true) {
+    loadRes = await loadCodeAssist(accessToken, envProject, projectMetadata);
+    const validation = getValidationRequiredTier(loadRes);
+    if (!validation) break;
+    callbacks.onStatus(
+      `Gemini Code Assist requires account validation${validation.reasonMessage ? `: ${validation.reasonMessage}` : ""}`
+    );
+    callbacks.onOpenUrl(validation.validationUrl);
+    const answer = await callbacks.onPromptCode(
+      "Complete validation in the browser, then press Enter to retry (or type cancel):"
+    );
+    if (answer.trim().toLowerCase() === "cancel") {
+      throw new Error("Gemini Code Assist account validation was cancelled.");
+    }
+  }
+  if (loadRes.currentTier) {
+    const project2 = loadRes.cloudaicompanionProject ?? envProject;
+    if (!project2) throwProjectError(loadRes);
+    return project2;
+  }
+  const tier = getOnboardTier(loadRes);
+  const onboardReq = tier.id === USER_TIER_FREE ? {
+    tierId: tier.id,
+    cloudaicompanionProject: void 0,
+    metadata: coreMetadata
+  } : {
+    tierId: tier.id,
+    cloudaicompanionProject: envProject,
+    metadata: projectMetadata
+  };
+  let operation = await codeAssistPost(
+    accessToken,
+    "onboardUser",
+    onboardReq
+  );
+  while (!operation.done && operation.name) {
+    await new Promise((resolve) => setTimeout(resolve, 5e3));
+    operation = await codeAssistGet(accessToken, operation.name);
+  }
+  const project = operation.response?.cloudaicompanionProject?.id ?? envProject;
+  if (!project) throwProjectError(loadRes);
+  return project;
+}
+async function loadCodeAssist(accessToken, envProject, metadata) {
+  try {
+    return await codeAssistPost(accessToken, "loadCodeAssist", {
+      ...envProject ? { cloudaicompanionProject: envProject } : {},
+      metadata
+    });
+  } catch (err) {
+    if (err instanceof CodeAssistHttpError && isVpcScAffectedError(err)) {
+      return { currentTier: { id: USER_TIER_STANDARD } };
+    }
+    if (err instanceof CodeAssistHttpError && err.status === 403 && envProject === "cloudshell-gca") {
+      throw new Error(
+        "Access to the default Cloud Shell Gemini project was denied.\nPlease set your own Google Cloud project by running:\ngcloud config set project [PROJECT_ID]\nor setting export GOOGLE_CLOUD_PROJECT=...",
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+}
+function getValidationRequiredTier(response) {
+  return response.ineligibleTiers?.find(
+    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
+  );
+}
+function getOnboardTier(response) {
+  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
+  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
+}
+function throwProjectError(response) {
+  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
+  if (reasons && reasons.length > 0) {
+    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
+  }
+  throw new Error(
+    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
+  );
+}
+async function codeAssistPost(accessToken, method, body) {
+  let lastError;
+  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
+    try {
+      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
+        method: "POST",
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
+        throw err;
+      }
+      lastError = err;
+    }
+    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
+  }
+  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
+}
+async function codeAssistGet(accessToken, operationName) {
+  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
+    method: "GET"
+  });
+}
+async function codeAssistRequest(url, accessToken, label, init) {
+  const response = await fetch(url, {
+    ...init,
+    headers: codeAssistHeaders(accessToken)
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new CodeAssistHttpError(label, response.status, text);
+  }
+  return await response.json();
+}
+function getCodeAssistBaseUrl() {
+  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
+  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
+  return `${endpoint}/${version}`;
+}
+function getCodeAssistMethodUrl(method) {
+  return `${getCodeAssistBaseUrl()}:${method}`;
+}
+function getCodeAssistOperationUrl(operationName) {
+  return `${getCodeAssistBaseUrl()}/${operationName}`;
+}
+function shouldRetryCodeAssistStatus(status) {
+  return status === 429 || status === 499 || status >= 500 && status <= 599;
+}
+function isVpcScAffectedError(error) {
+  try {
+    const parsed = JSON.parse(error.body);
+    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
+    const details = parsed.error?.details;
+    return Array.isArray(details) ? details.some(
+      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
+    ) : false;
+  } catch {
+    return false;
+  }
+}
+function codeAssistHeaders(accessToken) {
+  return {
+    Authorization: `Bearer ${accessToken}`,
+    "Content-Type": "application/json",
+    "User-Agent": "google-gemini-cli",
+    "X-Goog-Api-Client": "gemini-cli/0.0.0"
+  };
+}
+
+// src/oauth/kimi.ts
+import { execFileSync } from "child_process";
+import { randomUUID } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { arch, hostname, release, type } from "os";
+import path3 from "path";
+var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_PLATFORM = "kimi_code_cli";
+var DEFAULT_KIMI_VERSION = "1.0.11";
+var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
+function oauthHost() {
+  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
+  return host.replace(/\/+$/, "");
+}
+function kimiCodeBaseUrl() {
+  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
+}
+function kimiVersion() {
+  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
+  return asciiHeader(v, DEFAULT_KIMI_VERSION);
+}
+function asciiHeader(value, fallback = "unknown") {
+  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+function macOsProductVersion() {
+  try {
+    const version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], {
+      encoding: "utf-8",
+      timeout: 1e3
+    }).trim();
+    return version.length > 0 ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function deviceModel() {
+  const os = type();
+  const version = release();
+  const osArch = arch();
+  if (os === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
+  if (os === "Windows_NT") return `Windows ${version} ${osArch}`;
+  return `${os} ${version} ${osArch}`.trim();
+}
+function deviceId() {
+  const idPath = path3.join(getAppPaths().agentDir, "kimi_device_id");
+  if (existsSync(idPath)) {
+    try {
+      const text = readFileSync(idPath, "utf-8").trim();
+      if (text.length > 0) return text;
+    } catch {
+    }
+  }
+  const id = randomUUID();
+  try {
+    mkdirSync(getAppPaths().agentDir, { recursive: true, mode: 448 });
+    writeFileSync(idPath, id, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return id;
+}
+function deviceHeaders() {
+  return {
+    "X-Msh-Platform": KIMI_PLATFORM,
+    "X-Msh-Version": kimiVersion(),
+    "X-Msh-Device-Name": asciiHeader(hostname()),
+    "X-Msh-Device-Model": asciiHeader(deviceModel()),
+    "X-Msh-Os-Version": asciiHeader(release()),
+    "X-Msh-Device-Id": deviceId()
+  };
+}
+function kimiCodingHeaders() {
+  return {
+    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
+    ...deviceHeaders()
+  };
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
+}
+async function postForm(endpoint, params) {
+  const response = await fetch(`${oauthHost()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      ...deviceHeaders(),
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function credsFromTokenResponse(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  const expiresIn = Number(data.expires_in);
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Kimi OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error("Kimi OAuth response missing refresh_token.");
+  }
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    baseUrl: kimiCodeBaseUrl()
+  };
+}
+async function requestDeviceAuthorization() {
+  const { status, data } = await postForm("/api/oauth/device_authorization", {
+    client_id: CLIENT_ID3
+  });
+  if (status !== 200) {
+    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Kimi device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5
+  };
+}
+async function pollDeviceToken(deviceCode) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID3,
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginKimi(callbacks) {
+  const auth = await requestDeviceAuthorization();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    const result = await pollDeviceToken(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Kimi authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Kimi device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Kimi login timed out. Please run login again.");
+}
+async function refreshKimiToken(refreshToken) {
+  const { status, data } = await postForm("/api/oauth/token", {
+    client_id: CLIENT_ID3,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+}
+
+// src/file-lock.ts
+import fs3 from "fs/promises";
+import { setTimeout as setTimeout2 } from "timers/promises";
+var STALE_TIMEOUT_MS = 1e4;
+var RETRY_INTERVAL_MS = 50;
+var MAX_WAIT_MS = 5e3;
+async function withFileLock(filePath, fn) {
+  const lockPath = filePath + ".lock";
+  await acquireLock(lockPath);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock(lockPath);
+  }
+}
+async function acquireLock(lockPath) {
+  const startTime = Date.now();
+  while (true) {
+    try {
+      const info = { pid: process.pid, timestamp: Date.now() };
+      await fs3.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      try {
+        const content = await fs3.readFile(lockPath, "utf-8");
+        const info = JSON.parse(content);
+        const isProcessAlive = isAlive(info.pid);
+        const isStale = Date.now() - info.timestamp > STALE_TIMEOUT_MS;
+        if (!isProcessAlive || isStale) {
+          await fs3.unlink(lockPath).catch(() => {
+          });
+          continue;
+        }
+      } catch {
+        await fs3.unlink(lockPath).catch(() => {
+        });
+        continue;
+      }
+      if (Date.now() - startTime > MAX_WAIT_MS) {
+        await fs3.unlink(lockPath).catch(() => {
+        });
+        continue;
+      }
+      await setTimeout2(RETRY_INTERVAL_MS);
+    }
+  }
+}
+async function releaseLock(lockPath) {
+  await fs3.unlink(lockPath).catch(() => {
+  });
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    if (err.code === "EPERM") return true;
+    return false;
+  }
+}
+
+// src/auth-storage.ts
+var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
+var XIAOMI_CREDITS_KEY = "xiaomi-credits";
+var REFRESH_SKEW_MS = 6e4;
+var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
+  "glm",
+  "moonshot",
+  "xiaomi",
+  "minimax",
+  "deepseek",
+  "openrouter",
+  "sakana"
+]);
+var AuthStorage = class {
+  data = {};
+  filePath;
+  loaded = false;
+  /** Per-provider lock to serialize concurrent refresh calls. */
+  refreshLocks = /* @__PURE__ */ new Map();
+  constructor(filePath) {
+    this.filePath = filePath ?? getAppPaths().authFile;
+  }
+  /** Path to the on-disk auth file. Useful for status output. */
+  get path() {
+    return this.filePath;
+  }
+  /** List provider keys with stored credentials. */
+  async listProviders() {
+    await this.ensureLoaded();
+    return Object.keys(this.data);
+  }
+  /** True if credentials exist for `provider`. */
+  async hasCredentials(provider) {
+    await this.ensureLoaded();
+    return Boolean(this.data[provider]);
+  }
+  /**
+   * First key in `keys` (in order) that has stored credentials, or `undefined`
+   * if none do. Mirrors the first-match logic `resolveCredentials({ storageKeys })`
+   * uses internally — callers that need to know WHICH credential will actually
+   * be used (e.g. to clear the right one after a 401) call this directly
+   * instead of re-deriving the same order.
+   */
+  async pickStorageKey(keys) {
+    await this.ensureLoaded();
+    return keys.find((key) => Boolean(this.data[key]));
+  }
+  /**
+   * True if the user has any usable auth for the logical provider. For
+   * `moonshot` this is satisfied by either the Kimi OAuth credential or the
+   * Moonshot API key.
+   */
+  async hasProviderAuth(provider) {
+    await this.ensureLoaded();
+    if (provider === "moonshot") {
+      return Boolean(this.data[MOONSHOT_OAUTH_KEY] || this.data["moonshot"]);
+    }
+    if (provider === "xiaomi") {
+      return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
+    }
+    return Boolean(this.data[provider]);
+  }
+  /**
+   * True if the active credential for `provider` is a static API key with no
+   * refresh mechanism. For `moonshot` this is only true when the Kimi OAuth
+   * credential is absent (a present OAuth credential is refreshable).
+   */
+  async isStaticApiKey(provider) {
+    await this.ensureLoaded();
+    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
+      return false;
+    }
+    return STATIC_API_KEY_PROVIDERS.has(provider);
+  }
+  async load() {
+    await withFileLock(this.filePath, async () => {
+      try {
+        const content = await fs4.readFile(this.filePath, "utf-8");
+        this.data = JSON.parse(content);
+        log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
+          providers: Object.keys(this.data).join(",") || "(none)"
+        });
+      } catch (err) {
+        this.data = {};
+        const code = err.code;
+        if (code === "ENOENT") {
+          log("INFO", "auth", `No auth file found at ${this.filePath} (first run)`);
+        } else {
+          log(
+            "ERROR",
+            "auth",
+            `Failed to load auth file: ${err instanceof Error ? err.message : String(err)}`,
+            { path: this.filePath, code: code ?? "unknown" }
+          );
+        }
+      }
+    });
+    this.loaded = true;
+  }
+  async ensureLoaded() {
+    if (!this.loaded) await this.load();
+  }
+  async getCredentials(provider) {
+    await this.ensureLoaded();
+    return this.data[provider];
+  }
+  async setCredentials(provider, creds) {
+    await this.ensureLoaded();
+    this.data[provider] = creds;
+    await this.save();
+  }
+  async clearCredentials(provider) {
+    await this.ensureLoaded();
+    delete this.data[provider];
+    await this.save();
+  }
+  async clearAll() {
+    this.data = {};
+    await this.save();
+  }
+  /**
+   * Returns valid credentials, auto-refreshing if expired.
+   * If `forceRefresh` is true, refreshes even if the token hasn't expired
+   * (useful when the provider rejects a token with 401 before its stored expiry).
+   * Throws if not logged in.
+   */
+  async resolveCredentials(provider, opts) {
+    await this.ensureLoaded();
+    if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
+      for (const key of opts.storageKeys) {
+        const creds2 = this.data[key];
+        if (creds2) return creds2;
+      }
+      throw new NotLoggedInError(provider);
+    }
+    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
+      try {
+        return await this.resolveCredentials(MOONSHOT_OAUTH_KEY, opts);
+      } catch (err) {
+        if (err instanceof NotLoggedInError && this.data["moonshot"]) {
+          log(
+            "WARN",
+            "auth",
+            'Kimi OAuth credential is no longer valid \u2014 falling back to the Moonshot API key. Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+          );
+          return this.data["moonshot"];
+        }
+        throw err;
+      }
+    }
+    const creds = this.data[provider];
+    if (!creds) {
+      throw new NotLoggedInError(provider);
+    }
+    if (STATIC_API_KEY_PROVIDERS.has(provider)) {
+      return creds;
+    }
+    if (!opts?.forceRefresh && Date.now() < creds.expiresAt - REFRESH_SKEW_MS) {
+      return creds;
+    }
+    const existing = this.refreshLocks.get(provider);
+    if (existing) return existing;
+    const refreshPromise = withFileLock(this.filePath, async () => {
+      try {
+        const content = await fs4.readFile(this.filePath, "utf-8");
+        const freshData = JSON.parse(content);
+        const freshCreds = freshData[provider];
+        if (freshCreds && !opts?.forceRefresh && Date.now() < freshCreds.expiresAt - REFRESH_SKEW_MS) {
+          this.data[provider] = freshCreds;
+          return freshCreds;
+        }
+      } catch {
+      }
+      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
+      let refreshed;
+      try {
+        refreshed = await refreshFn(creds.refreshToken);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
+        if (isAuthFailure) {
+          delete this.data[provider];
+          await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+          throw new NotLoggedInError(provider);
+        }
+        throw err;
+      }
+      if (!refreshed.accountId && creds.accountId) {
+        refreshed.accountId = creds.accountId;
+      }
+      if (!refreshed.projectId && creds.projectId) {
+        refreshed.projectId = creds.projectId;
+      }
+      if (!refreshed.baseUrl && creds.baseUrl) {
+        refreshed.baseUrl = creds.baseUrl;
+      }
+      this.data[provider] = refreshed;
+      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+      return refreshed;
+    });
+    this.refreshLocks.set(provider, refreshPromise);
+    try {
+      return await refreshPromise;
+    } finally {
+      this.refreshLocks.delete(provider);
+    }
+  }
+  /**
+   * Returns a valid access token, auto-refreshing if expired.
+   * Throws if not logged in.
+   */
+  async resolveToken(provider) {
+    const creds = await this.resolveCredentials(provider);
+    return creds.accessToken;
+  }
+  async save() {
+    await withFileLock(this.filePath, async () => {
+      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
+    });
+  }
+};
+async function atomicWriteFile(filePath, content) {
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto5.randomUUID().slice(0, 8)}.tmp`;
+  try {
+    await fs4.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await fs4.rename(tmpPath, filePath);
+  } catch (err) {
+    await fs4.unlink(tmpPath).catch(() => {
+    });
+    throw err;
+  }
+}
+var NotLoggedInError = class extends Error {
+  provider;
+  constructor(provider) {
+    super(`Not logged in to ${provider}. Run "ggcoder login" to authenticate.`);
+    this.name = "NotLoggedInError";
+    this.provider = provider;
+  }
+};
+
+// src/model-registry.ts
+var MODELS = [
+  // ── Anthropic ──────────────────────────────────────────
+  // NOTE: Claude Fable 5 (`claude-fable-5`) and Claude Mythos 5
+  // (`claude-mythos-5`) are temporarily unavailable, so they're commented out
+  // here to keep them out of the /model selector and avoid user confusion.
+  // Re-enable once they're generally available again.
+  // {
+  //   id: "claude-fable-5",
+  //   name: "Claude Fable 5",
+  //   provider: "anthropic",
+  //   contextWindow: 1_000_000,
+  //   maxOutputTokens: 128_000,
+  //   supportsThinking: true,
+  //   supportsImages: true,
+  //   supportsVideo: false,
+  //   costTier: "high",
+  //   maxThinkingLevel: "max",
+  // },
+  // {
+  //   // Mythos-class model offered through Project Glasswing (limited
+  //   // availability, invitation-only). Same underlying model as Fable 5 with
+  //   // some safeguards lifted; kept here so approved accounts can select it.
+  //   id: "claude-mythos-5",
+  //   name: "Claude Mythos 5",
+  //   provider: "anthropic",
+  //   contextWindow: 1_000_000,
+  //   maxOutputTokens: 128_000,
+  //   supportsThinking: true,
+  //   supportsImages: true,
+  //   supportsVideo: false,
+  //   costTier: "high",
+  //   maxThinkingLevel: "max",
+  // },
+  {
+    id: "claude-opus-4-8",
+    name: "Claude Opus 4.8",
+    provider: "anthropic",
+    contextWindow: 1e6,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "high",
+    maxThinkingLevel: "max"
+  },
+  {
+    id: "claude-sonnet-5",
+    name: "Claude Sonnet 5",
+    provider: "anthropic",
+    contextWindow: 1e6,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "max"
+  },
+  {
+    id: "claude-haiku-4-5-20251001",
+    name: "Claude Haiku 4.5",
+    provider: "anthropic",
+    contextWindow: 2e5,
+    maxOutputTokens: 64e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "low",
+    maxThinkingLevel: "high"
+  },
+  // ── OpenAI (Codex) ─────────────────────────────────────
+  {
+    id: "gpt-5.5",
+    name: "GPT-5.5",
+    provider: "openai",
+    contextWindow: 105e4,
+    codexContextWindow: 272e3,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "high",
+    maxThinkingLevel: "xhigh"
+  },
+  {
+    id: "gpt-5.4",
+    name: "GPT-5.4",
+    provider: "openai",
+    contextWindow: 105e4,
+    codexContextWindow: 272e3,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "high",
+    maxThinkingLevel: "xhigh"
+  },
+  {
+    id: "gpt-5.4-mini",
+    name: "GPT-5.4 Mini",
+    provider: "openai",
+    contextWindow: 4e5,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "low",
+    maxThinkingLevel: "xhigh"
+  },
+  {
+    id: "gpt-5.3-codex",
+    name: "GPT-5.3 Codex",
+    provider: "openai",
+    contextWindow: 4e5,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "high",
+    maxThinkingLevel: "xhigh"
+  },
+  // ── Sakana (Fugu) ──────────────────────────────────────
+  // Sakana Fugu is a multi-agent system surfaced as a standard LLM via the
+  // OpenAI-compatible Sakana API (https://api.sakana.ai/v1). Both models take
+  // text + image input and only accept "high"/"xhigh" reasoning effort, so the
+  // top tier is `xhigh`. `fugu` routes across all providers; `fugu-ultra` is
+  // the heavier tier (may need larger client timeouts on complex tasks).
+  {
+    id: "fugu",
+    name: "Fugu",
+    provider: "sakana",
+    contextWindow: 1e6,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "xhigh"
+  },
+  {
+    id: "fugu-ultra",
+    name: "Fugu Ultra",
+    provider: "sakana",
+    contextWindow: 1e6,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "high",
+    maxThinkingLevel: "xhigh"
+  },
+  // ── Gemini ─────────────────────────────────────────────
+  {
+    id: "gemini-3.1-flash-lite-preview",
+    name: "Gemini 3.1 Flash Lite Preview",
+    provider: "gemini",
+    contextWindow: 1048576,
+    maxOutputTokens: 65536,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: true,
+    maxVideoBytes: 20 * 1024 * 1024,
+    costTier: "low",
+    maxThinkingLevel: "high"
+  },
+  {
+    id: "gemini-3.5-flash",
+    name: "Gemini 3.5 Flash",
+    provider: "gemini",
+    contextWindow: 1048576,
+    maxOutputTokens: 65536,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: true,
+    maxVideoBytes: 20 * 1024 * 1024,
+    costTier: "low",
+    maxThinkingLevel: "high"
+  },
+  // ── Moonshot (Kimi) ────────────────────────────────────
+  {
+    id: "kimi-k2.7-code",
+    name: "Kimi K2.7",
+    provider: "moonshot",
+    contextWindow: 262144,
+    maxOutputTokens: 262144,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: true,
+    maxVideoBytes: 100 * 1024 * 1024,
+    costTier: "medium",
+    maxThinkingLevel: "high"
+  },
+  // ── Z.AI (GLM) ─────────────────────────────────────────
+  // GLM-5.2: coding-first flagship with a usable 1M-token context window
+  // (5x jump over GLM-5.1's ~200K) and 131K max output. Released 2026-06-13.
+  {
+    id: "glm-5.2",
+    name: "GLM-5.2",
+    provider: "glm",
+    contextWindow: 1e6,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "high"
+  },
+  {
+    id: "glm-5.1",
+    name: "GLM-5.1",
+    provider: "glm",
+    contextWindow: 204800,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "high"
+  },
+  {
+    id: "glm-4.7",
+    name: "GLM-4.7",
+    provider: "glm",
+    contextWindow: 2e5,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "low",
+    maxThinkingLevel: "high"
+  },
+  {
+    id: "glm-4.7-flash",
+    name: "GLM-4.7 Flash",
+    provider: "glm",
+    contextWindow: 2e5,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "low",
+    maxThinkingLevel: "high"
+  },
+  // ── MiniMax ────────────────────────────────────────────
+  {
+    id: "MiniMax-M3",
+    name: "MiniMax M3",
+    provider: "minimax",
+    contextWindow: 1e6,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: true,
+    maxVideoBytes: 50 * 1024 * 1024,
+    costTier: "medium",
+    maxThinkingLevel: "high"
+  },
+  // ── Xiaomi (MiMo) ──────────────────────────────────────
+  // Pro series: text-only coding/agentic flagship. The legacy mimo-v2-pro
+  // auto-routes to v2.5 on 2026-06-01 and is fully deprecated by 2026-06-30.
+  {
+    id: "mimo-v2.5-pro",
+    name: "MiMo-V2.5-Pro",
+    provider: "xiaomi",
+    contextWindow: 1e6,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "high",
+    authStorageKeys: ["xiaomi", XIAOMI_CREDITS_KEY]
+  },
+  // UltraSpeed: lower-latency sibling of the Pro coding flagship, same
+  // text-only capability surface, premium-priced for the throughput gain.
+  // API-only — not served over the Token Plan endpoint, so credentials
+  // resolve from the distinct API Credits key only (see authStorageKeys doc).
+  {
+    id: "mimo-v2.5-pro-ultraspeed",
+    name: "MiMo-V2.5-Pro-UltraSpeed",
+    provider: "xiaomi",
+    contextWindow: 1e6,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "high",
+    maxThinkingLevel: "high",
+    authStorageKeys: [XIAOMI_CREDITS_KEY]
+  },
+  // Omni series: native full-modal understanding (image + audio + video).
+  // Video/image ride the OpenAI-compatible transport as base64 data URLs
+  // (`video_url`/`image_url`), which the shared transform already emits.
+  {
+    id: "mimo-v2.5",
+    name: "MiMo-V2.5",
+    provider: "xiaomi",
+    contextWindow: 1e6,
+    maxOutputTokens: 131072,
+    supportsThinking: true,
+    supportsImages: true,
+    supportsVideo: true,
+    maxVideoBytes: 36 * 1024 * 1024,
+    costTier: "medium",
+    maxThinkingLevel: "high",
+    authStorageKeys: ["xiaomi", XIAOMI_CREDITS_KEY]
+  },
+  // ── DeepSeek ───────────────────────────────────────────
+  {
+    id: "deepseek-v4-pro",
+    name: "DeepSeek V4 Pro",
+    provider: "deepseek",
+    contextWindow: 1048576,
+    maxOutputTokens: 384e3,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "high",
+    // DeepSeek V4 maps `xhigh` → its internal `max` tier.
+    maxThinkingLevel: "xhigh"
+  },
+  {
+    id: "deepseek-v4-flash",
+    name: "DeepSeek V4 Flash",
+    provider: "deepseek",
+    contextWindow: 1048576,
+    maxOutputTokens: 384e3,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "low",
+    maxThinkingLevel: "xhigh"
+  },
+  // ── OpenRouter ─────────────────────────────────────────
+  {
+    id: "qwen/qwen3.6-plus",
+    name: "Qwen3.6-Plus",
+    provider: "openrouter",
+    contextWindow: 1e6,
+    maxOutputTokens: 65536,
+    supportsThinking: true,
+    supportsImages: false,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "high"
+  }
+];
+function getModel(id) {
+  return MODELS.find((m) => m.id === id);
+}
+function getModelsForProvider(provider) {
+  return MODELS.filter((m) => m.provider === provider);
+}
+function getAuthStorageKeys(provider, modelId) {
+  const model = MODELS.find((m) => m.id === modelId && m.provider === provider);
+  return model?.authStorageKeys ?? [provider];
+}
+function getAuthStorageKey(provider, modelId) {
+  return getAuthStorageKeys(provider, modelId)[0];
+}
+var DEFAULT_MAX_VIDEO_BYTES = 20 * 1024 * 1024;
+function getVideoByteLimit(modelId) {
+  const model = getModel(modelId);
+  if (!model?.supportsVideo) return void 0;
+  return model.maxVideoBytes ?? DEFAULT_MAX_VIDEO_BYTES;
+}
+function getDefaultModel(provider) {
+  if (provider === "xiaomi") return MODELS.find((m) => m.id === "mimo-v2.5-pro");
+  if (provider === "openai") return MODELS.find((m) => m.id === "gpt-5.5");
+  if (provider === "gemini") return MODELS.find((m) => m.id === "gemini-3.1-flash-lite-preview");
+  if (provider === "glm") return MODELS.find((m) => m.id === "glm-5.2");
+  if (provider === "moonshot") return MODELS.find((m) => m.id === "kimi-k2.7-code");
+  if (provider === "minimax") return MODELS.find((m) => m.id === "MiniMax-M3");
+  if (provider === "deepseek") return MODELS.find((m) => m.id === "deepseek-v4-pro");
+  if (provider === "openrouter") return MODELS.find((m) => m.id === "qwen/qwen3.6-plus");
+  if (provider === "sakana") return MODELS.find((m) => m.id === "fugu");
+  return MODELS.find((m) => m.id === "claude-sonnet-5");
+}
+function usesOpenAICodexTransport(options) {
+  return options?.provider === "openai" && Boolean(options.accountId);
+}
+function getContextWindow(modelId, options) {
+  const model = getModel(modelId);
+  if (!model) return 2e5;
+  if (usesOpenAICodexTransport(options) && model.codexContextWindow) {
+    return model.codexContextWindow;
+  }
+  return model.contextWindow;
+}
+function getMaxThinkingLevel(modelId) {
+  return getModel(modelId)?.maxThinkingLevel ?? "high";
+}
+function getSummaryModel(provider, currentModelId) {
+  if (provider === "anthropic") {
+    return MODELS.find((m) => m.id === "claude-sonnet-5");
+  }
+  if (provider === "openai" || provider === "glm" || provider === "deepseek") {
+    const low = getModelsForProvider(provider).find((m) => m.costTier === "low");
+    if (low) return low;
+  }
+  return getModel(currentModelId) ?? getDefaultModel(provider);
+}
+
+export {
+  generatePKCE,
+  openLog,
+  getSessionId,
+  isLoggerOpen,
+  log,
+  registerLogCleanup,
+  closeLogger,
+  getClaudeCodeVersion,
+  getClaudeCliUserAgent,
+  loginAnthropic,
+  refreshAnthropicToken,
+  loginOpenAI,
+  refreshOpenAIToken,
+  loginGemini,
+  refreshGeminiToken,
+  kimiCodeBaseUrl,
+  kimiCodingHeaders,
+  isKimiCodingEndpoint,
+  loginKimi,
+  refreshKimiToken,
+  withFileLock,
+  MOONSHOT_OAUTH_KEY,
+  XIAOMI_CREDITS_KEY,
+  AuthStorage,
+  NotLoggedInError,
+  MODELS,
+  getModel,
+  getModelsForProvider,
+  getAuthStorageKeys,
+  getAuthStorageKey,
+  DEFAULT_MAX_VIDEO_BYTES,
+  getVideoByteLimit,
+  getDefaultModel,
+  usesOpenAICodexTransport,
+  getContextWindow,
+  getMaxThinkingLevel,
+  getSummaryModel
+};
+//# sourceMappingURL=chunk-IFKGCWX2.js.map