@psnext/slingcli 2.5.20260710-1 → 2.5.20260718-2

package/node_modules/@earendil-works/pi-ai/dist/{utils → auth}/oauth/openai-codex.js

@@ -15,7 +15,7 @@ if (typeof process !== "undefined" && (process.versions?.node || process.version
         _http = m;
     });
 }
-import { getProviderEnvValue } from "../provider-env.js";
+import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
@@ -29,8 +29,8 @@ const DEVICE_TOKEN_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
 const DEVICE_VERIFICATION_URI = `${AUTH_BASE_URL}/codex/device`;
 const DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
 const DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
-export const OPENAI_CODEX_BROWSER_LOGIN_METHOD = "browser";
-export const OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD = "device_code";
+const OPENAI_CODEX_BROWSER_LOGIN_METHOD = "browser";
+const OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD = "device_code";
 const SCOPE = "openid profile email offline_access";
 const JWT_CLAIM_PATH = "https://api.openai.com/auth";
 function getCallbackHost() {
@@ -328,6 +328,7 @@ function credentialsFromToken(token) {
         throw new Error("Failed to extract accountId from token");
     }
     return {
+        type: "oauth",
         access: token.access,
         refresh: token.refresh,
         expires: token.expires,
@@ -337,120 +338,88 @@ function credentialsFromToken(token) {
 async function exchangeAuthorizationCodeForCredentials(code, verifier, redirectUri, signal) {
     return credentialsFromToken(await exchangeAuthorizationCode(code, verifier, redirectUri, signal));
 }
-/**
- * Login with OpenAI Codex OAuth using the Codex device-code flow.
- */
-export async function loginOpenAICodexDeviceCode(options) {
-    const device = await startOpenAICodexDeviceAuth(options.signal);
-    options.onDeviceCode({
+async function loginOpenAICodexDeviceCode(interaction) {
+    const device = await startOpenAICodexDeviceAuth(interaction.signal);
+    interaction.notify({
+        type: "device_code",
         userCode: device.userCode,
         verificationUri: DEVICE_VERIFICATION_URI,
         intervalSeconds: device.intervalSeconds,
         expiresInSeconds: DEVICE_CODE_TIMEOUT_SECONDS,
     });
-    const code = await pollOpenAICodexDeviceAuth(device, options.signal);
-    return exchangeAuthorizationCodeForCredentials(code.authorizationCode, code.codeVerifier, DEVICE_REDIRECT_URI, options.signal);
+    const code = await pollOpenAICodexDeviceAuth(device, interaction.signal);
+    return exchangeAuthorizationCodeForCredentials(code.authorizationCode, code.codeVerifier, DEVICE_REDIRECT_URI, interaction.signal);
 }
-/**
- * Login with OpenAI Codex OAuth
- *
- * @param options.onAuth - Called with URL and instructions when auth starts
- * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)
- * @param options.onProgress - Optional progress messages
- * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.
- *                                    Races with browser callback - whichever completes first wins.
- *                                    Useful for showing paste input immediately alongside browser flow.
- * @param options.originator - OAuth originator parameter (defaults to "pi")
- */
-export async function loginOpenAICodex(options) {
-    const { verifier, state, url } = await createAuthorizationFlow(options.originator);
+async function loginOpenAICodex(interaction) {
+    const { verifier, state, url } = await createAuthorizationFlow();
     const server = await startLocalOAuthServer(state);
-    options.onAuth({ url, instructions: "A browser window should open. Complete login to finish." });
+    const manualAbort = new AbortController();
     let code;
+    let manualCode;
+    let manualError;
+    interaction.notify({
+        type: "auth_url",
+        url,
+        instructions: "A browser window should open. Complete login to finish.",
+    });
     try {
-        if (options.onManualCodeInput) {
-            // Race between browser callback and manual input
-            let manualCode;
-            let manualError;
-            const manualPromise = options
-                .onManualCodeInput()
-                .then((input) => {
-                manualCode = input;
-                server.cancelWait();
-            })
-                .catch((err) => {
-                manualError = err instanceof Error ? err : new Error(String(err));
-                server.cancelWait();
-            });
-            const result = await server.waitForCode();
-            // If manual input was cancelled, throw that error
-            if (manualError) {
+        const manualPromise = interaction
+            .prompt({
+            type: "manual_code",
+            message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
+            placeholder: REDIRECT_URI,
+            signal: manualAbort.signal,
+        })
+            .then((input) => {
+            manualCode = input;
+            server.cancelWait();
+        })
+            .catch((error) => {
+            manualError = error instanceof Error ? error : new Error(String(error));
+            server.cancelWait();
+        });
+        const result = await server.waitForCode();
+        if (manualError)
+            throw manualError;
+        if (result?.code) {
+            code = result.code;
+        }
+        else if (manualCode) {
+            const parsed = parseAuthorizationInput(manualCode);
+            if (parsed.state && parsed.state !== state)
+                throw new Error("State mismatch");
+            code = parsed.code;
+        }
+        if (!code) {
+            await manualPromise;
+            if (manualError)
                 throw manualError;
-            }
-            if (result?.code) {
-                // Browser callback won
-                code = result.code;
-            }
-            else if (manualCode) {
-                // Manual input won (or callback timed out and user had entered code)
+            if (manualCode) {
                 const parsed = parseAuthorizationInput(manualCode);
-                if (parsed.state && parsed.state !== state) {
+                if (parsed.state && parsed.state !== state)
                     throw new Error("State mismatch");
-                }
                 code = parsed.code;
             }
-            // If still no code, wait for manual promise to complete and try that
-            if (!code) {
-                await manualPromise;
-                if (manualError) {
-                    throw manualError;
-                }
-                if (manualCode) {
-                    const parsed = parseAuthorizationInput(manualCode);
-                    if (parsed.state && parsed.state !== state) {
-                        throw new Error("State mismatch");
-                    }
-                    code = parsed.code;
-                }
-            }
-        }
-        else {
-            // Original flow: wait for callback, then prompt if needed
-            const result = await server.waitForCode();
-            if (result?.code) {
-                code = result.code;
-            }
-        }
-        // Fallback to onPrompt if still no code
-        if (!code) {
-            const input = await options.onPrompt({
-                message: "Paste the authorization code (or full redirect URL):",
-            });
-            const parsed = parseAuthorizationInput(input);
-            if (parsed.state && parsed.state !== state) {
-                throw new Error("State mismatch");
-            }
-            code = parsed.code;
         }
-        if (!code) {
+        if (!code)
             throw new Error("Missing authorization code");
-        }
-        return exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI);
+        return exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI, interaction.signal);
     }
     finally {
+        manualAbort.abort();
         server.close();
     }
 }
 /**
  * Refresh OpenAI Codex OAuth token
  */
-export async function refreshOpenAICodexToken(refreshToken) {
+async function refreshOpenAICodexToken(refreshToken) {
     return credentialsFromToken(await refreshAccessToken(refreshToken));
 }
 export const openaiCodexOAuth = {
     name: "OpenAI (ChatGPT Plus/Pro)",
-    async login(callbacks) {
-        const method = await callbacks.prompt({
+    async login(interaction) {
+        const method = await interaction.prompt({
             type: "select",
             message: "Select OpenAI Codex login method:",
             options: [
@@ -459,79 +428,16 @@ export const openaiCodexOAuth = {
             ],
         });
         if (method === OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD) {
-            const credentials = await loginOpenAICodexDeviceCode({
-                onDeviceCode: (info) => callbacks.notify({ type: "device_code", ...info }),
-                signal: callbacks.signal,
-            });
-            return { ...credentials, type: "oauth" };
+            return loginOpenAICodexDeviceCode(interaction);
         }
         if (method !== OPENAI_CODEX_BROWSER_LOGIN_METHOD) {
             throw new Error(`Unknown OpenAI Codex login method: ${method}`);
         }
-        // The manual_code prompt races the local callback server; abort it once
-        // the flow settles so the UI can dismiss the pending input.
-        const manualAbort = new AbortController();
-        try {
-            const credentials = await loginOpenAICodex({
-                onAuth: (info) => callbacks.notify({ type: "auth_url", url: info.url, instructions: info.instructions }),
-                onProgress: (message) => callbacks.notify({ type: "progress", message }),
-                onPrompt: (prompt) => callbacks.prompt({ type: "text", message: prompt.message, placeholder: prompt.placeholder }),
-                onManualCodeInput: () => callbacks.prompt({
-                    type: "manual_code",
-                    message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
-                    placeholder: REDIRECT_URI,
-                    signal: manualAbort.signal,
-                }),
-            });
-            return { ...credentials, type: "oauth" };
-        }
-        finally {
-            manualAbort.abort();
-        }
-    },
-    async refresh(credential) {
-        return { ...(await refreshOpenAICodexToken(credential.refresh)), type: "oauth" };
+        return loginOpenAICodex(interaction);
     },
+    refresh: (credential) => refreshOpenAICodexToken(credential.refresh),
     async toAuth(credential) {
         return { apiKey: credential.access };
     },
 };
-export const openaiCodexOAuthProvider = {
-    id: "openai-codex",
-    name: "ChatGPT Plus/Pro (Codex Subscription)",
-    usesCallbackServer: true,
-    async login(callbacks) {
-        const loginMethod = await callbacks.onSelect({
-            message: "Select OpenAI Codex login method:",
-            options: [
-                { id: OPENAI_CODEX_BROWSER_LOGIN_METHOD, label: "Browser login (default)" },
-                { id: OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD, label: "Device code login (headless)" },
-            ],
-        });
-        if (!loginMethod) {
-            throw new Error("Login cancelled");
-        }
-        if (loginMethod === OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD) {
-            return loginOpenAICodexDeviceCode({
-                onDeviceCode: callbacks.onDeviceCode,
-                signal: callbacks.signal,
-            });
-        }
-        if (loginMethod !== OPENAI_CODEX_BROWSER_LOGIN_METHOD) {
-            throw new Error(`Unknown OpenAI Codex login method: ${loginMethod}`);
-        }
-        return loginOpenAICodex({
-            onAuth: callbacks.onAuth,
-            onPrompt: callbacks.onPrompt,
-            onProgress: callbacks.onProgress,
-            onManualCodeInput: callbacks.onManualCodeInput,
-        });
-    },
-    async refreshToken(credentials) {
-        return refreshOpenAICodexToken(credentials.refresh);
-    },
-    getApiKey(credentials) {
-        return credentials.access;
-    },
-};
 //# sourceMappingURL=openai-codex.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/radius.js

@@ -0,0 +1,318 @@
+/**
+ * Radius gateway OAuth flow.
+ *
+ * Radius is a pi-messages gateway. OAuth endpoints are discovered from the
+ * gateway (`/v1/oauth`); model catalog loading is owned by the Radius provider.
+ *
+ * NOTE: This module uses node:http for the OAuth callback server.
+ * It is only intended for CLI use, not browser environments.
+ */
+// NEVER convert to top-level imports - breaks browser/Vite builds
+let _http = null;
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+    import("node:http").then((m) => {
+        _http = m;
+    });
+}
+import { normalizeRadiusGatewayUrl } from "../../providers/radius-config.js";
+import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
+import { generatePKCE } from "./pkce.js";
+const CALLBACK_HOST = "127.0.0.1";
+const CALLBACK_PORT = 1456;
+const CALLBACK_PATH = "/oauth/callback";
+const REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const TOKEN_EXPIRY_SKEW_MS = 60_000;
+const LOGIN_METHOD_BROWSER = "browser";
+const LOGIN_METHOD_DEVICE_CODE = "device-code";
+async function loadRadiusOAuthConfig(gateway) {
+    const response = await fetch(new URL("/v1/oauth", gateway), {
+        headers: { accept: "application/json" },
+    });
+    if (!response.ok) {
+        throw new Error(`Could not load Radius OAuth config from ${gateway}: ${response.status} ${await response.text()}`);
+    }
+    return (await response.json());
+}
+class OAuthResponseError extends Error {
+    status;
+    oauthError;
+    constructor(status, oauthError, description, message) {
+        const detail = oauthError
+            ? description
+                ? `${oauthError}: ${description}`
+                : oauthError
+            : description || String(status);
+        super(`${message}: ${detail}`);
+        this.status = status;
+        this.oauthError = oauthError;
+    }
+}
+async function readOAuthResponseError(response, message) {
+    const text = await response.text().catch(() => "");
+    let oauthError;
+    let description;
+    if (text) {
+        try {
+            const data = JSON.parse(text);
+            oauthError = typeof data.error === "string" ? data.error : undefined;
+            description = typeof data.error_description === "string" ? data.error_description : undefined;
+        }
+        catch {
+            description = text;
+        }
+    }
+    return new OAuthResponseError(response.status, oauthError, description, message);
+}
+async function requestOAuthToken(oauth, body, signal) {
+    let response;
+    try {
+        response = await fetch(oauth.tokenEndpoint, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+            body,
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw new Error("Login cancelled");
+        }
+        throw error;
+    }
+    if (!response.ok) {
+        throw await readOAuthResponseError(response, "Radius OAuth token request failed");
+    }
+    const data = (await response.json());
+    return {
+        type: "oauth",
+        access: data.access_token,
+        refresh: data.refresh_token,
+        expires: Date.now() + data.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,
+        scope: data.scope,
+    };
+}
+function startOAuthCallbackServer(expectedState, signal) {
+    if (!_http) {
+        throw new Error("Radius OAuth is only available in Node.js environments");
+    }
+    let settle = () => { };
+    let settled = false;
+    const wait = new Promise((resolve) => {
+        settle = resolve;
+    });
+    const finish = (code) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        signal?.removeEventListener("abort", onAbort);
+        settle(code);
+    };
+    const onAbort = () => finish(null);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const sendPage = (response, status, html) => {
+        response.statusCode = status;
+        response.setHeader("content-type", "text/html; charset=utf-8");
+        response.end(html);
+    };
+    const server = _http.createServer((request, response) => {
+        const url = new URL(request.url ?? "/", REDIRECT_URI);
+        if (url.pathname !== CALLBACK_PATH) {
+            sendPage(response, 404, oauthErrorHtml("Callback route not found."));
+            return;
+        }
+        if (url.searchParams.get("state") !== expectedState) {
+            sendPage(response, 400, oauthErrorHtml("OAuth state mismatch."));
+            return;
+        }
+        const error = url.searchParams.get("error");
+        if (error) {
+            sendPage(response, 400, oauthErrorHtml(url.searchParams.get("error_description") ?? error));
+            finish(null);
+            return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+            sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
+            return;
+        }
+        sendPage(response, 200, oauthSuccessHtml("Signed in to Radius. You may now close this page."));
+        finish(code);
+    });
+    return new Promise((resolve) => {
+        server
+            .listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+            resolve({
+                waitForCode: () => wait,
+                close: () => {
+                    finish(null);
+                    server.close();
+                },
+            });
+        })
+            .once("error", () => {
+            finish(null);
+            resolve({ waitForCode: async () => null, close: () => { } });
+        });
+    });
+}
+async function loginWithBrowser(oauth, interaction) {
+    const { verifier, challenge } = await generatePKCE();
+    const state = crypto.randomUUID();
+    const authorizeUrl = new URL(oauth.authorizationEndpoint);
+    authorizeUrl.search = new URLSearchParams({
+        response_type: "code",
+        client_id: oauth.clientId,
+        redirect_uri: REDIRECT_URI,
+        scope: oauth.scope,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        handoff: "url",
+        state,
+    }).toString();
+    const callbackServer = await startOAuthCallbackServer(state, interaction.signal);
+    interaction.notify({ type: "progress", message: `Listening for OAuth callback on ${REDIRECT_URI}` });
+    interaction.notify({
+        type: "auth_url",
+        url: authorizeUrl.toString(),
+        instructions: "Continue in your browser.",
+    });
+    try {
+        const code = await callbackServer.waitForCode();
+        if (!code) {
+            if (interaction.signal?.aborted) {
+                throw new Error("Login cancelled");
+            }
+            throw new Error("OAuth callback did not complete.");
+        }
+        return await requestOAuthToken(oauth, new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: oauth.clientId,
+            redirect_uri: REDIRECT_URI,
+            code,
+            code_verifier: verifier,
+        }), interaction.signal);
+    }
+    finally {
+        callbackServer.close();
+    }
+}
+async function requestDeviceAuthorization(oauth, signal) {
+    let response;
+    try {
+        response = await fetch(oauth.deviceAuthorizationEndpoint, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ client_id: oauth.clientId, scope: oauth.scope }),
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw new Error("Login cancelled");
+        }
+        throw error;
+    }
+    if (!response.ok) {
+        throw await readOAuthResponseError(response, "Radius OAuth device authorization failed");
+    }
+    const data = (await response.json());
+    if (!data.device_code || !data.user_code || !data.expires_in) {
+        throw new Error("Radius OAuth device authorization response is missing required fields");
+    }
+    return {
+        device_code: data.device_code,
+        user_code: data.user_code,
+        verification_uri: data.verification_uri,
+        verification_uri_complete: data.verification_uri_complete,
+        expires_in: data.expires_in,
+        interval: data.interval,
+    };
+}
+async function loginWithDeviceCode(oauth, interaction) {
+    const device = await requestDeviceAuthorization(oauth, interaction.signal);
+    interaction.notify({
+        type: "device_code",
+        userCode: device.user_code,
+        verificationUri: device.verification_uri || oauth.verificationEndpoint,
+        intervalSeconds: device.interval,
+        expiresInSeconds: device.expires_in,
+    });
+    return pollOAuthDeviceCodeFlow({
+        intervalSeconds: device.interval,
+        expiresInSeconds: device.expires_in,
+        signal: interaction.signal,
+        poll: async () => {
+            try {
+                const credentials = await requestOAuthToken(oauth, new URLSearchParams({
+                    grant_type: oauth.deviceCodeGrantType,
+                    client_id: oauth.clientId,
+                    device_code: device.device_code,
+                }), interaction.signal);
+                return { status: "complete", value: credentials };
+            }
+            catch (error) {
+                if (!(error instanceof OAuthResponseError)) {
+                    throw error;
+                }
+                switch (error.oauthError) {
+                    case "authorization_pending":
+                        return { status: "pending" };
+                    case "slow_down":
+                        return { status: "slow_down" };
+                    case "expired_token":
+                        return { status: "failed", message: "Device authorization expired." };
+                    case "access_denied":
+                        return { status: "failed", message: "Device authorization was denied." };
+                    default:
+                        throw error;
+                }
+            }
+        },
+    });
+}
+export function createRadiusOAuth(options) {
+    const gateway = normalizeRadiusGatewayUrl(options.gateway);
+    return {
+        name: options.name,
+        async login(interaction) {
+            const oauth = await loadRadiusOAuthConfig(gateway);
+            const loginMethod = await interaction.prompt({
+                type: "select",
+                message: `Sign in to ${options.name}:`,
+                options: [
+                    { id: LOGIN_METHOD_BROWSER, label: "Sign in with browser (recommended)" },
+                    {
+                        id: LOGIN_METHOD_DEVICE_CODE,
+                        label: "Sign in with device code (when signing in from another device)",
+                    },
+                ],
+            });
+            let credential;
+            if (loginMethod === LOGIN_METHOD_DEVICE_CODE) {
+                credential = await loginWithDeviceCode(oauth, interaction);
+            }
+            else if (loginMethod === LOGIN_METHOD_BROWSER) {
+                credential = await loginWithBrowser(oauth, interaction);
+            }
+            else {
+                throw new Error(`Unknown ${options.name} sign-in method: ${loginMethod}`);
+            }
+            return credential;
+        },
+        async refresh(credential, signal) {
+            const oauth = await loadRadiusOAuthConfig(gateway);
+            const refreshed = await requestOAuthToken(oauth, new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: oauth.clientId,
+                refresh_token: credential.refresh,
+            }), signal);
+            return refreshed;
+        },
+        async toAuth(credential) {
+            return { apiKey: credential.access };
+        },
+    };
+}
+//# sourceMappingURL=radius.js.map