@psnext/slingcli 2.5.20260710-1 → 2.5.20260718-2

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/xai.js

@@ -0,0 +1,189 @@
+/**
+ * xAI OAuth device-code flow.
+ */
+import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+const XAI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const XAI_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const XAI_DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+const XAI_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+// Refresh slightly before the reported expiry to avoid using a token that dies mid-request.
+const REFRESH_SKEW_MS = 5 * 60 * 1000;
+const DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
+function requiredString(body, field) {
+    const value = body[field];
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`Invalid xAI OAuth response field: ${field}`);
+    }
+    return value;
+}
+function positiveNumber(body, field) {
+    const value = body[field];
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+        throw new Error(`Invalid xAI OAuth response field: ${field}`);
+    }
+    return value;
+}
+// The verification URI is opened in the user's browser; force it to be an https URL
+// so a malicious response cannot make `open` launch something else.
+function validateVerificationUri(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error("Untrusted verification URI in xAI OAuth response");
+    }
+    if (url.protocol !== "https:") {
+        throw new Error("Untrusted verification URI in xAI OAuth response");
+    }
+    return url.href;
+}
+async function postForm(url, fields, signal) {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body: new URLSearchParams(fields),
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw new Error("Login cancelled");
+        }
+        throw error;
+    }
+    let body;
+    try {
+        const parsed = (await response.json());
+        body = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        if (signal?.aborted) {
+            throw new Error("Login cancelled");
+        }
+        throw new Error(`xAI OAuth returned invalid JSON (HTTP ${response.status})`);
+    }
+    return {
+        ok: response.ok,
+        status: response.status,
+        body,
+    };
+}
+function requestFailure(action, response) {
+    const error = typeof response.body.error === "string" ? response.body.error : undefined;
+    const description = typeof response.body.error_description === "string" ? response.body.error_description : undefined;
+    const detail = [error, description].filter(Boolean).join(": ");
+    return new Error(`xAI OAuth ${action} failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+}
+function parseDeviceCode(body) {
+    // RFC 8628 allows interval 0 (no minimum wait); fall back to the poller's
+    // default instead of failing on non-positive or malformed values.
+    const interval = body.interval;
+    const intervalSeconds = typeof interval === "number" && Number.isFinite(interval) && interval > 0 ? interval : undefined;
+    const verificationUriComplete = typeof body.verification_uri_complete === "string" && body.verification_uri_complete.length > 0
+        ? validateVerificationUri(body.verification_uri_complete)
+        : undefined;
+    return {
+        deviceCode: requiredString(body, "device_code"),
+        userCode: requiredString(body, "user_code"),
+        verificationUri: validateVerificationUri(requiredString(body, "verification_uri")),
+        verificationUriComplete,
+        intervalSeconds,
+        expiresInSeconds: positiveNumber(body, "expires_in"),
+    };
+}
+function credentialsFromTokenResponse(body, previousRefreshToken) {
+    const access = requiredString(body, "access_token");
+    // xAI may omit refresh_token on refresh when the token is not rotated.
+    const refresh = body.refresh_token === undefined && previousRefreshToken
+        ? previousRefreshToken
+        : requiredString(body, "refresh_token");
+    const expiresInSeconds = body.expires_in === undefined ? DEFAULT_TOKEN_LIFETIME_SECONDS : positiveNumber(body, "expires_in");
+    return {
+        type: "oauth",
+        access,
+        refresh,
+        expires: Date.now() + expiresInSeconds * 1000 - REFRESH_SKEW_MS,
+    };
+}
+async function requestDeviceCode(signal) {
+    const response = await postForm(XAI_DEVICE_CODE_URL, {
+        client_id: XAI_CLIENT_ID,
+        scope: XAI_SCOPE,
+        referrer: "pi",
+    }, signal);
+    if (!response.ok) {
+        throw requestFailure("device authorization", response);
+    }
+    return parseDeviceCode(response.body);
+}
+async function pollForTokens(device, signal) {
+    return pollOAuthDeviceCodeFlow({
+        intervalSeconds: device.intervalSeconds,
+        expiresInSeconds: device.expiresInSeconds,
+        waitBeforeFirstPoll: true,
+        signal,
+        poll: async () => {
+            const response = await postForm(XAI_TOKEN_URL, {
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                client_id: XAI_CLIENT_ID,
+                device_code: device.deviceCode,
+            }, signal);
+            if (response.ok) {
+                return { status: "complete", value: credentialsFromTokenResponse(response.body) };
+            }
+            const error = response.body.error;
+            if (error === "authorization_pending") {
+                return { status: "pending" };
+            }
+            if (error === "slow_down") {
+                const interval = response.body.interval;
+                return { status: "slow_down", intervalSeconds: typeof interval === "number" ? interval : undefined };
+            }
+            if (error === "access_denied" || error === "authorization_denied") {
+                return { status: "failed", message: "xAI device authorization was denied" };
+            }
+            if (error === "expired_token") {
+                return { status: "failed", message: "xAI device code expired" };
+            }
+            return { status: "failed", message: requestFailure("device token polling", response).message };
+        },
+    });
+}
+async function loginXai(interaction) {
+    const device = await requestDeviceCode(interaction.signal);
+    interaction.notify({
+        type: "device_code",
+        userCode: device.userCode,
+        verificationUri: device.verificationUriComplete ?? device.verificationUri,
+        intervalSeconds: device.intervalSeconds,
+        expiresInSeconds: device.expiresInSeconds,
+    });
+    return pollForTokens(device, interaction.signal);
+}
+async function refreshXaiToken(refreshToken, signal) {
+    const response = await postForm(XAI_TOKEN_URL, {
+        grant_type: "refresh_token",
+        client_id: XAI_CLIENT_ID,
+        refresh_token: refreshToken,
+    }, signal);
+    if (!response.ok) {
+        throw requestFailure("token refresh", response);
+    }
+    return credentialsFromTokenResponse(response.body, refreshToken);
+}
+export const xaiOAuth = {
+    name: "xAI (Grok/X subscription)",
+    loginLabel: "Sign in with SuperGrok or X Premium",
+    login: loginXai,
+    refresh: (credential, signal) => refreshXaiToken(credential.refresh, signal),
+    async toAuth(credential) {
+        return { apiKey: credential.access };
+    },
+};
+//# sourceMappingURL=xai.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/resolve.js

@@ -12,10 +12,10 @@ export class ModelsError extends Error {
  * nothing is stored. No silent env fallback after a failed refresh or for a
  * credential type without a matching handler.
  */
-export async function resolveProviderAuth(provider, model, credentials, authContext, overrides) {
+export async function resolveProviderAuth(provider, credentials, authContext, overrides) {
     const requestAuthContext = overrides?.env ? overlayEnvAuthContext(authContext, overrides.env) : authContext;
     if (overrides?.apiKey !== undefined && provider.auth.apiKey) {
-        return resolveApiKey(requestAuthContext, provider.auth.apiKey, model, {
+        return resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, {
             type: "api_key",
             key: overrides.apiKey,
             env: overrides.env,
@@ -28,12 +28,14 @@ export async function resolveProviderAuth(provider, model, credentials, authCont
         }
         if (stored.type === "api_key" && provider.auth.apiKey) {
             const credential = overrides?.env ? { ...stored, env: { ...stored.env, ...overrides.env } } : stored;
-            return resolveApiKey(requestAuthContext, provider.auth.apiKey, model, credential);
+            return resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential);
         }
         return undefined;
     }
     // Ambient (env vars, AWS profiles, ADC files).
-    return provider.auth.apiKey ? resolveApiKey(requestAuthContext, provider.auth.apiKey, model, undefined) : undefined;
+    return provider.auth.apiKey
+        ? resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, undefined)
+        : undefined;
 }
 function overlayEnvAuthContext(base, env) {
     return {
@@ -82,12 +84,12 @@ async function resolveStoredOAuth(credentials, providerId, oauth, stored) {
         throw new ModelsError("oauth", `OAuth auth derivation failed for ${providerId}`, { cause: error });
     }
 }
-async function resolveApiKey(authContext, apiKey, model, credential) {
+async function resolveApiKey(authContext, apiKey, providerId, credential) {
     try {
-        return await apiKey.resolve({ model, ctx: authContext, credential });
+        return await apiKey.resolve({ ctx: authContext, credential });
     }
     catch (error) {
-        throw new ModelsError("auth", `API key auth failed for provider ${model.provider}`, { cause: error });
+        throw new ModelsError("auth", `API key auth failed for provider ${providerId}`, { cause: error });
     }
 }
 async function readCredential(credentials, providerId) {

package/node_modules/@earendil-works/pi-ai/dist/bun-oauth.js

@@ -0,0 +1,17 @@
+import { anthropicOAuth } from "./auth/oauth/anthropic.js";
+import { githubCopilotOAuth } from "./auth/oauth/github-copilot.js";
+import { registerBundledOAuthFlowLoaders } from "./auth/oauth/load.js";
+import { openaiCodexOAuth } from "./auth/oauth/openai-codex.js";
+import { createRadiusOAuth } from "./auth/oauth/radius.js";
+import { xaiOAuth } from "./auth/oauth/xai.js";
+/** Register OAuth flows statically embedded in the standalone Bun binary. */
+export function registerBunOAuthFlows() {
+    registerBundledOAuthFlowLoaders({
+        anthropic: () => anthropicOAuth,
+        openaiCodex: () => openaiCodexOAuth,
+        githubCopilot: () => githubCopilotOAuth,
+        xai: () => xaiOAuth,
+        radius: createRadiusOAuth,
+    });
+}
+//# sourceMappingURL=bun-oauth.js.map

package/node_modules/@earendil-works/pi-ai/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { createInterface } from "node:readline";
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { getOAuthProvider, getOAuthProviders } from "./utils/oauth/index.js";
+import { builtinProviders } from "./providers/all.js";
 const AUTH_FILE = "auth.json";
-const PROVIDERS = getOAuthProviders();
+const PROVIDERS = builtinProviders().filter((provider) => provider.auth.oauth !== undefined);
 function prompt(rl, question) {
     return new Promise((resolve) => rl.question(question, resolve));
 }
@@ -20,43 +20,48 @@ function loadAuth() {
 function saveAuth(auth) {
     writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), "utf-8");
 }
-async function login(providerId) {
-    const provider = getOAuthProvider(providerId);
-    if (!provider) {
-        console.error(`Unknown provider: ${providerId}`);
-        process.exit(1);
+async function answerPrompt(rl, authPrompt) {
+    if (authPrompt.type === "select") {
+        console.log(`\n${authPrompt.message}`);
+        for (let index = 0; index < authPrompt.options.length; index++) {
+            console.log(`  ${index + 1}. ${authPrompt.options[index].label}`);
+        }
+        const choice = Number.parseInt(await prompt(rl, `Enter number (1-${authPrompt.options.length}): `), 10) - 1;
+        const selected = authPrompt.options[choice];
+        if (!selected)
+            throw new Error("Invalid selection");
+        return selected.id;
     }
+    return prompt(rl, `${authPrompt.message}${authPrompt.placeholder ? ` (${authPrompt.placeholder})` : ""}: `);
+}
+async function login(providerId) {
+    const provider = PROVIDERS.find((entry) => entry.id === providerId);
+    if (!provider)
+        throw new Error(`Unknown provider: ${providerId}`);
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const promptFn = (msg) => prompt(rl, `${msg} `);
     try {
-        const credentials = await provider.login({
-            onAuth: (info) => {
-                console.log(`\nOpen this URL in your browser:\n${info.url}`);
-                if (info.instructions)
-                    console.log(info.instructions);
-                console.log();
-            },
-            onDeviceCode: (info) => {
-                console.log(`\nOpen this URL in your browser:\n${info.verificationUri}`);
-                console.log(`Enter code: ${info.userCode}`);
-                console.log();
-            },
-            onPrompt: async (p) => {
-                return await promptFn(`${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}:`);
-            },
-            onSelect: async (p) => {
-                console.log(`\n${p.message}`);
-                for (let i = 0; i < p.options.length; i++) {
-                    console.log(`  ${i + 1}. ${p.options[i].label}`);
+        const credential = await provider.auth.oauth.login({
+            prompt: (authPrompt) => answerPrompt(rl, authPrompt),
+            notify: (event) => {
+                switch (event.type) {
+                    case "auth_url":
+                        console.log(`\nOpen this URL in your browser:\n${event.url}`);
+                        if (event.instructions)
+                            console.log(event.instructions);
+                        break;
+                    case "device_code":
+                        console.log(`\nOpen this URL in your browser:\n${event.verificationUri}`);
+                        console.log(`Enter code: ${event.userCode}`);
+                        break;
+                    case "info":
+                    case "progress":
+                        console.log(event.message);
+                        break;
                 }
-                const choice = await promptFn(`Enter number (1-${p.options.length}):`);
-                const index = parseInt(choice, 10) - 1;
-                return p.options[index]?.id;
             },
-            onProgress: (msg) => console.log(msg),
         });
         const auth = loadAuth();
-        auth[providerId] = { type: "oauth", ...credentials };
+        auth[providerId] = credential;
         saveAuth(auth);
         console.log(`\nCredentials saved to ${AUTH_FILE}`);
     }
@@ -68,63 +73,40 @@ async function main() {
     const args = process.argv.slice(2);
     const command = args[0];
     if (!command || command === "help" || command === "--help" || command === "-h") {
-        const providerList = PROVIDERS.map((p) => `  ${p.id.padEnd(20)} ${p.name}`).join("\n");
-        console.log(`Usage: npx @earendil-works/pi-ai <command> [provider]
-
-Commands:
-  login [provider]  Login to an OAuth provider
-  list              List available providers
-
-Providers:
-${providerList}
-
-Examples:
-  npx @earendil-works/pi-ai login              # interactive provider selection
-  npx @earendil-works/pi-ai login anthropic    # login to specific provider
-  npx @earendil-works/pi-ai list               # list providers
-`);
+        const providerList = PROVIDERS.map((provider) => `  ${provider.id.padEnd(20)} ${provider.name}`).join("\n");
+        console.log(`Usage: npx @earendil-works/pi-ai <command> [provider]\n\nCommands:\n  login [provider]  Login to an OAuth provider\n  list              List available providers\n\nProviders:\n${providerList}`);
         return;
     }
     if (command === "list") {
-        console.log("Available OAuth providers:\n");
-        for (const p of PROVIDERS) {
-            console.log(`  ${p.id.padEnd(20)} ${p.name}`);
-        }
+        for (const provider of PROVIDERS)
+            console.log(`${provider.id.padEnd(20)} ${provider.name}`);
         return;
     }
     if (command === "login") {
-        let provider = args[1];
-        if (!provider) {
+        let providerId = args[1];
+        if (!providerId) {
             const rl = createInterface({ input: process.stdin, output: process.stdout });
-            console.log("Select a provider:\n");
-            for (let i = 0; i < PROVIDERS.length; i++) {
-                console.log(`  ${i + 1}. ${PROVIDERS[i].name}`);
+            try {
+                for (let index = 0; index < PROVIDERS.length; index++) {
+                    console.log(`  ${index + 1}. ${PROVIDERS[index].name}`);
+                }
+                const index = Number.parseInt(await prompt(rl, `Enter number (1-${PROVIDERS.length}): `), 10) - 1;
+                providerId = PROVIDERS[index]?.id;
             }
-            console.log();
-            const choice = await prompt(rl, `Enter number (1-${PROVIDERS.length}): `);
-            rl.close();
-            const index = parseInt(choice, 10) - 1;
-            if (index < 0 || index >= PROVIDERS.length) {
-                console.error("Invalid selection");
-                process.exit(1);
+            finally {
+                rl.close();
             }
-            provider = PROVIDERS[index].id;
         }
-        if (!PROVIDERS.some((p) => p.id === provider)) {
-            console.error(`Unknown provider: ${provider}`);
-            console.error(`Use 'npx @earendil-works/pi-ai list' to see available providers`);
-            process.exit(1);
+        if (!providerId || !PROVIDERS.some((provider) => provider.id === providerId)) {
+            throw new Error(`Unknown provider: ${providerId ?? ""}`);
         }
-        console.log(`Logging in to ${provider}...`);
-        await login(provider);
+        await login(providerId);
         return;
     }
-    console.error(`Unknown command: ${command}`);
-    console.error(`Use 'npx @earendil-works/pi-ai --help' for usage`);
-    process.exit(1);
+    throw new Error(`Unknown command: ${command}`);
 }
-main().catch((err) => {
-    console.error("Error:", err.message);
+main().catch((error) => {
+    console.error("Error:", error instanceof Error ? error.message : String(error));
     process.exit(1);
 });
 //# sourceMappingURL=cli.js.map

package/node_modules/@earendil-works/pi-ai/dist/compat/extension-oauth-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=extension-oauth-types.js.map

package/node_modules/@earendil-works/pi-ai/dist/compat.js

@@ -18,6 +18,7 @@ export * from "./api/mistral-conversations.lazy.js";
 export * from "./api/openai-codex-responses.lazy.js";
 export * from "./api/openai-completions.lazy.js";
 export * from "./api/openai-responses.lazy.js";
+export * from "./api/pi-messages.lazy.js";
 export * from "./env-api-keys.js";
 export * from "./image-models.js";
 export * from "./images.js";
@@ -34,6 +35,7 @@ import { mistralConversationsApi } from "./api/mistral-conversations.lazy.js";
 import { openAICodexResponsesApi } from "./api/openai-codex-responses.lazy.js";
 import { openAICompletionsApi } from "./api/openai-completions.lazy.js";
 import { openAIResponsesApi } from "./api/openai-responses.lazy.js";
+import { piMessagesApi } from "./api/pi-messages.lazy.js";
 import { getEnvApiKey } from "./env-api-keys.js";
 import { builtinModels, getBuiltinModel, getBuiltinModels, getBuiltinProviders } from "./providers/all.js";
 import { createFauxCore } from "./providers/faux.js";
@@ -113,6 +115,7 @@ const BUILTIN_APIS = [
     ["google-vertex", googleVertexApi()],
     ["mistral-conversations", mistralConversationsApi()],
     ["bedrock-converse-stream", bedrockConverseStreamApi()],
+    ["pi-messages", piMessagesApi()],
 ];
 const builtinApiProviderInstances = new Map();
 /**
@@ -135,6 +138,7 @@ export function resetApiProviders() {
 }
 registerBuiltInApiProviders();
 const compatModels = builtinModels();
+const AMBIENT_AUTH_MARKER = "<authenticated>";
 function hasExplicitApiKey(apiKey) {
     return typeof apiKey === "string" && apiKey.trim().length > 0;
 }
@@ -142,13 +146,18 @@ function withEnvApiKey(model, options) {
     if (hasExplicitApiKey(options?.apiKey))
         return options;
     const apiKey = getEnvApiKey(model.provider, options?.env);
-    if (!apiKey)
+    if (!apiKey || apiKey === AMBIENT_AUTH_MARKER)
         return options;
     return { ...options, apiKey };
 }
-function shouldUseBuiltinModels(model) {
-    const builtin = compatModels.getModel(model.provider, model.id);
-    return builtin?.api === model.api && getApiProvider(model.api) === builtinApiProviderInstances.get(model.api);
+function hasResolvedCloudflareAuth(options) {
+    return hasExplicitApiKey(options?.apiKey) || typeof options?.headers?.["cf-aig-authorization"] === "string";
+}
+function getBuiltinProviderForModel(model) {
+    if (getApiProvider(model.api) !== builtinApiProviderInstances.get(model.api))
+        return undefined;
+    const provider = compatModels.getProvider(model.provider);
+    return provider?.getModels().some((candidate) => candidate.api === model.api) ? provider : undefined;
 }
 function resolveApiProvider(api) {
     const provider = getApiProvider(api);
@@ -158,8 +167,12 @@ function resolveApiProvider(api) {
     return provider;
 }
 export function stream(model, context, options) {
-    if (shouldUseBuiltinModels(model)) {
-        return compatModels.stream(model, context, options);
+    const builtinProvider = getBuiltinProviderForModel(model);
+    if (builtinProvider) {
+        if (model.provider.startsWith("cloudflare-") && !hasResolvedCloudflareAuth(options)) {
+            return compatModels.stream(model, context, options);
+        }
+        return builtinProvider.stream(model, context, withEnvApiKey(model, options));
     }
     const provider = resolveApiProvider(model.api);
     return provider.stream(model, context, withEnvApiKey(model, options));
@@ -169,8 +182,12 @@ export async function complete(model, context, options) {
     return s.result();
 }
 export function streamSimple(model, context, options) {
-    if (shouldUseBuiltinModels(model)) {
-        return compatModels.streamSimple(model, context, options);
+    const builtinProvider = getBuiltinProviderForModel(model);
+    if (builtinProvider) {
+        if (model.provider.startsWith("cloudflare-") && !hasResolvedCloudflareAuth(options)) {
+            return compatModels.streamSimple(model, context, options);
+        }
+        return builtinProvider.streamSimple(model, context, withEnvApiKey(model, options));
     }
     const provider = resolveApiProvider(model.api);
     return provider.streamSimple(model, context, withEnvApiKey(model, options));

package/node_modules/@earendil-works/pi-ai/dist/env-api-keys.js

@@ -76,6 +76,7 @@ function getApiKeyEnvVars(provider) {
         groq: "GROQ_API_KEY",
         cerebras: "CEREBRAS_API_KEY",
         xai: "XAI_API_KEY",
+        radius: "RADIUS_API_KEY",
         openrouter: "OPENROUTER_API_KEY",
         "vercel-ai-gateway": "AI_GATEWAY_API_KEY",
         zai: "ZAI_API_KEY",