@oracle-agent/oracle 0.24.2 → 0.24.4

package/dist/cli/commands/setup.mjs

@@ -2,10 +2,10 @@ import{spawnSync as bt}from"node:child_process";import{stdin as O,stdout as be}f
 `)+`
 `}import S from"node:fs";import ze from"node:os";import ee from"node:path";import M from"node:fs";import De from"node:os";import A from"node:path";import{fileURLToPath as Me}from"node:url";var Ne=A.dirname(Me(import.meta.url)),Dt=A.resolve(Ne,"../..");function H(){return process.env.ORACLE_FAKE_HOME||De.homedir()}function Ke(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function k(){return Ke()?process.env.ORACLE_CONFIG_DIR||A.join(H(),".config","oracle"):A.join(H(),".config","oracle")}function Fe(){return A.join(k(),"desk.json")}function He(){return A.join(k(),"env")}function R({force:e=!1}={}){if(R._done&&!e)return R._result||null;R._done=!0;let t={},r=(n,s)=>{if(s==null)return;let i=String(s).trim();i&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=i,t[n]=i))};try{let n=He();if(M.existsSync(n))for(let s of M.readFileSync(n,"utf8").split(/\r?\n/)){let i=s.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!i||i[2].startsWith("#"))continue;let a=i[2];(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),r(i[1],a)}}catch{}try{let n=Fe();if(M.existsSync(n)){let s=JSON.parse(M.readFileSync(n,"utf8"));s&&typeof s=="object"&&(r("ORACLE_DESK_URL",s.deskUrl||s.dataUrl||s.url),r("ORACLE_DATA_URL",s.dataUrl||s.deskUrl||s.url),r("ORACLE_API_URL",s.apiUrl||s.dataUrl||s.deskUrl),r("ORACLE_PUBLIC_URL",s.publicUrl||s.deskUrl||s.dataUrl),r("ORACLE_EXEC_URL",s.execUrl),r("MAD_DESK_URL",s.deskUrl||s.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),R._result=Object.keys(t).length?t:null,R._result}try{R()}catch{}function N(){return process.env.HERMES_HOME?A.resolve(process.env.HERMES_HOME):A.join(H(),".hermes")}function _(e){return M.mkdirSync(e,{recursive:!0}),e}var qe=/(TOKEN|SECRET|PASSWORD|KEY|AUTH|PRIVATE|MNEMONIC|SEED)/i;function z(e="oracle"){return ee.join(N(),"profiles",e,".env")}function Be(e){let t={};for(let r of String(e||"").split(/\r?\n/)){let o=r.trim();if(!o||o.startsWith("#"))continue;let n=o.indexOf("=");if(n<=0)continue;let s=o.slice(0,n).trim(),i=o.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),t[s]=i}return t}function We(e="oracle"){let t=z(e);return S.existsSync(t)?Be(S.readFileSync(t,"utf8")):{}}function ge(e,t,r){if(!t||qe.test(t)===!1&&/[^A-Z0-9_]/.test(t),!/^[A-Z][A-Z0-9_]*$/.test(t)){let f=new Error(`invalid env key '${t}'`);throw f.code="BAD_KEY",f}if(r==null||String(r).trim()===""){let f=new Error(`empty value for ${t}`);throw f.code="EMPTY",f}let o=z(e);_(ee.dirname(o));let n=S.existsSync(o)?S.readFileSync(o,"utf8"):"",s=n?n.split(/\r?\n/):[],i=[],a=!1,c=`${t}=${String(r)}`;for(let f of s)f.startsWith(`${t}=`)?(i.push(c),a=!0):(f.length||i.length)&&i.push(f);for(a||(i.length&&i[i.length-1]!==""&&i.push(""),i.push(c));i.length&&i[i.length-1]==="";)i.pop();i.push(""),S.writeFileSync(o,i.join(`
 `),{mode:384});try{S.chmodSync(o,384)}catch{}return{path:o,key:t,set:!0}}function q(e="oracle"){let t=We(e),r={};for(let o of F()){if(!o.required.length){r[o.key]="manual";continue}let n=o.required.filter(s=>!String(t[s]||"").trim());r[o.key]=n.length?"unset":"ready"}return{profile:e,statuses:r,envPath:z(e)}}function B(e="oracle"){let{statuses:t}=q(e);return me({profile:e,statuses:t})}function ye(e,t,r,o={}){let n=D(t);if(!n){let i=new Error(`unknown platform '${t}'`);throw i.code="UNKNOWN_PLATFORM",i}if(!n.required.length){let i=new Error(`${n.key} uses hermes interactive setup (oracle setup messaging)`);throw i.code="NEEDS_INTERACTIVE",i}let s=n.required[0];ge(e,s,r);for(let[i,a]of Object.entries(o||{}))a!=null&&String(a).trim()&&ge(e,i,a);return{platform:n.key,set:n.required,profile:e,path:z(e)}}function Ve(){return ee.join(k(),"setup-state.json")}function W(e={}){_(k());let t=Ve(),r={};if(S.existsSync(t))try{r=JSON.parse(S.readFileSync(t,"utf8"))}catch{r={}}let o={...r,...e,updatedAt:new Date().toISOString(),host:ze.hostname()};return S.writeFileSync(t,JSON.stringify(o,null,2)+`
-`,{mode:384}),o}import ve from"node:fs";import L from"node:path";var Je="0.19.0",Jt=`hermes-agent==${Je}`;var we="0.12.1",Gt=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${we}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${we}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Ge(){return L.join(k(),"runtime")}function Ye(){return L.join(Ge(),"venv")}function Xe(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return L.join(Ye(),t,r)}function Ze(){return Xe("hermes")}function Qe(e){let t=process.platform==="win32"&&!L.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(L.delimiter))if(r)for(let o of t){let n=L.join(r,`${e}${o}`);try{if(ve.existsSync(n))return n}catch{}}return null}function ke(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=Ze();if(ve.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=Qe("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as et,randomBytes as oe,timingSafeEqual as tt}from"node:crypto";import w from"node:fs";import x from"node:path";import rt from"node:readline/promises";import{spawn as ot,spawnSync as nt}from"node:child_process";var I=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.5",protocol:"responses"}}),st=12e4;function it(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function b(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(I))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function K(e){let t=b(e);return{id:t,...I[t]}}function g(e,t={}){if(!w.existsSync(e))return t;try{let r=JSON.parse(w.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function xe(e){_(e),process.platform!=="win32"&&w.chmodSync(e,448)}function E(e,t){xe(x.dirname(e));let r=`${e}.${process.pid}.${oe(4).toString("hex")}.tmp`;w.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),o}import ve from"node:fs";import L from"node:path";var Je="0.19.0",Jt=`hermes-agent==${Je}`;var we="0.12.1",Gt=Object.freeze({posix:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${we}/uv-installer.sh`,sha256:"d3f5412d38c99f9d024901843bf98206f0d2c6dbe64df40d0b740e2751ca62c1"}),windows:Object.freeze({url:`https://github.com/astral-sh/uv/releases/download/${we}/uv-installer.ps1`,sha256:"b9ec035151bfbb11d616dbd69886498d885551489eddf095ea3c0ad59f640eb0"})});function Ge(){return L.join(k(),"runtime")}function Ye(){return L.join(Ge(),"venv")}function Xe(e){let t=process.platform==="win32"?"Scripts":"bin",r=process.platform==="win32"?`${e}.exe`:e;return L.join(Ye(),t,r)}function Ze(){return Xe("hermes")}function Qe(e){let t=process.platform==="win32"&&!L.extname(e)?["",".exe",".cmd",".bat"]:[""];for(let r of(process.env.PATH||"").split(L.delimiter))if(r)for(let o of t){let n=L.join(r,`${e}${o}`);try{if(ve.existsSync(n))return n}catch{}}return null}function ke(){if(process.env.ORACLE_HERMES_BIN)return{ok:!0,bin:process.env.ORACLE_HERMES_BIN,source:"env"};let e=Ze();if(ve.existsSync(e))return{ok:!0,bin:e,source:"managed"};let t=Qe("hermes");return t?{ok:!0,bin:t,source:"path"}:{ok:!1,bin:null,source:null}}import{createHash as et,randomBytes as oe,timingSafeEqual as tt}from"node:crypto";import w from"node:fs";import x from"node:path";import rt from"node:readline/promises";import{spawn as ot,spawnSync as nt}from"node:child_process";var I=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),st=12e4;function it(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function b(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(I))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function K(e){let t=b(e);return{id:t,...I[t]}}function g(e,t={}){if(!w.existsSync(e))return t;try{let r=JSON.parse(w.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function xe(e){_(e),process.platform!=="win32"&&w.chmodSync(e,448)}function E(e,t){xe(x.dirname(e));let r=`${e}.${process.pid}.${oe(4).toString("hex")}.tmp`;w.writeFileSync(r,`${JSON.stringify(t,null,2)}
 `,{mode:384}),w.renameSync(r,e),process.platform!=="win32"&&w.chmodSync(e,384)}function at(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function te(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function $(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function ct(e={}){let t=e.file||x.join(k(),"oauth.json"),r=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),o=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),s=e.spawnFn||nt,i=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&at(s),a=i?"linux-secret-service":"private-file",c=`${t}.lock`;async function f(h){xe(x.dirname(c));let d;for(let u=0;u<400;u+=1)try{d=w.openSync(c,"wx",384);break}catch(l){if(l?.code!=="EEXIST")throw l;try{Date.now()-w.statSync(c).mtimeMs>3e5&&w.unlinkSync(c)}catch{}await new Promise(p=>setTimeout(p,25))}if(d===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await h()}finally{try{w.closeSync(d)}catch{}try{w.unlinkSync(c)}catch{}}}function y(h,d="oauth"){return["application","oracle","kind",d,"provider",h]}function j(h){if(!w.existsSync(o))return null;let u=g(o,{providers:{}}).providers?.[h];if(!Array.isArray(u))return null;let l=[];for(let p of u)if(x.isAbsolute(String(p||"")))try{let m=g(p,{});if(h==="anthropic-oauth"&&m.claudeAiOauth){let T=$(m.claudeAiOauth);l.push({...T,refreshToken:"",source:"external-access-only"});continue}let v=m.credential_pool&&typeof m.credential_pool=="object"?m.credential_pool:null;if(v){let T=v[h]||v[h.replace(/-oauth$/,"")]||[],Ue=Array.isArray(T)?T:T?[T]:[];for(let Z of Ue)if(!(!Z||typeof Z!="object"))try{let je=$(Z);l.push({...je,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return l.length?l.find(p=>!p.expiresAt||p.expiresAt>n()+st)||l[0]:null}function de(h){let d=b(h);if(i){let p=s("secret-tool",["lookup",...y(d)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!p.error&&p.status===0&&String(p.stdout||"").trim())try{return $(JSON.parse(String(p.stdout).trim()))}catch{}return j(d)}let l=g(t,{providers:{}}).providers?.[d];if(l)try{return $(l)}catch{}return j(d)}function Re(h,d){let u=b(h),l=$(d);if(i){let m=s("secret-tool",["store",`--label=Oracle ${u} OAuth`,...y(u)],{input:JSON.stringify(l),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(m.error||m.status!==0)throw new Error("OS credential store rejected OAuth credential");let v=g(r,{providers:{}});return v.providers||={},v.providers[u]={expiresAt:l.expiresAt,source:l.source},E(r,v),l}let p=g(t,{providers:{}});return p.providers||={},p.providers[u]=l,E(t,p),l}function Le(h){let d=b(h);if(i){let p=s("secret-tool",["clear",...y(d)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),m=g(r,{providers:{}});return m.providers&&delete m.providers[d],E(r,m),!p.error&&p.status===0}let u=g(t,{providers:{}}),l=!!u.providers?.[d];return u.providers&&delete u.providers[d],E(t,u),l}function fe(h){let d=te(h);if(i){let u=s("secret-tool",["lookup",...y(d,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(g(t,{apiKeys:{}}).apiKeys?.[d]||"").trim()}function $e(h,d){let u=te(h),l=String(d||"").trim();if(!l)throw new Error("API key is empty");if(i){let m=s("secret-tool",["store",`--label=Oracle ${u} API key`,...y(u,"api-key")],{input:l,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(m.error||m.status!==0)throw new Error("OS credential store rejected API key");let v=g(r,{providers:{},apiKeys:{}});return v.apiKeys||={},v.apiKeys[u]={configured:!0},E(r,v),!0}let p=g(t,{providers:{},apiKeys:{}});return p.apiKeys||={},p.apiKeys[u]=l,E(t,p),!0}function Ie(h){let d=te(h);if(i){let p=s("secret-tool",["clear",...y(d,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),m=g(r,{providers:{},apiKeys:{}});return m.apiKeys&&delete m.apiKeys[d],E(r,m),!p.error&&p.status===0}let u=g(t,{providers:{},apiKeys:{}}),l=!!u.apiKeys?.[d];return u.apiKeys&&delete u.apiKeys[d],E(t,u),l}function Ce(){let h={},d={};if(i){let u=g(r,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))h[l]={loggedIn:!!de(l),expiresAt:Number(p.expiresAt||0),source:String(p.source||"oracle"),storage:a};for(let l of Object.keys(u.apiKeys||{}))d[l]={configured:!!fe(l),storage:a}}else{let u=g(t,{providers:{},apiKeys:{}});for(let[l,p]of Object.entries(u.providers||{}))h[l]={loggedIn:!!p?.accessToken,expiresAt:Number(p?.expiresAt||0),source:String(p?.source||"oracle"),storage:a};for(let[l,p]of Object.entries(u.apiKeys||{}))d[l]={configured:!!p,storage:a}}for(let u of Object.keys(I)){if(h[u])continue;let l=j(u);l&&(h[u]={loggedIn:!0,expiresAt:l.expiresAt,source:l.source,storage:"external-access-source"})}return{storage:a,providers:h,apiKeys:d}}return Object.freeze({file:t,storage:a,get:de,set:Re,remove:Le,getApiKey:fe,setApiKey:$e,removeApiKey:Ie,status:Ce,withLock:f})}var Se;function C(){return Se||=ct(),Se}function re(e){return Buffer.from(e).toString("base64url")}function ut(){let e=re(oe(32));return{verifier:e,challenge:re(et("sha256").update(e).digest()),state:re(oe(24))}}function lt(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&tt(r,o)}function pt(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return ot(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function ne(e){return new URLSearchParams(e).toString()}async function P(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function dt(e){if(e)return String(await e()).trim();let t=rt.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function se(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return $({accessToken:r,refreshToken:o,expiresAt:it(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function ft(e){let t=I["anthropic-oauth"],r=e.pkce||ut(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let s=await dt(e.inputFn),[i,a]=s.split("#",2);if(!i||!lt(a,r.state))throw new Error("Claude OAuth state mismatch");let c=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:i,state:a,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return se(await P(c,"Claude OAuth token exchange"),e)}async function ht(e){let t=I["openai-codex"],r=await P(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),s;for(let a=0;a<Math.ceil(900/n);a+=1){await e.sleepFn(n*1e3);let c=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(c.ok){s=await P(c,"Codex device authorization");break}if(![403,404].includes(c.status))throw new Error(`Codex device authorization failed (HTTP ${c.status})`)}if(!s)throw new Error("Codex device authorization timed out");let i=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:ne({grant_type:"authorization_code",code:s.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:s.code_verifier})});return se(await P(i,"Codex OAuth token exchange"),e)}function V(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function mt(e){let t=I["xai-oauth"],r=await P(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");V(r.authorization_endpoint);let o=V(r.token_endpoint),n=await P(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let s=V(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${s}`),e.output(`Code: ${n.user_code}`),e.openFn(s);let i=Math.max(1,Number(n.interval||5)),a=Math.ceil(Math.max(1,Number(n.expires_in||600))/i);for(let c=0;c<a;c+=1){let f=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:ne({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(f.ok){let j=await P(f,"xAI OAuth token exchange");return se(j,{...e,discovery:{authorization_endpoint:V(r.authorization_endpoint),token_endpoint:o}})}let y="";try{y=String((await f.json())?.error||"")}catch{}if(y==="slow_down")await e.sleepFn((i+1)*1e3);else if(y==="authorization_pending")await e.sleepFn(i*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${f.status}${y?`, ${y}`:""})`)}throw new Error("xAI device authorization timed out")}async function Ae(e,t={}){let r=b(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(s=>setTimeout(s,n))),openFn:t.openFn||pt,output:t.output||(n=>process.stdout.write(`${n}
 `)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?ft(o):r==="openai-codex"?ht(o):mt(o)}import Y from"node:fs";import ie from"node:path";var gt=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","custom","anthropic-oauth","openai-codex","xai-oauth"]);function J(e){return String(e||"").trim()||void 0}function yt(e,{required:t=!1}={}){let r=J(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!gt.has(r))throw new Error(`unsupported provider: ${r}`);return r}function wt(e,{required:t=!1}={}){let r=J(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function vt(e){let t=J(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function G({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=yt(e),s=wt(t,{required:o});if(n==="custom")return{provider:n,...s?{model:s}:{},baseUrl:vt(r)};if(J(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...s?{model:s}:{}}}var kt=new Set(["auto","standalone","hermes","remote","arch"]);function St(){return ie.join(k(),"model.json")}function U(e){return String(e||"").trim()||void 0}function xt(e={}){let t=U(e.backend)?.toLowerCase()||"auto",r=G({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=U(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),s=U(e.reasoningEffort),i=U(e.computeHost||e.remoteHost),a=U(e.computeUser||e.remoteUser),c=U(e.computePath||e.remotePath);if(!kt.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!i)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...s?{reasoningEffort:s}:{},...i?{computeHost:i}:{},...a?{computeUser:a}:{},...c?{computePath:c}:{}}}function _e(e){let t=xt(e),r=St();_(ie.dirname(r)),process.platform!=="win32"&&Y.chmodSync(ie.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return Y.writeFileSync(o,`${JSON.stringify(t,null,2)}
-`,{mode:384}),Y.renameSync(o,r),process.platform!=="win32"&&Y.chmodSync(r,384),t}var Ee=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.5"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},custom:{model:""}});function ae(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function At(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function _t(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`,{mode:384}),Y.renameSync(o,r),process.platform!=="win32"&&Y.chmodSync(r,384),t}var Ee=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},custom:{model:""}});function ae(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function At(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function _t(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",s),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
 `)},s=i=>{let a=String(i);for(let c of a){if(c==="\r"||c===`
 `){n(),t(o.trim());return}if(c===""){n(),r(new Error("cancelled"));return}c==="\x7F"||c==="\b"?o=o.slice(0,-1):o+=c}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",s)})}function ce(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...G({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function Oe(e,t,r={}){return _e(ce(e,t,r))}function Et(e){process.stdout.write(`storage: ${e.storage}
 `);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured