@kenkaiiii/gg-core 5.93.0 → 5.95.0

package/dist/{chunk-SDUIKPGO.js → chunk-J7W5HS6X.js}

@@ -1,1149 +1,959 @@
 import {
   getAppPaths
-} from "./chunk-2X5L6U4Z.js";
+} from "./chunk-GXOFTHM5.js";
 
-// src/oauth/kimi.ts
-import { execFileSync } from "child_process";
-import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { arch, hostname, release, type } from "os";
-import path from "path";
-
-// src/oauth/request-timeout.ts
-var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
-function oauthRequestSignal() {
-  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
-}
-
-// src/oauth/kimi.ts
-var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os = type();
-  const version = release();
-  const osArch = arch();
-  if (os === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = path.join(getAppPaths().agentDir, "kimi_device_id");
-  if (existsSync(idPath)) {
-    try {
-      const text = readFileSync(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = randomUUID();
+// src/kimi-region.ts
+import { GG_CODER_USER_AGENT } from "@kenkaiiii/gg-ai";
+var KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_CODE_OVERSEAS_BASE_URL = "https://api.kimi.ai/coding/v1";
+var KIMI_CODE_BASE_URLS = [KIMI_CODE_DEFAULT_BASE_URL, KIMI_CODE_OVERSEAS_BASE_URL];
+async function probeHost(baseUrl, apiKey, fetchImpl, timeoutMs) {
   try {
-    mkdirSync(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    writeFileSync(idPath, id, { encoding: "utf-8", mode: 384 });
+    const res = await fetchImpl(`${baseUrl}/models`, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": GG_CODER_USER_AGENT },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (res.ok) return "authorized";
+    if (res.status === 401 || res.status === 403) return "unauthorized";
+    return "inconclusive";
   } catch {
+    return "inconclusive";
   }
-  return id;
 }
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader(hostname()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader(release()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
+async function detectKimiCodeBaseUrl(apiKey, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const results = await Promise.all(
+    KIMI_CODE_BASE_URLS.map((url) => probeHost(url, apiKey, fetchImpl, timeoutMs))
+  );
+  const index = results.indexOf("authorized");
+  return index === -1 ? void 0 : KIMI_CODE_BASE_URLS[index];
 }
 function isKimiCodingEndpoint(baseUrl) {
   if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
-}
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+  return /^https:\/\/api\.kimi\.(com|ai)\/coding(\/|$)/i.test(baseUrl);
 }
 
 // src/auth-storage.ts
-import fs3 from "fs/promises";
-import { readFileSync as readFileSync2 } from "fs";
-import crypto5 from "crypto";
+import fs6 from "fs/promises";
+import { readFileSync } from "fs";
+import crypto4 from "crypto";
 
-// src/oauth/anthropic.ts
+// src/claude-code/runtime.ts
+import { spawn } from "child_process";
 import crypto2 from "crypto";
+import fs2 from "fs";
+import fsp2 from "fs/promises";
+import path from "path";
 
-// src/oauth/pkce.ts
-function base64urlEncode(bytes) {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
+// src/claude-code/tar.ts
+import fs from "fs";
+import fsp from "fs/promises";
+import zlib from "zlib";
+var BLOCK = 512;
+function readString(buf, offset, length) {
+  const end = buf.indexOf(0, offset);
+  return buf.toString("utf8", offset, end === -1 || end > offset + length ? offset + length : end);
+}
+function readSize(buf, offset) {
+  if (buf[offset] & 128) {
+    let value = buf[offset] & 127;
+    for (let i = 1; i < 12; i++) value = value * 256 + buf[offset + i];
+    return value;
+  }
+  const text = readString(buf, offset, 12).trim();
+  return text ? parseInt(text, 8) : 0;
+}
+function paxPath(data) {
+  let pos = 0;
+  while (pos < data.length) {
+    const space = data.indexOf(32, pos);
+    if (space === -1) break;
+    const len = parseInt(data.toString("utf8", pos, space), 10);
+    if (!Number.isFinite(len) || len <= 0) break;
+    const record = data.toString("utf8", space + 1, pos + len - 1);
+    const eq = record.indexOf("=");
+    if (eq !== -1 && record.slice(0, eq) === "path") return record.slice(eq + 1);
+    pos += len;
   }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return void 0;
 }
-async function generatePKCE() {
-  const verifierBytes = new Uint8Array(32);
-  crypto.getRandomValues(verifierBytes);
-  const verifier = base64urlEncode(verifierBytes);
-  const data = new TextEncoder().encode(verifier);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
-  return { verifier, challenge };
+async function extractFileFromTarGz(tgzPath, entryName, destPath) {
+  const input = fs.createReadStream(tgzPath).pipe(zlib.createGunzip());
+  let pending = Buffer.alloc(0);
+  let remaining = 0;
+  let padding = 0;
+  let kind = "skip";
+  let meta = [];
+  let overridePath;
+  let out;
+  let found = false;
+  try {
+    for await (const chunk of input) {
+      pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+      let pos = 0;
+      while (pos < pending.length) {
+        if (remaining > 0) {
+          const take = Math.min(remaining, pending.length - pos);
+          const slice = pending.subarray(pos, pos + take);
+          if (kind === "target") await out.write(slice);
+          else if (kind === "pax" || kind === "longname") meta.push(Buffer.from(slice));
+          pos += take;
+          remaining -= take;
+          if (remaining === 0) {
+            if (kind === "target") {
+              await out.close();
+              out = void 0;
+              found = true;
+            } else if (kind === "pax") {
+              overridePath = paxPath(Buffer.concat(meta)) ?? overridePath;
+            } else if (kind === "longname") {
+              overridePath = readString(Buffer.concat(meta), 0, Number.MAX_SAFE_INTEGER);
+            }
+          }
+          continue;
+        }
+        if (padding > 0) {
+          const skip = Math.min(padding, pending.length - pos);
+          pos += skip;
+          padding -= skip;
+          continue;
+        }
+        if (found) break;
+        if (pending.length - pos < BLOCK) break;
+        const header = pending.subarray(pos, pos + BLOCK);
+        pos += BLOCK;
+        if (header.every((b) => b === 0)) continue;
+        const size = readSize(header, 124);
+        const type = String.fromCharCode(header[156] || 48);
+        let name = readString(header, 0, 100);
+        if (readString(header, 257, 6) === "ustar") {
+          const prefix = readString(header, 345, 155);
+          if (prefix) name = `${prefix}/${name}`;
+        }
+        remaining = size;
+        padding = (BLOCK - size % BLOCK) % BLOCK;
+        meta = [];
+        if (type === "x") kind = "pax";
+        else if (type === "L") kind = "longname";
+        else {
+          const path4 = overridePath ?? name;
+          overridePath = void 0;
+          if ((type === "0" || type === "\0" || type === "7") && path4 === entryName) {
+            kind = "target";
+            out = await fsp.open(destPath, "w", 493);
+            if (size === 0) {
+              await out.close();
+              out = void 0;
+              found = true;
+            }
+          } else {
+            kind = "skip";
+          }
+        }
+      }
+      pending = pos < pending.length ? Buffer.from(pending.subarray(pos)) : Buffer.alloc(0);
+      if (found) break;
+    }
+    if (!found && out) throw new Error(`Archive ended inside ${entryName}`);
+    return found;
+  } finally {
+    if (out) await out.close().catch(() => {
+    });
+    input.destroy();
+  }
 }
 
-// src/claude-code-version.ts
-import {
-  getClaudeCodeVersion,
-  getClaudeCliUserAgent,
-  pendingClaudeCodeVersionRefresh
-} from "@kenkaiiii/gg-ai";
-
-// src/oauth/anthropic.ts
-var CLIENT_ID2 = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
-var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URLS = [
-  "https://platform.claude.com/v1/oauth/token",
-  "https://console.anthropic.com/v1/oauth/token"
-];
-var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
-var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-async function postTokenRequest(body, label) {
-  const encoded = JSON.stringify(body);
-  const headers = {
-    "Content-Type": "application/json",
-    "User-Agent": await getClaudeCliUserAgent(),
-    "anthropic-beta": "oauth-2025-04-20"
-  };
-  let lastError = null;
-  for (const url of TOKEN_URLS) {
-    let response;
-    try {
-      response = await fetch(url, {
-        method: "POST",
-        headers,
-        body: encoded,
-        signal: oauthRequestSignal()
-      });
-    } catch (err) {
-      lastError = err instanceof Error ? err : new Error(String(err));
-      continue;
-    }
-    if (response.ok) {
-      return await response.json();
-    }
-    const text = await response.text();
-    if (response.status >= 400 && response.status < 500) {
-      throw new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
+// src/claude-code/manifest.json
+var manifest_default = {
+  sdkVersion: "0.3.318",
+  claudeCodeVersion: "2.1.318",
+  platforms: {
+    "darwin-arm64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-arm64/-/claude-agent-sdk-darwin-arm64-0.3.318.tgz",
+      integrity: "sha512-AWoXeDXzAMD3RaA21lWuHvCrKd8xmbTTmKjovninn4j07jheoVSMzFbCFjpp4kk5TdhT36JtWPkAxvjNMbcO8w==",
+      bin: "claude"
+    },
+    "darwin-x64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-x64/-/claude-agent-sdk-darwin-x64-0.3.318.tgz",
+      integrity: "sha512-6CkZ5PCdebSY/LePp16sf/HYRtM6zVuxtn8qYICFS5KUZFsjccJJ9swVsOdHXNHi4SWZcSmIFTwoUbfFCzisRw==",
+      bin: "claude"
+    },
+    "linux-arm64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64/-/claude-agent-sdk-linux-arm64-0.3.318.tgz",
+      integrity: "sha512-mBm4su17aMitLBBCQj3bHdejyUDY6z/ormGih+HG24N689RSbdKECjGjkT87tDBIR/4jyoqmuSeHqM1DI8TJlg==",
+      bin: "claude"
+    },
+    "linux-arm64-musl": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64-musl/-/claude-agent-sdk-linux-arm64-musl-0.3.318.tgz",
+      integrity: "sha512-l4LSYFOrvlYCrUImGfxMTQ0wg+T3s9CBhrBvPF/0oJGKZg+QnxHHU8jUVm9e9/xYmDRTtqFIrr4id/5AfH4XGw==",
+      bin: "claude"
+    },
+    "linux-x64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64/-/claude-agent-sdk-linux-x64-0.3.318.tgz",
+      integrity: "sha512-+mE+ueBD3oRFdaG16rd0h+LMjdeivGxL0pr/+FZK7JeLWVu+yPSw/f/X02b9oK36/DWykiFTu2G6HnJ9/+YO6w==",
+      bin: "claude"
+    },
+    "linux-x64-musl": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64-musl/-/claude-agent-sdk-linux-x64-musl-0.3.318.tgz",
+      integrity: "sha512-SAF3lj/2OzTU84p+OOA13QEKA9+5fYAw0M9E7AJjdnRmVFGqQfbV7Do1i1f9Sj0mIubB3rLTRphGRw8O4HZjgA==",
+      bin: "claude"
+    },
+    "win32-arm64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-arm64/-/claude-agent-sdk-win32-arm64-0.3.318.tgz",
+      integrity: "sha512-19iVSZ4379QbZU1XnGUtfFvhKS1WzS8H1sbU/DbrzqbJ5Kq1eB1drj+obB1fCxTh6m26tRPj0zMJmdeu/jk3Gw==",
+      bin: "claude.exe"
+    },
+    "win32-x64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-x64/-/claude-agent-sdk-win32-x64-0.3.318.tgz",
+      integrity: "sha512-ZdKVWpyVNVt0cXrOf8sUBaxcxLEAP+oGMdQDLBWr/BqOxTWLy7TBWOj1kzw+wVg/9WIkjkgQWeJzGXPWulR1sA==",
+      bin: "claude.exe"
     }
-    lastError = new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
   }
-  throw lastError ?? new Error(`Anthropic ${label} failed: all endpoints unreachable`);
+};
+
+// src/claude-code/runtime.ts
+var CLAUDE_CODE_MANIFEST = manifest_default;
+var CLAUDE_CODE_AUTH_KEY = "anthropic-claude-code";
+var CLAUDE_CODE_AUTH_MARKER = { via: "claude-code" };
+function isClaudeCodeAuthMarker(value) {
+  return value?.via === CLAUDE_CODE_AUTH_MARKER.via;
+}
+function isLegacyClaudeOAuth(value) {
+  const token = value?.accessToken;
+  return typeof token === "string" && token.startsWith("sk-ant-oat");
+}
+function isMusl() {
+  if (process.platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  return report != null && report.header?.glibcVersionRuntime === void 0;
+}
+function claudeCodePlatformKey(info = { platform: process.platform, arch: process.arch, musl: isMusl() }) {
+  const arch = info.arch === "arm64" || info.arch === "x64" ? info.arch : null;
+  if (!arch) return null;
+  if (info.platform === "darwin" || info.platform === "win32") return `${info.platform}-${arch}`;
+  if (info.platform === "linux") return `linux-${arch}${info.musl ? "-musl" : ""}`;
+  return null;
+}
+function resolveAsset(opts) {
+  const manifest = opts.manifest ?? CLAUDE_CODE_MANIFEST;
+  const key = opts.platformKey ?? claudeCodePlatformKey();
+  const asset = key ? manifest.platforms[key] : void 0;
+  if (!asset) {
+    throw new Error(
+      `Claude Code isn't available for ${process.platform}-${process.arch}. Use an Anthropic API key instead.`
+    );
+  }
+  return { manifest, asset };
 }
-function toCredentials(data) {
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
+function claudeCodeHome(opts = {}) {
+  return opts.home ?? getAppPaths().claudeCodeDir;
 }
-async function loginAnthropic(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto2.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLIENT_ID2,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: SCOPES,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${AUTHORIZE_URL}?${params}`;
-  callbacks.onOpenUrl(authUrl);
-  const raw = await callbacks.onPromptCode("Paste the code from the browser (format: code#state):");
-  const parts = raw.trim().split("#");
-  if (parts.length !== 2 || !parts[0] || parts[1] !== state) {
-    throw new Error("Invalid code or state mismatch. Please try again.");
-  }
-  return exchangeAnthropicCode(parts[0], parts[1], verifier);
-}
-async function exchangeAnthropicCode(code, state, verifier) {
-  const data = await postTokenRequest(
-    {
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
-      code,
-      state,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: verifier
-    },
-    "token exchange"
-  );
-  return toCredentials(data);
-}
-async function refreshAnthropicToken(refreshToken) {
-  const data = await postTokenRequest(
-    {
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID2,
-      refresh_token: refreshToken
-    },
-    "token refresh"
-  );
-  return toCredentials(data);
+function claudeCodeConfigDir(opts = {}) {
+  return opts.home ? path.join(opts.home, "config") : getAppPaths().claudeCodeConfigDir;
 }
-
-// src/oauth/openai.ts
-import http from "http";
-import crypto3 from "crypto";
-var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
-var TOKEN_URL = "https://auth.openai.com/oauth/token";
-var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
-var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
-var CALLBACK_TIMEOUT_MS = 12e4;
-var MAX_PASTE_ATTEMPTS = 3;
-var MIN_RAW_CODE_LENGTH = 10;
-async function loginOpenAI(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto3.randomBytes(16).toString("hex");
-  const url = new URL(AUTHORIZE_URL2);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID3);
-  url.searchParams.set("redirect_uri", REDIRECT_URI2);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("prompt", "login");
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", "ggcoder");
-  const code = await acquireAuthorizationCode(url.toString(), state, callbacks);
-  const creds = await exchangeOpenAICode(code, verifier);
-  const accountId = getAccountId(creds.accessToken);
-  if (!accountId) {
-    throw new Error("Failed to extract accountId from OpenAI token.");
-  }
-  creds.accountId = accountId;
-  return creds;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
+function claudeCodeBinaryPath(opts = {}) {
+  const { manifest, asset } = resolveAsset(opts);
+  return path.join(claudeCodeHome(opts), manifest.claudeCodeVersion, asset.bin);
+}
+function resolveClaudeCodeBinary(opts = {}) {
+  let binary;
   try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
+    binary = claudeCodeBinaryPath(opts);
   } catch {
+    return null;
   }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  if (/\s/.test(value) || value.length < MIN_RAW_CODE_LENGTH) return {};
-  return { code: value };
-}
-function decodeJwt(token) {
   try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const decoded = atob(parts[1]);
-    return JSON.parse(decoded);
+    return fs2.statSync(binary).isFile() ? binary : null;
   } catch {
     return null;
   }
 }
-function getAccountId(accessToken) {
-  const payload = decodeJwt(accessToken);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const accountId = auth?.chatgpt_account_id;
-  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
-}
-async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
-  callbacks.onOpenUrl(authUrl);
-  callbacks.onStatus("Waiting for browser callback...");
-  const done = new AbortController();
+var installs = /* @__PURE__ */ new Map();
+async function ensureClaudeCodeBinary(opts = {}) {
+  const existing = resolveClaudeCodeBinary(opts);
+  if (existing) return existing;
+  const target = claudeCodeBinaryPath(opts);
+  let install = installs.get(target);
+  if (!install) {
+    install = installClaudeCode(opts).finally(() => installs.delete(target));
+    installs.set(target, install);
+  }
+  return install;
+}
+async function installClaudeCode(opts) {
+  const { manifest, asset } = resolveAsset(opts);
+  const home = claudeCodeHome(opts);
+  const versionDir = path.join(home, manifest.claudeCodeVersion);
+  const binary = path.join(versionDir, asset.bin);
+  await fsp2.mkdir(home, { recursive: true });
+  const tag = `${process.pid}-${crypto2.randomBytes(4).toString("hex")}`;
+  const tarball = path.join(home, `.download-${tag}.tgz`);
+  const staging = path.join(home, `.staging-${tag}`);
   try {
-    return await new Promise((resolve, reject) => {
-      let serverFailed = false;
-      let pasteError;
-      const failIfExhausted = () => {
-        if (!serverFailed || pasteError === void 0) return;
-        reject(
-          pasteError instanceof Error ? pasteError : new Error("Could not obtain an authorization code.")
-        );
-      };
-      listenForCallback(expectedState, done.signal).then(resolve, () => {
-        serverFailed = true;
-        failIfExhausted();
-      });
-      promptForCode(expectedState, callbacks, done.signal).then(resolve, (err) => {
-        if (err instanceof FatalLoginError) {
-          reject(err);
-          return;
-        }
-        pasteError = err;
-        failIfExhausted();
-      });
-    });
-  } finally {
-    done.abort();
-  }
-}
-var FatalLoginError = class extends Error {
-};
-async function promptForCode(expectedState, callbacks, signal) {
-  let message = "If the browser is on another machine (SSH/headless), paste the callback URL or code here:";
-  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const raw = await callbacks.onPromptCode(message, signal);
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const parsed = parseAuthorizationInput(raw);
-    if (parsed.code && parsed.state && parsed.state !== expectedState) {
-      throw new FatalLoginError("Authorization state mismatch \u2014 start the login again.");
+    await download(asset, tarball, opts);
+    opts.onProgress?.({ phase: "extract" });
+    await fsp2.mkdir(staging, { recursive: true });
+    const found = await extractFileFromTarGz(
+      tarball,
+      `package/${asset.bin}`,
+      path.join(staging, asset.bin)
+    );
+    if (!found) throw new Error(`The Claude Code download has no ${asset.bin} binary.`);
+    await fsp2.chmod(path.join(staging, asset.bin), 493);
+    try {
+      await fsp2.rename(staging, versionDir);
+    } catch (err) {
+      if (!fs2.existsSync(binary)) throw err;
     }
-    if (parsed.code) return parsed.code;
-    message = "That didn't contain an authorization code. Paste the full callback URL:";
-  }
-  throw new Error("No authorization code found in input.");
-}
-async function listenForCallback(expectedState, signal) {
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url || "", "http://localhost");
-      if (url.pathname !== "/auth/callback") {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => {
-      reject(err);
+    await removeOldVersions(home, manifest.claudeCodeVersion);
+    return binary;
+  } finally {
+    await fsp2.rm(tarball, { force: true }).catch(() => {
     });
-    server.listen(1455, "127.0.0.1");
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, CALLBACK_TIMEOUT_MS);
-    timeout.unref();
-    const onAbort = () => {
-      server.close();
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    server.on("close", () => {
-      clearTimeout(timeout);
-      signal.removeEventListener("abort", onAbort);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code"));
-      }
+    await fsp2.rm(staging, { recursive: true, force: true }).catch(() => {
     });
-  });
-}
-async function exchangeOpenAICode(code, verifier) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID3,
-      code,
-      redirect_uri: REDIRECT_URI2,
-      code_verifier: verifier
-    }),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token exchange failed (${response.status}): ${text}`);
   }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
 }
-async function refreshOpenAIToken(refreshToken) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLIENT_ID3
-    }),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token refresh failed (${response.status}): ${text}`);
+async function download(asset, dest, opts) {
+  const doFetch = opts.fetch ?? fetch;
+  const res = await doFetch(asset.url, { signal: opts.signal });
+  if (!res.ok || !res.body) {
+    throw new Error(`Claude Code download failed (HTTP ${res.status}).`);
   }
-  const data = await response.json();
-  const creds = {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
-  const accountId = getAccountId(creds.accessToken);
-  if (accountId) {
-    creds.accountId = accountId;
+  const totalBytes = Number(res.headers.get("content-length")) || void 0;
+  const hash = crypto2.createHash("sha512");
+  const out = await fsp2.open(dest, "w");
+  let receivedBytes = 0;
+  let lastReported = -1;
+  try {
+    opts.onProgress?.({ phase: "download", receivedBytes, totalBytes });
+    for await (const chunk of res.body) {
+      if (opts.signal?.aborted) throw opts.signal.reason ?? new Error("Download cancelled.");
+      hash.update(chunk);
+      await out.write(chunk);
+      receivedBytes += chunk.byteLength;
+      const step = totalBytes ? Math.floor(receivedBytes / totalBytes * 100) : Math.floor(receivedBytes / 4194304);
+      if (step !== lastReported) {
+        lastReported = step;
+        opts.onProgress?.({ phase: "download", receivedBytes, totalBytes });
+      }
+    }
+  } finally {
+    await out.close();
   }
-  return creds;
-}
-
-// src/oauth/gemini.ts
-import http2 from "http";
-import crypto4 from "crypto";
-var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
-var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
-var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
-var DEFAULT_CLIENT_SECRET = "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";
-var AUTHORIZE_URL3 = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL2 = "https://oauth2.googleapis.com/token";
-var CODE_ASSIST_BASE_URL = "https://cloudcode-pa.googleapis.com";
-var CODE_ASSIST_API_VERSION = "v1internal";
-var CODE_ASSIST_POST_RETRIES = 3;
-var CODE_ASSIST_POST_RETRY_DELAY_MS = 100;
-var SCOPE2 = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile"
-].join(" ");
-var USER_TIER_FREE = "free-tier";
-var USER_TIER_LEGACY = "legacy-tier";
-var USER_TIER_STANDARD = "standard-tier";
-var VALIDATION_REQUIRED_REASON = "VALIDATION_REQUIRED";
-var VPC_SC_REASON = "SECURITY_POLICY_VIOLATED";
-var CodeAssistHttpError = class extends Error {
-  status;
-  body;
-  constructor(label, status, body) {
-    super(`Gemini Code Assist ${label} failed (${status}): ${body}`);
-    this.name = "CodeAssistHttpError";
-    this.status = status;
-    this.body = body;
+  opts.onProgress?.({ phase: "verify" });
+  const expected = asset.integrity.replace(/^sha512-/, "");
+  if (hash.digest("base64") !== expected) {
+    throw new Error(
+      "The Claude Code download didn't match its pinned checksum, so it was discarded."
+    );
   }
-};
-async function loginGemini(callbacks) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto4.randomBytes(32).toString("hex");
-  const redirectUri = await getLoopbackRedirectUri();
-  const url = new URL(AUTHORIZE_URL3);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId2);
-  url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", SCOPE2);
-  url.searchParams.set("access_type", "offline");
-  url.searchParams.set("prompt", "consent");
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  let code;
+}
+async function removeOldVersions(home, keep) {
+  let entries;
   try {
-    code = await loginWithServer(url.toString(), redirectUri, state, callbacks);
+    entries = await fsp2.readdir(home, { withFileTypes: true });
   } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput2(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    if (parsed.state && parsed.state !== state) {
-      throw new Error("Invalid state. Please try again.");
-    }
-    code = parsed.code;
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name === keep || entry.name === "config") continue;
+    if (!/^\d+\.\d+\.\d+/.test(entry.name)) continue;
+    await fsp2.rm(path.join(home, entry.name), { recursive: true, force: true }).catch(() => {
+    });
   }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret);
-  callbacks.onStatus("Setting up Gemini Code Assist access...");
-  const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
-  return {
-    ...creds,
-    projectId
-  };
-}
-async function refreshGeminiToken(refreshToken) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const data = await postTokenRequest2({
-    grant_type: "refresh_token",
-    refresh_token: refreshToken,
-    client_id: clientId2,
-    client_secret: clientSecret
-  });
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? refreshToken,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-function getGeminiOAuthClientCredentials() {
-  const clientId2 = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
-  const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId: clientId2, clientSecret };
 }
-async function getLoopbackRedirectUri() {
+function formatClaudeCodeInstallProgress(progress) {
+  if (progress.phase === "verify") return "Checking the Claude Code download\u2026";
+  if (progress.phase === "extract") return "Unpacking Claude Code\u2026";
+  const mb = (bytes) => Math.round(bytes / 1048576);
+  if (!progress.totalBytes) return `Downloading Claude Code\u2026 ${mb(progress.receivedBytes)} MB`;
+  const pct = Math.floor(progress.receivedBytes / progress.totalBytes * 100);
+  return `Downloading Claude Code\u2026 ${pct}% (${mb(progress.receivedBytes)} of ${mb(progress.totalBytes)} MB)`;
+}
+var STRIPPED_ENV = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "NODE_OPTIONS"
+];
+function claudeCodeEnv(opts = {}, base = process.env) {
+  const env = {};
+  for (const [key, value] of Object.entries(base)) {
+    if (value !== void 0 && !STRIPPED_ENV.includes(key)) env[key] = value;
+  }
+  env.CLAUDE_CONFIG_DIR = claudeCodeConfigDir(opts);
+  env.DISABLE_AUTOUPDATER = "1";
+  return env;
+}
+function runCommand(opts) {
+  if (opts.binary) return { command: opts.binary, prefix: opts.binaryArgs ?? [] };
+  const binary = resolveClaudeCodeBinary(opts);
+  if (!binary) throw new Error("Claude Code isn't installed yet. Sign in with Claude first.");
+  return { command: binary, prefix: [] };
+}
+function runClaude(args, opts) {
+  const { command, prefix } = runCommand(opts);
   return new Promise((resolve, reject) => {
-    const server = http2.createServer();
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      server.close(() => {
-        if (addr && typeof addr === "object") {
-          resolve(`http://127.0.0.1:${addr.port}/oauth2callback`);
-        } else {
-          reject(new Error("Failed to allocate OAuth callback port."));
-        }
-      });
+    const child = spawn(command, [...prefix, ...args], {
+      env: claudeCodeEnv(opts),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      signal: opts.signal
     });
-    server.on("error", reject);
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => stdout += d.toString());
+    child.stderr.on("data", (d) => stderr += d.toString());
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ code, stdout, stderr }));
   });
 }
-function parseAuthorizationInput2(input) {
-  const value = input.trim();
-  if (!value) return {};
+async function claudeCodeAuthStatus(opts = {}) {
+  if (!opts.binary && !resolveClaudeCodeBinary(opts)) return { loggedIn: false };
+  const { stdout } = await runClaude(["auth", "status", "--json"], opts);
   try {
-    const url = new URL(value);
+    const parsed = JSON.parse(stdout);
     return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
+      loggedIn: parsed.loggedIn === true,
+      ...typeof parsed.authMethod === "string" ? { authMethod: parsed.authMethod } : {},
+      ...typeof parsed.email === "string" ? { email: parsed.email } : {},
+      ...typeof parsed.subscriptionType === "string" ? { subscriptionType: parsed.subscriptionType } : {}
     };
   } catch {
+    return { loggedIn: false };
   }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
+}
+async function logoutClaudeCode(opts = {}) {
+  if (!opts.binary && !resolveClaudeCodeBinary(opts)) return;
+  const { code, stderr } = await runClaude(["auth", "logout"], opts);
+  if (code !== 0) throw new Error(stderr.trim() || `claude auth logout exited with ${code}`);
+}
+var OPEN_URL_HOOK = `const arg = String(process.argv[1] || "");
+const file = process.env.GG_CLAUDE_CODE_URL_FILE;
+if (file && /https?:/.test(arg)) {
+  require("node:fs").appendFileSync(file, arg + "\\n");
+  process.exit(0);
+}
+`;
+var CAPTURE_WAIT_MS = 3e3;
+function stripAnsi(text) {
+  return text.replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b\[[0-9;?]*[A-Za-z]/g, "");
+}
+function claudeCodeCallbackUrl(manualUrl, captured) {
+  const port = /localhost(?::|%3A)(\d{2,5})(?:\/|%2F)callback/i.exec(captured)?.[1];
+  if (!port) return null;
+  try {
+    const url = new URL(manualUrl);
+    url.searchParams.set("redirect_uri", `http://localhost:${port}/callback`);
+    return url.toString();
+  } catch {
+    return null;
   }
-  return { code: value };
 }
-async function loginWithServer(authUrl, redirectUri, expectedState, callbacks) {
-  const redirect = new URL(redirectUri);
-  const port = Number(redirect.port);
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = http2.createServer((req, res) => {
-      const url = new URL(req.url || "", redirect.origin);
-      if (url.pathname !== redirect.pathname) {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
+async function loginClaudeCode(callbacks, opts = {}) {
+  const { command, prefix } = runCommand(opts);
+  const home = claudeCodeHome(opts);
+  await fsp2.mkdir(claudeCodeConfigDir(opts), { recursive: true });
+  const tag = `${process.pid}-${crypto2.randomBytes(4).toString("hex")}`;
+  const hookFile = path.join(home, `.open-url-${tag}.cjs`);
+  const urlFile = path.join(home, `.open-url-${tag}.txt`);
+  await fsp2.writeFile(hookFile, OPEN_URL_HOOK);
+  const env = {
+    ...claudeCodeEnv(opts),
+    BROWSER: process.execPath,
+    NODE_OPTIONS: `--require ${JSON.stringify(hookFile)}`,
+    GG_CLAUDE_CODE_URL_FILE: urlFile
+  };
+  const promptAbort = new AbortController();
+  let timer;
+  try {
+    await new Promise((resolve, reject) => {
+      const child = spawn(command, [...prefix, "auth", "login", "--claudeai"], {
+        env,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+      let stdout = "";
+      let stderr = "";
+      let manualUrl = null;
+      let opened = false;
+      const onAbort = () => child.kill();
+      opts.signal?.addEventListener("abort", onAbort, { once: true });
+      const open = (url, needsCode) => {
+        if (opened) return;
+        opened = true;
+        clearInterval(timer);
+        callbacks.onOpenUrl(url);
+        callbacks.onStatus("Finish signing in to Claude in your browser\u2026");
+        if (!needsCode) return;
+        void callbacks.onPromptCode("Paste the code shown after signing in to Claude:", promptAbort.signal).then((code) => {
+          const trimmed = code.trim();
+          if (trimmed && !child.stdin.destroyed) child.stdin.write(`${trimmed}
+`);
+        }).catch(() => {
+        });
+      };
+      child.stdout.on("data", (d) => {
+        stdout += d.toString();
+        if (manualUrl) return;
+        const match = /visit:\s*(https:\/\/\S+)/.exec(stripAnsi(stdout));
+        if (!match) return;
+        manualUrl = match[1];
+        const started = Date.now();
+        timer = setInterval(() => {
+          let captured = "";
+          try {
+            captured = fs2.readFileSync(urlFile, "utf8");
+          } catch {
+          }
+          const callbackUrl = captured ? claudeCodeCallbackUrl(manualUrl, captured) : null;
+          if (callbackUrl) open(callbackUrl, false);
+          else if (Date.now() - started > (opts.browserWaitMs ?? CAPTURE_WAIT_MS))
+            open(manualUrl, true);
+        }, 100);
+      });
+      child.stderr.on("data", (d) => stderr += d.toString());
+      child.on("error", reject);
+      child.on("close", (code) => {
+        opts.signal?.removeEventListener("abort", onAbort);
+        if (opts.signal?.aborted) reject(new Error("Sign-in cancelled."));
+        else if (code === 0) resolve();
+        else {
+          const detail = stripAnsi(stderr).trim().split("\n").pop()?.trim();
+          reject(new Error(detail || `Claude sign-in failed (exit ${code}).`));
+        }
+      });
     });
-    server.on("error", (err) => reject(err));
-    server.listen(port, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
+  } finally {
+    clearInterval(timer);
+    promptAbort.abort();
+    await fsp2.rm(hookFile, { force: true }).catch(() => {
     });
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, 12e4);
-    timeout.unref();
-    server.on("close", () => {
-      clearTimeout(timeout);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code."));
-      }
+    await fsp2.rm(urlFile, { force: true }).catch(() => {
     });
-  });
+  }
 }
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret) {
-  const data = await postTokenRequest2({
-    grant_type: "authorization_code",
-    client_id: clientId2,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
-  });
-  if (!data.refresh_token) {
-    throw new Error("Gemini OAuth did not return a refresh token. Please try login again.");
+
+// src/oauth/openai.ts
+import http from "http";
+import crypto3 from "crypto";
+import fs3 from "fs/promises";
+import path2 from "path";
+
+// src/oauth/pkce.ts
+function base64urlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
   }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-async function postTokenRequest2(body) {
-  const response = await fetch(TOKEN_URL2, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(body),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Gemini token request failed (${response.status}): ${text}`);
+async function generatePKCE() {
+  const verifierBytes = new Uint8Array(32);
+  crypto.getRandomValues(verifierBytes);
+  const verifier = base64urlEncode(verifierBytes);
+  const data = new TextEncoder().encode(verifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
+  return { verifier, challenge };
+}
+
+// src/oauth/request-timeout.ts
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+function oauthRequestSignal() {
+  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
+}
+
+// src/oauth/openai.ts
+var ISSUER = "https://auth.openai.com";
+var AUTHORIZE_URL = `${ISSUER}/api/accounts/authorize`;
+var TOKEN_URL = `${ISSUER}/api/accounts/oauth/token`;
+var REVOKE_URL = `${ISSUER}/api/accounts/oauth/revoke`;
+var JWKS_URL = `${ISSUER}/.well-known/jwks.json`;
+var REGISTRATION_CLIENT_ID = "dynamic_agent_client";
+var AGENT_NAME = "GG Coder";
+var RESOURCE = "https://api.openai.com/v1";
+var CHATGPT_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPES = `openid profile email offline_access resource.invoke ${CHATGPT_PLAN_SCOPE}`;
+var CHATGPT_PLAN_BASE_URL = "https://api.openai.com/v1";
+var CHATGPT_USAGE_URL = "https://chatgpt.com/settings/usage";
+var CALLBACK_PATH = "/auth/callback";
+var PREFERRED_PORT = 1455;
+var CALLBACK_TIMEOUT_MS = 12e4;
+var MAX_PASTE_ATTEMPTS = 3;
+var ID_TOKEN_CLOCK_SKEW_S = 60;
+var CHATGPT_PLAN_NOT_ENABLED_MESSAGE = "ChatGPT plan use isn't enabled for GG Coder. Allow Use your ChatGPT plan, or add an OpenAI API key.";
+var ChatGPTPlanNotEnabledError = class extends Error {
+  constructor() {
+    super(CHATGPT_PLAN_NOT_ENABLED_MESSAGE);
+    this.name = "ChatGPTPlanNotEnabledError";
   }
-  return await response.json();
+};
+function defaultHostIdFile() {
+  return path2.join(getAppPaths().agentDir, "openai-host-id");
 }
-async function setupCodeAssistProject(accessToken, callbacks) {
-  const envProject = process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID;
-  if (envProject && /^\d+$/.test(envProject)) {
-    throw new Error("GOOGLE_CLOUD_PROJECT must be a project ID, not a numeric project number.");
-  }
-  const coreMetadata = {
-    ideType: "IDE_UNSPECIFIED",
-    platform: "PLATFORM_UNSPECIFIED",
-    pluginType: "GEMINI"
-  };
-  const projectMetadata = {
-    ...coreMetadata,
-    ...envProject ? { duetProject: envProject } : {}
-  };
-  let loadRes;
-  while (true) {
-    loadRes = await loadCodeAssist(accessToken, envProject, projectMetadata);
-    const validation = getValidationRequiredTier(loadRes);
-    if (!validation) break;
-    callbacks.onStatus(
-      `Gemini Code Assist requires account validation${validation.reasonMessage ? `: ${validation.reasonMessage}` : ""}`
-    );
-    callbacks.onOpenUrl(validation.validationUrl);
-    const answer = await callbacks.onPromptCode(
-      "Complete validation in the browser, then press Enter to retry (or type cancel):"
-    );
-    if (answer.trim().toLowerCase() === "cancel") {
-      throw new Error("Gemini Code Assist account validation was cancelled.");
-    }
-  }
-  if (loadRes.currentTier) {
-    const project2 = loadRes.cloudaicompanionProject ?? envProject;
-    if (!project2) throwProjectError(loadRes);
-    return project2;
-  }
-  const tier = getOnboardTier(loadRes);
-  const onboardReq = tier.id === USER_TIER_FREE ? {
-    tierId: tier.id,
-    cloudaicompanionProject: void 0,
-    metadata: coreMetadata
-  } : {
-    tierId: tier.id,
-    cloudaicompanionProject: envProject,
-    metadata: projectMetadata
-  };
-  let operation = await codeAssistPost(
-    accessToken,
-    "onboardUser",
-    onboardReq
-  );
-  while (!operation.done && operation.name) {
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    operation = await codeAssistGet(accessToken, operation.name);
-  }
-  const project = operation.response?.cloudaicompanionProject?.id ?? envProject;
-  if (!project) throwProjectError(loadRes);
-  return project;
+function defaultRegistrationFile() {
+  return path2.join(getAppPaths().agentDir, "openai-chatgpt-client.json");
 }
-async function loadCodeAssist(accessToken, envProject, metadata) {
+async function writePrivateFile(file, content) {
+  await fs3.mkdir(path2.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${crypto3.randomUUID().slice(0, 8)}.tmp`;
   try {
-    return await codeAssistPost(accessToken, "loadCodeAssist", {
-      ...envProject ? { cloudaicompanionProject: envProject } : {},
-      metadata
-    });
+    await fs3.writeFile(tmp, content, { encoding: "utf-8", mode: 384 });
+    await fs3.rename(tmp, file);
   } catch (err) {
-    if (err instanceof CodeAssistHttpError && isVpcScAffectedError(err)) {
-      return { currentTier: { id: USER_TIER_STANDARD } };
-    }
-    if (err instanceof CodeAssistHttpError && err.status === 403 && envProject === "cloudshell-gca") {
-      throw new Error(
-        "Access to the default Cloud Shell Gemini project was denied.\nPlease set your own Google Cloud project by running:\ngcloud config set project [PROJECT_ID]\nor setting export GOOGLE_CLOUD_PROJECT=...",
-        { cause: err }
-      );
-    }
+    await fs3.unlink(tmp).catch(() => {
+    });
     throw err;
   }
 }
-function getValidationRequiredTier(response) {
-  return response.ineligibleTiers?.find(
-    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
-  );
-}
-function getOnboardTier(response) {
-  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
-  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
+var HOST_ID_PATTERN = /^urn:uuid:[0-9a-f-]{36}$/i;
+async function getChatGPTHostId(file = defaultHostIdFile()) {
+  const existing = await fs3.readFile(file, "utf-8").catch(() => "");
+  if (HOST_ID_PATTERN.test(existing.trim())) return existing.trim();
+  await writePrivateFile(file, `urn:uuid:${crypto3.randomUUID()}`);
+  return (await fs3.readFile(file, "utf-8")).trim();
 }
-function throwProjectError(response) {
-  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
-  if (reasons && reasons.length > 0) {
-    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
+async function readRegistration(file) {
+  try {
+    const value = JSON.parse(await fs3.readFile(file, "utf-8"));
+    if (typeof value.clientId === "string" && typeof value.subject === "string") {
+      return { clientId: value.clientId, subject: value.subject };
+    }
+  } catch {
   }
-  throw new Error(
-    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
-  );
+  return void 0;
 }
-async function codeAssistPost(accessToken, method, body) {
-  let lastError;
-  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
-    try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
+async function loginChatGPT(callbacks, options = {}) {
+  const hostId = await getChatGPTHostId(options.hostIdFile);
+  const registrationFile = options.registrationFile ?? defaultRegistrationFile();
+  const registration = await readRegistration(registrationFile);
+  const { verifier, challenge } = await generatePKCE();
+  const state = crypto3.randomBytes(16).toString("hex");
+  const nonce = crypto3.randomBytes(16).toString("hex");
+  const listener = await startCallbackListener(state, Boolean(registration));
+  try {
+    const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`;
+    const url = new URL(AUTHORIZE_URL);
+    url.searchParams.set("client_id", registration?.clientId ?? REGISTRATION_CLIENT_ID);
+    if (!registration) url.searchParams.set("agent_name_hint", AGENT_NAME);
+    url.searchParams.set("ext_agent_host_id", hostId);
+    if (registration && options.previous?.idToken) {
+      url.searchParams.set("id_token_hint", options.previous.idToken);
+    }
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("scope", SCOPES);
+    url.searchParams.set("resource", RESOURCE);
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("code_challenge", challenge);
+    const callback = await acquireCallback(url.toString(), state, listener, callbacks);
+    if (callback.get("error")) {
+      if (callback.get("error") === "access_denied") throw new ChatGPTPlanNotEnabledError();
+      throw new Error(
+        `ChatGPT sign-in failed: ${callback.get("error_description") ?? callback.get("error")}`
+      );
+    }
+    const code = callback.get("code");
+    if (!code) throw new Error("ChatGPT sign-in returned no authorization code.");
+    const issued = callback.get("client_id") ?? void 0;
+    if (registration && issued && issued !== registration.clientId) {
+      throw new Error("ChatGPT returned a different app registration. Start the sign-in again.");
+    }
+    const clientId = registration?.clientId ?? issued;
+    if (!clientId || clientId === REGISTRATION_CLIENT_ID) {
+      throw new Error(
+        "ChatGPT didn't finish registering GG Coder. Start the sign-in again, and paste the full callback URL if you're on another machine."
+      );
+    }
+    const tokens = await exchangeCode({ code, verifier, clientId, redirectUri });
+    const claims = await verifyIdToken(tokens.idToken, { clientId, nonce });
+    const subject = String(claims.sub ?? "");
+    if (!subject) throw new Error("ChatGPT ID token has no subject.");
+    if (registration && registration.subject !== subject) {
+      await fs3.unlink(registrationFile).catch(() => {
       });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
-      }
-      lastError = err;
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new Error(
+        "That was a different ChatGPT account. Continue with ChatGPT again to connect it."
+      );
+    }
+    if (!tokens.scopes.includes(CHATGPT_PLAN_SCOPE)) {
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new ChatGPTPlanNotEnabledError();
+    }
+    if (!registration) {
+      await writePrivateFile(registrationFile, JSON.stringify({ clientId, subject }));
     }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
+    return {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3,
+      expiresIn: tokens.expiresIn,
+      accountId: subject,
+      clientId,
+      idToken: tokens.idToken,
+      scopes: tokens.scopes,
+      baseUrl: CHATGPT_PLAN_BASE_URL
+    };
+  } finally {
+    listener.close();
   }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
 }
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
+async function fetchChatGPTPlanModels(accessToken, fetchFn = fetch) {
+  const response = await fetchFn(`${CHATGPT_PLAN_BASE_URL}/models`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: oauthRequestSignal()
   });
+  if (!response.ok) throw new Error(`ChatGPT model list failed (${response.status})`);
+  const data = await response.json();
+  return (data.models ?? []).filter((m) => typeof m.slug === "string" && (m.visibility ?? "list") === "list").map((m) => m.slug);
 }
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken),
-    signal: oauthRequestSignal()
+async function startCallbackListener(expectedState, anyPort) {
+  let settle;
+  const result = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
   });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
+  result.catch(() => {
+  });
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url || "", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    if (url.searchParams.get("state") !== expectedState) {
+      res.statusCode = 400;
+      res.end("State mismatch");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(
+      "<html><body><h1>You're signed in to GG Coder.</h1><p>You can close this tab.</p></body></html>"
+    );
+    settle?.resolve(url.searchParams);
+    server.close();
+  });
+  const listen = (port2) => new Promise((resolve, reject) => {
+    const onError = (err) => reject(err);
+    server.once("error", onError);
+    server.listen(port2, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve(server.address().port);
+    });
+  });
+  let port;
+  for (const candidate of anyPort ? [PREFERRED_PORT, 0] : [PREFERRED_PORT]) {
+    try {
+      port = await listen(candidate);
+      break;
+    } catch {
+    }
   }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
+  if (port === void 0) {
+    settle?.reject(new Error("Could not start the local sign-in listener."));
+    return { port: PREFERRED_PORT, result, close: () => {
+    } };
+  }
+  const timeout = setTimeout(() => server.close(), CALLBACK_TIMEOUT_MS);
+  timeout.unref();
+  server.on("close", () => {
+    clearTimeout(timeout);
+    settle?.reject(new Error("Sign-in listener closed without a callback."));
+  });
+  return { port, result, close: () => server.close() };
 }
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
+async function acquireCallback(authUrl, expectedState, listener, callbacks) {
+  callbacks.onOpenUrl(authUrl);
+  callbacks.onStatus("Waiting for ChatGPT sign-in in your browser...");
+  const done = new AbortController();
+  try {
+    return await new Promise((resolve, reject) => {
+      let listenerFailed = false;
+      let pasteError;
+      const failIfExhausted = () => {
+        if (!listenerFailed || pasteError === void 0) return;
+        reject(
+          pasteError instanceof Error ? pasteError : new Error("Could not complete the sign-in.")
+        );
+      };
+      listener.result.then(resolve, () => {
+        listenerFailed = true;
+        failIfExhausted();
+      });
+      promptForCallback(expectedState, callbacks, done.signal).then(resolve, (err) => {
+        if (err instanceof FatalLoginError) {
+          reject(err);
+          return;
+        }
+        pasteError = err;
+        failIfExhausted();
+      });
+    });
+  } finally {
+    done.abort();
+    listener.close();
+  }
 }
-function isVpcScAffectedError(error) {
+var FatalLoginError = class extends Error {
+};
+function parseCallbackInput(input) {
+  const value = input.trim();
+  if (!value) return void 0;
   try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
+    return new URL(value).searchParams;
   } catch {
-    return false;
   }
+  if (/[?&]?(code|error)=/.test(value)) {
+    return new URLSearchParams(value.replace(/^.*\?/, ""));
+  }
+  return void 0;
 }
-function codeAssistHeaders(accessToken) {
-  return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/xai.ts
-var DEFAULT_CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
-var DEFAULT_ISSUER = "https://auth.x.ai";
-var DEFAULT_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
-var OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-var DEFAULT_GROK_CLI_VERSION = "1.0.67";
-var DEVICE_TIMEOUT_FALLBACK_MS = 10 * 60 * 1e3;
-var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
-function issuer() {
-  return (process.env.XAI_OAUTH_ISSUER ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-}
-function clientId() {
-  return process.env.XAI_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID2;
-}
-function grokCliBaseUrl() {
-  return (process.env.XAI_CLI_BASE_URL ?? DEFAULT_CLI_BASE_URL).replace(/\/+$/, "");
-}
-function grokCliVersion() {
-  const raw = process.env.GROK_CLI_VERSION ?? DEFAULT_GROK_CLI_VERSION;
-  const cleaned = raw.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : DEFAULT_GROK_CLI_VERSION;
-}
-function grokCliHeaders(modelId) {
-  return {
-    "X-XAI-Token-Auth": "xai-grok-cli",
-    "x-grok-client-version": grokCliVersion(),
-    "x-grok-client-identifier": "ggcoder",
-    ...modelId ? { "x-grok-model-override": modelId } : {}
-  };
-}
-function isGrokCliEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === grokCliBaseUrl() || /(^|\.)grok\.com/i.test(normalized);
+async function promptForCallback(expectedState, callbacks, signal) {
+  let message = "If the browser is on another machine (SSH/headless), paste the full callback URL here:";
+  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
+    if (signal.aborted) throw new Error("Callback already received.");
+    const raw = await callbacks.onPromptCode(message, signal);
+    if (signal.aborted) throw new Error("Callback already received.");
+    const params = parseCallbackInput(raw);
+    if (params && (params.get("code") || params.get("error"))) {
+      if (params.get("state") !== expectedState) {
+        throw new FatalLoginError("Sign-in state mismatch \u2014 start the sign-in again.");
+      }
+      return params;
+    }
+    message = "That wasn't a callback URL. Paste the full URL from the browser's address bar:";
+  }
+  throw new Error("No callback URL found in input.");
 }
-async function postForm2(endpoint, params) {
-  const response = await fetch(`${issuer()}${endpoint}`, {
+async function postForm(url, form) {
+  return fetch(url, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-      "User-Agent": `grok-cli/${grokCliVersion()}`
-    },
-    body: new URLSearchParams(params).toString(),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(form),
     signal: oauthRequestSignal()
   });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail2(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function jwtExpirySeconds(token) {
-  const payload = token.split(".")[1];
-  if (!payload) return void 0;
-  try {
-    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
-      "utf-8"
-    );
-    const claims = JSON.parse(json);
-    if (!claims || typeof claims !== "object") return void 0;
-    const exp = claims.exp;
-    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : void 0;
-  } catch {
-    return void 0;
-  }
 }
-function credsFromTokenResponse2(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Grok OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error(
-      "Grok OAuth response missing refresh_token \u2014 the offline_access scope was not granted."
-    );
+async function exchangeCode(input) {
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "authorization_code",
+    client_id: input.clientId,
+    code: input.code,
+    code_verifier: input.verifier,
+    redirect_uri: input.redirectUri,
+    resource: RESOURCE
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token exchange failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  const responseExpiresIn = Number(data.expires_in);
-  let expiresIn;
-  if (Number.isFinite(responseExpiresIn) && responseExpiresIn > 0) {
-    expiresIn = responseExpiresIn;
-  } else {
-    const exp = jwtExpirySeconds(accessToken);
-    const fromJwt = exp !== void 0 ? exp - Math.floor(Date.now() / 1e3) : 0;
-    expiresIn = fromJwt > 0 ? fromJwt : DEFAULT_TOKEN_LIFETIME_SECONDS;
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token || !data.id_token) {
+    throw new Error("ChatGPT token response is missing tokens.");
   }
   return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: grokCliBaseUrl()
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    idToken: data.id_token,
+    expiresIn: data.expires_in ?? 3600,
+    scopes: (data.scope ?? "").split(/\s+/).filter(Boolean)
   };
 }
-async function requestDeviceAuthorization2() {
-  const { status, data } = await postForm2("/oauth2/device/code", {
-    client_id: clientId(),
-    scope: OAUTH_SCOPE
+async function refreshChatGPTToken(creds) {
+  if (!creds.clientId) {
+    throw new Error("ChatGPT token refresh failed (401): no issued client ID saved");
+  }
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "refresh_token",
+    client_id: creds.clientId,
+    refresh_token: creds.refreshToken,
+    resource: RESOURCE
   });
-  if (status !== 200) {
-    throw new Error(`Grok device authorization failed (${status}): ${errorDetail2(data)}`);
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token refresh failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Grok device authorization response missing user_code/device_code.");
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token) {
+    throw new Error("ChatGPT token refresh returned no tokens.");
   }
+  const expiresIn = data.expires_in ?? 3600;
   return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5,
-    // RFC 8628 §3.2: the server states how long the device code lives. Honor it
-    // rather than imposing our own budget — polling a code we know is dead only
-    // burns requests, and a longer local window would keep a user waiting past
-    // the point the code can ever succeed.
-    expiresInMs: (Number(data.expires_in) || 0) > 0 ? Number(data.expires_in) * 1e3 : DEVICE_TIMEOUT_FALLBACK_MS
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    expiresIn,
+    ...data.id_token ? { idToken: data.id_token } : {},
+    ...data.scope ? { scopes: data.scope.split(/\s+/).filter(Boolean) } : {}
   };
 }
-async function pollDeviceToken2(deviceCode) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse2(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Grok token polling server error (${status}): ${errorDetail2(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Grok token polling failed (${status}): ${errorDetail2(data)}`);
-  }
-}
-function sleep2(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginXai(callbacks) {
-  const auth = await requestDeviceAuthorization2();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + auth.expiresInMs;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    const remaining = deadline - Date.now();
-    await sleep2(Math.min(interval * 1e3, remaining));
-    const result = await pollDeviceToken2(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Grok authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Grok device code expired. Please run login again.");
+async function revokeChatGPTSignIn(creds, options = {}) {
+  if (!creds.clientId || !creds.refreshToken) return false;
+  const attempts = options.attempts ?? 3;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      const response = await postForm(REVOKE_URL, {
+        token: creds.refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: creds.clientId
+      });
+      if (response.ok) return true;
+      if (response.status < 500) return false;
+    } catch {
     }
-    if (result.kind === "slow_down") {
-      interval += 5;
+    if (attempt < attempts - 1) {
+      await new Promise((r) => setTimeout(r, (options.backoffMs ?? 500) * 2 ** attempt));
     }
   }
-  throw new Error("Grok login timed out. Please run login again.");
-}
-async function refreshXaiToken(refreshToken) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse2(data, { fallbackRefreshToken: refreshToken });
+  return false;
+}
+function decodeSegment(segment) {
+  return JSON.parse(Buffer.from(segment, "base64url").toString("utf-8"));
+}
+async function verifyIdToken(idToken, expected) {
+  const [headerSeg, payloadSeg, signatureSeg] = idToken.split(".");
+  if (!headerSeg || !payloadSeg || !signatureSeg) throw new Error("Malformed ChatGPT ID token.");
+  const header = decodeSegment(headerSeg);
+  if (header.alg !== "RS256") throw new Error("Unexpected ChatGPT ID token algorithm.");
+  const response = await fetch(JWKS_URL, { signal: oauthRequestSignal() });
+  if (!response.ok) throw new Error(`Could not load OpenAI signing keys (${response.status}).`);
+  const { keys = [] } = await response.json();
+  const jwk = keys.find((k) => k.kid === header.kid);
+  if (!jwk) throw new Error("ChatGPT ID token is signed with an unknown key.");
+  const valid = crypto3.verify(
+    "RSA-SHA256",
+    Buffer.from(`${headerSeg}.${payloadSeg}`),
+    crypto3.createPublicKey({ key: jwk, format: "jwk" }),
+    Buffer.from(signatureSeg, "base64url")
+  );
+  if (!valid) throw new Error("ChatGPT ID token signature is invalid.");
+  const claims = decodeSegment(payloadSeg);
+  const now = Math.floor((expected.now ?? Date.now()) / 1e3);
+  const aud = claims.aud;
+  const audiences = Array.isArray(aud) ? aud : [aud];
+  if (claims.iss !== ISSUER) throw new Error("ChatGPT ID token has the wrong issuer.");
+  if (!audiences.includes(expected.clientId)) {
+    throw new Error("ChatGPT ID token was issued to another app.");
+  }
+  if (typeof claims.exp !== "number" || claims.exp + ID_TOKEN_CLOCK_SKEW_S < now) {
+    throw new Error("ChatGPT ID token has expired.");
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Grok token refresh failed (${status}): ${errorCode || errorDetail2(data)}`);
+  if (claims.nonce !== expected.nonce) throw new Error("ChatGPT ID token nonce mismatch.");
+  return claims;
 }
 
 // src/file-lock.ts
-import fs from "fs/promises";
+import fs4 from "fs/promises";
 import { setTimeout as setTimeout2 } from "timers/promises";
 var STALE_TIMEOUT_MS = 1e4;
 var RETRY_INTERVAL_MS = 50;
@@ -1164,7 +974,7 @@ async function acquireLock(lockPath) {
   while (true) {
     try {
       const info = { pid: process.pid, timestamp: Date.now() };
-      await fs.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
+      await fs4.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
       return;
     } catch (err) {
       const code = err.code;
@@ -1177,26 +987,26 @@ async function acquireLock(lockPath) {
         continue;
       }
       try {
-        const content = await fs.readFile(lockPath, "utf-8");
+        const content = await fs4.readFile(lockPath, "utf-8");
         const info = JSON.parse(content);
         const isProcessAlive = isAlive(info.pid);
         const isStale = Date.now() - info.timestamp > STALE_TIMEOUT_MS;
         if (!isProcessAlive || isStale) {
-          await fs.unlink(lockPath).catch(() => {
+          await fs4.unlink(lockPath).catch(() => {
           });
           continue;
         }
       } catch {
-        const stat = await fs.stat(lockPath).catch(() => null);
+        const stat = await fs4.stat(lockPath).catch(() => null);
         if (!stat) continue;
         if (Date.now() - stat.mtimeMs > STALE_TIMEOUT_MS) {
-          await fs.unlink(lockPath).catch(() => {
+          await fs4.unlink(lockPath).catch(() => {
           });
           continue;
         }
       }
       if (Date.now() - startTime > MAX_WAIT_MS) {
-        await fs.unlink(lockPath).catch(() => {
+        await fs4.unlink(lockPath).catch(() => {
         });
         continue;
       }
@@ -1206,14 +1016,14 @@ async function acquireLock(lockPath) {
 }
 async function lockFileExists(lockPath) {
   try {
-    await fs.stat(lockPath);
+    await fs4.stat(lockPath);
     return true;
   } catch (err) {
     return err.code !== "ENOENT";
   }
 }
 async function releaseLock(lockPath) {
-  await fs.unlink(lockPath).catch(() => {
+  await fs4.unlink(lockPath).catch(() => {
   });
 }
 function isAlive(pid) {
@@ -1227,8 +1037,8 @@ function isAlive(pid) {
 }
 
 // src/logger.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs5 from "fs";
+import path3 from "path";
 import { randomBytes } from "crypto";
 import { environmentSecrets, redactText, redactValue } from "@kenkaiiii/gg-ai";
 var MAX_BYTES = 10 * 1024 * 1024;
@@ -1245,14 +1055,14 @@ var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath, force = false) {
   try {
-    const st = fs2.statSync(filePath);
+    const st = fs5.statSync(filePath);
     if (!force && st.size <= MAX_BYTES - MIN_HEADROOM_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      fs2.unlinkSync(rotated);
+      fs5.unlinkSync(rotated);
     } catch {
     }
-    fs2.renameSync(filePath, rotated);
+    fs5.renameSync(filePath, rotated);
   } catch {
   }
 }
@@ -1260,18 +1070,18 @@ function rotateOpenLog() {
   if (fd === null || logPath === null) return false;
   const sizeBefore = fileBytes;
   try {
-    fs2.closeSync(fd);
+    fs5.closeSync(fd);
   } catch {
   }
   fd = null;
   rotateIfNeeded(logPath, true);
   try {
-    fd = fs2.openSync(logPath, "a");
-    fileBytes = fs2.fstatSync(fd).size;
+    fd = fs5.openSync(logPath, "a");
+    fileBytes = fs5.fstatSync(fd).size;
   } catch {
     if (fd !== null) {
       try {
-        fs2.closeSync(fd);
+        fs5.closeSync(fd);
       } catch {
       }
     }
@@ -1287,22 +1097,22 @@ function openLog(filePath, name) {
   appName = name;
   exactSecrets = environmentSecrets(process.env);
   try {
-    fs2.mkdirSync(path2.dirname(filePath), { recursive: true, mode: 448 });
+    fs5.mkdirSync(path3.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = fs2.openSync(filePath, "a");
+    fd = fs5.openSync(filePath, "a");
   } catch {
     fd = null;
     fileBytes = 0;
     return false;
   }
   try {
-    fileBytes = fs2.fstatSync(fd).size;
+    fileBytes = fs5.fstatSync(fd).size;
   } catch {
     try {
-      fs2.closeSync(fd);
+      fs5.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1315,7 +1125,7 @@ function openLog(filePath, name) {
   sessionId = randomBytes(4).toString("hex");
   try {
     if (fileBytes < MAX_BYTES) {
-      const written = fs2.writeSync(fd, "\n");
+      const written = fs5.writeSync(fd, "\n");
       fileBytes += written;
       processBytes += written;
     }
@@ -1350,9 +1160,9 @@ function log(level, category, message, data) {
 `;
     try {
       if (fileBytes + Buffer.byteLength(capLine) <= MAX_BYTES) {
-        fileBytes += fs2.writeSync(fd, capLine);
+        fileBytes += fs5.writeSync(fd, capLine);
       }
-      fs2.closeSync(fd);
+      fs5.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1362,7 +1172,7 @@ function log(level, category, message, data) {
   if (fileBytes + lineBytes > MAX_BYTES && !rotationFailed && !rotateOpenLog()) return;
   if (fd === null) return;
   try {
-    const written = fs2.writeSync(fd, line);
+    const written = fs5.writeSync(fd, line);
     fileBytes += written;
     processBytes += written;
   } catch {
@@ -1375,7 +1185,7 @@ function closeLogger(opts) {
   if (fd !== null) {
     if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
     try {
-      if (fd !== null) fs2.closeSync(fd);
+      if (fd !== null) fs5.closeSync(fd);
     } catch {
     }
   }
@@ -1391,7 +1201,7 @@ function closeLogger(opts) {
 }
 
 // src/hidden-providers.ts
-var HIDDEN_PROVIDERS = ["gemini"];
+var HIDDEN_PROVIDERS = [];
 function isHiddenProvider(provider) {
   return HIDDEN_PROVIDERS.includes(provider);
 }
@@ -1482,22 +1292,76 @@ async function detectXiaomiTokenPlanBaseUrl(apiKey, options = {}) {
 }
 
 // src/auth-storage.ts
-var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
-var XAI_OAUTH_KEY = "xai-oauth";
-var DUAL_AUTH_PROVIDERS = [
+var OPENAI_CHATGPT_KEY = "openai-chatgpt";
+var KIMI_CODE_KEY = "kimi-code";
+var RETIRED_SIGN_INS = [
+  {
+    provider: "anthropic",
+    storageKey: "anthropic",
+    message: "Your old Claude sign-in no longer works. Sign in with Claude again to keep using your subscription."
+  },
+  {
+    provider: "openai",
+    storageKey: "openai",
+    message: "Your old ChatGPT sign-in no longer works. Continue with ChatGPT again, or add an OpenAI API key."
+  },
   {
     provider: "moonshot",
-    oauthKey: MOONSHOT_OAUTH_KEY,
-    oauthLabel: "Kimi OAuth",
-    apiKeyLabel: "Moonshot API key",
-    restoreHint: 'Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+    storageKey: "moonshot-oauth",
+    message: "Kimi sign-in was removed. Paste a Kimi Code plan key from the Kimi Code Console, or a Moonshot API key."
   },
   {
     provider: "xai",
-    oauthKey: XAI_OAUTH_KEY,
-    oauthLabel: "Grok OAuth",
-    apiKeyLabel: "xAI API key",
-    restoreHint: 'Run "ggcoder login" and choose Grok OAuth to restore OAuth auth.'
+    storageKey: "xai-oauth",
+    message: "Grok sign-in was removed: xAI offers SuperGrok and X Premium usage only in apps it partners with. Add an xAI API key instead."
+  },
+  {
+    provider: "gemini",
+    storageKey: "gemini",
+    message: "Google sign-in was removed. Add a Gemini API key from Google AI Studio instead."
+  }
+];
+function isRetiredEntry(retired, value) {
+  if (!value) return false;
+  switch (retired.storageKey) {
+    case "anthropic":
+      return isLegacyClaudeOAuth(value);
+    // These slots now hold API keys; only a refreshable sign-in token is retired.
+    case "openai":
+    case "gemini":
+      return Boolean(value.refreshToken) || Boolean(value.accountId) || Boolean(value.projectId);
+    default:
+      return true;
+  }
+}
+function isRetiredStorageKey(data, storageKey) {
+  return RETIRED_SIGN_INS.some(
+    (r) => r.storageKey === storageKey && isRetiredEntry(r, data[storageKey])
+  );
+}
+function usableEntry(data, storageKey) {
+  return isRetiredStorageKey(data, storageKey) ? void 0 : data[storageKey];
+}
+function storageKeyProvider(storageKey) {
+  if (storageKey === OPENAI_CHATGPT_KEY) return "openai";
+  if (storageKey === KIMI_CODE_KEY) return "moonshot";
+  if (storageKey === XIAOMI_CREDITS_KEY) return "xiaomi";
+  if (storageKey === GEMINI_API_KEY) return "gemini";
+  return storageKey;
+}
+function apiKeyStorageKeys(provider) {
+  if (provider === "moonshot") return [KIMI_CODE_KEY, "moonshot"];
+  if (provider === "xiaomi") return ["xiaomi", XIAOMI_CREDITS_KEY];
+  if (provider === "gemini") return [GEMINI_API_KEY];
+  return [provider];
+}
+var DUAL_AUTH_PROVIDERS = [
+  {
+    provider: "openai",
+    oauthKey: OPENAI_CHATGPT_KEY,
+    oauthLabel: "ChatGPT plan",
+    apiKeyLabel: "OpenAI API key",
+    restoreHint: 'Run "ggcoder login" and choose Continue with ChatGPT to use your ChatGPT plan again.'
   }
 ];
 function dualAuthProvider(provider) {
@@ -1522,14 +1386,20 @@ function activeBaseUrlEntry(data, provider) {
   const dual = dualAuthProvider(provider);
   if (dual) {
     const oauth = data[dual.oauthKey];
+    const apiKey = usableEntry(data, dual.provider);
     if (oauth) {
       const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && data[dual.provider]) return data[dual.provider];
+      if (Date.now() < exhaustedUntil && apiKey) return apiKey;
       return oauth;
     }
-    return data[dual.provider];
+    return apiKey;
+  }
+  const key = apiKeyStorageKeys(provider).find((k) => usableEntry(data, k));
+  const entry = key ? data[key] : void 0;
+  if (key === KIMI_CODE_KEY && entry && !entry.baseUrl) {
+    return { ...entry, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
   }
-  return data[provider];
+  return entry;
 }
 var MINIMAX_REGION_RETRY_MS = 5 * 60 * 1e3;
 var miniMaxRegionProbes = /* @__PURE__ */ new Map();
@@ -1540,9 +1410,17 @@ function cachedMiniMaxRegion(apiKey) {
   miniMaxRegionProbes.set(apiKey, { at: Date.now(), result });
   return result;
 }
+var kimiRegionProbes = /* @__PURE__ */ new Map();
+function cachedKimiRegion(apiKey) {
+  const cached = kimiRegionProbes.get(apiKey);
+  if (cached && Date.now() - cached.at < MINIMAX_REGION_RETRY_MS) return cached.result;
+  const result = detectKimiCodeBaseUrl(apiKey).catch(() => void 0);
+  kimiRegionProbes.set(apiKey, { at: Date.now(), result });
+  return result;
+}
 function readStoredBaseUrlSync(authFile, provider) {
   try {
-    const data = JSON.parse(readFileSync2(authFile, "utf-8"));
+    const data = JSON.parse(readFileSync(authFile, "utf-8"));
     return activeBaseUrlEntry(data, provider)?.baseUrl;
   } catch {
     return void 0;
@@ -1555,19 +1433,7 @@ function refreshThresholdMs(creds) {
   return Math.max(MIN_REFRESH_THRESHOLD_MS, lifetimeMs * REFRESH_THRESHOLD_RATIO);
 }
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
-var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
-  "glm",
-  "moonshot",
-  "xiaomi",
-  "minimax",
-  "deepseek",
-  "openrouter",
-  "huggingface",
-  "sakana",
-  "xai",
-  // Local endpoints: a fixed (usually placeholder) key, never refreshable.
-  "local"
-]);
+var REFRESHABLE_STORAGE_KEYS = /* @__PURE__ */ new Set([OPENAI_CHATGPT_KEY]);
 var AuthStorage = class {
   data = {};
   filePath;
@@ -1588,10 +1454,12 @@ var AuthStorage = class {
   refreshLocks = /* @__PURE__ */ new Map();
   detectMiniMaxRegion;
   detectXiaomiCluster;
+  detectKimiRegion;
   constructor(filePath, options) {
     this.filePath = filePath ?? getAppPaths().authFile;
     this.detectMiniMaxRegion = options?.detectMiniMaxBaseUrl ?? cachedMiniMaxRegion;
     this.detectXiaomiCluster = options?.detectXiaomiTokenPlanBaseUrl ?? detectXiaomiTokenPlanBaseUrl;
+    this.detectKimiRegion = options?.detectKimiCodeBaseUrl ?? cachedKimiRegion;
   }
   /** Path to the on-disk auth file. Useful for status output. */
   get path() {
@@ -1619,27 +1487,78 @@ var AuthStorage = class {
     return keys.find((key) => Boolean(this.data[key]));
   }
   /**
-   * True if the user has any usable auth for the logical provider. For a
-   * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
-   * satisfies it.
+   * True if the user has any usable auth for the logical provider: the plan
+   * sign-in or any of its API keys. A retired sign-in doesn't count.
    */
   async hasProviderAuth(provider) {
     if (isHiddenProvider(provider)) return false;
     await this.ensureFresh();
     const dual = dualAuthProvider(provider);
     if (dual) {
-      return Boolean(this.data[dual.oauthKey] || this.data[dual.provider]);
-    }
-    if (provider === "xiaomi") {
-      return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
+      return Boolean(this.data[dual.oauthKey] || usableEntry(this.data, dual.provider));
     }
-    if (provider === "gemini") {
-      return Boolean(this.data["gemini"] || this.data[GEMINI_API_KEY]);
+    if (provider === "anthropic") {
+      return Boolean(this.data.anthropic) && !isLegacyClaudeOAuth(this.data.anthropic) || isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY]);
     }
     if (provider === "local") {
       return Object.keys(this.data).some((key) => key.startsWith(LOCAL_AUTH_KEY_PREFIX));
     }
-    return Boolean(this.data[provider]);
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /** True if any of `provider`'s API keys is stored. A retired sign-in in a key slot doesn't count. */
+  async hasApiKey(provider) {
+    await this.ensureFresh();
+    if (provider === "anthropic" && isLegacyClaudeOAuth(this.data.anthropic)) return false;
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /**
+   * `provider`'s first stored API key, never its plan sign-in. For calls that
+   * only an API key may make (OpenAI's Images API isn't on the ChatGPT plan).
+   */
+  async resolveApiKey(provider) {
+    await this.ensureFresh();
+    for (const key of apiKeyStorageKeys(provider)) {
+      const creds = usableEntry(this.data, key);
+      if (creds && !(provider === "anthropic" && isLegacyClaudeOAuth(creds))) return creds;
+    }
+    throw new NotLoggedInError(provider);
+  }
+  /** True when the user signed in with Claude through Claude Code (marker only, no token). */
+  async hasClaudeCodeLogin() {
+    await this.ensureFresh();
+    return isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY]);
+  }
+  /** Record a Claude Code sign-in. Claude Code keeps the token; auth.json gets only the marker. */
+  async setClaudeCodeLogin() {
+    await this.mutateLatest((latest) => {
+      latest[CLAUDE_CODE_AUTH_KEY] = { ...CLAUDE_CODE_AUTH_MARKER };
+      if (isLegacyClaudeOAuth(latest.anthropic)) delete latest.anthropic;
+    });
+  }
+  /** Retired sign-ins still on disk, so the UI can ask the user to reconnect. */
+  async legacySignIns() {
+    await this.ensureFresh();
+    return RETIRED_SIGN_INS.filter((r) => isRetiredEntry(r, this.data[r.storageKey]));
+  }
+  /**
+   * Remove `provider`'s retired sign-in, if any. True when one was removed, so
+   * the caller can tell the user once to reconnect.
+   */
+  async takeLegacySignIn(provider) {
+    const retired = RETIRED_SIGN_INS.find((r) => r.provider === provider);
+    if (!retired) return false;
+    await this.ensureFresh();
+    if (!isRetiredEntry(retired, this.data[retired.storageKey])) return false;
+    let removed = false;
+    await this.mutateLatest((latest) => {
+      if (!isRetiredEntry(retired, latest[retired.storageKey])) return;
+      delete latest[retired.storageKey];
+      removed = true;
+    });
+    return removed;
+  }
+  async clearClaudeCodeLogin() {
+    await this.clearCredentials(CLAUDE_CODE_AUTH_KEY);
   }
   /** Endpoint ids that currently have a `local:<id>` credential stored. */
   async listLocalEndpointIds() {
@@ -1674,18 +1593,18 @@ var AuthStorage = class {
     const oauthCreds = dual ? this.data[dual.oauthKey] : void 0;
     if (dual && oauthCreds) {
       const exhaustedUntil = oauthCreds.usageExhaustedUntil ?? 0;
-      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data[dual.provider]);
+      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(usableEntry(this.data, dual.provider));
       if (!apiKeyActive) return false;
     }
-    return STATIC_API_KEY_PROVIDERS.has(provider);
+    return !REFRESHABLE_STORAGE_KEYS.has(provider);
   }
   /**
    * The base URL on the credential that is active right now, if any.
    * Synchronous — call only after load()/resolveCredentials() populated the
-   * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
-   * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
-   * resolveCredentials would serve (i.e. not currently usage-exhausted with an
-   * API key configured).
+   * snapshot. For a dual-auth provider this is the plan endpoint whenever the
+   * sign-in is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured); for a plan/pay-per-token key
+   * split it is the plan key's endpoint when one is stored.
    */
   getStoredBaseUrl(provider) {
     return activeBaseUrlEntry(this.data, provider)?.baseUrl;
@@ -1694,7 +1613,7 @@ var AuthStorage = class {
     const first = !this.loaded;
     await withFileLock(this.filePath, async () => {
       try {
-        const content = await fs3.readFile(this.filePath, "utf-8");
+        const content = await fs6.readFile(this.filePath, "utf-8");
         this.data = JSON.parse(content);
         if (first) {
           log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
@@ -1740,7 +1659,7 @@ var AuthStorage = class {
     }
     let changed;
     try {
-      const stat = await fs3.stat(this.filePath);
+      const stat = await fs6.stat(this.filePath);
       changed = stat.ino !== this.snapshotIno || stat.mtimeMs !== this.snapshotMtimeMs || stat.size !== this.snapshotSize;
     } catch {
       changed = this.snapshotSize !== -1;
@@ -1753,7 +1672,7 @@ var AuthStorage = class {
    */
   async rememberSnapshot() {
     try {
-      const stat = await fs3.stat(this.filePath);
+      const stat = await fs6.stat(this.filePath);
       this.snapshotMtimeMs = stat.mtimeMs;
       this.snapshotSize = stat.size;
       this.snapshotIno = stat.ino;
@@ -1808,9 +1727,34 @@ var AuthStorage = class {
     });
     return { ...creds, baseUrl };
   }
-  async setCredentials(provider, creds) {
+  /**
+   * A Kimi Code key saved without an endpoint gets the host that issued it
+   * (`api.kimi.com` or `api.kimi.ai`), saved so the check runs once.
+   */
+  async withKimiRegion(creds) {
+    const baseUrl = await this.detectKimiRegion(creds.accessToken);
+    if (!baseUrl) return { ...creds, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
+    log("INFO", "auth", `Kimi Code key belongs to ${baseUrl} \u2014 saved for future requests`);
+    await this.mutateLatest((latest) => {
+      const current = latest[KIMI_CODE_KEY];
+      if (current?.accessToken === creds.accessToken && !current.baseUrl) {
+        current.baseUrl = baseUrl;
+      }
+    });
+    return { ...creds, baseUrl };
+  }
+  /**
+   * Store `creds` under `storageKey`. Connecting a provider again also removes
+   * its retired sign-in, which is what the reconnect notice asked for.
+   */
+  async setCredentials(storageKey, creds) {
+    const provider = storageKeyProvider(storageKey);
     await this.mutateLatest((latest) => {
-      latest[provider] = creds;
+      for (const retired of RETIRED_SIGN_INS) {
+        if (retired.provider !== provider || retired.storageKey === storageKey) continue;
+        if (isRetiredEntry(retired, latest[retired.storageKey])) delete latest[retired.storageKey];
+      }
+      latest[storageKey] = creds;
     });
   }
   /**
@@ -1847,9 +1791,9 @@ var AuthStorage = class {
    * Mark the credential stored under `storageKey` as usage-exhausted until
    * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
    * 15-minute default when no reset time is known. While the mark is in the
-   * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-   * instead of the subscription OAuth credential (when both are configured) — OAuth
-   * stays the preferred credential and is retried automatically once the mark
+   * future, `resolveCredentials("openai")` serves the OpenAI API key instead of
+   * the ChatGPT plan sign-in (when both are configured) — the plan stays the
+   * preferred credential and is retried automatically once the mark
    * lapses. Persisted to auth.json so a restart (or another gg-app window)
    * doesn't burn a request rediscovering the same exhausted window. No-op if
    * nothing is stored under `storageKey`.
@@ -1894,12 +1838,12 @@ var AuthStorage = class {
       await this.ensureFresh();
     }
     const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
-    if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
+    if (!directStorageKeys.some((key) => Boolean(usableEntry(this.data, key))) && !(provider === "anthropic" && this.data[CLAUDE_CODE_AUTH_KEY])) {
       await this.reloadLatest();
     }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
-        const creds2 = this.data[key];
+        const creds2 = usableEntry(this.data, key);
         if (!creds2) continue;
         if (key !== provider && dualAuthProviderByOAuthKey(key)) {
           return await this.resolveCredentials(key, {
@@ -1913,21 +1857,29 @@ var AuthStorage = class {
             ...opts.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
           });
         }
+        if (key === KIMI_CODE_KEY && !creds2.baseUrl) return await this.withKimiRegion(creds2);
         return creds2;
       }
       throw new NotLoggedInError(provider);
     }
+    if (provider === "anthropic" && (!this.data.anthropic || isLegacyClaudeOAuth(this.data.anthropic))) {
+      if (isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY])) {
+        return { accessToken: "", refreshToken: "", expiresAt: Number.MAX_SAFE_INTEGER };
+      }
+      if (this.data.anthropic) throw new NotLoggedInError(provider);
+    }
     const dual = dualAuthProvider(provider);
     const dualOAuthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    const dualApiKey = dual ? usableEntry(this.data, dual.provider) : void 0;
     if (dual && dualOAuthCreds) {
       const exhaustedUntil = dualOAuthCreds.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && this.data[dual.provider]) {
+      if (Date.now() < exhaustedUntil && dualApiKey) {
         log(
           "WARN",
           "auth",
           `${dual.oauthLabel} usage window is exhausted \u2014 using the ${dual.apiKeyLabel} until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
         );
-        return this.data[dual.provider];
+        return dualApiKey;
       }
       try {
         return await this.resolveCredentials(dual.oauthKey, {
@@ -1935,23 +1887,24 @@ var AuthStorage = class {
           ...opts?.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
         });
       } catch (err) {
-        if (err instanceof NotLoggedInError && this.data[dual.provider]) {
+        if (err instanceof NotLoggedInError && dualApiKey) {
           log(
             "WARN",
             "auth",
             `${dual.oauthLabel} credential is no longer valid \u2014 falling back to the ${dual.apiKeyLabel}. ${dual.restoreHint}`
           );
-          return this.data[dual.provider];
+          return dualApiKey;
         }
         throw err;
       }
     }
-    const creds = this.data[provider];
+    const creds = usableEntry(this.data, provider);
     if (!creds) {
       throw new NotLoggedInError(provider);
     }
-    if (STATIC_API_KEY_PROVIDERS.has(provider)) {
+    if (!REFRESHABLE_STORAGE_KEYS.has(provider)) {
       if (provider === "minimax" && !creds.baseUrl) return await this.withMiniMaxRegion(creds);
+      if (provider === KIMI_CODE_KEY && !creds.baseUrl) return await this.withKimiRegion(creds);
       return creds;
     }
     if (!opts?.forceRefresh && Date.now() < creds.expiresAt - refreshThresholdMs(creds)) {
@@ -1979,13 +1932,14 @@ var AuthStorage = class {
         this.data = latest;
         return latestCreds;
       }
-      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : provider === XAI_OAUTH_KEY ? refreshXaiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(latestCreds.refreshToken);
+        refreshed = await refreshChatGPTToken(latestCreds);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
+        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh|token_expired|refresh_token_(?:expired|invalidated|reused)/i.test(
+          msg
+        ) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
           const current = await readAuthData(this.filePath);
           const currentCreds = current[provider];
@@ -2005,15 +1959,10 @@ var AuthStorage = class {
         }
         throw err;
       }
-      if (!refreshed.accountId && latestCreds.accountId) {
-        refreshed.accountId = latestCreds.accountId;
-      }
-      if (!refreshed.projectId && latestCreds.projectId) {
-        refreshed.projectId = latestCreds.projectId;
-      }
-      if (!refreshed.baseUrl && latestCreds.baseUrl) {
-        refreshed.baseUrl = latestCreds.baseUrl;
-      }
+      refreshed = {
+        ...pick(latestCreds, ["accountId", "baseUrl", "clientId", "idToken", "scopes"]),
+        ...refreshed
+      };
       latest[provider] = refreshed;
       this.data = latest;
       await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
@@ -2036,9 +1985,14 @@ var AuthStorage = class {
     return creds.accessToken;
   }
 };
+function pick(value, keys) {
+  const out = {};
+  for (const key of keys) if (value[key] !== void 0) out[key] = value[key];
+  return out;
+}
 async function readAuthData(filePath) {
   try {
-    const content = await fs3.readFile(filePath, "utf-8");
+    const content = await fs6.readFile(filePath, "utf-8");
     return JSON.parse(content);
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -2046,12 +2000,12 @@ async function readAuthData(filePath) {
   }
 }
 async function atomicWriteFile(filePath, content) {
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto5.randomUUID().slice(0, 8)}.tmp`;
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto4.randomUUID().slice(0, 8)}.tmp`;
   try {
-    await fs3.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await fs3.rename(tmpPath, filePath);
+    await fs6.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await fs6.rename(tmpPath, filePath);
   } catch (err) {
-    await fs3.unlink(tmpPath).catch(() => {
+    await fs6.unlink(tmpPath).catch(() => {
     });
     throw err;
   }
@@ -2083,7 +2037,8 @@ var CODEX_FAST_BILLING = {
   detail: "Codex Fast mode uses your ChatGPT plan limits at 2.5x the standard rate (purchased credits at 2x).",
   paid: false
 };
-var GEMINI_AUTH_KEYS = [GEMINI_API_KEY, "gemini"];
+var GEMINI_AUTH_KEYS = [GEMINI_API_KEY];
+var KIMI_AUTH_KEYS = [KIMI_CODE_KEY, "moonshot"];
 var MODELS = [
   // ── Anthropic ──────────────────────────────────────────
   // NOTE: Claude Mythos 5.1 (`claude-mythos-5-1`, 2026-09-01) is kept commented
@@ -2213,14 +2168,13 @@ var MODELS = [
   {
     // GPT-6 Astra — "Our most capable model for complex, demanding work."
     // (Codex catalog priority 2, listed for every ChatGPT plan, requires a
-    // Codex client >= 0.153.0 — see CODEX_CLIENT_VERSION). Same split as 5.6:
-    // 1.05M on the public Responses API, 272K on the ChatGPT OAuth route
+    // Codex client >= 0.153.0). Same split as 5.6:
+    // 1.05M on the public Responses API, 272K on the ChatGPT plan route
     // (openai/codex models.json, `gpt-6-astra`). Reasoning ladder low → medium
     // → high → xhigh → max → ultra; `ultra` is the Codex orchestration preset
     // (multi_agent v2) and is Codex-only — the public API tops out at `max`.
-    // Note: through a plain API key OpenAI requires the Responses API for tool
-    // calling on Astra, so the Chat Completions path is text-only; the OAuth
-    // Codex route is the supported way to use it as an agent.
+    // OpenAI requires the Responses API for tool calling on Astra, so both
+    // the ChatGPT plan and API keys ride gg-ai's Responses transport.
     id: "gpt-6-astra",
     name: "GPT-6 Astra",
     provider: "openai",
@@ -2254,18 +2208,16 @@ var MODELS = [
     billing: CODEX_FAST_BILLING
   },
   // GPT-6 Sol + Luna — released 2026-09-22 below Astra, replacing the whole
-  // GPT-5.6 family (Sol/Terra/Luna; there is no GPT-6 Terra — OpenAI's Codex
+  // GPT-5.6 family (Sol/Terra/Luna; there was no GPT-6 Terra — OpenAI's Codex
   // catalog upgrades 5.6 Terra to 6 Sol). GPT-6.1 Sol (2026-09-29) then replaced
-  // GPT-6 Sol. Same window split as Astra: 1.05M on the public Responses API,
+  // GPT-6 Sol, and GPT-6.1 Terra (2026-10-26) sits between Sol and Luna. Same window split as Astra: 1.05M on the public Responses API,
   // 272K on the Codex route; 128K output, text+image input, freeform
   // apply_patch, responses-lite transport. The GPT-5.6 ids and `gpt-6-sol` are
   // retired — a saved session on one falls back to the provider default on
   // next start.
   {
     // GPT-6.1 Sol — "Latest workhorse model for coding and everyday work."
-    // (Codex priority 1, default low). The catalog says Codex client >= 0.153.0,
-    // but the ChatGPT backend only serves it from 0.159.0 (see
-    // CODEX_CLIENT_VERSION). $2/$10 MTok, cached input $0.10. Ladder low →
+    // (Codex priority 1, default low). $2/$10 MTok, cached input $0.10. Ladder low →
     // medium → high → xhigh → max → ultra; ultra is the Codex orchestration
     // preset (xhigh effort on the wire + proactive local subagent delegation).
     id: "gpt-6.1-sol",
@@ -2298,6 +2250,40 @@ var MODELS = [
     maxThinkingLevel: "ultra",
     billing: CODEX_FAST_BILLING
   },
+  {
+    // GPT-6.1 Terra (Codex priority 7, default low, client >= 0.153.0). $1/$5
+    // MTok, cached input $0.05. Unlike Sol/Astra the Codex route gets a 500K
+    // window (catalog `context_window`). Same ladder and Ultra preset as Sol.
+    id: "gpt-6.1-terra",
+    name: "GPT-6.1 Terra",
+    provider: "openai",
+    contextWindow: 105e4,
+    codexContextWindow: 5e5,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    defaultThinkingLevel: "low",
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "ultra"
+  },
+  {
+    // Codex Fast mode for 6.1 Terra ("1.5x speed") — see `gpt-6-astra-fast`
+    // for the wire mapping and billing.
+    id: "gpt-6.1-terra-fast",
+    name: "GPT-6.1 Terra Fast",
+    provider: "openai",
+    contextWindow: 105e4,
+    codexContextWindow: 5e5,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    defaultThinkingLevel: "low",
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "ultra",
+    billing: CODEX_FAST_BILLING
+  },
   {
     // Luna — "Fast and affordable model for easier tasks." (Codex priority 4,
     // default medium, needs a Codex client >= 0.155.0). $0.10/$0.50 MTok.
@@ -2418,8 +2404,8 @@ var MODELS = [
     maxThinkingLevel: "high",
     authStorageKeys: GEMINI_AUTH_KEYS
   },
-  // Keep 3.1 Flash Lite first for the working OAuth default and fast-model routing.
-  // New GA models are opt-in; Code Assist access varies by account. Gemini 3.7
+  // Keep 3.1 Flash Lite first for the default and fast-model routing.
+  // Gemini 3.7
   // Flash is retired: Google deprecated it on 2026-10-08 and routes every
   // `gemini-3.7-flash` request to 3.8 Flash (ai.google.dev/gemini-api/docs/
   // changelog), so a saved session on it falls back to the provider default.
@@ -2452,9 +2438,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Wire name `gemini-3-flash` — the Code Assist (OAuth) backend rejects the
-    // display string `gemini-3.5-flash` with a 404, so gemini-cli keeps this
-    // alternative name (SECONDARY_GEMINI_3_5_FLASH_MODEL) for that endpoint.
+    // Wire name `gemini-3-flash`, the id Google serves 3.5 Flash under.
     id: "gemini-3-flash",
     name: "Gemini 3.5 Flash",
     provider: "gemini",
@@ -2469,9 +2453,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Gemini 3.1 Pro is public preview — gated behind Code Assist preview
-    // enablement, so free/personal OAuth accounts 404 on it (see
-    // ACCOUNT_GATED_MODELS in gg-ai's gemini provider).
+    // Gemini 3.1 Pro is public preview.
     id: "gemini-3.1-pro-preview",
     name: "Gemini 3.1 Pro (Preview)",
     provider: "gemini",
@@ -2488,8 +2470,8 @@ var MODELS = [
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
   // work, and deep reasoning. Its effort ladder is server-declared as
-  // low/high/max on both the public API (default max) and the Kimi For Coding
-  // OAuth endpoint (default high); thinking can also be fully disabled.
+  // low/high/max on both the public API (default max) and the Kimi Code plan
+  // endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -2503,13 +2485,14 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "high",
-    maxThinkingLevel: "max"
+    maxThinkingLevel: "max",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
-  // K2.8 Preview (2026-09-11) is served only on the Kimi For Coding OAuth
-  // endpoint, under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
+  // K2.8 Preview (2026-09-11) is served only on the Kimi Code plan endpoint,
+  // under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
   // display_name "K2.8 Preview", 1M context, image + video input, efforts
-  // low/high/max default max). The public API-key endpoint does not serve it,
-  // so it resolves from the Kimi sign-in credential only.
+  // low/high/max default max). The public Moonshot API does not serve it, so
+  // it resolves from a Kimi Code plan key only.
   {
     id: "kimi-for-coding",
     name: "Kimi K2.8 Preview",
@@ -2522,7 +2505,7 @@ var MODELS = [
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
     maxThinkingLevel: "max",
-    authStorageKeys: [MOONSHOT_OAUTH_KEY]
+    authStorageKeys: [KIMI_CODE_KEY]
   },
   // K2.7 Code is requested by its pinned id (not the `kimi-for-coding` alias
   // that moved to K2.8), so it stays the real K2.7 on both endpoints.
@@ -2537,7 +2520,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // K2.7 Code HighSpeed — the same model as K2.7 Code served at ~180 tok/s
   // (up to ~260 on short contexts), 256K context (platform.kimi.ai model list,
@@ -2556,7 +2540,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // ── Z.AI (GLM) ─────────────────────────────────────────
   // Two GLM entries, both live on the coding endpoint (verified against its
@@ -2969,26 +2954,40 @@ function getSummaryModel(provider, currentModelId) {
 }
 
 export {
-  kimiCodeBaseUrl,
-  kimiCodingHeaders,
+  KIMI_CODE_DEFAULT_BASE_URL,
+  KIMI_CODE_OVERSEAS_BASE_URL,
+  detectKimiCodeBaseUrl,
   isKimiCodingEndpoint,
-  loginKimi,
-  refreshKimiToken,
+  CLAUDE_CODE_MANIFEST,
+  CLAUDE_CODE_AUTH_KEY,
+  CLAUDE_CODE_AUTH_MARKER,
+  isClaudeCodeAuthMarker,
+  isLegacyClaudeOAuth,
+  claudeCodePlatformKey,
+  claudeCodeHome,
+  claudeCodeConfigDir,
+  claudeCodeBinaryPath,
+  resolveClaudeCodeBinary,
+  ensureClaudeCodeBinary,
+  formatClaudeCodeInstallProgress,
+  claudeCodeEnv,
+  claudeCodeAuthStatus,
+  logoutClaudeCode,
+  claudeCodeCallbackUrl,
+  loginClaudeCode,
   generatePKCE,
-  getClaudeCodeVersion,
-  getClaudeCliUserAgent,
-  pendingClaudeCodeVersionRefresh,
-  loginAnthropic,
-  refreshAnthropicToken,
-  loginOpenAI,
-  refreshOpenAIToken,
-  loginGemini,
-  refreshGeminiToken,
-  grokCliBaseUrl,
-  grokCliHeaders,
-  isGrokCliEndpoint,
-  loginXai,
-  refreshXaiToken,
+  CHATGPT_PLAN_SCOPE,
+  CHATGPT_PLAN_BASE_URL,
+  CHATGPT_USAGE_URL,
+  CHATGPT_PLAN_NOT_ENABLED_MESSAGE,
+  ChatGPTPlanNotEnabledError,
+  getChatGPTHostId,
+  loginChatGPT,
+  fetchChatGPTPlanModels,
+  parseCallbackInput,
+  refreshChatGPTToken,
+  revokeChatGPTSignIn,
+  verifyIdToken,
   withFileLock,
   openLog,
   getSessionId,
@@ -3003,8 +3002,11 @@ export {
   detectMiniMaxBaseUrl,
   XIAOMI_TOKEN_PLAN_BASE_URLS,
   detectXiaomiTokenPlanBaseUrl,
-  MOONSHOT_OAUTH_KEY,
-  XAI_OAUTH_KEY,
+  OPENAI_CHATGPT_KEY,
+  KIMI_CODE_KEY,
+  RETIRED_SIGN_INS,
+  storageKeyProvider,
+  apiKeyStorageKeys,
   dualAuthProvider,
   dualAuthProviderByOAuthKey,
   oauthStorageKey,
@@ -3039,4 +3041,4 @@ export {
   getDefaultThinkingLevel,
   getSummaryModel
 };
-//# sourceMappingURL=chunk-SDUIKPGO.js.map
+//# sourceMappingURL=chunk-J7W5HS6X.js.map