@prestyj/core 5.1.1 → 5.2.0

package/dist/index.js

@@ -1,15 +1,42 @@
 import {
+  AuthStorage,
   DEFAULT_MAX_VIDEO_BYTES,
   MODELS,
+  MOONSHOT_OAUTH_KEY,
+  NotLoggedInError,
+  XIAOMI_CREDITS_KEY,
+  closeLogger,
+  generatePKCE,
+  getAuthStorageKey,
+  getAuthStorageKeys,
+  getClaudeCliUserAgent,
+  getClaudeCodeVersion,
   getContextWindow,
   getDefaultModel,
   getMaxThinkingLevel,
   getModel,
   getModelsForProvider,
+  getSessionId,
   getSummaryModel,
   getVideoByteLimit,
-  usesOpenAICodexTransport
-} from "./chunk-GRBEFHTI.js";
+  isKimiCodingEndpoint,
+  isLoggerOpen,
+  kimiCodeBaseUrl,
+  kimiCodingHeaders,
+  log,
+  loginAnthropic,
+  loginGemini,
+  loginKimi,
+  loginOpenAI,
+  openLog,
+  refreshAnthropicToken,
+  refreshGeminiToken,
+  refreshKimiToken,
+  refreshOpenAIToken,
+  registerLogCleanup,
+  usesOpenAICodexTransport,
+  withFileLock
+} from "./chunk-5GGCATYH.js";
 import {
   getAppPaths
 } from "./chunk-WQFTKHPJ.js";
@@ -40,7 +67,7 @@ function isAnthropicOpus48Or47Model(provider, model) {
   return provider === "anthropic" && /opus-4-8|opus-4-7/.test(model);
 }
 function isAnthropicAdaptiveModel(provider, model) {
-  return provider === "anthropic" && /opus-4-8|opus-4-7|opus-4-6|sonnet-4-6|fable-5|mythos-5/.test(model);
+  return provider === "anthropic" && /opus-4-8|opus-4-7|opus-4-6|sonnet-5|fable-5|mythos-5/.test(model);
 }
 function getSupportedThinkingLevels(provider, model) {
   const maxLevel = getMaxThinkingLevel(model);
@@ -75,1341 +102,6 @@ function getNextThinkingLevel(provider, model, current) {
   return supportedLevels[index + 1];
 }
 
-// src/logger.ts
-import fs from "fs";
-import path from "path";
-import { randomBytes } from "crypto";
-var MAX_BYTES = 10 * 1024 * 1024;
-var fd = null;
-var sessionId = "";
-var appName = "app";
-var cleanups = [];
-function rotateIfNeeded(filePath) {
-  try {
-    const st = fs.statSync(filePath);
-    if (st.size < MAX_BYTES) return;
-    const rotated = `${filePath}.1`;
-    try {
-      fs.unlinkSync(rotated);
-    } catch {
-    }
-    fs.renameSync(filePath, rotated);
-  } catch {
-  }
-}
-function openLog(filePath, name) {
-  if (fd !== null) return false;
-  appName = name;
-  try {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
-  } catch {
-  }
-  rotateIfNeeded(filePath);
-  try {
-    fd = fs.openSync(filePath, "a");
-  } catch {
-    return false;
-  }
-  sessionId = randomBytes(4).toString("hex");
-  try {
-    fs.writeSync(fd, "\n");
-  } catch {
-  }
-  return true;
-}
-function getSessionId() {
-  return sessionId;
-}
-function isLoggerOpen() {
-  return fd !== null;
-}
-function log(level, category, message, data) {
-  if (fd === null) return;
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  let line = `[${ts}] [sid=${sessionId}] [${level}] [${category}] ${message}`;
-  if (data) {
-    const pairs = Object.entries(data).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
-    if (pairs) line += ` ${pairs}`;
-  }
-  line += "\n";
-  try {
-    fs.writeSync(fd, line);
-  } catch {
-  }
-}
-function registerLogCleanup(fn) {
-  cleanups.push(fn);
-}
-function closeLogger(opts) {
-  if (fd === null) return;
-  if (opts?.shutdownLine !== false) log("INFO", "shutdown", `${appName} shutting down`);
-  try {
-    fs.closeSync(fd);
-  } catch {
-  }
-  fd = null;
-  for (const unsub of cleanups) unsub();
-  cleanups = [];
-}
-
-// src/file-lock.ts
-import fs2 from "fs/promises";
-import { setTimeout as setTimeout2 } from "timers/promises";
-var STALE_TIMEOUT_MS = 1e4;
-var RETRY_INTERVAL_MS = 50;
-var MAX_WAIT_MS = 5e3;
-async function withFileLock(filePath, fn) {
-  const lockPath = filePath + ".lock";
-  await acquireLock(lockPath);
-  try {
-    return await fn();
-  } finally {
-    await releaseLock(lockPath);
-  }
-}
-async function acquireLock(lockPath) {
-  const startTime = Date.now();
-  while (true) {
-    try {
-      const info = { pid: process.pid, timestamp: Date.now() };
-      await fs2.writeFile(lockPath, JSON.stringify(info), { flag: "wx" });
-      return;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      try {
-        const content = await fs2.readFile(lockPath, "utf-8");
-        const info = JSON.parse(content);
-        const isProcessAlive = isAlive(info.pid);
-        const isStale = Date.now() - info.timestamp > STALE_TIMEOUT_MS;
-        if (!isProcessAlive || isStale) {
-          await fs2.unlink(lockPath).catch(() => {
-          });
-          continue;
-        }
-      } catch {
-        await fs2.unlink(lockPath).catch(() => {
-        });
-        continue;
-      }
-      if (Date.now() - startTime > MAX_WAIT_MS) {
-        await fs2.unlink(lockPath).catch(() => {
-        });
-        continue;
-      }
-      await setTimeout2(RETRY_INTERVAL_MS);
-    }
-  }
-}
-async function releaseLock(lockPath) {
-  await fs2.unlink(lockPath).catch(() => {
-  });
-}
-function isAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    if (err.code === "EPERM") return true;
-    return false;
-  }
-}
-
-// src/claude-code-version.ts
-import fs3 from "fs/promises";
-import path2 from "path";
-var NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
-var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var FETCH_TIMEOUT_MS = 3e3;
-var FALLBACK_VERSION = "2.1.88";
-var memoryCache = null;
-var inflight = null;
-function cachePath() {
-  return path2.join(getAppPaths().agentDir, "claude-code-version.json");
-}
-async function readDiskCache() {
-  try {
-    const raw = await fs3.readFile(cachePath(), "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.version === "string" && typeof parsed.fetchedAt === "number") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-async function writeDiskCache(data) {
-  try {
-    await fs3.mkdir(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    await fs3.writeFile(cachePath(), JSON.stringify(data), { mode: 384 });
-  } catch (err) {
-    log(
-      "WARN",
-      "claude-code-version",
-      `Failed to write cache: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function fetchLatest() {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-  try {
-    const response = await fetch(NPM_LATEST_URL, { signal: controller.signal });
-    if (!response.ok) return null;
-    const data = await response.json();
-    if (typeof data.version === "string" && /^\d/.test(data.version)) {
-      return data.version;
-    }
-    return null;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function getClaudeCodeVersion() {
-  if (memoryCache && Date.now() < memoryCache.expiresAt) {
-    return memoryCache.version;
-  }
-  if (inflight) return inflight;
-  inflight = (async () => {
-    const disk = await readDiskCache();
-    const diskFresh = disk && Date.now() - disk.fetchedAt < CACHE_TTL_MS;
-    if (disk && diskFresh) {
-      memoryCache = { version: disk.version, expiresAt: Date.now() + CACHE_TTL_MS };
-      return disk.version;
-    }
-    const fetched = await fetchLatest();
-    if (fetched) {
-      await writeDiskCache({ version: fetched, fetchedAt: Date.now() });
-      memoryCache = { version: fetched, expiresAt: Date.now() + CACHE_TTL_MS };
-      return fetched;
-    }
-    const resolved = disk?.version ?? FALLBACK_VERSION;
-    memoryCache = { version: resolved, expiresAt: Date.now() + 5 * 60 * 1e3 };
-    log(
-      "WARN",
-      "claude-code-version",
-      `Failed to fetch latest Claude Code version; using ${resolved}`
-    );
-    return resolved;
-  })();
-  try {
-    return await inflight;
-  } finally {
-    inflight = null;
-  }
-}
-async function getClaudeCliUserAgent() {
-  const version = await getClaudeCodeVersion();
-  return `claude-cli/${version} (external, cli)`;
-}
-
-// src/auth-storage.ts
-import fs4 from "fs/promises";
-import crypto5 from "crypto";
-
-// src/oauth/anthropic.ts
-import crypto2 from "crypto";
-
-// src/oauth/pkce.ts
-function base64urlEncode(bytes) {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-async function generatePKCE() {
-  const verifierBytes = new Uint8Array(32);
-  crypto.getRandomValues(verifierBytes);
-  const verifier = base64urlEncode(verifierBytes);
-  const data = new TextEncoder().encode(verifier);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
-  return { verifier, challenge };
-}
-
-// src/oauth/anthropic.ts
-var CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
-var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URLS = [
-  "https://platform.claude.com/v1/oauth/token",
-  "https://console.anthropic.com/v1/oauth/token"
-];
-var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
-var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-async function postTokenRequest(body, label) {
-  const encoded = JSON.stringify(body);
-  const headers = {
-    "Content-Type": "application/json",
-    "User-Agent": await getClaudeCliUserAgent(),
-    "anthropic-beta": "oauth-2025-04-20"
-  };
-  let lastError = null;
-  for (const url of TOKEN_URLS) {
-    let response;
-    try {
-      response = await fetch(url, { method: "POST", headers, body: encoded });
-    } catch (err) {
-      lastError = err instanceof Error ? err : new Error(String(err));
-      continue;
-    }
-    if (response.ok) {
-      return await response.json();
-    }
-    const text = await response.text();
-    if (response.status >= 400 && response.status < 500) {
-      throw new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
-    }
-    lastError = new Error(`Anthropic ${label} failed (${response.status}): ${text}`);
-  }
-  throw lastError ?? new Error(`Anthropic ${label} failed: all endpoints unreachable`);
-}
-function toCredentials(data) {
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-async function loginAnthropic(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto2.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLIENT_ID,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: SCOPES,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${AUTHORIZE_URL}?${params}`;
-  callbacks.onOpenUrl(authUrl);
-  const raw = await callbacks.onPromptCode("Paste the code from the browser (format: code#state):");
-  const parts = raw.trim().split("#");
-  if (parts.length !== 2 || !parts[0] || parts[1] !== state) {
-    throw new Error("Invalid code or state mismatch. Please try again.");
-  }
-  return exchangeAnthropicCode(parts[0], parts[1], verifier);
-}
-async function exchangeAnthropicCode(code, state, verifier) {
-  const data = await postTokenRequest(
-    {
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      state,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: verifier
-    },
-    "token exchange"
-  );
-  return toCredentials(data);
-}
-async function refreshAnthropicToken(refreshToken) {
-  const data = await postTokenRequest(
-    {
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID,
-      refresh_token: refreshToken
-    },
-    "token refresh"
-  );
-  return toCredentials(data);
-}
-
-// src/oauth/openai.ts
-import http from "http";
-import crypto3 from "crypto";
-var CLIENT_ID2 = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
-var TOKEN_URL = "https://auth.openai.com/oauth/token";
-var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
-var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
-async function loginOpenAI(callbacks) {
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto3.randomBytes(16).toString("hex");
-  const url = new URL(AUTHORIZE_URL2);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID2);
-  url.searchParams.set("redirect_uri", REDIRECT_URI2);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("prompt", "login");
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", "ezcoder");
-  let code;
-  try {
-    code = await loginWithServer(url.toString(), state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    code = parsed.code;
-  }
-  const creds = await exchangeOpenAICode(code, verifier);
-  const accountId = getAccountId(creds.accessToken);
-  if (!accountId) {
-    throw new Error("Failed to extract accountId from OpenAI token.");
-  }
-  creds.accountId = accountId;
-  return creds;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  return { code: value };
-}
-function decodeJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const decoded = atob(parts[1]);
-    return JSON.parse(decoded);
-  } catch {
-    return null;
-  }
-}
-function getAccountId(accessToken) {
-  const payload = decodeJwt(accessToken);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const accountId = auth?.chatgpt_account_id;
-  return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
-}
-async function loginWithServer(authUrl, expectedState, callbacks) {
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url || "", "http://localhost");
-      if (url.pathname !== "/auth/callback") {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => {
-      reject(err);
-    });
-    server.listen(1455, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
-    const timeout = setTimeout(() => {
-      if (!receivedCode) {
-        server.close();
-      }
-    }, 12e4);
-    timeout.unref();
-    server.on("close", () => {
-      clearTimeout(timeout);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code"));
-      }
-    });
-  });
-}
-async function exchangeOpenAICode(code, verifier) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID2,
-      code,
-      redirect_uri: REDIRECT_URI2,
-      code_verifier: verifier
-    })
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token exchange failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
-}
-async function refreshOpenAIToken(refreshToken) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLIENT_ID2
-    })
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`OpenAI token refresh failed (${response.status}): ${text}`);
-  }
-  const data = await response.json();
-  const creds = {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3
-  };
-  const accountId = getAccountId(creds.accessToken);
-  if (accountId) {
-    creds.accountId = accountId;
-  }
-  return creds;
-}
-
-// src/oauth/gemini.ts
-import http2 from "http";
-import crypto4 from "crypto";
-var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
-var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
-var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
-var DEFAULT_CLIENT_SECRET = "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";
-var AUTHORIZE_URL3 = "https://accounts.google.com/o/oauth2/v2/auth";
-var TOKEN_URL2 = "https://oauth2.googleapis.com/token";
-var CODE_ASSIST_BASE_URL = "https://cloudcode-pa.googleapis.com";
-var CODE_ASSIST_API_VERSION = "v1internal";
-var CODE_ASSIST_POST_RETRIES = 3;
-var CODE_ASSIST_POST_RETRY_DELAY_MS = 100;
-var SCOPE2 = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile"
-].join(" ");
-var USER_TIER_FREE = "free-tier";
-var USER_TIER_LEGACY = "legacy-tier";
-var USER_TIER_STANDARD = "standard-tier";
-var VALIDATION_REQUIRED_REASON = "VALIDATION_REQUIRED";
-var VPC_SC_REASON = "SECURITY_POLICY_VIOLATED";
-var CodeAssistHttpError = class extends Error {
-  status;
-  body;
-  constructor(label, status, body) {
-    super(`Gemini Code Assist ${label} failed (${status}): ${body}`);
-    this.name = "CodeAssistHttpError";
-    this.status = status;
-    this.body = body;
-  }
-};
-async function loginGemini(callbacks) {
-  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
-  const { verifier, challenge } = await generatePKCE();
-  const state = crypto4.randomBytes(32).toString("hex");
-  const redirectUri = await getLoopbackRedirectUri();
-  const url = new URL(AUTHORIZE_URL3);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId);
-  url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", SCOPE2);
-  url.searchParams.set("access_type", "offline");
-  url.searchParams.set("prompt", "consent");
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  let code;
-  try {
-    code = await loginWithServer2(url.toString(), redirectUri, state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput2(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    if (parsed.state && parsed.state !== state) {
-      throw new Error("Invalid state. Please try again.");
-    }
-    code = parsed.code;
-  }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret);
-  callbacks.onStatus("Setting up Gemini Code Assist access...");
-  const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
-  return {
-    ...creds,
-    projectId
-  };
-}
-async function refreshGeminiToken(refreshToken) {
-  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
-  const data = await postTokenRequest2({
-    grant_type: "refresh_token",
-    refresh_token: refreshToken,
-    client_id: clientId,
-    client_secret: clientSecret
-  });
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? refreshToken,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-function getGeminiOAuthClientCredentials() {
-  const clientId = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
-  const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId, clientSecret };
-}
-async function getLoopbackRedirectUri() {
-  return new Promise((resolve, reject) => {
-    const server = http2.createServer();
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      server.close(() => {
-        if (addr && typeof addr === "object") {
-          resolve(`http://127.0.0.1:${addr.port}/oauth2callback`);
-        } else {
-          reject(new Error("Failed to allocate OAuth callback port."));
-        }
-      });
-    });
-    server.on("error", reject);
-  });
-}
-function parseAuthorizationInput2(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  return { code: value };
-}
-async function loginWithServer2(authUrl, redirectUri, expectedState, callbacks) {
-  const redirect = new URL(redirectUri);
-  const port = Number(redirect.port);
-  return new Promise((resolve, reject) => {
-    let receivedCode = null;
-    const server = http2.createServer((req, res) => {
-      const url = new URL(req.url || "", redirect.origin);
-      if (url.pathname !== redirect.pathname) {
-        res.statusCode = 404;
-        res.end("Not found");
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.statusCode = 400;
-        res.end("State mismatch");
-        return;
-      }
-      receivedCode = url.searchParams.get("code");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end("<html><body><h1>Login successful!</h1><p>You can close this tab.</p></body></html>");
-      server.close();
-    });
-    server.on("error", (err) => reject(err));
-    server.listen(port, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
-    const timeout = setTimeout(() => {
-      if (!receivedCode) server.close();
-    }, 12e4);
-    timeout.unref();
-    server.on("close", () => {
-      clearTimeout(timeout);
-      if (receivedCode) {
-        resolve(receivedCode);
-      } else {
-        reject(new Error("Server closed without receiving code."));
-      }
-    });
-  });
-}
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret) {
-  const data = await postTokenRequest2({
-    grant_type: "authorization_code",
-    client_id: clientId,
-    client_secret: clientSecret,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
-  });
-  if (!data.refresh_token) {
-    throw new Error("Gemini OAuth did not return a refresh token. Please try login again.");
-  }
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: Date.now() + data.expires_in * 1e3 - 5 * 60 * 1e3
-  };
-}
-async function postTokenRequest2(body) {
-  const response = await fetch(TOKEN_URL2, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(body)
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Gemini token request failed (${response.status}): ${text}`);
-  }
-  return await response.json();
-}
-async function setupCodeAssistProject(accessToken, callbacks) {
-  const envProject = process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID;
-  if (envProject && /^\d+$/.test(envProject)) {
-    throw new Error("GOOGLE_CLOUD_PROJECT must be a project ID, not a numeric project number.");
-  }
-  const coreMetadata = {
-    ideType: "IDE_UNSPECIFIED",
-    platform: "PLATFORM_UNSPECIFIED",
-    pluginType: "GEMINI"
-  };
-  const projectMetadata = {
-    ...coreMetadata,
-    ...envProject ? { duetProject: envProject } : {}
-  };
-  let loadRes;
-  while (true) {
-    loadRes = await loadCodeAssist(accessToken, envProject, projectMetadata);
-    const validation = getValidationRequiredTier(loadRes);
-    if (!validation) break;
-    callbacks.onStatus(
-      `Gemini Code Assist requires account validation${validation.reasonMessage ? `: ${validation.reasonMessage}` : ""}`
-    );
-    callbacks.onOpenUrl(validation.validationUrl);
-    const answer = await callbacks.onPromptCode(
-      "Complete validation in the browser, then press Enter to retry (or type cancel):"
-    );
-    if (answer.trim().toLowerCase() === "cancel") {
-      throw new Error("Gemini Code Assist account validation was cancelled.");
-    }
-  }
-  if (loadRes.currentTier) {
-    const project2 = loadRes.cloudaicompanionProject ?? envProject;
-    if (!project2) throwProjectError(loadRes);
-    return project2;
-  }
-  const tier = getOnboardTier(loadRes);
-  const onboardReq = tier.id === USER_TIER_FREE ? {
-    tierId: tier.id,
-    cloudaicompanionProject: void 0,
-    metadata: coreMetadata
-  } : {
-    tierId: tier.id,
-    cloudaicompanionProject: envProject,
-    metadata: projectMetadata
-  };
-  let operation = await codeAssistPost(
-    accessToken,
-    "onboardUser",
-    onboardReq
-  );
-  while (!operation.done && operation.name) {
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    operation = await codeAssistGet(accessToken, operation.name);
-  }
-  const project = operation.response?.cloudaicompanionProject?.id ?? envProject;
-  if (!project) throwProjectError(loadRes);
-  return project;
-}
-async function loadCodeAssist(accessToken, envProject, metadata) {
-  try {
-    return await codeAssistPost(accessToken, "loadCodeAssist", {
-      ...envProject ? { cloudaicompanionProject: envProject } : {},
-      metadata
-    });
-  } catch (err) {
-    if (err instanceof CodeAssistHttpError && isVpcScAffectedError(err)) {
-      return { currentTier: { id: USER_TIER_STANDARD } };
-    }
-    if (err instanceof CodeAssistHttpError && err.status === 403 && envProject === "cloudshell-gca") {
-      throw new Error(
-        "Access to the default Cloud Shell Gemini project was denied.\nPlease set your own Google Cloud project by running:\ngcloud config set project [PROJECT_ID]\nor setting export GOOGLE_CLOUD_PROJECT=...",
-        { cause: err }
-      );
-    }
-    throw err;
-  }
-}
-function getValidationRequiredTier(response) {
-  return response.ineligibleTiers?.find(
-    (tier) => tier.reasonCode === VALIDATION_REQUIRED_REASON && typeof tier.validationUrl === "string"
-  );
-}
-function getOnboardTier(response) {
-  const defaultTier = response.allowedTiers?.find((tier) => tier.isDefault);
-  return defaultTier ?? { id: USER_TIER_LEGACY, name: "" };
-}
-function throwProjectError(response) {
-  const reasons = response.ineligibleTiers?.map((tier) => tier.reasonMessage ?? tier.tierName).filter((reason) => Boolean(reason));
-  if (reasons && reasons.length > 0) {
-    throw new Error(`Gemini Code Assist setup failed: ${reasons.join(", ")}`);
-  }
-  throw new Error(
-    "Gemini requires a Google Cloud project for this account. Set GOOGLE_CLOUD_PROJECT and try again."
-  );
-}
-async function codeAssistPost(accessToken, method, body) {
-  let lastError;
-  for (let attempt = 0; attempt <= CODE_ASSIST_POST_RETRIES; attempt++) {
-    try {
-      return await codeAssistRequest(getCodeAssistMethodUrl(method), accessToken, method, {
-        method: "POST",
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      if (!(err instanceof CodeAssistHttpError) || attempt === CODE_ASSIST_POST_RETRIES || !shouldRetryCodeAssistStatus(err.status)) {
-        throw err;
-      }
-      lastError = err;
-    }
-    await new Promise((resolve) => setTimeout(resolve, CODE_ASSIST_POST_RETRY_DELAY_MS));
-  }
-  throw lastError ?? new Error(`Gemini Code Assist ${method} failed.`);
-}
-async function codeAssistGet(accessToken, operationName) {
-  return codeAssistRequest(getCodeAssistOperationUrl(operationName), accessToken, "operation", {
-    method: "GET"
-  });
-}
-async function codeAssistRequest(url, accessToken, label, init) {
-  const response = await fetch(url, {
-    ...init,
-    headers: codeAssistHeaders(accessToken)
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new CodeAssistHttpError(label, response.status, text);
-  }
-  return await response.json();
-}
-function getCodeAssistBaseUrl() {
-  const endpoint = process.env.CODE_ASSIST_ENDPOINT ?? CODE_ASSIST_BASE_URL;
-  const version = process.env.CODE_ASSIST_API_VERSION || CODE_ASSIST_API_VERSION;
-  return `${endpoint}/${version}`;
-}
-function getCodeAssistMethodUrl(method) {
-  return `${getCodeAssistBaseUrl()}:${method}`;
-}
-function getCodeAssistOperationUrl(operationName) {
-  return `${getCodeAssistBaseUrl()}/${operationName}`;
-}
-function shouldRetryCodeAssistStatus(status) {
-  return status === 429 || status === 499 || status >= 500 && status <= 599;
-}
-function isVpcScAffectedError(error) {
-  try {
-    const parsed = JSON.parse(error.body);
-    if (!parsed || typeof parsed !== "object" || !("error" in parsed)) return false;
-    const details = parsed.error?.details;
-    return Array.isArray(details) ? details.some(
-      (detail) => detail != null && typeof detail === "object" && "reason" in detail && detail.reason === VPC_SC_REASON
-    ) : false;
-  } catch {
-    return false;
-  }
-}
-function codeAssistHeaders(accessToken) {
-  return {
-    Authorization: `Bearer ${accessToken}`,
-    "Content-Type": "application/json",
-    "User-Agent": "google-gemini-cli",
-    "X-Goog-Api-Client": "gemini-cli/0.0.0"
-  };
-}
-
-// src/oauth/kimi.ts
-import { execFileSync } from "child_process";
-import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { arch, hostname, release, type } from "os";
-import path3 from "path";
-var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
-var DEFAULT_CODING_BASE_URL = "https://api.kimi.com/coding/v1";
-var KIMI_PLATFORM = "kimi_code_cli";
-var DEFAULT_KIMI_VERSION = "1.0.11";
-var DEVICE_TIMEOUT_MS = 15 * 60 * 1e3;
-function oauthHost() {
-  const host = process.env.KIMI_CODE_OAUTH_HOST ?? process.env.KIMI_OAUTH_HOST ?? DEFAULT_OAUTH_HOST;
-  return host.replace(/\/+$/, "");
-}
-function kimiCodeBaseUrl() {
-  return (process.env.KIMI_CODE_BASE_URL ?? DEFAULT_CODING_BASE_URL).replace(/\/+$/, "");
-}
-function kimiVersion() {
-  const v = process.env.KIMI_CODE_VERSION ?? DEFAULT_KIMI_VERSION;
-  return asciiHeader(v, DEFAULT_KIMI_VERSION);
-}
-function asciiHeader(value, fallback = "unknown") {
-  const cleaned = value.replace(/[^\u0020-\u007E]/g, "").trim();
-  return cleaned.length > 0 ? cleaned : fallback;
-}
-function macOsProductVersion() {
-  try {
-    const version = execFileSync("/usr/bin/sw_vers", ["-productVersion"], {
-      encoding: "utf-8",
-      timeout: 1e3
-    }).trim();
-    return version.length > 0 ? version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function deviceModel() {
-  const os = type();
-  const version = release();
-  const osArch = arch();
-  if (os === "Darwin") return `macOS ${macOsProductVersion() ?? version} ${osArch}`;
-  if (os === "Windows_NT") return `Windows ${version} ${osArch}`;
-  return `${os} ${version} ${osArch}`.trim();
-}
-function deviceId() {
-  const idPath = path3.join(getAppPaths().agentDir, "kimi_device_id");
-  if (existsSync(idPath)) {
-    try {
-      const text = readFileSync(idPath, "utf-8").trim();
-      if (text.length > 0) return text;
-    } catch {
-    }
-  }
-  const id = randomUUID();
-  try {
-    mkdirSync(getAppPaths().agentDir, { recursive: true, mode: 448 });
-    writeFileSync(idPath, id, { encoding: "utf-8", mode: 384 });
-  } catch {
-  }
-  return id;
-}
-function deviceHeaders() {
-  return {
-    "X-Msh-Platform": KIMI_PLATFORM,
-    "X-Msh-Version": kimiVersion(),
-    "X-Msh-Device-Name": asciiHeader(hostname()),
-    "X-Msh-Device-Model": asciiHeader(deviceModel()),
-    "X-Msh-Os-Version": asciiHeader(release()),
-    "X-Msh-Device-Id": deviceId()
-  };
-}
-function kimiCodingHeaders() {
-  return {
-    "User-Agent": `kimi-code-cli/${kimiVersion()}`,
-    ...deviceHeaders()
-  };
-}
-function isKimiCodingEndpoint(baseUrl) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
-  const normalized = baseUrl.replace(/\/+$/, "");
-  return normalized === kimiCodeBaseUrl() || /(^|\.)kimi\.com/i.test(normalized);
-}
-async function postForm(endpoint, params) {
-  const response = await fetch(`${oauthHost()}${endpoint}`, {
-    method: "POST",
-    headers: {
-      ...deviceHeaders(),
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(params).toString()
-  });
-  let data = {};
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object") data = parsed;
-  } catch {
-  }
-  return { status: response.status, data };
-}
-function errorDetail(data) {
-  const desc = data.error_description ?? data.message ?? data.error;
-  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
-}
-function credsFromTokenResponse(data, opts) {
-  const accessToken = data.access_token;
-  const responseRefreshToken = data.refresh_token;
-  const expiresIn = Number(data.expires_in);
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("Kimi OAuth response missing access_token.");
-  }
-  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
-  if (refreshToken.length === 0) {
-    throw new Error("Kimi OAuth response missing refresh_token.");
-  }
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-    throw new Error("Kimi OAuth response missing or invalid expires_in.");
-  }
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: Date.now() + expiresIn * 1e3,
-    baseUrl: kimiCodeBaseUrl()
-  };
-}
-async function requestDeviceAuthorization() {
-  const { status, data } = await postForm("/api/oauth/device_authorization", {
-    client_id: CLIENT_ID3
-  });
-  if (status !== 200) {
-    throw new Error(`Kimi device authorization failed (${status}): ${errorDetail(data)}`);
-  }
-  const userCode = data.user_code;
-  const deviceCode = data.device_code;
-  const verificationUriComplete = data.verification_uri_complete;
-  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
-    throw new Error("Kimi device authorization response missing user_code/device_code.");
-  }
-  return {
-    userCode,
-    deviceCode,
-    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
-    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
-    interval: Number(data.interval ?? 5) || 5
-  };
-}
-async function pollDeviceToken(deviceCode) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    device_code: deviceCode,
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return { kind: "success", creds: credsFromTokenResponse(data) };
-  }
-  if (status >= 500) {
-    throw new Error(`Kimi token polling server error (${status}): ${errorDetail(data)}`);
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
-  switch (errorCode) {
-    case "authorization_pending":
-      return { kind: "pending" };
-    case "slow_down":
-      return { kind: "slow_down" };
-    case "expired_token":
-      return { kind: "expired" };
-    case "access_denied":
-      return { kind: "denied" };
-    default:
-      throw new Error(`Kimi token polling failed (${status}): ${errorDetail(data)}`);
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-async function loginKimi(callbacks) {
-  const auth = await requestDeviceAuthorization();
-  callbacks.onStatus(
-    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
-  );
-  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
-  callbacks.onStatus("Waiting for you to authorize in the browser...");
-  const deadline = Date.now() + DEVICE_TIMEOUT_MS;
-  let interval = Math.max(auth.interval, 1);
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    const result = await pollDeviceToken(auth.deviceCode);
-    if (result.kind === "success") return result.creds;
-    if (result.kind === "denied") {
-      throw new Error("Kimi authorization was denied.");
-    }
-    if (result.kind === "expired") {
-      throw new Error("Kimi device code expired. Please run login again.");
-    }
-    if (result.kind === "slow_down") {
-      interval += 5;
-    }
-  }
-  throw new Error("Kimi login timed out. Please run login again.");
-}
-async function refreshKimiToken(refreshToken) {
-  const { status, data } = await postForm("/api/oauth/token", {
-    client_id: CLIENT_ID3,
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  if (status === 200 && typeof data.access_token === "string") {
-    return credsFromTokenResponse(data, { fallbackRefreshToken: refreshToken });
-  }
-  const errorCode = typeof data.error === "string" ? data.error : "";
-  throw new Error(`Kimi token refresh failed (${status}): ${errorCode || errorDetail(data)}`);
-}
-
-// src/auth-storage.ts
-var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
-var REFRESH_SKEW_MS = 6e4;
-var STATIC_API_KEY_PROVIDERS = /* @__PURE__ */ new Set([
-  "glm",
-  "moonshot",
-  "xiaomi",
-  "minimax",
-  "deepseek",
-  "openrouter",
-  "sakana"
-]);
-var AuthStorage = class {
-  data = {};
-  filePath;
-  loaded = false;
-  /** Per-provider lock to serialize concurrent refresh calls. */
-  refreshLocks = /* @__PURE__ */ new Map();
-  constructor(filePath) {
-    this.filePath = filePath ?? getAppPaths().authFile;
-  }
-  /** Path to the on-disk auth file. Useful for status output. */
-  get path() {
-    return this.filePath;
-  }
-  /** List provider keys with stored credentials. */
-  async listProviders() {
-    await this.ensureLoaded();
-    return Object.keys(this.data);
-  }
-  /** True if credentials exist for `provider`. */
-  async hasCredentials(provider) {
-    await this.ensureLoaded();
-    return Boolean(this.data[provider]);
-  }
-  /**
-   * True if the user has any usable auth for the logical provider. For
-   * `moonshot` this is satisfied by either the Kimi OAuth credential or the
-   * Moonshot API key.
-   */
-  async hasProviderAuth(provider) {
-    await this.ensureLoaded();
-    if (provider === "moonshot") {
-      return Boolean(this.data[MOONSHOT_OAUTH_KEY] || this.data["moonshot"]);
-    }
-    return Boolean(this.data[provider]);
-  }
-  /**
-   * True if the active credential for `provider` is a static API key with no
-   * refresh mechanism. For `moonshot` this is only true when the Kimi OAuth
-   * credential is absent (a present OAuth credential is refreshable).
-   */
-  async isStaticApiKey(provider) {
-    await this.ensureLoaded();
-    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
-      return false;
-    }
-    return STATIC_API_KEY_PROVIDERS.has(provider);
-  }
-  async load() {
-    await withFileLock(this.filePath, async () => {
-      try {
-        const content = await fs4.readFile(this.filePath, "utf-8");
-        this.data = JSON.parse(content);
-        log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
-          providers: Object.keys(this.data).join(",") || "(none)"
-        });
-      } catch (err) {
-        this.data = {};
-        const code = err.code;
-        if (code === "ENOENT") {
-          log("INFO", "auth", `No auth file found at ${this.filePath} (first run)`);
-        } else {
-          log(
-            "ERROR",
-            "auth",
-            `Failed to load auth file: ${err instanceof Error ? err.message : String(err)}`,
-            { path: this.filePath, code: code ?? "unknown" }
-          );
-        }
-      }
-    });
-    this.loaded = true;
-  }
-  async ensureLoaded() {
-    if (!this.loaded) await this.load();
-  }
-  /**
-   * Force a re-read from disk, discarding the in-memory cache. Needed when
-   * another process mutates the auth file out-of-band — e.g. the desktop app
-   * writes API keys natively (Rust → ~/.ezcoder/auth.json) without going through
-   * this instance, so a long-lived daemon's cache would otherwise stay stale and
-   * never see a newly added provider key.
-   */
-  async reload() {
-    this.loaded = false;
-    await this.load();
-  }
-  async getCredentials(provider) {
-    await this.ensureLoaded();
-    return this.data[provider];
-  }
-  async setCredentials(provider, creds) {
-    await this.ensureLoaded();
-    this.data[provider] = creds;
-    await this.save();
-  }
-  async clearCredentials(provider) {
-    await this.ensureLoaded();
-    delete this.data[provider];
-    await this.save();
-  }
-  async clearAll() {
-    this.data = {};
-    await this.save();
-  }
-  /**
-   * Returns valid credentials, auto-refreshing if expired.
-   * If `forceRefresh` is true, refreshes even if the token hasn't expired
-   * (useful when the provider rejects a token with 401 before its stored expiry).
-   * Throws if not logged in.
-   */
-  async resolveCredentials(provider, opts) {
-    await this.ensureLoaded();
-    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
-      try {
-        return await this.resolveCredentials(MOONSHOT_OAUTH_KEY, opts);
-      } catch (err) {
-        if (err instanceof NotLoggedInError && this.data["moonshot"]) {
-          log(
-            "WARN",
-            "auth",
-            'Kimi OAuth credential is no longer valid \u2014 falling back to the Moonshot API key. Run "ezcoder login" and choose Kimi OAuth to restore OAuth auth.'
-          );
-          return this.data["moonshot"];
-        }
-        throw err;
-      }
-    }
-    const creds = this.data[provider];
-    if (!creds) {
-      throw new NotLoggedInError(provider);
-    }
-    if (STATIC_API_KEY_PROVIDERS.has(provider)) {
-      return creds;
-    }
-    if (!opts?.forceRefresh && Date.now() < creds.expiresAt - REFRESH_SKEW_MS) {
-      return creds;
-    }
-    const existing = this.refreshLocks.get(provider);
-    if (existing) return existing;
-    const refreshPromise = withFileLock(this.filePath, async () => {
-      try {
-        const content = await fs4.readFile(this.filePath, "utf-8");
-        const freshData = JSON.parse(content);
-        const freshCreds = freshData[provider];
-        if (freshCreds && !opts?.forceRefresh && Date.now() < freshCreds.expiresAt - REFRESH_SKEW_MS) {
-          this.data[provider] = freshCreds;
-          return freshCreds;
-        }
-      } catch {
-      }
-      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
-      let refreshed;
-      try {
-        refreshed = await refreshFn(creds.refreshToken);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        const isAuthFailure = /\((401|400)\)/.test(msg) || /invalid_grant|invalid_token|invalid.*refresh/i.test(msg) || /unauthorized/i.test(msg);
-        if (isAuthFailure) {
-          delete this.data[provider];
-          await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-          throw new NotLoggedInError(provider);
-        }
-        throw err;
-      }
-      if (!refreshed.accountId && creds.accountId) {
-        refreshed.accountId = creds.accountId;
-      }
-      if (!refreshed.projectId && creds.projectId) {
-        refreshed.projectId = creds.projectId;
-      }
-      if (!refreshed.baseUrl && creds.baseUrl) {
-        refreshed.baseUrl = creds.baseUrl;
-      }
-      this.data[provider] = refreshed;
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-      return refreshed;
-    });
-    this.refreshLocks.set(provider, refreshPromise);
-    try {
-      return await refreshPromise;
-    } finally {
-      this.refreshLocks.delete(provider);
-    }
-  }
-  /**
-   * Returns a valid access token, auto-refreshing if expired.
-   * Throws if not logged in.
-   */
-  async resolveToken(provider) {
-    const creds = await this.resolveCredentials(provider);
-    return creds.accessToken;
-  }
-  async save() {
-    await withFileLock(this.filePath, async () => {
-      await atomicWriteFile(this.filePath, JSON.stringify(this.data, null, 2));
-    });
-  }
-};
-async function atomicWriteFile(filePath, content) {
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto5.randomUUID().slice(0, 8)}.tmp`;
-  try {
-    await fs4.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await fs4.rename(tmpPath, filePath);
-  } catch (err) {
-    await fs4.unlink(tmpPath).catch(() => {
-    });
-    throw err;
-  }
-}
-var NotLoggedInError = class extends Error {
-  provider;
-  constructor(provider) {
-    super(`Not logged in to ${provider}. Run "ezcoder login" to authenticate.`);
-    this.name = "NotLoggedInError";
-    this.provider = provider;
-  }
-};
-
 // src/telegram.ts
 var TELEGRAM_API = "https://api.telegram.org";
 var MAX_MESSAGE_LENGTH = 4096;
@@ -1463,7 +155,7 @@ var TelegramBot = class {
       } catch (err) {
         if (!this.running) break;
         console.error(`[telegram] Poll error: ${err instanceof Error ? err.message : err}`);
-        await sleep2(3e3);
+        await sleep(3e3);
       }
     }
   }
@@ -1633,7 +325,7 @@ function splitMessage(text) {
   }
   return chunks;
 }
-function sleep2(ms) {
+function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
@@ -1719,10 +411,10 @@ async function transcribeVoice(fileUrl) {
 
 // src/auto-update.ts
 import { spawn } from "child_process";
-import fs5 from "fs";
-import path4 from "path";
+import fs from "fs";
+import path from "path";
 var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
-var FETCH_TIMEOUT_MS2 = 1e4;
+var FETCH_TIMEOUT_MS = 1e4;
 function compareVersions(a, b) {
   const pa = a.split(".").map(Number);
   const pb = b.split(".").map(Number);
@@ -1753,7 +445,7 @@ function createAutoUpdater(config) {
   }
   function readState() {
     try {
-      const raw = fs5.readFileSync(stateFilePath(), "utf-8");
+      const raw = fs.readFileSync(stateFilePath(), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -1762,8 +454,8 @@ function createAutoUpdater(config) {
   function writeState(state) {
     try {
       const filePath = stateFilePath();
-      fs5.mkdirSync(path4.dirname(filePath), { recursive: true, mode: 448 });
-      fs5.writeFileSync(filePath, JSON.stringify(state));
+      fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
+      fs.writeFileSync(filePath, JSON.stringify(state));
     } catch {
     }
   }
@@ -1792,7 +484,7 @@ function createAutoUpdater(config) {
   async function fetchLatestVersion() {
     try {
       const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
+      const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
       const response = await fetch(REGISTRY_URL, { signal: controller.signal });
       clearTimeout(timeout);
       const data = await response.json();
@@ -1892,12 +584,15 @@ export {
   MOONSHOT_OAUTH_KEY,
   NotLoggedInError,
   TelegramBot,
+  XIAOMI_CREDITS_KEY,
   closeLogger,
   createAutoUpdater,
   decodeOggOpus,
   downmixToMono,
   generatePKCE,
   getAppPaths,
+  getAuthStorageKey,
+  getAuthStorageKeys,
   getClaudeCliUserAgent,
   getClaudeCodeVersion,
   getContextWindow,