@kevin5251984/guild 0.2.12

package/src/oauth.ts

@@ -0,0 +1,1474 @@
+/**
+ * Subscription login + completion, same path as
+ * https://github.com/ziyou979/dsh-llm-oauth: `@earendil-works/pi-ai`
+ * with a durable CredentialStore so tokens refresh on the request.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import {
+  contentText,
+  createModels,
+  type AssistantMessage,
+  type AuthEvent,
+  type AuthInteraction,
+  type AuthPrompt,
+  type Credential,
+  type CredentialInfo,
+  type CredentialStore,
+  type Message,
+  type Model,
+  type MutableModels,
+  type OAuthCredential,
+} from "@earendil-works/pi-ai";
+import {
+  emitProgress,
+  guildTools,
+  roundSignal,
+  TOOL_LOOP_EXHAUSTED,
+  TOOL_LOOP_WRAP,
+  type SkillRef,
+  type ToolContext,
+  type ToolTrace,
+} from "./tools.ts";
+import { estimateSendTokens, trimSendMessages } from "./send-budget.ts";
+import { runAgentLoop } from "./harness.ts";
+import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+import { defaultDataDir, StoreError } from "./store.ts";
+import {
+  addUsage,
+  blankUsage,
+  fromPiUsage,
+  withDuration,
+} from "./usage.ts";
+import type { ChatUsage } from "@guild/protocol";
+
+export type ModelEntryLite = { id: string; name: string };
+export type SubscriptionFlow = "device" | "pkce";
+
+export type SubscriptionDef = {
+  id: string;
+  pickerId: string;
+  name: string;
+  hint: string;
+  loginHint?: string;
+  flow: SubscriptionFlow;
+};
+
+export const SUBSCRIPTIONS: SubscriptionDef[] = [
+  {
+    id: "xai",
+    pickerId: "xai-oauth",
+    name: "xAI Grok",
+    hint: "SuperGrok / X Premium+ 訂閱。裝置碼登入，不必貼 API key。",
+    flow: "device",
+  },
+  {
+    id: "openai-codex",
+    pickerId: "openai-codex",
+    name: "ChatGPT Codex",
+    hint: "ChatGPT Plus/Pro 訂閱。Web 走裝置碼（與 dsh-llm-oauth 相同）。",
+    loginHint:
+      "先到 ChatGPT → Settings → Apps & connectors，開啟 Codex 的 device code authorization。非正式客戶端有帳號風險。",
+    flow: "device",
+  },
+  {
+    id: "anthropic",
+    pickerId: "anthropic-oauth",
+    name: "Claude Pro/Max",
+    hint: "Claude 訂閱。瀏覽器 PKCE，完成後自動回到 Guild。",
+    flow: "pkce",
+  },
+  {
+    id: "github-copilot",
+    pickerId: "github-copilot",
+    name: "GitHub Copilot",
+    hint: "GitHub Copilot 訂閱。裝置碼登入 github.com。",
+    flow: "device",
+  },
+  {
+    id: "openrouter",
+    pickerId: "openrouter-oauth",
+    name: "OpenRouter",
+    hint: "OpenRouter OAuth 會換成你帳號下的 API key，從點數扣款。",
+    flow: "pkce",
+  },
+  {
+    id: "kimi-coding",
+    pickerId: "kimi-coding-oauth",
+    name: "Kimi Code",
+    hint: "Kimi Code 訂閱。裝置碼登入 kimi.com，不必貼 API key。",
+    flow: "device",
+  },
+  {
+    id: "radius",
+    pickerId: "radius-oauth",
+    name: "Pi Radius",
+    hint: "Pi 的 Radius 閘道（預設 radius.pi.dev）。裝置碼登入，模型清單登入後從閘道拉取。",
+    flow: "device",
+  },
+];
+
+export const OAUTH_PICKER_IDS = new Set(SUBSCRIPTIONS.map((s) => s.pickerId));
+const CATALOG_IDS = SUBSCRIPTIONS.map((s) => s.id);
+
+export function subscriptionById(id: string): SubscriptionDef | undefined {
+  return SUBSCRIPTIONS.find((s) => s.id === id);
+}
+
+export function subscriptionByPicker(pickerId: string): SubscriptionDef | undefined {
+  return SUBSCRIPTIONS.find((s) => s.pickerId === pickerId);
+}
+
+export function oauthPath(dataDir: string): string {
+  return join(dataDir, "oauth.json");
+}
+
+class FileCredentialStore implements CredentialStore {
+  private cache: Record<string, Credential> | undefined;
+  private readonly chains = new Map<string, Promise<unknown>>();
+
+  constructor(
+    readonly path: string,
+    private readonly seedPaths: string[],
+  ) {}
+
+  private load(): Record<string, Credential> {
+    const cached = this.cache;
+    if (cached) {
+      const xai = cached.xai;
+      if (xai?.type !== "oauth" || Date.now() + 60_000 < xai.expires) {
+        return cached;
+      }
+    }
+    this.cache = hydrateAuthFile(this.path, this.seedPaths);
+    return this.cache;
+  }
+
+  private save(next: Record<string, Credential>): void {
+    this.cache = next;
+    mkdirSync(dirname(this.path), { recursive: true });
+    writeFileSync(this.path, `${JSON.stringify(next, null, 2)}\n`, {
+      mode: 0o600,
+    });
+  }
+
+  private enqueue<T>(providerId: string, task: () => Promise<T>): Promise<T> {
+    const previous = this.chains.get(providerId) ?? Promise.resolve();
+    const run = previous.catch(() => undefined).then(task);
+    this.chains.set(providerId, run.then(() => undefined, () => undefined));
+    return run;
+  }
+
+  async read(providerId: string): Promise<Credential | undefined> {
+    return this.load()[providerId];
+  }
+
+  async list(): Promise<readonly CredentialInfo[]> {
+    return Object.entries(this.load()).map(([providerId, credential]) => ({
+      providerId,
+      type: credential.type,
+    }));
+  }
+
+  modify(
+    providerId: string,
+    fn: (current: Credential | undefined) => Promise<Credential | undefined>,
+  ): Promise<Credential | undefined> {
+    return this.enqueue(providerId, async () => {
+      const file = { ...this.load() };
+      const next = await fn(file[providerId]);
+      if (next === undefined) return file[providerId];
+      file[providerId] = next;
+      this.save(file);
+      return next;
+    });
+  }
+
+  delete(providerId: string): Promise<void> {
+    return this.enqueue(providerId, async () => {
+      const file = { ...this.load() };
+      if (file[providerId] === undefined) return;
+      delete file[providerId];
+      this.save(file);
+    });
+  }
+
+  peek(providerId: string): Credential | undefined {
+    return this.load()[providerId];
+  }
+}
+
+function readJsonObject(path: string): Record<string, unknown> {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>;
+    }
+  } catch {
+    /* missing or invalid */
+  }
+  return {};
+}
+
+function parseExpiry(rec: Record<string, unknown>): number {
+  for (const n of [rec.expires, rec.expiresAt, rec.expires_at]) {
+    if (typeof n === "number" && Number.isFinite(n) && n > 0) {
+      return n > 1e12 ? n : n * 1000;
+    }
+    if (typeof n === "string" && n.trim()) {
+      const t = Date.parse(n);
+      if (!Number.isNaN(t)) return t;
+    }
+  }
+  return Date.now() + 3600_000;
+}
+
+function asCredential(raw: unknown): Credential | undefined {
+  if (!raw || typeof raw !== "object") return undefined;
+  const rec = raw as Record<string, unknown>;
+  if (rec.type === "api_key" && typeof rec.key === "string") {
+    return rec as Credential;
+  }
+  if (rec.type === "oauth" && typeof rec.access === "string") {
+    const typed = rec as OAuthCredential;
+    const expires = parseExpiry(rec);
+    if (expires !== typed.expires) {
+      return { ...typed, expires };
+    }
+    return typed;
+  }
+  const grokCliKey =
+    typeof rec.key === "string" &&
+    rec.key &&
+    (typeof rec.refresh_token === "string" ||
+      typeof rec.refresh === "string" ||
+      rec.auth_mode === "oidc");
+  const access =
+    (typeof rec.access === "string" && rec.access) ||
+    (typeof rec.accessToken === "string" && rec.accessToken) ||
+    (typeof rec.access_token === "string" && rec.access_token) ||
+    (grokCliKey ? rec.key : "") ||
+    "";
+  if (!access) return undefined;
+  const refresh =
+    (typeof rec.refresh === "string" && rec.refresh) ||
+    (typeof rec.refreshToken === "string" && rec.refreshToken) ||
+    (typeof rec.refresh_token === "string" && rec.refresh_token) ||
+    "";
+  const cred: OAuthCredential = {
+    type: "oauth",
+    access,
+    refresh,
+    expires: parseExpiry(rec),
+  };
+  if (typeof rec.accountId === "string") cred.accountId = rec.accountId;
+  if (Array.isArray(rec.availableModelIds)) {
+    cred.availableModelIds = rec.availableModelIds.filter(
+      (item): item is string => typeof item === "string",
+    );
+  }
+  return cred;
+}
+
+export function oauthCredentialFromUnknown(raw: unknown): Credential | undefined {
+  return asCredential(raw);
+}
+
+export function xaiFromGrokAuthFile(
+  raw: unknown,
+): OAuthCredential | undefined {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const rec = raw as Record<string, unknown>;
+  const direct = asCredential(rec);
+  if (direct?.type === "oauth") return direct;
+  for (const [key, value] of Object.entries(rec)) {
+    if (
+      !key.includes("auth.x.ai") &&
+      !(
+        value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        ("refresh_token" in value || "key" in value)
+      )
+    ) {
+      continue;
+    }
+    const cred = asCredential(value);
+    if (cred?.type === "oauth") return cred;
+  }
+  return undefined;
+}
+
+function takeBetterOAuth(
+  current: Credential | undefined,
+  incoming: Credential | undefined,
+): Credential | undefined {
+  if (!incoming || incoming.type !== "oauth") return current;
+  if (!current || current.type !== "oauth") return incoming;
+  const now = Date.now();
+  const incomingOk = incoming.expires > now;
+  const currentOk = current.expires > now;
+  if (incomingOk && !currentOk) return incoming;
+  if (incoming.expires > current.expires + 5000) return incoming;
+  return current;
+}
+
+function hydrateAuthFile(
+  path: string,
+  seedPaths: string[],
+): Record<string, Credential> {
+  const file: Record<string, Credential> = {};
+  const incoming = readJsonObject(path);
+  let dirty = false;
+  for (const [id, raw] of Object.entries(incoming)) {
+    const cred = asCredential(raw);
+    if (!cred) continue;
+    file[id] = cred;
+    if (!(raw && typeof raw === "object" && (raw as { type?: string }).type)) {
+      dirty = true;
+    }
+  }
+  for (const seed of seedPaths) {
+    const extra = readJsonObject(seed);
+    for (const id of CATALOG_IDS) {
+      const cred = asCredential(extra[id]);
+      if (!cred || cred.type !== "oauth") continue;
+      const better = takeBetterOAuth(file[id], cred);
+      if (better && better !== file[id]) {
+        file[id] = better;
+        dirty = true;
+      }
+    }
+    const grokXai = xaiFromGrokAuthFile(extra);
+    if (grokXai) {
+      const better = takeBetterOAuth(file.xai, grokXai);
+      if (better && better !== file.xai) {
+        file.xai = better;
+        dirty = true;
+      }
+    }
+  }
+  if (dirty) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+  }
+  return file;
+}
+
+const modelsByDir = new Map<string, MutableModels>();
+const storesByDir = new Map<string, FileCredentialStore>();
+let providerCache: ReturnType<typeof builtinProviders> | undefined;
+
+/** SuperGrok / X Premium+ is billed on the Grok CLI proxy, not api.x.ai. */
+export const GROK_CLI_PROXY = "https://cli-chat-proxy.grok.com/v1";
+
+function grokCliVersion(): string {
+  try {
+    const raw = JSON.parse(
+      readFileSync(join(homedir(), ".grok", "version.json"), "utf8"),
+    ) as { version?: string };
+    if (typeof raw.version === "string" && raw.version.trim()) {
+      return raw.version.trim();
+    }
+  } catch {
+    /* ignore */
+  }
+  return "1.0.5";
+}
+
+export function grokCliHeaders(): Record<string, string> {
+  const version = grokCliVersion();
+  return {
+    "X-XAI-Token-Auth": "xai-grok-cli",
+    "x-grok-client-identifier": "grok-shell",
+    "x-grok-client-version": version,
+    "User-Agent": `xai-grok-cli/${version}`,
+  };
+}
+
+function withGrokSubscriptionProxy<T extends { id: string }>(
+  provider: T,
+): T {
+  if (provider.id !== "xai") return provider;
+  const stock = provider as T & {
+    baseUrl?: string;
+    headers?: Record<string, string>;
+    getModels?: () => readonly { baseUrl?: string; headers?: Record<string, string> }[];
+  };
+  const headers = grokCliHeaders();
+  const originalGetModels = stock.getModels?.bind(stock);
+  return {
+    ...stock,
+    name: "xAI Grok",
+    baseUrl: GROK_CLI_PROXY,
+    headers: { ...stock.headers, ...headers },
+    getModels() {
+      const models = originalGetModels ? originalGetModels() : [];
+      return models.map((model) => ({
+        ...model,
+        baseUrl: GROK_CLI_PROXY,
+        headers: { ...headers, ...(model.headers ?? {}) },
+      }));
+    },
+  };
+}
+
+function catalogProviders() {
+  if (!providerCache) providerCache = builtinProviders();
+  return CATALOG_IDS.map((id) => providerCache!.find((p) => p.id === id))
+    .filter((p): p is NonNullable<typeof p> => Boolean(p))
+    .map((p) => withGrokSubscriptionProxy(p));
+}
+
+function oauthSeedPaths(dataDir: string): string[] {
+  if (resolve(dataDir) !== resolve(defaultDataDir())) return [];
+  return [
+    join(homedir(), ".pi", "agent", "auth.json"),
+    join(homedir(), ".dsh", "pi-ai-oauth.json"),
+    join(homedir(), ".grok", "auth.json"),
+  ];
+}
+
+function getStore(dataDir: string): FileCredentialStore {
+  const existing = storesByDir.get(dataDir);
+  if (existing) return existing;
+  const store = new FileCredentialStore(oauthPath(dataDir), oauthSeedPaths(dataDir));
+  storesByDir.set(dataDir, store);
+  return store;
+}
+
+function piModels(dataDir: string): MutableModels {
+  const hit = modelsByDir.get(dataDir);
+  if (hit) return hit;
+  const models = createModels({ credentials: getStore(dataDir) });
+  for (const provider of catalogProviders()) models.setProvider(provider);
+  modelsByDir.set(dataDir, models);
+  return models;
+}
+
+function copilotAllowedIds(dataDir: string): string[] | undefined {
+  const cred = getStore(dataDir).peek("github-copilot");
+  if (cred?.type !== "oauth") return undefined;
+  if (!Array.isArray(cred.availableModelIds)) return undefined;
+  return cred.availableModelIds.filter((item) => typeof item === "string");
+}
+
+function storedModelIds(dataDir: string, id: string): string[] | undefined {
+  const cred = getStore(dataDir).peek(id);
+  if (cred?.type !== "oauth" || !Array.isArray(cred.availableModelIds)) {
+    return undefined;
+  }
+  return cred.availableModelIds.filter((item) => typeof item === "string");
+}
+
+function catalogModels(id: string, dataDir: string): ModelEntryLite[] {
+  if (id === "github-copilot" && copilotAutoOnly(dataDir)) {
+    return [{ id: "auto", name: "Auto" }];
+  }
+  if (id === "radius") {
+    try {
+      const live = piModels(dataDir).getModels("radius");
+      if (live.length) {
+        return live.map((model) => ({
+          id: model.id,
+          name: model.name || model.id,
+        }));
+      }
+    } catch {
+      /* catalog not ready */
+    }
+    const stored = storedModelIds(dataDir, "radius");
+    if (stored?.length) {
+      return stored.map((modelId) => ({ id: modelId, name: modelId }));
+    }
+    if (oauthUsable(dataDir, "radius")) void refreshRadiusCatalog(dataDir);
+    return [];
+  }
+  try {
+    const models = piModels(dataDir).getModels(id);
+    const allowed = id === "github-copilot" ? copilotAllowedIds(dataDir) : undefined;
+    const kept = allowed ? models.filter((model) => allowed.includes(model.id)) : models;
+    if (kept.length) {
+      return kept.map((model) => ({
+        id: model.id,
+        name: model.name || model.id,
+      }));
+    }
+  } catch {
+    /* catalog not ready */
+  }
+  return [];
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+function copilotSkuFromToken(token: string): string | undefined {
+  const match = token.match(/(?:^|;)sku=([^;]+)/);
+  return match?.[1];
+}
+
+/** Free / Student Copilot may only use auto model selection. */
+export function isCopilotAutoOnlySku(sku?: string): boolean {
+  if (!sku) return false;
+  const key = sku.toLowerCase();
+  if (/(?:^|_)(?:pro|business|enterprise|max)(?:_|$)/.test(key) && !/free/.test(key)) {
+    return false;
+  }
+  return /free|student|edu/.test(key);
+}
+
+function copilotPeekSku(dataDir: string): string | undefined {
+  const cred = getStore(dataDir).peek("github-copilot");
+  if (cred?.type !== "oauth") return undefined;
+  return copilotSkuFromToken(cred.access);
+}
+
+function copilotAutoOnly(dataDir: string): boolean {
+  return isCopilotAutoOnlySku(copilotPeekSku(dataDir));
+}
+
+function copilotSkuAllowsModel(
+  item: Record<string, unknown>,
+  sku?: string,
+): boolean {
+  const billing = asRecord(item.billing);
+  const restricted = billing?.restricted_to;
+  if (!Array.isArray(restricted) || !restricted.length) return true;
+  if (!sku) return true;
+  return restricted.includes(sku);
+}
+
+export function parseCopilotPickerIds(
+  raw: unknown,
+  allowPolicyFallback: boolean,
+  sku?: string,
+): string[] {
+  const data = asRecord(raw)?.data;
+  if (!Array.isArray(data)) return [];
+  const pickerIds: string[] = [];
+  const policyEnabledIds: string[] = [];
+  for (const rawItem of data) {
+    const item = asRecord(rawItem);
+    const id = item?.id;
+    if (!item || typeof id !== "string") continue;
+    const capabilities = asRecord(item.capabilities);
+    const supports = asRecord(capabilities?.supports);
+    if (supports?.tool_calls === false) continue;
+    if (!copilotSkuAllowsModel(item, sku)) continue;
+    const policy = asRecord(item.policy);
+    if (item.model_picker_enabled === true && policy?.state !== "disabled") {
+      pickerIds.push(id);
+    }
+    if (policy?.state === "enabled") policyEnabledIds.push(id);
+  }
+  return pickerIds.length > 0 || !allowPolicyFallback ? pickerIds : policyEnabledIds;
+}
+
+const copilotCatalogAt = new Map<string, number>();
+const COPILOT_CATALOG_TTL_MS = 30_000;
+const COPILOT_API_VERSION = "2026-06-01";
+
+/** IDE headers Copilot requires. Missing X-GitHub-Api-Version looks like a named-model 400. */
+export function copilotIdeHeaders(sessionToken?: string): Record<string, string> {
+  return {
+    "User-Agent": "GitHubCopilotChat/0.35.0",
+    "Editor-Version": "vscode/1.107.0",
+    "Editor-Plugin-Version": "copilot-chat/0.35.0",
+    "Copilot-Integration-Id": "vscode-chat",
+    "X-GitHub-Api-Version": COPILOT_API_VERSION,
+    ...(sessionToken ? { "Copilot-Session-Token": sessionToken } : {}),
+  };
+}
+
+function copilotAuthHeaders(token: string, sessionToken?: string): Record<string, string> {
+  return {
+    Accept: "application/json",
+    Authorization: `Bearer ${token}`,
+    ...copilotIdeHeaders(sessionToken),
+  };
+}
+
+/** Refresh github-copilot availableModelIds from Copilot's picker, not the full catalog. */
+export async function refreshCopilotCatalog(dataDir: string): Promise<void> {
+  const store = getStore(dataDir);
+  const cred = store.peek("github-copilot");
+  if (cred?.type !== "oauth") return;
+  const prev = copilotCatalogAt.get(dataDir) ?? 0;
+  if (
+    Date.now() - prev < COPILOT_CATALOG_TTL_MS &&
+    Array.isArray(cred.availableModelIds)
+  ) {
+    return;
+  }
+  try {
+    const resolved = await piModels(dataDir).getAuth("github-copilot");
+    const token = resolved?.auth.apiKey;
+    const baseUrl = (resolved?.auth.baseUrl || "").replace(/\/+$/, "");
+    if (!token || !baseUrl) return;
+    const response = await fetch(`${baseUrl}/models`, {
+      headers: copilotAuthHeaders(token),
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok) return;
+    const ids = parseCopilotPickerIds(
+      await response.json(),
+      baseUrl.includes("api.individual.githubcopilot.com"),
+      copilotSkuFromToken(token),
+    );
+    await store.modify("github-copilot", async (current) => {
+      if (current?.type !== "oauth") return current;
+      return { ...current, availableModelIds: ids };
+    });
+    copilotCatalogAt.set(dataDir, Date.now());
+  } catch {
+    /* keep the last stored list */
+  }
+}
+
+const radiusCatalogAt = new Map<string, number>();
+const RADIUS_CATALOG_TTL_MS = 60_000;
+
+async function refreshRadiusCatalog(
+  dataDir: string,
+  force = false,
+): Promise<void> {
+  const store = getStore(dataDir);
+  const cred = store.peek("radius");
+  if (cred?.type !== "oauth") return;
+  const prev = radiusCatalogAt.get(dataDir) ?? 0;
+  const live = piModels(dataDir).getModels("radius");
+  if (
+    !force &&
+    Date.now() - prev < RADIUS_CATALOG_TTL_MS &&
+    live.length
+  ) {
+    return;
+  }
+  try {
+    const models = piModels(dataDir);
+    await models.refresh({
+      providers: ["radius"],
+      allowNetwork: true,
+      force: true,
+    });
+    const ids = models
+      .getModels("radius")
+      .map((model) => model.id)
+      .filter((item) => item.length > 0);
+    if (ids.length) {
+      await store.modify("radius", async (current) => {
+        if (current?.type !== "oauth") return current;
+        return { ...current, availableModelIds: ids };
+      });
+    }
+    radiusCatalogAt.set(dataDir, Date.now());
+  } catch {
+    /* keep the last stored list */
+  }
+}
+
+type CopilotAutoSession = {
+  selectedModel: string;
+  sessionToken: string;
+};
+
+async function openCopilotAutoSession(dataDir: string): Promise<CopilotAutoSession> {
+  const resolved = await piModels(dataDir).getAuth("github-copilot");
+  const token = resolved?.auth.apiKey;
+  const baseUrl = (resolved?.auth.baseUrl || "").replace(/\/+$/, "");
+  if (!token || !baseUrl) {
+    throw new Error("GitHub Copilot is not logged in");
+  }
+  const response = await fetch(`${baseUrl}/models/session`, {
+    method: "POST",
+    headers: {
+      ...copilotAuthHeaders(token),
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ auto_mode: { enabled: true } }),
+    signal: AbortSignal.timeout(8000),
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(
+      text || "GitHub Copilot Auto 無法開 session。免費／學生方案只能走 Auto。",
+    );
+  }
+  const body = asRecord(await response.json());
+  const selected =
+    typeof body?.selected_model === "string" ? body.selected_model : "";
+  const sessionToken =
+    typeof body?.session_token === "string" ? body.session_token : "";
+  if (!selected || !sessionToken) {
+    throw new Error("GitHub Copilot Auto 沒有可用模型。");
+  }
+  return { selectedModel: selected, sessionToken };
+}
+
+function copilotModelForId(
+  models: MutableModels,
+  id: string,
+): ReturnType<MutableModels["getModel"]> {
+  const exact = models.getModel("github-copilot", id);
+  if (exact) return exact;
+  const template = models
+    .getModels("github-copilot")
+    .find((model) => model.api === "openai-responses");
+  if (!template) return undefined;
+  return { ...template, id, name: id };
+}
+
+export type OAuthStatus = {
+  id: string;
+  pickerId: string;
+  name: string;
+  hint: string;
+  loginHint?: string;
+  flow: SubscriptionFlow;
+  connected: boolean;
+  pending: boolean;
+  ready: boolean;
+  kind: "oauth";
+  models: ModelEntryLite[];
+  userCode?: string;
+  verificationUri?: string;
+  importHint?: string | null;
+  error?: string;
+};
+
+type LoginWatch = {
+  provider: string;
+  status: "waiting" | "ok" | "error";
+  detail?: string;
+  openUrl?: string;
+  userCode?: string;
+  flow: SubscriptionFlow;
+  resolvePrompt?: (value: string) => void;
+};
+
+const watches = new Map<string, LoginWatch>();
+
+function importHintFor(id: string): string | null {
+  const pi = join(homedir(), ".pi", "agent", "auth.json");
+  const grok = join(homedir(), ".grok", "auth.json");
+  const dsh = join(homedir(), ".dsh", "pi-ai-oauth.json");
+  try {
+    if (asCredential(readJsonObject(pi)[id])) return "偵測到 ~/.pi/agent/auth.json";
+  } catch {
+    /* ignore */
+  }
+  if (id === "xai") {
+    try {
+      if (xaiFromGrokAuthFile(readJsonObject(grok))) {
+        return "偵測到 ~/.grok/auth.json";
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  try {
+    if (asCredential(readJsonObject(dsh)[id])) return "偵測到 ~/.dsh/pi-ai-oauth.json";
+  } catch {
+    /* ignore */
+  }
+  return null;
+}
+
+function hasOAuth(dataDir: string, id: string): boolean {
+  const cred = getStore(dataDir).peek(id);
+  return Boolean(cred && cred.type === "oauth" && cred.access);
+}
+
+function oauthUsable(dataDir: string, id: string): boolean {
+  const cred = getStore(dataDir).peek(id);
+  if (!cred || cred.type !== "oauth" || !cred.access) return false;
+  if (Date.now() < cred.expires) return true;
+  return Boolean(cred.refresh);
+}
+
+export function storedAccessToken(dataDir: string, id: string): string | null {
+  const cred = getStore(dataDir).peek(id);
+  if (cred?.type === "oauth" && cred.access) return cred.access;
+  return null;
+}
+
+export function oauthStatus(dataDir: string, id: string): OAuthStatus {
+  const def = subscriptionById(id);
+  if (!def) throw new StoreError(400, `unknown subscription ${id}`);
+  const watch = watches.get(id);
+  const connected = hasOAuth(dataDir, id);
+  const ready = oauthUsable(dataDir, id);
+  const provider = catalogProviders().find((p) => p.id === id);
+  return {
+    id: def.id,
+    pickerId: def.pickerId,
+    name: provider?.name || def.name,
+    hint: def.hint,
+    loginHint: def.loginHint,
+    flow: def.flow,
+    kind: "oauth",
+    connected,
+    pending: watch?.status === "waiting",
+    ready,
+    models: catalogModels(id, dataDir),
+    userCode: watch?.userCode,
+    verificationUri: watch?.openUrl,
+    importHint: importHintFor(id),
+    error: watch?.status === "error" ? watch.detail : undefined,
+  };
+}
+
+export function listSubscriptions(dataDir: string): OAuthStatus[] {
+  return SUBSCRIPTIONS.map((def) => oauthStatus(dataDir, def.id));
+}
+
+function pickSelectOption(
+  provider: string,
+  options: readonly { id: string; label: string; description?: string }[],
+): { id: string; label: string } {
+  const byId = (id: string) => options.find((option) => option.id === id);
+  if (provider === "openai-codex") {
+    const device = byId("device_code");
+    if (device) return device;
+  }
+  const headless = options.find((option) =>
+    /device[_-]?code|headless|cli/i.test(
+      `${option.id} ${option.label} ${option.description ?? ""}`,
+    ),
+  );
+  if (headless) return headless;
+  return options[0]!;
+}
+
+function answerOptionalText(
+  provider: string,
+  prompt: AuthPrompt,
+): string | undefined {
+  if (prompt.type !== "text") return undefined;
+  const blob = `${prompt.message} ${prompt.placeholder ?? ""}`.toLowerCase();
+  if (
+    provider === "github-copilot" ||
+    /enterprise|blank for github\.com|github\.com/i.test(blob)
+  ) {
+    return "";
+  }
+  if (/\bblank\b|\boptional\b|\bleave empty\b|\(empty\)/i.test(blob)) {
+    return "";
+  }
+  return undefined;
+}
+
+function waitForPaste(watch: LoginWatch, signal?: AbortSignal): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const finish = (value: string) => {
+      watch.resolvePrompt = undefined;
+      signal?.removeEventListener("abort", onAbort);
+      resolve(value);
+    };
+    const onAbort = () => {
+      watch.resolvePrompt = undefined;
+      reject(new Error("Login cancelled"));
+    };
+    watch.resolvePrompt = finish;
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+  });
+}
+
+export async function startLogin(dataDir: string, id: string): Promise<OAuthStatus> {
+  const def = subscriptionById(id);
+  if (!def) throw new StoreError(400, `unknown subscription ${id}`);
+  const existing = watches.get(id);
+  if (existing?.status === "waiting") return oauthStatus(dataDir, id);
+
+  const models = piModels(dataDir);
+  if (!models.getProvider(id)) {
+    throw new StoreError(400, `unknown subscription ${id}`);
+  }
+
+  const watch: LoginWatch = {
+    provider: id,
+    status: "waiting",
+    flow: def.flow,
+  };
+  watches.set(id, watch);
+
+  let released = false;
+  let release!: (error?: Error) => void;
+  const firstNotice = new Promise<void>((resolve, reject) => {
+    release = (error?: Error) => {
+      if (released) return;
+      released = true;
+      if (error) reject(error);
+      else resolve();
+    };
+  });
+
+  const interaction: AuthInteraction = {
+    async prompt(prompt) {
+      if (prompt.type === "select" && prompt.options.length > 0) {
+        return pickSelectOption(id, prompt.options).id;
+      }
+      const optional = answerOptionalText(id, prompt);
+      if (optional !== undefined) return optional;
+      if (prompt.type === "manual_code" || prompt.type === "text") {
+        return waitForPaste(watch, prompt.signal);
+      }
+      throw new Error(
+        `Interactive prompt required (${prompt.type}: ${prompt.message}). ` +
+          "Paste the redirect URL on the settings page.",
+      );
+    },
+    notify(event: AuthEvent) {
+      if (event.type === "auth_url") watch.openUrl = event.url;
+      if (event.type === "device_code") {
+        watch.openUrl = event.verificationUri;
+        watch.userCode = event.userCode;
+      }
+      if (event.type === "device_code" || event.type === "auth_url") release();
+    },
+  };
+
+  const finished = models.login(id, "oauth", interaction).then(
+    async () => {
+      if (id === "radius") await refreshRadiusCatalog(dataDir, true);
+      watch.status = "ok";
+      watch.detail = `Logged in to ${id}`;
+    },
+    (error: unknown) => {
+      watch.status = "error";
+      watch.detail = error instanceof Error ? error.message : String(error);
+      release(error instanceof Error ? error : new Error(watch.detail));
+    },
+  );
+  void finished;
+
+  try {
+    await firstNotice;
+  } catch (error) {
+    throw new StoreError(
+      502,
+      error instanceof Error ? error.message : String(error),
+    );
+  }
+  return oauthStatus(dataDir, id);
+}
+
+export async function pollLogin(dataDir: string, id: string): Promise<OAuthStatus> {
+  const def = subscriptionById(id);
+  if (!def) throw new StoreError(400, `unknown subscription ${id}`);
+  const watch = watches.get(id);
+  if (watch?.status === "error") {
+    return { ...oauthStatus(dataDir, id), error: watch.detail };
+  }
+  return oauthStatus(dataDir, id);
+}
+
+export async function completeLogin(
+  dataDir: string,
+  id: string,
+  input: { code?: string; url?: string },
+): Promise<OAuthStatus> {
+  const watch = watches.get(id);
+  const value = (input.url || input.code || "").trim();
+  if (!watch?.resolvePrompt) {
+    throw new StoreError(400, "no pending browser login");
+  }
+  if (!value) throw new StoreError(400, "missing authorization code");
+  watch.resolvePrompt(value);
+  for (let i = 0; i < 20; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 250));
+    if (watch.status !== "waiting") break;
+  }
+  return oauthStatus(dataDir, id);
+}
+
+export async function logoutOAuth(dataDir: string, id: string): Promise<OAuthStatus> {
+  const def = subscriptionById(id);
+  if (!def) throw new StoreError(400, `unknown subscription ${id}`);
+  watches.delete(id);
+  await piModels(dataDir).logout(id);
+  return oauthStatus(dataDir, id);
+}
+
+export function formatOAuthError(provider: string, message?: string): string {
+  const text = (message ?? "").trim();
+  if (
+    /^模型請求/.test(text) ||
+    text.includes("不是訂閱失效") ||
+    text.includes("登入已失效") ||
+    text.includes("這個 GitHub Copilot 帳號不支援")
+  ) {
+    return text.replace(/^模型請求失敗：/, "");
+  }
+  if (/terminated|timed?\s*out|timeout|aborted/i.test(text)) {
+    return "模型請求逾時，多半是思考或工具跑太久，不是訂閱失效。再送一次即可。";
+  }
+  if (/401|unauthorized|invalid.?token|not logged in/i.test(text)) {
+    return "登入已失效，請到模型頁重新連接。";
+  }
+  if (
+    (provider === "github-copilot" || /github/.test(provider)) &&
+    /model_not_supported|not supported/i.test(text)
+  ) {
+    return "這個 GitHub Copilot 帳號不支援指定模型。免費／學生方案只能用 Auto，到模型頁選 Auto。";
+  }
+  if (provider === "xai" && /426|outdated/i.test(text)) {
+    return "Grok CLI 被判定過舊。請執行 grok update。";
+  }
+  if (
+    provider === "xai" &&
+    /402|credits|Grok subscription|spending-limit/i.test(text)
+  ) {
+    return (
+      "Grok 訂閱走 grok.com CLI（SuperGrok / X Premium+），不是 console.x.ai 的 API 點數。" +
+      (text ? ` 原文：${text}` : "")
+    );
+  }
+  return text ? `模型請求失敗：${text}` : "模型請求失敗";
+}
+
+/** ChatGPT Codex and Copilot reasoning/Auto reject `temperature`. */
+export function oauthOmitsTemperature(input: {
+  provider: string;
+  modelReasoning?: boolean;
+  copilotSession?: boolean;
+}): boolean {
+  if (input.copilotSession) return true;
+  if (input.provider === "openai-codex") return true;
+  if (input.provider === "github-copilot" && input.modelReasoning) return true;
+  return false;
+}
+
+function thinkingText(message: AssistantMessage | undefined): string {
+  if (!message) return "";
+  return message.content
+    .filter(
+      (part): part is Extract<typeof part, { type: "thinking" }> =>
+        part.type === "thinking",
+    )
+    .map((part) => part.thinking)
+    .join("\n")
+    .trim();
+}
+
+/**
+ * Codex `DEFAULT_STREAM_IDLE_TIMEOUT_MS`. No tokens on the stream — not a
+ * wall clock on the whole turn. Do not pass this as Pi `timeoutMs` for xAI:
+ * OpenAI-completions maps that to the SDK request timeout and kills thinking.
+ */
+export const STREAM_IDLE_TIMEOUT_MS = 300_000;
+
+export class StreamIdleError extends Error {
+  readonly idleMs: number;
+  constructor(idleMs: number) {
+    super(
+      `stream idle: no tokens for ${Math.round(idleMs / 1000)}s (Codex-style; not a turn wall clock). Resend or switch models.`,
+    );
+    this.name = "StreamIdleError";
+    this.idleMs = idleMs;
+  }
+}
+
+export function startStreamIdle(
+  idleMs: number,
+  parent?: AbortSignal,
+): {
+  signal: AbortSignal;
+  bump: () => void;
+  dispose: () => void;
+  timedOut: () => boolean;
+} {
+  const ctrl = new AbortController();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let timedOut = false;
+  const fire = () => {
+    if (timedOut || ctrl.signal.aborted) return;
+    timedOut = true;
+    ctrl.abort();
+  };
+  const bump = () => {
+    if (timedOut || parent?.aborted) return;
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(fire, idleMs);
+  };
+  const onParent = () => {
+    if (timer) clearTimeout(timer);
+    ctrl.abort();
+  };
+  if (parent?.aborted) {
+    ctrl.abort();
+  } else {
+    parent?.addEventListener("abort", onParent, { once: true });
+  }
+  bump();
+  return {
+    signal: ctrl.signal,
+    bump,
+    dispose: () => {
+      if (timer) clearTimeout(timer);
+      parent?.removeEventListener("abort", onParent);
+    },
+    timedOut: () => timedOut,
+  };
+}
+
+function userAborted(signal?: AbortSignal): Error {
+  const err = new Error("aborted");
+  err.name = "AbortError";
+  return err;
+}
+
+/** Pi streamSimple: Think chips only from thinking_delta, not a planted placeholder. */
+async function streamOAuthMessage(
+  models: MutableModels,
+  model: Model,
+  context: Parameters<MutableModels["streamSimple"]>[1],
+  options: Parameters<MutableModels["streamSimple"]>[2],
+  toolCtx: ToolContext,
+  traces: ToolTrace[],
+): Promise<AssistantMessage> {
+  const idle = startStreamIdle(STREAM_IDLE_TIMEOUT_MS, options?.signal);
+  const stream = models.streamSimple(model, context, {
+    ...options,
+    signal: idle.signal,
+  });
+  let lastEmit = 0;
+  const flush = (partial: AssistantMessage | undefined, force: boolean) => {
+    const think = thinkingText(partial);
+    if (!think) return;
+    const now = Date.now();
+    if (!force && now - lastEmit < 120) return;
+    lastEmit = now;
+    emitProgress(toolCtx, traces, think);
+  };
+  const failIfIdle = (): never => {
+    if (options?.signal?.aborted) throw userAborted(options.signal);
+    throw new StreamIdleError(STREAM_IDLE_TIMEOUT_MS);
+  };
+  try {
+    for await (const event of stream) {
+      idle.bump();
+      if (event.type === "thinking_start" || event.type === "thinking_delta") {
+        flush(event.partial, event.type === "thinking_start");
+      } else if (event.type === "thinking_end") {
+        flush(event.partial, true);
+      } else if (event.type === "done") {
+        flush(event.message, true);
+        return event.message;
+      } else if (event.type === "error") {
+        if (idle.timedOut() || options?.signal?.aborted) failIfIdle();
+        return event.error;
+      }
+    }
+    if (idle.timedOut() || options?.signal?.aborted) failIfIdle();
+    return stream.result();
+  } catch (err) {
+    if (err instanceof StreamIdleError) throw err;
+    if (err instanceof Error && err.name === "AbortError") {
+      if (options?.signal?.aborted) throw err;
+      if (idle.timedOut()) throw new StreamIdleError(STREAM_IDLE_TIMEOUT_MS);
+    }
+    if (idle.timedOut() && !(options?.signal?.aborted)) {
+      throw new StreamIdleError(STREAM_IDLE_TIMEOUT_MS);
+    }
+    throw err;
+  } finally {
+    idle.dispose();
+  }
+}
+
+function abortWhen(signal?: AbortSignal): Promise<never> {
+  return new Promise((_, reject) => {
+    const fail = () => {
+      const err = new Error("aborted");
+      err.name = "AbortError";
+      reject(err);
+    };
+    if (!signal) return;
+    if (signal.aborted) {
+      fail();
+      return;
+    }
+    signal.addEventListener("abort", fail, { once: true });
+  });
+}
+
+export async function completeOAuth(input: {
+  dataDir: string;
+  pickerId: string;
+  model: string;
+  system: string;
+  messages: { role: "user" | "assistant"; content: string }[];
+  temperature?: number;
+  reasoning?: "minimal" | "low" | "medium" | "high";
+  tools?: boolean;
+  skills?: SkillRef[];
+  toolCtx?: ToolContext;
+}): Promise<{
+  text: string;
+  provider: string;
+  model: string;
+  traces: ToolTrace[];
+  thinking: string;
+  usage: ChatUsage;
+}> {
+  const sub = subscriptionByPicker(input.pickerId);
+  if (!sub) throw new Error(`unknown oauth provider ${input.pickerId}`);
+  const models = piModels(input.dataDir);
+  let modelId = input.model;
+  let copilotSessionToken = "";
+  if (sub.id === "radius") {
+    await refreshRadiusCatalog(input.dataDir, true);
+  }
+  if (sub.id === "github-copilot") {
+    await refreshCopilotCatalog(input.dataDir);
+    const autoOnly = copilotAutoOnly(input.dataDir);
+    if (autoOnly || modelId === "auto") {
+      const session = await openCopilotAutoSession(input.dataDir);
+      modelId = session.selectedModel;
+      copilotSessionToken = session.sessionToken;
+    } else {
+      const allowed = copilotAllowedIds(input.dataDir);
+      if (allowed && !allowed.includes(modelId)) {
+        throw new Error(
+          `這個 GitHub Copilot 帳號不支援 ${modelId}。免費／學生方案請選 Auto。`,
+        );
+      }
+    }
+  }
+  const model =
+    sub.id === "github-copilot"
+      ? copilotModelForId(models, modelId)
+      : models.getModel(sub.id, modelId);
+  if (!model) throw new Error(`${sub.id} has no model ${modelId}`);
+  const auth = await models.checkAuth(sub.id);
+  if (!auth) {
+    throw new Error(`${sub.name} is not logged in`);
+  }
+  const now = Date.now();
+  const transcript: Message[] = input.messages.map((item) =>
+    item.role === "user"
+      ? { role: "user" as const, content: item.content, timestamp: now }
+      : stubAssistant(model, item.content, now),
+  );
+  const useTools = Boolean(input.tools);
+  const omitTemperature = oauthOmitsTemperature({
+    provider: sub.id,
+    modelReasoning: Boolean(model.reasoning),
+    copilotSession: Boolean(copilotSessionToken),
+  });
+  const options: {
+    temperature?: number;
+    reasoning?: "minimal" | "low" | "medium" | "high";
+    signal?: AbortSignal;
+    transformHeaders?: (
+      headers: Record<string, string | null>,
+    ) => Record<string, string | null>;
+    onPayload?: (payload: unknown) => unknown;
+  } = {
+    temperature: omitTemperature ? undefined : (input.temperature ?? 0.4),
+    reasoning: input.reasoning,
+  };
+  if (sub.id === "xai" || sub.id === "github-copilot") {
+    options.transformHeaders = (headers) => ({
+      ...headers,
+      ...(sub.id === "xai" ? grokCliHeaders() : {}),
+      ...(sub.id === "github-copilot"
+        ? copilotIdeHeaders(copilotSessionToken || undefined)
+        : {}),
+    });
+  }
+  if (omitTemperature) {
+    options.onPayload = (payload) => {
+      if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+        return payload;
+      }
+      const next = { ...(payload as Record<string, unknown>) };
+      delete next.temperature;
+      return next;
+    };
+  }
+  const traces: ToolTrace[] = [];
+  const thinkingChunks: string[] = [];
+  const usage = blankUsage();
+  usage.provider = input.pickerId;
+  usage.model = modelId;
+  const started = Date.now();
+  const finish = (text: string) => ({
+    text,
+    provider: input.pickerId,
+    model: modelId,
+    traces,
+    thinking: thinkingChunks.join("\n\n"),
+    usage: withDuration(usage, started),
+  });
+  const toolCtx: ToolContext = input.toolCtx ?? {
+    skills: input.skills,
+    dataDir: input.dataDir,
+    spawnDepth: 0,
+    allowWrite: true,
+  };
+  options.signal = roundSignal(toolCtx);
+  const tools = guildTools(input.skills ?? [], toolCtx);
+  let lastResult: AssistantMessage | null = null;
+  const looped = await runAgentLoop({
+    toolCtx,
+    traces,
+    thinkingChunks,
+    ask: async ({ wrap, steer }) => {
+      if (wrap) {
+        transcript.push({
+          role: "user",
+          content: TOOL_LOOP_WRAP,
+          timestamp: Date.now(),
+        });
+      }
+      if (steer) {
+        transcript.push({
+          role: "user",
+          content: steer,
+          timestamp: Date.now(),
+        });
+      }
+      const extra =
+        estimateSendTokens(input.system) +
+        estimateSendTokens(JSON.stringify(useTools ? tools : [])) +
+        2048;
+      const fitted = trimSendMessages(transcript, extra);
+      if (fitted.length < transcript.length) {
+        transcript.splice(0, transcript.length, ...fitted);
+      }
+      let result: AssistantMessage;
+      try {
+        result = await Promise.race([
+          streamOAuthMessage(
+            models,
+            model,
+            {
+              systemPrompt: input.system,
+              messages: transcript,
+              ...(useTools ? { tools } : {}),
+            },
+            options,
+            toolCtx,
+            traces,
+          ),
+          abortWhen(options.signal),
+        ]);
+      } catch (err) {
+        if (err instanceof StreamIdleError) {
+          return {
+            calls: [],
+            text: err.message,
+            thinking: thinkingChunks.join("\n\n"),
+          };
+        }
+        throw err;
+      }
+      if (result.stopReason === "aborted" || toolCtx.signal?.aborted || options.signal?.aborted) {
+        const err = new Error("aborted");
+        err.name = "AbortError";
+        throw err;
+      }
+      if (result.stopReason === "error") {
+        throw new Error(
+          formatOAuthError(sub.id, result.errorMessage) ||
+            `${sub.id} request failed`,
+        );
+      }
+      addUsage(usage, fromPiUsage(result.usage));
+      lastResult = result;
+      const think = thinkingText(result);
+      const calls =
+        result.stopReason === "toolUse"
+          ? result.content.filter(
+              (part): part is Extract<typeof part, { type: "toolCall" }> =>
+                part.type === "toolCall",
+            )
+          : [];
+      const text = contentText(result.content).trim();
+      if (!calls.length && !text && traces.length === 0) {
+        throw new Error(`${sub.id} returned an empty reply`);
+      }
+      return {
+        calls: calls.map((call) => ({
+          id: call.id,
+          name: call.name,
+          args: (call.arguments ?? {}) as Record<string, unknown>,
+        })),
+        text,
+        thinking: think,
+      };
+    },
+    onRetry: (late) => {
+      if (lastResult) transcript.push(lastResult);
+      transcript.push({
+        role: "user",
+        content: late,
+        timestamp: Date.now(),
+      });
+    },
+    onTools: (calls, outcomes) => {
+      if (lastResult) transcript.push(lastResult);
+      for (let i = 0; i < calls.length; i++) {
+        transcript.push({
+          role: "toolResult",
+          toolCallId: calls[i].id,
+          toolName: calls[i].name,
+          content: [{ type: "text", text: outcomes[i]?.text ?? "" }],
+          isError: outcomes[i]?.isError,
+          timestamp: Date.now(),
+        });
+      }
+    },
+  });
+  if (!looped) return finish(TOOL_LOOP_EXHAUSTED);
+  return finish(looped.text);
+}
+
+function stubAssistant(
+  model: { api: AssistantMessage["api"]; provider: string; id: string },
+  text: string,
+  timestamp: number,
+): AssistantMessage {
+  return {
+    role: "assistant",
+    content: [{ type: "text", text }],
+    api: model.api,
+    provider: model.provider,
+    model: model.id,
+    usage: {
+      input: 0,
+      output: 0,
+      cacheRead: 0,
+      cacheWrite: 0,
+      totalTokens: 0,
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+    },
+    stopReason: "stop",
+    timestamp,
+  };
+}
+
+export async function accessToken(
+  dataDir: string,
+  id: string,
+): Promise<{ accessToken: string } | null> {
+  const auth = storedAccessToken(dataDir, id);
+  if (!auth) return null;
+  const resolved = await piModels(dataDir).getAuth(id);
+  const key = resolved?.auth.apiKey;
+  if (!key) return { accessToken: auth };
+  return { accessToken: key };
+}
+
+export async function xaiAccessToken(dataDir: string): Promise<string | null> {
+  const tokens = await accessToken(dataDir, "xai");
+  return tokens?.accessToken ?? null;
+}