@kenkaiiii/gg-core 5.93.0 → 5.95.0

package/dist/index.cjs

@@ -32,34 +32,55 @@ var index_exports = {};
 __export(index_exports, {
   AUTH_PROVIDERS: () => AUTH_PROVIDERS,
   AuthStorage: () => AuthStorage,
+  CHATGPT_PLAN_BASE_URL: () => CHATGPT_PLAN_BASE_URL,
+  CHATGPT_PLAN_NOT_ENABLED_MESSAGE: () => CHATGPT_PLAN_NOT_ENABLED_MESSAGE,
+  CHATGPT_PLAN_SCOPE: () => CHATGPT_PLAN_SCOPE,
+  CHATGPT_USAGE_URL: () => CHATGPT_USAGE_URL,
+  CLAUDE_CODE_AUTH_KEY: () => CLAUDE_CODE_AUTH_KEY,
+  CLAUDE_CODE_AUTH_MARKER: () => CLAUDE_CODE_AUTH_MARKER,
+  CLAUDE_CODE_MANIFEST: () => CLAUDE_CODE_MANIFEST,
+  ChatGPTPlanNotEnabledError: () => ChatGPTPlanNotEnabledError,
   DEFAULT_LOCAL_ENDPOINTS: () => DEFAULT_LOCAL_ENDPOINTS,
   DEFAULT_MAX_VIDEO_BYTES: () => DEFAULT_MAX_VIDEO_BYTES,
   FALLBACK_CONTEXT_WINDOW: () => FALLBACK_CONTEXT_WINDOW,
   GEMINI_API_KEY: () => GEMINI_API_KEY,
   GEMINI_API_KEY_BASE_URL: () => GEMINI_API_KEY_BASE_URL,
   HIDDEN_PROVIDERS: () => HIDDEN_PROVIDERS,
+  KIMI_CODE_DEFAULT_BASE_URL: () => KIMI_CODE_DEFAULT_BASE_URL,
+  KIMI_CODE_KEY: () => KIMI_CODE_KEY,
+  KIMI_CODE_OVERSEAS_BASE_URL: () => KIMI_CODE_OVERSEAS_BASE_URL,
   LOCAL_API_KEY_PLACEHOLDER: () => LOCAL_API_KEY_PLACEHOLDER,
   LOCAL_AUTH_KEY_PREFIX: () => LOCAL_AUTH_KEY_PREFIX,
   MINIMAX_CN_BASE_URL: () => MINIMAX_CN_BASE_URL,
   MINIMAX_GLOBAL_BASE_URL: () => MINIMAX_GLOBAL_BASE_URL,
   MODELS: () => MODELS,
-  MOONSHOT_OAUTH_KEY: () => MOONSHOT_OAUTH_KEY,
   NotLoggedInError: () => NotLoggedInError,
+  OPENAI_CHATGPT_KEY: () => OPENAI_CHATGPT_KEY,
   OPENROUTER_DEFAULT_BASE_URL: () => OPENROUTER_DEFAULT_BASE_URL,
   PLAN_MODE_THINKING_CAP: () => PLAN_MODE_THINKING_CAP,
+  RETIRED_SIGN_INS: () => RETIRED_SIGN_INS,
   SubscriptionUsageError: () => SubscriptionUsageError,
   TelegramBot: () => TelegramBot,
-  XAI_OAUTH_KEY: () => XAI_OAUTH_KEY,
   XIAOMI_CREDITS_KEY: () => XIAOMI_CREDITS_KEY,
   XIAOMI_TOKEN_PLAN_BASE_URLS: () => XIAOMI_TOKEN_PLAN_BASE_URLS,
+  apiKeyStorageKeys: () => apiKeyStorageKeys,
   authPriorityNote: () => authPriorityNote,
   clampThinkingForPlanMode: () => clampThinkingForPlanMode,
+  claudeCodeAuthStatus: () => claudeCodeAuthStatus,
+  claudeCodeBinaryPath: () => claudeCodeBinaryPath,
+  claudeCodeCallbackUrl: () => claudeCodeCallbackUrl,
+  claudeCodeConfigDir: () => claudeCodeConfigDir,
+  claudeCodeEnv: () => claudeCodeEnv,
+  claudeCodeHome: () => claudeCodeHome,
+  claudeCodePlatformKey: () => claudeCodePlatformKey,
+  clearClaudeCodeUsage: () => clearClaudeCodeUsage,
   clearLocalDiscoveryCache: () => clearLocalDiscoveryCache,
   clearRuntimeModels: () => clearRuntimeModels,
   closeLogger: () => closeLogger,
   createAutoUpdater: () => createAutoUpdater,
   decodeOggOpus: () => decodeOggOpus,
   describeAuthMethods: () => describeAuthMethods,
+  detectKimiCodeBaseUrl: () => detectKimiCodeBaseUrl,
   detectMiniMaxBaseUrl: () => detectMiniMaxBaseUrl,
   detectXiaomiTokenPlanBaseUrl: () => detectXiaomiTokenPlanBaseUrl,
   discoverLocalModels: () => discoverLocalModels,
@@ -67,8 +88,11 @@ __export(index_exports, {
   dualAuthProvider: () => dualAuthProvider,
   dualAuthProviderByOAuthKey: () => dualAuthProviderByOAuthKey,
   endpointRoot: () => endpointRoot,
+  ensureClaudeCodeBinary: () => ensureClaudeCodeBinary,
+  fetchChatGPTPlanModels: () => fetchChatGPTPlanModels,
   fetchSubscriptionUsage: () => fetchSubscriptionUsage,
   findProbedModel: () => findProbedModel,
+  formatClaudeCodeInstallProgress: () => formatClaudeCodeInstallProgress,
   formatLocalModelId: () => formatLocalModelId,
   generatePKCE: () => generatePKCE,
   getAllModels: () => getAllModels,
@@ -76,8 +100,7 @@ __export(index_exports, {
   getAuthProvider: () => getAuthProvider,
   getAuthStorageKey: () => getAuthStorageKey,
   getAuthStorageKeys: () => getAuthStorageKeys,
-  getClaudeCliUserAgent: () => import_gg_ai.getClaudeCliUserAgent,
-  getClaudeCodeVersion: () => import_gg_ai.getClaudeCodeVersion,
+  getChatGPTHostId: () => getChatGPTHostId,
   getContextWindow: () => getContextWindow,
   getDefaultModel: () => getDefaultModel,
   getDefaultThinkingLevel: () => getDefaultThinkingLevel,
@@ -93,59 +116,90 @@ __export(index_exports, {
   getSupportedThinkingLevels: () => getSupportedThinkingLevels,
   getToolResultCharLimit: () => getToolResultCharLimit,
   getVideoByteLimit: () => getVideoByteLimit,
-  grokCliBaseUrl: () => grokCliBaseUrl,
-  grokCliHeaders: () => grokCliHeaders,
-  isGrokCliEndpoint: () => isGrokCliEndpoint,
+  isClaudeCodeAuthMarker: () => isClaudeCodeAuthMarker,
   isHiddenProvider: () => isHiddenProvider,
   isKimiCodingEndpoint: () => isKimiCodingEndpoint,
+  isLegacyClaudeOAuth: () => isLegacyClaudeOAuth,
   isLocalModelId: () => isLocalModelId,
   isLoggerOpen: () => isLoggerOpen,
   isModelLoaded: () => isModelLoaded,
   isPaidModel: () => isPaidModel,
   isThinkingLevelSupported: () => isThinkingLevelSupported,
-  kimiCodeBaseUrl: () => kimiCodeBaseUrl,
-  kimiCodingHeaders: () => kimiCodingHeaders,
   localAuthStorageKey: () => localAuthStorageKey,
   localModelShortName: () => localModelShortName,
   log: () => log,
-  loginAnthropic: () => loginAnthropic,
-  loginGemini: () => loginGemini,
-  loginKimi: () => loginKimi,
-  loginOpenAI: () => loginOpenAI,
-  loginXai: () => loginXai,
+  loginChatGPT: () => loginChatGPT,
+  loginClaudeCode: () => loginClaudeCode,
+  logoutClaudeCode: () => logoutClaudeCode,
+  mergeClaudeCodeRateLimit: () => mergeClaudeCodeRateLimit,
   oauthStorageKey: () => oauthStorageKey,
   ollamaServedContext: () => ollamaServedContext,
   openLog: () => openLog,
+  parseCallbackInput: () => parseCallbackInput,
   parseLocalModelId: () => parseLocalModelId,
   parseOpenRouterCatalog: () => parseOpenRouterCatalog,
-  pendingClaudeCodeVersionRefresh: () => import_gg_ai.pendingClaudeCodeVersionRefresh,
   probeEndpoint: () => probeEndpoint,
   providerStorageKeys: () => providerStorageKeys,
+  readClaudeCodeUsage: () => readClaudeCodeUsage,
   readStoredBaseUrlSync: () => readStoredBaseUrlSync,
-  refreshAnthropicToken: () => refreshAnthropicToken,
-  refreshGeminiToken: () => refreshGeminiToken,
-  refreshKimiToken: () => refreshKimiToken,
-  refreshOpenAIToken: () => refreshOpenAIToken,
-  refreshXaiToken: () => refreshXaiToken,
+  recordClaudeCodeRateLimit: () => recordClaudeCodeRateLimit,
+  refreshChatGPTToken: () => refreshChatGPTToken,
   registerLogCleanup: () => registerLogCleanup,
   registerRuntimeModels: () => registerRuntimeModels,
+  requiredKeyLabel: () => requiredKeyLabel,
   resample: () => resample,
+  resolveClaudeCodeBinary: () => resolveClaudeCodeBinary,
+  revokeChatGPTSignIn: () => revokeChatGPTSignIn,
   setProgressCallback: () => setProgressCallback,
   setProviderCatalog: () => setProviderCatalog,
+  signInWithClaudeCode: () => signInWithClaudeCode,
+  signOutOfClaudeCode: () => signOutOfClaudeCode,
+  storageKeyProvider: () => storageKeyProvider,
   toModelInfo: () => toModelInfo,
   transcribeVoice: () => transcribeVoice,
   usesOpenAICodexTransport: () => usesOpenAICodexTransport,
+  verifyIdToken: () => verifyIdToken,
   withFileLock: () => withFileLock,
   withoutPaidTier: () => withoutPaidTier
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/oauth/kimi.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto = require("crypto");
-var import_node_fs = require("fs");
-var import_node_os2 = require("os");
-var import_node_path2 = __toESM(require("path"), 1);
+// src/kimi-region.ts
+var import_gg_ai = require("@kenkaiiii/gg-ai");
+var KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_CODE_OVERSEAS_BASE_URL = "https://api.kimi.ai/coding/v1";
+var KIMI_CODE_BASE_URLS = [KIMI_CODE_DEFAULT_BASE_URL, KIMI_CODE_OVERSEAS_BASE_URL];
+async function probeHost(baseUrl, apiKey, fetchImpl, timeoutMs) {
+  try {
+    const res = await fetchImpl(`${baseUrl}/models`, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": import_gg_ai.GG_CODER_USER_AGENT },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (res.ok) return "authorized";
+    if (res.status === 401 || res.status === 403) return "unauthorized";
+    return "inconclusive";
+  } catch {
+    return "inconclusive";
+  }
+}
+async function detectKimiCodeBaseUrl(apiKey, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const results = await Promise.all(
+    KIMI_CODE_BASE_URLS.map((url) => probeHost(url, apiKey, fetchImpl, timeoutMs))
+  );
+  const index = results.indexOf("authorized");
+  return index === -1 ? void 0 : KIMI_CODE_BASE_URLS[index];
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  return /^https:\/\/api\.kimi\.(com|ai)\/coding(\/|$)/i.test(baseUrl);
+}
+
+// src/auth-storage.ts
+var import_promises6 = __toESM(require("fs/promises"), 1);
+var import_node_fs4 = require("fs");
+var import_node_crypto4 = __toESM(require("crypto"), 1);
 
 // src/paths.ts
 var import_node_path = __toESM(require("path"), 1);
@@ -170,237 +224,519 @@ function getAppPaths() {
     agentsDir: import_node_path.default.join(agentDir, "agents"),
     progressFile: import_node_path.default.join(agentDir, "progress.json"),
     progressBackupFile: import_node_path.default.join(agentDir, "progress.backup.json"),
-    trophiesFile: import_node_path.default.join(agentDir, "trophies.json")
+    trophiesFile: import_node_path.default.join(agentDir, "trophies.json"),
+    claudeCodeDir: import_node_path.default.join(agentDir, "claude-code"),
+    claudeCodeConfigDir: import_node_path.default.join(agentDir, "claude-code", "config")
   };
 }
 
-// src/oauth/request-timeout.ts
-var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
-function oauthRequestSignal() {
-  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
-}
+// src/claude-code/runtime.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto = __toESM(require("crypto"), 1);
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_promises2 = __toESM(require("fs/promises"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
 
-// src/oauth/kimi.ts
-var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
+// src/claude-code/tar.ts
+var import_node_fs = __toESM(require("fs"), 1);
+var import_promises = __toESM(require("fs/promises"), 1);
+var import_node_zlib = __toESM(require("zlib"), 1);
+var BLOCK = 512;
+function readString(buf, offset, length) {
+  const end = buf.indexOf(0, offset);
+  return buf.toString("utf8", offset, end === -1 || end > offset + length ? offset + length : end);
+}
+function readSize(buf, offset) {
+  if (buf[offset] & 128) {
+    let value = buf[offset] & 127;
+    for (let i = 1; i < 12; i++) value = value * 256 + buf[offset + i];
+    return value;
+  }
+  const text = readString(buf, offset, 12).trim();
+  return text ? parseInt(text, 8) : 0;
+}
+function paxPath(data) {
+  let pos = 0;
+  while (pos < data.length) {
+    const space = data.indexOf(32, pos);
+    if (space === -1) break;
+    const len = parseInt(data.toString("utf8", pos, space), 10);
+    if (!Number.isFinite(len) || len <= 0) break;
+    const record = data.toString("utf8", space + 1, pos + len - 1);
+    const eq = record.indexOf("=");
+    if (eq !== -1 && record.slice(0, eq) === "path") return record.slice(eq + 1);
+    pos += len;
   }
+  return void 0;
 }
-function deviceModel() {
-  const os2 = (0, import_node_os2.type)();
-  const version = (0, import_node_os2.release)();
-  const osArch = (0, import_node_os2.arch)();
-  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os2} ${version} ${osArch}`.trim();
+async function extractFileFromTarGz(tgzPath, entryName, destPath) {
+  const input = import_node_fs.default.createReadStream(tgzPath).pipe(import_node_zlib.default.createGunzip());
+  let pending = Buffer.alloc(0);
+  let remaining = 0;
+  let padding = 0;
+  let kind = "skip";
+  let meta = [];
+  let overridePath;
+  let out;
+  let found = false;
+  try {
+    for await (const chunk of input) {
+      pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+      let pos = 0;
+      while (pos < pending.length) {
+        if (remaining > 0) {
+          const take = Math.min(remaining, pending.length - pos);
+          const slice = pending.subarray(pos, pos + take);
+          if (kind === "target") await out.write(slice);
+          else if (kind === "pax" || kind === "longname") meta.push(Buffer.from(slice));
+          pos += take;
+          remaining -= take;
+          if (remaining === 0) {
+            if (kind === "target") {
+              await out.close();
+              out = void 0;
+              found = true;
+            } else if (kind === "pax") {
+              overridePath = paxPath(Buffer.concat(meta)) ?? overridePath;
+            } else if (kind === "longname") {
+              overridePath = readString(Buffer.concat(meta), 0, Number.MAX_SAFE_INTEGER);
+            }
+          }
+          continue;
+        }
+        if (padding > 0) {
+          const skip = Math.min(padding, pending.length - pos);
+          pos += skip;
+          padding -= skip;
+          continue;
+        }
+        if (found) break;
+        if (pending.length - pos < BLOCK) break;
+        const header = pending.subarray(pos, pos + BLOCK);
+        pos += BLOCK;
+        if (header.every((b) => b === 0)) continue;
+        const size = readSize(header, 124);
+        const type = String.fromCharCode(header[156] || 48);
+        let name = readString(header, 0, 100);
+        if (readString(header, 257, 6) === "ustar") {
+          const prefix = readString(header, 345, 155);
+          if (prefix) name = `${prefix}/${name}`;
+        }
+        remaining = size;
+        padding = (BLOCK - size % BLOCK) % BLOCK;
+        meta = [];
+        if (type === "x") kind = "pax";
+        else if (type === "L") kind = "longname";
+        else {
+          const path7 = overridePath ?? name;
+          overridePath = void 0;
+          if ((type === "0" || type === "\0" || type === "7") && path7 === entryName) {
+            kind = "target";
+            out = await import_promises.default.open(destPath, "w", 493);
+            if (size === 0) {
+              await out.close();
+              out = void 0;
+              found = true;
+            }
+          } else {
+            kind = "skip";
+          }
+        }
+      }
+      pending = pos < pending.length ? Buffer.from(pending.subarray(pos)) : Buffer.alloc(0);
+      if (found) break;
+    }
+    if (!found && out) throw new Error(`Archive ended inside ${entryName}`);
+    return found;
+  } finally {
+    if (out) await out.close().catch(() => {
+    });
+    input.destroy();
+  }
 }
-function deviceId() {
-  const idPath = import_node_path2.default.join(getAppPaths().agentDir, "kimi_device_id");
-  if ((0, import_node_fs.existsSync)(idPath)) {
-    try {
-      const text = (0, import_node_fs.readFileSync)(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
+
+// src/claude-code/manifest.json
+var manifest_default = {
+  sdkVersion: "0.3.318",
+  claudeCodeVersion: "2.1.318",
+  platforms: {
+    "darwin-arm64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-arm64/-/claude-agent-sdk-darwin-arm64-0.3.318.tgz",
+      integrity: "sha512-AWoXeDXzAMD3RaA21lWuHvCrKd8xmbTTmKjovninn4j07jheoVSMzFbCFjpp4kk5TdhT36JtWPkAxvjNMbcO8w==",
+      bin: "claude"
+    },
+    "darwin-x64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-darwin-x64/-/claude-agent-sdk-darwin-x64-0.3.318.tgz",
+      integrity: "sha512-6CkZ5PCdebSY/LePp16sf/HYRtM6zVuxtn8qYICFS5KUZFsjccJJ9swVsOdHXNHi4SWZcSmIFTwoUbfFCzisRw==",
+      bin: "claude"
+    },
+    "linux-arm64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64/-/claude-agent-sdk-linux-arm64-0.3.318.tgz",
+      integrity: "sha512-mBm4su17aMitLBBCQj3bHdejyUDY6z/ormGih+HG24N689RSbdKECjGjkT87tDBIR/4jyoqmuSeHqM1DI8TJlg==",
+      bin: "claude"
+    },
+    "linux-arm64-musl": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-arm64-musl/-/claude-agent-sdk-linux-arm64-musl-0.3.318.tgz",
+      integrity: "sha512-l4LSYFOrvlYCrUImGfxMTQ0wg+T3s9CBhrBvPF/0oJGKZg+QnxHHU8jUVm9e9/xYmDRTtqFIrr4id/5AfH4XGw==",
+      bin: "claude"
+    },
+    "linux-x64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64/-/claude-agent-sdk-linux-x64-0.3.318.tgz",
+      integrity: "sha512-+mE+ueBD3oRFdaG16rd0h+LMjdeivGxL0pr/+FZK7JeLWVu+yPSw/f/X02b9oK36/DWykiFTu2G6HnJ9/+YO6w==",
+      bin: "claude"
+    },
+    "linux-x64-musl": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-linux-x64-musl/-/claude-agent-sdk-linux-x64-musl-0.3.318.tgz",
+      integrity: "sha512-SAF3lj/2OzTU84p+OOA13QEKA9+5fYAw0M9E7AJjdnRmVFGqQfbV7Do1i1f9Sj0mIubB3rLTRphGRw8O4HZjgA==",
+      bin: "claude"
+    },
+    "win32-arm64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-arm64/-/claude-agent-sdk-win32-arm64-0.3.318.tgz",
+      integrity: "sha512-19iVSZ4379QbZU1XnGUtfFvhKS1WzS8H1sbU/DbrzqbJ5Kq1eB1drj+obB1fCxTh6m26tRPj0zMJmdeu/jk3Gw==",
+      bin: "claude.exe"
+    },
+    "win32-x64": {
+      url: "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk-win32-x64/-/claude-agent-sdk-win32-x64-0.3.318.tgz",
+      integrity: "sha512-ZdKVWpyVNVt0cXrOf8sUBaxcxLEAP+oGMdQDLBWr/BqOxTWLy7TBWOj1kzw+wVg/9WIkjkgQWeJzGXPWulR1sA==",
+      bin: "claude.exe"
     }
   }
-  const id = (0, import_node_crypto.randomUUID)();
-  try {
-    (0, import_node_fs.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    (0, import_node_fs.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
+};
+
+// src/claude-code/runtime.ts
+var CLAUDE_CODE_MANIFEST = manifest_default;
+var CLAUDE_CODE_AUTH_KEY = "anthropic-claude-code";
+var CLAUDE_CODE_AUTH_MARKER = { via: "claude-code" };
+function isClaudeCodeAuthMarker(value) {
+  return value?.via === CLAUDE_CODE_AUTH_MARKER.via;
+}
+function isLegacyClaudeOAuth(value) {
+  const token = value?.accessToken;
+  return typeof token === "string" && token.startsWith("sk-ant-oat");
+}
+function isMusl() {
+  if (process.platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  return report != null && report.header?.glibcVersionRuntime === void 0;
+}
+function claudeCodePlatformKey(info = { platform: process.platform, arch: process.arch, musl: isMusl() }) {
+  const arch = info.arch === "arm64" || info.arch === "x64" ? info.arch : null;
+  if (!arch) return null;
+  if (info.platform === "darwin" || info.platform === "win32") return `${info.platform}-${arch}`;
+  if (info.platform === "linux") return `linux-${arch}${info.musl ? "-musl" : ""}`;
+  return null;
+}
+function resolveAsset(opts) {
+  const manifest = opts.manifest ?? CLAUDE_CODE_MANIFEST;
+  const key = opts.platformKey ?? claudeCodePlatformKey();
+  const asset = key ? manifest.platforms[key] : void 0;
+  if (!asset) {
+    throw new Error(
+      `Claude Code isn't available for ${process.platform}-${process.arch}. Use an Anthropic API key instead.`
+    );
   }
-  return id;
+  return { manifest, asset };
 }
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
-    "X-Msh-Device-Id": deviceId()
-  };
+function claudeCodeHome(opts = {}) {
+  return opts.home ?? getAppPaths().claudeCodeDir;
 }
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
+function claudeCodeConfigDir(opts = {}) {
+  return opts.home ? import_node_path2.default.join(opts.home, "config") : getAppPaths().claudeCodeConfigDir;
 }
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
+function claudeCodeBinaryPath(opts = {}) {
+  const { manifest, asset } = resolveAsset(opts);
+  return import_node_path2.default.join(claudeCodeHome(opts), manifest.claudeCodeVersion, asset.bin);
 }
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
+function resolveClaudeCodeBinary(opts = {}) {
+  let binary;
   try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
+    binary = claudeCodeBinaryPath(opts);
   } catch {
+    return null;
+  }
+  try {
+    return import_node_fs2.default.statSync(binary).isFile() ? binary : null;
+  } catch {
+    return null;
   }
-  return { status: response.status, data };
 }
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+var installs = /* @__PURE__ */ new Map();
+async function ensureClaudeCodeBinary(opts = {}) {
+  const existing = resolveClaudeCodeBinary(opts);
+  if (existing) return existing;
+  const target = claudeCodeBinaryPath(opts);
+  let install = installs.get(target);
+  if (!install) {
+    install = installClaudeCode(opts).finally(() => installs.delete(target));
+    installs.set(target, install);
+  }
+  return install;
+}
+async function installClaudeCode(opts) {
+  const { manifest, asset } = resolveAsset(opts);
+  const home = claudeCodeHome(opts);
+  const versionDir = import_node_path2.default.join(home, manifest.claudeCodeVersion);
+  const binary = import_node_path2.default.join(versionDir, asset.bin);
+  await import_promises2.default.mkdir(home, { recursive: true });
+  const tag = `${process.pid}-${import_node_crypto.default.randomBytes(4).toString("hex")}`;
+  const tarball = import_node_path2.default.join(home, `.download-${tag}.tgz`);
+  const staging = import_node_path2.default.join(home, `.staging-${tag}`);
+  try {
+    await download(asset, tarball, opts);
+    opts.onProgress?.({ phase: "extract" });
+    await import_promises2.default.mkdir(staging, { recursive: true });
+    const found = await extractFileFromTarGz(
+      tarball,
+      `package/${asset.bin}`,
+      import_node_path2.default.join(staging, asset.bin)
+    );
+    if (!found) throw new Error(`The Claude Code download has no ${asset.bin} binary.`);
+    await import_promises2.default.chmod(import_node_path2.default.join(staging, asset.bin), 493);
+    try {
+      await import_promises2.default.rename(staging, versionDir);
+    } catch (err) {
+      if (!import_node_fs2.default.existsSync(binary)) throw err;
+    }
+    await removeOldVersions(home, manifest.claudeCodeVersion);
+    return binary;
+  } finally {
+    await import_promises2.default.rm(tarball, { force: true }).catch(() => {
+    });
+    await import_promises2.default.rm(staging, { recursive: true, force: true }).catch(() => {
+    });
+  }
 }
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
+async function download(asset, dest, opts) {
+  const doFetch = opts.fetch ?? fetch;
+  const res = await doFetch(asset.url, { signal: opts.signal });
+  if (!res.ok || !res.body) {
+    throw new Error(`Claude Code download failed (HTTP ${res.status}).`);
   }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
+  const totalBytes = Number(res.headers.get("content-length")) || void 0;
+  const hash = import_node_crypto.default.createHash("sha512");
+  const out = await import_promises2.default.open(dest, "w");
+  let receivedBytes = 0;
+  let lastReported = -1;
+  try {
+    opts.onProgress?.({ phase: "download", receivedBytes, totalBytes });
+    for await (const chunk of res.body) {
+      if (opts.signal?.aborted) throw opts.signal.reason ?? new Error("Download cancelled.");
+      hash.update(chunk);
+      await out.write(chunk);
+      receivedBytes += chunk.byteLength;
+      const step = totalBytes ? Math.floor(receivedBytes / totalBytes * 100) : Math.floor(receivedBytes / 4194304);
+      if (step !== lastReported) {
+        lastReported = step;
+        opts.onProgress?.({ phase: "download", receivedBytes, totalBytes });
+      }
+    }
+  } finally {
+    await out.close();
   }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
+  opts.onProgress?.({ phase: "verify" });
+  const expected = asset.integrity.replace(/^sha512-/, "");
+  if (hash.digest("base64") !== expected) {
+    throw new Error(
+      "The Claude Code download didn't match its pinned checksum, so it was discarded."
+    );
   }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: kimiCodeBaseUrl()
-  };
 }
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
+async function removeOldVersions(home, keep) {
+  let entries;
+  try {
+    entries = await import_promises2.default.readdir(home, { withFileTypes: true });
+  } catch {
+    return;
   }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name === keep || entry.name === "config") continue;
+    if (!/^\d+\.\d+\.\d+/.test(entry.name)) continue;
+    await import_promises2.default.rm(import_node_path2.default.join(home, entry.name), { recursive: true, force: true }).catch(() => {
+    });
   }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
 }
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+function formatClaudeCodeInstallProgress(progress) {
+  if (progress.phase === "verify") return "Checking the Claude Code download\u2026";
+  if (progress.phase === "extract") return "Unpacking Claude Code\u2026";
+  const mb = (bytes) => Math.round(bytes / 1048576);
+  if (!progress.totalBytes) return `Downloading Claude Code\u2026 ${mb(progress.receivedBytes)} MB`;
+  const pct = Math.floor(progress.receivedBytes / progress.totalBytes * 100);
+  return `Downloading Claude Code\u2026 ${pct}% (${mb(progress.receivedBytes)} of ${mb(progress.totalBytes)} MB)`;
+}
+var STRIPPED_ENV = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "NODE_OPTIONS"
+];
+function claudeCodeEnv(opts = {}, base = process.env) {
+  const env = {};
+  for (const [key, value] of Object.entries(base)) {
+    if (value !== void 0 && !STRIPPED_ENV.includes(key)) env[key] = value;
+  }
+  env.CLAUDE_CONFIG_DIR = claudeCodeConfigDir(opts);
+  env.DISABLE_AUTOUPDATER = "1";
+  return env;
+}
+function runCommand(opts) {
+  if (opts.binary) return { command: opts.binary, prefix: opts.binaryArgs ?? [] };
+  const binary = resolveClaudeCodeBinary(opts);
+  if (!binary) throw new Error("Claude Code isn't installed yet. Sign in with Claude first.");
+  return { command: binary, prefix: [] };
+}
+function runClaude(args, opts) {
+  const { command, prefix } = runCommand(opts);
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)(command, [...prefix, ...args], {
+      env: claudeCodeEnv(opts),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      signal: opts.signal
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => stdout += d.toString());
+    child.stderr.on("data", (d) => stderr += d.toString());
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ code, stdout, stderr }));
   });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
+}
+async function claudeCodeAuthStatus(opts = {}) {
+  if (!opts.binary && !resolveClaudeCodeBinary(opts)) return { loggedIn: false };
+  const { stdout } = await runClaude(["auth", "status", "--json"], opts);
+  try {
+    const parsed = JSON.parse(stdout);
+    return {
+      loggedIn: parsed.loggedIn === true,
+      ...typeof parsed.authMethod === "string" ? { authMethod: parsed.authMethod } : {},
+      ...typeof parsed.email === "string" ? { email: parsed.email } : {},
+      ...typeof parsed.subscriptionType === "string" ? { subscriptionType: parsed.subscriptionType } : {}
+    };
+  } catch {
+    return { loggedIn: false };
   }
 }
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
+async function logoutClaudeCode(opts = {}) {
+  if (!opts.binary && !resolveClaudeCodeBinary(opts)) return;
+  const { code, stderr } = await runClaude(["auth", "logout"], opts);
+  if (code !== 0) throw new Error(stderr.trim() || `claude auth logout exited with ${code}`);
 }
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
+var OPEN_URL_HOOK = `const arg = String(process.argv[1] || "");
+const file = process.env.GG_CLAUDE_CODE_URL_FILE;
+if (file && /https?:/.test(arg)) {
+  require("node:fs").appendFileSync(file, arg + "\\n");
+  process.exit(0);
+}
+`;
+var CAPTURE_WAIT_MS = 3e3;
+function stripAnsi(text) {
+  return text.replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b\[[0-9;?]*[A-Za-z]/g, "");
+}
+function claudeCodeCallbackUrl(manualUrl, captured) {
+  const port = /localhost(?::|%3A)(\d{2,5})(?:\/|%2F)callback/i.exec(captured)?.[1];
+  if (!port) return null;
+  try {
+    const url = new URL(manualUrl);
+    url.searchParams.set("redirect_uri", `http://localhost:${port}/callback`);
+    return url.toString();
+  } catch {
+    return null;
   }
-  throw new Error("Kimi login timed out. Please run login again.");
 }
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
+async function loginClaudeCode(callbacks, opts = {}) {
+  const { command, prefix } = runCommand(opts);
+  const home = claudeCodeHome(opts);
+  await import_promises2.default.mkdir(claudeCodeConfigDir(opts), { recursive: true });
+  const tag = `${process.pid}-${import_node_crypto.default.randomBytes(4).toString("hex")}`;
+  const hookFile = import_node_path2.default.join(home, `.open-url-${tag}.cjs`);
+  const urlFile = import_node_path2.default.join(home, `.open-url-${tag}.txt`);
+  await import_promises2.default.writeFile(hookFile, OPEN_URL_HOOK);
+  const env = {
+    ...claudeCodeEnv(opts),
+    BROWSER: process.execPath,
+    NODE_OPTIONS: `--require ${JSON.stringify(hookFile)}`,
+    GG_CLAUDE_CODE_URL_FILE: urlFile
+  };
+  const promptAbort = new AbortController();
+  let timer;
+  try {
+    await new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process.spawn)(command, [...prefix, "auth", "login", "--claudeai"], {
+        env,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+      let stdout = "";
+      let stderr = "";
+      let manualUrl = null;
+      let opened = false;
+      const onAbort = () => child.kill();
+      opts.signal?.addEventListener("abort", onAbort, { once: true });
+      const open = (url, needsCode) => {
+        if (opened) return;
+        opened = true;
+        clearInterval(timer);
+        callbacks.onOpenUrl(url);
+        callbacks.onStatus("Finish signing in to Claude in your browser\u2026");
+        if (!needsCode) return;
+        void callbacks.onPromptCode("Paste the code shown after signing in to Claude:", promptAbort.signal).then((code) => {
+          const trimmed = code.trim();
+          if (trimmed && !child.stdin.destroyed) child.stdin.write(`${trimmed}
+`);
+        }).catch(() => {
+        });
+      };
+      child.stdout.on("data", (d) => {
+        stdout += d.toString();
+        if (manualUrl) return;
+        const match = /visit:\s*(https:\/\/\S+)/.exec(stripAnsi(stdout));
+        if (!match) return;
+        manualUrl = match[1];
+        const started = Date.now();
+        timer = setInterval(() => {
+          let captured = "";
+          try {
+            captured = import_node_fs2.default.readFileSync(urlFile, "utf8");
+          } catch {
+          }
+          const callbackUrl = captured ? claudeCodeCallbackUrl(manualUrl, captured) : null;
+          if (callbackUrl) open(callbackUrl, false);
+          else if (Date.now() - started > (opts.browserWaitMs ?? CAPTURE_WAIT_MS))
+            open(manualUrl, true);
+        }, 100);
+      });
+      child.stderr.on("data", (d) => stderr += d.toString());
+      child.on("error", reject);
+      child.on("close", (code) => {
+        opts.signal?.removeEventListener("abort", onAbort);
+        if (opts.signal?.aborted) reject(new Error("Sign-in cancelled."));
+        else if (code === 0) resolve();
+        else {
+          const detail = stripAnsi(stderr).trim().split("\n").pop()?.trim();
+          reject(new Error(detail || `Claude sign-in failed (exit ${code}).`));
+        }
+      });
+    });
+  } finally {
+    clearInterval(timer);
+    promptAbort.abort();
+    await import_promises2.default.rm(hookFile, { force: true }).catch(() => {
+    });
+    await import_promises2.default.rm(urlFile, { force: true }).catch(() => {
+    });
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
 }
 
-// src/auth-storage.ts
-var import_promises3 = __toESM(require("fs/promises"), 1);
-var import_node_fs3 = require("fs");
-var import_node_crypto6 = __toESM(require("crypto"), 1);
-
-// src/oauth/anthropic.ts
+// src/oauth/openai.ts
+var import_node_http = __toESM(require("http"), 1);
 var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_promises3 = __toESM(require("fs/promises"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
 
 // src/oauth/pkce.ts
 function base64urlEncode(bytes) {
@@ -420,201 +756,233 @@ async function generatePKCE() {
   return { verifier, challenge };
 }
 
-// src/claude-code-version.ts
-var import_gg_ai = require("@kenkaiiii/gg-ai");
-
-// src/oauth/anthropic.ts
-var CLIENT_ID2 = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
-var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URLS = [
-  "https://platform.claude.com/v1/oauth/token",
-  "https://console.anthropic.com/v1/oauth/token"
-];
-var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
-var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-async function postTokenRequest(body, label) {
-  const encoded = JSON.stringify(body);
-  const headers = {
-    "Content-Type": "application/json",
-    "User-Agent": await (0, import_gg_ai.getClaudeCliUserAgent)(),
-    "anthropic-beta": "oauth-2025-04-20"
-  };
-  let lastError = null;
-  for (const url of TOKEN_URLS) {
-    let response;
-    try {
-      response = await fetch(url, {
-        method: "POST",
-        headers,
-        body: encoded,
-        signal: oauthRequestSignal()
-      });
-    } catch (err) {
-      lastError = err instanceof Error ? err : new Error(String(err));
-      continue;
-    }
-    if (response.ok) {
-      return await response.json();
-    }
-    const text = await response.text();
-    if (response.status >= 400 && response.status < 500) {
-      throw new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
-    }
-    lastError = new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
-  }
-  throw lastError ?? new Error(`Anthropic ${label} failed: all endpoints unreachable`);
-}
-function toCredentials(data) {
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-async function loginAnthropic(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLIENT_ID2,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: SCOPES,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${AUTHORIZE_URL}?${params}`;
-  callbacks.onOpenUrl(authUrl);
-  const raw = await callbacks.onPromptCode("Paste the code from the browser (format: code#state):");
-  const parts = raw.trim().split("#");
-  if (parts.length !== 2 || !parts[0] || parts[1] !== state) {
-    throw new Error("Invalid code or state mismatch. Please try again.");
-  }
-  return exchangeAnthropicCode(parts[0], parts[1], verifier);
-}
-async function exchangeAnthropicCode(code, state, verifier) {
-  const data = await postTokenRequest(
-    {
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
-      code,
-      state,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: verifier
-    },
-    "token exchange"
-  );
-  return toCredentials(data);
-}
-async function refreshAnthropicToken(refreshToken) {
-  const data = await postTokenRequest(
-    {
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID2,
-      refresh_token: refreshToken
-    },
-    "token refresh"
-  );
-  return toCredentials(data);
+// src/oauth/request-timeout.ts
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+function oauthRequestSignal() {
+  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
 }
 
 // src/oauth/openai.ts
-var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto3 = __toESM(require("crypto"), 1);
-var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
-var TOKEN_URL = "https://auth.openai.com/oauth/token";
-var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
-var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+var ISSUER = "https://auth.openai.com";
+var AUTHORIZE_URL = `${ISSUER}/api/accounts/authorize`;
+var TOKEN_URL = `${ISSUER}/api/accounts/oauth/token`;
+var REVOKE_URL = `${ISSUER}/api/accounts/oauth/revoke`;
+var JWKS_URL = `${ISSUER}/.well-known/jwks.json`;
+var REGISTRATION_CLIENT_ID = "dynamic_agent_client";
+var AGENT_NAME = "GG Coder";
+var RESOURCE = "https://api.openai.com/v1";
+var CHATGPT_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPES = `openid profile email offline_access resource.invoke ${CHATGPT_PLAN_SCOPE}`;
+var CHATGPT_PLAN_BASE_URL = "https://api.openai.com/v1";
+var CHATGPT_USAGE_URL = "https://chatgpt.com/settings/usage";
+var CALLBACK_PATH = "/auth/callback";
+var PREFERRED_PORT = 1455;
 var CALLBACK_TIMEOUT_MS = 12e4;
 var MAX_PASTE_ATTEMPTS = 3;
-var MIN_RAW_CODE_LENGTH = 10;
-async function loginOpenAI(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
-  const url = new URL(AUTHORIZE_URL2);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID3);
-  url.searchParams.set("redirect_uri", REDIRECT_URI2);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("prompt", "login");
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", "ggcoder");
-  const code = await acquireAuthorizationCode(url.toString(), state, callbacks);
-  const creds = await exchangeOpenAICode(code, verifier);
-  const accountId = getAccountId(creds.accessToken);
-  if (!accountId) {
-    throw new Error("Failed to extract accountId from OpenAI token.");
-  }
-  creds.accountId = accountId;
-  return creds;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
+var ID_TOKEN_CLOCK_SKEW_S = 60;
+var CHATGPT_PLAN_NOT_ENABLED_MESSAGE = "ChatGPT plan use isn't enabled for GG Coder. Allow Use your ChatGPT plan, or add an OpenAI API key.";
+var ChatGPTPlanNotEnabledError = class extends Error {
+  constructor() {
+    super(CHATGPT_PLAN_NOT_ENABLED_MESSAGE);
+    this.name = "ChatGPTPlanNotEnabledError";
+  }
+};
+function defaultHostIdFile() {
+  return import_node_path3.default.join(getAppPaths().agentDir, "openai-host-id");
+}
+function defaultRegistrationFile() {
+  return import_node_path3.default.join(getAppPaths().agentDir, "openai-chatgpt-client.json");
+}
+async function writePrivateFile(file, content) {
+  await import_promises3.default.mkdir(import_node_path3.default.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${import_node_crypto2.default.randomUUID().slice(0, 8)}.tmp`;
   try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
+    await import_promises3.default.writeFile(tmp, content, { encoding: "utf-8", mode: 384 });
+    await import_promises3.default.rename(tmp, file);
+  } catch (err) {
+    await import_promises3.default.unlink(tmp).catch(() => {
+    });
+    throw err;
   }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
+}
+var HOST_ID_PATTERN = /^urn:uuid:[0-9a-f-]{36}$/i;
+async function getChatGPTHostId(file = defaultHostIdFile()) {
+  const existing = await import_promises3.default.readFile(file, "utf-8").catch(() => "");
+  if (HOST_ID_PATTERN.test(existing.trim())) return existing.trim();
+  await writePrivateFile(file, `urn:uuid:${import_node_crypto2.default.randomUUID()}`);
+  return (await import_promises3.default.readFile(file, "utf-8")).trim();
+}
+async function readRegistration(file) {
+  try {
+    const value = JSON.parse(await import_promises3.default.readFile(file, "utf-8"));
+    if (typeof value.clientId === "string" && typeof value.subject === "string") {
+      return { clientId: value.clientId, subject: value.subject };
+    }
+  } catch {
   }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
+  return void 0;
+}
+async function loginChatGPT(callbacks, options = {}) {
+  const hostId = await getChatGPTHostId(options.hostIdFile);
+  const registrationFile = options.registrationFile ?? defaultRegistrationFile();
+  const registration = await readRegistration(registrationFile);
+  const { verifier, challenge } = await generatePKCE();
+  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const nonce = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const listener = await startCallbackListener(state, Boolean(registration));
+  try {
+    const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`;
+    const url = new URL(AUTHORIZE_URL);
+    url.searchParams.set("client_id", registration?.clientId ?? REGISTRATION_CLIENT_ID);
+    if (!registration) url.searchParams.set("agent_name_hint", AGENT_NAME);
+    url.searchParams.set("ext_agent_host_id", hostId);
+    if (registration && options.previous?.idToken) {
+      url.searchParams.set("id_token_hint", options.previous.idToken);
+    }
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("scope", SCOPES);
+    url.searchParams.set("resource", RESOURCE);
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("code_challenge", challenge);
+    const callback = await acquireCallback(url.toString(), state, listener, callbacks);
+    if (callback.get("error")) {
+      if (callback.get("error") === "access_denied") throw new ChatGPTPlanNotEnabledError();
+      throw new Error(
+        `ChatGPT sign-in failed: ${callback.get("error_description") ?? callback.get("error")}`
+      );
+    }
+    const code = callback.get("code");
+    if (!code) throw new Error("ChatGPT sign-in returned no authorization code.");
+    const issued = callback.get("client_id") ?? void 0;
+    if (registration && issued && issued !== registration.clientId) {
+      throw new Error("ChatGPT returned a different app registration. Start the sign-in again.");
+    }
+    const clientId = registration?.clientId ?? issued;
+    if (!clientId || clientId === REGISTRATION_CLIENT_ID) {
+      throw new Error(
+        "ChatGPT didn't finish registering GG Coder. Start the sign-in again, and paste the full callback URL if you're on another machine."
+      );
+    }
+    const tokens = await exchangeCode({ code, verifier, clientId, redirectUri });
+    const claims = await verifyIdToken(tokens.idToken, { clientId, nonce });
+    const subject = String(claims.sub ?? "");
+    if (!subject) throw new Error("ChatGPT ID token has no subject.");
+    if (registration && registration.subject !== subject) {
+      await import_promises3.default.unlink(registrationFile).catch(() => {
+      });
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new Error(
+        "That was a different ChatGPT account. Continue with ChatGPT again to connect it."
+      );
+    }
+    if (!tokens.scopes.includes(CHATGPT_PLAN_SCOPE)) {
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new ChatGPTPlanNotEnabledError();
+    }
+    if (!registration) {
+      await writePrivateFile(registrationFile, JSON.stringify({ clientId, subject }));
+    }
     return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3,
+      expiresIn: tokens.expiresIn,
+      accountId: subject,
+      clientId,
+      idToken: tokens.idToken,
+      scopes: tokens.scopes,
+      baseUrl: CHATGPT_PLAN_BASE_URL
     };
+  } finally {
+    listener.close();
   }
-  if (/\s/.test(value) || value.length < MIN_RAW_CODE_LENGTH) return {};
-  return { code: value };
 }
-function decodeJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const decoded = atob(parts[1]);
-    return JSON.parse(decoded);
-  } catch {
-    return null;
-  }
+async function fetchChatGPTPlanModels(accessToken, fetchFn = fetch) {
+  const response = await fetchFn(`${CHATGPT_PLAN_BASE_URL}/models`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: oauthRequestSignal()
+  });
+  if (!response.ok) throw new Error(`ChatGPT model list failed (${response.status})`);
+  const data = await response.json();
+  return (data.models ?? []).filter((m) => typeof m.slug === "string" && (m.visibility ?? "list") === "list").map((m) => m.slug);
 }
-function getAccountId(accessToken) {
-  const payload = decodeJwt(accessToken);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const accountId = auth?.chatgpt_account_id;
-  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+async function startCallbackListener(expectedState, anyPort) {
+  let settle;
+  const result = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
+  });
+  result.catch(() => {
+  });
+  const server = import_node_http.default.createServer((req, res) => {
+    const url = new URL(req.url || "", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    if (url.searchParams.get("state") !== expectedState) {
+      res.statusCode = 400;
+      res.end("State mismatch");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(
+      "<html><body><h1>You're signed in to GG Coder.</h1><p>You can close this tab.</p></body></html>"
+    );
+    settle?.resolve(url.searchParams);
+    server.close();
+  });
+  const listen = (port2) => new Promise((resolve, reject) => {
+    const onError = (err) => reject(err);
+    server.once("error", onError);
+    server.listen(port2, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve(server.address().port);
+    });
+  });
+  let port;
+  for (const candidate of anyPort ? [PREFERRED_PORT, 0] : [PREFERRED_PORT]) {
+    try {
+      port = await listen(candidate);
+      break;
+    } catch {
+    }
+  }
+  if (port === void 0) {
+    settle?.reject(new Error("Could not start the local sign-in listener."));
+    return { port: PREFERRED_PORT, result, close: () => {
+    } };
+  }
+  const timeout = setTimeout(() => server.close(), CALLBACK_TIMEOUT_MS);
+  timeout.unref();
+  server.on("close", () => {
+    clearTimeout(timeout);
+    settle?.reject(new Error("Sign-in listener closed without a callback."));
+  });
+  return { port, result, close: () => server.close() };
 }
-async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
+async function acquireCallback(authUrl, expectedState, listener, callbacks) {
   callbacks.onOpenUrl(authUrl);
-  callbacks.onStatus("Waiting for browser callback...");
+  callbacks.onStatus("Waiting for ChatGPT sign-in in your browser...");
   const done = new AbortController();
   try {
     return await new Promise((resolve, reject) => {
-      let serverFailed = false;
+      let listenerFailed = false;
       let pasteError;
       const failIfExhausted = () => {
-        if (!serverFailed || pasteError === void 0) return;
+        if (!listenerFailed || pasteError === void 0) return;
         reject(
-          pasteError instanceof Error ? pasteError : new Error("Could not obtain an authorization code.")
+          pasteError instanceof Error ? pasteError : new Error("Could not complete the sign-in.")
         );
       };
-      listenForCallback(expectedState, done.signal).then(resolve, () => {
-        serverFailed = true;
+      listener.result.then(resolve, () => {
+        listenerFailed = true;
         failIfExhausted();
       });
-      promptForCode(expectedState, callbacks, done.signal).then(resolve, (err) => {
+      promptForCallback(expectedState, callbacks, done.signal).then(resolve, (err) => {
         if (err instanceof FatalLoginError) {
           reject(err);
           return;
@@ -625,687 +993,159 @@ async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
     });
   } finally {
     done.abort();
+    listener.close();
   }
 }
 var FatalLoginError = class extends Error {
 };
-async function promptForCode(expectedState, callbacks, signal) {
-  let message = "If the browser is on another machine (SSH/headless), paste the callback URL or code here:";
-  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const raw = await callbacks.onPromptCode(message, signal);
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const parsed = parseAuthorizationInput(raw);
-    if (parsed.code && parsed.state && parsed.state !== expectedState) {
-      throw new FatalLoginError("Authorization state mismatch \u2014 start the login again.");
-    }
-    if (parsed.code) return parsed.code;
-    message = "That didn't contain an authorization code. Paste the full callback URL:";
-  }
-  throw new Error("No authorization code found in input.");
-}
-async function listenForCallback(expectedState, signal) {
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = import_node_http.default.createServer((req, res) => {
-      const url = new URL(req.url || "", "http://localhost");
-      if (url.pathname !== "/auth/callback") {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => {
-      reject(err);
-    });
-    server.listen(1455, "127.0.0.1");
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, CALLBACK_TIMEOUT_MS);
-    timeout.unref();
-    const onAbort = () => {
-      server.close();
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    server.on("close", () => {
-      clearTimeout(timeout);
-      signal.removeEventListener("abort", onAbort);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code"));
-      }
-    });
-  });
-}
-async function exchangeOpenAICode(code, verifier) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID3,
-      code,
-      redirect_uri: REDIRECT_URI2,
-      code_verifier: verifier
-    }),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token exchange failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
-}
-async function refreshOpenAIToken(refreshToken) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLIENT_ID3
-    }),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token refresh failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  const creds = {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
-  const accountId = getAccountId(creds.accessToken);
-  if (accountId) {
-    creds.accountId = accountId;
-  }
-  return creds;
-}
-
-// src/oauth/gemini.ts
-var import_node_http2 = __toESM(require("http"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
-var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
-var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
-var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
-var DEFAULT_CLIENT_SECRET = "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";
-var AUTHORIZE_URL3 = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL2 = "https://oauth2.googleapis.com/token";
-var CODE_ASSIST_BASE_URL = "https://cloudcode-pa.googleapis.com";
-var CODE_ASSIST_API_VERSION = "v1internal";
-var CODE_ASSIST_POST_RETRIES = 3;
-var CODE_ASSIST_POST_RETRY_DELAY_MS = 100;
-var SCOPE2 = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile"
-].join(" ");
-var USER_TIER_FREE = "free-tier";
-var USER_TIER_LEGACY = "legacy-tier";
-var USER_TIER_STANDARD = "standard-tier";
-var VALIDATION_REQUIRED_REASON = "VALIDATION_REQUIRED";
-var VPC_SC_REASON = "SECURITY_POLICY_VIOLATED";
-var CodeAssistHttpError = class extends Error {
-  status;
-  body;
-  constructor(label, status, body) {
-    super(`Gemini Code Assist ${label} failed (${status}): ${body}`);
-    this.name = "CodeAssistHttpError";
-    this.status = status;
-    this.body = body;
-  }
-};
-async function loginGemini(callbacks) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto4.default.randomBytes(32).toString("hex");
-  const redirectUri = await getLoopbackRedirectUri();
-  const url = new URL(AUTHORIZE_URL3);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId2);
-  url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", SCOPE2);
-  url.searchParams.set("access_type", "offline");
-  url.searchParams.set("prompt", "consent");
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  let code;
-  try {
-    code = await loginWithServer(url.toString(), redirectUri, state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput2(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    if (parsed.state && parsed.state !== state) {
-      throw new Error("Invalid state. Please try again.");
-    }
-    code = parsed.code;
-  }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret);
-  callbacks.onStatus("Setting up Gemini Code Assist access...");
-  const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
-  return {
-    ...creds,
-    projectId
-  };
-}
-async function refreshGeminiToken(refreshToken) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const data = await postTokenRequest2({
-    grant_type: "refresh_token",
-    refresh_token: refreshToken,
-    client_id: clientId2,
-    client_secret: clientSecret
-  });
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? refreshToken,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-function getGeminiOAuthClientCredentials() {
-  const clientId2 = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
-  const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId: clientId2, clientSecret };
-}
-async function getLoopbackRedirectUri() {
-  return new Promise((resolve, reject) => {
-    const server = import_node_http2.default.createServer();
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      server.close(() => {
-        if (addr && typeof addr === "object") {
-          resolve(`http://127.0.0.1:${addr.port}/oauth2callback`);
-        } else {
-          reject(new Error("Failed to allocate OAuth callback port."));
-        }
-      });
-    });
-    server.on("error", reject);
-  });
-}
-function parseAuthorizationInput2(input) {
+function parseCallbackInput(input) {
   const value = input.trim();
-  if (!value) return {};
+  if (!value) return void 0;
   try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
+    return new URL(value).searchParams;
   } catch {
   }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
+  if (/[?&]?(code|error)=/.test(value)) {
+    return new URLSearchParams(value.replace(/^.*\?/, ""));
   }
-  return { code: value };
+  return void 0;
 }
-async function loginWithServer(authUrl, redirectUri, expectedState, callbacks) {
-  const redirect = new URL(redirectUri);
-  const port = Number(redirect.port);
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = import_node_http2.default.createServer((req, res) => {
-      const url = new URL(req.url || "", redirect.origin);
-      if (url.pathname !== redirect.pathname) {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => reject(err));
-    server.listen(port, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, 12e4);
-    timeout.unref();
-    server.on("close", () => {
-      clearTimeout(timeout);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code."));
+async function promptForCallback(expectedState, callbacks, signal) {
+  let message = "If the browser is on another machine (SSH/headless), paste the full callback URL here:";
+  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
+    if (signal.aborted) throw new Error("Callback already received.");
+    const raw = await callbacks.onPromptCode(message, signal);
+    if (signal.aborted) throw new Error("Callback already received.");
+    const params = parseCallbackInput(raw);
+    if (params && (params.get("code") || params.get("error"))) {
+      if (params.get("state") !== expectedState) {
+        throw new FatalLoginError("Sign-in state mismatch \u2014 start the sign-in again.");
       }
-    });
-  });
-}
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret) {
-  const data = await postTokenRequest2({
-    grant_type: "authorization_code",
-    client_id: clientId2,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
-  });
-  if (!data.refresh_token) {
-    throw new Error("Gemini OAuth did not return a refresh token. Please try login again.");
+      return params;
+    }
+    message = "That wasn't a callback URL. Paste the full URL from the browser's address bar:";
   }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
+  throw new Error("No callback URL found in input.");
 }
-async function postTokenRequest2(body) {
-  const response = await fetch(TOKEN_URL2, {
+async function postForm(url, form) {
+  return fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(body),
+    body: new URLSearchParams(form),
     signal: oauthRequestSignal()
   });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Gemini token request failed (${response.status}): ${text}`);
-  }
-  return await response.json();
-}
-async function setupCodeAssistProject(accessToken, callbacks) {
-  const envProject = process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID;
-  if (envProject && /^\d+$/.test(envProject)) {
-    throw new Error("GOOGLE_CLOUD_PROJECT must be a project ID, not a numeric project number.");
-  }
-  const coreMetadata = {
-    ideType: "IDE_UNSPECIFIED",
-    platform: "PLATFORM_UNSPECIFIED",
-    pluginType: "GEMINI"
-  };
-  const projectMetadata = {
-    ...coreMetadata,
-    ...envProject ? { duetProject: envProject } : {}
-  };
-  let loadRes;
-  while (true) {
-    loadRes = await loadCodeAssist(accessToken, envProject, projectMetadata);
-    const validation = getValidationRequiredTier(loadRes);
-    if (!validation) break;
-    callbacks.onStatus(
-      `Gemini Code Assist requires account validation${validation.reasonMessage ? `: ${validation.reasonMessage}` : ""}`
-    );
-    callbacks.onOpenUrl(validation.validationUrl);
-    const answer = await callbacks.onPromptCode(
-      "Complete validation in the browser, then press Enter to retry (or type cancel):"
-    );
-    if (answer.trim().toLowerCase() === "cancel") {
-      throw new Error("Gemini Code Assist account validation was cancelled.");
-    }
-  }
-  if (loadRes.currentTier) {
-    const project2 = loadRes.cloudaicompanionProject ?? envProject;
-    if (!project2) throwProjectError(loadRes);
-    return project2;
-  }
-  const tier = getOnboardTier(loadRes);
-  const onboardReq = tier.id === USER_TIER_FREE ? {
-    tierId: tier.id,
-    cloudaicompanionProject: void 0,
-    metadata: coreMetadata
-  } : {
-    tierId: tier.id,
-    cloudaicompanionProject: envProject,
-    metadata: projectMetadata
-  };
-  let operation = await codeAssistPost(
-    accessToken,
-    "onboardUser",
-    onboardReq
-  );
-  while (!operation.done && operation.name) {
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    operation = await codeAssistGet(accessToken, operation.name);
-  }
-  const project = operation.response?.cloudaicompanionProject?.id ?? envProject;
-  if (!project) throwProjectError(loadRes);
-  return project;
-}
-async function loadCodeAssist(accessToken, envProject, metadata) {
-  try {
-    return await codeAssistPost(accessToken, "loadCodeAssist", {
-      ...envProject ? { cloudaicompanionProject: envProject } : {},
-      metadata
-    });
-  } catch (err) {
-    if (err instanceof CodeAssistHttpError && isVpcScAffectedError(err)) {
-      return { currentTier: { id: USER_TIER_STANDARD } };
-    }
-    if (err instanceof CodeAssistHttpError && err.status === 403 && envProject === "cloudshell-gca") {
-      throw new Error(
-        "Access to the default Cloud Shell Gemini project was denied.\nPlease set your own Google Cloud project by running:\ngcloud config set project [PROJECT_ID]\nor setting export GOOGLE_CLOUD_PROJECT=...",
-        { cause: err }
-      );
-    }
-    throw err;
-  }
-}
-function getValidationRequiredTier(response) {
-  return response.ineligibleTiers?.find(
-    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
-  );
-}
-function getOnboardTier(response) {
-  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
-  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
-}
-function throwProjectError(response) {
-  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
-  if (reasons && reasons.length > 0) {
-    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
-  }
-  throw new Error(
-    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
-  );
-}
-async function codeAssistPost(accessToken, method, body) {
-  let lastError;
-  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
-    try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
-      }
-      lastError = err;
-    }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
-  }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
-}
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
-  });
 }
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken),
-    signal: oauthRequestSignal()
+async function exchangeCode(input) {
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "authorization_code",
+    client_id: input.clientId,
+    code: input.code,
+    code_verifier: input.verifier,
+    redirect_uri: input.redirectUri,
+    resource: RESOURCE
   });
   if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token exchange failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
-}
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
-}
-function isVpcScAffectedError(error) {
-  try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
-  } catch {
-    return false;
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token || !data.id_token) {
+    throw new Error("ChatGPT token response is missing tokens.");
   }
-}
-function codeAssistHeaders(accessToken) {
   return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/xai.ts
-var DEFAULT_CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
-var DEFAULT_ISSUER = "https://auth.x.ai";
-var DEFAULT_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
-var OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-var DEFAULT_GROK_CLI_VERSION = "1.0.67";
-var DEVICE_TIMEOUT_FALLBACK_MS = 10 * 60 * 1e3;
-var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
-function issuer() {
-  return (process.env.XAI_OAUTH_ISSUER ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-}
-function clientId() {
-  return process.env.XAI_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID2;
-}
-function grokCliBaseUrl() {
-  return (process.env.XAI_CLI_BASE_URL ?? DEFAULT_CLI_BASE_URL).replace(/\/+$/, "");
-}
-function grokCliVersion() {
-  const raw = process.env.GROK_CLI_VERSION ?? DEFAULT_GROK_CLI_VERSION;
-  const cleaned = raw.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : DEFAULT_GROK_CLI_VERSION;
-}
-function grokCliHeaders(modelId) {
-  return {
-    "X-XAI-Token-Auth": "xai-grok-cli",
-    "x-grok-client-version": grokCliVersion(),
-    "x-grok-client-identifier": "ggcoder",
-    ...modelId ? { "x-grok-model-override": modelId } : {}
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    idToken: data.id_token,
+    expiresIn: data.expires_in ?? 3600,
+    scopes: (data.scope ?? "").split(/\s+/).filter(Boolean)
   };
 }
-function isGrokCliEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === grokCliBaseUrl() || /(^|\.)grok\.com/i.test(normalized);
-}
-async function postForm2(endpoint, params) {
-  const response = await fetch(`${issuer()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-      "User-Agent": `grok-cli/${grokCliVersion()}`
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail2(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function jwtExpirySeconds(token) {
-  const payload = token.split(".")[1];
-  if (!payload) return void 0;
-  try {
-    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
-      "utf-8"
-    );
-    const claims = JSON.parse(json);
-    if (!claims || typeof claims !== "object") return void 0;
-    const exp = claims.exp;
-    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function credsFromTokenResponse2(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Grok OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error(
-      "Grok OAuth response missing refresh_token \u2014 the offline_access scope was not granted."
-    );
-  }
-  const responseExpiresIn = Number(data.expires_in);
-  let expiresIn;
-  if (Number.isFinite(responseExpiresIn) && responseExpiresIn > 0) {
-    expiresIn = responseExpiresIn;
-  } else {
-    const exp = jwtExpirySeconds(accessToken);
-    const fromJwt = exp !== void 0 ? exp - Math.floor(Date.now() / 1e3) : 0;
-    expiresIn = fromJwt > 0 ? fromJwt : DEFAULT_TOKEN_LIFETIME_SECONDS;
+async function refreshChatGPTToken(creds) {
+  if (!creds.clientId) {
+    throw new Error("ChatGPT token refresh failed (401): no issued client ID saved");
   }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: grokCliBaseUrl()
-  };
-}
-async function requestDeviceAuthorization2() {
-  const { status, data } = await postForm2("/oauth2/device/code", {
-    client_id: clientId(),
-    scope: OAUTH_SCOPE
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "refresh_token",
+    client_id: creds.clientId,
+    refresh_token: creds.refreshToken,
+    resource: RESOURCE
   });
-  if (status !== 200) {
-    throw new Error(`Grok device authorization failed (${status}): ${errorDetail2(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Grok device authorization response missing user_code/device_code.");
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token refresh failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5,
-    // RFC 8628 §3.2: the server states how long the device code lives. Honor it
-    // rather than imposing our own budget — polling a code we know is dead only
-    // burns requests, and a longer local window would keep a user waiting past
-    // the point the code can ever succeed.
-    expiresInMs: (Number(data.expires_in) || 0) > 0 ? Number(data.expires_in) * 1e3 : DEVICE_TIMEOUT_FALLBACK_MS
-  };
-}
-async function pollDeviceToken2(deviceCode) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse2(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Grok token polling server error (${status}): ${errorDetail2(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Grok token polling failed (${status}): ${errorDetail2(data)}`);
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token) {
+    throw new Error("ChatGPT token refresh returned no tokens.");
   }
+  const expiresIn = data.expires_in ?? 3600;
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    expiresIn,
+    ...data.id_token ? { idToken: data.id_token } : {},
+    ...data.scope ? { scopes: data.scope.split(/\s+/).filter(Boolean) } : {}
+  };
 }
-function sleep2(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginXai(callbacks) {
-  const auth = await requestDeviceAuthorization2();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + auth.expiresInMs;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    const remaining = deadline - Date.now();
-    await sleep2(Math.min(interval * 1e3, remaining));
-    const result = await pollDeviceToken2(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Grok authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Grok device code expired. Please run login again.");
+async function revokeChatGPTSignIn(creds, options = {}) {
+  if (!creds.clientId || !creds.refreshToken) return false;
+  const attempts = options.attempts ?? 3;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      const response = await postForm(REVOKE_URL, {
+        token: creds.refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: creds.clientId
+      });
+      if (response.ok) return true;
+      if (response.status < 500) return false;
+    } catch {
     }
-    if (result.kind === "slow_down") {
-      interval += 5;
+    if (attempt < attempts - 1) {
+      await new Promise((r) => setTimeout(r, (options.backoffMs ?? 500) * 2 ** attempt));
     }
   }
-  throw new Error("Grok login timed out. Please run login again.");
-}
-async function refreshXaiToken(refreshToken) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse2(data, { fallbackRefreshToken: refreshToken });
+  return false;
+}
+function decodeSegment(segment) {
+  return JSON.parse(Buffer.from(segment, "base64url").toString("utf-8"));
+}
+async function verifyIdToken(idToken, expected) {
+  const [headerSeg, payloadSeg, signatureSeg] = idToken.split(".");
+  if (!headerSeg || !payloadSeg || !signatureSeg) throw new Error("Malformed ChatGPT ID token.");
+  const header = decodeSegment(headerSeg);
+  if (header.alg !== "RS256") throw new Error("Unexpected ChatGPT ID token algorithm.");
+  const response = await fetch(JWKS_URL, { signal: oauthRequestSignal() });
+  if (!response.ok) throw new Error(`Could not load OpenAI signing keys (${response.status}).`);
+  const { keys = [] } = await response.json();
+  const jwk = keys.find((k) => k.kid === header.kid);
+  if (!jwk) throw new Error("ChatGPT ID token is signed with an unknown key.");
+  const valid = import_node_crypto2.default.verify(
+    "RSA-SHA256",
+    Buffer.from(`${headerSeg}.${payloadSeg}`),
+    import_node_crypto2.default.createPublicKey({ key: jwk, format: "jwk" }),
+    Buffer.from(signatureSeg, "base64url")
+  );
+  if (!valid) throw new Error("ChatGPT ID token signature is invalid.");
+  const claims = decodeSegment(payloadSeg);
+  const now = Math.floor((expected.now ?? Date.now()) / 1e3);
+  const aud = claims.aud;
+  const audiences = Array.isArray(aud) ? aud : [aud];
+  if (claims.iss !== ISSUER) throw new Error("ChatGPT ID token has the wrong issuer.");
+  if (!audiences.includes(expected.clientId)) {
+    throw new Error("ChatGPT ID token was issued to another app.");
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Grok token refresh failed (${status}): ${errorCode || errorDetail2(data)}`);
+  if (typeof claims.exp !== "number" || claims.exp + ID_TOKEN_CLOCK_SKEW_S < now) {
+    throw new Error("ChatGPT ID token has expired.");
+  }
+  if (claims.nonce !== expected.nonce) throw new Error("ChatGPT ID token nonce mismatch.");
+  return claims;
 }
 
 // src/file-lock.ts
-var import_promises = __toESM(require("fs/promises"), 1);
-var import_promises2 = require("timers/promises");
+var import_promises4 = __toESM(require("fs/promises"), 1);
+var import_promises5 = require("timers/promises");
 var STALE_TIMEOUT_MS = 1e4;
 var RETRY_INTERVAL_MS = 50;
 var MAX_WAIT_MS = 5e3;
@@ -1325,7 +1165,7 @@ async function acquireLock(lockPath) {
   while (true) {
     try {
       const info = { pid: process.pid, timestamp: Date.now() };
-      await import_promises.default.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
+      await import_promises4.default.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
       return;
     } catch (err) {
       const code = err.code;
@@ -1334,47 +1174,47 @@ async function acquireLock(lockPath) {
         const lockPresent = await lockFileExists(lockPath);
         if (!lockPresent && ++refusedWithoutLock > 3) throw err;
         if (Date.now() - startTime > MAX_WAIT_MS) throw err;
-        await (0, import_promises2.setTimeout)(RETRY_INTERVAL_MS);
+        await (0, import_promises5.setTimeout)(RETRY_INTERVAL_MS);
         continue;
       }
       try {
-        const content = await import_promises.default.readFile(lockPath, "utf-8");
+        const content = await import_promises4.default.readFile(lockPath, "utf-8");
         const info = JSON.parse(content);
         const isProcessAlive = isAlive(info.pid);
         const isStale = Date.now() - info.timestamp > STALE_TIMEOUT_MS;
         if (!isProcessAlive || isStale) {
-          await import_promises.default.unlink(lockPath).catch(() => {
+          await import_promises4.default.unlink(lockPath).catch(() => {
           });
           continue;
         }
       } catch {
-        const stat = await import_promises.default.stat(lockPath).catch(() => null);
+        const stat = await import_promises4.default.stat(lockPath).catch(() => null);
         if (!stat) continue;
         if (Date.now() - stat.mtimeMs > STALE_TIMEOUT_MS) {
-          await import_promises.default.unlink(lockPath).catch(() => {
+          await import_promises4.default.unlink(lockPath).catch(() => {
           });
           continue;
         }
       }
       if (Date.now() - startTime > MAX_WAIT_MS) {
-        await import_promises.default.unlink(lockPath).catch(() => {
+        await import_promises4.default.unlink(lockPath).catch(() => {
         });
         continue;
       }
-      await (0, import_promises2.setTimeout)(RETRY_INTERVAL_MS);
+      await (0, import_promises5.setTimeout)(RETRY_INTERVAL_MS);
     }
   }
 }
 async function lockFileExists(lockPath) {
   try {
-    await import_promises.default.stat(lockPath);
+    await import_promises4.default.stat(lockPath);
     return true;
   } catch (err) {
     return err.code !== "ENOENT";
   }
 }
 async function releaseLock(lockPath) {
-  await import_promises.default.unlink(lockPath).catch(() => {
+  await import_promises4.default.unlink(lockPath).catch(() => {
   });
 }
 function isAlive(pid) {
@@ -1388,9 +1228,9 @@ function isAlive(pid) {
 }
 
 // src/logger.ts
-var import_node_fs2 = __toESM(require("fs"), 1);
-var import_node_path3 = __toESM(require("path"), 1);
-var import_node_crypto5 = require("crypto");
+var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
+var import_node_crypto3 = require("crypto");
 var import_gg_ai2 = require("@kenkaiiii/gg-ai");
 var MAX_BYTES = 10 * 1024 * 1024;
 var MIN_HEADROOM_BYTES = 64 * 1024;
@@ -1406,14 +1246,14 @@ var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath, force = false) {
   try {
-    const st = import_node_fs2.default.statSync(filePath);
+    const st = import_node_fs3.default.statSync(filePath);
     if (!force && st.size <= MAX_BYTES - MIN_HEADROOM_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      import_node_fs2.default.unlinkSync(rotated);
+      import_node_fs3.default.unlinkSync(rotated);
     } catch {
     }
-    import_node_fs2.default.renameSync(filePath, rotated);
+    import_node_fs3.default.renameSync(filePath, rotated);
   } catch {
   }
 }
@@ -1421,18 +1261,18 @@ function rotateOpenLog() {
   if (fd === null || logPath === null) return false;
   const sizeBefore = fileBytes;
   try {
-    import_node_fs2.default.closeSync(fd);
+    import_node_fs3.default.closeSync(fd);
   } catch {
   }
   fd = null;
   rotateIfNeeded(logPath, true);
   try {
-    fd = import_node_fs2.default.openSync(logPath, "a");
-    fileBytes = import_node_fs2.default.fstatSync(fd).size;
+    fd = import_node_fs3.default.openSync(logPath, "a");
+    fileBytes = import_node_fs3.default.fstatSync(fd).size;
   } catch {
     if (fd !== null) {
       try {
-        import_node_fs2.default.closeSync(fd);
+        import_node_fs3.default.closeSync(fd);
       } catch {
       }
     }
@@ -1448,22 +1288,22 @@ function openLog(filePath, name) {
   appName = name;
   exactSecrets = (0, import_gg_ai2.environmentSecrets)(process.env);
   try {
-    import_node_fs2.default.mkdirSync(import_node_path3.default.dirname(filePath), { recursive: true, mode: 448 });
+    import_node_fs3.default.mkdirSync(import_node_path4.default.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = import_node_fs2.default.openSync(filePath, "a");
+    fd = import_node_fs3.default.openSync(filePath, "a");
   } catch {
     fd = null;
     fileBytes = 0;
     return false;
   }
   try {
-    fileBytes = import_node_fs2.default.fstatSync(fd).size;
+    fileBytes = import_node_fs3.default.fstatSync(fd).size;
   } catch {
     try {
-      import_node_fs2.default.closeSync(fd);
+      import_node_fs3.default.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1473,10 +1313,10 @@ function openLog(filePath, name) {
   logPath = filePath;
   processBytes = 0;
   rotationFailed = false;
-  sessionId = (0, import_node_crypto5.randomBytes)(4).toString("hex");
+  sessionId = (0, import_node_crypto3.randomBytes)(4).toString("hex");
   try {
     if (fileBytes < MAX_BYTES) {
-      const written = import_node_fs2.default.writeSync(fd, "\n");
+      const written = import_node_fs3.default.writeSync(fd, "\n");
       fileBytes += written;
       processBytes += written;
     }
@@ -1511,9 +1351,9 @@ function log(level, category, message, data) {
 `;
     try {
       if (fileBytes + Buffer.byteLength(capLine) <= MAX_BYTES) {
-        fileBytes += import_node_fs2.default.writeSync(fd, capLine);
+        fileBytes += import_node_fs3.default.writeSync(fd, capLine);
       }
-      import_node_fs2.default.closeSync(fd);
+      import_node_fs3.default.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1523,7 +1363,7 @@ function log(level, category, message, data) {
   if (fileBytes + lineBytes > MAX_BYTES && !rotationFailed && !rotateOpenLog()) return;
   if (fd === null) return;
   try {
-    const written = import_node_fs2.default.writeSync(fd, line);
+    const written = import_node_fs3.default.writeSync(fd, line);
     fileBytes += written;
     processBytes += written;
   } catch {
@@ -1536,7 +1376,7 @@ function closeLogger(opts) {
   if (fd !== null) {
     if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
     try {
-      if (fd !== null) import_node_fs2.default.closeSync(fd);
+      if (fd !== null) import_node_fs3.default.closeSync(fd);
     } catch {
     }
   }
@@ -1552,7 +1392,7 @@ function closeLogger(opts) {
 }
 
 // src/hidden-providers.ts
-var HIDDEN_PROVIDERS = ["gemini"];
+var HIDDEN_PROVIDERS = [];
 function isHiddenProvider(provider) {
   return HIDDEN_PROVIDERS.includes(provider);
 }
@@ -1643,22 +1483,76 @@ async function detectXiaomiTokenPlanBaseUrl(apiKey, options = {}) {
 }
 
 // src/auth-storage.ts
-var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
-var XAI_OAUTH_KEY = "xai-oauth";
-var DUAL_AUTH_PROVIDERS = [
+var OPENAI_CHATGPT_KEY = "openai-chatgpt";
+var KIMI_CODE_KEY = "kimi-code";
+var RETIRED_SIGN_INS = [
+  {
+    provider: "anthropic",
+    storageKey: "anthropic",
+    message: "Your old Claude sign-in no longer works. Sign in with Claude again to keep using your subscription."
+  },
+  {
+    provider: "openai",
+    storageKey: "openai",
+    message: "Your old ChatGPT sign-in no longer works. Continue with ChatGPT again, or add an OpenAI API key."
+  },
   {
     provider: "moonshot",
-    oauthKey: MOONSHOT_OAUTH_KEY,
-    oauthLabel: "Kimi OAuth",
-    apiKeyLabel: "Moonshot API key",
-    restoreHint: 'Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+    storageKey: "moonshot-oauth",
+    message: "Kimi sign-in was removed. Paste a Kimi Code plan key from the Kimi Code Console, or a Moonshot API key."
   },
   {
     provider: "xai",
-    oauthKey: XAI_OAUTH_KEY,
-    oauthLabel: "Grok OAuth",
-    apiKeyLabel: "xAI API key",
-    restoreHint: 'Run "ggcoder login" and choose Grok OAuth to restore OAuth auth.'
+    storageKey: "xai-oauth",
+    message: "Grok sign-in was removed: xAI offers SuperGrok and X Premium usage only in apps it partners with. Add an xAI API key instead."
+  },
+  {
+    provider: "gemini",
+    storageKey: "gemini",
+    message: "Google sign-in was removed. Add a Gemini API key from Google AI Studio instead."
+  }
+];
+function isRetiredEntry(retired, value) {
+  if (!value) return false;
+  switch (retired.storageKey) {
+    case "anthropic":
+      return isLegacyClaudeOAuth(value);
+    // These slots now hold API keys; only a refreshable sign-in token is retired.
+    case "openai":
+    case "gemini":
+      return Boolean(value.refreshToken) || Boolean(value.accountId) || Boolean(value.projectId);
+    default:
+      return true;
+  }
+}
+function isRetiredStorageKey(data, storageKey) {
+  return RETIRED_SIGN_INS.some(
+    (r) => r.storageKey === storageKey && isRetiredEntry(r, data[storageKey])
+  );
+}
+function usableEntry(data, storageKey) {
+  return isRetiredStorageKey(data, storageKey) ? void 0 : data[storageKey];
+}
+function storageKeyProvider(storageKey) {
+  if (storageKey === OPENAI_CHATGPT_KEY) return "openai";
+  if (storageKey === KIMI_CODE_KEY) return "moonshot";
+  if (storageKey === XIAOMI_CREDITS_KEY) return "xiaomi";
+  if (storageKey === GEMINI_API_KEY) return "gemini";
+  return storageKey;
+}
+function apiKeyStorageKeys(provider) {
+  if (provider === "moonshot") return [KIMI_CODE_KEY, "moonshot"];
+  if (provider === "xiaomi") return ["xiaomi", XIAOMI_CREDITS_KEY];
+  if (provider === "gemini") return [GEMINI_API_KEY];
+  return [provider];
+}
+var DUAL_AUTH_PROVIDERS = [
+  {
+    provider: "openai",
+    oauthKey: OPENAI_CHATGPT_KEY,
+    oauthLabel: "ChatGPT plan",
+    apiKeyLabel: "OpenAI API key",
+    restoreHint: 'Run "ggcoder login" and choose Continue with ChatGPT to use your ChatGPT plan again.'
   }
 ];
 function dualAuthProvider(provider) {
@@ -1683,14 +1577,20 @@ function activeBaseUrlEntry(data, provider) {
   const dual = dualAuthProvider(provider);
   if (dual) {
     const oauth = data[dual.oauthKey];
+    const apiKey = usableEntry(data, dual.provider);
     if (oauth) {
       const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && data[dual.provider]) return data[dual.provider];
+      if (Date.now() < exhaustedUntil && apiKey) return apiKey;
       return oauth;
     }
-    return data[dual.provider];
+    return apiKey;
   }
-  return data[provider];
+  const key = apiKeyStorageKeys(provider).find((k) => usableEntry(data, k));
+  const entry = key ? data[key] : void 0;
+  if (key === KIMI_CODE_KEY && entry && !entry.baseUrl) {
+    return { ...entry, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
+  }
+  return entry;
 }
 var MINIMAX_REGION_RETRY_MS = 5 * 60 * 1e3;
 var miniMaxRegionProbes = /* @__PURE__ */ new Map();
@@ -1701,9 +1601,17 @@ function cachedMiniMaxRegion(apiKey) {
   miniMaxRegionProbes.set(apiKey, { at: Date.now(), result });
   return result;
 }
+var kimiRegionProbes = /* @__PURE__ */ new Map();
+function cachedKimiRegion(apiKey) {
+  const cached = kimiRegionProbes.get(apiKey);
+  if (cached && Date.now() - cached.at < MINIMAX_REGION_RETRY_MS) return cached.result;
+  const result = detectKimiCodeBaseUrl(apiKey).catch(() => void 0);
+  kimiRegionProbes.set(apiKey, { at: Date.now(), result });
+  return result;
+}
 function readStoredBaseUrlSync(authFile, provider) {
   try {
-    const data = JSON.parse((0, import_node_fs3.readFileSync)(authFile, "utf-8"));
+    const data = JSON.parse((0, import_node_fs4.readFileSync)(authFile, "utf-8"));
     return activeBaseUrlEntry(data, provider)?.baseUrl;
   } catch {
     return void 0;
@@ -1716,19 +1624,7 @@ function refreshThresholdMs(creds) {
   return Math.max(MIN_REFRESH_THRESHOLD_MS, lifetimeMs * REFRESH_THRESHOLD_RATIO);
 }
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
-var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
-  "glm",
-  "moonshot",
-  "xiaomi",
-  "minimax",
-  "deepseek",
-  "openrouter",
-  "huggingface",
-  "sakana",
-  "xai",
-  // Local endpoints: a fixed (usually placeholder) key, never refreshable.
-  "local"
-]);
+var REFRESHABLE_STORAGE_KEYS = /* @__PURE__ */ new Set([OPENAI_CHATGPT_KEY]);
 var AuthStorage = class {
   data = {};
   filePath;
@@ -1749,10 +1645,12 @@ var AuthStorage = class {
   refreshLocks = /* @__PURE__ */ new Map();
   detectMiniMaxRegion;
   detectXiaomiCluster;
+  detectKimiRegion;
   constructor(filePath, options) {
     this.filePath = filePath ?? getAppPaths().authFile;
     this.detectMiniMaxRegion = options?.detectMiniMaxBaseUrl ?? cachedMiniMaxRegion;
     this.detectXiaomiCluster = options?.detectXiaomiTokenPlanBaseUrl ?? detectXiaomiTokenPlanBaseUrl;
+    this.detectKimiRegion = options?.detectKimiCodeBaseUrl ?? cachedKimiRegion;
   }
   /** Path to the on-disk auth file. Useful for status output. */
   get path() {
@@ -1780,27 +1678,78 @@ var AuthStorage = class {
     return keys.find((key) => Boolean(this.data[key]));
   }
   /**
-   * True if the user has any usable auth for the logical provider. For a
-   * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
-   * satisfies it.
+   * True if the user has any usable auth for the logical provider: the plan
+   * sign-in or any of its API keys. A retired sign-in doesn't count.
    */
   async hasProviderAuth(provider) {
     if (isHiddenProvider(provider)) return false;
     await this.ensureFresh();
     const dual = dualAuthProvider(provider);
     if (dual) {
-      return Boolean(this.data[dual.oauthKey] || this.data[dual.provider]);
+      return Boolean(this.data[dual.oauthKey] || usableEntry(this.data, dual.provider));
     }
-    if (provider === "xiaomi") {
-      return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
-    }
-    if (provider === "gemini") {
-      return Boolean(this.data["gemini"] || this.data[GEMINI_API_KEY]);
+    if (provider === "anthropic") {
+      return Boolean(this.data.anthropic) && !isLegacyClaudeOAuth(this.data.anthropic) || isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY]);
     }
     if (provider === "local") {
       return Object.keys(this.data).some((key) => key.startsWith(LOCAL_AUTH_KEY_PREFIX));
     }
-    return Boolean(this.data[provider]);
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /** True if any of `provider`'s API keys is stored. A retired sign-in in a key slot doesn't count. */
+  async hasApiKey(provider) {
+    await this.ensureFresh();
+    if (provider === "anthropic" && isLegacyClaudeOAuth(this.data.anthropic)) return false;
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /**
+   * `provider`'s first stored API key, never its plan sign-in. For calls that
+   * only an API key may make (OpenAI's Images API isn't on the ChatGPT plan).
+   */
+  async resolveApiKey(provider) {
+    await this.ensureFresh();
+    for (const key of apiKeyStorageKeys(provider)) {
+      const creds = usableEntry(this.data, key);
+      if (creds && !(provider === "anthropic" && isLegacyClaudeOAuth(creds))) return creds;
+    }
+    throw new NotLoggedInError(provider);
+  }
+  /** True when the user signed in with Claude through Claude Code (marker only, no token). */
+  async hasClaudeCodeLogin() {
+    await this.ensureFresh();
+    return isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY]);
+  }
+  /** Record a Claude Code sign-in. Claude Code keeps the token; auth.json gets only the marker. */
+  async setClaudeCodeLogin() {
+    await this.mutateLatest((latest) => {
+      latest[CLAUDE_CODE_AUTH_KEY] = { ...CLAUDE_CODE_AUTH_MARKER };
+      if (isLegacyClaudeOAuth(latest.anthropic)) delete latest.anthropic;
+    });
+  }
+  /** Retired sign-ins still on disk, so the UI can ask the user to reconnect. */
+  async legacySignIns() {
+    await this.ensureFresh();
+    return RETIRED_SIGN_INS.filter((r) => isRetiredEntry(r, this.data[r.storageKey]));
+  }
+  /**
+   * Remove `provider`'s retired sign-in, if any. True when one was removed, so
+   * the caller can tell the user once to reconnect.
+   */
+  async takeLegacySignIn(provider) {
+    const retired = RETIRED_SIGN_INS.find((r) => r.provider === provider);
+    if (!retired) return false;
+    await this.ensureFresh();
+    if (!isRetiredEntry(retired, this.data[retired.storageKey])) return false;
+    let removed = false;
+    await this.mutateLatest((latest) => {
+      if (!isRetiredEntry(retired, latest[retired.storageKey])) return;
+      delete latest[retired.storageKey];
+      removed = true;
+    });
+    return removed;
+  }
+  async clearClaudeCodeLogin() {
+    await this.clearCredentials(CLAUDE_CODE_AUTH_KEY);
   }
   /** Endpoint ids that currently have a `local:<id>` credential stored. */
   async listLocalEndpointIds() {
@@ -1835,18 +1784,18 @@ var AuthStorage = class {
     const oauthCreds = dual ? this.data[dual.oauthKey] : void 0;
     if (dual && oauthCreds) {
       const exhaustedUntil = oauthCreds.usageExhaustedUntil ?? 0;
-      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data[dual.provider]);
+      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(usableEntry(this.data, dual.provider));
       if (!apiKeyActive) return false;
     }
-    return STATIC_API_KEY_PROVIDERS.has(provider);
+    return !REFRESHABLE_STORAGE_KEYS.has(provider);
   }
   /**
    * The base URL on the credential that is active right now, if any.
    * Synchronous — call only after load()/resolveCredentials() populated the
-   * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
-   * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
-   * resolveCredentials would serve (i.e. not currently usage-exhausted with an
-   * API key configured).
+   * snapshot. For a dual-auth provider this is the plan endpoint whenever the
+   * sign-in is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured); for a plan/pay-per-token key
+   * split it is the plan key's endpoint when one is stored.
    */
   getStoredBaseUrl(provider) {
     return activeBaseUrlEntry(this.data, provider)?.baseUrl;
@@ -1855,7 +1804,7 @@ var AuthStorage = class {
     const first = !this.loaded;
     await withFileLock(this.filePath, async () => {
       try {
-        const content = await import_promises3.default.readFile(this.filePath, "utf-8");
+        const content = await import_promises6.default.readFile(this.filePath, "utf-8");
         this.data = JSON.parse(content);
         if (first) {
           log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
@@ -1901,7 +1850,7 @@ var AuthStorage = class {
     }
     let changed;
     try {
-      const stat = await import_promises3.default.stat(this.filePath);
+      const stat = await import_promises6.default.stat(this.filePath);
       changed = stat.ino !== this.snapshotIno || stat.mtimeMs !== this.snapshotMtimeMs || stat.size !== this.snapshotSize;
     } catch {
       changed = this.snapshotSize !== -1;
@@ -1914,7 +1863,7 @@ var AuthStorage = class {
    */
   async rememberSnapshot() {
     try {
-      const stat = await import_promises3.default.stat(this.filePath);
+      const stat = await import_promises6.default.stat(this.filePath);
       this.snapshotMtimeMs = stat.mtimeMs;
       this.snapshotSize = stat.size;
       this.snapshotIno = stat.ino;
@@ -1969,9 +1918,34 @@ var AuthStorage = class {
     });
     return { ...creds, baseUrl };
   }
-  async setCredentials(provider, creds) {
+  /**
+   * A Kimi Code key saved without an endpoint gets the host that issued it
+   * (`api.kimi.com` or `api.kimi.ai`), saved so the check runs once.
+   */
+  async withKimiRegion(creds) {
+    const baseUrl = await this.detectKimiRegion(creds.accessToken);
+    if (!baseUrl) return { ...creds, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
+    log("INFO", "auth", `Kimi Code key belongs to ${baseUrl} \u2014 saved for future requests`);
+    await this.mutateLatest((latest) => {
+      const current = latest[KIMI_CODE_KEY];
+      if (current?.accessToken === creds.accessToken && !current.baseUrl) {
+        current.baseUrl = baseUrl;
+      }
+    });
+    return { ...creds, baseUrl };
+  }
+  /**
+   * Store `creds` under `storageKey`. Connecting a provider again also removes
+   * its retired sign-in, which is what the reconnect notice asked for.
+   */
+  async setCredentials(storageKey, creds) {
+    const provider = storageKeyProvider(storageKey);
     await this.mutateLatest((latest) => {
-      latest[provider] = creds;
+      for (const retired of RETIRED_SIGN_INS) {
+        if (retired.provider !== provider || retired.storageKey === storageKey) continue;
+        if (isRetiredEntry(retired, latest[retired.storageKey])) delete latest[retired.storageKey];
+      }
+      latest[storageKey] = creds;
     });
   }
   /**
@@ -2008,9 +1982,9 @@ var AuthStorage = class {
    * Mark the credential stored under `storageKey` as usage-exhausted until
    * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
    * 15-minute default when no reset time is known. While the mark is in the
-   * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-   * instead of the subscription OAuth credential (when both are configured) — OAuth
-   * stays the preferred credential and is retried automatically once the mark
+   * future, `resolveCredentials("openai")` serves the OpenAI API key instead of
+   * the ChatGPT plan sign-in (when both are configured) — the plan stays the
+   * preferred credential and is retried automatically once the mark
    * lapses. Persisted to auth.json so a restart (or another gg-app window)
    * doesn't burn a request rediscovering the same exhausted window. No-op if
    * nothing is stored under `storageKey`.
@@ -2055,12 +2029,12 @@ var AuthStorage = class {
       await this.ensureFresh();
     }
     const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
-    if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
+    if (!directStorageKeys.some((key) => Boolean(usableEntry(this.data, key))) && !(provider === "anthropic" && this.data[CLAUDE_CODE_AUTH_KEY])) {
       await this.reloadLatest();
     }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
-        const creds2 = this.data[key];
+        const creds2 = usableEntry(this.data, key);
         if (!creds2) continue;
         if (key !== provider && dualAuthProviderByOAuthKey(key)) {
           return await this.resolveCredentials(key, {
@@ -2074,21 +2048,29 @@ var AuthStorage = class {
             ...opts.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
           });
         }
+        if (key === KIMI_CODE_KEY && !creds2.baseUrl) return await this.withKimiRegion(creds2);
         return creds2;
       }
       throw new NotLoggedInError(provider);
     }
+    if (provider === "anthropic" && (!this.data.anthropic || isLegacyClaudeOAuth(this.data.anthropic))) {
+      if (isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY])) {
+        return { accessToken: "", refreshToken: "", expiresAt: Number.MAX_SAFE_INTEGER };
+      }
+      if (this.data.anthropic) throw new NotLoggedInError(provider);
+    }
     const dual = dualAuthProvider(provider);
     const dualOAuthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    const dualApiKey = dual ? usableEntry(this.data, dual.provider) : void 0;
     if (dual && dualOAuthCreds) {
       const exhaustedUntil = dualOAuthCreds.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && this.data[dual.provider]) {
+      if (Date.now() < exhaustedUntil && dualApiKey) {
         log(
           "WARN",
           "auth",
           `${dual.oauthLabel} usage window is exhausted \u2014 using the ${dual.apiKeyLabel} until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
         );
-        return this.data[dual.provider];
+        return dualApiKey;
       }
       try {
         return await this.resolveCredentials(dual.oauthKey, {
@@ -2096,23 +2078,24 @@ var AuthStorage = class {
           ...opts?.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
         });
       } catch (err) {
-        if (err instanceof NotLoggedInError && this.data[dual.provider]) {
+        if (err instanceof NotLoggedInError && dualApiKey) {
           log(
             "WARN",
             "auth",
             `${dual.oauthLabel} credential is no longer valid \u2014 falling back to the ${dual.apiKeyLabel}. ${dual.restoreHint}`
           );
-          return this.data[dual.provider];
+          return dualApiKey;
         }
         throw err;
       }
     }
-    const creds = this.data[provider];
+    const creds = usableEntry(this.data, provider);
     if (!creds) {
       throw new NotLoggedInError(provider);
     }
-    if (STATIC_API_KEY_PROVIDERS.has(provider)) {
+    if (!REFRESHABLE_STORAGE_KEYS.has(provider)) {
       if (provider === "minimax" && !creds.baseUrl) return await this.withMiniMaxRegion(creds);
+      if (provider === KIMI_CODE_KEY && !creds.baseUrl) return await this.withKimiRegion(creds);
       return creds;
     }
     if (!opts?.forceRefresh && Date.now() < creds.expiresAt - refreshThresholdMs(creds)) {
@@ -2140,13 +2123,14 @@ var AuthStorage = class {
         this.data = latest;
         return latestCreds;
       }
-      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : provider === XAI_OAUTH_KEY ? refreshXaiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(latestCreds.refreshToken);
+        refreshed = await refreshChatGPTToken(latestCreds);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
+        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh|token_expired|refresh_token_(?:expired|invalidated|reused)/i.test(
+          msg
+        ) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
           const current = await readAuthData(this.filePath);
           const currentCreds = current[provider];
@@ -2166,15 +2150,10 @@ var AuthStorage = class {
         }
         throw err;
       }
-      if (!refreshed.accountId && latestCreds.accountId) {
-        refreshed.accountId = latestCreds.accountId;
-      }
-      if (!refreshed.projectId && latestCreds.projectId) {
-        refreshed.projectId = latestCreds.projectId;
-      }
-      if (!refreshed.baseUrl && latestCreds.baseUrl) {
-        refreshed.baseUrl = latestCreds.baseUrl;
-      }
+      refreshed = {
+        ...pick(latestCreds, ["accountId", "baseUrl", "clientId", "idToken", "scopes"]),
+        ...refreshed
+      };
       latest[provider] = refreshed;
       this.data = latest;
       await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
@@ -2197,9 +2176,14 @@ var AuthStorage = class {
     return creds.accessToken;
   }
 };
+function pick(value, keys) {
+  const out = {};
+  for (const key of keys) if (value[key] !== void 0) out[key] = value[key];
+  return out;
+}
 async function readAuthData(filePath) {
   try {
-    const content = await import_promises3.default.readFile(filePath, "utf-8");
+    const content = await import_promises6.default.readFile(filePath, "utf-8");
     return JSON.parse(content);
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -2207,12 +2191,12 @@ async function readAuthData(filePath) {
   }
 }
 async function atomicWriteFile(filePath, content) {
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto6.default.randomUUID().slice(0, 8)}.tmp`;
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto4.default.randomUUID().slice(0, 8)}.tmp`;
   try {
-    await import_promises3.default.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await import_promises3.default.rename(tmpPath, filePath);
+    await import_promises6.default.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await import_promises6.default.rename(tmpPath, filePath);
   } catch (err) {
-    await import_promises3.default.unlink(tmpPath).catch(() => {
+    await import_promises6.default.unlink(tmpPath).catch(() => {
     });
     throw err;
   }
@@ -2244,7 +2228,8 @@ var CODEX_FAST_BILLING = {
   detail: "Codex Fast mode uses your ChatGPT plan limits at 2.5x the standard rate (purchased credits at 2x).",
   paid: false
 };
-var GEMINI_AUTH_KEYS = [GEMINI_API_KEY, "gemini"];
+var GEMINI_AUTH_KEYS = [GEMINI_API_KEY];
+var KIMI_AUTH_KEYS = [KIMI_CODE_KEY, "moonshot"];
 var MODELS = [
   // ── Anthropic ──────────────────────────────────────────
   // NOTE: Claude Mythos 5.1 (`claude-mythos-5-1`, 2026-09-01) is kept commented
@@ -2374,14 +2359,13 @@ var MODELS = [
   {
     // GPT-6 Astra — "Our most capable model for complex, demanding work."
     // (Codex catalog priority 2, listed for every ChatGPT plan, requires a
-    // Codex client >= 0.153.0 — see CODEX_CLIENT_VERSION). Same split as 5.6:
-    // 1.05M on the public Responses API, 272K on the ChatGPT OAuth route
+    // Codex client >= 0.153.0). Same split as 5.6:
+    // 1.05M on the public Responses API, 272K on the ChatGPT plan route
     // (openai/codex models.json, `gpt-6-astra`). Reasoning ladder low → medium
     // → high → xhigh → max → ultra; `ultra` is the Codex orchestration preset
     // (multi_agent v2) and is Codex-only — the public API tops out at `max`.
-    // Note: through a plain API key OpenAI requires the Responses API for tool
-    // calling on Astra, so the Chat Completions path is text-only; the OAuth
-    // Codex route is the supported way to use it as an agent.
+    // OpenAI requires the Responses API for tool calling on Astra, so both
+    // the ChatGPT plan and API keys ride gg-ai's Responses transport.
     id: "gpt-6-astra",
     name: "GPT-6 Astra",
     provider: "openai",
@@ -2415,18 +2399,16 @@ var MODELS = [
     billing: CODEX_FAST_BILLING
   },
   // GPT-6 Sol + Luna — released 2026-09-22 below Astra, replacing the whole
-  // GPT-5.6 family (Sol/Terra/Luna; there is no GPT-6 Terra — OpenAI's Codex
+  // GPT-5.6 family (Sol/Terra/Luna; there was no GPT-6 Terra — OpenAI's Codex
   // catalog upgrades 5.6 Terra to 6 Sol). GPT-6.1 Sol (2026-09-29) then replaced
-  // GPT-6 Sol. Same window split as Astra: 1.05M on the public Responses API,
+  // GPT-6 Sol, and GPT-6.1 Terra (2026-10-26) sits between Sol and Luna. Same window split as Astra: 1.05M on the public Responses API,
   // 272K on the Codex route; 128K output, text+image input, freeform
   // apply_patch, responses-lite transport. The GPT-5.6 ids and `gpt-6-sol` are
   // retired — a saved session on one falls back to the provider default on
   // next start.
   {
     // GPT-6.1 Sol — "Latest workhorse model for coding and everyday work."
-    // (Codex priority 1, default low). The catalog says Codex client >= 0.153.0,
-    // but the ChatGPT backend only serves it from 0.159.0 (see
-    // CODEX_CLIENT_VERSION). $2/$10 MTok, cached input $0.10. Ladder low →
+    // (Codex priority 1, default low). $2/$10 MTok, cached input $0.10. Ladder low →
     // medium → high → xhigh → max → ultra; ultra is the Codex orchestration
     // preset (xhigh effort on the wire + proactive local subagent delegation).
     id: "gpt-6.1-sol",
@@ -2459,6 +2441,40 @@ var MODELS = [
     maxThinkingLevel: "ultra",
     billing: CODEX_FAST_BILLING
   },
+  {
+    // GPT-6.1 Terra (Codex priority 7, default low, client >= 0.153.0). $1/$5
+    // MTok, cached input $0.05. Unlike Sol/Astra the Codex route gets a 500K
+    // window (catalog `context_window`). Same ladder and Ultra preset as Sol.
+    id: "gpt-6.1-terra",
+    name: "GPT-6.1 Terra",
+    provider: "openai",
+    contextWindow: 105e4,
+    codexContextWindow: 5e5,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    defaultThinkingLevel: "low",
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "ultra"
+  },
+  {
+    // Codex Fast mode for 6.1 Terra ("1.5x speed") — see `gpt-6-astra-fast`
+    // for the wire mapping and billing.
+    id: "gpt-6.1-terra-fast",
+    name: "GPT-6.1 Terra Fast",
+    provider: "openai",
+    contextWindow: 105e4,
+    codexContextWindow: 5e5,
+    maxOutputTokens: 128e3,
+    supportsThinking: true,
+    defaultThinkingLevel: "low",
+    supportsImages: true,
+    supportsVideo: false,
+    costTier: "medium",
+    maxThinkingLevel: "ultra",
+    billing: CODEX_FAST_BILLING
+  },
   {
     // Luna — "Fast and affordable model for easier tasks." (Codex priority 4,
     // default medium, needs a Codex client >= 0.155.0). $0.10/$0.50 MTok.
@@ -2579,8 +2595,8 @@ var MODELS = [
     maxThinkingLevel: "high",
     authStorageKeys: GEMINI_AUTH_KEYS
   },
-  // Keep 3.1 Flash Lite first for the working OAuth default and fast-model routing.
-  // New GA models are opt-in; Code Assist access varies by account. Gemini 3.7
+  // Keep 3.1 Flash Lite first for the default and fast-model routing.
+  // Gemini 3.7
   // Flash is retired: Google deprecated it on 2026-10-08 and routes every
   // `gemini-3.7-flash` request to 3.8 Flash (ai.google.dev/gemini-api/docs/
   // changelog), so a saved session on it falls back to the provider default.
@@ -2613,9 +2629,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Wire name `gemini-3-flash` — the Code Assist (OAuth) backend rejects the
-    // display string `gemini-3.5-flash` with a 404, so gemini-cli keeps this
-    // alternative name (SECONDARY_GEMINI_3_5_FLASH_MODEL) for that endpoint.
+    // Wire name `gemini-3-flash`, the id Google serves 3.5 Flash under.
     id: "gemini-3-flash",
     name: "Gemini 3.5 Flash",
     provider: "gemini",
@@ -2630,9 +2644,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Gemini 3.1 Pro is public preview — gated behind Code Assist preview
-    // enablement, so free/personal OAuth accounts 404 on it (see
-    // ACCOUNT_GATED_MODELS in gg-ai's gemini provider).
+    // Gemini 3.1 Pro is public preview.
     id: "gemini-3.1-pro-preview",
     name: "Gemini 3.1 Pro (Preview)",
     provider: "gemini",
@@ -2649,8 +2661,8 @@ var MODELS = [
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
   // work, and deep reasoning. Its effort ladder is server-declared as
-  // low/high/max on both the public API (default max) and the Kimi For Coding
-  // OAuth endpoint (default high); thinking can also be fully disabled.
+  // low/high/max on both the public API (default max) and the Kimi Code plan
+  // endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -2664,13 +2676,14 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "high",
-    maxThinkingLevel: "max"
+    maxThinkingLevel: "max",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
-  // K2.8 Preview (2026-09-11) is served only on the Kimi For Coding OAuth
-  // endpoint, under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
+  // K2.8 Preview (2026-09-11) is served only on the Kimi Code plan endpoint,
+  // under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
   // display_name "K2.8 Preview", 1M context, image + video input, efforts
-  // low/high/max default max). The public API-key endpoint does not serve it,
-  // so it resolves from the Kimi sign-in credential only.
+  // low/high/max default max). The public Moonshot API does not serve it, so
+  // it resolves from a Kimi Code plan key only.
   {
     id: "kimi-for-coding",
     name: "Kimi K2.8 Preview",
@@ -2683,7 +2696,7 @@ var MODELS = [
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
     maxThinkingLevel: "max",
-    authStorageKeys: [MOONSHOT_OAUTH_KEY]
+    authStorageKeys: [KIMI_CODE_KEY]
   },
   // K2.7 Code is requested by its pinned id (not the `kimi-for-coding` alias
   // that moved to K2.8), so it stays the real K2.7 on both endpoints.
@@ -2698,7 +2711,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // K2.7 Code HighSpeed — the same model as K2.7 Code served at ~180 tok/s
   // (up to ~260 on short contexts), 256K context (platform.kimi.ai model list,
@@ -2717,7 +2731,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // ── Z.AI (GLM) ─────────────────────────────────────────
   // Two GLM entries, both live on the coding endpoint (verified against its
@@ -3643,101 +3658,238 @@ function findProbedModel(probes, modelId) {
   return void 0;
 }
 
+// src/claude-code/usage.ts
+var import_promises7 = __toESM(require("fs/promises"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
+var USAGE_FILE = "usage.json";
+var WINDOWS = {
+  five_hour: { kind: "current", label: "5-hour" },
+  seven_day: { kind: "weekly", label: "Weekly" }
+};
+function finite(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function toWindow(key, raw) {
+  const shape = WINDOWS[key];
+  const fraction = finite(raw?.utilization);
+  if (!shape || fraction === void 0) return null;
+  const resetsAt = finite(raw?.resetsAt);
+  return {
+    ...shape,
+    usedPercent: Math.min(100, Math.max(0, fraction * 100)),
+    ...resetsAt !== void 0 ? { resetsAt: resetsAt * 1e3 } : {}
+  };
+}
+function mergeClaudeCodeRateLimit(info, previous, now = Date.now()) {
+  const reported = info.unifiedWindows ? Object.entries(info.unifiedWindows).map(([key, raw]) => toWindow(key, raw)) : info.rateLimitType ? [toWindow(info.rateLimitType, info)] : [];
+  const byKind = new Map(previous?.windows.map((w) => [w.kind, w]) ?? []);
+  for (const window of reported) if (window) byKind.set(window.kind, window);
+  const windows = [...byKind.values()].sort(
+    (a, b) => a.kind === b.kind ? 0 : a.kind === "current" ? -1 : 1
+  );
+  return { provider: "anthropic", displayName: "Anthropic", windows, fetchedAt: now };
+}
+function usagePath(opts) {
+  return import_node_path5.default.join(claudeCodeHome(opts), USAGE_FILE);
+}
+async function readClaudeCodeUsage(opts = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await import_promises7.default.readFile(usagePath(opts), "utf8"));
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed?.windows) || typeof parsed.fetchedAt !== "number") return null;
+  const now = opts.now ?? Date.now();
+  const windows = parsed.windows.filter(
+    (w) => (w.kind === "current" || w.kind === "weekly") && typeof w.usedPercent === "number" && (w.resetsAt === void 0 || w.resetsAt > now)
+  );
+  return { provider: "anthropic", displayName: "Anthropic", windows, fetchedAt: parsed.fetchedAt };
+}
+var writeQueue = Promise.resolve();
+function recordClaudeCodeRateLimit(info, opts = {}) {
+  const write = async () => {
+    const now = opts.now ?? Date.now();
+    const next = mergeClaudeCodeRateLimit(info, await readClaudeCodeUsage({ ...opts, now }), now);
+    if (next.windows.length === 0) return;
+    const file = usagePath(opts);
+    await import_promises7.default.mkdir(import_node_path5.default.dirname(file), { recursive: true });
+    await import_promises7.default.writeFile(file, JSON.stringify(next), "utf8");
+  };
+  writeQueue = writeQueue.then(write).catch(() => {
+  });
+  return writeQueue;
+}
+async function clearClaudeCodeUsage(opts = {}) {
+  await writeQueue;
+  await import_promises7.default.rm(usagePath(opts), { force: true }).catch(() => {
+  });
+}
+
+// src/claude-code/sign-in.ts
+async function signInWithClaudeCode(auth, callbacks, opts = {}) {
+  if (!opts.binary && !resolveClaudeCodeBinary(opts)) {
+    callbacks.onStatus("Downloading Claude Code (one time)\u2026");
+    await ensureClaudeCodeBinary({
+      ...opts,
+      onProgress: (progress) => {
+        callbacks.onStatus(formatClaudeCodeInstallProgress(progress));
+        opts.onProgress?.(progress);
+      }
+    });
+  }
+  let status = await claudeCodeAuthStatus(opts);
+  if (!status.loggedIn) {
+    callbacks.onStatus("Opening Claude sign-in\u2026");
+    await loginClaudeCode(callbacks, opts);
+    status = await claudeCodeAuthStatus(opts);
+  }
+  if (!status.loggedIn) throw new Error("Claude sign-in didn't finish. Try again.");
+  await auth.setClaudeCodeLogin();
+  return status;
+}
+async function signOutOfClaudeCode(auth, opts = {}) {
+  await auth.clearClaudeCodeLogin();
+  await clearClaudeCodeUsage(opts);
+  try {
+    await logoutClaudeCode(opts);
+  } catch (err) {
+    log(
+      "WARN",
+      "auth",
+      `claude auth logout failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+
 // src/auth-providers.ts
+function apiKeyDetails(label, billing, when = "") {
+  return { apikey: { method: "apikey", label, billing, when } };
+}
 var ALL_AUTH_PROVIDERS = [
   {
     value: "anthropic",
     label: "Anthropic",
     description: "Claude Fable 5.1, Opus 5.5, Opus 5.5 Fast, Sonnet 5.5, Haiku 5.5",
-    methods: ["oauth"]
-  },
-  {
-    value: "openai",
-    label: "OpenAI",
-    description: "GPT-6 Astra, GPT-6 Astra Fast, GPT-6.1 Sol, GPT-6.1 Sol Fast, GPT-6 Luna, GPT-6 Luna Fast",
-    methods: ["oauth"]
-  },
-  {
-    value: "gemini",
-    label: "Gemini",
-    description: "Gemini 3.8 Flash, 3.5 Flash Lite, 3.1 Flash Lite, 3.5 Flash, 3.1 Pro (Preview)",
     methods: ["oauth", "apikey"],
-    apiKeyLabel: "Gemini",
-    apiKeyBaseUrl: GEMINI_API_KEY_BASE_URL,
-    // Stored under its own key so it never overwrites the `gemini` OAuth login.
-    apiKeyVariants: [
-      { key: GEMINI_API_KEY, label: "Google AI Studio", baseUrl: GEMINI_API_KEY_BASE_URL }
-    ],
+    apiKeyLabel: "Anthropic",
     methodDetails: {
       oauth: {
         method: "oauth",
-        label: "Sign in with Google",
-        billing: "Gemini Code Assist Standard or Enterprise licence.",
-        when: "Personal Google accounts are no longer served here (Google ended it on June 18, 2026)."
+        label: "Sign in with Claude",
+        billing: "Uses your Claude Pro or Max plan.",
+        when: "Runs through Anthropic's Claude Code, which GG Coder downloads once (about 140 MB) the first time you pick this.",
+        requires: "A Claude Pro or Max subscription."
       },
       apikey: {
         method: "apikey",
-        label: "Gemini API key",
-        billing: "Pay-per-token from a Google AI Studio key.",
-        when: "Used first whenever it is set."
+        label: "Anthropic API key",
+        billing: "Pay-per-token from an Anthropic Console key.",
+        when: "No subscription needed. Used only while you are not signed in with Claude."
       }
     }
   },
   {
-    value: "xai",
-    label: "xAI (Grok)",
-    description: "Grok 4.7 \xB7 OAuth or API key",
+    value: "openai",
+    label: "OpenAI",
+    description: "GPT-6 Astra, GPT-6 Astra Fast, GPT-6.1 Sol, GPT-6.1 Sol Fast, GPT-6.1 Terra, GPT-6.1 Terra Fast, GPT-6 Luna, GPT-6 Luna Fast",
     methods: ["oauth", "apikey"],
-    apiKeyLabel: "xAI",
+    apiKeyLabel: "OpenAI",
     methodDetails: {
       oauth: {
         method: "oauth",
-        label: "Sign in with Grok",
-        billing: "Included with SuperGrok or X Premium.",
-        when: ""
+        label: "Continue with ChatGPT",
+        billing: "Uses your ChatGPT plan.",
+        when: "Signs in through OpenAI. Manage what GG Coder may use at chatgpt.com/settings/usage.",
+        requires: "A ChatGPT plan."
       },
       apikey: {
         method: "apikey",
-        label: "xAI API key",
-        billing: "Pay-per-token on console.x.ai credits.",
-        when: ""
+        label: "OpenAI API key",
+        billing: "Pay-per-token from an OpenAI Platform key.",
+        when: "No subscription needed. Covers you while your ChatGPT plan's usage is out."
       }
     }
   },
+  {
+    value: "gemini",
+    label: "Gemini",
+    description: "Gemini 3.8 Flash, 3.5 Flash Lite, 3.1 Flash Lite, 3.5 Flash, 3.1 Pro (Preview)",
+    methods: ["apikey"],
+    apiKeyLabel: "Gemini",
+    apiKeyBaseUrl: GEMINI_API_KEY_BASE_URL,
+    // Stored under its own key: `gemini` held the retired Google sign-in.
+    apiKeyVariants: [
+      {
+        key: GEMINI_API_KEY,
+        label: "Google AI Studio",
+        kind: "payg",
+        billing: "Pay-per-token from a Google AI Studio key.",
+        baseUrl: GEMINI_API_KEY_BASE_URL
+      }
+    ],
+    methodDetails: apiKeyDetails("Gemini API key", "Pay-per-token from a Google AI Studio key.")
+  },
+  {
+    value: "xai",
+    label: "xAI (Grok)",
+    description: "Grok 4.7",
+    methods: ["apikey"],
+    apiKeyLabel: "xAI",
+    methodDetails: apiKeyDetails(
+      "xAI API key",
+      "Pay-per-token from console.x.ai credits.",
+      "SuperGrok and X Premium usage is only offered in apps xAI partners with."
+    )
+  },
   {
     value: "moonshot",
-    label: "Moonshot",
-    description: "Kimi K3, K2.8 Preview (Kimi sign-in), K2.7 Code, K2.7 Code HighSpeed \xB7 OAuth or API key",
-    methods: ["oauth", "apikey"],
-    apiKeyLabel: "Moonshot",
-    methodDetails: {
-      oauth: {
-        method: "oauth",
-        label: "Sign in with Kimi",
-        billing: "Included with a Kimi For Coding plan.",
-        when: ""
+    label: "Kimi (Moonshot)",
+    description: "Kimi K3, K2.8 Preview (Kimi Code plan), K2.7 Code, K2.7 Code HighSpeed",
+    methods: ["apikey"],
+    apiKeyLabel: "Kimi",
+    apiKeyVariants: [
+      {
+        key: KIMI_CODE_KEY,
+        label: "Kimi Code plan",
+        kind: "plan",
+        billing: "Uses your Kimi Code plan. Create the key in the Kimi Code Console."
       },
-      apikey: {
-        method: "apikey",
-        label: "Moonshot API key",
-        billing: "Pay-per-token on Moonshot credits.",
-        when: ""
+      {
+        key: "moonshot",
+        label: "Moonshot API",
+        kind: "payg",
+        billing: "Pay-per-token from platform.moonshot.ai."
       }
-    }
+    ],
+    methodDetails: apiKeyDetails(
+      "Kimi API key",
+      "A Kimi Code plan key uses your plan; a Moonshot key is pay-per-token."
+    )
   },
   {
     value: "glm",
     label: "Z.AI (GLM)",
     description: "GLM-5.3, GLM-5.3-Flash",
     methods: ["apikey"],
-    apiKeyLabel: "Z.AI"
+    apiKeyLabel: "Z.AI",
+    methodDetails: apiKeyDetails(
+      "Z.AI API key",
+      "Pay-per-token from your Z.AI account balance.",
+      "GLM Coding Plan quota can't be used here: Z.AI limits the plan to the tools it lists."
+    )
   },
   {
     value: "minimax",
     label: "MiniMax",
     description: "MiniMax M3.1 Flash, M3",
     methods: ["apikey"],
-    apiKeyLabel: "MiniMax"
+    apiKeyLabel: "MiniMax",
+    methodDetails: apiKeyDetails(
+      "MiniMax API key",
+      "An M Plan key uses your plan; a pay-as-you-go key is pay-per-token.",
+      "The key you paste decides which one is billed."
+    )
   },
   {
     value: "xiaomi",
@@ -3750,44 +3902,66 @@ var ALL_AUTH_PROVIDERS = [
       {
         key: "xiaomi",
         label: "Token Plan",
+        kind: "plan",
+        billing: "Uses your MiMo Token Plan.",
         baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1"
       },
       {
         key: XIAOMI_CREDITS_KEY,
-        label: "API Credits (required for UltraSpeed)",
+        label: "API Credits",
+        kind: "payg",
+        billing: "Pay-per-token from MiMo API Credits. Required for UltraSpeed.",
         baseUrl: "https://api.xiaomimimo.com/v1"
       }
-    ]
+    ],
+    methodDetails: apiKeyDetails(
+      "Xiaomi MiMo API key",
+      "A Token Plan key uses your plan; an API Credits key is pay-per-token."
+    )
   },
   {
     value: "deepseek",
     label: "DeepSeek",
     description: "DeepSeek V4 Pro, V4.1 Flash",
     methods: ["apikey"],
-    apiKeyLabel: "DeepSeek"
+    apiKeyLabel: "DeepSeek",
+    methodDetails: apiKeyDetails("DeepSeek API key", "Pay-per-token from platform.deepseek.com.")
   },
   {
     value: "sakana",
     label: "Sakana (Fugu)",
     description: "Fugu, Fugu Max, Fugu Ultra",
     methods: ["apikey"],
-    apiKeyLabel: "Sakana"
+    apiKeyLabel: "Sakana",
+    methodDetails: apiKeyDetails("Sakana API key", "Pay-per-token from your Sakana API account.")
   },
   {
     value: "openrouter",
     label: "OpenRouter",
     description: "Qwen3.8 Max \xB7 multi-provider gateway",
     methods: ["apikey"],
-    apiKeyLabel: "OpenRouter"
+    apiKeyLabel: "OpenRouter",
+    methodDetails: apiKeyDetails("OpenRouter API key", "Pay-per-token from OpenRouter credits.")
   },
   {
     value: "huggingface",
     label: "Hugging Face",
     description: "Kimi K2.7 Code, DeepSeek V4.1 Flash, GPT-OSS 120B",
     methods: ["apikey"],
-    apiKeyLabel: "Hugging Face"
+    apiKeyLabel: "Hugging Face",
+    methodDetails: apiKeyDetails(
+      "Hugging Face token",
+      "Pay-per-token from Hugging Face Inference Providers credits."
+    )
   }
 ];
+function requiredKeyLabel(provider, storageKeys) {
+  const variants = ALL_AUTH_PROVIDERS.find((p) => p.value === provider)?.apiKeyVariants ?? [];
+  const needed = variants.filter((v) => storageKeys.includes(v.key));
+  if (needed.length === 0 || needed.length === variants.length) return void 0;
+  const names = needed.map((v) => v.label).join(" or ");
+  return `Needs ${/^[aeiou]/i.test(names) ? "an" : "a"} ${names} key`;
+}
 var AUTH_PROVIDERS = ALL_AUTH_PROVIDERS.filter(
   (p) => !isHiddenProvider(p.value)
 );
@@ -3814,15 +3988,24 @@ function describeAuthMethods(provider) {
   });
 }
 function authPriorityNote(provider) {
-  if (provider === "gemini") {
-    return "Uses the Gemini API key first when one is set; otherwise the Google sign-in.";
+  if (provider === "anthropic") {
+    return "Uses Sign in with Claude while you are signed in; otherwise the Anthropic API key.";
   }
   const dual = dualAuthProvider(provider);
-  if (!dual) return void 0;
-  return `Uses ${dual.oauthLabel} first; the ${dual.apiKeyLabel} takes over when it runs out, then switches back.`;
+  if (dual) {
+    return `Uses your ${dual.oauthLabel} first; the ${dual.apiKeyLabel} takes over while its usage is out, then switches back.`;
+  }
+  const variants = getAuthProvider(provider)?.apiKeyVariants;
+  const plan = variants?.find((v) => v.kind === "plan");
+  const payg = variants?.find((v) => v.kind === "payg");
+  if (plan && payg) {
+    return `Uses the ${plan.label} key first when both are set; the ${payg.label} key covers models the plan doesn't include.`;
+  }
+  return void 0;
 }
 
 // src/provider-usage.ts
+var import_gg_ai5 = require("@kenkaiiii/gg-ai");
 var SubscriptionUsageError = class extends Error {
   constructor(message, status, retryAfterMs2) {
     super(message);
@@ -3831,52 +4014,14 @@ var SubscriptionUsageError = class extends Error {
     this.name = "SubscriptionUsageError";
   }
 };
-var ANTHROPIC_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
-var CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
 function finiteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
-function clampPercent(value) {
-  const number = finiteNumber(value);
-  return number === void 0 ? void 0 : Math.min(100, Math.max(0, number));
-}
 function isoTimestamp(value) {
   if (typeof value !== "string" || !value.trim()) return void 0;
   const timestamp = Date.parse(value);
   return Number.isFinite(timestamp) ? timestamp : void 0;
 }
-function unixTimestamp(value) {
-  const seconds = finiteNumber(value);
-  return seconds === void 0 ? void 0 : seconds * 1e3;
-}
-function codexResetAt(window, now) {
-  const absolute = unixTimestamp(window.reset_at);
-  if (absolute !== void 0) return absolute;
-  const afterSeconds = finiteNumber(window.reset_after_seconds);
-  return afterSeconds === void 0 ? void 0 : now + afterSeconds * 1e3;
-}
-function currentWindowLabel(seconds, fallbackHours) {
-  const duration = finiteNumber(seconds);
-  const hours = Math.max(1, Math.round((duration ?? fallbackHours * 3600) / 3600));
-  return `${hours}-hour`;
-}
-function codexWindowKind(window, fallback) {
-  const duration = finiteNumber(window.limit_window_seconds);
-  if (duration === void 0) return fallback;
-  return duration >= 6 * 24 * 60 * 60 ? "weekly" : "current";
-}
-function normalizedCodexWindow(window, fallbackKind, now) {
-  if (!window) return null;
-  const usedPercent = clampPercent(window.used_percent);
-  if (usedPercent === void 0) return null;
-  const kind = codexWindowKind(window, fallbackKind);
-  return {
-    kind,
-    label: kind === "weekly" ? "Weekly" : currentWindowLabel(window.limit_window_seconds, 5),
-    usedPercent,
-    resetsAt: codexResetAt(window, now)
-  };
-}
 function retryAfterMs(response, now) {
   const value = response.headers.get("retry-after")?.trim();
   if (!value) return void 0;
@@ -3899,70 +4044,6 @@ async function readUsageResponse(response, now) {
     throw new SubscriptionUsageError("Subscription usage response was not valid JSON");
   }
 }
-async function fetchAnthropicUsage(credentials, fetchFn, signal, now) {
-  const response = await fetchFn(ANTHROPIC_USAGE_URL, {
-    method: "GET",
-    signal,
-    headers: {
-      Authorization: `Bearer ${credentials.accessToken}`,
-      Accept: "application/json",
-      "anthropic-version": "2023-06-01",
-      "anthropic-beta": "oauth-2025-04-20",
-      "User-Agent": "ggcoder"
-    }
-  });
-  const data = await readUsageResponse(response, now());
-  const windows = [];
-  const currentPercent = clampPercent(data.five_hour?.utilization);
-  if (currentPercent !== void 0) {
-    windows.push({
-      kind: "current",
-      label: "5-hour",
-      usedPercent: currentPercent,
-      resetsAt: isoTimestamp(data.five_hour?.resets_at)
-    });
-  }
-  const weeklyPercent = clampPercent(data.seven_day?.utilization);
-  if (weeklyPercent !== void 0) {
-    windows.push({
-      kind: "weekly",
-      label: "Weekly",
-      usedPercent: weeklyPercent,
-      resetsAt: isoTimestamp(data.seven_day?.resets_at)
-    });
-  }
-  return {
-    provider: "anthropic",
-    displayName: "Anthropic",
-    windows,
-    fetchedAt: now()
-  };
-}
-async function fetchCodexUsage(credentials, fetchFn, signal, now) {
-  const headers = {
-    Authorization: `Bearer ${credentials.accessToken}`,
-    Accept: "application/json",
-    originator: "ggcoder",
-    "User-Agent": "ggcoder"
-  };
-  if (credentials.accountId) headers["ChatGPT-Account-Id"] = credentials.accountId;
-  const response = await fetchFn(CODEX_USAGE_URL, { method: "GET", signal, headers });
-  const data = await readUsageResponse(response, now());
-  const windows = [
-    normalizedCodexWindow(data.rate_limit?.primary_window, "current", now()),
-    normalizedCodexWindow(data.rate_limit?.secondary_window, "weekly", now())
-  ].filter((window) => window !== null);
-  windows.sort((left, right) => {
-    if (left.kind === right.kind) return 0;
-    return left.kind === "current" ? -1 : 1;
-  });
-  return {
-    provider: "openai",
-    displayName: "Codex",
-    windows,
-    fetchedAt: now()
-  };
-}
 function kimiNumber(value) {
   if (typeof value === "string" && value.trim()) {
     const parsed = Number(value);
@@ -3993,15 +4074,14 @@ function kimiWindowMinutes(window) {
   }
 }
 async function fetchKimiUsage(credentials, fetchFn, signal, now) {
-  const response = await fetchFn(`${kimiCodeBaseUrl()}/usages`, {
+  const baseUrl = (credentials.baseUrl ?? KIMI_CODE_DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const response = await fetchFn(`${baseUrl}/usages`, {
     method: "GET",
     signal,
     headers: {
       Authorization: "Bearer " + credentials.accessToken,
       Accept: "application/json",
-      // The managed coding endpoint gates on the kimi-code-cli client identity,
-      // same as model requests.
-      ...kimiCodingHeaders()
+      "User-Agent": import_gg_ai5.GG_CODER_USER_AGENT
     }
   });
   const data = await readUsageResponse(response, now());
@@ -4053,7 +4133,7 @@ async function fetchSubscriptionUsage(provider, credentials, options = {}) {
   const now = options.now ?? Date.now;
   const signal = AbortSignal.timeout(options.timeoutMs ?? 8e3);
   try {
-    return provider === "anthropic" ? await fetchAnthropicUsage(credentials, fetchFn, signal, now) : provider === "openai" ? await fetchCodexUsage(credentials, fetchFn, signal, now) : await fetchKimiUsage(credentials, fetchFn, signal, now);
+    return await fetchKimiUsage(credentials, fetchFn, signal, now);
   } catch (error) {
     if (error instanceof SubscriptionUsageError) throw error;
     const message = error instanceof Error ? error.message : String(error);
@@ -4118,7 +4198,7 @@ var TelegramBot = class {
       } catch (err) {
         if (!this.running) break;
         console.error(`[telegram] Poll error: ${err instanceof Error ? err.message : err}`);
-        await sleep3(3e3);
+        await sleep(3e3);
       }
     }
   }
@@ -4304,7 +4384,7 @@ function splitMessage(text) {
   }
   return chunks;
 }
-function sleep3(ms) {
+function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
@@ -4390,8 +4470,8 @@ async function transcribeVoice(fileUrl) {
 
 // src/auto-update.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs4 = __toESM(require("fs"), 1);
-var import_node_path4 = __toESM(require("path"), 1);
+var import_node_fs5 = __toESM(require("fs"), 1);
+var import_node_path6 = __toESM(require("path"), 1);
 var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 1e4;
 function compareVersions(a, b) {
@@ -4424,7 +4504,7 @@ function createAutoUpdater(config) {
   }
   function readState() {
     try {
-      const raw = import_node_fs4.default.readFileSync(stateFilePath(), "utf-8");
+      const raw = import_node_fs5.default.readFileSync(stateFilePath(), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -4433,8 +4513,8 @@ function createAutoUpdater(config) {
   function writeState(state) {
     try {
       const filePath = stateFilePath();
-      import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(filePath), { recursive: true, mode: 448 });
-      import_node_fs4.default.writeFileSync(filePath, JSON.stringify(state));
+      import_node_fs5.default.mkdirSync(import_node_path6.default.dirname(filePath), { recursive: true, mode: 448 });
+      import_node_fs5.default.writeFileSync(filePath, JSON.stringify(state));
     } catch {
     }
   }
@@ -4560,34 +4640,55 @@ function createAutoUpdater(config) {
 0 && (module.exports = {
   AUTH_PROVIDERS,
   AuthStorage,
+  CHATGPT_PLAN_BASE_URL,
+  CHATGPT_PLAN_NOT_ENABLED_MESSAGE,
+  CHATGPT_PLAN_SCOPE,
+  CHATGPT_USAGE_URL,
+  CLAUDE_CODE_AUTH_KEY,
+  CLAUDE_CODE_AUTH_MARKER,
+  CLAUDE_CODE_MANIFEST,
+  ChatGPTPlanNotEnabledError,
   DEFAULT_LOCAL_ENDPOINTS,
   DEFAULT_MAX_VIDEO_BYTES,
   FALLBACK_CONTEXT_WINDOW,
   GEMINI_API_KEY,
   GEMINI_API_KEY_BASE_URL,
   HIDDEN_PROVIDERS,
+  KIMI_CODE_DEFAULT_BASE_URL,
+  KIMI_CODE_KEY,
+  KIMI_CODE_OVERSEAS_BASE_URL,
   LOCAL_API_KEY_PLACEHOLDER,
   LOCAL_AUTH_KEY_PREFIX,
   MINIMAX_CN_BASE_URL,
   MINIMAX_GLOBAL_BASE_URL,
   MODELS,
-  MOONSHOT_OAUTH_KEY,
   NotLoggedInError,
+  OPENAI_CHATGPT_KEY,
   OPENROUTER_DEFAULT_BASE_URL,
   PLAN_MODE_THINKING_CAP,
+  RETIRED_SIGN_INS,
   SubscriptionUsageError,
   TelegramBot,
-  XAI_OAUTH_KEY,
   XIAOMI_CREDITS_KEY,
   XIAOMI_TOKEN_PLAN_BASE_URLS,
+  apiKeyStorageKeys,
   authPriorityNote,
   clampThinkingForPlanMode,
+  claudeCodeAuthStatus,
+  claudeCodeBinaryPath,
+  claudeCodeCallbackUrl,
+  claudeCodeConfigDir,
+  claudeCodeEnv,
+  claudeCodeHome,
+  claudeCodePlatformKey,
+  clearClaudeCodeUsage,
   clearLocalDiscoveryCache,
   clearRuntimeModels,
   closeLogger,
   createAutoUpdater,
   decodeOggOpus,
   describeAuthMethods,
+  detectKimiCodeBaseUrl,
   detectMiniMaxBaseUrl,
   detectXiaomiTokenPlanBaseUrl,
   discoverLocalModels,
@@ -4595,8 +4696,11 @@ function createAutoUpdater(config) {
   dualAuthProvider,
   dualAuthProviderByOAuthKey,
   endpointRoot,
+  ensureClaudeCodeBinary,
+  fetchChatGPTPlanModels,
   fetchSubscriptionUsage,
   findProbedModel,
+  formatClaudeCodeInstallProgress,
   formatLocalModelId,
   generatePKCE,
   getAllModels,
@@ -4604,8 +4708,7 @@ function createAutoUpdater(config) {
   getAuthProvider,
   getAuthStorageKey,
   getAuthStorageKeys,
-  getClaudeCliUserAgent,
-  getClaudeCodeVersion,
+  getChatGPTHostId,
   getContextWindow,
   getDefaultModel,
   getDefaultThinkingLevel,
@@ -4621,48 +4724,49 @@ function createAutoUpdater(config) {
   getSupportedThinkingLevels,
   getToolResultCharLimit,
   getVideoByteLimit,
-  grokCliBaseUrl,
-  grokCliHeaders,
-  isGrokCliEndpoint,
+  isClaudeCodeAuthMarker,
   isHiddenProvider,
   isKimiCodingEndpoint,
+  isLegacyClaudeOAuth,
   isLocalModelId,
   isLoggerOpen,
   isModelLoaded,
   isPaidModel,
   isThinkingLevelSupported,
-  kimiCodeBaseUrl,
-  kimiCodingHeaders,
   localAuthStorageKey,
   localModelShortName,
   log,
-  loginAnthropic,
-  loginGemini,
-  loginKimi,
-  loginOpenAI,
-  loginXai,
+  loginChatGPT,
+  loginClaudeCode,
+  logoutClaudeCode,
+  mergeClaudeCodeRateLimit,
   oauthStorageKey,
   ollamaServedContext,
   openLog,
+  parseCallbackInput,
   parseLocalModelId,
   parseOpenRouterCatalog,
-  pendingClaudeCodeVersionRefresh,
   probeEndpoint,
   providerStorageKeys,
+  readClaudeCodeUsage,
   readStoredBaseUrlSync,
-  refreshAnthropicToken,
-  refreshGeminiToken,
-  refreshKimiToken,
-  refreshOpenAIToken,
-  refreshXaiToken,
+  recordClaudeCodeRateLimit,
+  refreshChatGPTToken,
   registerLogCleanup,
   registerRuntimeModels,
+  requiredKeyLabel,
   resample,
+  resolveClaudeCodeBinary,
+  revokeChatGPTSignIn,
   setProgressCallback,
   setProviderCatalog,
+  signInWithClaudeCode,
+  signOutOfClaudeCode,
+  storageKeyProvider,
   toModelInfo,
   transcribeVoice,
   usesOpenAICodexTransport,
+  verifyIdToken,
   withFileLock,
   withoutPaidTier
 });