@oracle-agent/oracle 0.35.32 → 0.35.34

package/dist/assets/skills/oracle-desk-product/SKILL.md

@@ -97,7 +97,7 @@ does not prove npm users receive it. A locally hosted model/data/policy loop doe
 a bundled signer. A merged feature is not public until the npm artifact containing it is
 published and inspected.
 
-**Candidate release in this source tree:** public package `@oracle-agent/oracle@0.35.32`
+**Candidate release in this source tree:** public package `@oracle-agent/oracle@0.35.34`
 ships the encrypted local vault + short-lived loopback signer. Hosted/keyless
 Oracle cannot hold keys or move funds. Self-hosting with `oracle sign init` or
 `oracle sign import --kind evm --key-file <0600 file>` writes an encrypted vault and marks

package/dist/bin/oracle-gateway.mjs

@@ -27,7 +27,7 @@ Native harness only.`}function _t(){let t=q(),e=["Oracle native models (tap /mod
 `),null;let h=Lt(n);if(h)return It(h,i);let g=Ut(n);if(g)try{return g.action==="list"?_t():g.action==="show"?Ue():g.action==="usage"?_t():Jn(g)}catch(y){return`model not saved: ${y.message}`}let k=Dt(n);if(k)try{return k.action==="show"?Ue():k.action==="usage"?"usage: /effort low|medium|high":Xn(k.reasoningEffort)}catch(y){return`effort not saved: ${y.message}`}if(jt(n))return to();if(Bt(n))return ro();let v=Ft(n);if(v){if(v.action==="show"){let y=qt();return y?.goal?`goal ${y.goal}`:"goal unset \u2014 /goal <objective>"}return v.action==="clear"?(eo(),"goal cleared"):(Zn(v.goal),`goal pinned: ${v.goal}`)}let x=Ht(n);if(x){let y=x.focus?` Focus: ${x.focus}.`:"";return Et({platform:t,chatId:e,senderId:r,text:`Compact this session context now.${y} Summarize older turns, keep the current goal, model, chain, and any pending unsigned prepare artifacts. Do not sign or broadcast.`,userName:o,persona:d,backend:p,profile:m})}let A=Gt(n);if(A){if(A.action==="list")return ht({selectedKey:Le()?.key||null});let y=ee(A.chain);return y?(yt(y.key),`chain ${y.key}`):`unknown chain '${A.chain}' \u2014 /chain list`}if($e(n)){let y=await Ce({platform:t,text:n,grant:{local:!0}});return y?y.buttons?.kind==="inline_keyboard"?{text:y.text,replyMarkup:y.buttons.replyMarkup}:y.text:null}if(c){let y=Wt(n);if(y){let I=await c.send({from:s||"oracle",to:y.peer,text:y.text,kind:"consult"});return I.ok?I.reply?`[${y.peer}] ${I.reply}`:`[${y.peer}] (no reply)`:I.error}if(/^\/(agents|roster)\b/i.test(String(n||"").trim())){let I=c.roster().map(X=>`\u2022 ${X.name}${X.role?` \u2014 ${X.role}`:""}${X.chains.length?` (${X.chains.join(", ")})`:""}`);return I.length?`Agents on the bus:
 ${I.join(`
 `)}`:"No peer agents registered."}}let xr=n.toLowerCase().trim();return/\b(buy|sell|swap|bridge|send|transfer|balance|portfolio|watch|quote|price)\b/.test(xr)?oo({platform:t,chatId:e,senderId:r,text:n,userName:o}):Et({platform:t,chatId:e,senderId:r,text:n,userName:o,persona:d,backend:p,profile:m})}function Vt(t,{timeout:e=12e4}={}){return new Promise(r=>{let n=Ot(process.execPath,[Kn,...t],{stdio:["ignore","pipe","pipe"],timeout:e,env:{...process.env,ORACLE_CONFIG_DIR:je}}),o="",a="";n.stdout.on("data",i=>o+=i.toString()),n.stderr.on("data",i=>a+=i.toString()),n.on("close",i=>r({code:i,out:o.trim(),err:a.trim()}))})}function no(t,e,{timeout:r=18e4}={}){return new Promise(n=>{let o=Ot(t,e,{stdio:["ignore","pipe","pipe"],timeout:r,env:{...process.env}}),a="",i="";o.on("error",l=>n({code:127,out:"",err:String(l.message)})),o.stdout.on("data",l=>a+=l.toString()),o.stderr.on("data",l=>i+=l.toString()),o.on("close",l=>n({code:l,out:a.trim(),err:i.trim()}))})}async function oo({text:t,chatId:e}){let r=await Vt(["route","swap","--text",t],{timeout:3e4});if(r.code===0&&r.out)try{return ao(JSON.parse(r.out),{chatId:e})}catch{return r.out}return`Trade routing failed. Try: \`${t}\` again.`}async function Et({text:t,persona:e,backend:r,profile:n}){let o=e?`[your role: ${e}]
-${t}`:t;return Kt({text:o,backend:r,profile:n,unconfiguredPrefix:"Oracle is not configured yet: "})}async function Kt({text:t,backend:e,profile:r,unconfiguredPrefix:n}){let o=zt(e,t,{profile:r});if(!o.ok)return`${n}${o.error}`;if(!o.bin){let i=Pt();if(!i.ok)return`${n}${i.error}`;let l=await Vt(o.args);return l.code===0&&l.out?l.out:l.err||"Oracle could not answer that. Try again."}let a=await no(o.bin,o.args);return a.code===0&&a.out?a.out:/ENOENT/.test(a.err)?`${n}backend '${o.bin}' is not installed on this machine`:a.err||`${o.bin} could not answer that. Try again.`}function ao(t,{chatId:e}={}){if(t.error)return`\u274C ${t.error}`;let r=t.quote||t.portfolio||(t.tx?"Unsigned trade prepared. Sign from your own wallet.":"");if(!r&&!t.tx)return JSON.stringify(t,null,2);let n=Ct({id:String(t.artifactId||`trade-${Date.now().toString(36)}`).toLowerCase().slice(0,40),kind:t.tx?"prepared_action":t.quote?"strategy":"thesis",title:t.tx?"Prepared trade":t.quote?"Quote":"Desk update",summary:r,payload:t},{grant:{local:!0}});return e&&Pe(n.state,{chatId:e,artifactId:n.artifact.id}),de(re(),n.state),{text:n.text,replyMarkup:n.replyMarkup}}var je,Kn,V,Mt,Yn,Y=w(()=>{Xe();_e();ut();Re();wt();Me();je=process.env.ORACLE_CONFIG_DIR||De(Hn(),".config","oracle");Kn=Rt();V="Oracle is self-hostable. Install your own instance: npm install -g @oracle-agent/oracle";Mt=Object.freeze({claude:{provider:"anthropic-oauth",model:"claude-sonnet-4-20250514"},anthropic:{provider:"anthropic",model:"claude-sonnet-4-6"},codex:{provider:"openai-codex",model:"gpt-5.4"},openai:{provider:"openai",model:"gpt-4.1-mini"},grok:{provider:"xai-oauth",model:"grok-4.6"},xai:{provider:"xai",model:"grok-4.6"},openrouter:{provider:"openrouter",model:"openrouter/auto"},nous:{provider:"nous",model:"moonshotai/kimi-k3"},deepseek:{provider:"deepseek",model:"deepseek-chat"},gemini:{provider:"gemini",model:"gemini-2.5-flash"},kimi:{provider:"kimi",model:"kimi-k3"},mistral:{provider:"mistral",model:"mistral-large-latest"},qwen:{provider:"qwen",model:"qwen-plus"},glm:{provider:"glm",model:"glm-4.5"},local:{provider:"local",model:"Qwen3-8B-Q4_K_M"},llama:{provider:"local",model:"Qwen3-8B-Q4_K_M"},ollama:{provider:"ollama",model:"llama3.2"}}),Yn=Object.freeze(["low","medium","high"])});function so(t,e){let r=new Set,n=[];for(let o of Array.isArray(t)?t:[]){let a=typeof o?.digest=="string"?o.digest:null;a&&(r.add(a),e.has(a)||n.push(o))}e.clear();for(let o of r)e.add(o);return n}function Jt({onNew:t,intervalMs:e=io,env:r=process.env,signerCall:n=T,setIntervalFn:o=setInterval,clearIntervalFn:a=clearInterval}={}){if(typeof t!="function")throw new Error("pending-watch: onNew callback required");let i=new Set,l=!1,c=!1;async function s(){if(!c){c=!0;try{let p=await n("/pending",{env:r});if(!p||p.ok===!1||p.error||!Array.isArray(p.items))return;let m=so(p.items,i);if(!l){l=!0;return}if(m.length===0)return;try{await t(m,{armed:p.armed===!0})}catch{}}catch{}finally{c=!1}}}let d=o(s,e);return typeof d?.unref=="function"&&d.unref(),{stop(){a(d)},tick:s}}var io,Xt=w(()=>{ce();io=4e3});import D from"node:fs";function co(t){if(!t.isFile())throw new Error("local-vault: secret source must be a regular file");if(t.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(t.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((t.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function Qt(t){let e;try{e=D.openSync(t,D.constants.O_RDONLY|D.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=D.fstatSync(e);if(co(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let n=D.lstatSync(t);if(n.isSymbolicLink()||n.dev!==r.dev||n.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return D.readFileSync(e,"utf8").replace(/[\r\n]+$/,"")}finally{D.closeSync(e)}}var ai,ii,si,Zt=w(()=>{ai=Object.freeze({N:1<<17,r:8,p:1}),ii=256*1024*1024,si=16*1024});import{createHash as lo,createHmac as er,randomBytes as uo,timingSafeEqual as po}from"node:crypto";function nr({keyFile:t,approvedTelegramOwners:e,nowMs:r=Date.now}={}){if(!t)throw new Error("cex owner proof: signer policy key required");let n=new Set((e||[]).map(J).filter(Boolean));if(!n.size)throw new Error("cex owner proof: approved owner context required");let o=new Set,a=l=>{let c=Buffer.from(Qt(t));try{return l(c)}finally{c.fill(0)}},i=a(l=>lo("sha256").update("cex-owner-instance\0").update(l).digest("hex"));return Object.freeze({mint({digest:l,senderId:c,chatId:s,platform:d,ttlMs:p=15e3}={}){let m=J(c),h=J(s),g=r();if(d!=="telegram"||!m||h!==m||!n.has(m))throw new Error("cex owner proof: exact Telegram owner DM required");if(!/^[0-9a-f]{64}$/.test(String(l||""))||!Number.isSafeInteger(p)||p<1||p>3e4)throw new Error("cex owner proof: binding refused");let k={version:1,decision:"Allow",digest:l,ownerSenderId:m,telegramChatId:h,audience:tr,instance:i,nonce:uo(16).toString("hex"),issuedAtMs:g,expiresAtMs:g+p},v=a(x=>er("sha256",x).update(rr(k)).digest("hex"));return{claims:k,mac:v}},verify(l,{digest:c}={}){let s=l?.claims,d=r();if(!s||s.version!==1||s.decision!=="Allow"||s.digest!==c||s.audience!==tr||s.instance!==i||!/^[0-9a-f]{32}$/.test(s.nonce||"")||J(s.ownerSenderId)!==J(s.telegramChatId)||!n.has(J(s.ownerSenderId))||!Number.isSafeInteger(s.issuedAtMs)||!Number.isSafeInteger(s.expiresAtMs)||s.expiresAtMs<=d||s.issuedAtMs>d||s.expiresAtMs-s.issuedAtMs>3e4||o.has(s.nonce))return!1;let p=a(m=>er("sha256",m).update(rr(s)).digest("hex"));return mo(l.mac,p)?(o.add(s.nonce),!0):!1}})}var tr,J,rr,mo,or=w(()=>{Zt();tr="oracle-local-signer-cex-owner-allow-v1",J=t=>/^(?:0|[1-9]\d{0,19})$/.test(String(t||""))?String(t):null,rr=t=>JSON.stringify(t),mo=(t,e)=>{let r=Buffer.from(String(t)),n=Buffer.from(String(e));return r.length===n.length&&po(r,n)}});var cr={};j(cr,{buildPersona:()=>K,telegram:()=>ho,telegramPendingRecipients:()=>sr});import{join as ar}from"node:path";import{homedir as fo}from"node:os";function pe(t=process.env){return St(re(t)),ue()}function ir(t=process.env){de(re(t),ue())}function sr({extraOwners:t,env:e=process.env}={}){let r=String(e.ORACLE_OWNER_TELEGRAM||"").split(",").map(o=>o.trim()).filter(Boolean),n=Array.isArray(t)?t.map(o=>String(o).trim()):[];return[...new Set([...r,...n])].filter(o=>/^\d+$/.test(o))}function Fe(t,e){if(!e)return;if(typeof e=="string")return t.reply(e,{parse_mode:"Markdown"});let r=e.replyMarkup?{reply_markup:e.replyMarkup}:{};return t.reply(e.text,{parse_mode:"Markdown",...r})}async function ho(t){let{Bot:e}=await import("grammy");pe();let r=new e(t.token),n=String(t.name||"oracle").toLowerCase(),o=K(t),a=Array.isArray(t.owners)?t.owners:void 0,i=t.bus;i&&i.register(n,{role:t.role||"",chains:t.chains||[],handler:s=>oe({from:s.from,text:s.text,persona:o,backend:t.backend,profile:t.hermesProfile})}),r.command("start",s=>{let d=String(s.from?.id||s.chat.id);if(!z({platform:"telegram",senderId:d,extraOwners:a}))return s.reply(V);let p=String(s.match||"").trim();if(p){let m=pe(),h=$t(m,{token:p,telegramUserId:d});return ir(),h.ok?s.reply("Telegram linked to Oracle. Agent artifacts will land as interactive cards. Deepen stays in this thread."):s.reply(`Link failed: ${h.error}`)}return s.reply(`${n} ready. /help lists every native command. /model lists models. /setup model adds OpenRouter, Nous Portal, Qwen, GLM. /effort sets reasoning. /update installs latest.${i?" /agents lists peers.":""}`)}),r.command("update",async s=>{let d=String(s.from?.id||s.chat.id),p=String(s.chat.id);if(!z({platform:"telegram",senderId:d,extraOwners:a}))return s.reply(V);if(s.message.forward_origin||s.message.forward_from||s.message.forward_date)return;s.replyWithChatAction("typing").catch(()=>{});let m=await O({platform:"telegram",chatId:p,senderId:d,text:s.match?`update ${s.match}`.trim():"update",userName:s.from?.username||s.from?.first_name||"user"});if(m)return Fe(s,m)}),r.on("message:text",async s=>{let d=String(s.chat.id),p=String(s.from?.id||d),m=s.message.text;try{s.replyWithChatAction("typing").catch(()=>{});let h=pe(),g=vt(h,{chatId:d,text:m}),k=await O({platform:"telegram",chatId:d,senderId:p,text:g||m,userName:s.from?.username||s.from?.first_name||"user",extraOwners:a,bus:i,agentName:n,persona:o,backend:t.backend,profile:t.hermesProfile,meta:{forward_origin:s.message.forward_origin,forward_from:s.message.forward_from,forward_from_chat:s.message.forward_from_chat,forward_sender_name:s.message.forward_sender_name,forward_date:s.message.forward_date}});k&&await Fe(s,k)}catch(h){process.stderr.write(`telegram-gateway[${n}]: ${h.message}
+${t}`:t;return Kt({text:o,backend:r,profile:n,unconfiguredPrefix:"Oracle is not configured yet: "})}async function Kt({text:t,backend:e,profile:r,unconfiguredPrefix:n}){let o=zt(e,t,{profile:r});if(!o.ok)return`${n}${o.error}`;if(!o.bin){let i=Pt();if(!i.ok)return`${n}${i.error}`;let l=await Vt(o.args);return l.code===0&&l.out?l.out:l.err||"Oracle could not answer that. Try again."}let a=await no(o.bin,o.args);return a.code===0&&a.out?a.out:/ENOENT/.test(a.err)?`${n}backend '${o.bin}' is not installed on this machine`:a.err||`${o.bin} could not answer that. Try again.`}function ao(t,{chatId:e}={}){if(t.error)return`\u274C ${t.error}`;let r=t.quote||t.portfolio||(t.tx?"Unsigned trade prepared. Sign from your own wallet.":"");if(!r&&!t.tx)return JSON.stringify(t,null,2);let n=Ct({id:String(t.artifactId||`trade-${Date.now().toString(36)}`).toLowerCase().slice(0,40),kind:t.tx?"prepared_action":t.quote?"strategy":"thesis",title:t.tx?"Prepared trade":t.quote?"Quote":"Desk update",summary:r,payload:t},{grant:{local:!0}});return e&&Pe(n.state,{chatId:e,artifactId:n.artifact.id}),de(re(),n.state),{text:n.text,replyMarkup:n.replyMarkup}}var je,Kn,V,Mt,Yn,Y=w(()=>{Xe();_e();ut();Re();wt();Me();je=process.env.ORACLE_CONFIG_DIR||De(Hn(),".config","oracle");Kn=Rt();V="Oracle is self-hostable. Install your own instance: npm install -g @oracle-agent/oracle";Mt=Object.freeze({claude:{provider:"anthropic-oauth",model:"claude-sonnet-4-20250514"},anthropic:{provider:"anthropic",model:"claude-sonnet-4-6"},codex:{provider:"openai-codex",model:"gpt-5.6-sol"},openai:{provider:"openai",model:"gpt-4.1-mini"},grok:{provider:"xai-oauth",model:"grok-4.6"},xai:{provider:"xai",model:"grok-4.6"},openrouter:{provider:"openrouter",model:"openrouter/auto"},nous:{provider:"nous",model:"moonshotai/kimi-k3"},deepseek:{provider:"deepseek",model:"deepseek-chat"},gemini:{provider:"gemini",model:"gemini-2.5-flash"},kimi:{provider:"kimi",model:"kimi-k3"},mistral:{provider:"mistral",model:"mistral-large-latest"},qwen:{provider:"qwen",model:"qwen-plus"},glm:{provider:"glm",model:"glm-4.5"},local:{provider:"local",model:"Qwen3-8B-Q4_K_M"},llama:{provider:"local",model:"Qwen3-8B-Q4_K_M"},ollama:{provider:"ollama",model:"llama3.2"}}),Yn=Object.freeze(["low","medium","high"])});function so(t,e){let r=new Set,n=[];for(let o of Array.isArray(t)?t:[]){let a=typeof o?.digest=="string"?o.digest:null;a&&(r.add(a),e.has(a)||n.push(o))}e.clear();for(let o of r)e.add(o);return n}function Jt({onNew:t,intervalMs:e=io,env:r=process.env,signerCall:n=T,setIntervalFn:o=setInterval,clearIntervalFn:a=clearInterval}={}){if(typeof t!="function")throw new Error("pending-watch: onNew callback required");let i=new Set,l=!1,c=!1;async function s(){if(!c){c=!0;try{let p=await n("/pending",{env:r});if(!p||p.ok===!1||p.error||!Array.isArray(p.items))return;let m=so(p.items,i);if(!l){l=!0;return}if(m.length===0)return;try{await t(m,{armed:p.armed===!0})}catch{}}catch{}finally{c=!1}}}let d=o(s,e);return typeof d?.unref=="function"&&d.unref(),{stop(){a(d)},tick:s}}var io,Xt=w(()=>{ce();io=4e3});import D from"node:fs";function co(t){if(!t.isFile())throw new Error("local-vault: secret source must be a regular file");if(t.uid!==process.getuid?.())throw new Error("local-vault: secret source must be owned by this user");if(t.nlink!==1)throw new Error("local-vault: refusing hard-linked secret source");if((t.mode&63)!==0)throw new Error("local-vault: secret source must be owner-only (0600)")}function Qt(t){let e;try{e=D.openSync(t,D.constants.O_RDONLY|D.constants.O_NOFOLLOW)}catch(r){throw r.code==="ELOOP"?new Error("local-vault: refusing symlink"):r}try{let r=D.fstatSync(e);if(co(r),r.size>1024*1024)throw new Error("local-vault: secret source changed or is too large");let n=D.lstatSync(t);if(n.isSymbolicLink()||n.dev!==r.dev||n.ino!==r.ino)throw new Error("local-vault: secret source changed or is too large");return D.readFileSync(e,"utf8").replace(/[\r\n]+$/,"")}finally{D.closeSync(e)}}var ai,ii,si,Zt=w(()=>{ai=Object.freeze({N:1<<17,r:8,p:1}),ii=256*1024*1024,si=16*1024});import{createHash as lo,createHmac as er,randomBytes as uo,timingSafeEqual as po}from"node:crypto";function nr({keyFile:t,approvedTelegramOwners:e,nowMs:r=Date.now}={}){if(!t)throw new Error("cex owner proof: signer policy key required");let n=new Set((e||[]).map(J).filter(Boolean));if(!n.size)throw new Error("cex owner proof: approved owner context required");let o=new Set,a=l=>{let c=Buffer.from(Qt(t));try{return l(c)}finally{c.fill(0)}},i=a(l=>lo("sha256").update("cex-owner-instance\0").update(l).digest("hex"));return Object.freeze({mint({digest:l,senderId:c,chatId:s,platform:d,ttlMs:p=15e3}={}){let m=J(c),h=J(s),g=r();if(d!=="telegram"||!m||h!==m||!n.has(m))throw new Error("cex owner proof: exact Telegram owner DM required");if(!/^[0-9a-f]{64}$/.test(String(l||""))||!Number.isSafeInteger(p)||p<1||p>3e4)throw new Error("cex owner proof: binding refused");let k={version:1,decision:"Allow",digest:l,ownerSenderId:m,telegramChatId:h,audience:tr,instance:i,nonce:uo(16).toString("hex"),issuedAtMs:g,expiresAtMs:g+p},v=a(x=>er("sha256",x).update(rr(k)).digest("hex"));return{claims:k,mac:v}},verify(l,{digest:c}={}){let s=l?.claims,d=r();if(!s||s.version!==1||s.decision!=="Allow"||s.digest!==c||s.audience!==tr||s.instance!==i||!/^[0-9a-f]{32}$/.test(s.nonce||"")||J(s.ownerSenderId)!==J(s.telegramChatId)||!n.has(J(s.ownerSenderId))||!Number.isSafeInteger(s.issuedAtMs)||!Number.isSafeInteger(s.expiresAtMs)||s.expiresAtMs<=d||s.issuedAtMs>d||s.expiresAtMs-s.issuedAtMs>3e4||o.has(s.nonce))return!1;let p=a(m=>er("sha256",m).update(rr(s)).digest("hex"));return mo(l.mac,p)?(o.add(s.nonce),!0):!1}})}var tr,J,rr,mo,or=w(()=>{Zt();tr="oracle-local-signer-cex-owner-allow-v1",J=t=>/^(?:0|[1-9]\d{0,19})$/.test(String(t||""))?String(t):null,rr=t=>JSON.stringify(t),mo=(t,e)=>{let r=Buffer.from(String(t)),n=Buffer.from(String(e));return r.length===n.length&&po(r,n)}});var cr={};j(cr,{buildPersona:()=>K,telegram:()=>ho,telegramPendingRecipients:()=>sr});import{join as ar}from"node:path";import{homedir as fo}from"node:os";function pe(t=process.env){return St(re(t)),ue()}function ir(t=process.env){de(re(t),ue())}function sr({extraOwners:t,env:e=process.env}={}){let r=String(e.ORACLE_OWNER_TELEGRAM||"").split(",").map(o=>o.trim()).filter(Boolean),n=Array.isArray(t)?t.map(o=>String(o).trim()):[];return[...new Set([...r,...n])].filter(o=>/^\d+$/.test(o))}function Fe(t,e){if(!e)return;if(typeof e=="string")return t.reply(e,{parse_mode:"Markdown"});let r=e.replyMarkup?{reply_markup:e.replyMarkup}:{};return t.reply(e.text,{parse_mode:"Markdown",...r})}async function ho(t){let{Bot:e}=await import("grammy");pe();let r=new e(t.token),n=String(t.name||"oracle").toLowerCase(),o=K(t),a=Array.isArray(t.owners)?t.owners:void 0,i=t.bus;i&&i.register(n,{role:t.role||"",chains:t.chains||[],handler:s=>oe({from:s.from,text:s.text,persona:o,backend:t.backend,profile:t.hermesProfile})}),r.command("start",s=>{let d=String(s.from?.id||s.chat.id);if(!z({platform:"telegram",senderId:d,extraOwners:a}))return s.reply(V);let p=String(s.match||"").trim();if(p){let m=pe(),h=$t(m,{token:p,telegramUserId:d});return ir(),h.ok?s.reply("Telegram linked to Oracle. Agent artifacts will land as interactive cards. Deepen stays in this thread."):s.reply(`Link failed: ${h.error}`)}return s.reply(`${n} ready. /help lists every native command. /model lists models. /setup model adds OpenRouter, Nous Portal, Qwen, GLM. /effort sets reasoning. /update installs latest.${i?" /agents lists peers.":""}`)}),r.command("update",async s=>{let d=String(s.from?.id||s.chat.id),p=String(s.chat.id);if(!z({platform:"telegram",senderId:d,extraOwners:a}))return s.reply(V);if(s.message.forward_origin||s.message.forward_from||s.message.forward_date)return;s.replyWithChatAction("typing").catch(()=>{});let m=await O({platform:"telegram",chatId:p,senderId:d,text:s.match?`update ${s.match}`.trim():"update",userName:s.from?.username||s.from?.first_name||"user"});if(m)return Fe(s,m)}),r.on("message:text",async s=>{let d=String(s.chat.id),p=String(s.from?.id||d),m=s.message.text;try{s.replyWithChatAction("typing").catch(()=>{});let h=pe(),g=vt(h,{chatId:d,text:m}),k=await O({platform:"telegram",chatId:d,senderId:p,text:g||m,userName:s.from?.username||s.from?.first_name||"user",extraOwners:a,bus:i,agentName:n,persona:o,backend:t.backend,profile:t.hermesProfile,meta:{forward_origin:s.message.forward_origin,forward_from:s.message.forward_from,forward_from_chat:s.message.forward_from_chat,forward_sender_name:s.message.forward_sender_name,forward_date:s.message.forward_date}});k&&await Fe(s,k)}catch(h){process.stderr.write(`telegram-gateway[${n}]: ${h.message}
 `),await s.reply("Something went wrong. Try again.").catch(()=>{})}}),r.on("callback_query:data",async s=>{let d=String(s.from?.id||"");if(!z({platform:"telegram",senderId:d,extraOwners:a})){await s.answerCallbackQuery({text:V.slice(0,180),show_alert:!0}).catch(()=>{});return}let p=String(s.callbackQuery?.data||""),m=String(process.env.ORACLE_OWNER_TELEGRAM||"").split(",").map(v=>v.trim()).filter(Boolean),h=process.env.ORACLE_CONFIG_DIR||ar(fo(),".config","oracle"),g;try{g=nr({keyFile:ar(h,"signer","policy-integrity-key"),approvedTelegramOwners:m})}catch{}let k=await ot({platform:"telegram",data:p,senderId:d,chatId:String(s.chat?.id||""),ownerProofAuthority:g,grant:{local:!0}});if(!k){let v=pe(),x=At(v,{data:p,chatId:String(s.chat?.id||""),grant:{local:!0}});if(ir(),!x){await s.answerCallbackQuery().catch(()=>{});return}if(await s.answerCallbackQuery({text:"ok"}).catch(()=>{}),x.prompt){let A=await O({platform:"telegram",chatId:String(s.chat?.id||""),senderId:d,text:x.prompt,extraOwners:a,bus:i,agentName:n,persona:o,backend:t.backend,profile:t.hermesProfile});A&&await Fe(s,A);return}if(x.text){let A=x.buttons?.replyMarkup?{reply_markup:x.buttons.replyMarkup}:{};await s.reply(x.text,{parse_mode:"Markdown",...A}).catch(()=>{})}return}await s.answerCallbackQuery({text:"ok"}).catch(()=>{}),k.text&&await s.reply(k.text,{parse_mode:"Markdown"}).catch(()=>{})}),r.start();let l=sr({extraOwners:a}),c=null;return l.length>0&&t.pendingWatch!==!1&&(c=Jt({intervalMs:t.pendingWatchIntervalMs,onNew:async(s,{armed:d})=>{let p=Ae(s,{platform:"telegram",grant:{local:!0},armed:d}),m=p.buttons?.replyMarkup?{reply_markup:p.buttons.replyMarkup}:{};for(let h of l)await r.api.sendMessage(h,p.text,{parse_mode:"Markdown",...m}).catch(()=>{})}})),{platform:"telegram",name:n,bot:r,stopPendingWatch:()=>c?.stop()}}var lr=w(()=>{Y();_e();Xt();or();Me()});var ur={};j(ur,{discord:()=>go});async function go(t){let{Client:e,GatewayIntentBits:r}=await import("discord.js"),n=new e({intents:[r.Guilds,r.GuildMessages,r.MessageContent,r.DirectMessages]}),o=String(t.name||"oracle").toLowerCase(),a=K(t),i=Array.isArray(t.owners)?t.owners:void 0,l=t.bus;return l&&l.register(o,{role:t.role||"",chains:t.chains||[],handler:c=>oe({from:c.from,text:c.text,persona:a,backend:t.backend,profile:t.hermesProfile})}),n.on("messageCreate",async c=>{if(c.author.bot)return;let s=c.channel.id,d=c.author.id,p=c.content;try{let m=!c.guild,h=c.mentions.has(n.user.id);if(!m&&!h)return;c.channel.sendTyping().catch(()=>{});let g=await O({platform:"discord",chatId:s,senderId:d,text:p.replace(`<@${n.user.id}>`,"").trim(),userName:c.author.username,extraOwners:i,bus:l,agentName:o,persona:a,backend:t.backend,profile:t.hermesProfile,meta:{forwarded:c.reference?.type===1||Array.isArray(c.messageSnapshots)&&c.messageSnapshots.length>0}});g&&await c.reply(typeof g=="string"?g:g.text).catch(()=>{})}catch(m){process.stderr.write(`discord-gateway[${o}]: ${m.message}
 `)}}),await n.login(t.token),{platform:"discord",name:o,client:n}}var dr=w(()=>{Y()});var mr={};j(mr,{whatsapp:()=>ko});import{join as pr}from"node:path";import{homedir as yo}from"node:os";async function ko(t){let[{Client:e,LocalAuth:r},{generate:n}]=await Promise.all([import("whatsapp-web.js"),import("qrcode-terminal")]),o=new e({authStrategy:new r({dataPath:pr(wo,".wwebjs_auth")}),puppeteer:{headless:!0,args:["--no-sandbox"]}});return o.on("qr",a=>{process.stderr.write(`
 WhatsApp: scan this QR code in WhatsApp \u2192 Linked Devices:

package/dist/cli/commands/auth.mjs

@@ -1,16 +1,17 @@
-import T from"node:fs";import F from"node:path";import j from"node:fs";import le from"node:os";import O from"node:path";import{fileURLToPath as pe}from"node:url";var fe=O.dirname(pe(import.meta.url)),Ve=O.resolve(fe,"../..");function X(){return process.env.ORACLE_FAKE_HOME||le.homedir()}function he(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function b(){return he()?process.env.ORACLE_CONFIG_DIR||O.join(X(),".config","oracle"):O.join(X(),".config","oracle")}function me(){return O.join(b(),"desk.json")}function we(){return O.join(b(),"env")}function E({force:e=!1}={}){if(E._done&&!e)return E._result||null;E._done=!0;let t={},r=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=we();if(j.existsSync(n))for(let i of j.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let l=s[2];(l.startsWith('"')&&l.endsWith('"')||l.startsWith("'")&&l.endsWith("'"))&&(l=l.slice(1,-1)),r(s[1],l)}}catch{}try{let n=me();if(j.existsSync(n)){let i=JSON.parse(j.readFileSync(n,"utf8"));i&&typeof i=="object"&&(r("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),r("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),r("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),r("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),r("ORACLE_EXEC_URL",i.execUrl),r("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let o=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return o&&(r("ORACLE_DESK_URL",o),r("ORACLE_DATA_URL",o),r("ORACLE_API_URL",o),r("ORACLE_PUBLIC_URL",o),r("MAD_DESK_URL",o)),E._result=Object.keys(t).length?t:null,E._result}try{E()}catch{}function $(e){return j.mkdirSync(e,{recursive:!0}),e}var ge=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function ye(e,{required:t=!1}={}){let r=I(e)?.toLowerCase();if(!r){if(t)throw new Error("model provider is required");return}if(!ge.has(r))throw new Error(`unsupported provider: ${r}`);return r}function ve(e,{required:t=!1}={}){let r=I(e);if(!r){if(t)throw new Error("model is required");return}if(r.includes("..")||r.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(r))throw new Error("invalid model id");return r}function ke(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let r;try{r=new URL(t)}catch{throw new Error("invalid custom base URL")}let o=r.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=o==="localhost"||o==="127.0.0.1"||o==="::1";if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n)||r.username||r.password||r.search||r.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return r.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:r}={},{requireModel:o=!1}={}){let n=ye(e),i=ve(t,{required:o});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:ke(r)};if(I(r))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var xe=new Set(["auto","standalone","hermes","remote","arch"]);function _e(){return F.join(b(),"model.json")}function P(e){return String(e||"").trim()||void 0}function Ae(e={}){let t=P(e.backend)?.toLowerCase()||"auto",r=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),o=P(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=P(e.reasoningEffort),s=P(e.computeHost||e.remoteHost),l=P(e.computeUser||e.remoteUser),u=P(e.computePath||e.remotePath);if(!xe.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(o&&!/^[A-Z][A-Z0-9_]*$/.test(o))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...r,...o?{apiKeyEnv:o}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...l?{computeUser:l}:{},...u?{computePath:u}:{}}}function Z(e){let t=Ae(e),r=_e();$(F.dirname(r)),process.platform!=="win32"&&T.chmodSync(F.dirname(r),448);let o=`${r}.${process.pid}.tmp`;return T.writeFileSync(o,`${JSON.stringify(t,null,2)}
-`,{mode:384}),T.renameSync(o,r),process.platform!=="win32"&&T.chmodSync(r,384),t}import{createHash as Se,randomBytes as N,timingSafeEqual as Ee}from"node:crypto";import g from"node:fs";import k from"node:path";import Oe from"node:readline/promises";import{spawn as be,spawnSync as Pe}from"node:child_process";var R=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),Ce=12e4;function Re(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function _(e){let t=String(e||"").trim().toLowerCase();for(let[r,o]of Object.entries(R))if(o.aliases.includes(t))return r;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function Y(e){let t=_(e);return{id:t,...R[t]}}function m(e,t={}){if(!g.existsSync(e))return t;try{let r=JSON.parse(g.readFileSync(e,"utf8"));if(!r||typeof r!="object"||Array.isArray(r))throw new Error("invalid object");return r}catch{throw new Error(`credential store is unreadable or corrupt: ${k.basename(e)}`)}}function Q(e){$(e),process.platform!=="win32"&&g.chmodSync(e,448)}function x(e,t){Q(k.dirname(e));let r=`${e}.${process.pid}.${N(4).toString("hex")}.tmp`;g.writeFileSync(r,`${JSON.stringify(t,null,2)}
-`,{mode:384}),g.renameSync(r,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ue(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function D(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function C(e={}){let t=String(e.accessToken||e.access_token||"").trim(),r=String(e.refreshToken||e.refresh_token||"").trim(),o=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(o)&&o>=1e9&&o<1e12&&(o=o*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:r,expiresAt:Number.isFinite(o)?o:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function je(e={}){let t=e.file||k.join(b(),"oauth.json"),r=e.metadataFile||k.join(k.dirname(t),"oauth-meta.json"),o=e.linksFile||k.join(k.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Pe,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ue(i),l=s?"linux-secret-service":"private-file",u=`${t}.lock`;async function v(f){Q(k.dirname(u));let p;for(let c=0;c<400;c+=1)try{p=g.openSync(u,"wx",384);break}catch(a){if(a?.code!=="EEXIST")throw a;try{Date.now()-g.statSync(u).mtimeMs>3e5&&g.unlinkSync(u)}catch{}await new Promise(d=>setTimeout(d,25))}if(p===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(p)}catch{}try{g.unlinkSync(u)}catch{}}}function w(f,p="oauth"){return["application","oracle","kind",p,"provider",f]}function U(f){if(!g.existsSync(o))return null;let c=m(o,{providers:{}}).providers?.[f];if(!Array.isArray(c))return null;let a=[];for(let d of c)if(k.isAbsolute(String(d||"")))try{let h=m(d,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let S=C(h.claudeAiOauth);a.push({...S,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let S=y[f]||y[f.replace(/-oauth$/,"")]||[],ue=Array.isArray(S)?S:S?[S]:[];for(let z of ue)if(!(!z||typeof z!="object"))try{let de=C(z);a.push({...de,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return a.length?a.find(d=>!d.expiresAt||d.expiresAt>n()+Ce)||a[0]:null}function W(f){let p=_(f);if(s){let d=i("secret-tool",["lookup",...w(p)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!d.error&&d.status===0&&String(d.stdout||"").trim())try{return C(JSON.parse(String(d.stdout).trim()))}catch{}return U(p)}let a=m(t,{providers:{}}).providers?.[p];if(a)try{return C(a)}catch{}return U(p)}function ne(f,p){let c=_(f),a=C(p);if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} OAuth`,...w(c)],{input:JSON.stringify(a),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(r,{providers:{}});return y.providers||={},y.providers[c]={expiresAt:a.expiresAt,source:a.source},x(r,y),a}let d=m(t,{providers:{}});return d.providers||={},d.providers[c]=a,x(t,d),a}function ie(f){let p=_(f);if(s){let d=i("secret-tool",["clear",...w(p)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{}});return h.providers&&delete h.providers[p],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{}}),a=!!c.providers?.[p];return c.providers&&delete c.providers[p],x(t,c),a}function V(f){let p=D(f);if(s){let c=i("secret-tool",["lookup",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return c.error||c.status!==0?"":String(c.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[p]||"").trim()}function se(f,p){let c=D(f),a=String(p||"").trim();if(!a)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${c} API key`,...w(c,"api-key")],{input:a,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(r,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[c]={configured:!0},x(r,y),!0}let d=m(t,{providers:{},apiKeys:{}});return d.apiKeys||={},d.apiKeys[c]=a,x(t,d),!0}function ce(f){let p=D(f);if(s){let d=i("secret-tool",["clear",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(r,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[p],x(r,h),!d.error&&d.status===0}let c=m(t,{providers:{},apiKeys:{}}),a=!!c.apiKeys?.[p];return c.apiKeys&&delete c.apiKeys[p],x(t,c),a}function ae(){let f={},p={};if(s){let c=m(r,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!W(a),expiresAt:Number(d.expiresAt||0),source:String(d.source||"oracle"),storage:l};for(let a of Object.keys(c.apiKeys||{}))p[a]={configured:!!V(a),storage:l}}else{let c=m(t,{providers:{},apiKeys:{}});for(let[a,d]of Object.entries(c.providers||{}))f[a]={loggedIn:!!d?.accessToken,expiresAt:Number(d?.expiresAt||0),source:String(d?.source||"oracle"),storage:l};for(let[a,d]of Object.entries(c.apiKeys||{}))p[a]={configured:!!d,storage:l}}for(let c of Object.keys(R)){if(f[c])continue;let a=U(c);a&&(f[c]={loggedIn:!0,expiresAt:a.expiresAt,source:a.source,storage:"external-access-source"})}return{storage:l,providers:f,apiKeys:p}}return Object.freeze({file:t,storage:l,get:W,set:ne,remove:ie,getApiKey:V,setApiKey:se,removeApiKey:ce,status:ae,withLock:v})}var G;function ee(){return G||=je(),G}function M(e){return Buffer.from(e).toString("base64url")}function $e(){let e=M(N(32));return{verifier:e,challenge:M(Se("sha256").update(e).digest()),state:M(N(24))}}function Ie(e,t){let r=Buffer.from(String(e||"")),o=Buffer.from(String(t||""));return r.length===o.length&&Ee(r,o)}function Le(e){let t=String(e),r=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return be(r[0],r[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function B(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let o="";try{o=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${o?`, ${o}`:""})`)}let r=await e.json();if(!r||typeof r!="object")throw new Error(`${t} returned invalid JSON`);return r}async function Te(e){if(e)return String(await e()).trim();let t=Oe.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let r=String(e.access_token||"").trim(),o=String(e.refresh_token||t.refreshToken||"").trim();if(!r)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return C({accessToken:r,refreshToken:o,expiresAt:Re(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ke(e){let t=R["anthropic-oauth"],r=e.pkce||$e(),o=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:r.challenge,code_challenge_method:"S256",state:r.state}),n=`${t.authorizeUrl}?${o}`;e.output(`Open: ${n}`),e.openFn(n);let i=await Te(e.inputFn),[s,l]=i.split("#",2);if(!s||!Ie(l,r.state))throw new Error("Claude OAuth state mismatch");let u=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:l,redirect_uri:t.redirectUri,code_verifier:r.verifier})});return H(await A(u,"Claude OAuth token exchange"),e)}async function ze(e){let t=R["openai-codex"],r=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!r.user_code||!r.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let o=`${t.issuer}/codex/device`;e.output(`Open: ${o}`),e.output(`Code: ${r.user_code}`),e.openFn(o);let n=Math.max(3,Number(r.interval||5)),i;for(let l=0;l<Math.ceil(900/n);l+=1){await e.sleepFn(n*1e3);let u=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:r.device_auth_id,user_code:r.user_code})});if(u.ok){i=await A(u,"Codex device authorization");break}if(![403,404].includes(u.status))throw new Error(`Codex device authorization failed (HTTP ${u.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:B({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function K(e){let t=new URL(String(e)),r=t.hostname.toLowerCase();if(t.protocol!=="https:"||r!=="x.ai"&&!r.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Fe(e){let t=R["xai-oauth"],r=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");K(r.authorization_endpoint);let o=K(r.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=K(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),l=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let u=0;u<l;u+=1){let v=await e.fetchFn(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:B({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let U=await A(v,"xAI OAuth token exchange");return H(U,{...e,discovery:{authorization_endpoint:K(r.authorization_endpoint),token_endpoint:o}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function te(e,t={}){let r=_(e),o={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Le,output:t.output||(n=>process.stdout.write(`${n}
-`)),now:t.now,pkce:t.pkce};return r==="anthropic-oauth"?Ke(o):r==="openai-codex"?ze(o):Fe(o)}var re=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function q(e,t){let r=e.indexOf(t);return r>=0&&e[r+1]?e[r+1]:""}async function De(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function Me(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,r)=>{let o="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
-`)},i=s=>{let l=String(s);for(let u of l){if(u==="\r"||u===`
-`){n(),t(o.trim());return}if(u===""){n(),r(new Error("cancelled"));return}u==="\x7F"||u==="\b"?o=o.slice(0,-1):o+=u}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function J(e,t,{baseUrl:r=""}={}){if(e==="custom"&&!String(r||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...L({provider:e,model:t,baseUrl:r},{requireModel:!0})}}function oe(e,t,r={}){return Z(J(e,t,r))}function Ne(e){process.stdout.write(`storage: ${e.storage}
-`);let t=Object.entries(e.providers||{}),r=Object.entries(e.apiKeys||{});if(!t.length&&!r.length){process.stdout.write(`no credentials configured
-`);return}for(let[o,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${o}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
-`)}for(let[o,n]of r)process.stdout.write(`${o}: API key ${n.configured?"configured":"missing"}
-`)}function Be(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
-`)}var pt={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:Be(),async run(e){let t=[...e.argv],r=t.shift()||"status",o=ee();try{if(r==="status"){let n=o.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
-`):Ne(n),0}if(r==="login"){let n=t.find(u=>!u.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=Y(n),s=q(t,"--model")||i.model;J(i.id,s);let l=await te(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await o.withLock(async()=>{let u=o.get(i.id);o.set(i.id,l);try{oe(i.id,s)}catch(v){throw u?o.set(i.id,u):o.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${o.storage}
-`),0}if(r==="api-key"){let n=String(t.find(u=>!u.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(re,n))throw new Error(`unsupported API-key provider: ${n}`);let i=q(t,"--model")||re[n].model,s=q(t,"--base-url");J(n,i,{baseUrl:s});let l=t.includes("--stdin")?await De():await Me();return await o.withLock(async()=>{let u=o.getApiKey(n);o.setApiKey(n,l);try{oe(n,i,{baseUrl:s})}catch(v){throw u?o.setApiKey(n,u):o.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${o.storage}
-`),0}if(r==="logout"){let n=String(t.find(l=>!l.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=o.remove(_(n))}catch{}let s=o.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
-`),0}throw new Error(`unknown auth action: ${r}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
-`),1}}};export{pt as default};
+var ve=Object.defineProperty;var xe=(e,t,o)=>()=>{if(o)throw o[0];try{return e&&(t=e(e=0)),t}catch(r){throw o=[r],r}};var ke=(e,t)=>{for(var o in t)ve(e,o,{get:t[o],enumerable:!0})};var ce={};ke(ce,{OAUTH_USAGE_PROVIDERS:()=>Ze,collectOAuthUsage:()=>Qe,parseAnthropicUsage:()=>se,parseCodexUsage:()=>ae});function ie(e){let t=Number(e);return Number.isFinite(t)?t:null}function Ye(e){let t=ie(e);if(t==null)return null;let o=t<=1?t*100:t;return Math.max(0,Math.min(100,o))}function se(e){let t=[["five_hour","5h"],["seven_day","7d"],["seven_day_opus","Opus 7d"],["seven_day_sonnet","Sonnet 7d"]],o=[];for(let[r,n]of t){let i=e?.[r]||{},s=Ye(i.utilization);s!=null&&o.push({label:n,usedPercent:s,resetAt:i.resets_at||i.reset_at||null})}return{source:"oauth_usage_api",windows:o}}function ae(e){let t=e?.rate_limit||{},o=[["primary_window","5h"],["secondary_window","wk"]],r=[];for(let[n,i]of o){let s=t[n]||{},c=ie(s.used_percent);c!=null&&r.push({label:i,usedPercent:Math.max(0,Math.min(100,c)),resetAt:s.reset_at||s.resets_at||null})}return{source:"usage_api",windows:r}}function S({id:e,label:t,connected:o,windows:r=[],unavailable:n=null}){let i=r[0]||null;return{id:e,label:t,connected:o,usedPercent:i?i.usedPercent:null,windowLabel:i?i.label:null,resetAt:i?i.resetAt:null,windows:r,unavailable:n}}function J(e,t){try{return String(e?.get?.(t)?.accessToken||"").trim()}catch{return""}}async function ne(e,t,o){let r=await e(t,{headers:o});if(!r?.ok)throw new Error(`HTTP ${r?.status||0}`);return r.json()}async function Qe(e,{fetchFn:t=globalThis.fetch}={}){let o=new Date().toISOString(),r=[],n=J(e,"anthropic-oauth");if(!n)r.push(S({id:"anthropic-oauth",label:"Claude",connected:!1,unavailable:"not connected"}));else try{let c=await ne(t,"https://api.anthropic.com/api/oauth/usage",{Authorization:`Bearer ${n}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":"claude-code/2.1.0"}),a=se(c);r.push(S({id:"anthropic-oauth",label:"Claude",connected:!0,windows:a.windows,unavailable:a.windows.length?null:"quota unavailable"}))}catch{r.push(S({id:"anthropic-oauth",label:"Claude",connected:!0,unavailable:"quota unavailable"}))}let i=J(e,"openai-codex");if(!i)r.push(S({id:"openai-codex",label:"Codex",connected:!1,unavailable:"not connected"}));else try{let c=await ne(t,"https://chatgpt.com/backend-api/wham/usage",{Authorization:`Bearer ${i}`,Accept:"application/json","User-Agent":"codex-cli"}),a=ae(c);r.push(S({id:"openai-codex",label:"Codex",connected:!0,windows:a.windows,unavailable:a.windows.length?null:"quota unavailable"}))}catch{r.push(S({id:"openai-codex",label:"Codex",connected:!0,unavailable:"quota unavailable"}))}let s=J(e,"xai-oauth");return r.push(S({id:"xai-oauth",label:"Grok",connected:!!s,unavailable:s?"quota not published":"not connected"})),{fetchedAt:o,providers:r}}var Ze,ue=xe(()=>{Ze=Object.freeze([{id:"anthropic-oauth",label:"Claude"},{id:"openai-codex",label:"Codex"},{id:"xai-oauth",label:"Grok"}])});import z from"node:fs";import D from"node:path";import $ from"node:fs";import _e from"node:os";import E from"node:path";import{fileURLToPath as Ae}from"node:url";var Se=E.dirname(Ae(import.meta.url)),ut=E.resolve(Se,"../..");function Z(){return process.env.ORACLE_FAKE_HOME||_e.homedir()}function be(){return process.env.ORACLE_PUBLIC_DESKTOP==="1"}function P(){return be()?process.env.ORACLE_CONFIG_DIR||E.join(Z(),".config","oracle"):E.join(Z(),".config","oracle")}function Oe(){return E.join(P(),"desk.json")}function Ee(){return E.join(P(),"env")}function O({force:e=!1}={}){if(O._done&&!e)return O._result||null;O._done=!0;let t={},o=(n,i)=>{if(i==null)return;let s=String(i).trim();s&&(process.env[n]!=null&&String(process.env[n]).trim()!==""||(process.env[n]=s,t[n]=s))};try{let n=Ee();if($.existsSync(n))for(let i of $.readFileSync(n,"utf8").split(/\r?\n/)){let s=i.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*?)\s*$/);if(!s||s[2].startsWith("#"))continue;let c=s[2];(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),o(s[1],c)}}catch{}try{let n=Oe();if($.existsSync(n)){let i=JSON.parse($.readFileSync(n,"utf8"));i&&typeof i=="object"&&(o("ORACLE_DESK_URL",i.deskUrl||i.dataUrl||i.url),o("ORACLE_DATA_URL",i.dataUrl||i.deskUrl||i.url),o("ORACLE_API_URL",i.apiUrl||i.dataUrl||i.deskUrl),o("ORACLE_PUBLIC_URL",i.publicUrl||i.deskUrl||i.dataUrl),o("ORACLE_EXEC_URL",i.execUrl),o("MAD_DESK_URL",i.deskUrl||i.dataUrl))}}catch{}let r=process.env.ORACLE_DESK_URL||process.env.ORACLE_DATA_URL||"";return r&&(o("ORACLE_DESK_URL",r),o("ORACLE_DATA_URL",r),o("ORACLE_API_URL",r),o("ORACLE_PUBLIC_URL",r),o("MAD_DESK_URL",r)),O._result=Object.keys(t).length?t:null,O._result}try{O()}catch{}function T(e){return $.mkdirSync(e,{recursive:!0}),e}var Pe=new Set(["openrouter","openai","anthropic","xai","deepseek","gemini","kimi","mistral","nous","qwen","glm","local","ollama","custom","anthropic-oauth","openai-codex","xai-oauth"]);function I(e){return String(e||"").trim()||void 0}function Ce(e,{required:t=!1}={}){let o=I(e)?.toLowerCase();if(!o){if(t)throw new Error("model provider is required");return}if(!Pe.has(o))throw new Error(`unsupported provider: ${o}`);return o}function Ue(e,{required:t=!1}={}){let o=I(e);if(!o){if(t)throw new Error("model is required");return}if(o.includes("..")||o.startsWith("/")||!/^[a-zA-Z0-9._:/-]{1,200}$/.test(o))throw new Error("invalid model id");return o}function Re(e){let t=I(e);if(!t||t.length>2048)throw new Error("invalid custom base URL");let o;try{o=new URL(t)}catch{throw new Error("invalid custom base URL")}let r=o.hostname.toLowerCase().replace(/^\[|\]$/g,""),n=r==="localhost"||r==="127.0.0.1"||r==="::1";if(o.protocol!=="https:"&&!(o.protocol==="http:"&&n)||o.username||o.password||o.search||o.hash)throw new Error("custom base URL must use HTTPS or loopback HTTP without credentials, query, or fragment");return o.toString().replace(/\/+$/,"")}function L({provider:e,model:t,baseUrl:o}={},{requireModel:r=!1}={}){let n=Ce(e),i=Ue(t,{required:r});if(n==="custom")return{provider:n,...i?{model:i}:{},baseUrl:Re(o)};if(I(o))throw new Error("baseUrl is only supported for the custom provider");return{...n?{provider:n}:{},...i?{model:i}:{}}}var je=new Set(["auto","standalone","hermes","remote","arch"]);function $e(){return D.join(P(),"model.json")}function C(e){return String(e||"").trim()||void 0}function Te(e={}){let t=C(e.backend)?.toLowerCase()||"auto",o=L({provider:e.provider,model:e.model,baseUrl:e.baseUrl},{requireModel:t==="standalone"}),r=C(e.apiKeyEnv),n=Number.parseInt(String(e.contextLength||""),10),i=C(e.reasoningEffort),s=C(e.computeHost||e.remoteHost),c=C(e.computeUser||e.remoteUser),a=C(e.computePath||e.remotePath);if(!je.has(t))throw new Error(`unsupported backend: ${t}`);if(process.env.ORACLE_PUBLIC_DESKTOP==="1"&&["remote","arch"].includes(t))throw new Error("remote compute backends are disabled in the public desktop");if(r&&!/^[A-Z][A-Z0-9_]*$/.test(r))throw new Error("api key env must be an uppercase environment variable name");if(t==="remote"&&!s)throw new Error("remote backend requires computeHost");return{backend:t,...o,...r?{apiKeyEnv:r}:{},...Number.isFinite(n)&&n>0?{contextLength:n}:{},...i?{reasoningEffort:i}:{},...s?{computeHost:s}:{},...c?{computeUser:c}:{},...a?{computePath:a}:{}}}function Y(e){let t=Te(e),o=$e();T(D.dirname(o)),process.platform!=="win32"&&z.chmodSync(D.dirname(o),448);let r=`${o}.${process.pid}.tmp`;return z.writeFileSync(r,`${JSON.stringify(t,null,2)}
+`,{mode:384}),z.renameSync(r,o),process.platform!=="win32"&&z.chmodSync(o,384),t}import{createHash as Ie,randomBytes as B,timingSafeEqual as Le}from"node:crypto";import g from"node:fs";import x from"node:path";import ze from"node:readline/promises";import{spawn as Fe,spawnSync as Ke}from"node:child_process";var R=Object.freeze({"anthropic-oauth":{aliases:["anthropic-oauth","anthropic","claude","claude-oauth"],clientId:"9d1c250a-e61b-44d9-88ed-5944d1962f5e",authorizeUrl:"https://claude.ai/oauth/authorize",tokenUrl:"https://platform.claude.com/v1/oauth/token",redirectUri:"https://console.anthropic.com/oauth/code/callback",scope:"org:create_api_key user:profile user:inference",baseUrl:"https://api.anthropic.com/v1",model:"claude-sonnet-4-6",protocol:"anthropic-messages"},"openai-codex":{aliases:["openai-codex","openai-oauth","codex","codex-oauth"],clientId:"app_EMoamEEZ73f0CkXaXp7hrann",issuer:"https://auth.openai.com",tokenUrl:"https://auth.openai.com/oauth/token",baseUrl:"https://chatgpt.com/backend-api/codex",model:"gpt-5.6-sol",protocol:"responses"},"xai-oauth":{aliases:["xai-oauth","xai","grok","grok-oauth"],clientId:"b1a00492-073a-47ea-816f-4c329264a828",issuer:"https://auth.x.ai",discoveryUrl:"https://auth.x.ai/.well-known/openid-configuration",deviceUrl:"https://auth.x.ai/oauth2/device/code",scope:"openid profile email offline_access grok-cli:access api:access",baseUrl:"https://api.x.ai/v1",model:"grok-4.6",protocol:"responses"}}),De=12e4;function Me(e={}){return typeof e.now=="function"?Number(e.now()):Date.now()}function _(e){let t=String(e||"").trim().toLowerCase();for(let[o,r]of Object.entries(R))if(r.aliases.includes(t))return o;throw new Error(`unsupported OAuth provider: ${e||"(empty)"}`)}function ee(e){let t=_(e);return{id:t,...R[t]}}function m(e,t={}){if(!g.existsSync(e))return t;try{let o=JSON.parse(g.readFileSync(e,"utf8"));if(!o||typeof o!="object"||Array.isArray(o))throw new Error("invalid object");return o}catch{throw new Error(`credential store is unreadable or corrupt: ${x.basename(e)}`)}}function te(e){T(e),process.platform!=="win32"&&g.chmodSync(e,448)}function k(e,t){te(x.dirname(e));let o=`${e}.${process.pid}.${B(4).toString("hex")}.tmp`;g.writeFileSync(o,`${JSON.stringify(t,null,2)}
+`,{mode:384}),g.renameSync(o,e),process.platform!=="win32"&&g.chmodSync(e,384)}function Ne(e){if(process.platform!=="linux")return!1;let t=e("secret-tool",["--version"],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return!t.error&&t.status===0}function M(e){let t=String(e||"").trim().toLowerCase();if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw new Error(`invalid API-key provider: ${e||"(empty)"}`);return t}function U(e={}){let t=String(e.accessToken||e.access_token||"").trim(),o=String(e.refreshToken||e.refresh_token||"").trim(),r=Number(e.expiresAt||e.expires_at||0);if(Number.isFinite(r)&&r>=1e9&&r<1e12&&(r=r*1e3),!t)throw new Error("OAuth credential is missing access token");return{accessToken:t,refreshToken:o,expiresAt:Number.isFinite(r)?r:0,tokenType:String(e.tokenType||e.token_type||"Bearer"),source:String(e.source||"oracle"),...e.discovery?{discovery:e.discovery}:{},...e.scope?{scope:e.scope}:{},...e.idToken||e.id_token?{idToken:String(e.idToken||e.id_token)}:{}}}function Be(e={}){let t=e.file||x.join(P(),"oauth.json"),o=e.metadataFile||x.join(x.dirname(t),"oauth-meta.json"),r=e.linksFile||x.join(x.dirname(t),"oauth-links.json"),n=()=>typeof e.now=="function"?Number(e.now()):Date.now(),i=e.spawnFn||Ke,s=e.keychain!==!1&&process.env.ORACLE_AUTH_FILE_STORE!=="1"&&Ne(i),c=s?"linux-secret-service":"private-file",a=`${t}.lock`;async function v(f){te(x.dirname(a));let p;for(let u=0;u<400;u+=1)try{p=g.openSync(a,"wx",384);break}catch(d){if(d?.code!=="EEXIST")throw d;try{Date.now()-g.statSync(a).mtimeMs>3e5&&g.unlinkSync(a)}catch{}await new Promise(l=>setTimeout(l,25))}if(p===void 0)throw new Error("timed out waiting for OAuth credential lock");try{return await f()}finally{try{g.closeSync(p)}catch{}try{g.unlinkSync(a)}catch{}}}function w(f,p="oauth"){return["application","oracle","kind",p,"provider",f]}function j(f){if(!g.existsSync(r))return null;let u=m(r,{providers:{}}).providers?.[f];if(!Array.isArray(u))return null;let d=[];for(let l of u)if(x.isAbsolute(String(l||"")))try{let h=m(l,{});if(f==="anthropic-oauth"&&h.claudeAiOauth){let b=U(h.claudeAiOauth);d.push({...b,refreshToken:"",source:"external-access-only"});continue}let y=h.credential_pool&&typeof h.credential_pool=="object"?h.credential_pool:null;if(y){let b=y[f]||y[f.replace(/-oauth$/,"")]||[],ge=Array.isArray(b)?b:b?[b]:[];for(let K of ge)if(!(!K||typeof K!="object"))try{let ye=U(K);d.push({...ye,refreshToken:"",source:"external-access-only"})}catch{}}}catch{}return d.length?d.find(l=>!l.expiresAt||l.expiresAt>n()+De)||d[0]:null}function G(f){let p=_(f);if(s){let l=i("secret-tool",["lookup",...w(p)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});if(!l.error&&l.status===0&&String(l.stdout||"").trim())try{return U(JSON.parse(String(l.stdout).trim()))}catch{}return j(p)}let d=m(t,{providers:{}}).providers?.[p];if(d)try{return U(d)}catch{}return j(p)}function pe(f,p){let u=_(f),d=U(p);if(s){let h=i("secret-tool",["store",`--label=Oracle ${u} OAuth`,...w(u)],{input:JSON.stringify(d),encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected OAuth credential");let y=m(o,{providers:{}});return y.providers||={},y.providers[u]={expiresAt:d.expiresAt,source:d.source},k(o,y),d}let l=m(t,{providers:{}});return l.providers||={},l.providers[u]=d,k(t,l),d}function fe(f){let p=_(f);if(s){let l=i("secret-tool",["clear",...w(p)],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(o,{providers:{}});return h.providers&&delete h.providers[p],k(o,h),!l.error&&l.status===0}let u=m(t,{providers:{}}),d=!!u.providers?.[p];return u.providers&&delete u.providers[p],k(t,u),d}function X(f){let p=M(f);if(s){let u=i("secret-tool",["lookup",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","pipe","ignore"]});return u.error||u.status!==0?"":String(u.stdout||"").trim()}return String(m(t,{apiKeys:{}}).apiKeys?.[p]||"").trim()}function he(f,p){let u=M(f),d=String(p||"").trim();if(!d)throw new Error("API key is empty");if(s){let h=i("secret-tool",["store",`--label=Oracle ${u} API key`,...w(u,"api-key")],{input:d,encoding:"utf8",stdio:["pipe","ignore","pipe"]});if(h.error||h.status!==0)throw new Error("OS credential store rejected API key");let y=m(o,{providers:{},apiKeys:{}});return y.apiKeys||={},y.apiKeys[u]={configured:!0},k(o,y),!0}let l=m(t,{providers:{},apiKeys:{}});return l.apiKeys||={},l.apiKeys[u]=d,k(t,l),!0}function me(f){let p=M(f);if(s){let l=i("secret-tool",["clear",...w(p,"api-key")],{encoding:"utf8",stdio:["ignore","ignore","pipe"]}),h=m(o,{providers:{},apiKeys:{}});return h.apiKeys&&delete h.apiKeys[p],k(o,h),!l.error&&l.status===0}let u=m(t,{providers:{},apiKeys:{}}),d=!!u.apiKeys?.[p];return u.apiKeys&&delete u.apiKeys[p],k(t,u),d}function we(){let f={},p={};if(s){let u=m(o,{providers:{},apiKeys:{}});for(let[d,l]of Object.entries(u.providers||{}))f[d]={loggedIn:!!G(d),expiresAt:Number(l.expiresAt||0),source:String(l.source||"oracle"),storage:c};for(let d of Object.keys(u.apiKeys||{}))p[d]={configured:!!X(d),storage:c}}else{let u=m(t,{providers:{},apiKeys:{}});for(let[d,l]of Object.entries(u.providers||{}))f[d]={loggedIn:!!l?.accessToken,expiresAt:Number(l?.expiresAt||0),source:String(l?.source||"oracle"),storage:c};for(let[d,l]of Object.entries(u.apiKeys||{}))p[d]={configured:!!l,storage:c}}for(let u of Object.keys(R)){if(f[u])continue;let d=j(u);d&&(f[u]={loggedIn:!0,expiresAt:d.expiresAt,source:d.source,storage:"external-access-source"})}return{storage:c,providers:f,apiKeys:p}}return Object.freeze({file:t,storage:c,get:G,set:pe,remove:fe,getApiKey:X,setApiKey:he,removeApiKey:me,status:we,withLock:v})}var Q;function oe(){return Q||=Be(),Q}function N(e){return Buffer.from(e).toString("base64url")}function qe(){let e=N(B(32));return{verifier:e,challenge:N(Ie("sha256").update(e).digest()),state:N(B(24))}}function He(e,t){let o=Buffer.from(String(e||"")),r=Buffer.from(String(t||""));return o.length===r.length&&Le(o,r)}function Je(e){let t=String(e),o=process.platform==="darwin"?["open",[t]]:process.platform==="win32"?["cmd.exe",["/d","/s","/c","start","",t]]:["xdg-open",[t]];try{return Fe(o[0],o[1],{detached:!0,stdio:"ignore"}).unref(),!0}catch{return!1}}function q(e){return new URLSearchParams(e).toString()}async function A(e,t){if(!e?.ok){let r="";try{r=String((await e.json())?.error||"")}catch{}throw new Error(`${t} failed (HTTP ${e?.status||"unknown"}${r?`, ${r}`:""})`)}let o=await e.json();if(!o||typeof o!="object")throw new Error(`${t} returned invalid JSON`);return o}async function We(e){if(e)return String(await e()).trim();let t=ze.createInterface({input:process.stdin,output:process.stdout});try{return String(await t.question("Authorization code: ")).trim()}finally{t.close()}}function H(e,t={}){let o=String(e.access_token||"").trim(),r=String(e.refresh_token||t.refreshToken||"").trim();if(!o)throw new Error("OAuth token response is missing access token");let n=Number(e.expires_in||3600);return U({accessToken:o,refreshToken:r,expiresAt:Me(t)+Math.max(1,n)*1e3,tokenType:e.token_type||"Bearer",idToken:e.id_token,source:"oracle",...t.discovery?{discovery:t.discovery}:{},...e.scope?{scope:e.scope}:{}})}async function Ve(e){let t=R["anthropic-oauth"],o=e.pkce||qe(),r=new URLSearchParams({code:"true",client_id:t.clientId,response_type:"code",redirect_uri:t.redirectUri,scope:t.scope,code_challenge:o.challenge,code_challenge_method:"S256",state:o.state}),n=`${t.authorizeUrl}?${r}`;e.output(`Open: ${n}`),e.openFn(n);let i=await We(e.inputFn),[s,c]=i.split("#",2);if(!s||!He(c,o.state))throw new Error("Claude OAuth state mismatch");let a=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/json","user-agent":"axios/1.7.9"},body:JSON.stringify({grant_type:"authorization_code",client_id:t.clientId,code:s,state:c,redirect_uri:t.redirectUri,code_verifier:o.verifier})});return H(await A(a,"Claude OAuth token exchange"),e)}async function Ge(e){let t=R["openai-codex"],o=await A(await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({client_id:t.clientId})}),"Codex device authorization");if(!o.user_code||!o.device_auth_id)throw new Error("Codex device authorization returned incomplete data");let r=`${t.issuer}/codex/device`;e.output(`Open: ${r}`),e.output(`Code: ${o.user_code}`),e.openFn(r);let n=Math.max(3,Number(o.interval||5)),i;for(let c=0;c<Math.ceil(900/n);c+=1){await e.sleepFn(n*1e3);let a=await e.fetchFn(`${t.issuer}/api/accounts/deviceauth/token`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({device_auth_id:o.device_auth_id,user_code:o.user_code})});if(a.ok){i=await A(a,"Codex device authorization");break}if(![403,404].includes(a.status))throw new Error(`Codex device authorization failed (HTTP ${a.status})`)}if(!i)throw new Error("Codex device authorization timed out");let s=await e.fetchFn(t.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:q({grant_type:"authorization_code",code:i.authorization_code,redirect_uri:`${t.issuer}/deviceauth/callback`,client_id:t.clientId,code_verifier:i.code_verifier})});return H(await A(s,"Codex OAuth token exchange"),e)}function F(e){let t=new URL(String(e)),o=t.hostname.toLowerCase();if(t.protocol!=="https:"||o!=="x.ai"&&!o.endsWith(".x.ai"))throw new Error("xAI OAuth discovery returned an untrusted endpoint");return t.toString()}async function Xe(e){let t=R["xai-oauth"],o=await A(await e.fetchFn(t.discoveryUrl,{headers:{accept:"application/json"}}),"xAI OAuth discovery");F(o.authorization_endpoint);let r=F(o.token_endpoint),n=await A(await e.fetchFn(t.deviceUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:q({client_id:t.clientId,scope:t.scope})}),"xAI device authorization");if(!n.device_code||!n.user_code||!n.verification_uri)throw new Error("xAI device authorization returned incomplete data");let i=F(n.verification_uri_complete||n.verification_uri);e.output(`Open: ${i}`),e.output(`Code: ${n.user_code}`),e.openFn(i);let s=Math.max(1,Number(n.interval||5)),c=Math.ceil(Math.max(1,Number(n.expires_in||600))/s);for(let a=0;a<c;a+=1){let v=await e.fetchFn(r,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",accept:"application/json"},body:q({grant_type:"urn:ietf:params:oauth:grant-type:device_code",client_id:t.clientId,device_code:n.device_code})});if(v.ok){let j=await A(v,"xAI OAuth token exchange");return H(j,{...e,discovery:{authorization_endpoint:F(o.authorization_endpoint),token_endpoint:r}})}let w="";try{w=String((await v.json())?.error||"")}catch{}if(w==="slow_down")await e.sleepFn((s+1)*1e3);else if(w==="authorization_pending")await e.sleepFn(s*1e3);else throw new Error(`xAI OAuth token exchange failed (HTTP ${v.status}${w?`, ${w}`:""})`)}throw new Error("xAI device authorization timed out")}async function re(e,t={}){let o=_(e),r={fetchFn:t.fetchFn||globalThis.fetch,inputFn:t.inputFn,sleepFn:t.sleepFn||(n=>new Promise(i=>setTimeout(i,n))),openFn:t.openFn||Je,output:t.output||(n=>process.stdout.write(`${n}
+`)),now:t.now,pkce:t.pkce};return o==="anthropic-oauth"?Ve(r):o==="openai-codex"?Ge(r):Xe(r)}var de=Object.freeze({openrouter:{model:"openrouter/auto"},openai:{model:"gpt-4.1-mini"},anthropic:{model:"claude-sonnet-4-6"},xai:{model:"grok-4.6"},deepseek:{model:"deepseek-chat"},gemini:{model:"gemini-2.5-flash"},kimi:{model:"kimi-k3"},mistral:{model:"mistral-large-latest"},nous:{model:"moonshotai/kimi-k3"},qwen:{model:"qwen-plus"},glm:{model:"glm-4.5"},custom:{model:""}});function W(e,t){let o=e.indexOf(t);return o>=0&&e[o+1]?e[o+1]:""}async function et(){let e="";for await(let t of process.stdin)e+=t;return e.trim()}function tt(e="API key: "){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw new Error("non-interactive API-key input requires --stdin");return process.stdout.write(e),new Promise((t,o)=>{let r="",n=()=>{process.stdin.off("data",i),process.stdin.setRawMode(!1),process.stdin.pause(),process.stdout.write(`
+`)},i=s=>{let c=String(s);for(let a of c){if(a==="\r"||a===`
+`){n(),t(r.trim());return}if(a===""){n(),o(new Error("cancelled"));return}a==="\x7F"||a==="\b"?r=r.slice(0,-1):r+=a}};process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("data",i)})}function V(e,t,{baseUrl:o=""}={}){if(e==="custom"&&!String(o||"").trim())throw new Error("custom provider requires --base-url");return{backend:"standalone",...L({provider:e,model:t,baseUrl:o},{requireModel:!0})}}function le(e,t,o={}){return Y(V(e,t,o))}function ot(e){process.stdout.write(`storage: ${e.storage}
+`);let t=Object.entries(e.providers||{}),o=Object.entries(e.apiKeys||{});if(!t.length&&!o.length){process.stdout.write(`no credentials configured
+`);return}for(let[r,n]of t){let i=n.expiresAt?new Date(n.expiresAt).toISOString():"unknown";process.stdout.write(`${r}: ${n.loggedIn?"logged in":"missing"}, expires ${i}
+`)}for(let[r,n]of o)process.stdout.write(`${r}: API key ${n.configured?"configured":"missing"}
+`)}function rt(){return["oracle auth, configure OAuth or API-key authentication","","  oracle auth login claude|codex|grok [--model MODEL] [--no-browser]","  oracle auth api-key PROVIDER [--model MODEL] [--base-url URL]","    PROVIDER: openrouter|openai|anthropic|xai|deepseek|gemini|kimi|mistral|nous|qwen|glm|custom",`  printf '%s\\n' "$KEY" | oracle auth api-key PROVIDER --stdin`,"  oracle auth status [--json]","  oracle auth usage [--json]","  oracle auth logout PROVIDER","","OAuth and API keys are additive. Select any compatible model with oracle model --provider PROVIDER --model MODEL."].join(`
+`)}var Et={name:"auth",summary:"login with Claude, Codex, or Grok OAuth; store provider API keys",group:"read",usage:rt(),async run(e){let t=[...e.argv],o=t.shift()||"status",r=oe();try{if(o==="status"){let n=r.status();return t.includes("--json")?process.stdout.write(`${JSON.stringify(n,null,2)}
+`):ot(n),0}if(o==="usage"){let{collectOAuthUsage:n}=await Promise.resolve().then(()=>(ue(),ce)),i=await n(r);return process.stdout.write(`${JSON.stringify(i)}
+`),0}if(o==="login"){let n=t.find(a=>!a.startsWith("-"));if(!n)throw new Error("usage: oracle auth login claude|codex|grok");let i=ee(n),s=W(t,"--model")||i.model;V(i.id,s);let c=await re(i.id,{openFn:t.includes("--no-browser")?()=>!1:void 0});return await r.withLock(async()=>{let a=r.get(i.id);r.set(i.id,c);try{le(i.id,s)}catch(v){throw a?r.set(i.id,a):r.remove(i.id),v}}),process.stdout.write(`${i.id}: logged in, stored in ${r.storage}
+`),0}if(o==="api-key"){let n=String(t.find(a=>!a.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth api-key PROVIDER [--stdin]");if(!Object.hasOwn(de,n))throw new Error(`unsupported API-key provider: ${n}`);let i=W(t,"--model")||de[n].model,s=W(t,"--base-url");V(n,i,{baseUrl:s});let c=t.includes("--stdin")?await et():await tt();return await r.withLock(async()=>{let a=r.getApiKey(n);r.setApiKey(n,c);try{le(n,i,{baseUrl:s})}catch(v){throw a?r.setApiKey(n,a):r.removeApiKey(n),v}}),process.stdout.write(`${n}: API key configured in ${r.storage}
+`),0}if(o==="logout"){let n=String(t.find(c=>!c.startsWith("-"))||"").trim().toLowerCase();if(!n)throw new Error("usage: oracle auth logout PROVIDER");let i=!1;try{i=r.remove(_(n))}catch{}let s=r.removeApiKey(n);if(!i&&!s)throw new Error(`${n}: no local credential found`);return process.stdout.write(`${n}: local credential removed
+`),0}throw new Error(`unknown auth action: ${o}`)}catch(n){return process.stderr.write(`oracle auth: ${n.message}
+`),1}}};export{Et as default};