@mastra/code-sdk 0.0.0-esbuild-bundle-worker-20260807173433

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (491) hide show
  1. package/CHANGELOG.md +1349 -0
  2. package/LICENSE.md +30 -0
  3. package/README.md +70 -0
  4. package/dist/acp/agent.d.ts +35 -0
  5. package/dist/acp/agent.d.ts.map +1 -0
  6. package/dist/acp/agent.js +161 -0
  7. package/dist/acp/agent.js.map +1 -0
  8. package/dist/acp/event-mapper.d.ts +22 -0
  9. package/dist/acp/event-mapper.d.ts.map +1 -0
  10. package/dist/acp/event-mapper.js +214 -0
  11. package/dist/acp/event-mapper.js.map +1 -0
  12. package/dist/acp/index.d.ts +8 -0
  13. package/dist/acp/index.d.ts.map +1 -0
  14. package/dist/acp/index.js +65 -0
  15. package/dist/acp/index.js.map +1 -0
  16. package/dist/acp/server.d.ts +7 -0
  17. package/dist/acp/server.d.ts.map +1 -0
  18. package/dist/acp/server.js +35 -0
  19. package/dist/acp/server.js.map +1 -0
  20. package/dist/acp.d.ts +2 -0
  21. package/dist/acp.d.ts.map +1 -0
  22. package/dist/acp.js +2 -0
  23. package/dist/agents/credential-resolver.d.ts +51 -0
  24. package/dist/agents/credential-resolver.d.ts.map +1 -0
  25. package/dist/agents/credential-resolver.js +52 -0
  26. package/dist/agents/credential-resolver.js.map +1 -0
  27. package/dist/agents/custom-provider-source.d.ts +35 -0
  28. package/dist/agents/custom-provider-source.d.ts.map +1 -0
  29. package/dist/agents/custom-provider-source.js +25 -0
  30. package/dist/agents/custom-provider-source.js.map +1 -0
  31. package/dist/agents/instructions.d.ts +6 -0
  32. package/dist/agents/instructions.d.ts.map +1 -0
  33. package/dist/agents/instructions.js +32 -0
  34. package/dist/agents/instructions.js.map +1 -0
  35. package/dist/agents/mastracode-gateway.d.ts +74 -0
  36. package/dist/agents/mastracode-gateway.d.ts.map +1 -0
  37. package/dist/agents/mastracode-gateway.js +400 -0
  38. package/dist/agents/mastracode-gateway.js.map +1 -0
  39. package/dist/agents/memory.d.ts +13 -0
  40. package/dist/agents/memory.d.ts.map +1 -0
  41. package/dist/agents/memory.js +116 -0
  42. package/dist/agents/memory.js.map +1 -0
  43. package/dist/agents/model.d.ts +59 -0
  44. package/dist/agents/model.d.ts.map +1 -0
  45. package/dist/agents/model.js +132 -0
  46. package/dist/agents/model.js.map +1 -0
  47. package/dist/agents/modes/build.d.ts +10 -0
  48. package/dist/agents/modes/build.d.ts.map +1 -0
  49. package/dist/agents/modes/build.js +44 -0
  50. package/dist/agents/modes/build.js.map +1 -0
  51. package/dist/agents/modes/explore.d.ts +10 -0
  52. package/dist/agents/modes/explore.d.ts.map +1 -0
  53. package/dist/agents/modes/explore.js +39 -0
  54. package/dist/agents/modes/explore.js.map +1 -0
  55. package/dist/agents/modes/plan.d.ts +6 -0
  56. package/dist/agents/modes/plan.d.ts.map +1 -0
  57. package/dist/agents/modes/plan.js +37 -0
  58. package/dist/agents/modes/plan.js.map +1 -0
  59. package/dist/agents/prompts/agent-instructions.d.ts +61 -0
  60. package/dist/agents/prompts/agent-instructions.d.ts.map +1 -0
  61. package/dist/agents/prompts/agent-instructions.js +201 -0
  62. package/dist/agents/prompts/agent-instructions.js.map +1 -0
  63. package/dist/agents/prompts/build.d.ts +12 -0
  64. package/dist/agents/prompts/build.d.ts.map +1 -0
  65. package/dist/agents/prompts/build.js +76 -0
  66. package/dist/agents/prompts/build.js.map +1 -0
  67. package/dist/agents/prompts/fast.d.ts +5 -0
  68. package/dist/agents/prompts/fast.d.ts.map +1 -0
  69. package/dist/agents/prompts/fast.js +26 -0
  70. package/dist/agents/prompts/fast.js.map +1 -0
  71. package/dist/agents/prompts/index.d.ts +19 -0
  72. package/dist/agents/prompts/index.d.ts.map +1 -0
  73. package/dist/agents/prompts/index.js +65 -0
  74. package/dist/agents/prompts/index.js.map +1 -0
  75. package/dist/agents/prompts/model.d.ts +5 -0
  76. package/dist/agents/prompts/model.d.ts.map +1 -0
  77. package/dist/agents/prompts/model.js +23 -0
  78. package/dist/agents/prompts/model.js.map +1 -0
  79. package/dist/agents/prompts/plan.d.ts +6 -0
  80. package/dist/agents/prompts/plan.d.ts.map +1 -0
  81. package/dist/agents/prompts/plan.js +111 -0
  82. package/dist/agents/prompts/plan.js.map +1 -0
  83. package/dist/agents/prompts/tool-guidance.d.ts +13 -0
  84. package/dist/agents/prompts/tool-guidance.d.ts.map +1 -0
  85. package/dist/agents/prompts/tool-guidance.js +149 -0
  86. package/dist/agents/prompts/tool-guidance.js.map +1 -0
  87. package/dist/agents/sandbox-filesystem.d.ts +99 -0
  88. package/dist/agents/sandbox-filesystem.d.ts.map +1 -0
  89. package/dist/agents/sandbox-filesystem.js +328 -0
  90. package/dist/agents/sandbox-filesystem.js.map +1 -0
  91. package/dist/agents/sandbox-reattach.d.ts +19 -0
  92. package/dist/agents/sandbox-reattach.d.ts.map +1 -0
  93. package/dist/agents/sandbox-reattach.js +15 -0
  94. package/dist/agents/sandbox-reattach.js.map +1 -0
  95. package/dist/agents/thread-caveman-state.d.ts +17 -0
  96. package/dist/agents/thread-caveman-state.d.ts.map +1 -0
  97. package/dist/agents/thread-caveman-state.js +107 -0
  98. package/dist/agents/thread-caveman-state.js.map +1 -0
  99. package/dist/agents/tool-availability.d.ts +10 -0
  100. package/dist/agents/tool-availability.d.ts.map +1 -0
  101. package/dist/agents/tool-availability.js +87 -0
  102. package/dist/agents/tool-availability.js.map +1 -0
  103. package/dist/agents/tools.d.ts +19 -0
  104. package/dist/agents/tools.d.ts.map +1 -0
  105. package/dist/agents/tools.js +105 -0
  106. package/dist/agents/tools.js.map +1 -0
  107. package/dist/agents/workspace.d.ts +32 -0
  108. package/dist/agents/workspace.d.ts.map +1 -0
  109. package/dist/agents/workspace.js +251 -0
  110. package/dist/agents/workspace.js.map +1 -0
  111. package/dist/analytics.d.ts +18 -0
  112. package/dist/analytics.d.ts.map +1 -0
  113. package/dist/analytics.js +163 -0
  114. package/dist/analytics.js.map +1 -0
  115. package/dist/auth/authorization-input.d.ts +16 -0
  116. package/dist/auth/authorization-input.d.ts.map +1 -0
  117. package/dist/auth/authorization-input.js +42 -0
  118. package/dist/auth/authorization-input.js.map +1 -0
  119. package/dist/auth/device-code.d.ts +93 -0
  120. package/dist/auth/device-code.d.ts.map +1 -0
  121. package/dist/auth/device-code.js +129 -0
  122. package/dist/auth/device-code.js.map +1 -0
  123. package/dist/auth/index.d.ts +10 -0
  124. package/dist/auth/index.d.ts.map +1 -0
  125. package/dist/auth/index.js +6 -0
  126. package/dist/auth/pkce.d.ts +13 -0
  127. package/dist/auth/pkce.d.ts.map +1 -0
  128. package/dist/auth/pkce.js +32 -0
  129. package/dist/auth/pkce.js.map +1 -0
  130. package/dist/auth/providers/anthropic.d.ts +40 -0
  131. package/dist/auth/providers/anthropic.d.ts.map +1 -0
  132. package/dist/auth/providers/anthropic.js +126 -0
  133. package/dist/auth/providers/anthropic.js.map +1 -0
  134. package/dist/auth/providers/github-copilot.d.ts +154 -0
  135. package/dist/auth/providers/github-copilot.d.ts.map +1 -0
  136. package/dist/auth/providers/github-copilot.js +340 -0
  137. package/dist/auth/providers/github-copilot.js.map +1 -0
  138. package/dist/auth/providers/openai-codex.d.ts +139 -0
  139. package/dist/auth/providers/openai-codex.d.ts.map +1 -0
  140. package/dist/auth/providers/openai-codex.js +519 -0
  141. package/dist/auth/providers/openai-codex.js.map +1 -0
  142. package/dist/auth/providers/xai.d.ts +64 -0
  143. package/dist/auth/providers/xai.d.ts.map +1 -0
  144. package/dist/auth/providers/xai.js +205 -0
  145. package/dist/auth/providers/xai.js.map +1 -0
  146. package/dist/auth/storage.d.ts +91 -0
  147. package/dist/auth/storage.d.ts.map +1 -0
  148. package/dist/auth/storage.js +197 -0
  149. package/dist/auth/storage.js.map +1 -0
  150. package/dist/auth/types.d.ts +89 -0
  151. package/dist/auth/types.d.ts.map +1 -0
  152. package/dist/auth/types.js +1 -0
  153. package/dist/clipboard/index.d.ts +26 -0
  154. package/dist/clipboard/index.d.ts.map +1 -0
  155. package/dist/clipboard/index.js +226 -0
  156. package/dist/clipboard/index.js.map +1 -0
  157. package/dist/constants.d.ts +10 -0
  158. package/dist/constants.d.ts.map +1 -0
  159. package/dist/constants.js +18 -0
  160. package/dist/constants.js.map +1 -0
  161. package/dist/error-classification.d.ts +10 -0
  162. package/dist/error-classification.d.ts.map +1 -0
  163. package/dist/error-classification.js +22 -0
  164. package/dist/error-classification.js.map +1 -0
  165. package/dist/evals/context-builder.d.ts +41 -0
  166. package/dist/evals/context-builder.d.ts.map +1 -0
  167. package/dist/evals/context-builder.js +161 -0
  168. package/dist/evals/context-builder.js.map +1 -0
  169. package/dist/evals/index.d.ts +4 -0
  170. package/dist/evals/index.d.ts.map +1 -0
  171. package/dist/evals/index.js +5 -0
  172. package/dist/evals/scorers/classify-command.d.ts +31 -0
  173. package/dist/evals/scorers/classify-command.d.ts.map +1 -0
  174. package/dist/evals/scorers/classify-command.js +73 -0
  175. package/dist/evals/scorers/classify-command.js.map +1 -0
  176. package/dist/evals/scorers/efficiency.d.ts +44 -0
  177. package/dist/evals/scorers/efficiency.d.ts.map +1 -0
  178. package/dist/evals/scorers/efficiency.js +259 -0
  179. package/dist/evals/scorers/efficiency.js.map +1 -0
  180. package/dist/evals/scorers/extract-tools.d.ts +25 -0
  181. package/dist/evals/scorers/extract-tools.d.ts.map +1 -0
  182. package/dist/evals/scorers/extract-tools.js +60 -0
  183. package/dist/evals/scorers/extract-tools.js.map +1 -0
  184. package/dist/evals/scorers/index.d.ts +3 -0
  185. package/dist/evals/scorers/index.d.ts.map +1 -0
  186. package/dist/evals/scorers/index.js +3 -0
  187. package/dist/evals/scorers/outcome.d.ts +49 -0
  188. package/dist/evals/scorers/outcome.d.ts.map +1 -0
  189. package/dist/evals/scorers/outcome.js +347 -0
  190. package/dist/evals/scorers/outcome.js.map +1 -0
  191. package/dist/goal-manager.d.ts +78 -0
  192. package/dist/goal-manager.d.ts.map +1 -0
  193. package/dist/goal-manager.js +273 -0
  194. package/dist/goal-manager.js.map +1 -0
  195. package/dist/goal-signal.d.ts +14 -0
  196. package/dist/goal-signal.d.ts.map +1 -0
  197. package/dist/goal-signal.js +17 -0
  198. package/dist/goal-signal.js.map +1 -0
  199. package/dist/headless/cli.d.ts +42 -0
  200. package/dist/headless/cli.d.ts.map +1 -0
  201. package/dist/headless/cli.js +195 -0
  202. package/dist/headless/cli.js.map +1 -0
  203. package/dist/headless/flags.d.ts +33 -0
  204. package/dist/headless/flags.d.ts.map +1 -0
  205. package/dist/headless/flags.js +190 -0
  206. package/dist/headless/flags.js.map +1 -0
  207. package/dist/headless/format.d.ts +38 -0
  208. package/dist/headless/format.d.ts.map +1 -0
  209. package/dist/headless/format.js +89 -0
  210. package/dist/headless/format.js.map +1 -0
  211. package/dist/headless/index.d.ts +25 -0
  212. package/dist/headless/index.d.ts.map +1 -0
  213. package/dist/headless/index.js +6 -0
  214. package/dist/headless/policy.d.ts +17 -0
  215. package/dist/headless/policy.d.ts.map +1 -0
  216. package/dist/headless/policy.js +42 -0
  217. package/dist/headless/policy.js.map +1 -0
  218. package/dist/headless/run-mc.d.ts +7 -0
  219. package/dist/headless/run-mc.d.ts.map +1 -0
  220. package/dist/headless/run-mc.js +346 -0
  221. package/dist/headless/run-mc.js.map +1 -0
  222. package/dist/headless/types.d.ts +158 -0
  223. package/dist/headless/types.d.ts.map +1 -0
  224. package/dist/headless/types.js +18 -0
  225. package/dist/headless/types.js.map +1 -0
  226. package/dist/hooks/config.d.ts +11 -0
  227. package/dist/hooks/config.d.ts.map +1 -0
  228. package/dist/hooks/config.js +73 -0
  229. package/dist/hooks/config.js.map +1 -0
  230. package/dist/hooks/executor.d.ts +13 -0
  231. package/dist/hooks/executor.d.ts.map +1 -0
  232. package/dist/hooks/executor.js +128 -0
  233. package/dist/hooks/executor.js.map +1 -0
  234. package/dist/hooks/index.d.ts +6 -0
  235. package/dist/hooks/index.d.ts.map +1 -0
  236. package/dist/hooks/index.js +5 -0
  237. package/dist/hooks/manager.d.ts +47 -0
  238. package/dist/hooks/manager.d.ts.map +1 -0
  239. package/dist/hooks/manager.js +225 -0
  240. package/dist/hooks/manager.js.map +1 -0
  241. package/dist/hooks/types.d.ts +152 -0
  242. package/dist/hooks/types.d.ts.map +1 -0
  243. package/dist/hooks/types.js +8 -0
  244. package/dist/hooks/types.js.map +1 -0
  245. package/dist/index.d.ts +258 -0
  246. package/dist/index.d.ts.map +1 -0
  247. package/dist/index.js +740 -0
  248. package/dist/index.js.map +1 -0
  249. package/dist/ipc/ipc-reporter.d.ts +14 -0
  250. package/dist/ipc/ipc-reporter.d.ts.map +1 -0
  251. package/dist/ipc/ipc-reporter.js +21 -0
  252. package/dist/ipc/ipc-reporter.js.map +1 -0
  253. package/dist/lsp/client.d.ts +56 -0
  254. package/dist/lsp/client.d.ts.map +1 -0
  255. package/dist/lsp/client.js +251 -0
  256. package/dist/lsp/client.js.map +1 -0
  257. package/dist/lsp/index.d.ts +4 -0
  258. package/dist/lsp/index.d.ts.map +1 -0
  259. package/dist/lsp/index.js +4 -0
  260. package/dist/lsp/language.d.ts +9 -0
  261. package/dist/lsp/language.d.ts.map +1 -0
  262. package/dist/lsp/language.js +44 -0
  263. package/dist/lsp/language.js.map +1 -0
  264. package/dist/lsp/manager.d.ts +34 -0
  265. package/dist/lsp/manager.d.ts.map +1 -0
  266. package/dist/lsp/manager.js +82 -0
  267. package/dist/lsp/manager.js.map +1 -0
  268. package/dist/lsp/server.d.ts +27 -0
  269. package/dist/lsp/server.d.ts.map +1 -0
  270. package/dist/lsp/server.js +159 -0
  271. package/dist/lsp/server.js.map +1 -0
  272. package/dist/lsp/workspace.d.ts +9 -0
  273. package/dist/lsp/workspace.d.ts.map +1 -0
  274. package/dist/lsp/workspace.js +55 -0
  275. package/dist/lsp/workspace.js.map +1 -0
  276. package/dist/mcp/config.d.ts +54 -0
  277. package/dist/mcp/config.d.ts.map +1 -0
  278. package/dist/mcp/config.js +240 -0
  279. package/dist/mcp/config.js.map +1 -0
  280. package/dist/mcp/index.d.ts +5 -0
  281. package/dist/mcp/index.d.ts.map +1 -0
  282. package/dist/mcp/index.js +3 -0
  283. package/dist/mcp/manager.d.ts +98 -0
  284. package/dist/mcp/manager.d.ts.map +1 -0
  285. package/dist/mcp/manager.js +612 -0
  286. package/dist/mcp/manager.js.map +1 -0
  287. package/dist/mcp/state.d.ts +33 -0
  288. package/dist/mcp/state.d.ts.map +1 -0
  289. package/dist/mcp/state.js +88 -0
  290. package/dist/mcp/state.js.map +1 -0
  291. package/dist/mcp/types.d.ts +120 -0
  292. package/dist/mcp/types.d.ts.map +1 -0
  293. package/dist/mcp/types.js +1 -0
  294. package/dist/onboarding/custom-packs.d.ts +7 -0
  295. package/dist/onboarding/custom-packs.d.ts.map +1 -0
  296. package/dist/onboarding/custom-packs.js +17 -0
  297. package/dist/onboarding/custom-packs.js.map +1 -0
  298. package/dist/onboarding/custom-providers.d.ts +4 -0
  299. package/dist/onboarding/custom-providers.d.ts.map +1 -0
  300. package/dist/onboarding/custom-providers.js +30 -0
  301. package/dist/onboarding/custom-providers.js.map +1 -0
  302. package/dist/onboarding/index.d.ts +5 -0
  303. package/dist/onboarding/index.d.ts.map +1 -0
  304. package/dist/onboarding/index.js +3 -0
  305. package/dist/onboarding/om-settings.d.ts +25 -0
  306. package/dist/onboarding/om-settings.d.ts.map +1 -0
  307. package/dist/onboarding/om-settings.js +47 -0
  308. package/dist/onboarding/om-settings.js.map +1 -0
  309. package/dist/onboarding/packs.d.ts +46 -0
  310. package/dist/onboarding/packs.d.ts.map +1 -0
  311. package/dist/onboarding/packs.js +160 -0
  312. package/dist/onboarding/packs.js.map +1 -0
  313. package/dist/onboarding/settings.d.ts +338 -0
  314. package/dist/onboarding/settings.d.ts.map +1 -0
  315. package/dist/onboarding/settings.js +673 -0
  316. package/dist/onboarding/settings.js.map +1 -0
  317. package/dist/permissions.d.ts +55 -0
  318. package/dist/permissions.d.ts.map +1 -0
  319. package/dist/permissions.js +132 -0
  320. package/dist/permissions.js.map +1 -0
  321. package/dist/plugin.d.ts +81 -0
  322. package/dist/plugin.d.ts.map +1 -0
  323. package/dist/plugin.js +28 -0
  324. package/dist/plugin.js.map +1 -0
  325. package/dist/plugins/dependencies.d.ts +9 -0
  326. package/dist/plugins/dependencies.d.ts.map +1 -0
  327. package/dist/plugins/dependencies.js +88 -0
  328. package/dist/plugins/dependencies.js.map +1 -0
  329. package/dist/plugins/install.d.ts +21 -0
  330. package/dist/plugins/install.d.ts.map +1 -0
  331. package/dist/plugins/install.js +190 -0
  332. package/dist/plugins/install.js.map +1 -0
  333. package/dist/plugins/loader.d.ts +15 -0
  334. package/dist/plugins/loader.d.ts.map +1 -0
  335. package/dist/plugins/loader.js +206 -0
  336. package/dist/plugins/loader.js.map +1 -0
  337. package/dist/plugins/manager.d.ts +64 -0
  338. package/dist/plugins/manager.d.ts.map +1 -0
  339. package/dist/plugins/manager.js +384 -0
  340. package/dist/plugins/manager.js.map +1 -0
  341. package/dist/plugins/manifest.d.ts +14 -0
  342. package/dist/plugins/manifest.d.ts.map +1 -0
  343. package/dist/plugins/manifest.js +50 -0
  344. package/dist/plugins/manifest.js.map +1 -0
  345. package/dist/plugins/package-link.d.ts +3 -0
  346. package/dist/plugins/package-link.d.ts.map +1 -0
  347. package/dist/plugins/package-link.js +61 -0
  348. package/dist/plugins/package-link.js.map +1 -0
  349. package/dist/plugins/paths.d.ts +10 -0
  350. package/dist/plugins/paths.d.ts.map +1 -0
  351. package/dist/plugins/paths.js +25 -0
  352. package/dist/plugins/paths.js.map +1 -0
  353. package/dist/plugins/registry.d.ts +8 -0
  354. package/dist/plugins/registry.d.ts.map +1 -0
  355. package/dist/plugins/registry.js +112 -0
  356. package/dist/plugins/registry.js.map +1 -0
  357. package/dist/plugins/scaffold.d.ts +10 -0
  358. package/dist/plugins/scaffold.d.ts.map +1 -0
  359. package/dist/plugins/scaffold.js +116 -0
  360. package/dist/plugins/scaffold.js.map +1 -0
  361. package/dist/plugins/types.d.ts +45 -0
  362. package/dist/plugins/types.d.ts.map +1 -0
  363. package/dist/plugins/types.js +1 -0
  364. package/dist/processors/plan-rejection-abort.d.ts +12 -0
  365. package/dist/processors/plan-rejection-abort.d.ts.map +1 -0
  366. package/dist/processors/plan-rejection-abort.js +54 -0
  367. package/dist/processors/plan-rejection-abort.js.map +1 -0
  368. package/dist/providers/amazon-bedrock-gateway.d.ts +47 -0
  369. package/dist/providers/amazon-bedrock-gateway.d.ts.map +1 -0
  370. package/dist/providers/amazon-bedrock-gateway.js +152 -0
  371. package/dist/providers/amazon-bedrock-gateway.js.map +1 -0
  372. package/dist/providers/amazon-bedrock.d.ts +28 -0
  373. package/dist/providers/amazon-bedrock.d.ts.map +1 -0
  374. package/dist/providers/amazon-bedrock.js +83 -0
  375. package/dist/providers/amazon-bedrock.js.map +1 -0
  376. package/dist/providers/claude-max.d.ts +52 -0
  377. package/dist/providers/claude-max.d.ts.map +1 -0
  378. package/dist/providers/claude-max.js +171 -0
  379. package/dist/providers/claude-max.js.map +1 -0
  380. package/dist/providers/github-copilot.d.ts +60 -0
  381. package/dist/providers/github-copilot.d.ts.map +1 -0
  382. package/dist/providers/github-copilot.js +265 -0
  383. package/dist/providers/github-copilot.js.map +1 -0
  384. package/dist/providers/openai-codex.d.ts +72 -0
  385. package/dist/providers/openai-codex.d.ts.map +1 -0
  386. package/dist/providers/openai-codex.js +302 -0
  387. package/dist/providers/openai-codex.js.map +1 -0
  388. package/dist/providers/xai.d.ts +33 -0
  389. package/dist/providers/xai.d.ts.map +1 -0
  390. package/dist/providers/xai.js +70 -0
  391. package/dist/providers/xai.js.map +1 -0
  392. package/dist/schema.d.ts +192 -0
  393. package/dist/schema.d.ts.map +1 -0
  394. package/dist/schema.js +98 -0
  395. package/dist/schema.js.map +1 -0
  396. package/dist/theme-palette.d.ts +17 -0
  397. package/dist/theme-palette.d.ts.map +1 -0
  398. package/dist/theme-palette.js +21 -0
  399. package/dist/theme-palette.js.map +1 -0
  400. package/dist/tool-names.d.ts +73 -0
  401. package/dist/tool-names.d.ts.map +1 -0
  402. package/dist/tool-names.js +52 -0
  403. package/dist/tool-names.js.map +1 -0
  404. package/dist/tools/index.d.ts +6 -0
  405. package/dist/tools/index.d.ts.map +1 -0
  406. package/dist/tools/index.js +3 -0
  407. package/dist/tools/request-sandbox-access.d.ts +6 -0
  408. package/dist/tools/request-sandbox-access.d.ts.map +1 -0
  409. package/dist/tools/request-sandbox-access.js +79 -0
  410. package/dist/tools/request-sandbox-access.js.map +1 -0
  411. package/dist/tools/utils.d.ts +20 -0
  412. package/dist/tools/utils.d.ts.map +1 -0
  413. package/dist/tools/utils.js +32 -0
  414. package/dist/tools/utils.js.map +1 -0
  415. package/dist/tools/web-search.d.ts +35 -0
  416. package/dist/tools/web-search.d.ts.map +1 -0
  417. package/dist/tools/web-search.js +61 -0
  418. package/dist/tools/web-search.js.map +1 -0
  419. package/dist/utils/binaries.d.ts +7 -0
  420. package/dist/utils/binaries.d.ts.map +1 -0
  421. package/dist/utils/binaries.js +78 -0
  422. package/dist/utils/binaries.js.map +1 -0
  423. package/dist/utils/debug-log.d.ts +12 -0
  424. package/dist/utils/debug-log.d.ts.map +1 -0
  425. package/dist/utils/debug-log.js +59 -0
  426. package/dist/utils/debug-log.js.map +1 -0
  427. package/dist/utils/errors.d.ts +36 -0
  428. package/dist/utils/errors.d.ts.map +1 -0
  429. package/dist/utils/errors.js +172 -0
  430. package/dist/utils/errors.js.map +1 -0
  431. package/dist/utils/gateway-sync.d.ts +26 -0
  432. package/dist/utils/gateway-sync.d.ts.map +1 -0
  433. package/dist/utils/gateway-sync.js +61 -0
  434. package/dist/utils/gateway-sync.js.map +1 -0
  435. package/dist/utils/path-security.d.ts +2 -0
  436. package/dist/utils/path-security.d.ts.map +1 -0
  437. package/dist/utils/path-security.js +10 -0
  438. package/dist/utils/path-security.js.map +1 -0
  439. package/dist/utils/plan-diff.d.ts +25 -0
  440. package/dist/utils/plan-diff.d.ts.map +1 -0
  441. package/dist/utils/plan-diff.js +62 -0
  442. package/dist/utils/plan-diff.js.map +1 -0
  443. package/dist/utils/plans.d.ts +56 -0
  444. package/dist/utils/plans.d.ts.map +1 -0
  445. package/dist/utils/plans.js +117 -0
  446. package/dist/utils/plans.js.map +1 -0
  447. package/dist/utils/project.d.ts +160 -0
  448. package/dist/utils/project.d.ts.map +1 -0
  449. package/dist/utils/project.js +364 -0
  450. package/dist/utils/project.js.map +1 -0
  451. package/dist/utils/signals-pubsub.d.ts +41 -0
  452. package/dist/utils/signals-pubsub.d.ts.map +1 -0
  453. package/dist/utils/signals-pubsub.js +122 -0
  454. package/dist/utils/signals-pubsub.js.map +1 -0
  455. package/dist/utils/slash-command-loader.d.ts +52 -0
  456. package/dist/utils/slash-command-loader.d.ts.map +1 -0
  457. package/dist/utils/slash-command-loader.js +141 -0
  458. package/dist/utils/slash-command-loader.js.map +1 -0
  459. package/dist/utils/slash-command-processor.d.ts +14 -0
  460. package/dist/utils/slash-command-processor.d.ts.map +1 -0
  461. package/dist/utils/slash-command-processor.js +105 -0
  462. package/dist/utils/slash-command-processor.js.map +1 -0
  463. package/dist/utils/stdin-pipe.d.ts +33 -0
  464. package/dist/utils/stdin-pipe.d.ts.map +1 -0
  465. package/dist/utils/stdin-pipe.js +96 -0
  466. package/dist/utils/stdin-pipe.js.map +1 -0
  467. package/dist/utils/storage-factory.d.ts +50 -0
  468. package/dist/utils/storage-factory.d.ts.map +1 -0
  469. package/dist/utils/storage-factory.js +121 -0
  470. package/dist/utils/storage-factory.js.map +1 -0
  471. package/dist/utils/storage-maintenance.d.ts +103 -0
  472. package/dist/utils/storage-maintenance.d.ts.map +1 -0
  473. package/dist/utils/storage-maintenance.js +274 -0
  474. package/dist/utils/storage-maintenance.js.map +1 -0
  475. package/dist/utils/thread-lock.d.ts +26 -0
  476. package/dist/utils/thread-lock.d.ts.map +1 -0
  477. package/dist/utils/thread-lock.js +112 -0
  478. package/dist/utils/thread-lock.js.map +1 -0
  479. package/dist/utils/token-estimator.d.ts +3 -0
  480. package/dist/utils/token-estimator.d.ts.map +1 -0
  481. package/dist/utils/token-estimator.js +21 -0
  482. package/dist/utils/token-estimator.js.map +1 -0
  483. package/dist/utils/update-check.d.ts +101 -0
  484. package/dist/utils/update-check.d.ts.map +1 -0
  485. package/dist/utils/update-check.js +383 -0
  486. package/dist/utils/update-check.js.map +1 -0
  487. package/dist/voice/stt-registry.d.ts +64 -0
  488. package/dist/voice/stt-registry.d.ts.map +1 -0
  489. package/dist/voice/stt-registry.js +144 -0
  490. package/dist/voice/stt-registry.js.map +1 -0
  491. package/package.json +96 -0
package/dist/auth/providers/openai-codex.js ADDED
@@ -0,0 +1,519 @@
1
+ import { parseAuthorizationInput } from "../authorization-input.js";
2
+ import { generatePKCE } from "../pkce.js";
3
+ //#region src/auth/providers/openai-codex.ts
4
+ /**
5
+ * OpenAI Codex (ChatGPT OAuth) flow
6
+ *
7
+ * Inspired by pi-mono's OAuth implementation:
8
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/openai-codex.ts
9
+ *
10
+ * NOTE: This module uses Node.js crypto and http for the OAuth callback.
11
+ * It is only intended for CLI use, not browser environments.
12
+ */
13
+ let _randomBytes = null;
14
+ let _cryptoPromise = null;
15
+ let _httpPromise = null;
16
+ let _http = null;
17
+ if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
18
+ _cryptoPromise = import("crypto").then((m) => {
19
+ _randomBytes = m.randomBytes;
20
+ return m;
21
+ });
22
+ _httpPromise = import("http").then((m) => {
23
+ _http = m;
24
+ return m;
25
+ });
26
+ }
27
+ const OPENAI_CODEX_AUTH_MODES = [{
28
+ id: "browser",
29
+ name: "Browser (local callback)",
30
+ description: "Opens the browser and waits for the OAuth callback on localhost."
31
+ }, {
32
+ id: "device",
33
+ name: "Device code (headless)",
34
+ description: "Shows a code to enter at openai.com — for SSH, remote, or no-browser environments."
35
+ }];
36
+ const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
37
+ const ISSUER = "https://auth.openai.com";
38
+ const AUTHORIZE_URL = `${ISSUER}/oauth/authorize`;
39
+ const TOKEN_URL = `${ISSUER}/oauth/token`;
40
+ const DEVICE_USER_CODE_URL = `${ISSUER}/api/accounts/deviceauth/usercode`;
41
+ const DEVICE_TOKEN_URL = `${ISSUER}/api/accounts/deviceauth/token`;
42
+ const DEVICE_AUTHORIZE_URL = `${ISSUER}/codex/device`;
43
+ const DEVICE_REDIRECT_URI = `${ISSUER}/deviceauth/callback`;
44
+ const DEFAULT_CALLBACK_PORT = 1455;
45
+ const FALLBACK_CALLBACK_PORT = 1457;
46
+ const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;
47
+ const DEVICE_AUTH_TIMEOUT_MS = 900 * 1e3;
48
+ const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
49
+ const JWT_CLAIM_PATH = "https://api.openai.com/auth";
50
+ const SUCCESS_HTML = `<!doctype html>
51
+ <html lang="en">
52
+ <head>
53
+ <meta charset="utf-8" />
54
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
55
+ <title>Authentication successful</title>
56
+ </head>
57
+ <body>
58
+ <p>Authentication successful. Return to your terminal to continue.</p>
59
+ </body>
60
+ </html>`;
61
+ async function createState() {
62
+ return (await getRandomBytes())(16).toString("hex");
63
+ }
64
+ function decodeJwt(token) {
65
+ try {
66
+ const parts = token.split(".");
67
+ if (parts.length !== 3) return null;
68
+ const payload = parts[1] ?? "";
69
+ const padded = payload.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payload.length / 4) * 4, "=");
70
+ const decoded = atob(padded);
71
+ return JSON.parse(decoded);
72
+ } catch {
73
+ return null;
74
+ }
75
+ }
76
+ function extractAccountIdFromClaims(payload) {
77
+ if (!payload) return null;
78
+ const accountId = payload.chatgpt_account_id ?? payload[JWT_CLAIM_PATH]?.chatgpt_account_id;
79
+ return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
80
+ }
81
+ function getAccountId(tokens, fallback) {
82
+ const fromIdToken = tokens.idToken ? extractAccountIdFromClaims(decodeJwt(tokens.idToken)) : null;
83
+ if (fromIdToken) return fromIdToken;
84
+ const fromAccessToken = extractAccountIdFromClaims(decodeJwt(tokens.access));
85
+ if (fromAccessToken) return fromAccessToken;
86
+ return fallback;
87
+ }
88
+ function requireAccountId(tokens, fallback) {
89
+ const accountId = getAccountId(tokens, fallback);
90
+ if (!accountId) throw new Error("Failed to extract ChatGPT account id from OpenAI Codex token");
91
+ return accountId;
92
+ }
93
+ function tokenResponseToResult(json, logPrefix) {
94
+ if (!json.access_token || !json.refresh_token) {
95
+ console.error(`[openai-codex] ${logPrefix} response missing fields:`, json);
96
+ return { type: "failed" };
97
+ }
98
+ return {
99
+ type: "success",
100
+ access: json.access_token,
101
+ refresh: json.refresh_token,
102
+ expires: Date.now() + (json.expires_in ?? DEFAULT_TOKEN_EXPIRES_IN_SECONDS) * 1e3,
103
+ idToken: json.id_token
104
+ };
105
+ }
106
+ async function exchangeAuthorizationCode(code, verifier, redirectUri) {
107
+ const response = await fetch(TOKEN_URL, {
108
+ method: "POST",
109
+ headers: { "Content-Type": "application/x-www-form-urlencoded" },
110
+ body: new URLSearchParams({
111
+ grant_type: "authorization_code",
112
+ client_id: CLIENT_ID,
113
+ code,
114
+ code_verifier: verifier,
115
+ redirect_uri: redirectUri
116
+ })
117
+ });
118
+ if (!response.ok) {
119
+ const text = await response.text().catch(() => "");
120
+ console.error("[openai-codex] code->token failed:", response.status, text);
121
+ return { type: "failed" };
122
+ }
123
+ return tokenResponseToResult(await response.json(), "token");
124
+ }
125
+ async function refreshAccessToken(refreshToken) {
126
+ try {
127
+ const response = await fetch(TOKEN_URL, {
128
+ method: "POST",
129
+ headers: { "Content-Type": "application/x-www-form-urlencoded" },
130
+ body: new URLSearchParams({
131
+ grant_type: "refresh_token",
132
+ refresh_token: refreshToken,
133
+ client_id: CLIENT_ID
134
+ })
135
+ });
136
+ if (!response.ok) {
137
+ const text = await response.text().catch(() => "");
138
+ console.error("[openai-codex] Token refresh failed:", response.status, text);
139
+ return { type: "failed" };
140
+ }
141
+ return tokenResponseToResult(await response.json(), "Token refresh");
142
+ } catch (error) {
143
+ console.error("[openai-codex] Token refresh error:", error);
144
+ return { type: "failed" };
145
+ }
146
+ }
147
+ async function getRandomBytes() {
148
+ if (!_randomBytes && _cryptoPromise) _randomBytes = (await _cryptoPromise).randomBytes;
149
+ if (!_randomBytes) throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
150
+ return _randomBytes;
151
+ }
152
+ async function createAuthorizationFlow(redirectUri, state, originator = "mastracode") {
153
+ const { verifier, challenge } = await generatePKCE();
154
+ const url = new URL(AUTHORIZE_URL);
155
+ url.searchParams.set("response_type", "code");
156
+ url.searchParams.set("client_id", CLIENT_ID);
157
+ url.searchParams.set("redirect_uri", redirectUri);
158
+ url.searchParams.set("scope", SCOPE);
159
+ url.searchParams.set("code_challenge", challenge);
160
+ url.searchParams.set("code_challenge_method", "S256");
161
+ url.searchParams.set("state", state);
162
+ url.searchParams.set("id_token_add_organizations", "true");
163
+ url.searchParams.set("codex_cli_simplified_flow", "true");
164
+ url.searchParams.set("originator", originator);
165
+ return {
166
+ verifier,
167
+ url: url.toString()
168
+ };
169
+ }
170
+ const CODEX_CALLBACK_PORTS = {
171
+ defaultPort: DEFAULT_CALLBACK_PORT,
172
+ fallbackPort: FALLBACK_CALLBACK_PORT
173
+ };
174
+ async function requestCancel(port) {
175
+ try {
176
+ await fetch(`http://127.0.0.1:${port}/cancel`, { signal: AbortSignal.timeout(200) });
177
+ } catch {}
178
+ }
179
+ function listen(server, port) {
180
+ return new Promise((resolve) => {
181
+ const onError = () => {
182
+ server.off("listening", onListening);
183
+ resolve(false);
184
+ };
185
+ const onListening = () => {
186
+ server.off("error", onError);
187
+ resolve(true);
188
+ };
189
+ server.once("error", onError);
190
+ server.once("listening", onListening);
191
+ server.listen(port, "127.0.0.1");
192
+ });
193
+ }
194
+ async function bindOAuthServer(server, ports) {
195
+ await requestCancel(ports.defaultPort);
196
+ if (await listen(server, ports.defaultPort)) return ports.defaultPort;
197
+ if (await listen(server, ports.fallbackPort)) return ports.fallbackPort;
198
+ return null;
199
+ }
200
+ async function getHttpModule() {
201
+ if (!_http && _httpPromise) _http = await _httpPromise;
202
+ if (!_http) throw new Error("OpenAI Codex OAuth is only available in Node.js environments");
203
+ return _http;
204
+ }
205
+ async function startLocalOAuthServer(state, ports = CODEX_CALLBACK_PORTS) {
206
+ const http = await getHttpModule();
207
+ let lastCode = null;
208
+ let cancelled = false;
209
+ const server = http.createServer((req, res) => {
210
+ try {
211
+ const url = new URL(req.url || "", "http://localhost");
212
+ if (url.pathname === "/cancel") {
213
+ cancelled = true;
214
+ res.statusCode = 200;
215
+ res.end("Cancelled");
216
+ return;
217
+ }
218
+ if (url.pathname !== "/auth/callback") {
219
+ res.statusCode = 404;
220
+ res.end("Not found");
221
+ return;
222
+ }
223
+ if (url.searchParams.get("state") !== state) {
224
+ res.statusCode = 400;
225
+ res.end("State mismatch");
226
+ return;
227
+ }
228
+ const code = url.searchParams.get("code");
229
+ if (!code) {
230
+ res.statusCode = 400;
231
+ res.end("Missing authorization code");
232
+ return;
233
+ }
234
+ res.statusCode = 200;
235
+ res.setHeader("Content-Type", "text/html; charset=utf-8");
236
+ res.end(SUCCESS_HTML);
237
+ lastCode = code;
238
+ } catch {
239
+ res.statusCode = 500;
240
+ res.end("Internal error");
241
+ }
242
+ });
243
+ return new Promise((resolve) => {
244
+ bindOAuthServer(server, ports).then((port) => {
245
+ if (!port) {
246
+ resolve({
247
+ redirectUri: `http://localhost:${ports.fallbackPort}/auth/callback`,
248
+ warning: `OpenAI Codex OAuth requires localhost port ${ports.defaultPort} or ${ports.fallbackPort}, but both are in use. Automatic browser callback will not work until one is freed.`,
249
+ close: () => {
250
+ try {
251
+ server.close();
252
+ } catch {}
253
+ },
254
+ cancelWait: () => {},
255
+ waitForCode: async () => null
256
+ });
257
+ return;
258
+ }
259
+ resolve({
260
+ redirectUri: `http://localhost:${port}/auth/callback`,
261
+ close: () => server.close(),
262
+ cancelWait: () => {
263
+ cancelled = true;
264
+ },
265
+ waitForCode: async () => {
266
+ const sleep = () => new Promise((r) => setTimeout(r, 100));
267
+ for (let i = 0; i < 600; i += 1) {
268
+ if (lastCode) return { code: lastCode };
269
+ if (cancelled) return null;
270
+ await sleep();
271
+ }
272
+ return null;
273
+ }
274
+ });
275
+ });
276
+ });
277
+ }
278
+ /**
279
+ * Start a Codex device-code login: request a user code and return the
280
+ * serializable pending state for subsequent polls.
281
+ */
282
+ async function startCodexDeviceLogin(options) {
283
+ const response = await fetch(DEVICE_USER_CODE_URL, {
284
+ method: "POST",
285
+ headers: {
286
+ "Content-Type": "application/json",
287
+ "User-Agent": "mastracode"
288
+ },
289
+ body: JSON.stringify({
290
+ client_id: CLIENT_ID,
291
+ originator: "mastracode"
292
+ }),
293
+ signal: options?.signal
294
+ });
295
+ if (!response.ok) throw new Error(`Failed to initiate OpenAI Codex device authorization: ${response.status}`);
296
+ const deviceData = await response.json();
297
+ const userCode = deviceData.user_code ?? deviceData.usercode;
298
+ if (!deviceData.device_auth_id || !userCode) throw new Error("OpenAI Codex device authorization response missing required fields");
299
+ const intervalSeconds = typeof deviceData.interval === "number" ? deviceData.interval : Number.parseInt(deviceData.interval ?? "", 10) || 5;
300
+ return {
301
+ deviceAuthId: deviceData.device_auth_id,
302
+ userCode,
303
+ url: DEVICE_AUTHORIZE_URL,
304
+ instructions: `Enter code: ${userCode}`,
305
+ intervalMs: Math.max(intervalSeconds, 1) * 1e3,
306
+ deadlineAt: Date.now() + DEVICE_AUTH_TIMEOUT_MS
307
+ };
308
+ }
309
+ /**
310
+ * Perform exactly one upstream poll for a pending Codex device login.
311
+ * The Codex device endpoint signals "still pending" via HTTP 403/404 (it is
312
+ * not an RFC 8628 error-JSON endpoint); on success it returns the
313
+ * authorization code plus server-held PKCE verifier, which we exchange
314
+ * immediately for credentials. Never throws for flow-level conditions.
315
+ */
316
+ async function pollCodexDeviceLogin(pending, options) {
317
+ if (Date.now() >= pending.deadlineAt) return {
318
+ status: "failed",
319
+ error: "OpenAI Codex device authorization timed out after 15 minutes"
320
+ };
321
+ const pollResponse = await fetch(DEVICE_TOKEN_URL, {
322
+ method: "POST",
323
+ headers: {
324
+ "Content-Type": "application/json",
325
+ "User-Agent": "mastracode"
326
+ },
327
+ body: JSON.stringify({
328
+ device_auth_id: pending.deviceAuthId,
329
+ user_code: pending.userCode
330
+ }),
331
+ signal: options?.signal
332
+ });
333
+ if (pollResponse.ok) {
334
+ const data = await pollResponse.json();
335
+ if (!data.authorization_code || !data.code_verifier) return {
336
+ status: "failed",
337
+ error: "OpenAI Codex device token response missing required fields"
338
+ };
339
+ const tokenResult = await exchangeAuthorizationCode(data.authorization_code, data.code_verifier, DEVICE_REDIRECT_URI);
340
+ if (tokenResult.type !== "success") return {
341
+ status: "failed",
342
+ error: "Token exchange failed"
343
+ };
344
+ let accountId;
345
+ try {
346
+ accountId = requireAccountId(tokenResult);
347
+ } catch (error) {
348
+ return {
349
+ status: "failed",
350
+ error: error instanceof Error ? error.message : String(error)
351
+ };
352
+ }
353
+ return {
354
+ status: "complete",
355
+ credentials: {
356
+ access: tokenResult.access,
357
+ refresh: tokenResult.refresh,
358
+ expires: tokenResult.expires,
359
+ accountId
360
+ }
361
+ };
362
+ }
363
+ if (pollResponse.status !== 403 && pollResponse.status !== 404) {
364
+ const text = await pollResponse.text().catch(() => "");
365
+ return {
366
+ status: "failed",
367
+ error: `OpenAI Codex device authorization failed: ${pollResponse.status}${text ? ` ${text}` : ""}`
368
+ };
369
+ }
370
+ return {
371
+ status: "pending",
372
+ nextPollMs: pending.intervalMs
373
+ };
374
+ }
375
+ async function loginOpenAICodexDevice(options) {
376
+ const pending = await startCodexDeviceLogin({ signal: options.signal });
377
+ const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
378
+ options.onAuth({
379
+ url: pending.url,
380
+ instructions: pending.instructions
381
+ });
382
+ await sleep(pending.intervalMs);
383
+ while (true) {
384
+ if (options.signal?.aborted) throw new Error("Login cancelled");
385
+ const result = await pollCodexDeviceLogin(pending, { signal: options.signal });
386
+ if (result.status === "complete") return result.credentials;
387
+ if (result.status === "failed") throw new Error(result.error);
388
+ options.onProgress?.("Waiting for OpenAI Codex device authorization...");
389
+ await sleep(result.nextPollMs);
390
+ }
391
+ }
392
+ /**
393
+ * Login with OpenAI Codex OAuth
394
+ *
395
+ * @param options.onAuth - Called with URL and instructions when auth starts
396
+ * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)
397
+ * @param options.onProgress - Optional progress messages
398
+ * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.
399
+ * Races with browser callback - whichever completes first wins.
400
+ * Useful for showing paste input immediately alongside browser flow.
401
+ * @param options.originator - OAuth originator parameter (defaults to "mastracode")
402
+ */
403
+ async function loginOpenAICodex(options) {
404
+ const envMode = typeof process !== "undefined" && process.env?.MASTRACODE_OPENAI_CODEX_AUTH_MODE === "device" ? "device" : void 0;
405
+ if ((options.mode ?? envMode ?? "browser") === "device") return loginOpenAICodexDevice({
406
+ onAuth: options.onAuth,
407
+ onProgress: options.onProgress,
408
+ signal: options.signal
409
+ });
410
+ const state = await createState();
411
+ const server = await startLocalOAuthServer(state);
412
+ if (server.warning) options.onProgress?.(server.warning);
413
+ const { verifier, url } = await createAuthorizationFlow(server.redirectUri, state, options.originator ?? "mastracode");
414
+ options.onAuth({
415
+ url,
416
+ instructions: server.warning ? `${server.warning} You can still paste the authorization code or full redirect URL manually.` : "A browser window should open. Complete login to finish."
417
+ });
418
+ let code;
419
+ try {
420
+ if (options.onManualCodeInput) {
421
+ let manualCode;
422
+ let manualError;
423
+ const manualPromise = options.onManualCodeInput().then((input) => {
424
+ manualCode = input;
425
+ server.cancelWait();
426
+ }).catch((err) => {
427
+ manualError = err instanceof Error ? err : new Error(String(err));
428
+ server.cancelWait();
429
+ });
430
+ const result = await server.waitForCode();
431
+ if (manualError) throw manualError;
432
+ if (result?.code) code = result.code;
433
+ else if (manualCode) {
434
+ const parsed = parseAuthorizationInput(manualCode);
435
+ if (parsed.state && parsed.state !== state) throw new Error("State mismatch");
436
+ code = parsed.code;
437
+ }
438
+ if (!code) {
439
+ await manualPromise;
440
+ if (manualError) throw manualError;
441
+ if (manualCode) {
442
+ const parsed = parseAuthorizationInput(manualCode);
443
+ if (parsed.state && parsed.state !== state) throw new Error("State mismatch");
444
+ code = parsed.code;
445
+ }
446
+ }
447
+ } else {
448
+ const result = await server.waitForCode();
449
+ if (result?.code) code = result.code;
450
+ }
451
+ if (!code) {
452
+ const parsed = parseAuthorizationInput(await options.onPrompt({ message: "Paste the authorization code (or full redirect URL):" }));
453
+ if (parsed.state && parsed.state !== state) throw new Error("State mismatch");
454
+ code = parsed.code;
455
+ }
456
+ if (!code) throw new Error("Missing authorization code");
457
+ const tokenResult = await exchangeAuthorizationCode(code, verifier, server.redirectUri);
458
+ if (tokenResult.type !== "success") throw new Error("Token exchange failed");
459
+ const accountId = requireAccountId(tokenResult);
460
+ return {
461
+ access: tokenResult.access,
462
+ refresh: tokenResult.refresh,
463
+ expires: tokenResult.expires,
464
+ accountId
465
+ };
466
+ } finally {
467
+ server.close();
468
+ }
469
+ }
470
+ const __testing = {
471
+ createAuthorizationFlow,
472
+ decodeJwt,
473
+ extractAccountIdFromClaims,
474
+ getAccountId,
475
+ loginOpenAICodexDevice,
476
+ requireAccountId,
477
+ startLocalOAuthServer
478
+ };
479
+ /**
480
+ * Refresh OpenAI Codex OAuth token
481
+ */
482
+ async function refreshOpenAICodexToken(refreshToken, previousAccountId) {
483
+ const result = await refreshAccessToken(refreshToken);
484
+ if (result.type !== "success") throw new Error("Failed to refresh OpenAI Codex token");
485
+ const accountId = requireAccountId(result, previousAccountId);
486
+ return {
487
+ access: result.access,
488
+ refresh: result.refresh,
489
+ expires: result.expires,
490
+ accountId
491
+ };
492
+ }
493
+ const openaiCodexOAuthProvider = {
494
+ id: "openai-codex",
495
+ name: "ChatGPT Plus/Pro (Codex Subscription)",
496
+ usesCallbackServer: true,
497
+ authModes: OPENAI_CODEX_AUTH_MODES,
498
+ async login(callbacks) {
499
+ const mode = callbacks.authMode === "device" || callbacks.authMode === "browser" ? callbacks.authMode : void 0;
500
+ return loginOpenAICodex({
501
+ onAuth: callbacks.onAuth,
502
+ onPrompt: callbacks.onPrompt,
503
+ onProgress: callbacks.onProgress,
504
+ onManualCodeInput: callbacks.onManualCodeInput,
505
+ signal: callbacks.signal,
506
+ mode
507
+ });
508
+ },
509
+ async refreshToken(credentials) {
510
+ return refreshOpenAICodexToken(credentials.refresh, credentials.accountId);
511
+ },
512
+ getApiKey(credentials) {
513
+ return credentials.access;
514
+ }
515
+ };
516
+ //#endregion
517
+ export { OPENAI_CODEX_AUTH_MODES, __testing, loginOpenAICodex, openaiCodexOAuthProvider, pollCodexDeviceLogin, refreshOpenAICodexToken, startCodexDeviceLogin };
518
+
519
+ //# sourceMappingURL=openai-codex.js.map
package/dist/auth/providers/openai-codex.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"openai-codex.js","names":[],"sources":["../../../src/auth/providers/openai-codex.ts"],"sourcesContent":["/**\n * OpenAI Codex (ChatGPT OAuth) flow\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/openai-codex.ts\n *\n * NOTE: This module uses Node.js crypto and http for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\n// NEVER convert to top-level imports - breaks browser/Vite builds (web-ui)\nlet _randomBytes: ((size: number) => Buffer) | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _cryptoPromise: Promise<typeof import('node:crypto')> | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _httpPromise: Promise<typeof import('node:http')> | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _http: typeof import('node:http') | null = null;\ntype HttpServer = {\n off: (event: 'error' | 'listening', listener: (...args: any[]) => void) => HttpServer;\n once: (event: 'error' | 'listening', listener: (...args: any[]) => void) => HttpServer;\n listen: (port: number, hostname: string) => HttpServer;\n close: () => void;\n};\nif (typeof process !== 'undefined' && (process.versions?.node || process.versions?.bun)) {\n _cryptoPromise = import('node:crypto').then(m => {\n _randomBytes = m.randomBytes;\n return m;\n });\n _httpPromise = import('node:http').then(m => {\n _http = m;\n return m;\n });\n}\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { AuthMode, OAuthCredentials, OAuthLoginCallbacks, OAuthPrompt, OAuthProviderInterface } from '../types.js';\n\nexport const OPENAI_CODEX_AUTH_MODES: ReadonlyArray<AuthMode> = [\n {\n id: 'browser',\n name: 'Browser (local callback)',\n description: 'Opens the browser and waits for the OAuth callback on localhost.',\n },\n {\n id: 'device',\n name: 'Device code (headless)',\n description: 'Shows a code to enter at openai.com — for SSH, remote, or no-browser environments.',\n },\n];\n\nconst CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\nconst ISSUER = 'https://auth.openai.com';\nconst AUTHORIZE_URL = `${ISSUER}/oauth/authorize`;\nconst TOKEN_URL = `${ISSUER}/oauth/token`;\nconst DEVICE_USER_CODE_URL = `${ISSUER}/api/accounts/deviceauth/usercode`;\nconst DEVICE_TOKEN_URL = `${ISSUER}/api/accounts/deviceauth/token`;\nconst DEVICE_AUTHORIZE_URL = `${ISSUER}/codex/device`;\nconst DEVICE_REDIRECT_URI = `${ISSUER}/deviceauth/callback`;\nconst DEFAULT_CALLBACK_PORT = 1455;\nconst FALLBACK_CALLBACK_PORT = 1457;\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\nconst DEVICE_AUTH_TIMEOUT_MS = 15 * 60 * 1000;\nconst SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';\nconst JWT_CLAIM_PATH = 'https://api.openai.com/auth';\n\nconst SUCCESS_HTML = `<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n <title>Authentication successful</title>\n</head>\n<body>\n <p>Authentication successful. Return to your terminal to continue.</p>\n</body>\n</html>`;\n\ntype TokenSuccess = {\n type: 'success';\n access: string;\n refresh: string;\n expires: number;\n idToken?: string;\n};\ntype TokenFailure = { type: 'failed' };\ntype TokenResult = TokenSuccess | TokenFailure;\n\ntype JwtPayload = {\n chatgpt_account_id?: string;\n [JWT_CLAIM_PATH]?: {\n chatgpt_account_id?: string;\n };\n [key: string]: unknown;\n};\n\nasync function createState(): Promise<string> {\n const randomBytes = await getRandomBytes();\n return randomBytes(16).toString('hex');\n}\n\nfunction decodeJwt(token: string): JwtPayload | null {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) return null;\n const payload = parts[1] ?? '';\n const padded = payload\n .replace(/-/g, '+')\n .replace(/_/g, '/')\n .padEnd(Math.ceil(payload.length / 4) * 4, '=');\n const decoded = atob(padded);\n return JSON.parse(decoded) as JwtPayload;\n } catch {\n return null;\n }\n}\n\nfunction extractAccountIdFromClaims(payload: JwtPayload | null | undefined): string | null {\n if (!payload) return null;\n const accountId = payload.chatgpt_account_id ?? payload[JWT_CLAIM_PATH]?.chatgpt_account_id;\n return typeof accountId === 'string' && accountId.length > 0 ? accountId : null;\n}\n\nfunction getAccountId(tokens: { idToken?: string; access: string }, fallback?: string): string | undefined {\n const fromIdToken = tokens.idToken ? extractAccountIdFromClaims(decodeJwt(tokens.idToken)) : null;\n if (fromIdToken) return fromIdToken;\n\n const fromAccessToken = extractAccountIdFromClaims(decodeJwt(tokens.access));\n if (fromAccessToken) return fromAccessToken;\n\n return fallback;\n}\n\nfunction requireAccountId(tokens: { idToken?: string; access: string }, fallback?: string): string {\n const accountId = getAccountId(tokens, fallback);\n if (!accountId) {\n throw new Error('Failed to extract ChatGPT account id from OpenAI Codex token');\n }\n return accountId;\n}\n\ntype TokenResponseJson = {\n id_token?: string;\n access_token?: string;\n refresh_token?: string;\n expires_in?: number;\n};\n\nfunction tokenResponseToResult(json: TokenResponseJson, logPrefix: string): TokenResult {\n if (!json.access_token || !json.refresh_token) {\n console.error(`[openai-codex] ${logPrefix} response missing fields:`, json);\n return { type: 'failed' };\n }\n\n return {\n type: 'success',\n access: json.access_token,\n refresh: json.refresh_token,\n expires: Date.now() + (json.expires_in ?? DEFAULT_TOKEN_EXPIRES_IN_SECONDS) * 1000,\n idToken: json.id_token,\n };\n}\n\nasync function exchangeAuthorizationCode(code: string, verifier: string, redirectUri: string): Promise<TokenResult> {\n const response = await fetch(TOKEN_URL, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'authorization_code',\n client_id: CLIENT_ID,\n code,\n code_verifier: verifier,\n redirect_uri: redirectUri,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n console.error('[openai-codex] code->token failed:', response.status, text);\n return { type: 'failed' };\n }\n\n return tokenResponseToResult((await response.json()) as TokenResponseJson, 'token');\n}\n\nasync function refreshAccessToken(refreshToken: string): Promise<TokenResult> {\n try {\n const response = await fetch(TOKEN_URL, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'refresh_token',\n refresh_token: refreshToken,\n client_id: CLIENT_ID,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n console.error('[openai-codex] Token refresh failed:', response.status, text);\n return { type: 'failed' };\n }\n\n return tokenResponseToResult((await response.json()) as TokenResponseJson, 'Token refresh');\n } catch (error) {\n console.error('[openai-codex] Token refresh error:', error);\n return { type: 'failed' };\n }\n}\n\nasync function getRandomBytes() {\n if (!_randomBytes && _cryptoPromise) {\n _randomBytes = (await _cryptoPromise).randomBytes;\n }\n if (!_randomBytes) {\n throw new Error('OpenAI Codex OAuth is only available in Node.js environments');\n }\n return _randomBytes;\n}\n\nasync function createAuthorizationFlow(\n redirectUri: string,\n state: string,\n originator: string = 'mastracode',\n): Promise<{ verifier: string; url: string }> {\n const { verifier, challenge } = await generatePKCE();\n\n const url = new URL(AUTHORIZE_URL);\n url.searchParams.set('response_type', 'code');\n url.searchParams.set('client_id', CLIENT_ID);\n url.searchParams.set('redirect_uri', redirectUri);\n url.searchParams.set('scope', SCOPE);\n url.searchParams.set('code_challenge', challenge);\n url.searchParams.set('code_challenge_method', 'S256');\n url.searchParams.set('state', state);\n url.searchParams.set('id_token_add_organizations', 'true');\n url.searchParams.set('codex_cli_simplified_flow', 'true');\n url.searchParams.set('originator', originator);\n\n return { verifier, url: url.toString() };\n}\n\ntype OAuthServerInfo = {\n redirectUri: string;\n warning?: string;\n close: () => void;\n cancelWait: () => void;\n waitForCode: () => Promise<{ code: string } | null>;\n};\n\ntype CallbackPorts = {\n defaultPort: number;\n fallbackPort: number;\n};\n\nconst CODEX_CALLBACK_PORTS: CallbackPorts = {\n defaultPort: DEFAULT_CALLBACK_PORT,\n fallbackPort: FALLBACK_CALLBACK_PORT,\n};\n\nasync function requestCancel(port: number): Promise<void> {\n try {\n await fetch(`http://127.0.0.1:${port}/cancel`, { signal: AbortSignal.timeout(200) });\n } catch {\n // The existing listener might not be a Codex auth server.\n }\n}\n\nfunction listen(server: HttpServer, port: number): Promise<boolean> {\n return new Promise(resolve => {\n const onError = () => {\n server.off('listening', onListening);\n resolve(false);\n };\n const onListening = () => {\n server.off('error', onError);\n resolve(true);\n };\n\n server.once('error', onError);\n server.once('listening', onListening);\n server.listen(port, '127.0.0.1');\n });\n}\n\nasync function bindOAuthServer(server: HttpServer, ports: CallbackPorts): Promise<number | null> {\n await requestCancel(ports.defaultPort);\n if (await listen(server, ports.defaultPort)) return ports.defaultPort;\n if (await listen(server, ports.fallbackPort)) return ports.fallbackPort;\n\n return null;\n}\n\nasync function getHttpModule() {\n if (!_http && _httpPromise) {\n _http = await _httpPromise;\n }\n if (!_http) {\n throw new Error('OpenAI Codex OAuth is only available in Node.js environments');\n }\n return _http;\n}\n\nasync function startLocalOAuthServer(\n state: string,\n ports: CallbackPorts = CODEX_CALLBACK_PORTS,\n): Promise<OAuthServerInfo> {\n const http = await getHttpModule();\n let lastCode: string | null = null;\n let cancelled = false;\n const server = http.createServer((req, res) => {\n try {\n const url = new URL(req.url || '', 'http://localhost');\n if (url.pathname === '/cancel') {\n cancelled = true;\n res.statusCode = 200;\n res.end('Cancelled');\n return;\n }\n if (url.pathname !== '/auth/callback') {\n res.statusCode = 404;\n res.end('Not found');\n return;\n }\n if (url.searchParams.get('state') !== state) {\n res.statusCode = 400;\n res.end('State mismatch');\n return;\n }\n const code = url.searchParams.get('code');\n if (!code) {\n res.statusCode = 400;\n res.end('Missing authorization code');\n return;\n }\n res.statusCode = 200;\n res.setHeader('Content-Type', 'text/html; charset=utf-8');\n res.end(SUCCESS_HTML);\n lastCode = code;\n } catch {\n res.statusCode = 500;\n res.end('Internal error');\n }\n });\n\n return new Promise(resolve => {\n bindOAuthServer(server, ports).then(port => {\n if (!port) {\n resolve({\n redirectUri: `http://localhost:${ports.fallbackPort}/auth/callback`,\n warning: `OpenAI Codex OAuth requires localhost port ${ports.defaultPort} or ${ports.fallbackPort}, but both are in use. Automatic browser callback will not work until one is freed.`,\n close: () => {\n try {\n server.close();\n } catch {\n // ignore\n }\n },\n cancelWait: () => {},\n waitForCode: async () => null,\n });\n return;\n }\n\n resolve({\n redirectUri: `http://localhost:${port}/auth/callback`,\n close: () => server.close(),\n cancelWait: () => {\n cancelled = true;\n },\n waitForCode: async () => {\n const sleep = () => new Promise(r => setTimeout(r, 100));\n for (let i = 0; i < 600; i += 1) {\n if (lastCode) return { code: lastCode };\n if (cancelled) return null;\n await sleep();\n }\n return null;\n },\n });\n });\n });\n}\n\n/**\n * Serializable pending state for a Codex device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests — the\n * device token response carries the `code_verifier`, so no PKCE state needs\n * to be kept client-side.\n */\nexport interface CodexDeviceLoginPending {\n deviceAuthId: string;\n userCode: string;\n /** Verification URL for the user to open. */\n url: string;\n instructions: string;\n /** Poll interval in ms suggested by the server. */\n intervalMs: number;\n /** ms epoch after which the device authorization expires. */\n deadlineAt: number;\n}\n\nexport type CodexDevicePollResult =\n | { status: 'complete'; credentials: OAuthCredentials }\n | { status: 'pending'; nextPollMs: number }\n | { status: 'failed'; error: string };\n\n/**\n * Start a Codex device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startCodexDeviceLogin(options?: { signal?: AbortSignal }): Promise<CodexDeviceLoginPending> {\n const response = await fetch(DEVICE_USER_CODE_URL, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'User-Agent': 'mastracode',\n },\n body: JSON.stringify({ client_id: CLIENT_ID, originator: 'mastracode' }),\n signal: options?.signal,\n });\n\n if (!response.ok) {\n throw new Error(`Failed to initiate OpenAI Codex device authorization: ${response.status}`);\n }\n\n const deviceData = (await response.json()) as {\n device_auth_id?: string;\n user_code?: string;\n usercode?: string;\n interval?: string | number;\n };\n\n const userCode = deviceData.user_code ?? deviceData.usercode;\n\n if (!deviceData.device_auth_id || !userCode) {\n throw new Error('OpenAI Codex device authorization response missing required fields');\n }\n\n const intervalSeconds =\n typeof deviceData.interval === 'number' ? deviceData.interval : Number.parseInt(deviceData.interval ?? '', 10) || 5;\n\n return {\n deviceAuthId: deviceData.device_auth_id,\n userCode,\n url: DEVICE_AUTHORIZE_URL,\n instructions: `Enter code: ${userCode}`,\n intervalMs: Math.max(intervalSeconds, 1) * 1000,\n deadlineAt: Date.now() + DEVICE_AUTH_TIMEOUT_MS,\n };\n}\n\n/**\n * Perform exactly one upstream poll for a pending Codex device login.\n * The Codex device endpoint signals \"still pending\" via HTTP 403/404 (it is\n * not an RFC 8628 error-JSON endpoint); on success it returns the\n * authorization code plus server-held PKCE verifier, which we exchange\n * immediately for credentials. Never throws for flow-level conditions.\n */\nexport async function pollCodexDeviceLogin(\n pending: CodexDeviceLoginPending,\n options?: { signal?: AbortSignal },\n): Promise<CodexDevicePollResult> {\n if (Date.now() >= pending.deadlineAt) {\n return { status: 'failed', error: 'OpenAI Codex device authorization timed out after 15 minutes' };\n }\n\n const pollResponse = await fetch(DEVICE_TOKEN_URL, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'User-Agent': 'mastracode',\n },\n body: JSON.stringify({\n device_auth_id: pending.deviceAuthId,\n user_code: pending.userCode,\n }),\n signal: options?.signal,\n });\n\n if (pollResponse.ok) {\n const data = (await pollResponse.json()) as {\n authorization_code?: string;\n code_verifier?: string;\n };\n\n if (!data.authorization_code || !data.code_verifier) {\n return { status: 'failed', error: 'OpenAI Codex device token response missing required fields' };\n }\n\n const tokenResult = await exchangeAuthorizationCode(\n data.authorization_code,\n data.code_verifier,\n DEVICE_REDIRECT_URI,\n );\n if (tokenResult.type !== 'success') {\n return { status: 'failed', error: 'Token exchange failed' };\n }\n\n let accountId: string;\n try {\n accountId = requireAccountId(tokenResult);\n } catch (error) {\n return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n }\n\n return {\n status: 'complete',\n credentials: {\n access: tokenResult.access,\n refresh: tokenResult.refresh,\n expires: tokenResult.expires,\n accountId,\n },\n };\n }\n\n if (pollResponse.status !== 403 && pollResponse.status !== 404) {\n const text = await pollResponse.text().catch(() => '');\n return {\n status: 'failed',\n error: `OpenAI Codex device authorization failed: ${pollResponse.status}${text ? ` ${text}` : ''}`,\n };\n }\n\n return { status: 'pending', nextPollMs: pending.intervalMs };\n}\n\nasync function loginOpenAICodexDevice(options: {\n onAuth: (info: { url: string; instructions?: string }) => void;\n onProgress?: (message: string) => void;\n signal?: AbortSignal;\n sleep?: (ms: number) => Promise<void>;\n}): Promise<OAuthCredentials> {\n const pending = await startCodexDeviceLogin({ signal: options.signal });\n const sleep = options.sleep ?? (ms => new Promise<void>(resolve => setTimeout(resolve, ms)));\n\n options.onAuth({\n url: pending.url,\n instructions: pending.instructions,\n });\n\n await sleep(pending.intervalMs);\n\n while (true) {\n if (options.signal?.aborted) {\n throw new Error('Login cancelled');\n }\n\n const result = await pollCodexDeviceLogin(pending, { signal: options.signal });\n if (result.status === 'complete') {\n return result.credentials;\n }\n if (result.status === 'failed') {\n throw new Error(result.error);\n }\n\n options.onProgress?.('Waiting for OpenAI Codex device authorization...');\n await sleep(result.nextPollMs);\n }\n}\n\n/**\n * Login with OpenAI Codex OAuth\n *\n * @param options.onAuth - Called with URL and instructions when auth starts\n * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)\n * @param options.onProgress - Optional progress messages\n * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.\n * Races with browser callback - whichever completes first wins.\n * Useful for showing paste input immediately alongside browser flow.\n * @param options.originator - OAuth originator parameter (defaults to \"mastracode\")\n */\nexport async function loginOpenAICodex(options: {\n onAuth: (info: { url: string; instructions?: string }) => void;\n onPrompt: (prompt: OAuthPrompt) => Promise<string>;\n onProgress?: (message: string) => void;\n onManualCodeInput?: () => Promise<string>;\n signal?: AbortSignal;\n originator?: string;\n mode?: 'browser' | 'device';\n}): Promise<OAuthCredentials> {\n const envMode =\n typeof process !== 'undefined' && process.env?.MASTRACODE_OPENAI_CODEX_AUTH_MODE === 'device'\n ? 'device'\n : undefined;\n const mode = options.mode ?? envMode ?? 'browser';\n if (mode === 'device') {\n return loginOpenAICodexDevice({\n onAuth: options.onAuth,\n onProgress: options.onProgress,\n signal: options.signal,\n });\n }\n\n const state = await createState();\n const server = await startLocalOAuthServer(state);\n if (server.warning) {\n options.onProgress?.(server.warning);\n }\n const { verifier, url } = await createAuthorizationFlow(\n server.redirectUri,\n state,\n options.originator ?? 'mastracode',\n );\n\n options.onAuth({\n url,\n instructions: server.warning\n ? `${server.warning} You can still paste the authorization code or full redirect URL manually.`\n : 'A browser window should open. Complete login to finish.',\n });\n\n let code: string | undefined;\n try {\n if (options.onManualCodeInput) {\n // Race between browser callback and manual input\n let manualCode: string | undefined;\n let manualError: Error | undefined;\n const manualPromise = options\n .onManualCodeInput()\n .then(input => {\n manualCode = input;\n server.cancelWait();\n })\n .catch(err => {\n manualError = err instanceof Error ? err : new Error(String(err));\n server.cancelWait();\n });\n\n const result = await server.waitForCode();\n\n // If manual input was cancelled, throw that error\n if (manualError) {\n throw manualError;\n }\n\n if (result?.code) {\n // Browser callback won\n code = result.code;\n } else if (manualCode) {\n // Manual input won (or callback timed out and user had entered code)\n const parsed = parseAuthorizationInput(manualCode);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n\n // If still no code, wait for manual promise to complete and try that\n if (!code) {\n await manualPromise;\n if (manualError) {\n throw manualError;\n }\n if (manualCode) {\n const parsed = parseAuthorizationInput(manualCode);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n }\n } else {\n // Original flow: wait for callback, then prompt if needed\n const result = await server.waitForCode();\n if (result?.code) {\n code = result.code;\n }\n }\n\n // Fallback to onPrompt if still no code\n if (!code) {\n const input = await options.onPrompt({\n message: 'Paste the authorization code (or full redirect URL):',\n });\n const parsed = parseAuthorizationInput(input);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n\n if (!code) {\n throw new Error('Missing authorization code');\n }\n\n const tokenResult = await exchangeAuthorizationCode(code, verifier, server.redirectUri);\n if (tokenResult.type !== 'success') {\n throw new Error('Token exchange failed');\n }\n\n const accountId = requireAccountId(tokenResult);\n\n return {\n access: tokenResult.access,\n refresh: tokenResult.refresh,\n expires: tokenResult.expires,\n accountId,\n };\n } finally {\n server.close();\n }\n}\n\nexport const __testing = {\n createAuthorizationFlow,\n decodeJwt,\n extractAccountIdFromClaims,\n getAccountId,\n loginOpenAICodexDevice,\n requireAccountId,\n startLocalOAuthServer,\n};\n\n/**\n * Refresh OpenAI Codex OAuth token\n */\nexport async function refreshOpenAICodexToken(\n refreshToken: string,\n previousAccountId?: string,\n): Promise<OAuthCredentials> {\n const result = await refreshAccessToken(refreshToken);\n if (result.type !== 'success') {\n throw new Error('Failed to refresh OpenAI Codex token');\n }\n\n const accountId = requireAccountId(result, previousAccountId);\n\n return {\n access: result.access,\n refresh: result.refresh,\n expires: result.expires,\n accountId,\n };\n}\n\nexport const openaiCodexOAuthProvider: OAuthProviderInterface = {\n id: 'openai-codex',\n name: 'ChatGPT Plus/Pro (Codex Subscription)',\n usesCallbackServer: true,\n authModes: OPENAI_CODEX_AUTH_MODES,\n\n async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n const mode = callbacks.authMode === 'device' || callbacks.authMode === 'browser' ? callbacks.authMode : undefined;\n return loginOpenAICodex({\n onAuth: callbacks.onAuth,\n onPrompt: callbacks.onPrompt,\n onProgress: callbacks.onProgress,\n onManualCodeInput: callbacks.onManualCodeInput,\n signal: callbacks.signal,\n mode,\n });\n },\n\n async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n return refreshOpenAICodexToken(credentials.refresh, credentials.accountId as string | undefined);\n },\n\n getApiKey(credentials: OAuthCredentials): string {\n return credentials.access;\n },\n};\n"],"mappings":";;;;;;;;;;;;AAWA,IAAI,eAAkD;AAEtD,IAAI,iBAA+D;AAEnE,IAAI,eAA2D;AAE/D,IAAI,QAA2C;AAO/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,MAAM;CACvF,iBAAiB,OAAO,SAAc,CAAC,MAAK,MAAK;EAC/C,eAAe,EAAE;EACjB,OAAO;CACT,CAAC;CACD,eAAe,OAAO,OAAY,CAAC,MAAK,MAAK;EAC3C,QAAQ;EACR,OAAO;CACT,CAAC;AACH;AAMA,MAAa,0BAAmD,CAC9D;CACE,IAAI;CACJ,MAAM;CACN,aAAa;AACf,GACA;CACE,IAAI;CACJ,MAAM;CACN,aAAa;AACf,CACF;AAEA,MAAM,YAAY;AAClB,MAAM,SAAS;AACf,MAAM,gBAAgB,GAAG,OAAO;AAChC,MAAM,YAAY,GAAG,OAAO;AAC5B,MAAM,uBAAuB,GAAG,OAAO;AACvC,MAAM,mBAAmB,GAAG,OAAO;AACnC,MAAM,uBAAuB,GAAG,OAAO;AACvC,MAAM,sBAAsB,GAAG,OAAO;AACtC,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AACzC,MAAM,yBAAyB,MAAU;AACzC,MAAM,QAAQ;AACd,MAAM,iBAAiB;AAEvB,MAAM,eAAe;;;;;;;;;;;AA8BrB,eAAe,cAA+B;CAE5C,QAAO,MADmB,eAAe,EAAA,CACtB,EAAE,CAAC,CAAC,SAAS,KAAK;AACvC;AAEA,SAAS,UAAU,OAAkC;CACnD,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,IAAI,MAAM,WAAW,GAAG,OAAO;EAC/B,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,SAAS,QACZ,QAAQ,MAAM,GAAG,CAAC,CAClB,QAAQ,MAAM,GAAG,CAAC,CAClB,OAAO,KAAK,KAAK,QAAQ,SAAS,CAAC,IAAI,GAAG,GAAG;EAChD,MAAM,UAAU,KAAK,MAAM;EAC3B,OAAO,KAAK,MAAM,OAAO;CAC3B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,2BAA2B,SAAuD;CACzF,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,YAAY,QAAQ,sBAAsB,QAAQ,eAAe,EAAE;CACzE,OAAO,OAAO,cAAc,YAAY,UAAU,SAAS,IAAI,YAAY;AAC7E;AAEA,SAAS,aAAa,QAA8C,UAAuC;CACzG,MAAM,cAAc,OAAO,UAAU,2BAA2B,UAAU,OAAO,OAAO,CAAC,IAAI;CAC7F,IAAI,aAAa,OAAO;CAExB,MAAM,kBAAkB,2BAA2B,UAAU,OAAO,MAAM,CAAC;CAC3E,IAAI,iBAAiB,OAAO;CAE5B,OAAO;AACT;AAEA,SAAS,iBAAiB,QAA8C,UAA2B;CACjG,MAAM,YAAY,aAAa,QAAQ,QAAQ;CAC/C,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO;AACT;AASA,SAAS,sBAAsB,MAAyB,WAAgC;CACtF,IAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,eAAe;EAC7C,QAAQ,MAAM,kBAAkB,UAAU,4BAA4B,IAAI;EAC1E,OAAO,EAAE,MAAM,SAAS;CAC1B;CAEA,OAAO;EACL,MAAM;EACN,QAAQ,KAAK;EACb,SAAS,KAAK;EACd,SAAS,KAAK,IAAI,KAAK,KAAK,cAAc,oCAAoC;EAC9E,SAAS,KAAK;CAChB;AACF;AAEA,eAAe,0BAA0B,MAAc,UAAkB,aAA2C;CAClH,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GACxB,YAAY;GACZ,WAAW;GACX;GACA,eAAe;GACf,cAAc;EAChB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,QAAQ,MAAM,sCAAsC,SAAS,QAAQ,IAAI;EACzE,OAAO,EAAE,MAAM,SAAS;CAC1B;CAEA,OAAO,sBAAuB,MAAM,SAAS,KAAK,GAAyB,OAAO;AACpF;AAEA,eAAe,mBAAmB,cAA4C;CAC5E,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,WAAW;GACtC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ,eAAe;IACf,WAAW;GACb,CAAC;EACH,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;GACjD,QAAQ,MAAM,wCAAwC,SAAS,QAAQ,IAAI;GAC3E,OAAO,EAAE,MAAM,SAAS;EAC1B;EAEA,OAAO,sBAAuB,MAAM,SAAS,KAAK,GAAyB,eAAe;CAC5F,SAAS,OAAO;EACd,QAAQ,MAAM,uCAAuC,KAAK;EAC1D,OAAO,EAAE,MAAM,SAAS;CAC1B;AACF;AAEA,eAAe,iBAAiB;CAC9B,IAAI,CAAC,gBAAgB,gBACnB,gBAAgB,MAAM,eAAA,CAAgB;CAExC,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO;AACT;AAEA,eAAe,wBACb,aACA,OACA,aAAqB,cACuB;CAC5C,MAAM,EAAE,UAAU,cAAc,MAAM,aAAa;CAEnD,MAAM,MAAM,IAAI,IAAI,aAAa;CACjC,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,aAAa,SAAS;CAC3C,IAAI,aAAa,IAAI,gBAAgB,WAAW;CAChD,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,IAAI,aAAa,IAAI,kBAAkB,SAAS;CAChD,IAAI,aAAa,IAAI,yBAAyB,MAAM;CACpD,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,IAAI,aAAa,IAAI,8BAA8B,MAAM;CACzD,IAAI,aAAa,IAAI,6BAA6B,MAAM;CACxD,IAAI,aAAa,IAAI,cAAc,UAAU;CAE7C,OAAO;EAAE;EAAU,KAAK,IAAI,SAAS;CAAE;AACzC;AAeA,MAAM,uBAAsC;CAC1C,aAAa;CACb,cAAc;AAChB;AAEA,eAAe,cAAc,MAA6B;CACxD,IAAI;EACF,MAAM,MAAM,oBAAoB,KAAK,UAAU,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;CACrF,QAAQ,CAER;AACF;AAEA,SAAS,OAAO,QAAoB,MAAgC;CAClE,OAAO,IAAI,SAAQ,YAAW;EAC5B,MAAM,gBAAgB;GACpB,OAAO,IAAI,aAAa,WAAW;GACnC,QAAQ,KAAK;EACf;EACA,MAAM,oBAAoB;GACxB,OAAO,IAAI,SAAS,OAAO;GAC3B,QAAQ,IAAI;EACd;EAEA,OAAO,KAAK,SAAS,OAAO;EAC5B,OAAO,KAAK,aAAa,WAAW;EACpC,OAAO,OAAO,MAAM,WAAW;CACjC,CAAC;AACH;AAEA,eAAe,gBAAgB,QAAoB,OAA8C;CAC/F,MAAM,cAAc,MAAM,WAAW;CACrC,IAAI,MAAM,OAAO,QAAQ,MAAM,WAAW,GAAG,OAAO,MAAM;CAC1D,IAAI,MAAM,OAAO,QAAQ,MAAM,YAAY,GAAG,OAAO,MAAM;CAE3D,OAAO;AACT;AAEA,eAAe,gBAAgB;CAC7B,IAAI,CAAC,SAAS,cACZ,QAAQ,MAAM;CAEhB,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO;AACT;AAEA,eAAe,sBACb,OACA,QAAuB,sBACG;CAC1B,MAAM,OAAO,MAAM,cAAc;CACjC,IAAI,WAA0B;CAC9B,IAAI,YAAY;CAChB,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;EAC7C,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;GACrD,IAAI,IAAI,aAAa,WAAW;IAC9B,YAAY;IACZ,IAAI,aAAa;IACjB,IAAI,IAAI,WAAW;IACnB;GACF;GACA,IAAI,IAAI,aAAa,kBAAkB;IACrC,IAAI,aAAa;IACjB,IAAI,IAAI,WAAW;IACnB;GACF;GACA,IAAI,IAAI,aAAa,IAAI,OAAO,MAAM,OAAO;IAC3C,IAAI,aAAa;IACjB,IAAI,IAAI,gBAAgB;IACxB;GACF;GACA,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;GACxC,IAAI,CAAC,MAAM;IACT,IAAI,aAAa;IACjB,IAAI,IAAI,4BAA4B;IACpC;GACF;GACA,IAAI,aAAa;GACjB,IAAI,UAAU,gBAAgB,0BAA0B;GACxD,IAAI,IAAI,YAAY;GACpB,WAAW;EACb,QAAQ;GACN,IAAI,aAAa;GACjB,IAAI,IAAI,gBAAgB;EAC1B;CACF,CAAC;CAED,OAAO,IAAI,SAAQ,YAAW;EAC5B,gBAAgB,QAAQ,KAAK,CAAC,CAAC,MAAK,SAAQ;GAC1C,IAAI,CAAC,MAAM;IACT,QAAQ;KACN,aAAa,oBAAoB,MAAM,aAAa;KACpD,SAAS,8CAA8C,MAAM,YAAY,MAAM,MAAM,aAAa;KAClG,aAAa;MACX,IAAI;OACF,OAAO,MAAM;MACf,QAAQ,CAER;KACF;KACA,kBAAkB,CAAC;KACnB,aAAa,YAAY;IAC3B,CAAC;IACD;GACF;GAEA,QAAQ;IACN,aAAa,oBAAoB,KAAK;IACtC,aAAa,OAAO,MAAM;IAC1B,kBAAkB;KAChB,YAAY;IACd;IACA,aAAa,YAAY;KACvB,MAAM,cAAc,IAAI,SAAQ,MAAK,WAAW,GAAG,GAAG,CAAC;KACvD,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;MAC/B,IAAI,UAAU,OAAO,EAAE,MAAM,SAAS;MACtC,IAAI,WAAW,OAAO;MACtB,MAAM,MAAM;KACd;KACA,OAAO;IACT;GACF,CAAC;EACH,CAAC;CACH,CAAC;AACH;;;;;AA6BA,eAAsB,sBAAsB,SAAsE;CAChH,MAAM,WAAW,MAAM,MAAM,sBAAsB;EACjD,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,KAAK,UAAU;GAAE,WAAW;GAAW,YAAY;EAAa,CAAC;EACvE,QAAQ,SAAS;CACnB,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,yDAAyD,SAAS,QAAQ;CAG5F,MAAM,aAAc,MAAM,SAAS,KAAK;CAOxC,MAAM,WAAW,WAAW,aAAa,WAAW;CAEpD,IAAI,CAAC,WAAW,kBAAkB,CAAC,UACjC,MAAM,IAAI,MAAM,oEAAoE;CAGtF,MAAM,kBACJ,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW,OAAO,SAAS,WAAW,YAAY,IAAI,EAAE,KAAK;CAEpH,OAAO;EACL,cAAc,WAAW;EACzB;EACA,KAAK;EACL,cAAc,eAAe;EAC7B,YAAY,KAAK,IAAI,iBAAiB,CAAC,IAAI;EAC3C,YAAY,KAAK,IAAI,IAAI;CAC3B;AACF;;;;;;;;AASA,eAAsB,qBACpB,SACA,SACgC;CAChC,IAAI,KAAK,IAAI,KAAK,QAAQ,YACxB,OAAO;EAAE,QAAQ;EAAU,OAAO;CAA+D;CAGnG,MAAM,eAAe,MAAM,MAAM,kBAAkB;EACjD,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,KAAK,UAAU;GACnB,gBAAgB,QAAQ;GACxB,WAAW,QAAQ;EACrB,CAAC;EACD,QAAQ,SAAS;CACnB,CAAC;CAED,IAAI,aAAa,IAAI;EACnB,MAAM,OAAQ,MAAM,aAAa,KAAK;EAKtC,IAAI,CAAC,KAAK,sBAAsB,CAAC,KAAK,eACpC,OAAO;GAAE,QAAQ;GAAU,OAAO;EAA6D;EAGjG,MAAM,cAAc,MAAM,0BACxB,KAAK,oBACL,KAAK,eACL,mBACF;EACA,IAAI,YAAY,SAAS,WACvB,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAwB;EAG5D,IAAI;EACJ,IAAI;GACF,YAAY,iBAAiB,WAAW;EAC1C,SAAS,OAAO;GACd,OAAO;IAAE,QAAQ;IAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC3F;EAEA,OAAO;GACL,QAAQ;GACR,aAAa;IACX,QAAQ,YAAY;IACpB,SAAS,YAAY;IACrB,SAAS,YAAY;IACrB;GACF;EACF;CACF;CAEA,IAAI,aAAa,WAAW,OAAO,aAAa,WAAW,KAAK;EAC9D,MAAM,OAAO,MAAM,aAAa,KAAK,CAAC,CAAC,YAAY,EAAE;EACrD,OAAO;GACL,QAAQ;GACR,OAAO,6CAA6C,aAAa,SAAS,OAAO,IAAI,SAAS;EAChG;CACF;CAEA,OAAO;EAAE,QAAQ;EAAW,YAAY,QAAQ;CAAW;AAC7D;AAEA,eAAe,uBAAuB,SAKR;CAC5B,MAAM,UAAU,MAAM,sBAAsB,EAAE,QAAQ,QAAQ,OAAO,CAAC;CACtE,MAAM,QAAQ,QAAQ,WAAU,OAAM,IAAI,SAAc,YAAW,WAAW,SAAS,EAAE,CAAC;CAE1F,QAAQ,OAAO;EACb,KAAK,QAAQ;EACb,cAAc,QAAQ;CACxB,CAAC;CAED,MAAM,MAAM,QAAQ,UAAU;CAE9B,OAAO,MAAM;EACX,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;EAGnC,MAAM,SAAS,MAAM,qBAAqB,SAAS,EAAE,QAAQ,QAAQ,OAAO,CAAC;EAC7E,IAAI,OAAO,WAAW,YACpB,OAAO,OAAO;EAEhB,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,MAAM,OAAO,KAAK;EAG9B,QAAQ,aAAa,kDAAkD;EACvE,MAAM,MAAM,OAAO,UAAU;CAC/B;AACF;;;;;;;;;;;;AAaA,eAAsB,iBAAiB,SAQT;CAC5B,MAAM,UACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,sCAAsC,WACjF,WACA,KAAA;CAEN,KADa,QAAQ,QAAQ,WAAW,eAC3B,UACX,OAAO,uBAAuB;EAC5B,QAAQ,QAAQ;EAChB,YAAY,QAAQ;EACpB,QAAQ,QAAQ;CAClB,CAAC;CAGH,MAAM,QAAQ,MAAM,YAAY;CAChC,MAAM,SAAS,MAAM,sBAAsB,KAAK;CAChD,IAAI,OAAO,SACT,QAAQ,aAAa,OAAO,OAAO;CAErC,MAAM,EAAE,UAAU,QAAQ,MAAM,wBAC9B,OAAO,aACP,OACA,QAAQ,cAAc,YACxB;CAEA,QAAQ,OAAO;EACb;EACA,cAAc,OAAO,UACjB,GAAG,OAAO,QAAQ,8EAClB;CACN,CAAC;CAED,IAAI;CACJ,IAAI;EACF,IAAI,QAAQ,mBAAmB;GAE7B,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,QACnB,kBAAkB,CAAC,CACnB,MAAK,UAAS;IACb,aAAa;IACb,OAAO,WAAW;GACpB,CAAC,CAAC,CACD,OAAM,QAAO;IACZ,cAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;IAChE,OAAO,WAAW;GACpB,CAAC;GAEH,MAAM,SAAS,MAAM,OAAO,YAAY;GAGxC,IAAI,aACF,MAAM;GAGR,IAAI,QAAQ,MAEV,OAAO,OAAO;QACT,IAAI,YAAY;IAErB,MAAM,SAAS,wBAAwB,UAAU;IACjD,IAAI,OAAO,SAAS,OAAO,UAAU,OACnC,MAAM,IAAI,MAAM,gBAAgB;IAElC,OAAO,OAAO;GAChB;GAGA,IAAI,CAAC,MAAM;IACT,MAAM;IACN,IAAI,aACF,MAAM;IAER,IAAI,YAAY;KACd,MAAM,SAAS,wBAAwB,UAAU;KACjD,IAAI,OAAO,SAAS,OAAO,UAAU,OACnC,MAAM,IAAI,MAAM,gBAAgB;KAElC,OAAO,OAAO;IAChB;GACF;EACF,OAAO;GAEL,MAAM,SAAS,MAAM,OAAO,YAAY;GACxC,IAAI,QAAQ,MACV,OAAO,OAAO;EAElB;EAGA,IAAI,CAAC,MAAM;GAIT,MAAM,SAAS,wBAAwB,MAHnB,QAAQ,SAAS,EACnC,SAAS,uDACX,CAAC,CAC2C;GAC5C,IAAI,OAAO,SAAS,OAAO,UAAU,OACnC,MAAM,IAAI,MAAM,gBAAgB;GAElC,OAAO,OAAO;EAChB;EAEA,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,4BAA4B;EAG9C,MAAM,cAAc,MAAM,0BAA0B,MAAM,UAAU,OAAO,WAAW;EACtF,IAAI,YAAY,SAAS,WACvB,MAAM,IAAI,MAAM,uBAAuB;EAGzC,MAAM,YAAY,iBAAiB,WAAW;EAE9C,OAAO;GACL,QAAQ,YAAY;GACpB,SAAS,YAAY;GACrB,SAAS,YAAY;GACrB;EACF;CACF,UAAU;EACR,OAAO,MAAM;CACf;AACF;AAEA,MAAa,YAAY;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;AAKA,eAAsB,wBACpB,cACA,mBAC2B;CAC3B,MAAM,SAAS,MAAM,mBAAmB,YAAY;CACpD,IAAI,OAAO,SAAS,WAClB,MAAM,IAAI,MAAM,sCAAsC;CAGxD,MAAM,YAAY,iBAAiB,QAAQ,iBAAiB;CAE5D,OAAO;EACL,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,SAAS,OAAO;EAChB;CACF;AACF;AAEA,MAAa,2BAAmD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CACpB,WAAW;CAEX,MAAM,MAAM,WAA2D;EACrE,MAAM,OAAO,UAAU,aAAa,YAAY,UAAU,aAAa,YAAY,UAAU,WAAW,KAAA;EACxG,OAAO,iBAAiB;GACtB,QAAQ,UAAU;GAClB,UAAU,UAAU;GACpB,YAAY,UAAU;GACtB,mBAAmB,UAAU;GAC7B,QAAQ,UAAU;GAClB;EACF,CAAC;CACH;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,wBAAwB,YAAY,SAAS,YAAY,SAA+B;CACjG;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}
package/dist/auth/providers/xai.d.ts ADDED
@@ -0,0 +1,64 @@
1
+ /**
2
+ * xAI OAuth flow (Grok)
3
+ *
4
+ * Ported from pi-mono's xAI OAuth implementation:
5
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts
6
+ *
7
+ * xAI uses a standard RFC 8628 device authorization grant, so the flow needs
8
+ * no inbound connection to the server. The primitives are split into
9
+ * `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist
10
+ * the JSON-serializable pending state between HTTP requests; the blocking
11
+ * `loginXAI()` wraps them for TUI use.
12
+ */
13
+ import type { DeviceCodePollState } from '../device-code.js';
14
+ import type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';
15
+ /**
16
+ * Serializable pending state for an xAI device-code login. Safe to persist
17
+ * (e.g. a `pending jsonb` column) so polling can span HTTP requests.
18
+ */
19
+ export interface XAIDeviceLoginPending {
20
+ deviceCode: string;
21
+ userCode: string;
22
+ /** Verification URL for the user to open (https-only, validated). */
23
+ url: string;
24
+ instructions: string;
25
+ /** RFC 8628 poll-loop state (interval growth, deadline, slow_down count). */
26
+ state: DeviceCodePollState;
27
+ }
28
+ export type XAIDevicePollResult = {
29
+ status: 'complete';
30
+ credentials: OAuthCredentials;
31
+ } | {
32
+ status: 'pending';
33
+ nextPollMs: number;
34
+ pending: XAIDeviceLoginPending;
35
+ } | {
36
+ status: 'failed';
37
+ error: string;
38
+ };
39
+ /**
40
+ * Start an xAI device-code login: request a user code and return the
41
+ * serializable pending state for subsequent polls.
42
+ */
43
+ export declare function startXAIDeviceLogin(options?: {
44
+ signal?: AbortSignal;
45
+ }): Promise<XAIDeviceLoginPending>;
46
+ /**
47
+ * Perform exactly one upstream poll for a pending xAI device login.
48
+ * Returns the updated pending state so callers (e.g. web routes) can persist
49
+ * slow_down interval growth between polls. Never throws for flow-level
50
+ * conditions.
51
+ */
52
+ export declare function pollXAIDeviceLogin(pending: XAIDeviceLoginPending, options?: {
53
+ signal?: AbortSignal;
54
+ }): Promise<XAIDevicePollResult>;
55
+ /**
56
+ * Login with xAI OAuth (device-code flow), blocking until authorized.
57
+ */
58
+ export declare function loginXAI(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
59
+ /**
60
+ * Refresh xAI OAuth token
61
+ */
62
+ export declare function refreshXAIToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials>;
63
+ export declare const xaiOAuthProvider: OAuthProviderInterface;
64
+ //# sourceMappingURL=xai.d.ts.map
package/dist/auth/providers/xai.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"xai.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/xai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAyB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AA8DjG;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,gBAAgB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiC5G;AAmDD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWxF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiB3G;AAED,eAAO,MAAM,gBAAgB,EAAE,sBAe9B,CAAC"}