@kenkaiiii/gg-core 5.39.3 → 5.40.0

package/dist/index.d.cts

@@ -185,7 +185,16 @@ interface OAuthCredentials {
 }
 interface OAuthLoginCallbacks {
     onOpenUrl: (url: string) => void;
-    onPromptCode: (message: string) => Promise<string>;
+    /**
+     * Collect a pasted authorization code or callback URL.
+     *
+     * `signal` aborts when the code already arrived another way (the local
+     * callback listener won the race) and the prompt should be torn down.
+     * Implementations may ignore it — an abandoned promise is simply never
+     * awaited — but a terminal prompt should honour it so the line does not
+     * linger after login already succeeded.
+     */
+    onPromptCode: (message: string, signal?: AbortSignal) => Promise<string>;
     onStatus: (message: string) => void;
 }
 
@@ -365,13 +374,27 @@ declare class AuthStorage {
     clearAll(): Promise<void>;
     /**
      * Returns valid credentials, auto-refreshing if expired.
+     *
      * If `forceRefresh` is true, refreshes even if the token hasn't expired
-     * (useful when the provider rejects a token with 401 before its stored expiry).
+     * (useful when the provider rejects a token with 401 before its stored
+     * expiry). Callers recovering from a rejection should also pass
+     * `rejectedToken` — see the stampede guard below.
+     *
      * Throws if not logged in.
      */
     resolveCredentials(provider: string, opts?: {
         forceRefresh?: boolean;
         storageKeys?: string[];
+        /**
+         * The access token the provider just rejected. Refreshing an OAuth grant
+         * invalidates the previous access token, so N processes sharing auth.json
+         * (app windows, CLI sessions, the usage poller) can otherwise revoke each
+         * other in a loop: each one force-refreshes on 401, and every refresh kills
+         * the token the others still hold. Naming the rejected token lets the
+         * refresh path tell "this credential is genuinely dead" from "someone else
+         * already rotated it" and simply adopt the newer on-disk credential.
+         */
+        rejectedToken?: string;
     }): Promise<OAuthCredentials>;
     /**
      * Returns a valid access token, auto-refreshing if expired.

package/dist/index.d.ts

@@ -185,7 +185,16 @@ interface OAuthCredentials {
 }
 interface OAuthLoginCallbacks {
     onOpenUrl: (url: string) => void;
-    onPromptCode: (message: string) => Promise<string>;
+    /**
+     * Collect a pasted authorization code or callback URL.
+     *
+     * `signal` aborts when the code already arrived another way (the local
+     * callback listener won the race) and the prompt should be torn down.
+     * Implementations may ignore it — an abandoned promise is simply never
+     * awaited — but a terminal prompt should honour it so the line does not
+     * linger after login already succeeded.
+     */
+    onPromptCode: (message: string, signal?: AbortSignal) => Promise<string>;
     onStatus: (message: string) => void;
 }
 
@@ -365,13 +374,27 @@ declare class AuthStorage {
     clearAll(): Promise<void>;
     /**
      * Returns valid credentials, auto-refreshing if expired.
+     *
      * If `forceRefresh` is true, refreshes even if the token hasn't expired
-     * (useful when the provider rejects a token with 401 before its stored expiry).
+     * (useful when the provider rejects a token with 401 before its stored
+     * expiry). Callers recovering from a rejection should also pass
+     * `rejectedToken` — see the stampede guard below.
+     *
      * Throws if not logged in.
      */
     resolveCredentials(provider: string, opts?: {
         forceRefresh?: boolean;
         storageKeys?: string[];
+        /**
+         * The access token the provider just rejected. Refreshing an OAuth grant
+         * invalidates the previous access token, so N processes sharing auth.json
+         * (app windows, CLI sessions, the usage poller) can otherwise revoke each
+         * other in a loop: each one force-refreshes on 401, and every refresh kills
+         * the token the others still hold. Naming the rejected token lets the
+         * refresh path tell "this credential is genuinely dead" from "someone else
+         * already rotated it" and simply adopt the newer on-disk credential.
+         */
+        rejectedToken?: string;
     }): Promise<OAuthCredentials>;
     /**
      * Returns a valid access token, auto-refreshing if expired.

package/dist/index.js

@@ -54,7 +54,7 @@ import {
   registerRuntimeModels,
   usesOpenAICodexTransport,
   withFileLock
-} from "./chunk-XDE6VUI4.js";
+} from "./chunk-JH7OVHH5.js";
 import {
   getAppPaths
 } from "./chunk-EAIPT76S.js";

package/dist/model-registry.cjs

@@ -92,6 +92,7 @@ var import_node_path3 = __toESM(require("path"), 1);
 var import_node_crypto2 = require("crypto");
 var import_gg_ai = require("@kenkaiiii/gg-ai");
 var MAX_BYTES = 10 * 1024 * 1024;
+var MIN_HEADROOM_BYTES = 64 * 1024;
 
 // src/claude-code-version.ts
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;