@kenkaiiii/gg-core 5.94.0 → 5.95.0

package/dist/{chunk-JLEBGMG4.js → chunk-J7W5HS6X.js}

@@ -2,244 +2,49 @@ import {
   getAppPaths
 } from "./chunk-GXOFTHM5.js";
 
-// src/oauth/kimi.ts
-import { execFileSync } from "child_process";
-import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { arch, hostname, release, type } from "os";
-import path from "path";
-
-// src/oauth/request-timeout.ts
-var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
-function oauthRequestSignal() {
-  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
-}
-
-// src/oauth/kimi.ts
-var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
+// src/kimi-region.ts
+import { GG_CODER_USER_AGENT } from "@kenkaiiii/gg-ai";
+var KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_CODE_OVERSEAS_BASE_URL = "https://api.kimi.ai/coding/v1";
+var KIMI_CODE_BASE_URLS = [KIMI_CODE_DEFAULT_BASE_URL, KIMI_CODE_OVERSEAS_BASE_URL];
+async function probeHost(baseUrl, apiKey, fetchImpl, timeoutMs) {
   try {
-    const version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os = type();
-  const version = release();
-  const osArch = arch();
-  if (os === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = path.join(getAppPaths().agentDir, "kimi_device_id");
-  if (existsSync(idPath)) {
-    try {
-      const text = readFileSync(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = randomUUID();
-  try {
-    mkdirSync(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    writeFileSync(idPath, id, { encoding: "utf-8", mode: 384 });
+    const res = await fetchImpl(`${baseUrl}/models`, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": GG_CODER_USER_AGENT },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (res.ok) return "authorized";
+    if (res.status === 401 || res.status === 403) return "unauthorized";
+    return "inconclusive";
   } catch {
+    return "inconclusive";
   }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader(hostname()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader(release()),
-    "X-Msh-Device-Id": deviceId()
-  };
 }
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
+async function detectKimiCodeBaseUrl(apiKey, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const results = await Promise.all(
+    KIMI_CODE_BASE_URLS.map((url) => probeHost(url, apiKey, fetchImpl, timeoutMs))
+  );
+  const index = results.indexOf("authorized");
+  return index === -1 ? void 0 : KIMI_CODE_BASE_URLS[index];
 }
 function isKimiCodingEndpoint(baseUrl) {
   if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
-}
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
+  return /^https:\/\/api\.kimi\.(com|ai)\/coding(\/|$)/i.test(baseUrl);
 }
 
 // src/auth-storage.ts
-import fs5 from "fs/promises";
-import { readFileSync as readFileSync2 } from "fs";
-import crypto5 from "crypto";
+import fs6 from "fs/promises";
+import { readFileSync } from "fs";
+import crypto4 from "crypto";
 
 // src/claude-code/runtime.ts
 import { spawn } from "child_process";
 import crypto2 from "crypto";
 import fs2 from "fs";
 import fsp2 from "fs/promises";
-import path2 from "path";
+import path from "path";
 
 // src/claude-code/tar.ts
 import fs from "fs";
@@ -320,7 +125,7 @@ async function extractFileFromTarGz(tgzPath, entryName, destPath) {
         pos += BLOCK;
         if (header.every((b) => b === 0)) continue;
         const size = readSize(header, 124);
-        const type2 = String.fromCharCode(header[156] || 48);
+        const type = String.fromCharCode(header[156] || 48);
         let name = readString(header, 0, 100);
         if (readString(header, 257, 6) === "ustar") {
           const prefix = readString(header, 345, 155);
@@ -329,12 +134,12 @@ async function extractFileFromTarGz(tgzPath, entryName, destPath) {
         remaining = size;
         padding = (BLOCK - size % BLOCK) % BLOCK;
         meta = [];
-        if (type2 === "x") kind = "pax";
-        else if (type2 === "L") kind = "longname";
+        if (type === "x") kind = "pax";
+        else if (type === "L") kind = "longname";
         else {
           const path4 = overridePath ?? name;
           overridePath = void 0;
-          if ((type2 === "0" || type2 === "\0" || type2 === "7") && path4 === entryName) {
+          if ((type === "0" || type === "\0" || type === "7") && path4 === entryName) {
             kind = "target";
             out = await fsp.open(destPath, "w", 493);
             if (size === 0) {
@@ -424,10 +229,10 @@ function isMusl() {
   return report != null && report.header?.glibcVersionRuntime === void 0;
 }
 function claudeCodePlatformKey(info = { platform: process.platform, arch: process.arch, musl: isMusl() }) {
-  const arch2 = info.arch === "arm64" || info.arch === "x64" ? info.arch : null;
-  if (!arch2) return null;
-  if (info.platform === "darwin" || info.platform === "win32") return `${info.platform}-${arch2}`;
-  if (info.platform === "linux") return `linux-${arch2}${info.musl ? "-musl" : ""}`;
+  const arch = info.arch === "arm64" || info.arch === "x64" ? info.arch : null;
+  if (!arch) return null;
+  if (info.platform === "darwin" || info.platform === "win32") return `${info.platform}-${arch}`;
+  if (info.platform === "linux") return `linux-${arch}${info.musl ? "-musl" : ""}`;
   return null;
 }
 function resolveAsset(opts) {
@@ -445,11 +250,11 @@ function claudeCodeHome(opts = {}) {
   return opts.home ?? getAppPaths().claudeCodeDir;
 }
 function claudeCodeConfigDir(opts = {}) {
-  return opts.home ? path2.join(opts.home, "config") : getAppPaths().claudeCodeConfigDir;
+  return opts.home ? path.join(opts.home, "config") : getAppPaths().claudeCodeConfigDir;
 }
 function claudeCodeBinaryPath(opts = {}) {
   const { manifest, asset } = resolveAsset(opts);
-  return path2.join(claudeCodeHome(opts), manifest.claudeCodeVersion, asset.bin);
+  return path.join(claudeCodeHome(opts), manifest.claudeCodeVersion, asset.bin);
 }
 function resolveClaudeCodeBinary(opts = {}) {
   let binary;
@@ -479,12 +284,12 @@ async function ensureClaudeCodeBinary(opts = {}) {
 async function installClaudeCode(opts) {
   const { manifest, asset } = resolveAsset(opts);
   const home = claudeCodeHome(opts);
-  const versionDir = path2.join(home, manifest.claudeCodeVersion);
-  const binary = path2.join(versionDir, asset.bin);
+  const versionDir = path.join(home, manifest.claudeCodeVersion);
+  const binary = path.join(versionDir, asset.bin);
   await fsp2.mkdir(home, { recursive: true });
   const tag = `${process.pid}-${crypto2.randomBytes(4).toString("hex")}`;
-  const tarball = path2.join(home, `.download-${tag}.tgz`);
-  const staging = path2.join(home, `.staging-${tag}`);
+  const tarball = path.join(home, `.download-${tag}.tgz`);
+  const staging = path.join(home, `.staging-${tag}`);
   try {
     await download(asset, tarball, opts);
     opts.onProgress?.({ phase: "extract" });
@@ -492,10 +297,10 @@ async function installClaudeCode(opts) {
     const found = await extractFileFromTarGz(
       tarball,
       `package/${asset.bin}`,
-      path2.join(staging, asset.bin)
+      path.join(staging, asset.bin)
     );
     if (!found) throw new Error(`The Claude Code download has no ${asset.bin} binary.`);
-    await fsp2.chmod(path2.join(staging, asset.bin), 493);
+    await fsp2.chmod(path.join(staging, asset.bin), 493);
     try {
       await fsp2.rename(staging, versionDir);
     } catch (err) {
@@ -555,7 +360,7 @@ async function removeOldVersions(home, keep) {
   for (const entry of entries) {
     if (!entry.isDirectory() || entry.name === keep || entry.name === "config") continue;
     if (!/^\d+\.\d+\.\d+/.test(entry.name)) continue;
-    await fsp2.rm(path2.join(home, entry.name), { recursive: true, force: true }).catch(() => {
+    await fsp2.rm(path.join(home, entry.name), { recursive: true, force: true }).catch(() => {
     });
   }
 }
@@ -657,8 +462,8 @@ async function loginClaudeCode(callbacks, opts = {}) {
   const home = claudeCodeHome(opts);
   await fsp2.mkdir(claudeCodeConfigDir(opts), { recursive: true });
   const tag = `${process.pid}-${crypto2.randomBytes(4).toString("hex")}`;
-  const hookFile = path2.join(home, `.open-url-${tag}.cjs`);
-  const urlFile = path2.join(home, `.open-url-${tag}.txt`);
+  const hookFile = path.join(home, `.open-url-${tag}.cjs`);
+  const urlFile = path.join(home, `.open-url-${tag}.txt`);
   await fsp2.writeFile(hookFile, OPEN_URL_HOOK);
   const env = {
     ...claudeCodeEnv(opts),
@@ -739,6 +544,8 @@ async function loginClaudeCode(callbacks, opts = {}) {
 // src/oauth/openai.ts
 import http from "http";
 import crypto3 from "crypto";
+import fs3 from "fs/promises";
+import path2 from "path";
 
 // src/oauth/pkce.ts
 function base64urlEncode(bytes) {
@@ -758,100 +565,233 @@ async function generatePKCE() {
   return { verifier, challenge };
 }
 
+// src/oauth/request-timeout.ts
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+function oauthRequestSignal() {
+  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
+}
+
 // src/oauth/openai.ts
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-var TOKEN_URL = "https://auth.openai.com/oauth/token";
-var REDIRECT_URI = "http://localhost:1455/auth/callback";
-var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+var ISSUER = "https://auth.openai.com";
+var AUTHORIZE_URL = `${ISSUER}/api/accounts/authorize`;
+var TOKEN_URL = `${ISSUER}/api/accounts/oauth/token`;
+var REVOKE_URL = `${ISSUER}/api/accounts/oauth/revoke`;
+var JWKS_URL = `${ISSUER}/.well-known/jwks.json`;
+var REGISTRATION_CLIENT_ID = "dynamic_agent_client";
+var AGENT_NAME = "GG Coder";
+var RESOURCE = "https://api.openai.com/v1";
+var CHATGPT_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPES = `openid profile email offline_access resource.invoke ${CHATGPT_PLAN_SCOPE}`;
+var CHATGPT_PLAN_BASE_URL = "https://api.openai.com/v1";
+var CHATGPT_USAGE_URL = "https://chatgpt.com/settings/usage";
+var CALLBACK_PATH = "/auth/callback";
+var PREFERRED_PORT = 1455;
 var CALLBACK_TIMEOUT_MS = 12e4;
 var MAX_PASTE_ATTEMPTS = 3;
-var MIN_RAW_CODE_LENGTH = 10;
-async function loginOpenAI(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto3.randomBytes(16).toString("hex");
-  const url = new URL(AUTHORIZE_URL);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
-  url.searchParams.set("redirect_uri", REDIRECT_URI);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("prompt", "login");
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", "ggcoder");
-  const code = await acquireAuthorizationCode(url.toString(), state, callbacks);
-  const creds = await exchangeOpenAICode(code, verifier);
-  const accountId = getAccountId(creds.accessToken);
-  if (!accountId) {
-    throw new Error("Failed to extract accountId from OpenAI token.");
-  }
-  creds.accountId = accountId;
-  return creds;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
+var ID_TOKEN_CLOCK_SKEW_S = 60;
+var CHATGPT_PLAN_NOT_ENABLED_MESSAGE = "ChatGPT plan use isn't enabled for GG Coder. Allow Use your ChatGPT plan, or add an OpenAI API key.";
+var ChatGPTPlanNotEnabledError = class extends Error {
+  constructor() {
+    super(CHATGPT_PLAN_NOT_ENABLED_MESSAGE);
+    this.name = "ChatGPTPlanNotEnabledError";
+  }
+};
+function defaultHostIdFile() {
+  return path2.join(getAppPaths().agentDir, "openai-host-id");
+}
+function defaultRegistrationFile() {
+  return path2.join(getAppPaths().agentDir, "openai-chatgpt-client.json");
+}
+async function writePrivateFile(file, content) {
+  await fs3.mkdir(path2.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${crypto3.randomUUID().slice(0, 8)}.tmp`;
   try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
+    await fs3.writeFile(tmp, content, { encoding: "utf-8", mode: 384 });
+    await fs3.rename(tmp, file);
+  } catch (err) {
+    await fs3.unlink(tmp).catch(() => {
+    });
+    throw err;
   }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
+}
+var HOST_ID_PATTERN = /^urn:uuid:[0-9a-f-]{36}$/i;
+async function getChatGPTHostId(file = defaultHostIdFile()) {
+  const existing = await fs3.readFile(file, "utf-8").catch(() => "");
+  if (HOST_ID_PATTERN.test(existing.trim())) return existing.trim();
+  await writePrivateFile(file, `urn:uuid:${crypto3.randomUUID()}`);
+  return (await fs3.readFile(file, "utf-8")).trim();
+}
+async function readRegistration(file) {
+  try {
+    const value = JSON.parse(await fs3.readFile(file, "utf-8"));
+    if (typeof value.clientId === "string" && typeof value.subject === "string") {
+      return { clientId: value.clientId, subject: value.subject };
+    }
+  } catch {
   }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
+  return void 0;
+}
+async function loginChatGPT(callbacks, options = {}) {
+  const hostId = await getChatGPTHostId(options.hostIdFile);
+  const registrationFile = options.registrationFile ?? defaultRegistrationFile();
+  const registration = await readRegistration(registrationFile);
+  const { verifier, challenge } = await generatePKCE();
+  const state = crypto3.randomBytes(16).toString("hex");
+  const nonce = crypto3.randomBytes(16).toString("hex");
+  const listener = await startCallbackListener(state, Boolean(registration));
+  try {
+    const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`;
+    const url = new URL(AUTHORIZE_URL);
+    url.searchParams.set("client_id", registration?.clientId ?? REGISTRATION_CLIENT_ID);
+    if (!registration) url.searchParams.set("agent_name_hint", AGENT_NAME);
+    url.searchParams.set("ext_agent_host_id", hostId);
+    if (registration && options.previous?.idToken) {
+      url.searchParams.set("id_token_hint", options.previous.idToken);
+    }
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("scope", SCOPES);
+    url.searchParams.set("resource", RESOURCE);
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("code_challenge", challenge);
+    const callback = await acquireCallback(url.toString(), state, listener, callbacks);
+    if (callback.get("error")) {
+      if (callback.get("error") === "access_denied") throw new ChatGPTPlanNotEnabledError();
+      throw new Error(
+        `ChatGPT sign-in failed: ${callback.get("error_description") ?? callback.get("error")}`
+      );
+    }
+    const code = callback.get("code");
+    if (!code) throw new Error("ChatGPT sign-in returned no authorization code.");
+    const issued = callback.get("client_id") ?? void 0;
+    if (registration && issued && issued !== registration.clientId) {
+      throw new Error("ChatGPT returned a different app registration. Start the sign-in again.");
+    }
+    const clientId = registration?.clientId ?? issued;
+    if (!clientId || clientId === REGISTRATION_CLIENT_ID) {
+      throw new Error(
+        "ChatGPT didn't finish registering GG Coder. Start the sign-in again, and paste the full callback URL if you're on another machine."
+      );
+    }
+    const tokens = await exchangeCode({ code, verifier, clientId, redirectUri });
+    const claims = await verifyIdToken(tokens.idToken, { clientId, nonce });
+    const subject = String(claims.sub ?? "");
+    if (!subject) throw new Error("ChatGPT ID token has no subject.");
+    if (registration && registration.subject !== subject) {
+      await fs3.unlink(registrationFile).catch(() => {
+      });
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new Error(
+        "That was a different ChatGPT account. Continue with ChatGPT again to connect it."
+      );
+    }
+    if (!tokens.scopes.includes(CHATGPT_PLAN_SCOPE)) {
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new ChatGPTPlanNotEnabledError();
+    }
+    if (!registration) {
+      await writePrivateFile(registrationFile, JSON.stringify({ clientId, subject }));
+    }
     return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3,
+      expiresIn: tokens.expiresIn,
+      accountId: subject,
+      clientId,
+      idToken: tokens.idToken,
+      scopes: tokens.scopes,
+      baseUrl: CHATGPT_PLAN_BASE_URL
     };
+  } finally {
+    listener.close();
   }
-  if (/\s/.test(value) || value.length < MIN_RAW_CODE_LENGTH) return {};
-  return { code: value };
 }
-function decodeJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const decoded = atob(parts[1]);
-    return JSON.parse(decoded);
-  } catch {
-    return null;
-  }
+async function fetchChatGPTPlanModels(accessToken, fetchFn = fetch) {
+  const response = await fetchFn(`${CHATGPT_PLAN_BASE_URL}/models`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: oauthRequestSignal()
+  });
+  if (!response.ok) throw new Error(`ChatGPT model list failed (${response.status})`);
+  const data = await response.json();
+  return (data.models ?? []).filter((m) => typeof m.slug === "string" && (m.visibility ?? "list") === "list").map((m) => m.slug);
 }
-function getAccountId(accessToken) {
-  const payload = decodeJwt(accessToken);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const accountId = auth?.chatgpt_account_id;
-  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+async function startCallbackListener(expectedState, anyPort) {
+  let settle;
+  const result = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
+  });
+  result.catch(() => {
+  });
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url || "", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    if (url.searchParams.get("state") !== expectedState) {
+      res.statusCode = 400;
+      res.end("State mismatch");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(
+      "<html><body><h1>You're signed in to GG Coder.</h1><p>You can close this tab.</p></body></html>"
+    );
+    settle?.resolve(url.searchParams);
+    server.close();
+  });
+  const listen = (port2) => new Promise((resolve, reject) => {
+    const onError = (err) => reject(err);
+    server.once("error", onError);
+    server.listen(port2, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve(server.address().port);
+    });
+  });
+  let port;
+  for (const candidate of anyPort ? [PREFERRED_PORT, 0] : [PREFERRED_PORT]) {
+    try {
+      port = await listen(candidate);
+      break;
+    } catch {
+    }
+  }
+  if (port === void 0) {
+    settle?.reject(new Error("Could not start the local sign-in listener."));
+    return { port: PREFERRED_PORT, result, close: () => {
+    } };
+  }
+  const timeout = setTimeout(() => server.close(), CALLBACK_TIMEOUT_MS);
+  timeout.unref();
+  server.on("close", () => {
+    clearTimeout(timeout);
+    settle?.reject(new Error("Sign-in listener closed without a callback."));
+  });
+  return { port, result, close: () => server.close() };
 }
-async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
+async function acquireCallback(authUrl, expectedState, listener, callbacks) {
   callbacks.onOpenUrl(authUrl);
-  callbacks.onStatus("Waiting for browser callback...");
+  callbacks.onStatus("Waiting for ChatGPT sign-in in your browser...");
   const done = new AbortController();
   try {
     return await new Promise((resolve, reject) => {
-      let serverFailed = false;
+      let listenerFailed = false;
       let pasteError;
       const failIfExhausted = () => {
-        if (!serverFailed || pasteError === void 0) return;
+        if (!listenerFailed || pasteError === void 0) return;
         reject(
-          pasteError instanceof Error ? pasteError : new Error("Could not obtain an authorization code.")
+          pasteError instanceof Error ? pasteError : new Error("Could not complete the sign-in.")
         );
       };
-      listenForCallback(expectedState, done.signal).then(resolve, () => {
-        serverFailed = true;
+      listener.result.then(resolve, () => {
+        listenerFailed = true;
         failIfExhausted();
       });
-      promptForCode(expectedState, callbacks, done.signal).then(resolve, (err) => {
+      promptForCallback(expectedState, callbacks, done.signal).then(resolve, (err) => {
         if (err instanceof FatalLoginError) {
           reject(err);
           return;
@@ -862,686 +802,158 @@ async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
     });
   } finally {
     done.abort();
+    listener.close();
   }
 }
 var FatalLoginError = class extends Error {
 };
-async function promptForCode(expectedState, callbacks, signal) {
-  let message = "If the browser is on another machine (SSH/headless), paste the callback URL or code here:";
+function parseCallbackInput(input) {
+  const value = input.trim();
+  if (!value) return void 0;
+  try {
+    return new URL(value).searchParams;
+  } catch {
+  }
+  if (/[?&]?(code|error)=/.test(value)) {
+    return new URLSearchParams(value.replace(/^.*\?/, ""));
+  }
+  return void 0;
+}
+async function promptForCallback(expectedState, callbacks, signal) {
+  let message = "If the browser is on another machine (SSH/headless), paste the full callback URL here:";
   for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
-    if (signal.aborted) throw new Error("Authorization code already received.");
+    if (signal.aborted) throw new Error("Callback already received.");
     const raw = await callbacks.onPromptCode(message, signal);
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const parsed = parseAuthorizationInput(raw);
-    if (parsed.code && parsed.state && parsed.state !== expectedState) {
-      throw new FatalLoginError("Authorization state mismatch \u2014 start the login again.");
+    if (signal.aborted) throw new Error("Callback already received.");
+    const params = parseCallbackInput(raw);
+    if (params && (params.get("code") || params.get("error"))) {
+      if (params.get("state") !== expectedState) {
+        throw new FatalLoginError("Sign-in state mismatch \u2014 start the sign-in again.");
+      }
+      return params;
     }
-    if (parsed.code) return parsed.code;
-    message = "That didn't contain an authorization code. Paste the full callback URL:";
+    message = "That wasn't a callback URL. Paste the full URL from the browser's address bar:";
   }
-  throw new Error("No authorization code found in input.");
+  throw new Error("No callback URL found in input.");
 }
-async function listenForCallback(expectedState, signal) {
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url || "", "http://localhost");
-      if (url.pathname !== "/auth/callback") {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => {
-      reject(err);
-    });
-    server.listen(1455, "127.0.0.1");
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, CALLBACK_TIMEOUT_MS);
-    timeout.unref();
-    const onAbort = () => {
-      server.close();
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    server.on("close", () => {
-      clearTimeout(timeout);
-      signal.removeEventListener("abort", onAbort);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code"));
-      }
-    });
-  });
-}
-async function exchangeOpenAICode(code, verifier) {
-  const response = await fetch(TOKEN_URL, {
+async function postForm(url, form) {
+  return fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
-      code,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: verifier
-    }),
+    body: new URLSearchParams(form),
     signal: oauthRequestSignal()
   });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token exchange failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
 }
-async function refreshOpenAIToken(refreshToken) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLIENT_ID2
-    }),
-    signal: oauthRequestSignal()
+async function exchangeCode(input) {
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "authorization_code",
+    client_id: input.clientId,
+    code: input.code,
+    code_verifier: input.verifier,
+    redirect_uri: input.redirectUri,
+    resource: RESOURCE
   });
   if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token refresh failed (${response.status}): ${text}`);
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token exchange failed (${response.status}): ${text.slice(0, 300)}`);
   }
   const data = await response.json();
-  const creds = {
+  if (!data.access_token || !data.refresh_token || !data.id_token) {
+    throw new Error("ChatGPT token response is missing tokens.");
+  }
+  return {
     accessToken: data.access_token,
     refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
+    idToken: data.id_token,
+    expiresIn: data.expires_in ?? 3600,
+    scopes: (data.scope ?? "").split(/\s+/).filter(Boolean)
   };
-  const accountId = getAccountId(creds.accessToken);
-  if (accountId) {
-    creds.accountId = accountId;
-  }
-  return creds;
 }
-
-// src/oauth/gemini.ts
-import http2 from "http";
-import crypto4 from "crypto";
-var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
-var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
-var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
-var DEFAULT_CLIENT_SECRET = "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";
-var AUTHORIZE_URL2 = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL2 = "https://oauth2.googleapis.com/token";
-var CODE_ASSIST_BASE_URL = "https://cloudcode-pa.googleapis.com";
-var CODE_ASSIST_API_VERSION = "v1internal";
-var CODE_ASSIST_POST_RETRIES = 3;
-var CODE_ASSIST_POST_RETRY_DELAY_MS = 100;
-var SCOPE2 = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile"
-].join(" ");
-var USER_TIER_FREE = "free-tier";
-var USER_TIER_LEGACY = "legacy-tier";
-var USER_TIER_STANDARD = "standard-tier";
-var VALIDATION_REQUIRED_REASON = "VALIDATION_REQUIRED";
-var VPC_SC_REASON = "SECURITY_POLICY_VIOLATED";
-var CodeAssistHttpError = class extends Error {
-  status;
-  body;
-  constructor(label, status, body) {
-    super(`Gemini Code Assist ${label} failed (${status}): ${body}`);
-    this.name = "CodeAssistHttpError";
-    this.status = status;
-    this.body = body;
-  }
-};
-async function loginGemini(callbacks) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto4.randomBytes(32).toString("hex");
-  const redirectUri = await getLoopbackRedirectUri();
-  const url = new URL(AUTHORIZE_URL2);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId2);
-  url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", SCOPE2);
-  url.searchParams.set("access_type", "offline");
-  url.searchParams.set("prompt", "consent");
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  let code;
-  try {
-    code = await loginWithServer(url.toString(), redirectUri, state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput2(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    if (parsed.state && parsed.state !== state) {
-      throw new Error("Invalid state. Please try again.");
-    }
-    code = parsed.code;
+async function refreshChatGPTToken(creds) {
+  if (!creds.clientId) {
+    throw new Error("ChatGPT token refresh failed (401): no issued client ID saved");
   }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret);
-  callbacks.onStatus("Setting up Gemini Code Assist access...");
-  const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
-  return {
-    ...creds,
-    projectId
-  };
-}
-async function refreshGeminiToken(refreshToken) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const data = await postTokenRequest({
+  const response = await postForm(TOKEN_URL, {
     grant_type: "refresh_token",
-    refresh_token: refreshToken,
-    client_id: clientId2,
-    client_secret: clientSecret
-  });
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? refreshToken,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-function getGeminiOAuthClientCredentials() {
-  const clientId2 = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
-  const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId: clientId2, clientSecret };
-}
-async function getLoopbackRedirectUri() {
-  return new Promise((resolve, reject) => {
-    const server = http2.createServer();
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      server.close(() => {
-        if (addr && typeof addr === "object") {
-          resolve(`http://127.0.0.1:${addr.port}/oauth2callback`);
-        } else {
-          reject(new Error("Failed to allocate OAuth callback port."));
-        }
-      });
-    });
-    server.on("error", reject);
+    client_id: creds.clientId,
+    refresh_token: creds.refreshToken,
+    resource: RESOURCE
   });
-}
-function parseAuthorizationInput2(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token refresh failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  return { code: value };
-}
-async function loginWithServer(authUrl, redirectUri, expectedState, callbacks) {
-  const redirect = new URL(redirectUri);
-  const port = Number(redirect.port);
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = http2.createServer((req, res) => {
-      const url = new URL(req.url || "", redirect.origin);
-      if (url.pathname !== redirect.pathname) {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => reject(err));
-    server.listen(port, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, 12e4);
-    timeout.unref();
-    server.on("close", () => {
-      clearTimeout(timeout);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code."));
-      }
-    });
-  });
-}
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret) {
-  const data = await postTokenRequest({
-    grant_type: "authorization_code",
-    client_id: clientId2,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
-  });
-  if (!data.refresh_token) {
-    throw new Error("Gemini OAuth did not return a refresh token. Please try login again.");
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token) {
+    throw new Error("ChatGPT token refresh returned no tokens.");
   }
+  const expiresIn = data.expires_in ?? 3600;
   return {
     accessToken: data.access_token,
     refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-async function postTokenRequest(body) {
-  const response = await fetch(TOKEN_URL2, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(body),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Gemini token request failed (${response.status}): ${text}`);
-  }
-  return await response.json();
-}
-async function setupCodeAssistProject(accessToken, callbacks) {
-  const envProject = process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID;
-  if (envProject && /^\d+$/.test(envProject)) {
-    throw new Error("GOOGLE_CLOUD_PROJECT must be a project ID, not a numeric project number.");
-  }
-  const coreMetadata = {
-    ideType: "IDE_UNSPECIFIED",
-    platform: "PLATFORM_UNSPECIFIED",
-    pluginType: "GEMINI"
-  };
-  const projectMetadata = {
-    ...coreMetadata,
-    ...envProject ? { duetProject: envProject } : {}
-  };
-  let loadRes;
-  while (true) {
-    loadRes = await loadCodeAssist(accessToken, envProject, projectMetadata);
-    const validation = getValidationRequiredTier(loadRes);
-    if (!validation) break;
-    callbacks.onStatus(
-      `Gemini Code Assist requires account validation${validation.reasonMessage ? `: ${validation.reasonMessage}` : ""}`
-    );
-    callbacks.onOpenUrl(validation.validationUrl);
-    const answer = await callbacks.onPromptCode(
-      "Complete validation in the browser, then press Enter to retry (or type cancel):"
-    );
-    if (answer.trim().toLowerCase() === "cancel") {
-      throw new Error("Gemini Code Assist account validation was cancelled.");
-    }
-  }
-  if (loadRes.currentTier) {
-    const project2 = loadRes.cloudaicompanionProject ?? envProject;
-    if (!project2) throwProjectError(loadRes);
-    return project2;
-  }
-  const tier = getOnboardTier(loadRes);
-  const onboardReq = tier.id === USER_TIER_FREE ? {
-    tierId: tier.id,
-    cloudaicompanionProject: void 0,
-    metadata: coreMetadata
-  } : {
-    tierId: tier.id,
-    cloudaicompanionProject: envProject,
-    metadata: projectMetadata
+    expiresAt: Date.now() + expiresIn * 1e3,
+    expiresIn,
+    ...data.id_token ? { idToken: data.id_token } : {},
+    ...data.scope ? { scopes: data.scope.split(/\s+/).filter(Boolean) } : {}
   };
-  let operation = await codeAssistPost(
-    accessToken,
-    "onboardUser",
-    onboardReq
-  );
-  while (!operation.done && operation.name) {
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    operation = await codeAssistGet(accessToken, operation.name);
-  }
-  const project = operation.response?.cloudaicompanionProject?.id ?? envProject;
-  if (!project) throwProjectError(loadRes);
-  return project;
 }
-async function loadCodeAssist(accessToken, envProject, metadata) {
-  try {
-    return await codeAssistPost(accessToken, "loadCodeAssist", {
-      ...envProject ? { cloudaicompanionProject: envProject } : {},
-      metadata
-    });
-  } catch (err) {
-    if (err instanceof CodeAssistHttpError && isVpcScAffectedError(err)) {
-      return { currentTier: { id: USER_TIER_STANDARD } };
-    }
-    if (err instanceof CodeAssistHttpError && err.status === 403 && envProject === "cloudshell-gca") {
-      throw new Error(
-        "Access to the default Cloud Shell Gemini project was denied.\nPlease set your own Google Cloud project by running:\ngcloud config set project [PROJECT_ID]\nor setting export GOOGLE_CLOUD_PROJECT=...",
-        { cause: err }
-      );
-    }
-    throw err;
-  }
-}
-function getValidationRequiredTier(response) {
-  return response.ineligibleTiers?.find(
-    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
-  );
-}
-function getOnboardTier(response) {
-  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
-  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
-}
-function throwProjectError(response) {
-  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
-  if (reasons && reasons.length > 0) {
-    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
-  }
-  throw new Error(
-    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
-  );
-}
-async function codeAssistPost(accessToken, method, body) {
-  let lastError;
-  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
+async function revokeChatGPTSignIn(creds, options = {}) {
+  if (!creds.clientId || !creds.refreshToken) return false;
+  const attempts = options.attempts ?? 3;
+  for (let attempt = 0; attempt < attempts; attempt++) {
     try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
+      const response = await postForm(REVOKE_URL, {
+        token: creds.refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: creds.clientId
       });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
-      }
-      lastError = err;
+      if (response.ok) return true;
+      if (response.status < 500) return false;
+    } catch {
+    }
+    if (attempt < attempts - 1) {
+      await new Promise((r) => setTimeout(r, (options.backoffMs ?? 500) * 2 ** attempt));
     }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
-  }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
-}
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
-  });
-}
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
-  }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
-}
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
-}
-function isVpcScAffectedError(error) {
-  try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
-  } catch {
-    return false;
-  }
-}
-function codeAssistHeaders(accessToken) {
-  return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/xai.ts
-var DEFAULT_CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
-var DEFAULT_ISSUER = "https://auth.x.ai";
-var DEFAULT_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
-var OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-var DEFAULT_GROK_CLI_VERSION = "1.0.67";
-var DEVICE_TIMEOUT_FALLBACK_MS = 10 * 60 * 1e3;
-var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
-function issuer() {
-  return (process.env.XAI_OAUTH_ISSUER ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-}
-function clientId() {
-  return process.env.XAI_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID2;
-}
-function grokCliBaseUrl() {
-  return (process.env.XAI_CLI_BASE_URL ?? DEFAULT_CLI_BASE_URL).replace(/\/+$/, "");
-}
-function grokCliVersion() {
-  const raw = process.env.GROK_CLI_VERSION ?? DEFAULT_GROK_CLI_VERSION;
-  const cleaned = raw.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : DEFAULT_GROK_CLI_VERSION;
-}
-function grokCliHeaders(modelId) {
-  return {
-    "X-XAI-Token-Auth": "xai-grok-cli",
-    "x-grok-client-version": grokCliVersion(),
-    "x-grok-client-identifier": "ggcoder",
-    ...modelId ? { "x-grok-model-override": modelId } : {}
-  };
-}
-function isGrokCliEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === grokCliBaseUrl() || /(^|\.)grok\.com/i.test(normalized);
-}
-async function postForm2(endpoint, params) {
-  const response = await fetch(`${issuer()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-      "User-Agent": `grok-cli/${grokCliVersion()}`
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail2(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function jwtExpirySeconds(token) {
-  const payload = token.split(".")[1];
-  if (!payload) return void 0;
-  try {
-    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
-      "utf-8"
-    );
-    const claims = JSON.parse(json);
-    if (!claims || typeof claims !== "object") return void 0;
-    const exp = claims.exp;
-    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function credsFromTokenResponse2(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Grok OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error(
-      "Grok OAuth response missing refresh_token \u2014 the offline_access scope was not granted."
-    );
-  }
-  const responseExpiresIn = Number(data.expires_in);
-  let expiresIn;
-  if (Number.isFinite(responseExpiresIn) && responseExpiresIn > 0) {
-    expiresIn = responseExpiresIn;
-  } else {
-    const exp = jwtExpirySeconds(accessToken);
-    const fromJwt = exp !== void 0 ? exp - Math.floor(Date.now() / 1e3) : 0;
-    expiresIn = fromJwt > 0 ? fromJwt : DEFAULT_TOKEN_LIFETIME_SECONDS;
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: grokCliBaseUrl()
-  };
-}
-async function requestDeviceAuthorization2() {
-  const { status, data } = await postForm2("/oauth2/device/code", {
-    client_id: clientId(),
-    scope: OAUTH_SCOPE
-  });
-  if (status !== 200) {
-    throw new Error(`Grok device authorization failed (${status}): ${errorDetail2(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Grok device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5,
-    // RFC 8628 §3.2: the server states how long the device code lives. Honor it
-    // rather than imposing our own budget — polling a code we know is dead only
-    // burns requests, and a longer local window would keep a user waiting past
-    // the point the code can ever succeed.
-    expiresInMs: (Number(data.expires_in) || 0) > 0 ? Number(data.expires_in) * 1e3 : DEVICE_TIMEOUT_FALLBACK_MS
-  };
-}
-async function pollDeviceToken2(deviceCode) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse2(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Grok token polling server error (${status}): ${errorDetail2(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Grok token polling failed (${status}): ${errorDetail2(data)}`);
   }
-}
-function sleep2(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginXai(callbacks) {
-  const auth = await requestDeviceAuthorization2();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  return false;
+}
+function decodeSegment(segment) {
+  return JSON.parse(Buffer.from(segment, "base64url").toString("utf-8"));
+}
+async function verifyIdToken(idToken, expected) {
+  const [headerSeg, payloadSeg, signatureSeg] = idToken.split(".");
+  if (!headerSeg || !payloadSeg || !signatureSeg) throw new Error("Malformed ChatGPT ID token.");
+  const header = decodeSegment(headerSeg);
+  if (header.alg !== "RS256") throw new Error("Unexpected ChatGPT ID token algorithm.");
+  const response = await fetch(JWKS_URL, { signal: oauthRequestSignal() });
+  if (!response.ok) throw new Error(`Could not load OpenAI signing keys (${response.status}).`);
+  const { keys = [] } = await response.json();
+  const jwk = keys.find((k) => k.kid === header.kid);
+  if (!jwk) throw new Error("ChatGPT ID token is signed with an unknown key.");
+  const valid = crypto3.verify(
+    "RSA-SHA256",
+    Buffer.from(`${headerSeg}.${payloadSeg}`),
+    crypto3.createPublicKey({ key: jwk, format: "jwk" }),
+    Buffer.from(signatureSeg, "base64url")
   );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + auth.expiresInMs;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    const remaining = deadline - Date.now();
-    await sleep2(Math.min(interval * 1e3, remaining));
-    const result = await pollDeviceToken2(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Grok authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Grok device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
+  if (!valid) throw new Error("ChatGPT ID token signature is invalid.");
+  const claims = decodeSegment(payloadSeg);
+  const now = Math.floor((expected.now ?? Date.now()) / 1e3);
+  const aud = claims.aud;
+  const audiences = Array.isArray(aud) ? aud : [aud];
+  if (claims.iss !== ISSUER) throw new Error("ChatGPT ID token has the wrong issuer.");
+  if (!audiences.includes(expected.clientId)) {
+    throw new Error("ChatGPT ID token was issued to another app.");
   }
-  throw new Error("Grok login timed out. Please run login again.");
-}
-async function refreshXaiToken(refreshToken) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse2(data, { fallbackRefreshToken: refreshToken });
+  if (typeof claims.exp !== "number" || claims.exp + ID_TOKEN_CLOCK_SKEW_S < now) {
+    throw new Error("ChatGPT ID token has expired.");
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Grok token refresh failed (${status}): ${errorCode || errorDetail2(data)}`);
+  if (claims.nonce !== expected.nonce) throw new Error("ChatGPT ID token nonce mismatch.");
+  return claims;
 }
 
 // src/file-lock.ts
-import fs3 from "fs/promises";
+import fs4 from "fs/promises";
 import { setTimeout as setTimeout2 } from "timers/promises";
 var STALE_TIMEOUT_MS = 1e4;
 var RETRY_INTERVAL_MS = 50;
@@ -1562,7 +974,7 @@ async function acquireLock(lockPath) {
   while (true) {
     try {
       const info = { pid: process.pid, timestamp: Date.now() };
-      await fs3.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
+      await fs4.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
       return;
     } catch (err) {
       const code = err.code;
@@ -1575,26 +987,26 @@ async function acquireLock(lockPath) {
         continue;
       }
       try {
-        const content = await fs3.readFile(lockPath, "utf-8");
+        const content = await fs4.readFile(lockPath, "utf-8");
         const info = JSON.parse(content);
         const isProcessAlive = isAlive(info.pid);
         const isStale = Date.now() - info.timestamp > STALE_TIMEOUT_MS;
         if (!isProcessAlive || isStale) {
-          await fs3.unlink(lockPath).catch(() => {
+          await fs4.unlink(lockPath).catch(() => {
           });
           continue;
         }
       } catch {
-        const stat = await fs3.stat(lockPath).catch(() => null);
+        const stat = await fs4.stat(lockPath).catch(() => null);
         if (!stat) continue;
         if (Date.now() - stat.mtimeMs > STALE_TIMEOUT_MS) {
-          await fs3.unlink(lockPath).catch(() => {
+          await fs4.unlink(lockPath).catch(() => {
           });
           continue;
         }
       }
       if (Date.now() - startTime > MAX_WAIT_MS) {
-        await fs3.unlink(lockPath).catch(() => {
+        await fs4.unlink(lockPath).catch(() => {
         });
         continue;
       }
@@ -1604,14 +1016,14 @@ async function acquireLock(lockPath) {
 }
 async function lockFileExists(lockPath) {
   try {
-    await fs3.stat(lockPath);
+    await fs4.stat(lockPath);
     return true;
   } catch (err) {
     return err.code !== "ENOENT";
   }
 }
 async function releaseLock(lockPath) {
-  await fs3.unlink(lockPath).catch(() => {
+  await fs4.unlink(lockPath).catch(() => {
   });
 }
 function isAlive(pid) {
@@ -1625,7 +1037,7 @@ function isAlive(pid) {
 }
 
 // src/logger.ts
-import fs4 from "fs";
+import fs5 from "fs";
 import path3 from "path";
 import { randomBytes } from "crypto";
 import { environmentSecrets, redactText, redactValue } from "@kenkaiiii/gg-ai";
@@ -1643,14 +1055,14 @@ var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath, force = false) {
   try {
-    const st = fs4.statSync(filePath);
+    const st = fs5.statSync(filePath);
     if (!force && st.size <= MAX_BYTES - MIN_HEADROOM_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      fs4.unlinkSync(rotated);
+      fs5.unlinkSync(rotated);
     } catch {
     }
-    fs4.renameSync(filePath, rotated);
+    fs5.renameSync(filePath, rotated);
   } catch {
   }
 }
@@ -1658,18 +1070,18 @@ function rotateOpenLog() {
   if (fd === null || logPath === null) return false;
   const sizeBefore = fileBytes;
   try {
-    fs4.closeSync(fd);
+    fs5.closeSync(fd);
   } catch {
   }
   fd = null;
   rotateIfNeeded(logPath, true);
   try {
-    fd = fs4.openSync(logPath, "a");
-    fileBytes = fs4.fstatSync(fd).size;
+    fd = fs5.openSync(logPath, "a");
+    fileBytes = fs5.fstatSync(fd).size;
   } catch {
     if (fd !== null) {
       try {
-        fs4.closeSync(fd);
+        fs5.closeSync(fd);
       } catch {
       }
     }
@@ -1685,22 +1097,22 @@ function openLog(filePath, name) {
   appName = name;
   exactSecrets = environmentSecrets(process.env);
   try {
-    fs4.mkdirSync(path3.dirname(filePath), { recursive: true, mode: 448 });
+    fs5.mkdirSync(path3.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = fs4.openSync(filePath, "a");
+    fd = fs5.openSync(filePath, "a");
   } catch {
     fd = null;
     fileBytes = 0;
     return false;
   }
   try {
-    fileBytes = fs4.fstatSync(fd).size;
+    fileBytes = fs5.fstatSync(fd).size;
   } catch {
     try {
-      fs4.closeSync(fd);
+      fs5.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1713,7 +1125,7 @@ function openLog(filePath, name) {
   sessionId = randomBytes(4).toString("hex");
   try {
     if (fileBytes < MAX_BYTES) {
-      const written = fs4.writeSync(fd, "\n");
+      const written = fs5.writeSync(fd, "\n");
       fileBytes += written;
       processBytes += written;
     }
@@ -1748,9 +1160,9 @@ function log(level, category, message, data) {
 `;
     try {
       if (fileBytes + Buffer.byteLength(capLine) <= MAX_BYTES) {
-        fileBytes += fs4.writeSync(fd, capLine);
+        fileBytes += fs5.writeSync(fd, capLine);
       }
-      fs4.closeSync(fd);
+      fs5.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1760,7 +1172,7 @@ function log(level, category, message, data) {
   if (fileBytes + lineBytes > MAX_BYTES && !rotationFailed && !rotateOpenLog()) return;
   if (fd === null) return;
   try {
-    const written = fs4.writeSync(fd, line);
+    const written = fs5.writeSync(fd, line);
     fileBytes += written;
     processBytes += written;
   } catch {
@@ -1773,7 +1185,7 @@ function closeLogger(opts) {
   if (fd !== null) {
     if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
     try {
-      if (fd !== null) fs4.closeSync(fd);
+      if (fd !== null) fs5.closeSync(fd);
     } catch {
     }
   }
@@ -1789,7 +1201,7 @@ function closeLogger(opts) {
 }
 
 // src/hidden-providers.ts
-var HIDDEN_PROVIDERS = ["gemini"];
+var HIDDEN_PROVIDERS = [];
 function isHiddenProvider(provider) {
   return HIDDEN_PROVIDERS.includes(provider);
 }
@@ -1880,22 +1292,76 @@ async function detectXiaomiTokenPlanBaseUrl(apiKey, options = {}) {
 }
 
 // src/auth-storage.ts
-var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
-var XAI_OAUTH_KEY = "xai-oauth";
-var DUAL_AUTH_PROVIDERS = [
+var OPENAI_CHATGPT_KEY = "openai-chatgpt";
+var KIMI_CODE_KEY = "kimi-code";
+var RETIRED_SIGN_INS = [
+  {
+    provider: "anthropic",
+    storageKey: "anthropic",
+    message: "Your old Claude sign-in no longer works. Sign in with Claude again to keep using your subscription."
+  },
+  {
+    provider: "openai",
+    storageKey: "openai",
+    message: "Your old ChatGPT sign-in no longer works. Continue with ChatGPT again, or add an OpenAI API key."
+  },
   {
     provider: "moonshot",
-    oauthKey: MOONSHOT_OAUTH_KEY,
-    oauthLabel: "Kimi OAuth",
-    apiKeyLabel: "Moonshot API key",
-    restoreHint: 'Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+    storageKey: "moonshot-oauth",
+    message: "Kimi sign-in was removed. Paste a Kimi Code plan key from the Kimi Code Console, or a Moonshot API key."
   },
   {
     provider: "xai",
-    oauthKey: XAI_OAUTH_KEY,
-    oauthLabel: "Grok OAuth",
-    apiKeyLabel: "xAI API key",
-    restoreHint: 'Run "ggcoder login" and choose Grok OAuth to restore OAuth auth.'
+    storageKey: "xai-oauth",
+    message: "Grok sign-in was removed: xAI offers SuperGrok and X Premium usage only in apps it partners with. Add an xAI API key instead."
+  },
+  {
+    provider: "gemini",
+    storageKey: "gemini",
+    message: "Google sign-in was removed. Add a Gemini API key from Google AI Studio instead."
+  }
+];
+function isRetiredEntry(retired, value) {
+  if (!value) return false;
+  switch (retired.storageKey) {
+    case "anthropic":
+      return isLegacyClaudeOAuth(value);
+    // These slots now hold API keys; only a refreshable sign-in token is retired.
+    case "openai":
+    case "gemini":
+      return Boolean(value.refreshToken) || Boolean(value.accountId) || Boolean(value.projectId);
+    default:
+      return true;
+  }
+}
+function isRetiredStorageKey(data, storageKey) {
+  return RETIRED_SIGN_INS.some(
+    (r) => r.storageKey === storageKey && isRetiredEntry(r, data[storageKey])
+  );
+}
+function usableEntry(data, storageKey) {
+  return isRetiredStorageKey(data, storageKey) ? void 0 : data[storageKey];
+}
+function storageKeyProvider(storageKey) {
+  if (storageKey === OPENAI_CHATGPT_KEY) return "openai";
+  if (storageKey === KIMI_CODE_KEY) return "moonshot";
+  if (storageKey === XIAOMI_CREDITS_KEY) return "xiaomi";
+  if (storageKey === GEMINI_API_KEY) return "gemini";
+  return storageKey;
+}
+function apiKeyStorageKeys(provider) {
+  if (provider === "moonshot") return [KIMI_CODE_KEY, "moonshot"];
+  if (provider === "xiaomi") return ["xiaomi", XIAOMI_CREDITS_KEY];
+  if (provider === "gemini") return [GEMINI_API_KEY];
+  return [provider];
+}
+var DUAL_AUTH_PROVIDERS = [
+  {
+    provider: "openai",
+    oauthKey: OPENAI_CHATGPT_KEY,
+    oauthLabel: "ChatGPT plan",
+    apiKeyLabel: "OpenAI API key",
+    restoreHint: 'Run "ggcoder login" and choose Continue with ChatGPT to use your ChatGPT plan again.'
   }
 ];
 function dualAuthProvider(provider) {
@@ -1920,14 +1386,20 @@ function activeBaseUrlEntry(data, provider) {
   const dual = dualAuthProvider(provider);
   if (dual) {
     const oauth = data[dual.oauthKey];
+    const apiKey = usableEntry(data, dual.provider);
     if (oauth) {
       const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && data[dual.provider]) return data[dual.provider];
+      if (Date.now() < exhaustedUntil && apiKey) return apiKey;
       return oauth;
     }
-    return data[dual.provider];
+    return apiKey;
   }
-  return data[provider];
+  const key = apiKeyStorageKeys(provider).find((k) => usableEntry(data, k));
+  const entry = key ? data[key] : void 0;
+  if (key === KIMI_CODE_KEY && entry && !entry.baseUrl) {
+    return { ...entry, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
+  }
+  return entry;
 }
 var MINIMAX_REGION_RETRY_MS = 5 * 60 * 1e3;
 var miniMaxRegionProbes = /* @__PURE__ */ new Map();
@@ -1938,9 +1410,17 @@ function cachedMiniMaxRegion(apiKey) {
   miniMaxRegionProbes.set(apiKey, { at: Date.now(), result });
   return result;
 }
+var kimiRegionProbes = /* @__PURE__ */ new Map();
+function cachedKimiRegion(apiKey) {
+  const cached = kimiRegionProbes.get(apiKey);
+  if (cached && Date.now() - cached.at < MINIMAX_REGION_RETRY_MS) return cached.result;
+  const result = detectKimiCodeBaseUrl(apiKey).catch(() => void 0);
+  kimiRegionProbes.set(apiKey, { at: Date.now(), result });
+  return result;
+}
 function readStoredBaseUrlSync(authFile, provider) {
   try {
-    const data = JSON.parse(readFileSync2(authFile, "utf-8"));
+    const data = JSON.parse(readFileSync(authFile, "utf-8"));
     return activeBaseUrlEntry(data, provider)?.baseUrl;
   } catch {
     return void 0;
@@ -1953,21 +1433,7 @@ function refreshThresholdMs(creds) {
   return Math.max(MIN_REFRESH_THRESHOLD_MS, lifetimeMs * REFRESH_THRESHOLD_RATIO);
 }
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
-var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
-  // Anthropic is API-key only; Claude subscriptions run through Claude Code.
-  "anthropic",
-  "glm",
-  "moonshot",
-  "xiaomi",
-  "minimax",
-  "deepseek",
-  "openrouter",
-  "huggingface",
-  "sakana",
-  "xai",
-  // Local endpoints: a fixed (usually placeholder) key, never refreshable.
-  "local"
-]);
+var REFRESHABLE_STORAGE_KEYS = /* @__PURE__ */ new Set([OPENAI_CHATGPT_KEY]);
 var AuthStorage = class {
   data = {};
   filePath;
@@ -1988,10 +1454,12 @@ var AuthStorage = class {
   refreshLocks = /* @__PURE__ */ new Map();
   detectMiniMaxRegion;
   detectXiaomiCluster;
+  detectKimiRegion;
   constructor(filePath, options) {
     this.filePath = filePath ?? getAppPaths().authFile;
     this.detectMiniMaxRegion = options?.detectMiniMaxBaseUrl ?? cachedMiniMaxRegion;
     this.detectXiaomiCluster = options?.detectXiaomiTokenPlanBaseUrl ?? detectXiaomiTokenPlanBaseUrl;
+    this.detectKimiRegion = options?.detectKimiCodeBaseUrl ?? cachedKimiRegion;
   }
   /** Path to the on-disk auth file. Useful for status output. */
   get path() {
@@ -2019,22 +1487,15 @@ var AuthStorage = class {
     return keys.find((key) => Boolean(this.data[key]));
   }
   /**
-   * True if the user has any usable auth for the logical provider. For a
-   * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
-   * satisfies it.
+   * True if the user has any usable auth for the logical provider: the plan
+   * sign-in or any of its API keys. A retired sign-in doesn't count.
    */
   async hasProviderAuth(provider) {
     if (isHiddenProvider(provider)) return false;
     await this.ensureFresh();
     const dual = dualAuthProvider(provider);
     if (dual) {
-      return Boolean(this.data[dual.oauthKey] || this.data[dual.provider]);
-    }
-    if (provider === "xiaomi") {
-      return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
-    }
-    if (provider === "gemini") {
-      return Boolean(this.data["gemini"] || this.data[GEMINI_API_KEY]);
+      return Boolean(this.data[dual.oauthKey] || usableEntry(this.data, dual.provider));
     }
     if (provider === "anthropic") {
       return Boolean(this.data.anthropic) && !isLegacyClaudeOAuth(this.data.anthropic) || isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY]);
@@ -2042,7 +1503,25 @@ var AuthStorage = class {
     if (provider === "local") {
       return Object.keys(this.data).some((key) => key.startsWith(LOCAL_AUTH_KEY_PREFIX));
     }
-    return Boolean(this.data[provider]);
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /** True if any of `provider`'s API keys is stored. A retired sign-in in a key slot doesn't count. */
+  async hasApiKey(provider) {
+    await this.ensureFresh();
+    if (provider === "anthropic" && isLegacyClaudeOAuth(this.data.anthropic)) return false;
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /**
+   * `provider`'s first stored API key, never its plan sign-in. For calls that
+   * only an API key may make (OpenAI's Images API isn't on the ChatGPT plan).
+   */
+  async resolveApiKey(provider) {
+    await this.ensureFresh();
+    for (const key of apiKeyStorageKeys(provider)) {
+      const creds = usableEntry(this.data, key);
+      if (creds && !(provider === "anthropic" && isLegacyClaudeOAuth(creds))) return creds;
+    }
+    throw new NotLoggedInError(provider);
   }
   /** True when the user signed in with Claude through Claude Code (marker only, no token). */
   async hasClaudeCodeLogin() {
@@ -2056,17 +1535,24 @@ var AuthStorage = class {
       if (isLegacyClaudeOAuth(latest.anthropic)) delete latest.anthropic;
     });
   }
+  /** Retired sign-ins still on disk, so the UI can ask the user to reconnect. */
+  async legacySignIns() {
+    await this.ensureFresh();
+    return RETIRED_SIGN_INS.filter((r) => isRetiredEntry(r, this.data[r.storageKey]));
+  }
   /**
-   * Remove an old GG Claude sign-in token (`sk-ant-oat…`), if any. True when one
-   * was removed, so the caller can tell the user once to sign in with Claude again.
+   * Remove `provider`'s retired sign-in, if any. True when one was removed, so
+   * the caller can tell the user once to reconnect.
    */
-  async takeLegacyClaudeSignIn() {
+  async takeLegacySignIn(provider) {
+    const retired = RETIRED_SIGN_INS.find((r) => r.provider === provider);
+    if (!retired) return false;
     await this.ensureFresh();
-    if (!isLegacyClaudeOAuth(this.data.anthropic)) return false;
+    if (!isRetiredEntry(retired, this.data[retired.storageKey])) return false;
     let removed = false;
     await this.mutateLatest((latest) => {
-      if (!isLegacyClaudeOAuth(latest.anthropic)) return;
-      delete latest.anthropic;
+      if (!isRetiredEntry(retired, latest[retired.storageKey])) return;
+      delete latest[retired.storageKey];
       removed = true;
     });
     return removed;
@@ -2107,18 +1593,18 @@ var AuthStorage = class {
     const oauthCreds = dual ? this.data[dual.oauthKey] : void 0;
     if (dual && oauthCreds) {
       const exhaustedUntil = oauthCreds.usageExhaustedUntil ?? 0;
-      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data[dual.provider]);
+      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(usableEntry(this.data, dual.provider));
       if (!apiKeyActive) return false;
     }
-    return STATIC_API_KEY_PROVIDERS.has(provider);
+    return !REFRESHABLE_STORAGE_KEYS.has(provider);
   }
   /**
    * The base URL on the credential that is active right now, if any.
    * Synchronous — call only after load()/resolveCredentials() populated the
-   * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
-   * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
-   * resolveCredentials would serve (i.e. not currently usage-exhausted with an
-   * API key configured).
+   * snapshot. For a dual-auth provider this is the plan endpoint whenever the
+   * sign-in is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured); for a plan/pay-per-token key
+   * split it is the plan key's endpoint when one is stored.
    */
   getStoredBaseUrl(provider) {
     return activeBaseUrlEntry(this.data, provider)?.baseUrl;
@@ -2127,7 +1613,7 @@ var AuthStorage = class {
     const first = !this.loaded;
     await withFileLock(this.filePath, async () => {
       try {
-        const content = await fs5.readFile(this.filePath, "utf-8");
+        const content = await fs6.readFile(this.filePath, "utf-8");
         this.data = JSON.parse(content);
         if (first) {
           log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
@@ -2173,7 +1659,7 @@ var AuthStorage = class {
     }
     let changed;
     try {
-      const stat = await fs5.stat(this.filePath);
+      const stat = await fs6.stat(this.filePath);
       changed = stat.ino !== this.snapshotIno || stat.mtimeMs !== this.snapshotMtimeMs || stat.size !== this.snapshotSize;
     } catch {
       changed = this.snapshotSize !== -1;
@@ -2186,7 +1672,7 @@ var AuthStorage = class {
    */
   async rememberSnapshot() {
     try {
-      const stat = await fs5.stat(this.filePath);
+      const stat = await fs6.stat(this.filePath);
       this.snapshotMtimeMs = stat.mtimeMs;
       this.snapshotSize = stat.size;
       this.snapshotIno = stat.ino;
@@ -2241,9 +1727,34 @@ var AuthStorage = class {
     });
     return { ...creds, baseUrl };
   }
-  async setCredentials(provider, creds) {
+  /**
+   * A Kimi Code key saved without an endpoint gets the host that issued it
+   * (`api.kimi.com` or `api.kimi.ai`), saved so the check runs once.
+   */
+  async withKimiRegion(creds) {
+    const baseUrl = await this.detectKimiRegion(creds.accessToken);
+    if (!baseUrl) return { ...creds, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
+    log("INFO", "auth", `Kimi Code key belongs to ${baseUrl} \u2014 saved for future requests`);
+    await this.mutateLatest((latest) => {
+      const current = latest[KIMI_CODE_KEY];
+      if (current?.accessToken === creds.accessToken && !current.baseUrl) {
+        current.baseUrl = baseUrl;
+      }
+    });
+    return { ...creds, baseUrl };
+  }
+  /**
+   * Store `creds` under `storageKey`. Connecting a provider again also removes
+   * its retired sign-in, which is what the reconnect notice asked for.
+   */
+  async setCredentials(storageKey, creds) {
+    const provider = storageKeyProvider(storageKey);
     await this.mutateLatest((latest) => {
-      latest[provider] = creds;
+      for (const retired of RETIRED_SIGN_INS) {
+        if (retired.provider !== provider || retired.storageKey === storageKey) continue;
+        if (isRetiredEntry(retired, latest[retired.storageKey])) delete latest[retired.storageKey];
+      }
+      latest[storageKey] = creds;
     });
   }
   /**
@@ -2280,9 +1791,9 @@ var AuthStorage = class {
    * Mark the credential stored under `storageKey` as usage-exhausted until
    * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
    * 15-minute default when no reset time is known. While the mark is in the
-   * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-   * instead of the subscription OAuth credential (when both are configured) — OAuth
-   * stays the preferred credential and is retried automatically once the mark
+   * future, `resolveCredentials("openai")` serves the OpenAI API key instead of
+   * the ChatGPT plan sign-in (when both are configured) — the plan stays the
+   * preferred credential and is retried automatically once the mark
    * lapses. Persisted to auth.json so a restart (or another gg-app window)
    * doesn't burn a request rediscovering the same exhausted window. No-op if
    * nothing is stored under `storageKey`.
@@ -2327,12 +1838,12 @@ var AuthStorage = class {
       await this.ensureFresh();
     }
     const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
-    if (!directStorageKeys.some((key) => Boolean(this.data[key])) && !(provider === "anthropic" && this.data[CLAUDE_CODE_AUTH_KEY])) {
+    if (!directStorageKeys.some((key) => Boolean(usableEntry(this.data, key))) && !(provider === "anthropic" && this.data[CLAUDE_CODE_AUTH_KEY])) {
       await this.reloadLatest();
     }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
-        const creds2 = this.data[key];
+        const creds2 = usableEntry(this.data, key);
         if (!creds2) continue;
         if (key !== provider && dualAuthProviderByOAuthKey(key)) {
           return await this.resolveCredentials(key, {
@@ -2346,6 +1857,7 @@ var AuthStorage = class {
             ...opts.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
           });
         }
+        if (key === KIMI_CODE_KEY && !creds2.baseUrl) return await this.withKimiRegion(creds2);
         return creds2;
       }
       throw new NotLoggedInError(provider);
@@ -2358,15 +1870,16 @@ var AuthStorage = class {
     }
     const dual = dualAuthProvider(provider);
     const dualOAuthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    const dualApiKey = dual ? usableEntry(this.data, dual.provider) : void 0;
     if (dual && dualOAuthCreds) {
       const exhaustedUntil = dualOAuthCreds.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && this.data[dual.provider]) {
+      if (Date.now() < exhaustedUntil && dualApiKey) {
         log(
           "WARN",
           "auth",
           `${dual.oauthLabel} usage window is exhausted \u2014 using the ${dual.apiKeyLabel} until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
         );
-        return this.data[dual.provider];
+        return dualApiKey;
       }
       try {
         return await this.resolveCredentials(dual.oauthKey, {
@@ -2374,23 +1887,24 @@ var AuthStorage = class {
           ...opts?.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
         });
       } catch (err) {
-        if (err instanceof NotLoggedInError && this.data[dual.provider]) {
+        if (err instanceof NotLoggedInError && dualApiKey) {
           log(
             "WARN",
             "auth",
             `${dual.oauthLabel} credential is no longer valid \u2014 falling back to the ${dual.apiKeyLabel}. ${dual.restoreHint}`
           );
-          return this.data[dual.provider];
+          return dualApiKey;
         }
         throw err;
       }
     }
-    const creds = this.data[provider];
+    const creds = usableEntry(this.data, provider);
     if (!creds) {
       throw new NotLoggedInError(provider);
     }
-    if (STATIC_API_KEY_PROVIDERS.has(provider)) {
+    if (!REFRESHABLE_STORAGE_KEYS.has(provider)) {
       if (provider === "minimax" && !creds.baseUrl) return await this.withMiniMaxRegion(creds);
+      if (provider === KIMI_CODE_KEY && !creds.baseUrl) return await this.withKimiRegion(creds);
       return creds;
     }
     if (!opts?.forceRefresh && Date.now() < creds.expiresAt - refreshThresholdMs(creds)) {
@@ -2418,13 +1932,14 @@ var AuthStorage = class {
         this.data = latest;
         return latestCreds;
       }
-      const refreshFn = provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : provider === XAI_OAUTH_KEY ? refreshXaiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(latestCreds.refreshToken);
+        refreshed = await refreshChatGPTToken(latestCreds);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
+        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh|token_expired|refresh_token_(?:expired|invalidated|reused)/i.test(
+          msg
+        ) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
           const current = await readAuthData(this.filePath);
           const currentCreds = current[provider];
@@ -2444,15 +1959,10 @@ var AuthStorage = class {
         }
         throw err;
       }
-      if (!refreshed.accountId && latestCreds.accountId) {
-        refreshed.accountId = latestCreds.accountId;
-      }
-      if (!refreshed.projectId && latestCreds.projectId) {
-        refreshed.projectId = latestCreds.projectId;
-      }
-      if (!refreshed.baseUrl && latestCreds.baseUrl) {
-        refreshed.baseUrl = latestCreds.baseUrl;
-      }
+      refreshed = {
+        ...pick(latestCreds, ["accountId", "baseUrl", "clientId", "idToken", "scopes"]),
+        ...refreshed
+      };
       latest[provider] = refreshed;
       this.data = latest;
       await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
@@ -2475,9 +1985,14 @@ var AuthStorage = class {
     return creds.accessToken;
   }
 };
+function pick(value, keys) {
+  const out = {};
+  for (const key of keys) if (value[key] !== void 0) out[key] = value[key];
+  return out;
+}
 async function readAuthData(filePath) {
   try {
-    const content = await fs5.readFile(filePath, "utf-8");
+    const content = await fs6.readFile(filePath, "utf-8");
     return JSON.parse(content);
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -2485,12 +2000,12 @@ async function readAuthData(filePath) {
   }
 }
 async function atomicWriteFile(filePath, content) {
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto5.randomUUID().slice(0, 8)}.tmp`;
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto4.randomUUID().slice(0, 8)}.tmp`;
   try {
-    await fs5.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await fs5.rename(tmpPath, filePath);
+    await fs6.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await fs6.rename(tmpPath, filePath);
   } catch (err) {
-    await fs5.unlink(tmpPath).catch(() => {
+    await fs6.unlink(tmpPath).catch(() => {
     });
     throw err;
   }
@@ -2522,7 +2037,8 @@ var CODEX_FAST_BILLING = {
   detail: "Codex Fast mode uses your ChatGPT plan limits at 2.5x the standard rate (purchased credits at 2x).",
   paid: false
 };
-var GEMINI_AUTH_KEYS = [GEMINI_API_KEY, "gemini"];
+var GEMINI_AUTH_KEYS = [GEMINI_API_KEY];
+var KIMI_AUTH_KEYS = [KIMI_CODE_KEY, "moonshot"];
 var MODELS = [
   // ── Anthropic ──────────────────────────────────────────
   // NOTE: Claude Mythos 5.1 (`claude-mythos-5-1`, 2026-09-01) is kept commented
@@ -2652,14 +2168,13 @@ var MODELS = [
   {
     // GPT-6 Astra — "Our most capable model for complex, demanding work."
     // (Codex catalog priority 2, listed for every ChatGPT plan, requires a
-    // Codex client >= 0.153.0 — see CODEX_CLIENT_VERSION). Same split as 5.6:
-    // 1.05M on the public Responses API, 272K on the ChatGPT OAuth route
+    // Codex client >= 0.153.0). Same split as 5.6:
+    // 1.05M on the public Responses API, 272K on the ChatGPT plan route
     // (openai/codex models.json, `gpt-6-astra`). Reasoning ladder low → medium
     // → high → xhigh → max → ultra; `ultra` is the Codex orchestration preset
     // (multi_agent v2) and is Codex-only — the public API tops out at `max`.
-    // Note: through a plain API key OpenAI requires the Responses API for tool
-    // calling on Astra, so the Chat Completions path is text-only; the OAuth
-    // Codex route is the supported way to use it as an agent.
+    // OpenAI requires the Responses API for tool calling on Astra, so both
+    // the ChatGPT plan and API keys ride gg-ai's Responses transport.
     id: "gpt-6-astra",
     name: "GPT-6 Astra",
     provider: "openai",
@@ -2702,9 +2217,7 @@ var MODELS = [
   // next start.
   {
     // GPT-6.1 Sol — "Latest workhorse model for coding and everyday work."
-    // (Codex priority 1, default low). The catalog says Codex client >= 0.153.0,
-    // but the ChatGPT backend only serves it from 0.159.0 (see
-    // CODEX_CLIENT_VERSION). $2/$10 MTok, cached input $0.10. Ladder low →
+    // (Codex priority 1, default low). $2/$10 MTok, cached input $0.10. Ladder low →
     // medium → high → xhigh → max → ultra; ultra is the Codex orchestration
     // preset (xhigh effort on the wire + proactive local subagent delegation).
     id: "gpt-6.1-sol",
@@ -2891,8 +2404,8 @@ var MODELS = [
     maxThinkingLevel: "high",
     authStorageKeys: GEMINI_AUTH_KEYS
   },
-  // Keep 3.1 Flash Lite first for the working OAuth default and fast-model routing.
-  // New GA models are opt-in; Code Assist access varies by account. Gemini 3.7
+  // Keep 3.1 Flash Lite first for the default and fast-model routing.
+  // Gemini 3.7
   // Flash is retired: Google deprecated it on 2026-10-08 and routes every
   // `gemini-3.7-flash` request to 3.8 Flash (ai.google.dev/gemini-api/docs/
   // changelog), so a saved session on it falls back to the provider default.
@@ -2925,9 +2438,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Wire name `gemini-3-flash` — the Code Assist (OAuth) backend rejects the
-    // display string `gemini-3.5-flash` with a 404, so gemini-cli keeps this
-    // alternative name (SECONDARY_GEMINI_3_5_FLASH_MODEL) for that endpoint.
+    // Wire name `gemini-3-flash`, the id Google serves 3.5 Flash under.
     id: "gemini-3-flash",
     name: "Gemini 3.5 Flash",
     provider: "gemini",
@@ -2942,9 +2453,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Gemini 3.1 Pro is public preview — gated behind Code Assist preview
-    // enablement, so free/personal OAuth accounts 404 on it (see
-    // ACCOUNT_GATED_MODELS in gg-ai's gemini provider).
+    // Gemini 3.1 Pro is public preview.
     id: "gemini-3.1-pro-preview",
     name: "Gemini 3.1 Pro (Preview)",
     provider: "gemini",
@@ -2961,8 +2470,8 @@ var MODELS = [
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
   // work, and deep reasoning. Its effort ladder is server-declared as
-  // low/high/max on both the public API (default max) and the Kimi For Coding
-  // OAuth endpoint (default high); thinking can also be fully disabled.
+  // low/high/max on both the public API (default max) and the Kimi Code plan
+  // endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -2976,13 +2485,14 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "high",
-    maxThinkingLevel: "max"
+    maxThinkingLevel: "max",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
-  // K2.8 Preview (2026-09-11) is served only on the Kimi For Coding OAuth
-  // endpoint, under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
+  // K2.8 Preview (2026-09-11) is served only on the Kimi Code plan endpoint,
+  // under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
   // display_name "K2.8 Preview", 1M context, image + video input, efforts
-  // low/high/max default max). The public API-key endpoint does not serve it,
-  // so it resolves from the Kimi sign-in credential only.
+  // low/high/max default max). The public Moonshot API does not serve it, so
+  // it resolves from a Kimi Code plan key only.
   {
     id: "kimi-for-coding",
     name: "Kimi K2.8 Preview",
@@ -2995,7 +2505,7 @@ var MODELS = [
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
     maxThinkingLevel: "max",
-    authStorageKeys: [MOONSHOT_OAUTH_KEY]
+    authStorageKeys: [KIMI_CODE_KEY]
   },
   // K2.7 Code is requested by its pinned id (not the `kimi-for-coding` alias
   // that moved to K2.8), so it stays the real K2.7 on both endpoints.
@@ -3010,7 +2520,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // K2.7 Code HighSpeed — the same model as K2.7 Code served at ~180 tok/s
   // (up to ~260 on short contexts), 256K context (platform.kimi.ai model list,
@@ -3029,7 +2540,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // ── Z.AI (GLM) ─────────────────────────────────────────
   // Two GLM entries, both live on the coding endpoint (verified against its
@@ -3442,11 +2954,10 @@ function getSummaryModel(provider, currentModelId) {
 }
 
 export {
-  kimiCodeBaseUrl,
-  kimiCodingHeaders,
+  KIMI_CODE_DEFAULT_BASE_URL,
+  KIMI_CODE_OVERSEAS_BASE_URL,
+  detectKimiCodeBaseUrl,
   isKimiCodingEndpoint,
-  loginKimi,
-  refreshKimiToken,
   CLAUDE_CODE_MANIFEST,
   CLAUDE_CODE_AUTH_KEY,
   CLAUDE_CODE_AUTH_MARKER,
@@ -3465,15 +2976,18 @@ export {
   claudeCodeCallbackUrl,
   loginClaudeCode,
   generatePKCE,
-  loginOpenAI,
-  refreshOpenAIToken,
-  loginGemini,
-  refreshGeminiToken,
-  grokCliBaseUrl,
-  grokCliHeaders,
-  isGrokCliEndpoint,
-  loginXai,
-  refreshXaiToken,
+  CHATGPT_PLAN_SCOPE,
+  CHATGPT_PLAN_BASE_URL,
+  CHATGPT_USAGE_URL,
+  CHATGPT_PLAN_NOT_ENABLED_MESSAGE,
+  ChatGPTPlanNotEnabledError,
+  getChatGPTHostId,
+  loginChatGPT,
+  fetchChatGPTPlanModels,
+  parseCallbackInput,
+  refreshChatGPTToken,
+  revokeChatGPTSignIn,
+  verifyIdToken,
   withFileLock,
   openLog,
   getSessionId,
@@ -3488,8 +3002,11 @@ export {
   detectMiniMaxBaseUrl,
   XIAOMI_TOKEN_PLAN_BASE_URLS,
   detectXiaomiTokenPlanBaseUrl,
-  MOONSHOT_OAUTH_KEY,
-  XAI_OAUTH_KEY,
+  OPENAI_CHATGPT_KEY,
+  KIMI_CODE_KEY,
+  RETIRED_SIGN_INS,
+  storageKeyProvider,
+  apiKeyStorageKeys,
   dualAuthProvider,
   dualAuthProviderByOAuthKey,
   oauthStorageKey,
@@ -3524,4 +3041,4 @@ export {
   getDefaultThinkingLevel,
   getSummaryModel
 };
-//# sourceMappingURL=chunk-JLEBGMG4.js.map
+//# sourceMappingURL=chunk-J7W5HS6X.js.map