@prestyj/core 5.11.0 → 5.13.0

package/dist/{chunk-WAG5K2MH.js → chunk-S6QBRJ4D.js}

@@ -256,6 +256,7 @@ import path2 from "path";
 import { randomBytes } from "crypto";
 import { environmentSecrets, redactText, redactValue } from "@prestyj/ai";
 var MAX_BYTES = 10 * 1024 * 1024;
+var MIN_HEADROOM_BYTES = 64 * 1024;
 var fd = null;
 var bytesWritten = 0;
 var capped = false;
@@ -266,7 +267,7 @@ var exactSecrets = [];
 function rotateIfNeeded(filePath) {
   try {
     const st = fs.statSync(filePath);
-    if (st.size < MAX_BYTES) return;
+    if (st.size <= MAX_BYTES - MIN_HEADROOM_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
       fs.unlinkSync(rotated);
@@ -561,6 +562,9 @@ var TOKEN_URL = "https://auth.openai.com/oauth/token";
 var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
 var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
 var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+var CALLBACK_TIMEOUT_MS = 12e4;
+var MAX_PASTE_ATTEMPTS = 3;
+var MIN_RAW_CODE_LENGTH = 10;
 async function loginOpenAI(callbacks) {
   const { verifier, challenge } = await generatePKCE();
   const state = crypto3.randomBytes(16).toString("hex");
@@ -576,20 +580,7 @@ async function loginOpenAI(callbacks) {
   url.searchParams.set("id_token_add_organizations", "true");
   url.searchParams.set("codex_cli_simplified_flow", "true");
   url.searchParams.set("originator", "ezcoder");
-  let code;
-  try {
-    code = await loginWithServer(url.toString(), state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    code = parsed.code;
-  }
+  const code = await acquireAuthorizationCode(url.toString(), state, callbacks);
   const creds = await exchangeOpenAICode(code, verifier);
   const accountId = getAccountId(creds.accessToken);
   if (!accountId) {
@@ -620,6 +611,7 @@ function parseAuthorizationInput(input) {
       state: params.get("state") ?? void 0
     };
   }
+  if (/\s/.test(value) || value.length < MIN_RAW_CODE_LENGTH) return {};
   return { code: value };
 }
 function decodeJwt(token) {
@@ -638,7 +630,55 @@ function getAccountId(accessToken) {
   const accountId = auth?.chatgpt_account_id;
   return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
 }
-async function loginWithServer(authUrl, expectedState, callbacks) {
+async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
+  callbacks.onOpenUrl(authUrl);
+  callbacks.onStatus("Waiting for browser callback...");
+  const done = new AbortController();
+  try {
+    return await new Promise((resolve, reject) => {
+      let serverFailed = false;
+      let pasteError;
+      const failIfExhausted = () => {
+        if (!serverFailed || pasteError === void 0) return;
+        reject(
+          pasteError instanceof Error ? pasteError : new Error("Could not obtain an authorization code.")
+        );
+      };
+      listenForCallback(expectedState, done.signal).then(resolve, () => {
+        serverFailed = true;
+        failIfExhausted();
+      });
+      promptForCode(expectedState, callbacks, done.signal).then(resolve, (err) => {
+        if (err instanceof FatalLoginError) {
+          reject(err);
+          return;
+        }
+        pasteError = err;
+        failIfExhausted();
+      });
+    });
+  } finally {
+    done.abort();
+  }
+}
+var FatalLoginError = class extends Error {
+};
+async function promptForCode(expectedState, callbacks, signal) {
+  let message = "If the browser is on another machine (SSH/headless), paste the callback URL or code here:";
+  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
+    if (signal.aborted) throw new Error("Authorization code already received.");
+    const raw = await callbacks.onPromptCode(message, signal);
+    if (signal.aborted) throw new Error("Authorization code already received.");
+    const parsed = parseAuthorizationInput(raw);
+    if (parsed.code && parsed.state && parsed.state !== expectedState) {
+      throw new FatalLoginError("Authorization state mismatch \u2014 start the login again.");
+    }
+    if (parsed.code) return parsed.code;
+    message = "That didn't contain an authorization code. Paste the full callback URL:";
+  }
+  throw new Error("No authorization code found in input.");
+}
+async function listenForCallback(expectedState, signal) {
   return new Promise((resolve, reject) => {
     let receivedCode = null;
     const server = http.createServer((req, res) => {
@@ -661,18 +701,18 @@ async function loginWithServer(authUrl, expectedState, callbacks) {
     server.on("error", (err) => {
       reject(err);
     });
-    server.listen(1455, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
+    server.listen(1455, "127.0.0.1");
     const timeout = setTimeout(() => {
-      if (!receivedCode) {
-        server.close();
-      }
-    }, 12e4);
+      if (!receivedCode) server.close();
+    }, CALLBACK_TIMEOUT_MS);
     timeout.unref();
+    const onAbort = () => {
+      server.close();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
     server.on("close", () => {
       clearTimeout(timeout);
+      signal.removeEventListener("abort", onAbort);
       if (receivedCode) {
         resolve(receivedCode);
       } else {
@@ -734,8 +774,8 @@ async function refreshOpenAIToken(refreshToken) {
 // src/oauth/gemini.ts
 import http2 from "http";
 import crypto4 from "crypto";
-var CLIENT_ID_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_ID";
-var CLIENT_SECRET_ENV = "GGCODER_GEMINI_OAUTH_CLIENT_SECRET";
+var CLIENT_ID_ENV = "EZCODER_GEMINI_OAUTH_CLIENT_ID";
+var CLIENT_SECRET_ENV = "EZCODER_GEMINI_OAUTH_CLIENT_SECRET";
 var DEFAULT_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
 var DEFAULT_CLIENT_SECRET = "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";
 var AUTHORIZE_URL3 = "https://accounts.google.com/o/oauth2/v2/auth";
@@ -765,13 +805,13 @@ var CodeAssistHttpError = class extends Error {
   }
 };
 async function loginGemini(callbacks) {
-  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
+  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
   const { verifier, challenge } = await generatePKCE();
   const state = crypto4.randomBytes(32).toString("hex");
   const redirectUri = await getLoopbackRedirectUri();
   const url = new URL(AUTHORIZE_URL3);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("client_id", clientId2);
   url.searchParams.set("redirect_uri", redirectUri);
   url.searchParams.set("scope", SCOPE2);
   url.searchParams.set("access_type", "offline");
@@ -781,7 +821,7 @@ async function loginGemini(callbacks) {
   url.searchParams.set("state", state);
   let code;
   try {
-    code = await loginWithServer2(url.toString(), redirectUri, state, callbacks);
+    code = await loginWithServer(url.toString(), redirectUri, state, callbacks);
   } catch {
     callbacks.onOpenUrl(url.toString());
     const raw = await callbacks.onPromptCode(
@@ -796,7 +836,7 @@ async function loginGemini(callbacks) {
     }
     code = parsed.code;
   }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret);
+  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret);
   callbacks.onStatus("Setting up Gemini Code Assist access...");
   const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
   return {
@@ -805,11 +845,11 @@ async function loginGemini(callbacks) {
   };
 }
 async function refreshGeminiToken(refreshToken) {
-  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
+  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
   const data = await postTokenRequest2({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
-    client_id: clientId,
+    client_id: clientId2,
     client_secret: clientSecret
   });
   return {
@@ -819,9 +859,9 @@ async function refreshGeminiToken(refreshToken) {
   };
 }
 function getGeminiOAuthClientCredentials() {
-  const clientId = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
+  const clientId2 = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
   const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId, clientSecret };
+  return { clientId: clientId2, clientSecret };
 }
 async function getLoopbackRedirectUri() {
   return new Promise((resolve, reject) => {
@@ -859,7 +899,7 @@ function parseAuthorizationInput2(input) {
   }
   return { code: value };
 }
-async function loginWithServer2(authUrl, redirectUri, expectedState, callbacks) {
+async function loginWithServer(authUrl, redirectUri, expectedState, callbacks) {
   const redirect = new URL(redirectUri);
   const port = Number(redirect.port);
   return new Promise((resolve, reject) => {
@@ -900,10 +940,10 @@ async function loginWithServer2(authUrl, redirectUri, expectedState, callbacks)
     });
   });
 }
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret) {
+async function exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret) {
   const data = await postTokenRequest2({
     grant_type: "authorization_code",
-    client_id: clientId,
+    client_id: clientId2,
     client_secret: clientSecret,
     code,
     redirect_uri: redirectUri,
@@ -1094,6 +1134,204 @@ function codeAssistHeaders(accessToken) {
   };
 }
 
+// src/oauth/xai.ts
+var DEFAULT_CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
+var DEFAULT_ISSUER = "https://auth.x.ai";
+var DEFAULT_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+var OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+var DEFAULT_GROK_CLI_VERSION = "0.2.101";
+var DEVICE_TIMEOUT_FALLBACK_MS = 10 * 60 * 1e3;
+var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
+function issuer() {
+  return (process.env.XAI_OAUTH_ISSUER ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+}
+function clientId() {
+  return process.env.XAI_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID2;
+}
+function grokCliBaseUrl() {
+  return (process.env.XAI_CLI_BASE_URL ?? DEFAULT_CLI_BASE_URL).replace(/\/+$/, "");
+}
+function grokCliVersion() {
+  const raw = process.env.GROK_CLI_VERSION ?? DEFAULT_GROK_CLI_VERSION;
+  const cleaned = raw.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : DEFAULT_GROK_CLI_VERSION;
+}
+function grokCliHeaders(modelId) {
+  return {
+    "X-XAI-Token-Auth": "xai-grok-cli",
+    "x-grok-client-version": grokCliVersion(),
+    "x-grok-client-identifier": "ezcoder",
+    ...modelId ? { "x-grok-model-override": modelId } : {}
+  };
+}
+function isGrokCliEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === grokCliBaseUrl() || /(^|\.)grok\.com/i.test(normalized);
+}
+async function postForm2(endpoint, params) {
+  const response = await fetch(`${issuer()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      "User-Agent": `grok-cli/${grokCliVersion()}`
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail2(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function jwtExpirySeconds(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return void 0;
+  try {
+    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
+      "utf-8"
+    );
+    const claims = JSON.parse(json);
+    if (!claims || typeof claims !== "object") return void 0;
+    const exp = claims.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function credsFromTokenResponse2(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Grok OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error(
+      "Grok OAuth response missing refresh_token \u2014 the offline_access scope was not granted."
+    );
+  }
+  const responseExpiresIn = Number(data.expires_in);
+  let expiresIn;
+  if (Number.isFinite(responseExpiresIn) && responseExpiresIn > 0) {
+    expiresIn = responseExpiresIn;
+  } else {
+    const exp = jwtExpirySeconds(accessToken);
+    const fromJwt = exp !== void 0 ? exp - Math.floor(Date.now() / 1e3) : 0;
+    expiresIn = fromJwt > 0 ? fromJwt : DEFAULT_TOKEN_LIFETIME_SECONDS;
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    expiresIn,
+    baseUrl: grokCliBaseUrl()
+  };
+}
+async function requestDeviceAuthorization2() {
+  const { status, data } = await postForm2("/oauth2/device/code", {
+    client_id: clientId(),
+    scope: OAUTH_SCOPE
+  });
+  if (status !== 200) {
+    throw new Error(`Grok device authorization failed (${status}): ${errorDetail2(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Grok device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5,
+    // RFC 8628 §3.2: the server states how long the device code lives. Honor it
+    // rather than imposing our own budget — polling a code we know is dead only
+    // burns requests, and a longer local window would keep a user waiting past
+    // the point the code can ever succeed.
+    expiresInMs: (Number(data.expires_in) || 0) > 0 ? Number(data.expires_in) * 1e3 : DEVICE_TIMEOUT_FALLBACK_MS
+  };
+}
+async function pollDeviceToken2(deviceCode) {
+  const { status, data } = await postForm2("/oauth2/token", {
+    client_id: clientId(),
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse2(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Grok token polling server error (${status}): ${errorDetail2(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Grok token polling failed (${status}): ${errorDetail2(data)}`);
+  }
+}
+function sleep2(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginXai(callbacks) {
+  const auth = await requestDeviceAuthorization2();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + auth.expiresInMs;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    const remaining = deadline - Date.now();
+    await sleep2(Math.min(interval * 1e3, remaining));
+    const result = await pollDeviceToken2(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Grok authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Grok device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Grok login timed out. Please run login again.");
+}
+async function refreshXaiToken(refreshToken) {
+  const { status, data } = await postForm2("/oauth2/token", {
+    client_id: clientId(),
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse2(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Grok token refresh failed (${status}): ${errorCode || errorDetail2(data)}`);
+}
+
 // src/file-lock.ts
 import fs3 from "fs/promises";
 import { setTimeout as setTimeout2 } from "timers/promises";
@@ -1158,18 +1396,49 @@ function isAlive(pid) {
 
 // src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
+var XAI_OAUTH_KEY = "xai-oauth";
+var DUAL_AUTH_PROVIDERS = [
+  {
+    provider: "moonshot",
+    oauthKey: MOONSHOT_OAUTH_KEY,
+    oauthLabel: "Kimi OAuth",
+    apiKeyLabel: "Moonshot API key",
+    restoreHint: 'Run "ezcoder login" and choose Kimi OAuth to restore OAuth auth.'
+  },
+  {
+    provider: "xai",
+    oauthKey: XAI_OAUTH_KEY,
+    oauthLabel: "Grok OAuth",
+    apiKeyLabel: "xAI API key",
+    restoreHint: 'Run "ezcoder login" and choose Grok OAuth to restore OAuth auth.'
+  }
+];
+function dualAuthProvider(provider) {
+  return DUAL_AUTH_PROVIDERS.find((entry) => entry.provider === provider);
+}
+function dualAuthProviderByOAuthKey(storageKey) {
+  return DUAL_AUTH_PROVIDERS.find((entry) => entry.oauthKey === storageKey);
+}
+function oauthStorageKey(provider) {
+  return dualAuthProvider(provider)?.oauthKey;
+}
+function providerStorageKeys(provider) {
+  const dual = dualAuthProvider(provider);
+  return dual ? [dual.oauthKey, dual.provider] : [provider];
+}
 var XIAOMI_CREDITS_KEY = "xiaomi-credits";
 var LOCAL_AUTH_KEY_PREFIX = "local:";
 var LOCAL_CREDENTIAL_LIFETIME_MS = 100 * 365 * 24 * 60 * 60 * 1e3;
 function activeBaseUrlEntry(data, provider) {
-  if (provider === "moonshot") {
-    const oauth = data[MOONSHOT_OAUTH_KEY];
+  const dual = dualAuthProvider(provider);
+  if (dual) {
+    const oauth = data[dual.oauthKey];
     if (oauth) {
       const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && data["moonshot"]) return data["moonshot"];
+      if (Date.now() < exhaustedUntil && data[dual.provider]) return data[dual.provider];
       return oauth;
     }
-    return data["moonshot"];
+    return data[dual.provider];
   }
   return data[provider];
 }
@@ -1204,6 +1473,16 @@ var AuthStorage = class {
   data = {};
   filePath;
   loaded = false;
+  /**
+   * mtime+size of the file as of the cached snapshot (`size: -1` = no file).
+   * auth.json is shared: the desktop app writes API keys and disconnects
+   * NATIVELY (so they work with no daemon running), and every window/process has
+   * its own AuthStorage. A load-once cache therefore goes stale — the sidecar
+   * would keep listing models for a provider just disconnected, and hide the
+   * ones just connected, until the daemon restarted.
+   */
+  snapshotMtimeMs = 0;
+  snapshotSize = -1;
   /** Per-provider lock to serialize concurrent refresh calls. */
   refreshLocks = /* @__PURE__ */ new Map();
   constructor(filePath) {
@@ -1215,12 +1494,12 @@ var AuthStorage = class {
   }
   /** List provider keys with stored credentials. */
   async listProviders() {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return Object.keys(this.data);
   }
   /** True if credentials exist for `provider`. */
   async hasCredentials(provider) {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return Boolean(this.data[provider]);
   }
   /**
@@ -1231,18 +1510,19 @@ var AuthStorage = class {
    * instead of re-deriving the same order.
    */
   async pickStorageKey(keys) {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return keys.find((key) => Boolean(this.data[key]));
   }
   /**
-   * True if the user has any usable auth for the logical provider. For
-   * `moonshot` this is satisfied by either the Kimi OAuth credential or the
-   * Moonshot API key.
+   * True if the user has any usable auth for the logical provider. For a
+   * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
+   * satisfies it.
    */
   async hasProviderAuth(provider) {
-    await this.ensureLoaded();
-    if (provider === "moonshot") {
-      return Boolean(this.data[MOONSHOT_OAUTH_KEY] || this.data["moonshot"]);
+    await this.ensureFresh();
+    const dual = dualAuthProvider(provider);
+    if (dual) {
+      return Boolean(this.data[dual.oauthKey] || this.data[dual.provider]);
     }
     if (provider === "xiaomi") {
       return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
@@ -1276,14 +1556,16 @@ var AuthStorage = class {
   }
   /**
    * True if the active credential for `provider` is a static API key with no
-   * refresh mechanism. For `moonshot` this is only true when the Kimi OAuth
-   * credential is absent (a present OAuth credential is refreshable).
+   * refresh mechanism. For a dual-auth provider this is only true when its OAuth
+   * credential is absent or sidelined (a live OAuth credential is refreshable).
    */
   async isStaticApiKey(provider) {
-    await this.ensureLoaded();
-    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
-      const exhaustedUntil = this.data[MOONSHOT_OAUTH_KEY].usageExhaustedUntil ?? 0;
-      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data["moonshot"]);
+    await this.ensureFresh();
+    const dual = dualAuthProvider(provider);
+    const oauthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    if (dual && oauthCreds) {
+      const exhaustedUntil = oauthCreds.usageExhaustedUntil ?? 0;
+      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data[dual.provider]);
       if (!apiKeyActive) return false;
     }
     return STATIC_API_KEY_PROVIDERS.has(provider);
@@ -1291,26 +1573,30 @@ var AuthStorage = class {
   /**
    * The base URL on the credential that is active right now, if any.
    * Synchronous — call only after load()/resolveCredentials() populated the
-   * snapshot. For `moonshot` this is the Kimi For Coding URL whenever the
-   * OAuth entry is the one resolveCredentials would serve (i.e. not currently
-   * usage-exhausted with an API key configured).
+   * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
+   * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
+   * resolveCredentials would serve (i.e. not currently usage-exhausted with an
+   * API key configured).
    */
   getStoredBaseUrl(provider) {
     return activeBaseUrlEntry(this.data, provider)?.baseUrl;
   }
   async load() {
+    const first = !this.loaded;
     await withFileLock(this.filePath, async () => {
       try {
         const content = await fs4.readFile(this.filePath, "utf-8");
         this.data = JSON.parse(content);
-        log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
-          providers: Object.keys(this.data).join(",") || "(none)"
-        });
+        if (first) {
+          log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
+            providers: Object.keys(this.data).join(",") || "(none)"
+          });
+        }
       } catch (err) {
         this.data = {};
         const code = err.code;
         if (code === "ENOENT") {
-          log("INFO", "auth", `No auth file found at ${this.filePath} (first run)`);
+          if (first) log("INFO", "auth", `No auth file found at ${this.filePath} (first run)`);
         } else {
           log(
             "ERROR",
@@ -1322,6 +1608,7 @@ var AuthStorage = class {
       }
     });
     this.loaded = true;
+    await this.rememberSnapshot();
   }
   async ensureLoaded() {
     if (!this.loaded) await this.load();
@@ -1335,6 +1622,42 @@ var AuthStorage = class {
     this.loaded = false;
     await this.load();
   }
+  /**
+   * Like {@link ensureLoaded}, but re-reads when the file changed since this
+   * snapshot — a cheap stat, not a re-parse. Used by the "what is connected?"
+   * readers, which must reflect writes made by another window, the CLI, or the
+   * desktop app's native (daemon-free) API-key and disconnect paths.
+   *
+   * Deliberately NOT used by {@link resolveCredentials}: that path compares the
+   * caller's snapshot against the latest file to detect a concurrent re-login,
+   * and silently refreshing this instance's view first would destroy the
+   * evidence that the token it just had rejected has already been replaced.
+   */
+  async ensureFresh() {
+    if (!this.loaded) {
+      await this.load();
+      return;
+    }
+    let changed;
+    try {
+      const stat = await fs4.stat(this.filePath);
+      changed = stat.mtimeMs !== this.snapshotMtimeMs || stat.size !== this.snapshotSize;
+    } catch {
+      changed = this.snapshotSize !== -1;
+    }
+    if (changed) await this.load();
+  }
+  /** Record the file identity behind the current snapshot. */
+  async rememberSnapshot() {
+    try {
+      const stat = await fs4.stat(this.filePath);
+      this.snapshotMtimeMs = stat.mtimeMs;
+      this.snapshotSize = stat.size;
+    } catch {
+      this.snapshotMtimeMs = 0;
+      this.snapshotSize = -1;
+    }
+  }
   /**
    * Apply one provider-scoped mutation to the latest on-disk snapshot.
    * AuthStorage instances live in every app session/process, so writing this
@@ -1350,14 +1673,16 @@ var AuthStorage = class {
       await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
       this.data = latest;
     });
+    await this.rememberSnapshot();
   }
   async reloadLatest() {
     await withFileLock(this.filePath, async () => {
       this.data = await readAuthData(this.filePath);
     });
+    await this.rememberSnapshot();
   }
   async getCredentials(provider) {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return this.data[provider];
   }
   async setCredentials(provider, creds) {
@@ -1375,7 +1700,7 @@ var AuthStorage = class {
    * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
    * 15-minute default when no reset time is known. While the mark is in the
    * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-   * instead of the Kimi OAuth credential (when both are configured) — OAuth
+   * instead of the subscription OAuth credential (when both are configured) — OAuth
    * stays the preferred credential and is retried automatically once the mark
    * lapses. Persisted to auth.json so a restart (or another ezcoder-app window)
    * doesn't burn a request rediscovering the same exhausted window. No-op if
@@ -1406,13 +1731,21 @@ var AuthStorage = class {
   }
   /**
    * Returns valid credentials, auto-refreshing if expired.
+   *
    * If `forceRefresh` is true, refreshes even if the token hasn't expired
-   * (useful when the provider rejects a token with 401 before its stored expiry).
+   * (useful when the provider rejects a token with 401 before its stored
+   * expiry). Callers recovering from a rejection should also pass
+   * `rejectedToken` — see the stampede guard below.
+   *
    * Throws if not logged in.
    */
   async resolveCredentials(provider, opts) {
-    await this.ensureLoaded();
-    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : provider === "moonshot" ? [MOONSHOT_OAUTH_KEY, "moonshot"] : [provider];
+    if (opts?.forceRefresh) {
+      await this.ensureLoaded();
+    } else {
+      await this.ensureFresh();
+    }
+    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
     if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
       await this.reloadLatest();
     }
@@ -1423,28 +1756,31 @@ var AuthStorage = class {
       }
       throw new NotLoggedInError(provider);
     }
-    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
-      const exhaustedUntil = this.data[MOONSHOT_OAUTH_KEY].usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && this.data["moonshot"]) {
+    const dual = dualAuthProvider(provider);
+    const dualOAuthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    if (dual && dualOAuthCreds) {
+      const exhaustedUntil = dualOAuthCreds.usageExhaustedUntil ?? 0;
+      if (Date.now() < exhaustedUntil && this.data[dual.provider]) {
         log(
           "WARN",
           "auth",
-          `Kimi OAuth usage window is exhausted \u2014 using the Moonshot API key until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
+          `${dual.oauthLabel} usage window is exhausted \u2014 using the ${dual.apiKeyLabel} until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
         );
-        return this.data["moonshot"];
+        return this.data[dual.provider];
       }
       try {
-        return await this.resolveCredentials(MOONSHOT_OAUTH_KEY, {
-          ...opts?.forceRefresh ? { forceRefresh: true } : {}
+        return await this.resolveCredentials(dual.oauthKey, {
+          ...opts?.forceRefresh ? { forceRefresh: true } : {},
+          ...opts?.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
         });
       } catch (err) {
-        if (err instanceof NotLoggedInError && this.data["moonshot"]) {
+        if (err instanceof NotLoggedInError && this.data[dual.provider]) {
           log(
             "WARN",
             "auth",
-            'Kimi OAuth credential is no longer valid \u2014 falling back to the Moonshot API key. Run "ezcoder login" and choose Kimi OAuth to restore OAuth auth.'
+            `${dual.oauthLabel} credential is no longer valid \u2014 falling back to the ${dual.apiKeyLabel}. ${dual.restoreHint}`
           );
-          return this.data["moonshot"];
+          return this.data[dual.provider];
         }
         throw err;
       }
@@ -1469,11 +1805,19 @@ var AuthStorage = class {
         throw new NotLoggedInError(provider);
       }
       const credentialWasReplaced = latestCreds.accessToken !== creds.accessToken || latestCreds.refreshToken !== creds.refreshToken || latestCreds.expiresAt !== creds.expiresAt;
-      if (credentialWasReplaced || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - refreshThresholdMs(latestCreds)) {
+      const rotatedBySibling = opts?.rejectedToken !== void 0 && latestCreds.accessToken !== opts.rejectedToken;
+      if (credentialWasReplaced || rotatedBySibling || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - refreshThresholdMs(latestCreds)) {
+        if (rotatedBySibling && !credentialWasReplaced) {
+          log(
+            "INFO",
+            "auth",
+            `${provider} token was rotated by another EZ Coder process \u2014 adopting it instead of refreshing again`
+          );
+        }
         this.data = latest;
         return latestCreds;
       }
-      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
+      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : provider === XAI_OAUTH_KEY ? refreshXaiToken : refreshOpenAIToken;
       let refreshed;
       try {
         refreshed = await refreshFn(latestCreds.refreshToken);
@@ -1507,6 +1851,7 @@ var AuthStorage = class {
       return await refreshPromise;
     } finally {
       this.refreshLocks.delete(provider);
+      await this.rememberSnapshot();
     }
   }
   /**
@@ -1770,7 +2115,7 @@ var MODELS = [
   {
     // Gemini 3.1 Pro is public preview — gated behind Code Assist preview
     // enablement, so free/personal OAuth accounts 404 on it (see
-    // ACCOUNT_GATED_MODELS in gg-ai's gemini provider).
+    // ACCOUNT_GATED_MODELS in @prestyj/ai's gemini provider).
     id: "gemini-3.1-pro-preview",
     name: "Gemini 3.1 Pro (Preview)",
     provider: "gemini",
@@ -1818,11 +2163,16 @@ var MODELS = [
     maxThinkingLevel: "high"
   },
   // ── Z.AI (GLM) ─────────────────────────────────────────
-  // GLM-5.2: coding-first flagship with a usable 1M-token context window
-  // (5x jump over GLM-5.1's ~200K) and 131K max output. Released 2026-06-13.
+  // GLM-5.3 is the only GLM entry: it supersedes 5.2 (same GLM-5 base, all
+  // gains from post-training) and the coding endpoint already answers
+  // `glm-5.2` requests as glm-5.3, so the older ids were menu clutter that
+  // routed to strictly worse coding for the same plan quota.
+  // Released 2026-08-14; live on the coding endpoint (verified), while the
+  // standard paas API is still "coming soon". `max` is both the ceiling and
+  // Z.AI's own default — the rungs below it live in thinking-level.ts.
   {
-    id: "glm-5.2",
-    name: "GLM-5.2",
+    id: "glm-5.3",
+    name: "GLM-5.3",
     provider: "glm",
     contextWindow: 1e6,
     maxOutputTokens: 131072,
@@ -1830,43 +2180,7 @@ var MODELS = [
     supportsImages: false,
     supportsVideo: false,
     costTier: "medium",
-    maxThinkingLevel: "high"
-  },
-  {
-    id: "glm-5.1",
-    name: "GLM-5.1",
-    provider: "glm",
-    contextWindow: 204800,
-    maxOutputTokens: 131072,
-    supportsThinking: true,
-    supportsImages: false,
-    supportsVideo: false,
-    costTier: "medium",
-    maxThinkingLevel: "high"
-  },
-  {
-    id: "glm-4.7",
-    name: "GLM-4.7",
-    provider: "glm",
-    contextWindow: 2e5,
-    maxOutputTokens: 131072,
-    supportsThinking: true,
-    supportsImages: false,
-    supportsVideo: false,
-    costTier: "low",
-    maxThinkingLevel: "high"
-  },
-  {
-    id: "glm-4.7-flash",
-    name: "GLM-4.7 Flash",
-    provider: "glm",
-    contextWindow: 2e5,
-    maxOutputTokens: 131072,
-    supportsThinking: true,
-    supportsImages: false,
-    supportsVideo: false,
-    costTier: "low",
-    maxThinkingLevel: "high"
+    maxThinkingLevel: "max"
   },
   // ── MiniMax ────────────────────────────────────────────
   {
@@ -2011,7 +2325,7 @@ function getDefaultModel(provider) {
   if (provider === "xiaomi") return MODELS.find((m) => m.id === "mimo-v2.5-pro");
   if (provider === "openai") return MODELS.find((m) => m.id === "gpt-5.6-sol");
   if (provider === "gemini") return MODELS.find((m) => m.id === "gemini-3.1-flash-lite");
-  if (provider === "glm") return MODELS.find((m) => m.id === "glm-5.2");
+  if (provider === "glm") return MODELS.find((m) => m.id === "glm-5.3");
   if (provider === "moonshot") return MODELS.find((m) => m.id === "kimi-k3");
   if (provider === "minimax") return MODELS.find((m) => m.id === "MiniMax-M3");
   if (provider === "deepseek") return MODELS.find((m) => m.id === "deepseek-v4-pro");
@@ -2093,8 +2407,18 @@ export {
   refreshOpenAIToken,
   loginGemini,
   refreshGeminiToken,
+  grokCliBaseUrl,
+  grokCliHeaders,
+  isGrokCliEndpoint,
+  loginXai,
+  refreshXaiToken,
   withFileLock,
   MOONSHOT_OAUTH_KEY,
+  XAI_OAUTH_KEY,
+  dualAuthProvider,
+  dualAuthProviderByOAuthKey,
+  oauthStorageKey,
+  providerStorageKeys,
   XIAOMI_CREDITS_KEY,
   LOCAL_AUTH_KEY_PREFIX,
   readStoredBaseUrlSync,
@@ -2119,4 +2443,4 @@ export {
   getSummaryModel,
   getFastModel
 };
-//# sourceMappingURL=chunk-WAG5K2MH.js.map
+//# sourceMappingURL=chunk-S6QBRJ4D.js.map