@midscene/cli 1.14.0 → 1.15.0

package/dist/lib/index.js

@@ -2451,232 +2451,6 @@ var __webpack_modules__ = {
             ]
         };
     },
-    "../../node_modules/.pnpm/dotenv@16.4.5/node_modules/dotenv/lib/main.js" (module, __unused_rspack_exports, __webpack_require__) {
-        const fs = __webpack_require__("fs");
-        const path = __webpack_require__("path");
-        const os = __webpack_require__("os");
-        const crypto = __webpack_require__("crypto");
-        const packageJson = __webpack_require__("../../node_modules/.pnpm/dotenv@16.4.5/node_modules/dotenv/package.json");
-        const version = packageJson.version;
-        const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
-        function parse(src) {
-            const obj = {};
-            let lines = src.toString();
-            lines = lines.replace(/\r\n?/mg, '\n');
-            let match;
-            while(null != (match = LINE.exec(lines))){
-                const key = match[1];
-                let value = match[2] || '';
-                value = value.trim();
-                const maybeQuote = value[0];
-                value = value.replace(/^(['"`])([\s\S]*)\1$/mg, '$2');
-                if ('"' === maybeQuote) {
-                    value = value.replace(/\\n/g, '\n');
-                    value = value.replace(/\\r/g, '\r');
-                }
-                obj[key] = value;
-            }
-            return obj;
-        }
-        function _parseVault(options) {
-            const vaultPath = _vaultPath(options);
-            const result = DotenvModule.configDotenv({
-                path: vaultPath
-            });
-            if (!result.parsed) {
-                const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
-                err.code = 'MISSING_DATA';
-                throw err;
-            }
-            const keys = _dotenvKey(options).split(',');
-            const length = keys.length;
-            let decrypted;
-            for(let i = 0; i < length; i++)try {
-                const key = keys[i].trim();
-                const attrs = _instructions(result, key);
-                decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
-                break;
-            } catch (error) {
-                if (i + 1 >= length) throw error;
-            }
-            return DotenvModule.parse(decrypted);
-        }
-        function _log(message) {
-            console.log(`[dotenv@${version}][INFO] ${message}`);
-        }
-        function _warn(message) {
-            console.log(`[dotenv@${version}][WARN] ${message}`);
-        }
-        function _debug(message) {
-            console.log(`[dotenv@${version}][DEBUG] ${message}`);
-        }
-        function _dotenvKey(options) {
-            if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) return options.DOTENV_KEY;
-            if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) return process.env.DOTENV_KEY;
-            return '';
-        }
-        function _instructions(result, dotenvKey) {
-            let uri;
-            try {
-                uri = new URL(dotenvKey);
-            } catch (error) {
-                if ('ERR_INVALID_URL' === error.code) {
-                    const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development');
-                    err.code = 'INVALID_DOTENV_KEY';
-                    throw err;
-                }
-                throw error;
-            }
-            const key = uri.password;
-            if (!key) {
-                const err = new Error('INVALID_DOTENV_KEY: Missing key part');
-                err.code = 'INVALID_DOTENV_KEY';
-                throw err;
-            }
-            const environment = uri.searchParams.get('environment');
-            if (!environment) {
-                const err = new Error('INVALID_DOTENV_KEY: Missing environment part');
-                err.code = 'INVALID_DOTENV_KEY';
-                throw err;
-            }
-            const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
-            const ciphertext = result.parsed[environmentKey];
-            if (!ciphertext) {
-                const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
-                err.code = 'NOT_FOUND_DOTENV_ENVIRONMENT';
-                throw err;
-            }
-            return {
-                ciphertext,
-                key
-            };
-        }
-        function _vaultPath(options) {
-            let possibleVaultPath = null;
-            if (options && options.path && options.path.length > 0) if (Array.isArray(options.path)) {
-                for (const filepath of options.path)if (fs.existsSync(filepath)) possibleVaultPath = filepath.endsWith('.vault') ? filepath : `${filepath}.vault`;
-            } else possibleVaultPath = options.path.endsWith('.vault') ? options.path : `${options.path}.vault`;
-            else possibleVaultPath = path.resolve(process.cwd(), '.env.vault');
-            if (fs.existsSync(possibleVaultPath)) return possibleVaultPath;
-            return null;
-        }
-        function _resolveHome(envPath) {
-            return '~' === envPath[0] ? path.join(os.homedir(), envPath.slice(1)) : envPath;
-        }
-        function _configVault(options) {
-            _log('Loading env from encrypted .env.vault');
-            const parsed = DotenvModule._parseVault(options);
-            let processEnv = process.env;
-            if (options && null != options.processEnv) processEnv = options.processEnv;
-            DotenvModule.populate(processEnv, parsed, options);
-            return {
-                parsed
-            };
-        }
-        function configDotenv(options) {
-            const dotenvPath = path.resolve(process.cwd(), '.env');
-            let encoding = 'utf8';
-            const debug = Boolean(options && options.debug);
-            if (options && options.encoding) encoding = options.encoding;
-            else if (debug) _debug('No encoding is specified. UTF-8 is used by default');
-            let optionPaths = [
-                dotenvPath
-            ];
-            if (options && options.path) if (Array.isArray(options.path)) {
-                optionPaths = [];
-                for (const filepath of options.path)optionPaths.push(_resolveHome(filepath));
-            } else optionPaths = [
-                _resolveHome(options.path)
-            ];
-            let lastError;
-            const parsedAll = {};
-            for (const path of optionPaths)try {
-                const parsed = DotenvModule.parse(fs.readFileSync(path, {
-                    encoding
-                }));
-                DotenvModule.populate(parsedAll, parsed, options);
-            } catch (e1) {
-                if (debug) _debug(`Failed to load ${path} ${e1.message}`);
-                lastError = e1;
-            }
-            let processEnv = process.env;
-            if (options && null != options.processEnv) processEnv = options.processEnv;
-            DotenvModule.populate(processEnv, parsedAll, options);
-            if (lastError) return {
-                parsed: parsedAll,
-                error: lastError
-            };
-            return {
-                parsed: parsedAll
-            };
-        }
-        function config(options) {
-            if (0 === _dotenvKey(options).length) return DotenvModule.configDotenv(options);
-            const vaultPath = _vaultPath(options);
-            if (!vaultPath) {
-                _warn(`You set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}. Did you forget to build it?`);
-                return DotenvModule.configDotenv(options);
-            }
-            return DotenvModule._configVault(options);
-        }
-        function decrypt(encrypted, keyStr) {
-            const key = Buffer.from(keyStr.slice(-64), 'hex');
-            let ciphertext = Buffer.from(encrypted, 'base64');
-            const nonce = ciphertext.subarray(0, 12);
-            const authTag = ciphertext.subarray(-16);
-            ciphertext = ciphertext.subarray(12, -16);
-            try {
-                const aesgcm = crypto.createDecipheriv('aes-256-gcm', key, nonce);
-                aesgcm.setAuthTag(authTag);
-                return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
-            } catch (error) {
-                const isRange = error instanceof RangeError;
-                const invalidKeyLength = 'Invalid key length' === error.message;
-                const decryptionFailed = 'Unsupported state or unable to authenticate data' === error.message;
-                if (isRange || invalidKeyLength) {
-                    const err = new Error('INVALID_DOTENV_KEY: It must be 64 characters long (or more)');
-                    err.code = 'INVALID_DOTENV_KEY';
-                    throw err;
-                }
-                if (decryptionFailed) {
-                    const err = new Error('DECRYPTION_FAILED: Please check your DOTENV_KEY');
-                    err.code = 'DECRYPTION_FAILED';
-                    throw err;
-                }
-                throw error;
-            }
-        }
-        function populate(processEnv, parsed, options = {}) {
-            const debug = Boolean(options && options.debug);
-            const override = Boolean(options && options.override);
-            if ('object' != typeof parsed) {
-                const err = new Error('OBJECT_REQUIRED: Please check the processEnv argument being passed to populate');
-                err.code = 'OBJECT_REQUIRED';
-                throw err;
-            }
-            for (const key of Object.keys(parsed))if (Object.prototype.hasOwnProperty.call(processEnv, key)) {
-                if (true === override) processEnv[key] = parsed[key];
-                if (debug) true === override ? _debug(`"${key}" is already defined and WAS overwritten`) : _debug(`"${key}" is already defined and was NOT overwritten`);
-            } else processEnv[key] = parsed[key];
-        }
-        const DotenvModule = {
-            configDotenv,
-            _configVault,
-            _parseVault,
-            config,
-            decrypt,
-            parse,
-            populate
-        };
-        module.exports.configDotenv = DotenvModule.configDotenv;
-        module.exports._configVault = DotenvModule._configVault;
-        module.exports._parseVault = DotenvModule._parseVault;
-        module.exports.config = DotenvModule.config;
-        module.exports.decrypt = DotenvModule.decrypt;
-        module.exports.parse = DotenvModule.parse;
-        module.exports.populate = DotenvModule.populate;
-        module.exports = DotenvModule;
-    },
     "../../node_modules/.pnpm/emoji-regex@8.0.0/node_modules/emoji-regex/index.js" (module) {
         "use strict";
         module.exports = function() {
@@ -3014,7 +2788,7 @@ var __webpack_modules__ = {
         });
         var external_node_fs_ = __webpack_require__("node:fs");
         var external_node_path_ = __webpack_require__("node:path");
-        const external_node_crypto_namespaceObject = require("node:crypto");
+        var external_node_crypto_ = __webpack_require__("node:crypto");
         var core_ = __webpack_require__("@midscene/core");
         const common_namespaceObject = require("@midscene/shared/common");
         var logger_ = __webpack_require__("@midscene/shared/logger");
@@ -3171,7 +2945,7 @@ var __webpack_modules__ = {
         const safeReportNamePart = (value)=>value.replace(/[:*?"<>|# ]/g, '-');
         const createRetryReportName = (file)=>{
             const fileName = (0, external_node_path_.basename)(file, (0, external_node_path_.extname)(file)) || 'yaml';
-            const fileHash = (0, external_node_crypto_namespaceObject.createHash)('sha1').update((0, external_node_path_.resolve)(file)).digest('hex').slice(0, 8);
+            const fileHash = (0, external_node_crypto_.createHash)('sha1').update((0, external_node_path_.resolve)(file)).digest('hex').slice(0, 8);
             return `${safeReportNamePart(fileName)}-${fileHash}-retry-attempts`;
         };
         const createRetryAttemptReport = (result)=>{
@@ -4814,7 +4588,7 @@ defineYamlBatchTest(test, testOptions);
         var core_ = __webpack_require__("@midscene/core");
         const cli_namespaceObject = require("@midscene/shared/cli");
         var package_namespaceObject = {
-            rE: "1.14.0"
+            rE: "1.15.0"
         };
         var external_node_fs_ = __webpack_require__("node:fs");
         var external_node_fs_namespaceObject = /*#__PURE__*/ __webpack_require__.t(external_node_fs_, 2);
@@ -10437,9 +10211,11 @@ Homepage: https://midscenejs.com
 Github: https://github.com/web-infra-dev/midscene
 
 Usage: 
+      $0 model siwc <login|refresh> [options]
       $0 [options] <path-to-yaml-script-file-or-directory>
       $0 [options] --files <yaml-file1> <yaml-file2 ...>
-      $0 [options] --config <path-to-config-yaml-file>`).options({
+      $0 [options] --config <path-to-config-yaml-file>
+      $0 model verify  Check model connectivity and Midscene compatibility`).options({
                 files: {
                     type: 'array',
                     string: true,
@@ -10497,7 +10273,7 @@ Usage:
                     type: 'boolean',
                     description: 'Whether to dismiss the HarmonyOS keyboard after text input'
                 }
-            }).version('version', 'Show version number', "1.14.0").help().epilogue(`For complete list of configuration options, please visit:
+            }).version('version', 'Show version number', "1.15.0").help().epilogue(`For complete list of configuration options, please visit:
   • Web options: https://midscenejs.com/automate-with-scripts-in-yaml#the-web-part
   • Android options: https://midscenejs.com/automate-with-scripts-in-yaml#the-android-part
   • HarmonyOS options: https://midscenejs.com/automate-with-scripts-in-yaml#the-harmony-part
@@ -12747,188 +12523,440 @@ Native cases/steps Test projects use the midscene-test command.`).wrap(yargs().t
                 globalConfig: pickYamlTargetConfig(options)
             };
         }
-        var main = __webpack_require__("../../node_modules/.pnpm/dotenv@16.4.5/node_modules/dotenv/lib/main.js");
-        var main_default = /*#__PURE__*/ __webpack_require__.n(main);
-        function loadDotenvConfig(options = {}) {
-            const dotEnvConfigFile = (0, external_node_path_.join)(options.cwd ?? process.cwd(), '.env');
-            if (!(0, external_node_fs_.existsSync)(dotEnvConfigFile)) return;
-            options.log?.(`   Env file: ${dotEnvConfigFile}`);
-            main_default().config({
-                path: dotEnvConfigFile,
-                debug: options.dotenvDebug,
-                override: options.dotenvOverride
-            });
-        }
+        const model_command_namespaceObject = require("@midscene/test/internal/model-command");
         var framework = __webpack_require__("./src/framework/index.ts");
-        const env_namespaceObject = require("@midscene/shared/env");
+        const external_node_child_process_namespaceObject = require("node:child_process");
+        var external_node_crypto_ = __webpack_require__("node:crypto");
         var chalk_source = __webpack_require__("../../node_modules/.pnpm/chalk@4.1.2/node_modules/chalk/source/index.js");
         var source_default = /*#__PURE__*/ __webpack_require__.n(chalk_source);
-        const DEFAULT_OPENAI_BASE_URL = 'https://api.openai.com/v1';
-        const MODEL_VERIFY_SEPARATOR = '────────────────────────────────────────';
-        const MODEL_COMMAND_USAGE = `Usage:
-  midscene model verify
-  midscene model eval
-`;
-        function assertNoModelVerifyOptions(args) {
-            for (const arg of args)throw new Error(`Unknown option for midscene model verify: ${arg}`);
-        }
-        function shellSingleQuote(value) {
-            return `'${value.replace(/'/g, "'\\''")}'`;
+        const external_node_os_namespaceObject = require("node:os");
+        const defaultCredentialsPath = ()=>(0, external_node_path_.join)((0, external_node_os_namespaceObject.homedir)(), '.midscene', 'siwc.json');
+        async function readCredentialsFile(path) {
+            const content = await (0, promises_namespaceObject.readFile)(path, 'utf8').catch((error)=>{
+                if ('ENOENT' === error.code) return;
+                throw new Error('Unable to read the local SIWC credentials file.');
+            });
+            if (void 0 === content) return;
+            try {
+                const value = JSON.parse(content);
+                if (!value || 'string' != typeof value.credentials?.ext_agent_host_id || !value.credentials.ext_agent_host_id) throw new Error('Invalid SIWC credentials record.');
+                return value;
+            } catch  {
+                throw new Error('Invalid local SIWC credentials file.');
+            }
         }
-        function buildChatCompletionsUrl(baseURL) {
-            const normalizedBaseURL = (baseURL || DEFAULT_OPENAI_BASE_URL).replace(/\/+$/, '');
-            if (normalizedBaseURL.endsWith('/chat/completions')) return normalizedBaseURL;
-            return `${normalizedBaseURL}/chat/completions`;
+        async function readRegistration(path) {
+            return (await readCredentialsFile(path))?.credentials;
         }
-        function buildCurlCommand(modelConfig) {
-            const payload = {
-                model: modelConfig.modelName,
-                messages: [
-                    {
-                        role: 'user',
-                        content: 'What is 1+1?'
-                    }
-                ]
+        async function saveRegistration(path, value) {
+            const saved = await readCredentialsFile(path);
+            const now = new Date().toISOString();
+            const record = {
+                ...saved,
+                created_at: saved?.created_at ?? now,
+                updated_at: now,
+                credentials: value
             };
-            return [
-                `curl -X POST ${shellSingleQuote(buildChatCompletionsUrl(modelConfig.openaiBaseURL))} \\`,
-                `  -H ${shellSingleQuote(`Authorization: Bearer ${modelConfig.openaiApiKey || ''}`)} \\`,
-                `  -H ${shellSingleQuote('Content-Type: application/json')} \\`,
-                `  -d ${shellSingleQuote(JSON.stringify(payload, null, 2))}`
-            ].join('\n');
-        }
-        function buildCurlDedupKey(modelConfig) {
-            return JSON.stringify({
-                baseURL: modelConfig.openaiBaseURL || DEFAULT_OPENAI_BASE_URL,
-                apiKey: modelConfig.openaiApiKey || '',
-                modelName: modelConfig.modelName
-            });
-        }
-        function buildModelVerifyCurlCommands(configs) {
-            const commandMap = new Map();
-            for (const item of configs){
-                const key = buildCurlDedupKey(item.modelConfig);
-                const existing = commandMap.get(key);
-                if (existing) {
-                    existing.intents.push(item.intent);
-                    continue;
-                }
-                commandMap.set(key, {
-                    intents: [
-                        item.intent
-                    ],
-                    curl: buildCurlCommand(item.modelConfig),
-                    usesDefaultBaseURL: !item.modelConfig.openaiBaseURL
+            const temporary = `${path}.${(0, external_node_crypto_.randomUUID)()}.tmp`;
+            try {
+                await (0, promises_namespaceObject.writeFile)(temporary, `${JSON.stringify(record, null, 2)}\n`, {
+                    mode: 384,
+                    flag: 'wx'
+                });
+                await (0, promises_namespaceObject.rename)(temporary, path);
+            } finally{
+                await (0, promises_namespaceObject.rm)(temporary, {
+                    force: true
                 });
             }
-            return [
-                ...commandMap.values()
-            ];
         }
-        function formatModelVerifyFailureOutput(message, curlCommands) {
-            const details = message?.trim() || 'No failure details were generated.';
-            const curlSection = curlCommands.map((item)=>{
-                const baseUrlNote = item.usesDefaultBaseURL ? ' (base URL not configured; using OpenAI SDK default)' : '';
-                return source_default().gray(`# ${item.intents.join(', ')}${baseUrlNote}\n${item.curl}`);
-            }).join('\n\n');
-            return [
-                source_default().red.bold('❌ Model verify failed with messages:'),
-                MODEL_VERIFY_SEPARATOR,
-                '',
-                details,
-                '',
-                MODEL_VERIFY_SEPARATOR,
-                'Generated curl requests for basic API connectivity:',
-                'If the error is a basic connectivity issue, use these requests to test the base URL, API key, and model name directly.',
-                'These commands contain your API key. Do not share them publicly.',
-                '',
-                curlSection
-            ].join('\n');
+        async function lockCredentials(path) {
+            await (0, promises_namespaceObject.mkdir)((0, external_node_path_.dirname)(path), {
+                recursive: true,
+                mode: 448
+            });
+            const lockPath = `${path}.lock`;
+            try {
+                await (0, promises_namespaceObject.mkdir)(lockPath, {
+                    mode: 448
+                });
+            } catch (error) {
+                if ('EEXIST' === error.code) throw new Error(`Another SIWC command holds ${lockPath}. If it was interrupted, remove this lock only after confirming that no SIWC command is running.`);
+                throw new Error('Unable to lock the local SIWC credentials file.');
+            }
+            return ()=>(0, promises_namespaceObject.rm)(lockPath, {
+                    recursive: true,
+                    force: true
+                });
         }
-        function getDefaultDeps(io) {
-            return {
-                loadDotenv: ()=>{
-                    loadDotenvConfig({
-                        dotenvDebug: true,
-                        dotenvOverride: true,
-                        log: io.stdout
+        function requireCredentials(value) {
+            if (!value || [
+                'client_id',
+                'subject',
+                'issuer',
+                'access_token',
+                'refresh_token',
+                'id_token'
+            ].some((key)=>'string' != typeof value[key] || !value[key]) || !Array.isArray(value.scopes) || !value.scopes.every((scope)=>'string' == typeof scope) || !Number.isFinite(value.expires_at)) throw new Error('No valid SIWC credentials. Run midscene model siwc login first.');
+            return value;
+        }
+        const external_node_http_namespaceObject = require("node:http");
+        const external_jose_namespaceObject = require("jose");
+        const ISSUER = 'https://auth.openai.com';
+        const RESOURCE = 'https://api.openai.com/v1';
+        const SCOPES = 'openid profile email offline_access resource.invoke chatgpt.tokens.use.direct';
+        async function loginWithOpenAI(options, dependencies) {
+            const hostId = options.hostId ?? `urn:uuid:${(0, external_node_crypto_.randomUUID)()}`;
+            const existingClientId = options.clientId;
+            const state = (0, external_node_crypto_.randomBytes)(32).toString('base64url');
+            const nonce = (0, external_node_crypto_.randomBytes)(32).toString('base64url');
+            const verifier = (0, external_node_crypto_.randomBytes)(32).toString('base64url');
+            const signal = options.signal;
+            signal.throwIfAborted();
+            const server = (0, external_node_http_namespaceObject.createServer)();
+            const callback = new Promise((resolve, reject)=>{
+                const consumed = {
+                    value: false
+                };
+                server.on('request', (request, response)=>{
+                    response.setHeader('Content-Type', 'text/plain; charset=utf-8');
+                    response.setHeader('Cache-Control', 'no-store');
+                    response.setHeader('Referrer-Policy', 'no-referrer');
+                    const url = new URL(request.url || '/', 'http://127.0.0.1');
+                    if ('GET' !== request.method || '/auth/callback' !== url.pathname) return void response.writeHead(404).end('Not found');
+                    if (1 !== url.searchParams.getAll('state').length || url.searchParams.get('state') !== state) return void response.writeHead(400).end('Invalid login state. Use the original authorization link.');
+                    if (consumed.value) return void response.writeHead(409).end('Authorization already received.');
+                    if (url.searchParams.has('error')) {
+                        consumed.value = true;
+                        response.writeHead(400).end('Authorization was not granted. Return to the terminal.');
+                        reject(new Error('OpenAI authorization was denied or failed.'));
+                        return;
+                    }
+                    const code = url.searchParams.get('code');
+                    const clientId = url.searchParams.get('client_id') || existingClientId;
+                    if (!code || !clientId || 'dynamic_agent_client' === clientId || existingClientId && clientId !== existingClientId || 1 !== url.searchParams.getAll('code').length || url.searchParams.getAll('client_id').length > 1) return void response.writeHead(400).end('Invalid authorization callback.');
+                    consumed.value = true;
+                    response.setHeader('Content-Type', 'text/html; charset=utf-8');
+                    response.end(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Authorization received · Midscene</title>
+  <style>
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; background: #f6f7f9; color: #202124; font-family: system-ui, sans-serif; }
+    main { width: 100%; max-width: 480px; padding: 40px 28px; text-align: center; background: white; border: 1px solid #e5e7eb; border-radius: 20px; box-shadow: 0 8px 32px #00000008; }
+    h1 { margin: 0 0 20px; font-size: 24px; line-height: 1.4; }
+    h1 span { color: #16834a; }
+    p { margin: 8px 0 0; color: #596273; font-size: 15px; line-height: 1.6; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1><span aria-hidden="true">✓</span> Authorization received</h1>
+    <p>You can close this tab.</p>
+    <p>Check your terminal for the sign-in result and access token.</p>
+  </main>
+</body>
+</html>`);
+                    resolve({
+                        code,
+                        clientId
                     });
-                },
-                getModelConfig: (intent)=>env_namespaceObject.globalModelConfigManager.getModelConfig(intent),
-                verifyModel: core_.runConnectivityTest
-            };
-        }
-        async function runModelVerifyCommand(args, deps, io) {
+                });
+                server.on('error', reject);
+            });
+            callback.catch(()=>void 0);
+            const abort = ()=>server.emit('error', new Error('OpenAI login cancelled or timed out.'));
+            signal.addEventListener('abort', abort, {
+                once: true
+            });
             try {
-                if (args.includes('--help') || args.includes('-h')) {
-                    io.stdout(MODEL_COMMAND_USAGE);
-                    return 0;
-                }
-                assertNoModelVerifyOptions(args);
-                io.stdout('Model verify started. This usually takes about 5 seconds.\n');
-                deps.loadDotenv();
-                io.stdout('');
-                const defaultModelConfig = deps.getModelConfig('default');
-                const planningModelConfig = deps.getModelConfig('planning');
-                const insightModelConfig = deps.getModelConfig('insight');
-                const curlCommands = buildModelVerifyCurlCommands([
-                    {
-                        intent: 'default',
-                        modelConfig: defaultModelConfig
+                await new Promise((resolve, reject)=>{
+                    server.once('error', reject);
+                    server.listen(options.port ?? 0, '127.0.0.1', ()=>{
+                        server.removeListener('error', reject);
+                        resolve();
+                    });
+                });
+                signal.throwIfAborted();
+                const redirectUri = `http://127.0.0.1:${server.address().port}/auth/callback`;
+                const authorization = new URL(`${ISSUER}/api/accounts/authorize`);
+                authorization.search = new URLSearchParams({
+                    client_id: existingClientId ?? 'dynamic_agent_client',
+                    ...existingClientId ? {} : {
+                        agent_name_hint: 'Midscene'
                     },
-                    {
-                        intent: 'planning',
-                        modelConfig: planningModelConfig
+                    ext_agent_host_id: hostId,
+                    response_type: 'code',
+                    redirect_uri: redirectUri,
+                    scope: SCOPES,
+                    resource: RESOURCE,
+                    state,
+                    nonce,
+                    code_challenge_method: 'S256',
+                    code_challenge: (0, external_node_crypto_.createHash)('sha256').update(verifier).digest('base64url')
+                }).toString();
+                await options.onAuthorization(authorization.toString());
+                const { code, clientId } = await callback;
+                signal.throwIfAborted();
+                const request = dependencies?.fetch ?? fetch;
+                const result = await request(`${ISSUER}/api/accounts/oauth/token`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
                     },
-                    {
-                        intent: 'insight',
-                        modelConfig: insightModelConfig
-                    }
-                ]);
-                const result = await deps.verifyModel({
-                    defaultModelConfig,
-                    planningModelConfig,
-                    insightModelConfig
+                    body: new URLSearchParams({
+                        grant_type: 'authorization_code',
+                        client_id: clientId,
+                        code,
+                        code_verifier: verifier,
+                        redirect_uri: redirectUri,
+                        resource: RESOURCE
+                    }),
+                    signal,
+                    redirect: 'error'
                 });
-                if (result.passed) {
-                    io.stdout('✅ Model verify passed.');
-                    return 0;
-                }
-                io.stderr(formatModelVerifyFailureOutput(result.message, curlCommands));
-                return 1;
-            } catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                io.stderr([
-                    MODEL_VERIFY_SEPARATOR,
-                    '❌ Model verify failed with messages:',
-                    '',
-                    message,
-                    MODEL_VERIFY_SEPARATOR
-                ].join('\n'));
-                return 1;
+                if (!result.ok) throw new Error(`OpenAI token exchange failed (HTTP ${result.status}). Run midscene model siwc login again.`);
+                const tokens = await result.json();
+                if (!tokens || 'string' != typeof tokens.access_token || !tokens.access_token || 'string' != typeof tokens.refresh_token || !tokens.refresh_token || 'string' != typeof tokens.id_token || 'string' != typeof tokens.scope || 'number' != typeof tokens.expires_in || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || 'string' != typeof tokens.token_type || 'bearer' !== tokens.token_type.toLowerCase()) throw new Error('OpenAI returned an invalid token response.');
+                const scopes = tokens.scope.split(/\s+/);
+                if (!scopes.includes('chatgpt.tokens.use.direct')) throw new Error('ChatGPT plan usage was not authorized. Run midscene model siwc login again and grant access.');
+                const keys = dependencies?.keys ?? (0, external_jose_namespaceObject.createRemoteJWKSet)(new URL(`${ISSUER}/.well-known/jwks.json`));
+                const { payload } = await (0, external_jose_namespaceObject.jwtVerify)(tokens.id_token, keys, {
+                    issuer: ISSUER,
+                    audience: clientId,
+                    algorithms: [
+                        'RS256'
+                    ],
+                    requiredClaims: [
+                        'sub',
+                        'exp',
+                        'iat',
+                        'nonce'
+                    ]
+                });
+                if (payload.nonce !== nonce || !payload.sub) throw new Error('OpenAI login identity or nonce did not match.');
+                signal.throwIfAborted();
+                return {
+                    ext_agent_host_id: hostId,
+                    client_id: clientId,
+                    subject: payload.sub,
+                    issuer: ISSUER,
+                    ...'string' == typeof payload.email ? {
+                        email: payload.email
+                    } : {},
+                    access_token: tokens.access_token,
+                    refresh_token: tokens.refresh_token,
+                    id_token: tokens.id_token,
+                    scopes,
+                    expires_at: Date.now() + 1000 * tokens.expires_in
+                };
+            } finally{
+                signal.removeEventListener('abort', abort);
+                server.closeAllConnections();
+                await new Promise((resolve)=>server.close(()=>resolve()));
+            }
+        }
+        async function refreshOpenAICredentials(saved, signal, dependencies) {
+            const issuer = 'https://auth.openai.com';
+            signal.throwIfAborted();
+            const response = await (dependencies?.fetch ?? fetch)(`${issuer}/api/accounts/oauth/token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded'
+                },
+                body: new URLSearchParams({
+                    grant_type: 'refresh_token',
+                    client_id: saved.client_id,
+                    refresh_token: saved.refresh_token,
+                    resource: 'https://api.openai.com/v1'
+                }),
+                signal,
+                redirect: 'error'
+            });
+            if (!response.ok) throw new Error('OpenAI refresh failed.');
+            const tokens = await response.json();
+            if (!tokens || 'string' != typeof tokens.access_token || !tokens.access_token || 'string' != typeof tokens.refresh_token || !tokens.refresh_token || 'number' != typeof tokens.expires_in || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || 'string' != typeof tokens.token_type || 'bearer' !== tokens.token_type.toLowerCase() || 'string' != typeof tokens.scope) throw new Error('OpenAI returned an invalid refresh response.');
+            const scopes = tokens.scope.split(/\s+/);
+            if (!scopes.includes('chatgpt.tokens.use.direct')) throw new Error('ChatGPT plan usage is no longer authorized.');
+            if (void 0 !== tokens.id_token) {
+                if ('string' != typeof tokens.id_token || !tokens.id_token) throw new Error('Invalid refreshed ID token.');
+                const keys = dependencies?.keys ?? (0, external_jose_namespaceObject.createRemoteJWKSet)(new URL(`${issuer}/.well-known/jwks.json`));
+                const { payload } = await (0, external_jose_namespaceObject.jwtVerify)(tokens.id_token, keys, {
+                    issuer,
+                    audience: saved.client_id,
+                    algorithms: [
+                        'RS256'
+                    ],
+                    requiredClaims: [
+                        'sub',
+                        'exp',
+                        'iat'
+                    ]
+                });
+                if (payload.sub !== saved.subject) throw new Error('Refreshed identity does not match the saved account.');
             }
+            signal.throwIfAborted();
+            return {
+                ...saved,
+                access_token: tokens.access_token,
+                refresh_token: tokens.refresh_token,
+                id_token: tokens.id_token ?? saved.id_token,
+                scopes,
+                expires_at: Date.now() + 1000 * tokens.expires_in
+            };
+        }
+        const USAGE = `Usage:
+  midscene model siwc login [--no-open] [--port <port>]
+  midscene model siwc refresh
+
+Sign in with ChatGPT or refresh the saved credentials.
+Full credentials are saved to ~/.midscene/siwc.json. Only the access token is printed to stdout.
+Midscene does not collect your credentials.
+
+Options (login):
+  --no-open           Print the authorization URL without opening a browser
+  --port <port>       Loopback callback port (default: an available port)
+  --help, -h          Show this help
+`;
+        async function openBrowser(url) {
+            const command = 'darwin' === process.platform ? 'open' : 'win32' === process.platform ? 'rundll32' : 'xdg-open';
+            const args = 'win32' === process.platform ? [
+                'url.dll,FileProtocolHandler',
+                url
+            ] : [
+                url
+            ];
+            await new Promise((resolve, reject)=>{
+                const child = (0, external_node_child_process_namespaceObject.spawn)(command, args, {
+                    stdio: 'ignore',
+                    shell: false
+                });
+                child.once('error', reject);
+                child.once('spawn', ()=>{
+                    child.unref();
+                    resolve();
+                });
+            });
         }
-        async function runModelCommand(rawArgs, deps, io = {
+        async function runSiwcCommand(args, io = {
             stdout: console.log,
             stderr: console.error
-        }) {
-            const [, action, ...restArgs] = rawArgs;
-            const mergedDeps = {
-                ...getDefaultDeps(io),
-                ...deps
-            };
-            if (!action || '--help' === action || '-h' === action) {
-                io.stdout(MODEL_COMMAND_USAGE);
+        }, credentialsPath = defaultCredentialsPath()) {
+            if (!args.length || args.includes('--help') || args.includes('-h')) {
+                io.stdout(USAGE);
                 return 0;
             }
-            if ('verify' === action) return runModelVerifyCommand(restArgs, mergedDeps, io);
-            if ('eval' === action) {
-                io.stderr('midscene model eval is not implemented yet. It is reserved for future model evaluation suites.');
+            const [action, ...options] = args;
+            if ('login' !== action && 'refresh' !== action) {
+                io.stderr(`Unknown SIWC command: ${action}\n${USAGE}`);
                 return 1;
             }
-            io.stderr(`Unknown midscene model command: ${action}\n\n${MODEL_COMMAND_USAGE}`);
-            return 1;
+            const portOptions = {
+                port: 0,
+                noOpen: false
+            };
+            const seen = new Set();
+            for(let index = 0; index < options.length; index++){
+                const option = options[index];
+                if ('login' !== action || seen.has(option) || ![
+                    '--port',
+                    '--no-open'
+                ].includes(option)) {
+                    io.stderr(`Invalid midscene model siwc arguments.\n${USAGE}`);
+                    return 1;
+                }
+                seen.add(option);
+                if ('--no-open' === option) portOptions.noOpen = true;
+                else {
+                    const value = options[++index];
+                    if (!value || !/^\d+$/.test(value) || Number(value) > 65535) {
+                        io.stderr('--port must be an integer between 0 and 65535.');
+                        return 1;
+                    }
+                    portOptions.port = Number(value);
+                }
+            }
+            const unlock = await lockCredentials(credentialsPath).catch((error)=>{
+                io.stderr(error.message);
+            });
+            if (!unlock) return 1;
+            const controller = new AbortController();
+            const cancel = ()=>controller.abort();
+            const timer = setTimeout(cancel, 300000);
+            process.once('SIGINT', cancel);
+            process.once('SIGTERM', cancel);
+            try {
+                io.stderr(source_default().cyan.bold(`🔄 Starting OpenAI SIWC ${action}...`));
+                const saved = await readRegistration(credentialsPath);
+                const credentials = await (async ()=>{
+                    if ('refresh' === action) return refreshOpenAICredentials(requireCredentials(saved), controller.signal);
+                    const registration = saved ?? {
+                        ext_agent_host_id: `urn:uuid:${(0, external_node_crypto_.randomUUID)()}`
+                    };
+                    if (!saved) await saveRegistration(credentialsPath, registration);
+                    const result = await loginWithOpenAI({
+                        port: portOptions.port,
+                        hostId: registration.ext_agent_host_id,
+                        clientId: registration.client_id,
+                        signal: controller.signal,
+                        onAuthorization: async (url)=>{
+                            io.stderr(`\n${source_default().bold('Continue with ChatGPT:')}\n${url}\n\n${source_default().gray('Waiting for authorization...')}`);
+                            if (!portOptions.noOpen) try {
+                                await openBrowser(url);
+                            } catch  {
+                                io.stderr('Open the URL above in your browser to continue.');
+                            }
+                        }
+                    });
+                    if (registration.subject && result.subject !== registration.subject) throw new Error('Login identity does not match the saved account.');
+                    return result;
+                })();
+                await saveRegistration(credentialsPath, credentials);
+                io.stderr('\n🔑 your Access token:');
+                io.stdout(credentials.access_token);
+                const expiresAt = new Intl.DateTimeFormat('en-GB', {
+                    dateStyle: 'medium',
+                    timeStyle: 'long'
+                }).format(credentials.expires_at);
+                const remainingMinutes = Math.ceil((credentials.expires_at - Date.now()) / 60000);
+                const expiresIn = new Intl.RelativeTimeFormat('en', {
+                    numeric: 'always'
+                }).format(60 === remainingMinutes ? 1 : remainingMinutes, 60 === remainingMinutes ? 'hour' : 'minute');
+                io.stderr(`\nExpires at: ${expiresAt} (${expiresIn})`);
+                io.stderr(`\n${source_default().green(`✅ SIWC ${action} succeeded.`)}\n\nYou can use this access token as your model API Key in Midscene by setting MIDSCENE_MODEL_API_KEY.\n\nFull credentials are saved locally to:\n${source_default().cyan(credentialsPath)}\n\n${source_default().gray('Midscene does not collect your credentials.')}`);
+                return 0;
+            } catch  {
+                io.stderr(source_default().red(controller.signal.aborted ? `OpenAI ${action} cancelled or timed out.` : `OpenAI ${action} failed. Check the local credentials file permissions or run midscene model siwc login to authorize again.`));
+                return 1;
+            } finally{
+                clearTimeout(timer);
+                process.removeListener('SIGINT', cancel);
+                process.removeListener('SIGTERM', cancel);
+                await unlock();
+            }
         }
+        const runModelCommand = (rawArgs, deps, io = {
+            stdout: console.log,
+            stderr: console.error
+        })=>{
+            const [, action, ...restArgs] = rawArgs;
+            if ('siwc' === action) return runSiwcCommand(restArgs, io);
+            const withSiwcUsage = (message)=>message.replace('  midscene model verify\n', '  midscene model verify\n  midscene model siwc <login|refresh> [options]\n');
+            return (0, model_command_namespaceObject.runModelCommand)(rawArgs, {
+                loadDotenv: ()=>(0, model_command_namespaceObject.loadDotenvConfig)({
+                        dotenvDebug: true,
+                        dotenvOverride: true,
+                        log: io.stdout
+                    }),
+                ...deps
+            }, {
+                stdout: (message)=>io.stdout(withSiwcUsage(message)),
+                stderr: (message)=>io.stderr(withSiwcUsage(message))
+            }, 'midscene');
+        };
         const test_runner_namespaceObject = require("@midscene/core/internal/test-runner");
         const probeWorkflowFormat = (file)=>{
             try {
@@ -13036,7 +13064,7 @@ Native cases/steps Test projects use the midscene-test command.`).wrap(yargs().t
                 ] : [],
                 ...config.files
             ]);
-            loadDotenvConfig({
+            (0, model_command_namespaceObject.loadDotenvConfig)({
                 dotenvDebug: config.dotenvDebug,
                 dotenvOverride: config.dotenvOverride,
                 log: console.log
@@ -13067,10 +13095,6 @@ Native cases/steps Test projects use the midscene-test command.`).wrap(yargs().t
         "use strict";
         module.exports = require("assert");
     },
-    crypto (module) {
-        "use strict";
-        module.exports = require("crypto");
-    },
     fs (module) {
         "use strict";
         module.exports = require("fs");
@@ -13079,6 +13103,10 @@ Native cases/steps Test projects use the midscene-test command.`).wrap(yargs().t
         "use strict";
         module.exports = require("lodash.merge");
     },
+    "node:crypto" (module) {
+        "use strict";
+        module.exports = require("node:crypto");
+    },
     "node:fs" (module) {
         "use strict";
         module.exports = require("node:fs");
@@ -16384,10 +16412,6 @@ Native cases/steps Test projects use the midscene-test command.`).wrap(yargs().t
             YError: e1
         };
         module.exports = ue;
-    },
-    "../../node_modules/.pnpm/dotenv@16.4.5/node_modules/dotenv/package.json" (module) {
-        "use strict";
-        module.exports = JSON.parse('{"name":"dotenv","version":"16.4.5","description":"Loads environment variables from .env file","main":"lib/main.js","types":"lib/main.d.ts","exports":{".":{"types":"./lib/main.d.ts","require":"./lib/main.js","default":"./lib/main.js"},"./config":"./config.js","./config.js":"./config.js","./lib/env-options":"./lib/env-options.js","./lib/env-options.js":"./lib/env-options.js","./lib/cli-options":"./lib/cli-options.js","./lib/cli-options.js":"./lib/cli-options.js","./package.json":"./package.json"},"scripts":{"dts-check":"tsc --project tests/types/tsconfig.json","lint":"standard","lint-readme":"standard-markdown","pretest":"npm run lint && npm run dts-check","test":"tap tests/*.js --100 -Rspec","test:coverage":"tap --coverage-report=lcov","prerelease":"npm test","release":"standard-version"},"repository":{"type":"git","url":"git://github.com/motdotla/dotenv.git"},"funding":"https://dotenvx.com","keywords":["dotenv","env",".env","environment","variables","config","settings"],"readmeFilename":"README.md","license":"BSD-2-Clause","devDependencies":{"@definitelytyped/dtslint":"^0.0.133","@types/node":"^18.11.3","decache":"^4.6.1","sinon":"^14.0.1","standard":"^17.0.0","standard-markdown":"^7.1.0","standard-version":"^9.5.0","tap":"^16.3.0","tar":"^6.1.11","typescript":"^4.8.4"},"engines":{"node":">=12"},"browser":{"fs":false}}');
     }
 };
 var __webpack_module_cache__ = {};