@kenkaiiii/gg-core 5.94.0 → 5.95.0

package/dist/index.cjs

@@ -32,29 +32,38 @@ var index_exports = {};
 __export(index_exports, {
   AUTH_PROVIDERS: () => AUTH_PROVIDERS,
   AuthStorage: () => AuthStorage,
+  CHATGPT_PLAN_BASE_URL: () => CHATGPT_PLAN_BASE_URL,
+  CHATGPT_PLAN_NOT_ENABLED_MESSAGE: () => CHATGPT_PLAN_NOT_ENABLED_MESSAGE,
+  CHATGPT_PLAN_SCOPE: () => CHATGPT_PLAN_SCOPE,
+  CHATGPT_USAGE_URL: () => CHATGPT_USAGE_URL,
   CLAUDE_CODE_AUTH_KEY: () => CLAUDE_CODE_AUTH_KEY,
   CLAUDE_CODE_AUTH_MARKER: () => CLAUDE_CODE_AUTH_MARKER,
   CLAUDE_CODE_MANIFEST: () => CLAUDE_CODE_MANIFEST,
+  ChatGPTPlanNotEnabledError: () => ChatGPTPlanNotEnabledError,
   DEFAULT_LOCAL_ENDPOINTS: () => DEFAULT_LOCAL_ENDPOINTS,
   DEFAULT_MAX_VIDEO_BYTES: () => DEFAULT_MAX_VIDEO_BYTES,
   FALLBACK_CONTEXT_WINDOW: () => FALLBACK_CONTEXT_WINDOW,
   GEMINI_API_KEY: () => GEMINI_API_KEY,
   GEMINI_API_KEY_BASE_URL: () => GEMINI_API_KEY_BASE_URL,
   HIDDEN_PROVIDERS: () => HIDDEN_PROVIDERS,
+  KIMI_CODE_DEFAULT_BASE_URL: () => KIMI_CODE_DEFAULT_BASE_URL,
+  KIMI_CODE_KEY: () => KIMI_CODE_KEY,
+  KIMI_CODE_OVERSEAS_BASE_URL: () => KIMI_CODE_OVERSEAS_BASE_URL,
   LOCAL_API_KEY_PLACEHOLDER: () => LOCAL_API_KEY_PLACEHOLDER,
   LOCAL_AUTH_KEY_PREFIX: () => LOCAL_AUTH_KEY_PREFIX,
   MINIMAX_CN_BASE_URL: () => MINIMAX_CN_BASE_URL,
   MINIMAX_GLOBAL_BASE_URL: () => MINIMAX_GLOBAL_BASE_URL,
   MODELS: () => MODELS,
-  MOONSHOT_OAUTH_KEY: () => MOONSHOT_OAUTH_KEY,
   NotLoggedInError: () => NotLoggedInError,
+  OPENAI_CHATGPT_KEY: () => OPENAI_CHATGPT_KEY,
   OPENROUTER_DEFAULT_BASE_URL: () => OPENROUTER_DEFAULT_BASE_URL,
   PLAN_MODE_THINKING_CAP: () => PLAN_MODE_THINKING_CAP,
+  RETIRED_SIGN_INS: () => RETIRED_SIGN_INS,
   SubscriptionUsageError: () => SubscriptionUsageError,
   TelegramBot: () => TelegramBot,
-  XAI_OAUTH_KEY: () => XAI_OAUTH_KEY,
   XIAOMI_CREDITS_KEY: () => XIAOMI_CREDITS_KEY,
   XIAOMI_TOKEN_PLAN_BASE_URLS: () => XIAOMI_TOKEN_PLAN_BASE_URLS,
+  apiKeyStorageKeys: () => apiKeyStorageKeys,
   authPriorityNote: () => authPriorityNote,
   clampThinkingForPlanMode: () => clampThinkingForPlanMode,
   claudeCodeAuthStatus: () => claudeCodeAuthStatus,
@@ -71,6 +80,7 @@ __export(index_exports, {
   createAutoUpdater: () => createAutoUpdater,
   decodeOggOpus: () => decodeOggOpus,
   describeAuthMethods: () => describeAuthMethods,
+  detectKimiCodeBaseUrl: () => detectKimiCodeBaseUrl,
   detectMiniMaxBaseUrl: () => detectMiniMaxBaseUrl,
   detectXiaomiTokenPlanBaseUrl: () => detectXiaomiTokenPlanBaseUrl,
   discoverLocalModels: () => discoverLocalModels,
@@ -79,6 +89,7 @@ __export(index_exports, {
   dualAuthProviderByOAuthKey: () => dualAuthProviderByOAuthKey,
   endpointRoot: () => endpointRoot,
   ensureClaudeCodeBinary: () => ensureClaudeCodeBinary,
+  fetchChatGPTPlanModels: () => fetchChatGPTPlanModels,
   fetchSubscriptionUsage: () => fetchSubscriptionUsage,
   findProbedModel: () => findProbedModel,
   formatClaudeCodeInstallProgress: () => formatClaudeCodeInstallProgress,
@@ -89,6 +100,7 @@ __export(index_exports, {
   getAuthProvider: () => getAuthProvider,
   getAuthStorageKey: () => getAuthStorageKey,
   getAuthStorageKeys: () => getAuthStorageKeys,
+  getChatGPTHostId: () => getChatGPTHostId,
   getContextWindow: () => getContextWindow,
   getDefaultModel: () => getDefaultModel,
   getDefaultThinkingLevel: () => getDefaultThinkingLevel,
@@ -104,10 +116,7 @@ __export(index_exports, {
   getSupportedThinkingLevels: () => getSupportedThinkingLevels,
   getToolResultCharLimit: () => getToolResultCharLimit,
   getVideoByteLimit: () => getVideoByteLimit,
-  grokCliBaseUrl: () => grokCliBaseUrl,
-  grokCliHeaders: () => grokCliHeaders,
   isClaudeCodeAuthMarker: () => isClaudeCodeAuthMarker,
-  isGrokCliEndpoint: () => isGrokCliEndpoint,
   isHiddenProvider: () => isHiddenProvider,
   isKimiCodingEndpoint: () => isKimiCodingEndpoint,
   isLegacyClaudeOAuth: () => isLegacyClaudeOAuth,
@@ -116,21 +125,17 @@ __export(index_exports, {
   isModelLoaded: () => isModelLoaded,
   isPaidModel: () => isPaidModel,
   isThinkingLevelSupported: () => isThinkingLevelSupported,
-  kimiCodeBaseUrl: () => kimiCodeBaseUrl,
-  kimiCodingHeaders: () => kimiCodingHeaders,
   localAuthStorageKey: () => localAuthStorageKey,
   localModelShortName: () => localModelShortName,
   log: () => log,
+  loginChatGPT: () => loginChatGPT,
   loginClaudeCode: () => loginClaudeCode,
-  loginGemini: () => loginGemini,
-  loginKimi: () => loginKimi,
-  loginOpenAI: () => loginOpenAI,
-  loginXai: () => loginXai,
   logoutClaudeCode: () => logoutClaudeCode,
   mergeClaudeCodeRateLimit: () => mergeClaudeCodeRateLimit,
   oauthStorageKey: () => oauthStorageKey,
   ollamaServedContext: () => ollamaServedContext,
   openLog: () => openLog,
+  parseCallbackInput: () => parseCallbackInput,
   parseLocalModelId: () => parseLocalModelId,
   parseOpenRouterCatalog: () => parseOpenRouterCatalog,
   probeEndpoint: () => probeEndpoint,
@@ -138,32 +143,63 @@ __export(index_exports, {
   readClaudeCodeUsage: () => readClaudeCodeUsage,
   readStoredBaseUrlSync: () => readStoredBaseUrlSync,
   recordClaudeCodeRateLimit: () => recordClaudeCodeRateLimit,
-  refreshGeminiToken: () => refreshGeminiToken,
-  refreshKimiToken: () => refreshKimiToken,
-  refreshOpenAIToken: () => refreshOpenAIToken,
-  refreshXaiToken: () => refreshXaiToken,
+  refreshChatGPTToken: () => refreshChatGPTToken,
   registerLogCleanup: () => registerLogCleanup,
   registerRuntimeModels: () => registerRuntimeModels,
+  requiredKeyLabel: () => requiredKeyLabel,
   resample: () => resample,
   resolveClaudeCodeBinary: () => resolveClaudeCodeBinary,
+  revokeChatGPTSignIn: () => revokeChatGPTSignIn,
   setProgressCallback: () => setProgressCallback,
   setProviderCatalog: () => setProviderCatalog,
   signInWithClaudeCode: () => signInWithClaudeCode,
   signOutOfClaudeCode: () => signOutOfClaudeCode,
+  storageKeyProvider: () => storageKeyProvider,
   toModelInfo: () => toModelInfo,
   transcribeVoice: () => transcribeVoice,
   usesOpenAICodexTransport: () => usesOpenAICodexTransport,
+  verifyIdToken: () => verifyIdToken,
   withFileLock: () => withFileLock,
   withoutPaidTier: () => withoutPaidTier
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/oauth/kimi.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto = require("crypto");
-var import_node_fs = require("fs");
-var import_node_os2 = require("os");
-var import_node_path2 = __toESM(require("path"), 1);
+// src/kimi-region.ts
+var import_gg_ai = require("@kenkaiiii/gg-ai");
+var KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_CODE_OVERSEAS_BASE_URL = "https://api.kimi.ai/coding/v1";
+var KIMI_CODE_BASE_URLS = [KIMI_CODE_DEFAULT_BASE_URL, KIMI_CODE_OVERSEAS_BASE_URL];
+async function probeHost(baseUrl, apiKey, fetchImpl, timeoutMs) {
+  try {
+    const res = await fetchImpl(`${baseUrl}/models`, {
+      headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": import_gg_ai.GG_CODER_USER_AGENT },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (res.ok) return "authorized";
+    if (res.status === 401 || res.status === 403) return "unauthorized";
+    return "inconclusive";
+  } catch {
+    return "inconclusive";
+  }
+}
+async function detectKimiCodeBaseUrl(apiKey, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const results = await Promise.all(
+    KIMI_CODE_BASE_URLS.map((url) => probeHost(url, apiKey, fetchImpl, timeoutMs))
+  );
+  const index = results.indexOf("authorized");
+  return index === -1 ? void 0 : KIMI_CODE_BASE_URLS[index];
+}
+function isKimiCodingEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  return /^https:\/\/api\.kimi\.(com|ai)\/coding(\/|$)/i.test(baseUrl);
+}
+
+// src/auth-storage.ts
+var import_promises6 = __toESM(require("fs/promises"), 1);
+var import_node_fs4 = require("fs");
+var import_node_crypto4 = __toESM(require("crypto"), 1);
 
 // src/paths.ts
 var import_node_path = __toESM(require("path"), 1);
@@ -194,240 +230,15 @@ function getAppPaths() {
   };
 }
 
-// src/oauth/request-timeout.ts
-var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
-function oauthRequestSignal() {
-  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
-}
-
-// src/oauth/kimi.ts
-var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = (0, import_node_child_process.execFileSync)("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os2 = (0, import_node_os2.type)();
-  const version = (0, import_node_os2.release)();
-  const osArch = (0, import_node_os2.arch)();
-  if (os2 === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os2 === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os2} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = import_node_path2.default.join(getAppPaths().agentDir, "kimi_device_id");
-  if ((0, import_node_fs.existsSync)(idPath)) {
-    try {
-      const text = (0, import_node_fs.readFileSync)(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = (0, import_node_crypto.randomUUID)();
-  try {
-    (0, import_node_fs.mkdirSync)(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    (0, import_node_fs.writeFileSync)(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader((0, import_node_os2.hostname)()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader((0, import_node_os2.release)()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
-}
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    expiresIn,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
-}
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
-}
-
-// src/auth-storage.ts
-var import_promises5 = __toESM(require("fs/promises"), 1);
-var import_node_fs5 = require("fs");
-var import_node_crypto6 = __toESM(require("crypto"), 1);
-
 // src/claude-code/runtime.ts
-var import_node_child_process2 = require("child_process");
-var import_node_crypto2 = __toESM(require("crypto"), 1);
-var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_child_process = require("child_process");
+var import_node_crypto = __toESM(require("crypto"), 1);
+var import_node_fs2 = __toESM(require("fs"), 1);
 var import_promises2 = __toESM(require("fs/promises"), 1);
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
 
 // src/claude-code/tar.ts
-var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_fs = __toESM(require("fs"), 1);
 var import_promises = __toESM(require("fs/promises"), 1);
 var import_node_zlib = __toESM(require("zlib"), 1);
 var BLOCK = 512;
@@ -459,7 +270,7 @@ function paxPath(data) {
   return void 0;
 }
 async function extractFileFromTarGz(tgzPath, entryName, destPath) {
-  const input = import_node_fs2.default.createReadStream(tgzPath).pipe(import_node_zlib.default.createGunzip());
+  const input = import_node_fs.default.createReadStream(tgzPath).pipe(import_node_zlib.default.createGunzip());
   let pending = Buffer.alloc(0);
   let remaining = 0;
   let padding = 0;
@@ -505,7 +316,7 @@ async function extractFileFromTarGz(tgzPath, entryName, destPath) {
         pos += BLOCK;
         if (header.every((b) => b === 0)) continue;
         const size = readSize(header, 124);
-        const type2 = String.fromCharCode(header[156] || 48);
+        const type = String.fromCharCode(header[156] || 48);
         let name = readString(header, 0, 100);
         if (readString(header, 257, 6) === "ustar") {
           const prefix = readString(header, 345, 155);
@@ -514,12 +325,12 @@ async function extractFileFromTarGz(tgzPath, entryName, destPath) {
         remaining = size;
         padding = (BLOCK - size % BLOCK) % BLOCK;
         meta = [];
-        if (type2 === "x") kind = "pax";
-        else if (type2 === "L") kind = "longname";
+        if (type === "x") kind = "pax";
+        else if (type === "L") kind = "longname";
         else {
           const path7 = overridePath ?? name;
           overridePath = void 0;
-          if ((type2 === "0" || type2 === "\0" || type2 === "7") && path7 === entryName) {
+          if ((type === "0" || type === "\0" || type === "7") && path7 === entryName) {
             kind = "target";
             out = await import_promises.default.open(destPath, "w", 493);
             if (size === 0) {
@@ -609,10 +420,10 @@ function isMusl() {
   return report != null && report.header?.glibcVersionRuntime === void 0;
 }
 function claudeCodePlatformKey(info = { platform: process.platform, arch: process.arch, musl: isMusl() }) {
-  const arch2 = info.arch === "arm64" || info.arch === "x64" ? info.arch : null;
-  if (!arch2) return null;
-  if (info.platform === "darwin" || info.platform === "win32") return `${info.platform}-${arch2}`;
-  if (info.platform === "linux") return `linux-${arch2}${info.musl ? "-musl" : ""}`;
+  const arch = info.arch === "arm64" || info.arch === "x64" ? info.arch : null;
+  if (!arch) return null;
+  if (info.platform === "darwin" || info.platform === "win32") return `${info.platform}-${arch}`;
+  if (info.platform === "linux") return `linux-${arch}${info.musl ? "-musl" : ""}`;
   return null;
 }
 function resolveAsset(opts) {
@@ -630,11 +441,11 @@ function claudeCodeHome(opts = {}) {
   return opts.home ?? getAppPaths().claudeCodeDir;
 }
 function claudeCodeConfigDir(opts = {}) {
-  return opts.home ? import_node_path3.default.join(opts.home, "config") : getAppPaths().claudeCodeConfigDir;
+  return opts.home ? import_node_path2.default.join(opts.home, "config") : getAppPaths().claudeCodeConfigDir;
 }
 function claudeCodeBinaryPath(opts = {}) {
   const { manifest, asset } = resolveAsset(opts);
-  return import_node_path3.default.join(claudeCodeHome(opts), manifest.claudeCodeVersion, asset.bin);
+  return import_node_path2.default.join(claudeCodeHome(opts), manifest.claudeCodeVersion, asset.bin);
 }
 function resolveClaudeCodeBinary(opts = {}) {
   let binary;
@@ -644,7 +455,7 @@ function resolveClaudeCodeBinary(opts = {}) {
     return null;
   }
   try {
-    return import_node_fs3.default.statSync(binary).isFile() ? binary : null;
+    return import_node_fs2.default.statSync(binary).isFile() ? binary : null;
   } catch {
     return null;
   }
@@ -664,12 +475,12 @@ async function ensureClaudeCodeBinary(opts = {}) {
 async function installClaudeCode(opts) {
   const { manifest, asset } = resolveAsset(opts);
   const home = claudeCodeHome(opts);
-  const versionDir = import_node_path3.default.join(home, manifest.claudeCodeVersion);
-  const binary = import_node_path3.default.join(versionDir, asset.bin);
+  const versionDir = import_node_path2.default.join(home, manifest.claudeCodeVersion);
+  const binary = import_node_path2.default.join(versionDir, asset.bin);
   await import_promises2.default.mkdir(home, { recursive: true });
-  const tag = `${process.pid}-${import_node_crypto2.default.randomBytes(4).toString("hex")}`;
-  const tarball = import_node_path3.default.join(home, `.download-${tag}.tgz`);
-  const staging = import_node_path3.default.join(home, `.staging-${tag}`);
+  const tag = `${process.pid}-${import_node_crypto.default.randomBytes(4).toString("hex")}`;
+  const tarball = import_node_path2.default.join(home, `.download-${tag}.tgz`);
+  const staging = import_node_path2.default.join(home, `.staging-${tag}`);
   try {
     await download(asset, tarball, opts);
     opts.onProgress?.({ phase: "extract" });
@@ -677,14 +488,14 @@ async function installClaudeCode(opts) {
     const found = await extractFileFromTarGz(
       tarball,
       `package/${asset.bin}`,
-      import_node_path3.default.join(staging, asset.bin)
+      import_node_path2.default.join(staging, asset.bin)
     );
     if (!found) throw new Error(`The Claude Code download has no ${asset.bin} binary.`);
-    await import_promises2.default.chmod(import_node_path3.default.join(staging, asset.bin), 493);
+    await import_promises2.default.chmod(import_node_path2.default.join(staging, asset.bin), 493);
     try {
       await import_promises2.default.rename(staging, versionDir);
     } catch (err) {
-      if (!import_node_fs3.default.existsSync(binary)) throw err;
+      if (!import_node_fs2.default.existsSync(binary)) throw err;
     }
     await removeOldVersions(home, manifest.claudeCodeVersion);
     return binary;
@@ -702,7 +513,7 @@ async function download(asset, dest, opts) {
     throw new Error(`Claude Code download failed (HTTP ${res.status}).`);
   }
   const totalBytes = Number(res.headers.get("content-length")) || void 0;
-  const hash = import_node_crypto2.default.createHash("sha512");
+  const hash = import_node_crypto.default.createHash("sha512");
   const out = await import_promises2.default.open(dest, "w");
   let receivedBytes = 0;
   let lastReported = -1;
@@ -740,7 +551,7 @@ async function removeOldVersions(home, keep) {
   for (const entry of entries) {
     if (!entry.isDirectory() || entry.name === keep || entry.name === "config") continue;
     if (!/^\d+\.\d+\.\d+/.test(entry.name)) continue;
-    await import_promises2.default.rm(import_node_path3.default.join(home, entry.name), { recursive: true, force: true }).catch(() => {
+    await import_promises2.default.rm(import_node_path2.default.join(home, entry.name), { recursive: true, force: true }).catch(() => {
     });
   }
 }
@@ -781,7 +592,7 @@ function runCommand(opts) {
 function runClaude(args, opts) {
   const { command, prefix } = runCommand(opts);
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process2.spawn)(command, [...prefix, ...args], {
+    const child = (0, import_node_child_process.spawn)(command, [...prefix, ...args], {
       env: claudeCodeEnv(opts),
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
@@ -841,9 +652,9 @@ async function loginClaudeCode(callbacks, opts = {}) {
   const { command, prefix } = runCommand(opts);
   const home = claudeCodeHome(opts);
   await import_promises2.default.mkdir(claudeCodeConfigDir(opts), { recursive: true });
-  const tag = `${process.pid}-${import_node_crypto2.default.randomBytes(4).toString("hex")}`;
-  const hookFile = import_node_path3.default.join(home, `.open-url-${tag}.cjs`);
-  const urlFile = import_node_path3.default.join(home, `.open-url-${tag}.txt`);
+  const tag = `${process.pid}-${import_node_crypto.default.randomBytes(4).toString("hex")}`;
+  const hookFile = import_node_path2.default.join(home, `.open-url-${tag}.cjs`);
+  const urlFile = import_node_path2.default.join(home, `.open-url-${tag}.txt`);
   await import_promises2.default.writeFile(hookFile, OPEN_URL_HOOK);
   const env = {
     ...claudeCodeEnv(opts),
@@ -855,7 +666,7 @@ async function loginClaudeCode(callbacks, opts = {}) {
   let timer;
   try {
     await new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process2.spawn)(command, [...prefix, "auth", "login", "--claudeai"], {
+      const child = (0, import_node_child_process.spawn)(command, [...prefix, "auth", "login", "--claudeai"], {
         env,
         stdio: ["pipe", "pipe", "pipe"],
         windowsHide: true
@@ -890,7 +701,7 @@ async function loginClaudeCode(callbacks, opts = {}) {
         timer = setInterval(() => {
           let captured = "";
           try {
-            captured = import_node_fs3.default.readFileSync(urlFile, "utf8");
+            captured = import_node_fs2.default.readFileSync(urlFile, "utf8");
           } catch {
           }
           const callbackUrl = captured ? claudeCodeCallbackUrl(manualUrl, captured) : null;
@@ -923,7 +734,9 @@ async function loginClaudeCode(callbacks, opts = {}) {
 
 // src/oauth/openai.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto3 = __toESM(require("crypto"), 1);
+var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_promises3 = __toESM(require("fs/promises"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
 
 // src/oauth/pkce.ts
 function base64urlEncode(bytes) {
@@ -943,791 +756,396 @@ async function generatePKCE() {
   return { verifier, challenge };
 }
 
+// src/oauth/request-timeout.ts
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+function oauthRequestSignal() {
+  return AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
+}
+
 // src/oauth/openai.ts
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-var TOKEN_URL = "https://auth.openai.com/oauth/token";
-var REDIRECT_URI = "http://localhost:1455/auth/callback";
-var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+var ISSUER = "https://auth.openai.com";
+var AUTHORIZE_URL = `${ISSUER}/api/accounts/authorize`;
+var TOKEN_URL = `${ISSUER}/api/accounts/oauth/token`;
+var REVOKE_URL = `${ISSUER}/api/accounts/oauth/revoke`;
+var JWKS_URL = `${ISSUER}/.well-known/jwks.json`;
+var REGISTRATION_CLIENT_ID = "dynamic_agent_client";
+var AGENT_NAME = "GG Coder";
+var RESOURCE = "https://api.openai.com/v1";
+var CHATGPT_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPES = `openid profile email offline_access resource.invoke ${CHATGPT_PLAN_SCOPE}`;
+var CHATGPT_PLAN_BASE_URL = "https://api.openai.com/v1";
+var CHATGPT_USAGE_URL = "https://chatgpt.com/settings/usage";
+var CALLBACK_PATH = "/auth/callback";
+var PREFERRED_PORT = 1455;
 var CALLBACK_TIMEOUT_MS = 12e4;
 var MAX_PASTE_ATTEMPTS = 3;
-var MIN_RAW_CODE_LENGTH = 10;
-async function loginOpenAI(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
-  const url = new URL(AUTHORIZE_URL);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
-  url.searchParams.set("redirect_uri", REDIRECT_URI);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("prompt", "login");
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", "ggcoder");
-  const code = await acquireAuthorizationCode(url.toString(), state, callbacks);
-  const creds = await exchangeOpenAICode(code, verifier);
-  const accountId = getAccountId(creds.accessToken);
-  if (!accountId) {
-    throw new Error("Failed to extract accountId from OpenAI token.");
-  }
-  creds.accountId = accountId;
-  return creds;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  if (/\s/.test(value) || value.length < MIN_RAW_CODE_LENGTH) return {};
-  return { code: value };
-}
-function decodeJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const decoded = atob(parts[1]);
-    return JSON.parse(decoded);
-  } catch {
-    return null;
+var ID_TOKEN_CLOCK_SKEW_S = 60;
+var CHATGPT_PLAN_NOT_ENABLED_MESSAGE = "ChatGPT plan use isn't enabled for GG Coder. Allow Use your ChatGPT plan, or add an OpenAI API key.";
+var ChatGPTPlanNotEnabledError = class extends Error {
+  constructor() {
+    super(CHATGPT_PLAN_NOT_ENABLED_MESSAGE);
+    this.name = "ChatGPTPlanNotEnabledError";
   }
+};
+function defaultHostIdFile() {
+  return import_node_path3.default.join(getAppPaths().agentDir, "openai-host-id");
 }
-function getAccountId(accessToken) {
-  const payload = decodeJwt(accessToken);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const accountId = auth?.chatgpt_account_id;
-  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+function defaultRegistrationFile() {
+  return import_node_path3.default.join(getAppPaths().agentDir, "openai-chatgpt-client.json");
 }
-async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
-  callbacks.onOpenUrl(authUrl);
-  callbacks.onStatus("Waiting for browser callback...");
-  const done = new AbortController();
+async function writePrivateFile(file, content) {
+  await import_promises3.default.mkdir(import_node_path3.default.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${import_node_crypto2.default.randomUUID().slice(0, 8)}.tmp`;
   try {
-    return await new Promise((resolve, reject) => {
-      let serverFailed = false;
-      let pasteError;
-      const failIfExhausted = () => {
-        if (!serverFailed || pasteError === void 0) return;
-        reject(
-          pasteError instanceof Error ? pasteError : new Error("Could not obtain an authorization code.")
-        );
-      };
-      listenForCallback(expectedState, done.signal).then(resolve, () => {
-        serverFailed = true;
-        failIfExhausted();
-      });
-      promptForCode(expectedState, callbacks, done.signal).then(resolve, (err) => {
-        if (err instanceof FatalLoginError) {
-          reject(err);
-          return;
-        }
-        pasteError = err;
-        failIfExhausted();
-      });
+    await import_promises3.default.writeFile(tmp, content, { encoding: "utf-8", mode: 384 });
+    await import_promises3.default.rename(tmp, file);
+  } catch (err) {
+    await import_promises3.default.unlink(tmp).catch(() => {
     });
-  } finally {
-    done.abort();
-  }
-}
-var FatalLoginError = class extends Error {
-};
-async function promptForCode(expectedState, callbacks, signal) {
-  let message = "If the browser is on another machine (SSH/headless), paste the callback URL or code here:";
-  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const raw = await callbacks.onPromptCode(message, signal);
-    if (signal.aborted) throw new Error("Authorization code already received.");
-    const parsed = parseAuthorizationInput(raw);
-    if (parsed.code && parsed.state && parsed.state !== expectedState) {
-      throw new FatalLoginError("Authorization state mismatch \u2014 start the login again.");
-    }
-    if (parsed.code) return parsed.code;
-    message = "That didn't contain an authorization code. Paste the full callback URL:";
+    throw err;
   }
-  throw new Error("No authorization code found in input.");
 }
-async function listenForCallback(expectedState, signal) {
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = import_node_http.default.createServer((req, res) => {
-      const url = new URL(req.url || "", "http://localhost");
-      if (url.pathname !== "/auth/callback") {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => {
-      reject(err);
-    });
-    server.listen(1455, "127.0.0.1");
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, CALLBACK_TIMEOUT_MS);
-    timeout.unref();
-    const onAbort = () => {
-      server.close();
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    server.on("close", () => {
-      clearTimeout(timeout);
-      signal.removeEventListener("abort", onAbort);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code"));
-      }
-    });
-  });
-}
-async function exchangeOpenAICode(code, verifier) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
-      code,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: verifier
-    }),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token exchange failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
+var HOST_ID_PATTERN = /^urn:uuid:[0-9a-f-]{36}$/i;
+async function getChatGPTHostId(file = defaultHostIdFile()) {
+  const existing = await import_promises3.default.readFile(file, "utf-8").catch(() => "");
+  if (HOST_ID_PATTERN.test(existing.trim())) return existing.trim();
+  await writePrivateFile(file, `urn:uuid:${import_node_crypto2.default.randomUUID()}`);
+  return (await import_promises3.default.readFile(file, "utf-8")).trim();
 }
-async function refreshOpenAIToken(refreshToken) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLIENT_ID2
-    }),
-    signal: oauthRequestSignal()
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token refresh failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  const creds = {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
-  const accountId = getAccountId(creds.accessToken);
-  if (accountId) {
-    creds.accountId = accountId;
+async function readRegistration(file) {
+  try {
+    const value = JSON.parse(await import_promises3.default.readFile(file, "utf-8"));
+    if (typeof value.clientId === "string" && typeof value.subject === "string") {
+      return { clientId: value.clientId, subject: value.subject };
+    }
+  } catch {
   }
-  return creds;
+  return void 0;
 }
-
-// src/oauth/gemini.ts
-var import_node_http2 = __toESM(require("http"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
-var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
-var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
-var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
-var DEFAULT_CLIENT_SECRET = "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";
-var AUTHORIZE_URL2 = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL2 = "https://oauth2.googleapis.com/token";
-var CODE_ASSIST_BASE_URL = "https://cloudcode-pa.googleapis.com";
-var CODE_ASSIST_API_VERSION = "v1internal";
-var CODE_ASSIST_POST_RETRIES = 3;
-var CODE_ASSIST_POST_RETRY_DELAY_MS = 100;
-var SCOPE2 = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile"
-].join(" ");
-var USER_TIER_FREE = "free-tier";
-var USER_TIER_LEGACY = "legacy-tier";
-var USER_TIER_STANDARD = "standard-tier";
-var VALIDATION_REQUIRED_REASON = "VALIDATION_REQUIRED";
-var VPC_SC_REASON = "SECURITY_POLICY_VIOLATED";
-var CodeAssistHttpError = class extends Error {
-  status;
-  body;
-  constructor(label, status, body) {
-    super(`Gemini Code Assist ${label} failed (${status}): ${body}`);
-    this.name = "CodeAssistHttpError";
-    this.status = status;
-    this.body = body;
-  }
-};
-async function loginGemini(callbacks) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
+async function loginChatGPT(callbacks, options = {}) {
+  const hostId = await getChatGPTHostId(options.hostIdFile);
+  const registrationFile = options.registrationFile ?? defaultRegistrationFile();
+  const registration = await readRegistration(registrationFile);
   const { verifier, challenge } = await generatePKCE();
-  const state = import_node_crypto4.default.randomBytes(32).toString("hex");
-  const redirectUri = await getLoopbackRedirectUri();
-  const url = new URL(AUTHORIZE_URL2);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId2);
-  url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", SCOPE2);
-  url.searchParams.set("access_type", "offline");
-  url.searchParams.set("prompt", "consent");
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  let code;
+  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const nonce = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const listener = await startCallbackListener(state, Boolean(registration));
   try {
-    code = await loginWithServer(url.toString(), redirectUri, state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput2(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
+    const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`;
+    const url = new URL(AUTHORIZE_URL);
+    url.searchParams.set("client_id", registration?.clientId ?? REGISTRATION_CLIENT_ID);
+    if (!registration) url.searchParams.set("agent_name_hint", AGENT_NAME);
+    url.searchParams.set("ext_agent_host_id", hostId);
+    if (registration && options.previous?.idToken) {
+      url.searchParams.set("id_token_hint", options.previous.idToken);
     }
-    if (parsed.state && parsed.state !== state) {
-      throw new Error("Invalid state. Please try again.");
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("scope", SCOPES);
+    url.searchParams.set("resource", RESOURCE);
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("code_challenge", challenge);
+    const callback = await acquireCallback(url.toString(), state, listener, callbacks);
+    if (callback.get("error")) {
+      if (callback.get("error") === "access_denied") throw new ChatGPTPlanNotEnabledError();
+      throw new Error(
+        `ChatGPT sign-in failed: ${callback.get("error_description") ?? callback.get("error")}`
+      );
     }
-    code = parsed.code;
-  }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret);
-  callbacks.onStatus("Setting up Gemini Code Assist access...");
-  const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
-  return {
-    ...creds,
-    projectId
-  };
-}
-async function refreshGeminiToken(refreshToken) {
-  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
-  const data = await postTokenRequest({
-    grant_type: "refresh_token",
-    refresh_token: refreshToken,
-    client_id: clientId2,
-    client_secret: clientSecret
-  });
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? refreshToken,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-function getGeminiOAuthClientCredentials() {
-  const clientId2 = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
-  const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId: clientId2, clientSecret };
-}
-async function getLoopbackRedirectUri() {
-  return new Promise((resolve, reject) => {
-    const server = import_node_http2.default.createServer();
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      server.close(() => {
-        if (addr && typeof addr === "object") {
-          resolve(`http://127.0.0.1:${addr.port}/oauth2callback`);
-        } else {
-          reject(new Error("Failed to allocate OAuth callback port."));
-        }
+    const code = callback.get("code");
+    if (!code) throw new Error("ChatGPT sign-in returned no authorization code.");
+    const issued = callback.get("client_id") ?? void 0;
+    if (registration && issued && issued !== registration.clientId) {
+      throw new Error("ChatGPT returned a different app registration. Start the sign-in again.");
+    }
+    const clientId = registration?.clientId ?? issued;
+    if (!clientId || clientId === REGISTRATION_CLIENT_ID) {
+      throw new Error(
+        "ChatGPT didn't finish registering GG Coder. Start the sign-in again, and paste the full callback URL if you're on another machine."
+      );
+    }
+    const tokens = await exchangeCode({ code, verifier, clientId, redirectUri });
+    const claims = await verifyIdToken(tokens.idToken, { clientId, nonce });
+    const subject = String(claims.sub ?? "");
+    if (!subject) throw new Error("ChatGPT ID token has no subject.");
+    if (registration && registration.subject !== subject) {
+      await import_promises3.default.unlink(registrationFile).catch(() => {
       });
-    });
-    server.on("error", reject);
-  });
-}
-function parseAuthorizationInput2(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new Error(
+        "That was a different ChatGPT account. Continue with ChatGPT again to connect it."
+      );
+    }
+    if (!tokens.scopes.includes(CHATGPT_PLAN_SCOPE)) {
+      await revokeChatGPTSignIn({ refreshToken: tokens.refreshToken, clientId });
+      throw new ChatGPTPlanNotEnabledError();
+    }
+    if (!registration) {
+      await writePrivateFile(registrationFile, JSON.stringify({ clientId, subject }));
+    }
     return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3,
+      expiresIn: tokens.expiresIn,
+      accountId: subject,
+      clientId,
+      idToken: tokens.idToken,
+      scopes: tokens.scopes,
+      baseUrl: CHATGPT_PLAN_BASE_URL
     };
+  } finally {
+    listener.close();
   }
-  return { code: value };
 }
-async function loginWithServer(authUrl, redirectUri, expectedState, callbacks) {
-  const redirect = new URL(redirectUri);
-  const port = Number(redirect.port);
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = import_node_http2.default.createServer((req, res) => {
-      const url = new URL(req.url || "", redirect.origin);
-      if (url.pathname !== redirect.pathname) {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => reject(err));
-    server.listen(port, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, 12e4);
-    timeout.unref();
-    server.on("close", () => {
-      clearTimeout(timeout);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code."));
-      }
-    });
+async function fetchChatGPTPlanModels(accessToken, fetchFn = fetch) {
+  const response = await fetchFn(`${CHATGPT_PLAN_BASE_URL}/models`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: oauthRequestSignal()
   });
+  if (!response.ok) throw new Error(`ChatGPT model list failed (${response.status})`);
+  const data = await response.json();
+  return (data.models ?? []).filter((m) => typeof m.slug === "string" && (m.visibility ?? "list") === "list").map((m) => m.slug);
 }
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret) {
-  const data = await postTokenRequest({
-    grant_type: "authorization_code",
-    client_id: clientId2,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
+async function startCallbackListener(expectedState, anyPort) {
+  let settle;
+  const result = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
   });
-  if (!data.refresh_token) {
-    throw new Error("Gemini OAuth did not return a refresh token. Please try login again.");
-  }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-async function postTokenRequest(body) {
-  const response = await fetch(TOKEN_URL2, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(body),
-    signal: oauthRequestSignal()
+  result.catch(() => {
   });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Gemini token request failed (${response.status}): ${text}`);
-  }
-  return await response.json();
-}
-async function setupCodeAssistProject(accessToken, callbacks) {
-  const envProject = process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID;
-  if (envProject && /^\d+$/.test(envProject)) {
-    throw new Error("GOOGLE_CLOUD_PROJECT must be a project ID, not a numeric project number.");
-  }
-  const coreMetadata = {
-    ideType: "IDE_UNSPECIFIED",
-    platform: "PLATFORM_UNSPECIFIED",
-    pluginType: "GEMINI"
-  };
-  const projectMetadata = {
-    ...coreMetadata,
-    ...envProject ? { duetProject: envProject } : {}
-  };
-  let loadRes;
-  while (true) {
-    loadRes = await loadCodeAssist(accessToken, envProject, projectMetadata);
-    const validation = getValidationRequiredTier(loadRes);
-    if (!validation) break;
-    callbacks.onStatus(
-      `Gemini Code Assist requires account validation${validation.reasonMessage ? `: ${validation.reasonMessage}` : ""}`
-    );
-    callbacks.onOpenUrl(validation.validationUrl);
-    const answer = await callbacks.onPromptCode(
-      "Complete validation in the browser, then press Enter to retry (or type cancel):"
+  const server = import_node_http.default.createServer((req, res) => {
+    const url = new URL(req.url || "", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    if (url.searchParams.get("state") !== expectedState) {
+      res.statusCode = 400;
+      res.end("State mismatch");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(
+      "<html><body><h1>You're signed in to GG Coder.</h1><p>You can close this tab.</p></body></html>"
     );
-    if (answer.trim().toLowerCase() === "cancel") {
-      throw new Error("Gemini Code Assist account validation was cancelled.");
+    settle?.resolve(url.searchParams);
+    server.close();
+  });
+  const listen = (port2) => new Promise((resolve, reject) => {
+    const onError = (err) => reject(err);
+    server.once("error", onError);
+    server.listen(port2, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve(server.address().port);
+    });
+  });
+  let port;
+  for (const candidate of anyPort ? [PREFERRED_PORT, 0] : [PREFERRED_PORT]) {
+    try {
+      port = await listen(candidate);
+      break;
+    } catch {
     }
   }
-  if (loadRes.currentTier) {
-    const project2 = loadRes.cloudaicompanionProject ?? envProject;
-    if (!project2) throwProjectError(loadRes);
-    return project2;
-  }
-  const tier = getOnboardTier(loadRes);
-  const onboardReq = tier.id === USER_TIER_FREE ? {
-    tierId: tier.id,
-    cloudaicompanionProject: void 0,
-    metadata: coreMetadata
-  } : {
-    tierId: tier.id,
-    cloudaicompanionProject: envProject,
-    metadata: projectMetadata
-  };
-  let operation = await codeAssistPost(
-    accessToken,
-    "onboardUser",
-    onboardReq
-  );
-  while (!operation.done && operation.name) {
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    operation = await codeAssistGet(accessToken, operation.name);
-  }
-  const project = operation.response?.cloudaicompanionProject?.id ?? envProject;
-  if (!project) throwProjectError(loadRes);
-  return project;
+  if (port === void 0) {
+    settle?.reject(new Error("Could not start the local sign-in listener."));
+    return { port: PREFERRED_PORT, result, close: () => {
+    } };
+  }
+  const timeout = setTimeout(() => server.close(), CALLBACK_TIMEOUT_MS);
+  timeout.unref();
+  server.on("close", () => {
+    clearTimeout(timeout);
+    settle?.reject(new Error("Sign-in listener closed without a callback."));
+  });
+  return { port, result, close: () => server.close() };
 }
-async function loadCodeAssist(accessToken, envProject, metadata) {
+async function acquireCallback(authUrl, expectedState, listener, callbacks) {
+  callbacks.onOpenUrl(authUrl);
+  callbacks.onStatus("Waiting for ChatGPT sign-in in your browser...");
+  const done = new AbortController();
   try {
-    return await codeAssistPost(accessToken, "loadCodeAssist", {
-      ...envProject ? { cloudaicompanionProject: envProject } : {},
-      metadata
+    return await new Promise((resolve, reject) => {
+      let listenerFailed = false;
+      let pasteError;
+      const failIfExhausted = () => {
+        if (!listenerFailed || pasteError === void 0) return;
+        reject(
+          pasteError instanceof Error ? pasteError : new Error("Could not complete the sign-in.")
+        );
+      };
+      listener.result.then(resolve, () => {
+        listenerFailed = true;
+        failIfExhausted();
+      });
+      promptForCallback(expectedState, callbacks, done.signal).then(resolve, (err) => {
+        if (err instanceof FatalLoginError) {
+          reject(err);
+          return;
+        }
+        pasteError = err;
+        failIfExhausted();
+      });
     });
-  } catch (err) {
-    if (err instanceof CodeAssistHttpError && isVpcScAffectedError(err)) {
-      return { currentTier: { id: USER_TIER_STANDARD } };
-    }
-    if (err instanceof CodeAssistHttpError && err.status === 403 && envProject === "cloudshell-gca") {
-      throw new Error(
-        "Access to the default Cloud Shell Gemini project was denied.\nPlease set your own Google Cloud project by running:\ngcloud config set project [PROJECT_ID]\nor setting export GOOGLE_CLOUD_PROJECT=...",
-        { cause: err }
-      );
-    }
-    throw err;
+  } finally {
+    done.abort();
+    listener.close();
   }
 }
-function getValidationRequiredTier(response) {
-  return response.ineligibleTiers?.find(
-    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
-  );
-}
-function getOnboardTier(response) {
-  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
-  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
-}
-function throwProjectError(response) {
-  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
-  if (reasons && reasons.length > 0) {
-    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
+var FatalLoginError = class extends Error {
+};
+function parseCallbackInput(input) {
+  const value = input.trim();
+  if (!value) return void 0;
+  try {
+    return new URL(value).searchParams;
+  } catch {
   }
-  throw new Error(
-    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
-  );
+  if (/[?&]?(code|error)=/.test(value)) {
+    return new URLSearchParams(value.replace(/^.*\?/, ""));
+  }
+  return void 0;
 }
-async function codeAssistPost(accessToken, method, body) {
-  let lastError;
-  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
-    try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
+async function promptForCallback(expectedState, callbacks, signal) {
+  let message = "If the browser is on another machine (SSH/headless), paste the full callback URL here:";
+  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
+    if (signal.aborted) throw new Error("Callback already received.");
+    const raw = await callbacks.onPromptCode(message, signal);
+    if (signal.aborted) throw new Error("Callback already received.");
+    const params = parseCallbackInput(raw);
+    if (params && (params.get("code") || params.get("error"))) {
+      if (params.get("state") !== expectedState) {
+        throw new FatalLoginError("Sign-in state mismatch \u2014 start the sign-in again.");
       }
-      lastError = err;
+      return params;
     }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
+    message = "That wasn't a callback URL. Paste the full URL from the browser's address bar:";
   }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
+  throw new Error("No callback URL found in input.");
 }
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
+async function postForm(url, form) {
+  return fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(form),
+    signal: oauthRequestSignal()
   });
 }
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken),
-    signal: oauthRequestSignal()
+async function exchangeCode(input) {
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "authorization_code",
+    client_id: input.clientId,
+    code: input.code,
+    code_verifier: input.verifier,
+    redirect_uri: input.redirectUri,
+    resource: RESOURCE
   });
   if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token exchange failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
-}
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
-}
-function isVpcScAffectedError(error) {
-  try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
-  } catch {
-    return false;
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token || !data.id_token) {
+    throw new Error("ChatGPT token response is missing tokens.");
   }
-}
-function codeAssistHeaders(accessToken) {
-  return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/xai.ts
-var DEFAULT_CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
-var DEFAULT_ISSUER = "https://auth.x.ai";
-var DEFAULT_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
-var OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-var DEFAULT_GROK_CLI_VERSION = "1.0.67";
-var DEVICE_TIMEOUT_FALLBACK_MS = 10 * 60 * 1e3;
-var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
-function issuer() {
-  return (process.env.XAI_OAUTH_ISSUER ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-}
-function clientId() {
-  return process.env.XAI_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID2;
-}
-function grokCliBaseUrl() {
-  return (process.env.XAI_CLI_BASE_URL ?? DEFAULT_CLI_BASE_URL).replace(/\/+$/, "");
-}
-function grokCliVersion() {
-  const raw = process.env.GROK_CLI_VERSION ?? DEFAULT_GROK_CLI_VERSION;
-  const cleaned = raw.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : DEFAULT_GROK_CLI_VERSION;
-}
-function grokCliHeaders(modelId) {
   return {
-    "X-XAI-Token-Auth": "xai-grok-cli",
-    "x-grok-client-version": grokCliVersion(),
-    "x-grok-client-identifier": "ggcoder",
-    ...modelId ? { "x-grok-model-override": modelId } : {}
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    idToken: data.id_token,
+    expiresIn: data.expires_in ?? 3600,
+    scopes: (data.scope ?? "").split(/\s+/).filter(Boolean)
   };
 }
-function isGrokCliEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === grokCliBaseUrl() || /(^|\.)grok\.com/i.test(normalized);
-}
-async function postForm2(endpoint, params) {
-  const response = await fetch(`${issuer()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-      "User-Agent": `grok-cli/${grokCliVersion()}`
-    },
-    body: new URLSearchParams(params).toString(),
-    signal: oauthRequestSignal()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail2(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function jwtExpirySeconds(token) {
-  const payload = token.split(".")[1];
-  if (!payload) return void 0;
-  try {
-    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
-      "utf-8"
-    );
-    const claims = JSON.parse(json);
-    if (!claims || typeof claims !== "object") return void 0;
-    const exp = claims.exp;
-    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function credsFromTokenResponse2(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Grok OAuth response missing access_token.");
+async function refreshChatGPTToken(creds) {
+  if (!creds.clientId) {
+    throw new Error("ChatGPT token refresh failed (401): no issued client ID saved");
   }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error(
-      "Grok OAuth response missing refresh_token \u2014 the offline_access scope was not granted."
-    );
+  const response = await postForm(TOKEN_URL, {
+    grant_type: "refresh_token",
+    client_id: creds.clientId,
+    refresh_token: creds.refreshToken,
+    resource: RESOURCE
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`ChatGPT token refresh failed (${response.status}): ${text.slice(0, 300)}`);
   }
-  const responseExpiresIn = Number(data.expires_in);
-  let expiresIn;
-  if (Number.isFinite(responseExpiresIn) && responseExpiresIn > 0) {
-    expiresIn = responseExpiresIn;
-  } else {
-    const exp = jwtExpirySeconds(accessToken);
-    const fromJwt = exp !== void 0 ? exp - Math.floor(Date.now() / 1e3) : 0;
-    expiresIn = fromJwt > 0 ? fromJwt : DEFAULT_TOKEN_LIFETIME_SECONDS;
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token) {
+    throw new Error("ChatGPT token refresh returned no tokens.");
   }
+  const expiresIn = data.expires_in ?? 3600;
   return {
-    accessToken,
-    refreshToken,
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
     expiresAt: Date.now() + expiresIn * 1e3,
     expiresIn,
-    baseUrl: grokCliBaseUrl()
-  };
-}
-async function requestDeviceAuthorization2() {
-  const { status, data } = await postForm2("/oauth2/device/code", {
-    client_id: clientId(),
-    scope: OAUTH_SCOPE
-  });
-  if (status !== 200) {
-    throw new Error(`Grok device authorization failed (${status}): ${errorDetail2(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Grok device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5,
-    // RFC 8628 §3.2: the server states how long the device code lives. Honor it
-    // rather than imposing our own budget — polling a code we know is dead only
-    // burns requests, and a longer local window would keep a user waiting past
-    // the point the code can ever succeed.
-    expiresInMs: (Number(data.expires_in) || 0) > 0 ? Number(data.expires_in) * 1e3 : DEVICE_TIMEOUT_FALLBACK_MS
+    ...data.id_token ? { idToken: data.id_token } : {},
+    ...data.scope ? { scopes: data.scope.split(/\s+/).filter(Boolean) } : {}
   };
 }
-async function pollDeviceToken2(deviceCode) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse2(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Grok token polling server error (${status}): ${errorDetail2(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Grok token polling failed (${status}): ${errorDetail2(data)}`);
-  }
-}
-function sleep2(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginXai(callbacks) {
-  const auth = await requestDeviceAuthorization2();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + auth.expiresInMs;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    const remaining = deadline - Date.now();
-    await sleep2(Math.min(interval * 1e3, remaining));
-    const result = await pollDeviceToken2(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Grok authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Grok device code expired. Please run login again.");
+async function revokeChatGPTSignIn(creds, options = {}) {
+  if (!creds.clientId || !creds.refreshToken) return false;
+  const attempts = options.attempts ?? 3;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      const response = await postForm(REVOKE_URL, {
+        token: creds.refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: creds.clientId
+      });
+      if (response.ok) return true;
+      if (response.status < 500) return false;
+    } catch {
     }
-    if (result.kind === "slow_down") {
-      interval += 5;
+    if (attempt < attempts - 1) {
+      await new Promise((r) => setTimeout(r, (options.backoffMs ?? 500) * 2 ** attempt));
     }
   }
-  throw new Error("Grok login timed out. Please run login again.");
-}
-async function refreshXaiToken(refreshToken) {
-  const { status, data } = await postForm2("/oauth2/token", {
-    client_id: clientId(),
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse2(data, { fallbackRefreshToken: refreshToken });
+  return false;
+}
+function decodeSegment(segment) {
+  return JSON.parse(Buffer.from(segment, "base64url").toString("utf-8"));
+}
+async function verifyIdToken(idToken, expected) {
+  const [headerSeg, payloadSeg, signatureSeg] = idToken.split(".");
+  if (!headerSeg || !payloadSeg || !signatureSeg) throw new Error("Malformed ChatGPT ID token.");
+  const header = decodeSegment(headerSeg);
+  if (header.alg !== "RS256") throw new Error("Unexpected ChatGPT ID token algorithm.");
+  const response = await fetch(JWKS_URL, { signal: oauthRequestSignal() });
+  if (!response.ok) throw new Error(`Could not load OpenAI signing keys (${response.status}).`);
+  const { keys = [] } = await response.json();
+  const jwk = keys.find((k) => k.kid === header.kid);
+  if (!jwk) throw new Error("ChatGPT ID token is signed with an unknown key.");
+  const valid = import_node_crypto2.default.verify(
+    "RSA-SHA256",
+    Buffer.from(`${headerSeg}.${payloadSeg}`),
+    import_node_crypto2.default.createPublicKey({ key: jwk, format: "jwk" }),
+    Buffer.from(signatureSeg, "base64url")
+  );
+  if (!valid) throw new Error("ChatGPT ID token signature is invalid.");
+  const claims = decodeSegment(payloadSeg);
+  const now = Math.floor((expected.now ?? Date.now()) / 1e3);
+  const aud = claims.aud;
+  const audiences = Array.isArray(aud) ? aud : [aud];
+  if (claims.iss !== ISSUER) throw new Error("ChatGPT ID token has the wrong issuer.");
+  if (!audiences.includes(expected.clientId)) {
+    throw new Error("ChatGPT ID token was issued to another app.");
+  }
+  if (typeof claims.exp !== "number" || claims.exp + ID_TOKEN_CLOCK_SKEW_S < now) {
+    throw new Error("ChatGPT ID token has expired.");
   }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Grok token refresh failed (${status}): ${errorCode || errorDetail2(data)}`);
+  if (claims.nonce !== expected.nonce) throw new Error("ChatGPT ID token nonce mismatch.");
+  return claims;
 }
 
 // src/file-lock.ts
-var import_promises3 = __toESM(require("fs/promises"), 1);
-var import_promises4 = require("timers/promises");
+var import_promises4 = __toESM(require("fs/promises"), 1);
+var import_promises5 = require("timers/promises");
 var STALE_TIMEOUT_MS = 1e4;
 var RETRY_INTERVAL_MS = 50;
 var MAX_WAIT_MS = 5e3;
@@ -1747,7 +1165,7 @@ async function acquireLock(lockPath) {
   while (true) {
     try {
       const info = { pid: process.pid, timestamp: Date.now() };
-      await import_promises3.default.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
+      await import_promises4.default.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
       return;
     } catch (err) {
       const code = err.code;
@@ -1756,47 +1174,47 @@ async function acquireLock(lockPath) {
         const lockPresent = await lockFileExists(lockPath);
         if (!lockPresent && ++refusedWithoutLock > 3) throw err;
         if (Date.now() - startTime > MAX_WAIT_MS) throw err;
-        await (0, import_promises4.setTimeout)(RETRY_INTERVAL_MS);
+        await (0, import_promises5.setTimeout)(RETRY_INTERVAL_MS);
         continue;
       }
       try {
-        const content = await import_promises3.default.readFile(lockPath, "utf-8");
+        const content = await import_promises4.default.readFile(lockPath, "utf-8");
         const info = JSON.parse(content);
         const isProcessAlive = isAlive(info.pid);
         const isStale = Date.now() - info.timestamp > STALE_TIMEOUT_MS;
         if (!isProcessAlive || isStale) {
-          await import_promises3.default.unlink(lockPath).catch(() => {
+          await import_promises4.default.unlink(lockPath).catch(() => {
           });
           continue;
         }
       } catch {
-        const stat = await import_promises3.default.stat(lockPath).catch(() => null);
+        const stat = await import_promises4.default.stat(lockPath).catch(() => null);
         if (!stat) continue;
         if (Date.now() - stat.mtimeMs > STALE_TIMEOUT_MS) {
-          await import_promises3.default.unlink(lockPath).catch(() => {
+          await import_promises4.default.unlink(lockPath).catch(() => {
           });
           continue;
         }
       }
       if (Date.now() - startTime > MAX_WAIT_MS) {
-        await import_promises3.default.unlink(lockPath).catch(() => {
+        await import_promises4.default.unlink(lockPath).catch(() => {
         });
         continue;
       }
-      await (0, import_promises4.setTimeout)(RETRY_INTERVAL_MS);
+      await (0, import_promises5.setTimeout)(RETRY_INTERVAL_MS);
     }
   }
 }
 async function lockFileExists(lockPath) {
   try {
-    await import_promises3.default.stat(lockPath);
+    await import_promises4.default.stat(lockPath);
     return true;
   } catch (err) {
     return err.code !== "ENOENT";
   }
 }
 async function releaseLock(lockPath) {
-  await import_promises3.default.unlink(lockPath).catch(() => {
+  await import_promises4.default.unlink(lockPath).catch(() => {
   });
 }
 function isAlive(pid) {
@@ -1810,10 +1228,10 @@ function isAlive(pid) {
 }
 
 // src/logger.ts
-var import_node_fs4 = __toESM(require("fs"), 1);
+var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
-var import_node_crypto5 = require("crypto");
-var import_gg_ai = require("@kenkaiiii/gg-ai");
+var import_node_crypto3 = require("crypto");
+var import_gg_ai2 = require("@kenkaiiii/gg-ai");
 var MAX_BYTES = 10 * 1024 * 1024;
 var MIN_HEADROOM_BYTES = 64 * 1024;
 var fd = null;
@@ -1828,14 +1246,14 @@ var cleanups = [];
 var exactSecrets = [];
 function rotateIfNeeded(filePath, force = false) {
   try {
-    const st = import_node_fs4.default.statSync(filePath);
+    const st = import_node_fs3.default.statSync(filePath);
     if (!force && st.size <= MAX_BYTES - MIN_HEADROOM_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
-      import_node_fs4.default.unlinkSync(rotated);
+      import_node_fs3.default.unlinkSync(rotated);
     } catch {
     }
-    import_node_fs4.default.renameSync(filePath, rotated);
+    import_node_fs3.default.renameSync(filePath, rotated);
   } catch {
   }
 }
@@ -1843,18 +1261,18 @@ function rotateOpenLog() {
   if (fd === null || logPath === null) return false;
   const sizeBefore = fileBytes;
   try {
-    import_node_fs4.default.closeSync(fd);
+    import_node_fs3.default.closeSync(fd);
   } catch {
   }
   fd = null;
   rotateIfNeeded(logPath, true);
   try {
-    fd = import_node_fs4.default.openSync(logPath, "a");
-    fileBytes = import_node_fs4.default.fstatSync(fd).size;
+    fd = import_node_fs3.default.openSync(logPath, "a");
+    fileBytes = import_node_fs3.default.fstatSync(fd).size;
   } catch {
     if (fd !== null) {
       try {
-        import_node_fs4.default.closeSync(fd);
+        import_node_fs3.default.closeSync(fd);
       } catch {
       }
     }
@@ -1868,24 +1286,24 @@ function rotateOpenLog() {
 function openLog(filePath, name) {
   if (fd !== null || capped) return false;
   appName = name;
-  exactSecrets = (0, import_gg_ai.environmentSecrets)(process.env);
+  exactSecrets = (0, import_gg_ai2.environmentSecrets)(process.env);
   try {
-    import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(filePath), { recursive: true, mode: 448 });
+    import_node_fs3.default.mkdirSync(import_node_path4.default.dirname(filePath), { recursive: true, mode: 448 });
   } catch {
   }
   rotateIfNeeded(filePath);
   try {
-    fd = import_node_fs4.default.openSync(filePath, "a");
+    fd = import_node_fs3.default.openSync(filePath, "a");
   } catch {
     fd = null;
     fileBytes = 0;
     return false;
   }
   try {
-    fileBytes = import_node_fs4.default.fstatSync(fd).size;
+    fileBytes = import_node_fs3.default.fstatSync(fd).size;
   } catch {
     try {
-      import_node_fs4.default.closeSync(fd);
+      import_node_fs3.default.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1895,10 +1313,10 @@ function openLog(filePath, name) {
   logPath = filePath;
   processBytes = 0;
   rotationFailed = false;
-  sessionId = (0, import_node_crypto5.randomBytes)(4).toString("hex");
+  sessionId = (0, import_node_crypto3.randomBytes)(4).toString("hex");
   try {
     if (fileBytes < MAX_BYTES) {
-      const written = import_node_fs4.default.writeSync(fd, "\n");
+      const written = import_node_fs3.default.writeSync(fd, "\n");
       fileBytes += written;
       processBytes += written;
     }
@@ -1915,10 +1333,10 @@ function isLoggerOpen() {
 function log(level, category, message, data) {
   if (fd === null) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const safeMessage = (0, import_gg_ai.redactText)(message, { secrets: exactSecrets });
+  const safeMessage = (0, import_gg_ai2.redactText)(message, { secrets: exactSecrets });
   let line = `[${ts}] [sid=${sessionId}] [${level}] [${category}] ${safeMessage}`;
   if (data) {
-    const safeData = (0, import_gg_ai.redactValue)(data, { secrets: exactSecrets });
+    const safeData = (0, import_gg_ai2.redactValue)(data, { secrets: exactSecrets });
     const pairs = Object.entries(safeData).map(([k, v]) => {
       if (typeof v === "string") return `${k}=${v}`;
       if (typeof v === "bigint") return `${k}=${String(v)}`;
@@ -1933,9 +1351,9 @@ function log(level, category, message, data) {
 `;
     try {
       if (fileBytes + Buffer.byteLength(capLine) <= MAX_BYTES) {
-        fileBytes += import_node_fs4.default.writeSync(fd, capLine);
+        fileBytes += import_node_fs3.default.writeSync(fd, capLine);
       }
-      import_node_fs4.default.closeSync(fd);
+      import_node_fs3.default.closeSync(fd);
     } catch {
     }
     fd = null;
@@ -1945,7 +1363,7 @@ function log(level, category, message, data) {
   if (fileBytes + lineBytes > MAX_BYTES && !rotationFailed && !rotateOpenLog()) return;
   if (fd === null) return;
   try {
-    const written = import_node_fs4.default.writeSync(fd, line);
+    const written = import_node_fs3.default.writeSync(fd, line);
     fileBytes += written;
     processBytes += written;
   } catch {
@@ -1958,7 +1376,7 @@ function closeLogger(opts) {
   if (fd !== null) {
     if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
     try {
-      if (fd !== null) import_node_fs4.default.closeSync(fd);
+      if (fd !== null) import_node_fs3.default.closeSync(fd);
     } catch {
     }
   }
@@ -1974,13 +1392,13 @@ function closeLogger(opts) {
 }
 
 // src/hidden-providers.ts
-var HIDDEN_PROVIDERS = ["gemini"];
+var HIDDEN_PROVIDERS = [];
 function isHiddenProvider(provider) {
   return HIDDEN_PROVIDERS.includes(provider);
 }
 
 // src/auth-storage.ts
-var import_gg_ai2 = require("@kenkaiiii/gg-ai");
+var import_gg_ai3 = require("@kenkaiiii/gg-ai");
 
 // src/minimax-region.ts
 var MINIMAX_GLOBAL_BASE_URL = "https://api.minimax.io/anthropic";
@@ -2065,22 +1483,76 @@ async function detectXiaomiTokenPlanBaseUrl(apiKey, options = {}) {
 }
 
 // src/auth-storage.ts
-var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
-var XAI_OAUTH_KEY = "xai-oauth";
-var DUAL_AUTH_PROVIDERS = [
+var OPENAI_CHATGPT_KEY = "openai-chatgpt";
+var KIMI_CODE_KEY = "kimi-code";
+var RETIRED_SIGN_INS = [
+  {
+    provider: "anthropic",
+    storageKey: "anthropic",
+    message: "Your old Claude sign-in no longer works. Sign in with Claude again to keep using your subscription."
+  },
+  {
+    provider: "openai",
+    storageKey: "openai",
+    message: "Your old ChatGPT sign-in no longer works. Continue with ChatGPT again, or add an OpenAI API key."
+  },
   {
     provider: "moonshot",
-    oauthKey: MOONSHOT_OAUTH_KEY,
-    oauthLabel: "Kimi OAuth",
-    apiKeyLabel: "Moonshot API key",
-    restoreHint: 'Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+    storageKey: "moonshot-oauth",
+    message: "Kimi sign-in was removed. Paste a Kimi Code plan key from the Kimi Code Console, or a Moonshot API key."
   },
   {
     provider: "xai",
-    oauthKey: XAI_OAUTH_KEY,
-    oauthLabel: "Grok OAuth",
-    apiKeyLabel: "xAI API key",
-    restoreHint: 'Run "ggcoder login" and choose Grok OAuth to restore OAuth auth.'
+    storageKey: "xai-oauth",
+    message: "Grok sign-in was removed: xAI offers SuperGrok and X Premium usage only in apps it partners with. Add an xAI API key instead."
+  },
+  {
+    provider: "gemini",
+    storageKey: "gemini",
+    message: "Google sign-in was removed. Add a Gemini API key from Google AI Studio instead."
+  }
+];
+function isRetiredEntry(retired, value) {
+  if (!value) return false;
+  switch (retired.storageKey) {
+    case "anthropic":
+      return isLegacyClaudeOAuth(value);
+    // These slots now hold API keys; only a refreshable sign-in token is retired.
+    case "openai":
+    case "gemini":
+      return Boolean(value.refreshToken) || Boolean(value.accountId) || Boolean(value.projectId);
+    default:
+      return true;
+  }
+}
+function isRetiredStorageKey(data, storageKey) {
+  return RETIRED_SIGN_INS.some(
+    (r) => r.storageKey === storageKey && isRetiredEntry(r, data[storageKey])
+  );
+}
+function usableEntry(data, storageKey) {
+  return isRetiredStorageKey(data, storageKey) ? void 0 : data[storageKey];
+}
+function storageKeyProvider(storageKey) {
+  if (storageKey === OPENAI_CHATGPT_KEY) return "openai";
+  if (storageKey === KIMI_CODE_KEY) return "moonshot";
+  if (storageKey === XIAOMI_CREDITS_KEY) return "xiaomi";
+  if (storageKey === GEMINI_API_KEY) return "gemini";
+  return storageKey;
+}
+function apiKeyStorageKeys(provider) {
+  if (provider === "moonshot") return [KIMI_CODE_KEY, "moonshot"];
+  if (provider === "xiaomi") return ["xiaomi", XIAOMI_CREDITS_KEY];
+  if (provider === "gemini") return [GEMINI_API_KEY];
+  return [provider];
+}
+var DUAL_AUTH_PROVIDERS = [
+  {
+    provider: "openai",
+    oauthKey: OPENAI_CHATGPT_KEY,
+    oauthLabel: "ChatGPT plan",
+    apiKeyLabel: "OpenAI API key",
+    restoreHint: 'Run "ggcoder login" and choose Continue with ChatGPT to use your ChatGPT plan again.'
   }
 ];
 function dualAuthProvider(provider) {
@@ -2105,14 +1577,20 @@ function activeBaseUrlEntry(data, provider) {
   const dual = dualAuthProvider(provider);
   if (dual) {
     const oauth = data[dual.oauthKey];
+    const apiKey = usableEntry(data, dual.provider);
     if (oauth) {
       const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && data[dual.provider]) return data[dual.provider];
+      if (Date.now() < exhaustedUntil && apiKey) return apiKey;
       return oauth;
     }
-    return data[dual.provider];
+    return apiKey;
+  }
+  const key = apiKeyStorageKeys(provider).find((k) => usableEntry(data, k));
+  const entry = key ? data[key] : void 0;
+  if (key === KIMI_CODE_KEY && entry && !entry.baseUrl) {
+    return { ...entry, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
   }
-  return data[provider];
+  return entry;
 }
 var MINIMAX_REGION_RETRY_MS = 5 * 60 * 1e3;
 var miniMaxRegionProbes = /* @__PURE__ */ new Map();
@@ -2123,9 +1601,17 @@ function cachedMiniMaxRegion(apiKey) {
   miniMaxRegionProbes.set(apiKey, { at: Date.now(), result });
   return result;
 }
+var kimiRegionProbes = /* @__PURE__ */ new Map();
+function cachedKimiRegion(apiKey) {
+  const cached = kimiRegionProbes.get(apiKey);
+  if (cached && Date.now() - cached.at < MINIMAX_REGION_RETRY_MS) return cached.result;
+  const result = detectKimiCodeBaseUrl(apiKey).catch(() => void 0);
+  kimiRegionProbes.set(apiKey, { at: Date.now(), result });
+  return result;
+}
 function readStoredBaseUrlSync(authFile, provider) {
   try {
-    const data = JSON.parse((0, import_node_fs5.readFileSync)(authFile, "utf-8"));
+    const data = JSON.parse((0, import_node_fs4.readFileSync)(authFile, "utf-8"));
     return activeBaseUrlEntry(data, provider)?.baseUrl;
   } catch {
     return void 0;
@@ -2138,21 +1624,7 @@ function refreshThresholdMs(creds) {
   return Math.max(MIN_REFRESH_THRESHOLD_MS, lifetimeMs * REFRESH_THRESHOLD_RATIO);
 }
 var USAGE_EXHAUSTED_DEFAULT_MS = 15 * 60 * 1e3;
-var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
-  // Anthropic is API-key only; Claude subscriptions run through Claude Code.
-  "anthropic",
-  "glm",
-  "moonshot",
-  "xiaomi",
-  "minimax",
-  "deepseek",
-  "openrouter",
-  "huggingface",
-  "sakana",
-  "xai",
-  // Local endpoints: a fixed (usually placeholder) key, never refreshable.
-  "local"
-]);
+var REFRESHABLE_STORAGE_KEYS = /* @__PURE__ */ new Set([OPENAI_CHATGPT_KEY]);
 var AuthStorage = class {
   data = {};
   filePath;
@@ -2173,10 +1645,12 @@ var AuthStorage = class {
   refreshLocks = /* @__PURE__ */ new Map();
   detectMiniMaxRegion;
   detectXiaomiCluster;
+  detectKimiRegion;
   constructor(filePath, options) {
     this.filePath = filePath ?? getAppPaths().authFile;
     this.detectMiniMaxRegion = options?.detectMiniMaxBaseUrl ?? cachedMiniMaxRegion;
     this.detectXiaomiCluster = options?.detectXiaomiTokenPlanBaseUrl ?? detectXiaomiTokenPlanBaseUrl;
+    this.detectKimiRegion = options?.detectKimiCodeBaseUrl ?? cachedKimiRegion;
   }
   /** Path to the on-disk auth file. Useful for status output. */
   get path() {
@@ -2204,22 +1678,15 @@ var AuthStorage = class {
     return keys.find((key) => Boolean(this.data[key]));
   }
   /**
-   * True if the user has any usable auth for the logical provider. For a
-   * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
-   * satisfies it.
+   * True if the user has any usable auth for the logical provider: the plan
+   * sign-in or any of its API keys. A retired sign-in doesn't count.
    */
   async hasProviderAuth(provider) {
     if (isHiddenProvider(provider)) return false;
     await this.ensureFresh();
     const dual = dualAuthProvider(provider);
     if (dual) {
-      return Boolean(this.data[dual.oauthKey] || this.data[dual.provider]);
-    }
-    if (provider === "xiaomi") {
-      return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
-    }
-    if (provider === "gemini") {
-      return Boolean(this.data["gemini"] || this.data[GEMINI_API_KEY]);
+      return Boolean(this.data[dual.oauthKey] || usableEntry(this.data, dual.provider));
     }
     if (provider === "anthropic") {
       return Boolean(this.data.anthropic) && !isLegacyClaudeOAuth(this.data.anthropic) || isClaudeCodeAuthMarker(this.data[CLAUDE_CODE_AUTH_KEY]);
@@ -2227,7 +1694,25 @@ var AuthStorage = class {
     if (provider === "local") {
       return Object.keys(this.data).some((key) => key.startsWith(LOCAL_AUTH_KEY_PREFIX));
     }
-    return Boolean(this.data[provider]);
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /** True if any of `provider`'s API keys is stored. A retired sign-in in a key slot doesn't count. */
+  async hasApiKey(provider) {
+    await this.ensureFresh();
+    if (provider === "anthropic" && isLegacyClaudeOAuth(this.data.anthropic)) return false;
+    return apiKeyStorageKeys(provider).some((key) => Boolean(usableEntry(this.data, key)));
+  }
+  /**
+   * `provider`'s first stored API key, never its plan sign-in. For calls that
+   * only an API key may make (OpenAI's Images API isn't on the ChatGPT plan).
+   */
+  async resolveApiKey(provider) {
+    await this.ensureFresh();
+    for (const key of apiKeyStorageKeys(provider)) {
+      const creds = usableEntry(this.data, key);
+      if (creds && !(provider === "anthropic" && isLegacyClaudeOAuth(creds))) return creds;
+    }
+    throw new NotLoggedInError(provider);
   }
   /** True when the user signed in with Claude through Claude Code (marker only, no token). */
   async hasClaudeCodeLogin() {
@@ -2241,17 +1726,24 @@ var AuthStorage = class {
       if (isLegacyClaudeOAuth(latest.anthropic)) delete latest.anthropic;
     });
   }
+  /** Retired sign-ins still on disk, so the UI can ask the user to reconnect. */
+  async legacySignIns() {
+    await this.ensureFresh();
+    return RETIRED_SIGN_INS.filter((r) => isRetiredEntry(r, this.data[r.storageKey]));
+  }
   /**
-   * Remove an old GG Claude sign-in token (`sk-ant-oat…`), if any. True when one
-   * was removed, so the caller can tell the user once to sign in with Claude again.
+   * Remove `provider`'s retired sign-in, if any. True when one was removed, so
+   * the caller can tell the user once to reconnect.
    */
-  async takeLegacyClaudeSignIn() {
+  async takeLegacySignIn(provider) {
+    const retired = RETIRED_SIGN_INS.find((r) => r.provider === provider);
+    if (!retired) return false;
     await this.ensureFresh();
-    if (!isLegacyClaudeOAuth(this.data.anthropic)) return false;
+    if (!isRetiredEntry(retired, this.data[retired.storageKey])) return false;
     let removed = false;
     await this.mutateLatest((latest) => {
-      if (!isLegacyClaudeOAuth(latest.anthropic)) return;
-      delete latest.anthropic;
+      if (!isRetiredEntry(retired, latest[retired.storageKey])) return;
+      delete latest[retired.storageKey];
       removed = true;
     });
     return removed;
@@ -2271,7 +1763,7 @@ var AuthStorage = class {
    */
   async setLocalEndpoint(endpointId, baseUrl, apiKey) {
     await this.setCredentials(`${LOCAL_AUTH_KEY_PREFIX}${endpointId}`, {
-      accessToken: apiKey && apiKey.length > 0 ? apiKey : import_gg_ai2.LOCAL_NO_API_KEY,
+      accessToken: apiKey && apiKey.length > 0 ? apiKey : import_gg_ai3.LOCAL_NO_API_KEY,
       refreshToken: "",
       expiresAt: Date.now() + LOCAL_CREDENTIAL_LIFETIME_MS,
       baseUrl
@@ -2292,18 +1784,18 @@ var AuthStorage = class {
     const oauthCreds = dual ? this.data[dual.oauthKey] : void 0;
     if (dual && oauthCreds) {
       const exhaustedUntil = oauthCreds.usageExhaustedUntil ?? 0;
-      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data[dual.provider]);
+      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(usableEntry(this.data, dual.provider));
       if (!apiKeyActive) return false;
     }
-    return STATIC_API_KEY_PROVIDERS.has(provider);
+    return !REFRESHABLE_STORAGE_KEYS.has(provider);
   }
   /**
    * The base URL on the credential that is active right now, if any.
    * Synchronous — call only after load()/resolveCredentials() populated the
-   * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
-   * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
-   * resolveCredentials would serve (i.e. not currently usage-exhausted with an
-   * API key configured).
+   * snapshot. For a dual-auth provider this is the plan endpoint whenever the
+   * sign-in is the one resolveCredentials would serve (i.e. not currently
+   * usage-exhausted with an API key configured); for a plan/pay-per-token key
+   * split it is the plan key's endpoint when one is stored.
    */
   getStoredBaseUrl(provider) {
     return activeBaseUrlEntry(this.data, provider)?.baseUrl;
@@ -2312,7 +1804,7 @@ var AuthStorage = class {
     const first = !this.loaded;
     await withFileLock(this.filePath, async () => {
       try {
-        const content = await import_promises5.default.readFile(this.filePath, "utf-8");
+        const content = await import_promises6.default.readFile(this.filePath, "utf-8");
         this.data = JSON.parse(content);
         if (first) {
           log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
@@ -2358,7 +1850,7 @@ var AuthStorage = class {
     }
     let changed;
     try {
-      const stat = await import_promises5.default.stat(this.filePath);
+      const stat = await import_promises6.default.stat(this.filePath);
       changed = stat.ino !== this.snapshotIno || stat.mtimeMs !== this.snapshotMtimeMs || stat.size !== this.snapshotSize;
     } catch {
       changed = this.snapshotSize !== -1;
@@ -2371,7 +1863,7 @@ var AuthStorage = class {
    */
   async rememberSnapshot() {
     try {
-      const stat = await import_promises5.default.stat(this.filePath);
+      const stat = await import_promises6.default.stat(this.filePath);
       this.snapshotMtimeMs = stat.mtimeMs;
       this.snapshotSize = stat.size;
       this.snapshotIno = stat.ino;
@@ -2426,9 +1918,34 @@ var AuthStorage = class {
     });
     return { ...creds, baseUrl };
   }
-  async setCredentials(provider, creds) {
+  /**
+   * A Kimi Code key saved without an endpoint gets the host that issued it
+   * (`api.kimi.com` or `api.kimi.ai`), saved so the check runs once.
+   */
+  async withKimiRegion(creds) {
+    const baseUrl = await this.detectKimiRegion(creds.accessToken);
+    if (!baseUrl) return { ...creds, baseUrl: KIMI_CODE_DEFAULT_BASE_URL };
+    log("INFO", "auth", `Kimi Code key belongs to ${baseUrl} \u2014 saved for future requests`);
+    await this.mutateLatest((latest) => {
+      const current = latest[KIMI_CODE_KEY];
+      if (current?.accessToken === creds.accessToken && !current.baseUrl) {
+        current.baseUrl = baseUrl;
+      }
+    });
+    return { ...creds, baseUrl };
+  }
+  /**
+   * Store `creds` under `storageKey`. Connecting a provider again also removes
+   * its retired sign-in, which is what the reconnect notice asked for.
+   */
+  async setCredentials(storageKey, creds) {
+    const provider = storageKeyProvider(storageKey);
     await this.mutateLatest((latest) => {
-      latest[provider] = creds;
+      for (const retired of RETIRED_SIGN_INS) {
+        if (retired.provider !== provider || retired.storageKey === storageKey) continue;
+        if (isRetiredEntry(retired, latest[retired.storageKey])) delete latest[retired.storageKey];
+      }
+      latest[storageKey] = creds;
     });
   }
   /**
@@ -2465,9 +1982,9 @@ var AuthStorage = class {
    * Mark the credential stored under `storageKey` as usage-exhausted until
    * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
    * 15-minute default when no reset time is known. While the mark is in the
-   * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-   * instead of the subscription OAuth credential (when both are configured) — OAuth
-   * stays the preferred credential and is retried automatically once the mark
+   * future, `resolveCredentials("openai")` serves the OpenAI API key instead of
+   * the ChatGPT plan sign-in (when both are configured) — the plan stays the
+   * preferred credential and is retried automatically once the mark
    * lapses. Persisted to auth.json so a restart (or another gg-app window)
    * doesn't burn a request rediscovering the same exhausted window. No-op if
    * nothing is stored under `storageKey`.
@@ -2512,12 +2029,12 @@ var AuthStorage = class {
       await this.ensureFresh();
     }
     const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
-    if (!directStorageKeys.some((key) => Boolean(this.data[key])) && !(provider === "anthropic" && this.data[CLAUDE_CODE_AUTH_KEY])) {
+    if (!directStorageKeys.some((key) => Boolean(usableEntry(this.data, key))) && !(provider === "anthropic" && this.data[CLAUDE_CODE_AUTH_KEY])) {
       await this.reloadLatest();
     }
     if (opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider)) {
       for (const key of opts.storageKeys) {
-        const creds2 = this.data[key];
+        const creds2 = usableEntry(this.data, key);
         if (!creds2) continue;
         if (key !== provider && dualAuthProviderByOAuthKey(key)) {
           return await this.resolveCredentials(key, {
@@ -2531,6 +2048,7 @@ var AuthStorage = class {
             ...opts.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
           });
         }
+        if (key === KIMI_CODE_KEY && !creds2.baseUrl) return await this.withKimiRegion(creds2);
         return creds2;
       }
       throw new NotLoggedInError(provider);
@@ -2543,15 +2061,16 @@ var AuthStorage = class {
     }
     const dual = dualAuthProvider(provider);
     const dualOAuthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    const dualApiKey = dual ? usableEntry(this.data, dual.provider) : void 0;
     if (dual && dualOAuthCreds) {
       const exhaustedUntil = dualOAuthCreds.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && this.data[dual.provider]) {
+      if (Date.now() < exhaustedUntil && dualApiKey) {
         log(
           "WARN",
           "auth",
           `${dual.oauthLabel} usage window is exhausted \u2014 using the ${dual.apiKeyLabel} until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
         );
-        return this.data[dual.provider];
+        return dualApiKey;
       }
       try {
         return await this.resolveCredentials(dual.oauthKey, {
@@ -2559,23 +2078,24 @@ var AuthStorage = class {
           ...opts?.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
         });
       } catch (err) {
-        if (err instanceof NotLoggedInError && this.data[dual.provider]) {
+        if (err instanceof NotLoggedInError && dualApiKey) {
           log(
             "WARN",
             "auth",
             `${dual.oauthLabel} credential is no longer valid \u2014 falling back to the ${dual.apiKeyLabel}. ${dual.restoreHint}`
           );
-          return this.data[dual.provider];
+          return dualApiKey;
         }
         throw err;
       }
     }
-    const creds = this.data[provider];
+    const creds = usableEntry(this.data, provider);
     if (!creds) {
       throw new NotLoggedInError(provider);
     }
-    if (STATIC_API_KEY_PROVIDERS.has(provider)) {
+    if (!REFRESHABLE_STORAGE_KEYS.has(provider)) {
       if (provider === "minimax" && !creds.baseUrl) return await this.withMiniMaxRegion(creds);
+      if (provider === KIMI_CODE_KEY && !creds.baseUrl) return await this.withKimiRegion(creds);
       return creds;
     }
     if (!opts?.forceRefresh && Date.now() < creds.expiresAt - refreshThresholdMs(creds)) {
@@ -2603,13 +2123,14 @@ var AuthStorage = class {
         this.data = latest;
         return latestCreds;
       }
-      const refreshFn = provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : provider === XAI_OAUTH_KEY ? refreshXaiToken : refreshOpenAIToken;
       let refreshed;
       try {
-        refreshed = await refreshFn(latestCreds.refreshToken);
+        refreshed = await refreshChatGPTToken(latestCreds);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
+        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh|token_expired|refresh_token_(?:expired|invalidated|reused)/i.test(
+          msg
+        ) || /unauthorized/i.test(msg);
         if (isAuthFailure) {
           const current = await readAuthData(this.filePath);
           const currentCreds = current[provider];
@@ -2629,15 +2150,10 @@ var AuthStorage = class {
         }
         throw err;
       }
-      if (!refreshed.accountId && latestCreds.accountId) {
-        refreshed.accountId = latestCreds.accountId;
-      }
-      if (!refreshed.projectId && latestCreds.projectId) {
-        refreshed.projectId = latestCreds.projectId;
-      }
-      if (!refreshed.baseUrl && latestCreds.baseUrl) {
-        refreshed.baseUrl = latestCreds.baseUrl;
-      }
+      refreshed = {
+        ...pick(latestCreds, ["accountId", "baseUrl", "clientId", "idToken", "scopes"]),
+        ...refreshed
+      };
       latest[provider] = refreshed;
       this.data = latest;
       await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
@@ -2660,9 +2176,14 @@ var AuthStorage = class {
     return creds.accessToken;
   }
 };
+function pick(value, keys) {
+  const out = {};
+  for (const key of keys) if (value[key] !== void 0) out[key] = value[key];
+  return out;
+}
 async function readAuthData(filePath) {
   try {
-    const content = await import_promises5.default.readFile(filePath, "utf-8");
+    const content = await import_promises6.default.readFile(filePath, "utf-8");
     return JSON.parse(content);
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -2670,12 +2191,12 @@ async function readAuthData(filePath) {
   }
 }
 async function atomicWriteFile(filePath, content) {
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto6.default.randomUUID().slice(0, 8)}.tmp`;
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${import_node_crypto4.default.randomUUID().slice(0, 8)}.tmp`;
   try {
-    await import_promises5.default.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await import_promises5.default.rename(tmpPath, filePath);
+    await import_promises6.default.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await import_promises6.default.rename(tmpPath, filePath);
   } catch (err) {
-    await import_promises5.default.unlink(tmpPath).catch(() => {
+    await import_promises6.default.unlink(tmpPath).catch(() => {
     });
     throw err;
   }
@@ -2707,7 +2228,8 @@ var CODEX_FAST_BILLING = {
   detail: "Codex Fast mode uses your ChatGPT plan limits at 2.5x the standard rate (purchased credits at 2x).",
   paid: false
 };
-var GEMINI_AUTH_KEYS = [GEMINI_API_KEY, "gemini"];
+var GEMINI_AUTH_KEYS = [GEMINI_API_KEY];
+var KIMI_AUTH_KEYS = [KIMI_CODE_KEY, "moonshot"];
 var MODELS = [
   // ── Anthropic ──────────────────────────────────────────
   // NOTE: Claude Mythos 5.1 (`claude-mythos-5-1`, 2026-09-01) is kept commented
@@ -2837,14 +2359,13 @@ var MODELS = [
   {
     // GPT-6 Astra — "Our most capable model for complex, demanding work."
     // (Codex catalog priority 2, listed for every ChatGPT plan, requires a
-    // Codex client >= 0.153.0 — see CODEX_CLIENT_VERSION). Same split as 5.6:
-    // 1.05M on the public Responses API, 272K on the ChatGPT OAuth route
+    // Codex client >= 0.153.0). Same split as 5.6:
+    // 1.05M on the public Responses API, 272K on the ChatGPT plan route
     // (openai/codex models.json, `gpt-6-astra`). Reasoning ladder low → medium
     // → high → xhigh → max → ultra; `ultra` is the Codex orchestration preset
     // (multi_agent v2) and is Codex-only — the public API tops out at `max`.
-    // Note: through a plain API key OpenAI requires the Responses API for tool
-    // calling on Astra, so the Chat Completions path is text-only; the OAuth
-    // Codex route is the supported way to use it as an agent.
+    // OpenAI requires the Responses API for tool calling on Astra, so both
+    // the ChatGPT plan and API keys ride gg-ai's Responses transport.
     id: "gpt-6-astra",
     name: "GPT-6 Astra",
     provider: "openai",
@@ -2887,9 +2408,7 @@ var MODELS = [
   // next start.
   {
     // GPT-6.1 Sol — "Latest workhorse model for coding and everyday work."
-    // (Codex priority 1, default low). The catalog says Codex client >= 0.153.0,
-    // but the ChatGPT backend only serves it from 0.159.0 (see
-    // CODEX_CLIENT_VERSION). $2/$10 MTok, cached input $0.10. Ladder low →
+    // (Codex priority 1, default low). $2/$10 MTok, cached input $0.10. Ladder low →
     // medium → high → xhigh → max → ultra; ultra is the Codex orchestration
     // preset (xhigh effort on the wire + proactive local subagent delegation).
     id: "gpt-6.1-sol",
@@ -3076,8 +2595,8 @@ var MODELS = [
     maxThinkingLevel: "high",
     authStorageKeys: GEMINI_AUTH_KEYS
   },
-  // Keep 3.1 Flash Lite first for the working OAuth default and fast-model routing.
-  // New GA models are opt-in; Code Assist access varies by account. Gemini 3.7
+  // Keep 3.1 Flash Lite first for the default and fast-model routing.
+  // Gemini 3.7
   // Flash is retired: Google deprecated it on 2026-10-08 and routes every
   // `gemini-3.7-flash` request to 3.8 Flash (ai.google.dev/gemini-api/docs/
   // changelog), so a saved session on it falls back to the provider default.
@@ -3110,9 +2629,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Wire name `gemini-3-flash` — the Code Assist (OAuth) backend rejects the
-    // display string `gemini-3.5-flash` with a 404, so gemini-cli keeps this
-    // alternative name (SECONDARY_GEMINI_3_5_FLASH_MODEL) for that endpoint.
+    // Wire name `gemini-3-flash`, the id Google serves 3.5 Flash under.
     id: "gemini-3-flash",
     name: "Gemini 3.5 Flash",
     provider: "gemini",
@@ -3127,9 +2644,7 @@ var MODELS = [
     authStorageKeys: GEMINI_AUTH_KEYS
   },
   {
-    // Gemini 3.1 Pro is public preview — gated behind Code Assist preview
-    // enablement, so free/personal OAuth accounts 404 on it (see
-    // ACCOUNT_GATED_MODELS in gg-ai's gemini provider).
+    // Gemini 3.1 Pro is public preview.
     id: "gemini-3.1-pro-preview",
     name: "Gemini 3.1 Pro (Preview)",
     provider: "gemini",
@@ -3146,8 +2661,8 @@ var MODELS = [
   // ── Moonshot (Kimi) ────────────────────────────────────
   // K3 is Kimi's 2.8T-parameter flagship for long-horizon coding, knowledge
   // work, and deep reasoning. Its effort ladder is server-declared as
-  // low/high/max on both the public API (default max) and the Kimi For Coding
-  // OAuth endpoint (default high); thinking can also be fully disabled.
+  // low/high/max on both the public API (default max) and the Kimi Code plan
+  // endpoint (default high); thinking can also be fully disabled.
   {
     id: "kimi-k3",
     name: "Kimi K3",
@@ -3161,13 +2676,14 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "high",
-    maxThinkingLevel: "max"
+    maxThinkingLevel: "max",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
-  // K2.8 Preview (2026-09-11) is served only on the Kimi For Coding OAuth
-  // endpoint, under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
+  // K2.8 Preview (2026-09-11) is served only on the Kimi Code plan endpoint,
+  // under its rolling `kimi-for-coding` id (live /models, 2026-09-28:
   // display_name "K2.8 Preview", 1M context, image + video input, efforts
-  // low/high/max default max). The public API-key endpoint does not serve it,
-  // so it resolves from the Kimi sign-in credential only.
+  // low/high/max default max). The public Moonshot API does not serve it, so
+  // it resolves from a Kimi Code plan key only.
   {
     id: "kimi-for-coding",
     name: "Kimi K2.8 Preview",
@@ -3180,7 +2696,7 @@ var MODELS = [
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
     maxThinkingLevel: "max",
-    authStorageKeys: [MOONSHOT_OAUTH_KEY]
+    authStorageKeys: [KIMI_CODE_KEY]
   },
   // K2.7 Code is requested by its pinned id (not the `kimi-for-coding` alias
   // that moved to K2.8), so it stays the real K2.7 on both endpoints.
@@ -3195,7 +2711,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // K2.7 Code HighSpeed — the same model as K2.7 Code served at ~180 tok/s
   // (up to ~260 on short contexts), 256K context (platform.kimi.ai model list,
@@ -3214,7 +2731,8 @@ var MODELS = [
     supportsVideo: true,
     maxVideoBytes: 100 * 1024 * 1024,
     costTier: "medium",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "high",
+    authStorageKeys: KIMI_AUTH_KEYS
   },
   // ── Z.AI (GLM) ─────────────────────────────────────────
   // Two GLM entries, both live on the coding endpoint (verified against its
@@ -3816,12 +3334,12 @@ function clampThinkingForPlanMode(level) {
 }
 
 // src/local-models.ts
-var import_gg_ai3 = require("@kenkaiiii/gg-ai");
+var import_gg_ai4 = require("@kenkaiiii/gg-ai");
 var DEFAULT_LOCAL_ENDPOINTS = [
   { id: "ollama", label: "Ollama", baseUrl: "http://127.0.0.1:11434/v1", kind: "ollama" }
 ];
 var FALLBACK_CONTEXT_WINDOW = 4096;
-var LOCAL_API_KEY_PLACEHOLDER = import_gg_ai3.LOCAL_NO_API_KEY;
+var LOCAL_API_KEY_PLACEHOLDER = import_gg_ai4.LOCAL_NO_API_KEY;
 var DEFAULT_PROBE_TIMEOUT_MS = 1200;
 var ENRICH_CONCURRENCY = 6;
 var CACHE_TTL_MS = 3e4;
@@ -3850,7 +3368,7 @@ function endpointRoot(baseUrl) {
   return baseUrl.replace(/\/+$/, "").replace(/\/v1$/, "");
 }
 function authHeaders(endpoint) {
-  const key = (0, import_gg_ai3.localBearerKey)(endpoint.apiKey);
+  const key = (0, import_gg_ai4.localBearerKey)(endpoint.apiKey);
   return {
     ...key ? { Authorization: `Bearer ${key}` } : {},
     Accept: "application/json"
@@ -4141,7 +3659,7 @@ function findProbedModel(probes, modelId) {
 }
 
 // src/claude-code/usage.ts
-var import_promises6 = __toESM(require("fs/promises"), 1);
+var import_promises7 = __toESM(require("fs/promises"), 1);
 var import_node_path5 = __toESM(require("path"), 1);
 var USAGE_FILE = "usage.json";
 var WINDOWS = {
@@ -4177,7 +3695,7 @@ function usagePath(opts) {
 async function readClaudeCodeUsage(opts = {}) {
   let parsed;
   try {
-    parsed = JSON.parse(await import_promises6.default.readFile(usagePath(opts), "utf8"));
+    parsed = JSON.parse(await import_promises7.default.readFile(usagePath(opts), "utf8"));
   } catch {
     return null;
   }
@@ -4195,8 +3713,8 @@ function recordClaudeCodeRateLimit(info, opts = {}) {
     const next = mergeClaudeCodeRateLimit(info, await readClaudeCodeUsage({ ...opts, now }), now);
     if (next.windows.length === 0) return;
     const file = usagePath(opts);
-    await import_promises6.default.mkdir(import_node_path5.default.dirname(file), { recursive: true });
-    await import_promises6.default.writeFile(file, JSON.stringify(next), "utf8");
+    await import_promises7.default.mkdir(import_node_path5.default.dirname(file), { recursive: true });
+    await import_promises7.default.writeFile(file, JSON.stringify(next), "utf8");
   };
   writeQueue = writeQueue.then(write).catch(() => {
   });
@@ -4204,7 +3722,7 @@ function recordClaudeCodeRateLimit(info, opts = {}) {
 }
 async function clearClaudeCodeUsage(opts = {}) {
   await writeQueue;
-  await import_promises6.default.rm(usagePath(opts), { force: true }).catch(() => {
+  await import_promises7.default.rm(usagePath(opts), { force: true }).catch(() => {
   });
 }
 
@@ -4245,6 +3763,9 @@ async function signOutOfClaudeCode(auth, opts = {}) {
 }
 
 // src/auth-providers.ts
+function apiKeyDetails(label, billing, when = "") {
+  return { apikey: { method: "apikey", label, billing, when } };
+}
 var ALL_AUTH_PROVIDERS = [
   {
     value: "anthropic",
@@ -4272,89 +3793,103 @@ var ALL_AUTH_PROVIDERS = [
     value: "openai",
     label: "OpenAI",
     description: "GPT-6 Astra, GPT-6 Astra Fast, GPT-6.1 Sol, GPT-6.1 Sol Fast, GPT-6.1 Terra, GPT-6.1 Terra Fast, GPT-6 Luna, GPT-6 Luna Fast",
-    methods: ["oauth"]
+    methods: ["oauth", "apikey"],
+    apiKeyLabel: "OpenAI",
+    methodDetails: {
+      oauth: {
+        method: "oauth",
+        label: "Continue with ChatGPT",
+        billing: "Uses your ChatGPT plan.",
+        when: "Signs in through OpenAI. Manage what GG Coder may use at chatgpt.com/settings/usage.",
+        requires: "A ChatGPT plan."
+      },
+      apikey: {
+        method: "apikey",
+        label: "OpenAI API key",
+        billing: "Pay-per-token from an OpenAI Platform key.",
+        when: "No subscription needed. Covers you while your ChatGPT plan's usage is out."
+      }
+    }
   },
   {
     value: "gemini",
     label: "Gemini",
     description: "Gemini 3.8 Flash, 3.5 Flash Lite, 3.1 Flash Lite, 3.5 Flash, 3.1 Pro (Preview)",
-    methods: ["oauth", "apikey"],
+    methods: ["apikey"],
     apiKeyLabel: "Gemini",
     apiKeyBaseUrl: GEMINI_API_KEY_BASE_URL,
-    // Stored under its own key so it never overwrites the `gemini` OAuth login.
+    // Stored under its own key: `gemini` held the retired Google sign-in.
     apiKeyVariants: [
-      { key: GEMINI_API_KEY, label: "Google AI Studio", baseUrl: GEMINI_API_KEY_BASE_URL }
-    ],
-    methodDetails: {
-      oauth: {
-        method: "oauth",
-        label: "Sign in with Google",
-        billing: "Gemini Code Assist Standard or Enterprise licence.",
-        when: "Personal Google accounts are no longer served here (Google ended it on June 18, 2026)."
-      },
-      apikey: {
-        method: "apikey",
-        label: "Gemini API key",
+      {
+        key: GEMINI_API_KEY,
+        label: "Google AI Studio",
+        kind: "payg",
         billing: "Pay-per-token from a Google AI Studio key.",
-        when: "Used first whenever it is set."
+        baseUrl: GEMINI_API_KEY_BASE_URL
       }
-    }
+    ],
+    methodDetails: apiKeyDetails("Gemini API key", "Pay-per-token from a Google AI Studio key.")
   },
   {
     value: "xai",
     label: "xAI (Grok)",
-    description: "Grok 4.7 \xB7 OAuth or API key",
-    methods: ["oauth", "apikey"],
+    description: "Grok 4.7",
+    methods: ["apikey"],
     apiKeyLabel: "xAI",
-    methodDetails: {
-      oauth: {
-        method: "oauth",
-        label: "Sign in with Grok",
-        billing: "Included with SuperGrok or X Premium.",
-        when: ""
-      },
-      apikey: {
-        method: "apikey",
-        label: "xAI API key",
-        billing: "Pay-per-token on console.x.ai credits.",
-        when: ""
-      }
-    }
+    methodDetails: apiKeyDetails(
+      "xAI API key",
+      "Pay-per-token from console.x.ai credits.",
+      "SuperGrok and X Premium usage is only offered in apps xAI partners with."
+    )
   },
   {
     value: "moonshot",
-    label: "Moonshot",
-    description: "Kimi K3, K2.8 Preview (Kimi sign-in), K2.7 Code, K2.7 Code HighSpeed \xB7 OAuth or API key",
-    methods: ["oauth", "apikey"],
-    apiKeyLabel: "Moonshot",
-    methodDetails: {
-      oauth: {
-        method: "oauth",
-        label: "Sign in with Kimi",
-        billing: "Included with a Kimi For Coding plan.",
-        when: ""
+    label: "Kimi (Moonshot)",
+    description: "Kimi K3, K2.8 Preview (Kimi Code plan), K2.7 Code, K2.7 Code HighSpeed",
+    methods: ["apikey"],
+    apiKeyLabel: "Kimi",
+    apiKeyVariants: [
+      {
+        key: KIMI_CODE_KEY,
+        label: "Kimi Code plan",
+        kind: "plan",
+        billing: "Uses your Kimi Code plan. Create the key in the Kimi Code Console."
       },
-      apikey: {
-        method: "apikey",
-        label: "Moonshot API key",
-        billing: "Pay-per-token on Moonshot credits.",
-        when: ""
+      {
+        key: "moonshot",
+        label: "Moonshot API",
+        kind: "payg",
+        billing: "Pay-per-token from platform.moonshot.ai."
       }
-    }
+    ],
+    methodDetails: apiKeyDetails(
+      "Kimi API key",
+      "A Kimi Code plan key uses your plan; a Moonshot key is pay-per-token."
+    )
   },
   {
     value: "glm",
     label: "Z.AI (GLM)",
     description: "GLM-5.3, GLM-5.3-Flash",
     methods: ["apikey"],
-    apiKeyLabel: "Z.AI"
+    apiKeyLabel: "Z.AI",
+    methodDetails: apiKeyDetails(
+      "Z.AI API key",
+      "Pay-per-token from your Z.AI account balance.",
+      "GLM Coding Plan quota can't be used here: Z.AI limits the plan to the tools it lists."
+    )
   },
   {
     value: "minimax",
     label: "MiniMax",
     description: "MiniMax M3.1 Flash, M3",
     methods: ["apikey"],
-    apiKeyLabel: "MiniMax"
+    apiKeyLabel: "MiniMax",
+    methodDetails: apiKeyDetails(
+      "MiniMax API key",
+      "An M Plan key uses your plan; a pay-as-you-go key is pay-per-token.",
+      "The key you paste decides which one is billed."
+    )
   },
   {
     value: "xiaomi",
@@ -4367,44 +3902,66 @@ var ALL_AUTH_PROVIDERS = [
       {
         key: "xiaomi",
         label: "Token Plan",
+        kind: "plan",
+        billing: "Uses your MiMo Token Plan.",
         baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1"
       },
       {
         key: XIAOMI_CREDITS_KEY,
-        label: "API Credits (required for UltraSpeed)",
+        label: "API Credits",
+        kind: "payg",
+        billing: "Pay-per-token from MiMo API Credits. Required for UltraSpeed.",
         baseUrl: "https://api.xiaomimimo.com/v1"
       }
-    ]
+    ],
+    methodDetails: apiKeyDetails(
+      "Xiaomi MiMo API key",
+      "A Token Plan key uses your plan; an API Credits key is pay-per-token."
+    )
   },
   {
     value: "deepseek",
     label: "DeepSeek",
     description: "DeepSeek V4 Pro, V4.1 Flash",
     methods: ["apikey"],
-    apiKeyLabel: "DeepSeek"
+    apiKeyLabel: "DeepSeek",
+    methodDetails: apiKeyDetails("DeepSeek API key", "Pay-per-token from platform.deepseek.com.")
   },
   {
     value: "sakana",
     label: "Sakana (Fugu)",
     description: "Fugu, Fugu Max, Fugu Ultra",
     methods: ["apikey"],
-    apiKeyLabel: "Sakana"
+    apiKeyLabel: "Sakana",
+    methodDetails: apiKeyDetails("Sakana API key", "Pay-per-token from your Sakana API account.")
   },
   {
     value: "openrouter",
     label: "OpenRouter",
     description: "Qwen3.8 Max \xB7 multi-provider gateway",
     methods: ["apikey"],
-    apiKeyLabel: "OpenRouter"
+    apiKeyLabel: "OpenRouter",
+    methodDetails: apiKeyDetails("OpenRouter API key", "Pay-per-token from OpenRouter credits.")
   },
   {
     value: "huggingface",
     label: "Hugging Face",
     description: "Kimi K2.7 Code, DeepSeek V4.1 Flash, GPT-OSS 120B",
     methods: ["apikey"],
-    apiKeyLabel: "Hugging Face"
+    apiKeyLabel: "Hugging Face",
+    methodDetails: apiKeyDetails(
+      "Hugging Face token",
+      "Pay-per-token from Hugging Face Inference Providers credits."
+    )
   }
 ];
+function requiredKeyLabel(provider, storageKeys) {
+  const variants = ALL_AUTH_PROVIDERS.find((p) => p.value === provider)?.apiKeyVariants ?? [];
+  const needed = variants.filter((v) => storageKeys.includes(v.key));
+  if (needed.length === 0 || needed.length === variants.length) return void 0;
+  const names = needed.map((v) => v.label).join(" or ");
+  return `Needs ${/^[aeiou]/i.test(names) ? "an" : "a"} ${names} key`;
+}
 var AUTH_PROVIDERS = ALL_AUTH_PROVIDERS.filter(
   (p) => !isHiddenProvider(p.value)
 );
@@ -4431,18 +3988,24 @@ function describeAuthMethods(provider) {
   });
 }
 function authPriorityNote(provider) {
-  if (provider === "gemini") {
-    return "Uses the Gemini API key first when one is set; otherwise the Google sign-in.";
-  }
   if (provider === "anthropic") {
     return "Uses Sign in with Claude while you are signed in; otherwise the Anthropic API key.";
   }
   const dual = dualAuthProvider(provider);
-  if (!dual) return void 0;
-  return `Uses ${dual.oauthLabel} first; the ${dual.apiKeyLabel} takes over when it runs out, then switches back.`;
+  if (dual) {
+    return `Uses your ${dual.oauthLabel} first; the ${dual.apiKeyLabel} takes over while its usage is out, then switches back.`;
+  }
+  const variants = getAuthProvider(provider)?.apiKeyVariants;
+  const plan = variants?.find((v) => v.kind === "plan");
+  const payg = variants?.find((v) => v.kind === "payg");
+  if (plan && payg) {
+    return `Uses the ${plan.label} key first when both are set; the ${payg.label} key covers models the plan doesn't include.`;
+  }
+  return void 0;
 }
 
 // src/provider-usage.ts
+var import_gg_ai5 = require("@kenkaiiii/gg-ai");
 var SubscriptionUsageError = class extends Error {
   constructor(message, status, retryAfterMs2) {
     super(message);
@@ -4451,51 +4014,14 @@ var SubscriptionUsageError = class extends Error {
     this.name = "SubscriptionUsageError";
   }
 };
-var CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
 function finiteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
-function clampPercent(value) {
-  const number = finiteNumber(value);
-  return number === void 0 ? void 0 : Math.min(100, Math.max(0, number));
-}
 function isoTimestamp(value) {
   if (typeof value !== "string" || !value.trim()) return void 0;
   const timestamp = Date.parse(value);
   return Number.isFinite(timestamp) ? timestamp : void 0;
 }
-function unixTimestamp(value) {
-  const seconds = finiteNumber(value);
-  return seconds === void 0 ? void 0 : seconds * 1e3;
-}
-function codexResetAt(window, now) {
-  const absolute = unixTimestamp(window.reset_at);
-  if (absolute !== void 0) return absolute;
-  const afterSeconds = finiteNumber(window.reset_after_seconds);
-  return afterSeconds === void 0 ? void 0 : now + afterSeconds * 1e3;
-}
-function currentWindowLabel(seconds, fallbackHours) {
-  const duration = finiteNumber(seconds);
-  const hours = Math.max(1, Math.round((duration ?? fallbackHours * 3600) / 3600));
-  return `${hours}-hour`;
-}
-function codexWindowKind(window, fallback) {
-  const duration = finiteNumber(window.limit_window_seconds);
-  if (duration === void 0) return fallback;
-  return duration >= 6 * 24 * 60 * 60 ? "weekly" : "current";
-}
-function normalizedCodexWindow(window, fallbackKind, now) {
-  if (!window) return null;
-  const usedPercent = clampPercent(window.used_percent);
-  if (usedPercent === void 0) return null;
-  const kind = codexWindowKind(window, fallbackKind);
-  return {
-    kind,
-    label: kind === "weekly" ? "Weekly" : currentWindowLabel(window.limit_window_seconds, 5),
-    usedPercent,
-    resetsAt: codexResetAt(window, now)
-  };
-}
 function retryAfterMs(response, now) {
   const value = response.headers.get("retry-after")?.trim();
   if (!value) return void 0;
@@ -4518,31 +4044,6 @@ async function readUsageResponse(response, now) {
     throw new SubscriptionUsageError("Subscription usage response was not valid JSON");
   }
 }
-async function fetchCodexUsage(credentials, fetchFn, signal, now) {
-  const headers = {
-    Authorization: `Bearer ${credentials.accessToken}`,
-    Accept: "application/json",
-    originator: "ggcoder",
-    "User-Agent": "ggcoder"
-  };
-  if (credentials.accountId) headers["ChatGPT-Account-Id"] = credentials.accountId;
-  const response = await fetchFn(CODEX_USAGE_URL, { method: "GET", signal, headers });
-  const data = await readUsageResponse(response, now());
-  const windows = [
-    normalizedCodexWindow(data.rate_limit?.primary_window, "current", now()),
-    normalizedCodexWindow(data.rate_limit?.secondary_window, "weekly", now())
-  ].filter((window) => window !== null);
-  windows.sort((left, right) => {
-    if (left.kind === right.kind) return 0;
-    return left.kind === "current" ? -1 : 1;
-  });
-  return {
-    provider: "openai",
-    displayName: "Codex",
-    windows,
-    fetchedAt: now()
-  };
-}
 function kimiNumber(value) {
   if (typeof value === "string" && value.trim()) {
     const parsed = Number(value);
@@ -4573,15 +4074,14 @@ function kimiWindowMinutes(window) {
   }
 }
 async function fetchKimiUsage(credentials, fetchFn, signal, now) {
-  const response = await fetchFn(`${kimiCodeBaseUrl()}/usages`, {
+  const baseUrl = (credentials.baseUrl ?? KIMI_CODE_DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const response = await fetchFn(`${baseUrl}/usages`, {
     method: "GET",
     signal,
     headers: {
       Authorization: "Bearer " + credentials.accessToken,
       Accept: "application/json",
-      // The managed coding endpoint gates on the kimi-code-cli client identity,
-      // same as model requests.
-      ...kimiCodingHeaders()
+      "User-Agent": import_gg_ai5.GG_CODER_USER_AGENT
     }
   });
   const data = await readUsageResponse(response, now());
@@ -4633,7 +4133,7 @@ async function fetchSubscriptionUsage(provider, credentials, options = {}) {
   const now = options.now ?? Date.now;
   const signal = AbortSignal.timeout(options.timeoutMs ?? 8e3);
   try {
-    return provider === "openai" ? await fetchCodexUsage(credentials, fetchFn, signal, now) : await fetchKimiUsage(credentials, fetchFn, signal, now);
+    return await fetchKimiUsage(credentials, fetchFn, signal, now);
   } catch (error) {
     if (error instanceof SubscriptionUsageError) throw error;
     const message = error instanceof Error ? error.message : String(error);
@@ -4698,7 +4198,7 @@ var TelegramBot = class {
       } catch (err) {
         if (!this.running) break;
         console.error(`[telegram] Poll error: ${err instanceof Error ? err.message : err}`);
-        await sleep3(3e3);
+        await sleep(3e3);
       }
     }
   }
@@ -4884,7 +4384,7 @@ function splitMessage(text) {
   }
   return chunks;
 }
-function sleep3(ms) {
+function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
@@ -4969,8 +4469,8 @@ async function transcribeVoice(fileUrl) {
 }
 
 // src/auto-update.ts
-var import_node_child_process3 = require("child_process");
-var import_node_fs6 = __toESM(require("fs"), 1);
+var import_node_child_process2 = require("child_process");
+var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_path6 = __toESM(require("path"), 1);
 var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 1e4;
@@ -4986,7 +4486,7 @@ function compareVersions(a, b) {
 function performUpdateInBackground(command) {
   try {
     const parts = command.split(" ");
-    const child = (0, import_node_child_process3.spawn)(parts[0], parts.slice(1), {
+    const child = (0, import_node_child_process2.spawn)(parts[0], parts.slice(1), {
       detached: true,
       stdio: "ignore",
       env: { ...process.env, npm_config_loglevel: "silent" }
@@ -5004,7 +4504,7 @@ function createAutoUpdater(config) {
   }
   function readState() {
     try {
-      const raw = import_node_fs6.default.readFileSync(stateFilePath(), "utf-8");
+      const raw = import_node_fs5.default.readFileSync(stateFilePath(), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -5013,8 +4513,8 @@ function createAutoUpdater(config) {
   function writeState(state) {
     try {
       const filePath = stateFilePath();
-      import_node_fs6.default.mkdirSync(import_node_path6.default.dirname(filePath), { recursive: true, mode: 448 });
-      import_node_fs6.default.writeFileSync(filePath, JSON.stringify(state));
+      import_node_fs5.default.mkdirSync(import_node_path6.default.dirname(filePath), { recursive: true, mode: 448 });
+      import_node_fs5.default.writeFileSync(filePath, JSON.stringify(state));
     } catch {
     }
   }
@@ -5140,29 +4640,38 @@ function createAutoUpdater(config) {
 0 && (module.exports = {
   AUTH_PROVIDERS,
   AuthStorage,
+  CHATGPT_PLAN_BASE_URL,
+  CHATGPT_PLAN_NOT_ENABLED_MESSAGE,
+  CHATGPT_PLAN_SCOPE,
+  CHATGPT_USAGE_URL,
   CLAUDE_CODE_AUTH_KEY,
   CLAUDE_CODE_AUTH_MARKER,
   CLAUDE_CODE_MANIFEST,
+  ChatGPTPlanNotEnabledError,
   DEFAULT_LOCAL_ENDPOINTS,
   DEFAULT_MAX_VIDEO_BYTES,
   FALLBACK_CONTEXT_WINDOW,
   GEMINI_API_KEY,
   GEMINI_API_KEY_BASE_URL,
   HIDDEN_PROVIDERS,
+  KIMI_CODE_DEFAULT_BASE_URL,
+  KIMI_CODE_KEY,
+  KIMI_CODE_OVERSEAS_BASE_URL,
   LOCAL_API_KEY_PLACEHOLDER,
   LOCAL_AUTH_KEY_PREFIX,
   MINIMAX_CN_BASE_URL,
   MINIMAX_GLOBAL_BASE_URL,
   MODELS,
-  MOONSHOT_OAUTH_KEY,
   NotLoggedInError,
+  OPENAI_CHATGPT_KEY,
   OPENROUTER_DEFAULT_BASE_URL,
   PLAN_MODE_THINKING_CAP,
+  RETIRED_SIGN_INS,
   SubscriptionUsageError,
   TelegramBot,
-  XAI_OAUTH_KEY,
   XIAOMI_CREDITS_KEY,
   XIAOMI_TOKEN_PLAN_BASE_URLS,
+  apiKeyStorageKeys,
   authPriorityNote,
   clampThinkingForPlanMode,
   claudeCodeAuthStatus,
@@ -5179,6 +4688,7 @@ function createAutoUpdater(config) {
   createAutoUpdater,
   decodeOggOpus,
   describeAuthMethods,
+  detectKimiCodeBaseUrl,
   detectMiniMaxBaseUrl,
   detectXiaomiTokenPlanBaseUrl,
   discoverLocalModels,
@@ -5187,6 +4697,7 @@ function createAutoUpdater(config) {
   dualAuthProviderByOAuthKey,
   endpointRoot,
   ensureClaudeCodeBinary,
+  fetchChatGPTPlanModels,
   fetchSubscriptionUsage,
   findProbedModel,
   formatClaudeCodeInstallProgress,
@@ -5197,6 +4708,7 @@ function createAutoUpdater(config) {
   getAuthProvider,
   getAuthStorageKey,
   getAuthStorageKeys,
+  getChatGPTHostId,
   getContextWindow,
   getDefaultModel,
   getDefaultThinkingLevel,
@@ -5212,10 +4724,7 @@ function createAutoUpdater(config) {
   getSupportedThinkingLevels,
   getToolResultCharLimit,
   getVideoByteLimit,
-  grokCliBaseUrl,
-  grokCliHeaders,
   isClaudeCodeAuthMarker,
-  isGrokCliEndpoint,
   isHiddenProvider,
   isKimiCodingEndpoint,
   isLegacyClaudeOAuth,
@@ -5224,21 +4733,17 @@ function createAutoUpdater(config) {
   isModelLoaded,
   isPaidModel,
   isThinkingLevelSupported,
-  kimiCodeBaseUrl,
-  kimiCodingHeaders,
   localAuthStorageKey,
   localModelShortName,
   log,
+  loginChatGPT,
   loginClaudeCode,
-  loginGemini,
-  loginKimi,
-  loginOpenAI,
-  loginXai,
   logoutClaudeCode,
   mergeClaudeCodeRateLimit,
   oauthStorageKey,
   ollamaServedContext,
   openLog,
+  parseCallbackInput,
   parseLocalModelId,
   parseOpenRouterCatalog,
   probeEndpoint,
@@ -5246,21 +4751,22 @@ function createAutoUpdater(config) {
   readClaudeCodeUsage,
   readStoredBaseUrlSync,
   recordClaudeCodeRateLimit,
-  refreshGeminiToken,
-  refreshKimiToken,
-  refreshOpenAIToken,
-  refreshXaiToken,
+  refreshChatGPTToken,
   registerLogCleanup,
   registerRuntimeModels,
+  requiredKeyLabel,
   resample,
   resolveClaudeCodeBinary,
+  revokeChatGPTSignIn,
   setProgressCallback,
   setProviderCatalog,
   signInWithClaudeCode,
   signOutOfClaudeCode,
+  storageKeyProvider,
   toModelInfo,
   transcribeVoice,
   usesOpenAICodexTransport,
+  verifyIdToken,
   withFileLock,
   withoutPaidTier
 });