@quanta-intellect/vessel-browser 0.1.114 → 0.1.116

package/out/main/index.js

@@ -81,7 +81,7 @@ const defaults = {
 const SAVE_DEBOUNCE_MS$6 = 150;
 const CHAT_PROVIDER_SECRET_FILENAME = "vessel-chat-provider-secret";
 const CODEX_TOKENS_FILENAME = "vessel-codex-tokens";
-const logger$p = createLogger("Settings");
+const logger$r = createLogger("Settings");
 const SETTABLE_KEYS = new Set(Object.keys(defaults));
 let settings = null;
 let settingsIssues = [];
@@ -289,7 +289,7 @@ function persistNow() {
       JSON.stringify(buildPersistedSettings(settings), null, 2),
       { encoding: "utf-8", mode: 384 }
     )
-  ).then(() => fs.promises.chmod(getSettingsPath(), 384).catch(() => void 0)).catch((err) => logger$p.error("Failed to save settings:", err));
+  ).then(() => fs.promises.chmod(getSettingsPath(), 384).catch(() => void 0)).catch((err) => logger$r.error("Failed to save settings:", err));
 }
 function saveSettings() {
   saveDirty = true;
@@ -420,7 +420,7 @@ function loadTrustedAppURL(wc, url) {
 }
 const MAX_CUSTOM_HISTORY = 50;
 const READER_MODE_DATA_URL_PREFIX = "data:text/html;charset=utf-8,";
-const logger$o = createLogger("Tab");
+const logger$q = createLogger("Tab");
 const sessionCertExceptions = /* @__PURE__ */ new WeakMap();
 const sessionsWithVerifyProc = /* @__PURE__ */ new WeakSet();
 const CERT_VERIFY_TRUST = 0;
@@ -486,7 +486,7 @@ class Tab {
   guardedLoadURL(url, options) {
     const blockReason = this.getNavigationBlockReason(url);
     if (blockReason) {
-      logger$o.warn(blockReason);
+      logger$q.warn(blockReason);
       return blockReason;
     }
     void this.view.webContents.loadURL(url, options);
@@ -570,7 +570,7 @@ class Tab {
     wc.setWindowOpenHandler(({ url, disposition }) => {
       const error = this.getNavigationBlockReason(url);
       if (error) {
-        logger$o.warn(error);
+        logger$q.warn(error);
         return { action: "deny" };
       }
       this.onOpenUrl?.({
@@ -584,7 +584,7 @@ class Tab {
       const error = this.getNavigationBlockReason(url);
       if (!error) return;
       event.preventDefault();
-      logger$o.warn(`${context}: ${error}`);
+      logger$q.warn(`${context}: ${error}`);
     };
     wc.on("will-navigate", (event, url) => {
       blockNavigation(event, url, "Blocked top-level navigation");
@@ -668,7 +668,7 @@ class Tab {
         ::-webkit-scrollbar-thumb { background: rgba(255,255,255,0.12); border-radius: 999px; }
         ::-webkit-scrollbar-thumb:hover { background: rgba(255,255,255,0.22); }
         ::-webkit-scrollbar-corner { background: transparent; }
-      `).catch((err) => logger$o.warn("Failed to inject scrollbar CSS:", err));
+      `).catch((err) => logger$q.warn("Failed to inject scrollbar CSS:", err));
     });
     wc.on("page-favicon-updated", (_, favicons) => {
       this._state.favicon = favicons[0] || "";
@@ -704,7 +704,7 @@ class Tab {
       ).then((highlightedText) => {
         this.buildContextMenu(wc, params, highlightedText.trim());
       }).catch((err) => {
-        logger$o.warn("Failed to inspect highlighted text for context menu:", err);
+        logger$q.warn("Failed to inspect highlighted text for context menu:", err);
         this.buildContextMenu(wc, params, "");
       });
     });
@@ -905,7 +905,7 @@ class Tab {
         "document.documentElement.outerHTML"
       );
     } catch (err) {
-      logger$o.warn("Failed to retrieve page source:", err);
+      logger$q.warn("Failed to retrieve page source:", err);
       return;
     }
     const escaped = html.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -1033,7 +1033,7 @@ class Tab {
             document.addEventListener('mouseup', window.__vesselHighlightHandler);
           }
         })()
-      `).catch((err) => logger$o.warn("Failed to inject highlight listener:", err));
+      `).catch((err) => logger$q.warn("Failed to inject highlight listener:", err));
     } else {
       void wc.executeJavaScript(`
         (function() {
@@ -1044,7 +1044,7 @@ class Tab {
             delete window.__vesselHighlightHandler;
           }
         })()
-      `).catch((err) => logger$o.warn("Failed to remove highlight listener:", err));
+      `).catch((err) => logger$q.warn("Failed to remove highlight listener:", err));
     }
   }
   get webContentsId() {
@@ -1081,7 +1081,7 @@ const SEARCH_ENGINE_PRESETS = {
   ecosia: { label: "Ecosia", url: "https://www.ecosia.org/search?q=" },
   kagi: { label: "Kagi", url: "https://kagi.com/search?q=" }
 };
-const logger$n = createLogger("JsonPersistence");
+const logger$p = createLogger("JsonPersistence");
 function canUseSafeStorage() {
   try {
     return electron.safeStorage.isEncryptionAvailable();
@@ -1146,7 +1146,7 @@ function createDebouncedJsonPersistence({
         data,
         typeof data === "string" ? { encoding: "utf-8", mode: 384 } : { mode: 384 }
       )
-    ).then(() => fs.promises.chmod(filePath2, 384).catch(() => void 0)).catch((err) => logger$n.error(`Failed to save ${logLabel}:`, err));
+    ).then(() => fs.promises.chmod(filePath2, 384).catch(() => void 0)).catch((err) => logger$p.error(`Failed to save ${logLabel}:`, err));
   };
   const schedule = () => {
     saveDirty2 = true;
@@ -2838,7 +2838,7 @@ function destroySession(tabId) {
     sessions.delete(tabId);
   }
 }
-const logger$m = createLogger("TabManager");
+const logger$o = createLogger("TabManager");
 function sanitizePdfFilename(title) {
   const clean = title.replace(/[<>:"/\\|?*\x00-\x1f]/g, " ").replace(/\s+/g, " ").trim();
   const base = (clean || "Vessel Page").replace(/\.pdf$/i, "");
@@ -3238,7 +3238,7 @@ class TabManager {
     }));
     if (entries.length > 0) {
       void highlightBatchOnPage(wc, entries).catch(
-        (err) => logger$m.warn("Failed to batch highlight:", err)
+        (err) => logger$o.warn("Failed to batch highlight:", err)
       );
     }
   }
@@ -3260,12 +3260,12 @@ class TabManager {
         const result = await captureSelectionHighlight(wc);
         if (result.success && result.text) {
           await highlightOnPage(wc, null, result.text, void 0, void 0, "yellow").catch(
-            (err) => logger$m.warn("Failed to capture highlight:", err)
+            (err) => logger$o.warn("Failed to capture highlight:", err)
           );
         }
         this.highlightCaptureCallback?.(result);
       } catch (err) {
-        logger$m.warn("Failed to capture highlight from page:", err);
+        logger$o.warn("Failed to capture highlight from page:", err);
         this.highlightCaptureCallback?.({
           success: false,
           message: "Could not capture selection"
@@ -3290,7 +3290,7 @@ class TabManager {
           void this.removeHighlightMarksForText(wc, text);
         }
       } catch (err) {
-        logger$m.warn("Failed to remove highlight from matching tab:", err);
+        logger$o.warn("Failed to remove highlight from matching tab:", err);
       }
     }
     this.highlightCaptureCallback?.({
@@ -3321,12 +3321,12 @@ class TabManager {
               void 0,
               color
             ).catch(
-              (err) => logger$m.warn("Failed to update highlight color:", err)
+              (err) => logger$o.warn("Failed to update highlight color:", err)
             );
           });
         }
       } catch (err) {
-        logger$m.warn("Failed to iterate highlights for color change:", err);
+        logger$o.warn("Failed to iterate highlights for color change:", err);
       }
     }
     this.highlightCaptureCallback?.({
@@ -3381,7 +3381,7 @@ class TabManager {
         });
       })()`
     ).catch(
-      (err) => logger$m.warn("Failed to remove highlight marks:", err)
+      (err) => logger$o.warn("Failed to remove highlight marks:", err)
     );
   }
   broadcastState(meta = { persistSession: false }) {
@@ -3614,6 +3614,10 @@ const Channels = {
   CODEX_CANCEL_AUTH: "codex:cancel-auth",
   CODEX_AUTH_STATUS: "codex:auth-status",
   CODEX_DISCONNECT: "codex:disconnect",
+  // OpenRouter OAuth
+  OPENROUTER_START_AUTH: "openrouter:start-auth",
+  OPENROUTER_CANCEL_AUTH: "openrouter:cancel-auth",
+  OPENROUTER_AUTH_STATUS: "openrouter:auth-status",
   // Updates
   UPDATES_CHECK: "updates:check",
   UPDATES_OPEN_DOWNLOAD: "updates:open-download",
@@ -4578,7 +4582,7 @@ function errorResult(error, value) {
 function getErrorMessage(error, fallback = "Unknown error") {
   return error instanceof Error && error.message ? error.message : fallback;
 }
-const logger$l = createLogger("Premium");
+const logger$n = createLogger("Premium");
 const VERIFICATION_API = process.env.VESSEL_PREMIUM_API || "https://vesselpremium.quantaintellect.com";
 const FREE_TOOL_ITERATION_LIMIT = 50;
 const REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -4745,7 +4749,7 @@ async function verifySubscription$1(identifier) {
     });
     if (!res.ok) {
       const detail = await readApiErrorDetail(res);
-      logger$l.warn(
+      logger$n.warn(
         "Verification API returned a non-OK status:",
         res.status,
         detail
@@ -4764,7 +4768,7 @@ async function verifySubscription$1(identifier) {
     setSetting("premium", updated);
     return updated;
   } catch (err) {
-    logger$l.warn("Verification failed:", err);
+    logger$n.warn("Verification failed:", err);
     return current;
   }
 }
@@ -5376,7 +5380,7 @@ const EXTRACT_TIMEOUT_MAX_MS = 2e4;
 const MUTATION_CAPTURE_INTERVAL_MS = 5e3;
 const MUTATION_SETTLE_AFTER_MS = 1500;
 const AGENT_STREAM_IDLE_TIMEOUT_MS = 3e4;
-const logger$k = createLogger("Extractor");
+const logger$m = createLogger("Extractor");
 const EXTRACTION_CACHE_TTL_MS = 1500;
 const MAX_EXTRACTION_CACHE_ENTRIES = 50;
 const extractionCache = /* @__PURE__ */ new Map();
@@ -6143,9 +6147,9 @@ async function executeScript(webContents, script, options = {}) {
     const message = err instanceof Error ? err.message : String(err);
     const detail = `Failed to execute page script${label} on ${url}: ${message}`;
     if (options.warnOnFailure) {
-      logger$k.warn(detail);
+      logger$m.warn(detail);
     } else {
-      logger$k.debug(detail);
+      logger$m.debug(detail);
     }
     return null;
   } finally {
@@ -6254,7 +6258,7 @@ async function estimateExtractionTimeout(webContents) {
       return EXTRACT_TIMEOUT_BASE_MS + extra;
     }
   } catch (err) {
-    logger$k.warn("Failed to estimate extraction timeout, using base timeout:", err);
+    logger$m.warn("Failed to estimate extraction timeout, using base timeout:", err);
   }
   return EXTRACT_TIMEOUT_BASE_MS;
 }
@@ -7481,8 +7485,9 @@ const PROVIDERS = {
   openrouter: {
     id: "openrouter",
     name: "OpenRouter",
-    defaultModel: "anthropic/claude-sonnet-4",
+    defaultModel: "openrouter/free",
     models: [
+      "openrouter/free",
       "anthropic/claude-sonnet-4",
       "anthropic/claude-haiku-4",
       "openai/gpt-4o",
@@ -8028,7 +8033,7 @@ function recoverNarratedActionToolCalls(text, availableToolNames) {
   }
   return recovered;
 }
-const logger$j = createLogger("OpenAIProvider");
+const logger$l = createLogger("OpenAIProvider");
 function shouldDebugAgentLoop() {
   const value = process.env.VESSEL_DEBUG_AGENT_LOOP;
   return value === "1" || value === "true";
@@ -8296,9 +8301,9 @@ function shouldRetryCompactToolLoop(profile, text, hasToolHistory, userMessage)
 function logAgentLoopDebug(payload) {
   if (!shouldDebugAgentLoop()) return;
   try {
-    logger$j.info(`[agent-debug] ${JSON.stringify(payload)}`);
+    logger$l.info(`[agent-debug] ${JSON.stringify(payload)}`);
   } catch (err) {
-    logger$j.warn("Failed to serialize debug payload:", err);
+    logger$l.warn("Failed to serialize debug payload:", err);
   }
 }
 function formatOpenAICompatErrorMessage(providerId, message) {
@@ -8732,28 +8737,184 @@ async function openExternalAllowlisted(url, rule) {
   }
   await electron.shell.openExternal(parsed.toString());
 }
-const logger$i = createLogger("CodexOAuth");
-const ISSUER = "https://auth.openai.com";
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-const AUTH_TIMEOUT_MS = 5 * 60 * 1e3;
-const PREFERRED_PORT = 1455;
-const FALLBACK_PORT = 1457;
-let activeFlow = null;
 function base64url(buffer) {
   return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function generatePkce() {
   const codeVerifier = base64url(crypto$1.randomBytes(64));
   const hash = crypto$1.createHash("sha256").update(codeVerifier).digest();
-  const codeChallenge = base64url(hash);
-  return { codeVerifier, codeChallenge };
+  return {
+    codeVerifier,
+    codeChallenge: base64url(hash)
+  };
 }
 function generateState() {
   return base64url(crypto$1.randomBytes(32));
 }
-function buildAuthorizeUrl(port, pkce, state2) {
-  const redirectUri = `http://localhost:${port}/auth/callback`;
+function buildCallbackUrl(port, path2) {
+  return `http://localhost:${port}${path2}`;
+}
+async function bindServer(server, preferredPorts) {
+  for (const port of preferredPorts) {
+    try {
+      await new Promise((resolve, reject) => {
+        const onError = (err) => {
+          server.off("listening", onListening);
+          reject(err);
+        };
+        const onListening = () => {
+          server.off("error", onError);
+          resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, "127.0.0.1");
+      });
+      return port;
+    } catch (err) {
+      if (err.code === "EADDRINUSE") {
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error(
+    `Could not bind ${preferredPorts.join(", ")} callback ports`
+  );
+}
+function createLocalPkceOAuthFlow(config) {
+  let activeFlow = null;
+  const cancel = () => {
+    if (!activeFlow) return;
+    activeFlow.server.close();
+    clearTimeout(activeFlow.timeout);
+    try {
+      activeFlow.onStatus("idle");
+    } catch {
+      config.logger.warn(`${config.name} OAuth cancel status callback failed`);
+    }
+    activeFlow = null;
+  };
+  const start = (onStatus) => {
+    if (activeFlow) {
+      throw new Error(`${config.name} auth flow already in progress`);
+    }
+    const pkce = generatePkce();
+    const state2 = generateState();
+    const callbackPath = config.callbackPath(state2);
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      let boundPort = 0;
+      const safeOnStatus = (status, error) => {
+        try {
+          onStatus(status, error);
+        } catch {
+          config.logger.warn(`${config.name} OAuth status callback failed`);
+        }
+      };
+      const cleanup = () => {
+        clearTimeout(activeFlow?.timeout);
+        activeFlow?.server.close();
+        activeFlow = null;
+      };
+      const wrappedResolve = (result) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        safeOnStatus("connected");
+        resolve(result);
+      };
+      const wrappedReject = (err) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        safeOnStatus("error", err.message);
+        reject(err);
+      };
+      const server = http.createServer(async (req, res) => {
+        const url = new URL(req.url || "/", `http://localhost:${boundPort}`);
+        if (url.pathname === callbackPath) {
+          const authError = config.authErrorMessage?.(url) || url.searchParams.get("error");
+          if (authError) {
+            res.writeHead(400, { "Content-Type": "text/plain", Connection: "close" });
+            res.end(`Authorization failed: ${authError}`);
+            wrappedReject(new Error(authError));
+            return;
+          }
+          if (config.readState(url) !== state2) {
+            res.writeHead(400, { "Content-Type": "text/plain", Connection: "close" });
+            res.end("State mismatch. Please try again.");
+            wrappedReject(new Error("State mismatch"));
+            return;
+          }
+          const code = url.searchParams.get("code");
+          if (!code) {
+            res.writeHead(400, { "Content-Type": "text/plain", Connection: "close" });
+            res.end("Missing authorization code.");
+            wrappedReject(new Error("Missing authorization code"));
+            return;
+          }
+          try {
+            safeOnStatus("exchanging");
+            const result = await config.exchangeCode({
+              code,
+              codeVerifier: pkce.codeVerifier,
+              callbackUrl: buildCallbackUrl(boundPort, callbackPath),
+              port: boundPort
+            });
+            res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+            res.end(config.successHtml(result));
+            wrappedResolve(result);
+          } catch (err) {
+            const message = err instanceof Error ? err.message : "Unknown error";
+            res.writeHead(400, { "Content-Type": "text/plain", Connection: "close" });
+            res.end(`${config.name} setup failed: ${message}`);
+            wrappedReject(err instanceof Error ? err : new Error(`${config.name} setup failed`));
+          }
+          return;
+        }
+        res.writeHead(404, { Connection: "close" });
+        res.end("Not found");
+      });
+      const timeout = setTimeout(() => {
+        wrappedReject(new Error(`${config.name} setup timed out after 5 minutes`));
+      }, config.timeoutMs);
+      activeFlow = {
+        server,
+        timeout,
+        onStatus
+      };
+      bindServer(server, config.preferredPorts).then((port) => {
+        if (settled || !activeFlow) return;
+        boundPort = port;
+        const callbackUrl = buildCallbackUrl(port, callbackPath);
+        const authUrl = config.buildAuthorizeUrl({
+          port,
+          pkce,
+          state: state2,
+          callbackUrl
+        });
+        safeOnStatus("waiting");
+        openExternalAllowlisted(authUrl, { hosts: [...config.openHosts] }).catch((err) => {
+          config.logger.warn(`Failed to open ${config.name} auth URL:`, err);
+        });
+      }).catch(wrappedReject);
+    });
+  };
+  return {
+    start,
+    cancel,
+    isInProgress: () => activeFlow !== null
+  };
+}
+const logger$k = createLogger("CodexOAuth");
+const ISSUER = "https://auth.openai.com";
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const AUTH_TIMEOUT_MS$1 = 5 * 60 * 1e3;
+const PREFERRED_PORT$1 = 1455;
+const FALLBACK_PORT$1 = 1457;
+function buildAuthorizeUrl(redirectUri, pkce, state2) {
   const params = new URLSearchParams({
     response_type: "code",
     client_id: CLIENT_ID,
@@ -8872,172 +9033,36 @@ async function refreshAccessToken(tokens) {
   };
   return refreshedTokens;
 }
-function startServer(port, pkce, expectedState, resolve, reject) {
-  const server = http.createServer(async (req, res) => {
-    const url = new URL(req.url || "/", `http://localhost:${port}`);
-    if (url.pathname === "/auth/callback") {
-      const state2 = url.searchParams.get("state");
-      const code = url.searchParams.get("code");
-      const error = url.searchParams.get("error");
-      const errorDescription = url.searchParams.get("error_description");
-      if (error) {
-        res.writeHead(400, { "Content-Type": "text/plain", "Connection": "close" });
-        const msg = errorDescription || error;
-        res.end(`Authorization failed: ${msg}`);
-        reject(new Error(msg));
-        return;
-      }
-      if (state2 !== expectedState) {
-        res.writeHead(400, { "Content-Type": "text/plain", "Connection": "close" });
-        res.end("State mismatch. Please try again.");
-        reject(new Error("State mismatch"));
-        return;
-      }
-      if (!code) {
-        res.writeHead(400, { "Content-Type": "text/plain", "Connection": "close" });
-        res.end("Missing authorization code.");
-        reject(new Error("Missing authorization code"));
-        return;
-      }
-      try {
-        activeFlow?.onStatus("exchanging");
-        const redirectUri = `http://localhost:${activeFlow?.port ?? port}/auth/callback`;
-        const tokens = await exchangeCodeForTokens(code, redirectUri, pkce.codeVerifier);
-        res.writeHead(302, {
-          Location: `/success?email=${encodeURIComponent(tokens.accountEmail || tokens.accountId)}`,
-          Connection: "close"
-        });
-        res.end();
-        resolve(tokens);
-      } catch (err) {
-        res.writeHead(400, { "Content-Type": "text/plain", "Connection": "close" });
-        res.end(`Token exchange failed: ${err instanceof Error ? err.message : "Unknown error"}`);
-        reject(err instanceof Error ? err : new Error("Token exchange failed"));
-      }
-      return;
-    }
-    if (url.pathname === "/success") {
-      const email = url.searchParams.get("email") || "";
-      res.writeHead(200, { "Content-Type": "text/html", "Connection": "close" });
-      res.end(`<!DOCTYPE html>
-<html><head><meta charset="utf-8"><title>Vessel — Signed In</title>
-<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#111;color:#eee}</style></head>
-<body><div style="text-align:center"><h1>✓ Signed In</h1>
-<p>Connected as ${escapeHtml(email)}</p><p>You can close this tab.</p></div></body></html>`);
-      return;
-    }
-    if (url.pathname === "/cancel") {
-      res.writeHead(200, { "Content-Type": "text/plain", "Connection": "close" });
-      res.end("Login cancelled");
-      reject(new Error("Login cancelled by user"));
-      return;
-    }
-    res.writeHead(404, { "Connection": "close" });
-    res.end("Not found");
-  });
-  return server;
-}
 function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-async function bindServer(server) {
-  const allowedPorts = [PREFERRED_PORT, FALLBACK_PORT];
-  for (const port of allowedPorts) {
-    try {
-      await new Promise((resolve, reject) => {
-        const onError = (err) => {
-          server.off("listening", onListening);
-          reject(err);
-        };
-        const onListening = () => {
-          server.off("error", onError);
-          resolve();
-        };
-        server.once("error", onError);
-        server.once("listening", onListening);
-        server.listen(port, "127.0.0.1");
-      });
-      return port;
-    } catch (err) {
-      if (err.code === "EADDRINUSE") {
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new Error(
-    `Could not bind Codex OAuth callback server to registered ports ${allowedPorts.join(", ")}`
-  );
-}
+const codexOAuth = createLocalPkceOAuthFlow({
+  name: "Codex",
+  logger: logger$k,
+  preferredPorts: [PREFERRED_PORT$1, FALLBACK_PORT$1],
+  timeoutMs: AUTH_TIMEOUT_MS$1,
+  callbackPath: () => "/auth/callback",
+  readState: (url) => url.searchParams.get("state"),
+  authErrorMessage: (url) => url.searchParams.get("error_description") || url.searchParams.get("error"),
+  buildAuthorizeUrl: ({ callbackUrl, pkce, state: state2 }) => buildAuthorizeUrl(callbackUrl, pkce, state2),
+  exchangeCode: ({ code, callbackUrl, codeVerifier }) => exchangeCodeForTokens(code, callbackUrl, codeVerifier),
+  successHtml: (tokens) => {
+    const label = escapeHtml(tokens.accountEmail || tokens.accountId);
+    return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>Vessel — Signed In</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#111;color:#eee}</style></head>
+<body><div style="text-align:center"><h1>Signed In</h1>
+<p>Connected as ${label}</p><p>You can close this tab.</p></div></body></html>`;
+  },
+  openHosts: ["auth.openai.com"]
+});
 async function startCodexOAuth(onStatus) {
-  if (activeFlow) {
-    throw new Error("Auth flow already in progress");
-  }
-  const pkce = generatePkce();
-  const state2 = generateState();
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const safeOnStatus = (status, error) => {
-      try {
-        onStatus(status, error);
-      } catch {
-        logger$i.warn("Codex OAuth status callback failed — window may be closed");
-      }
-    };
-    const wrappedResolve = (tokens) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      safeOnStatus("connected");
-      resolve(tokens);
-    };
-    const wrappedReject = (err) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      safeOnStatus("error", err.message);
-      reject(err);
-    };
-    const server = startServer(0, pkce, state2, wrappedResolve, wrappedReject);
-    const timeout = setTimeout(() => {
-      wrappedReject(new Error("Auth flow timed out after 5 minutes"));
-    }, AUTH_TIMEOUT_MS);
-    activeFlow = {
-      state: state2,
-      codeVerifier: pkce.codeVerifier,
-      port: 0,
-      server,
-      timeout,
-      onStatus
-    };
-    const cleanup = () => {
-      if (activeFlow?.timeout) clearTimeout(activeFlow.timeout);
-      activeFlow?.server.close();
-      activeFlow = null;
-    };
-    bindServer(server).then((port) => {
-      if (settled) return;
-      activeFlow.port = port;
-      const authUrl = buildAuthorizeUrl(port, pkce, state2);
-      safeOnStatus("waiting");
-      openExternalAllowlisted(authUrl, { hosts: ["auth.openai.com"] }).catch((err) => {
-        logger$i.warn("Failed to open browser, user will need the URL:", err);
-      });
-    }).catch(wrappedReject);
-  });
+  return codexOAuth.start(onStatus);
 }
 function cancelCodexOAuth() {
-  if (!activeFlow) return;
-  activeFlow.server.close();
-  if (activeFlow.timeout) clearTimeout(activeFlow.timeout);
-  try {
-    activeFlow.onStatus("idle");
-  } catch {
-    logger$i.warn("Codex OAuth cancel status callback failed — window may be closed");
-  }
-  activeFlow = null;
+  codexOAuth.cancel();
 }
-const logger$h = createLogger("CodexProvider");
+const logger$j = createLogger("CodexProvider");
 const REFRESH_WINDOW_MS = 5 * 60 * 1e3;
 const CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
 const CODEX_CLIENT_VERSION = "0.129.0";
@@ -9102,7 +9127,7 @@ class CodexProvider {
   async ensureFreshTokens() {
     if (Date.now() < this.tokens.expiresAt - REFRESH_WINDOW_MS) return;
     try {
-      logger$h.info("Refreshing Codex access token");
+      logger$j.info("Refreshing Codex access token");
       const fresh = await refreshAccessToken(this.tokens);
       this.tokens = fresh;
       writeStoredCodexTokens(fresh);
@@ -9250,7 +9275,7 @@ class CodexProvider {
     } catch (err) {
       if (err.name !== "AbortError") {
         const msg = err instanceof Error ? err.message : String(err);
-        logger$h.error("Codex streamQuery error:", err);
+        logger$j.error("Codex streamQuery error:", err);
         onChunk(`
 
 [Error: ${msg}]`);
@@ -9318,7 +9343,7 @@ class CodexProvider {
     } catch (err) {
       if (err.name !== "AbortError") {
         const msg = err instanceof Error ? err.message : String(err);
-        logger$h.error("Codex streamAgentQuery error:", err);
+        logger$j.error("Codex streamAgentQuery error:", err);
         onChunk(`
 
 [Error: ${msg}]`);
@@ -9510,7 +9535,7 @@ function createProvider(config) {
   return new OpenAICompatProvider(normalized);
 }
 const require$1 = node_module.createRequire(require("url").pathToFileURL(__filename).href);
-const logger$g = createLogger("DevTrace");
+const logger$i = createLogger("DevTrace");
 let cachedFactory;
 function createNoopTraceSession() {
   return {
@@ -9543,7 +9568,7 @@ function loadLocalFactory() {
         return cachedFactory;
       }
     } catch (err) {
-      logger$g.warn("Failed to load local trace logger:", err);
+      logger$i.warn("Failed to load local trace logger:", err);
     }
   }
   return cachedFactory;
@@ -13671,7 +13696,7 @@ function formatDeadLinkMessage(label, result) {
   const status = result.statusCode ? `HTTP ${result.statusCode}` : "dead link";
   return `Skipped stale link "${label}" because ${destination} returned ${status}. Try a different link or URL instead.`;
 }
-const logger$f = createLogger("Screenshot");
+const logger$h = createLogger("Screenshot");
 const SCREENSHOT_RETRY_COUNT = 3;
 const SCREENSHOT_RETRY_BASE_DELAY_MS = 120;
 async function captureScreenshot(wc) {
@@ -13693,7 +13718,7 @@ async function captureScreenshot(wc) {
         }
       }
     } catch (err) {
-      logger$f.debug(
+      logger$h.debug(
         `capturePage attempt ${attempt + 1} failed; retrying if attempts remain.`,
         getErrorMessage(err)
       );
@@ -14669,7 +14694,7 @@ class TabMutex {
     return run;
   }
 }
-const logger$e = createLogger("PageActions");
+const logger$g = createLogger("PageActions");
 function getBookmarkMetadataFromArgs(args) {
   return normalizeBookmarkMetadata({
     intent: args.intent ?? args.intent,
@@ -14855,7 +14880,7 @@ async function executePageScript(wc, script, options) {
     return result;
   } catch (err) {
     const label = options?.label ? ` (${options.label})` : "";
-    logger$e.warn(`Failed to execute page script${label}:`, err);
+    logger$g.warn(`Failed to execute page script${label}:`, err);
     return null;
   } finally {
     if (timer) {
@@ -14956,7 +14981,7 @@ Search results snapshot:
 ${truncated}`;
     }
   } catch (err) {
-    logger$e.warn("Failed to build post-search summary, falling back to nav summary:", err);
+    logger$g.warn("Failed to build post-search summary, falling back to nav summary:", err);
   }
   const fallback = await getPostNavSummary(wc);
   return fallback ? `${fallback}
@@ -14979,7 +15004,7 @@ Page snapshot after navigation:
 ${truncated}`;
     }
   } catch (err) {
-    logger$e.warn("Failed to build post-click navigation summary:", err);
+    logger$g.warn("Failed to build post-click navigation summary:", err);
   }
   return "";
 }
@@ -15473,7 +15498,7 @@ async function restoreLocaleSnapshot(wc, snapshot2) {
       }
     }
   } catch (err) {
-    logger$e.warn("Failed to restore locale via history navigation, trying URL reload fallback:", err);
+    logger$g.warn("Failed to restore locale via history navigation, trying URL reload fallback:", err);
   }
   if (snapshot2.url && snapshot2.url !== wc.getURL()) {
     try {
@@ -15482,7 +15507,7 @@ async function restoreLocaleSnapshot(wc, snapshot2) {
       await waitForLoad(wc, 3e3);
       return;
     } catch (err) {
-      logger$e.warn("Failed to restore locale via safe URL load, trying page reload fallback:", err);
+      logger$g.warn("Failed to restore locale via safe URL load, trying page reload fallback:", err);
     }
   }
   if (snapshot2.url) {
@@ -15490,7 +15515,7 @@ async function restoreLocaleSnapshot(wc, snapshot2) {
       await wc.reload();
       await waitForLoad(wc, 3e3);
     } catch (err) {
-      logger$e.warn("Failed to restore locale via page reload:", err);
+      logger$g.warn("Failed to restore locale via page reload:", err);
     }
   }
 }
@@ -15760,7 +15785,7 @@ ${postActivationOverlayHint}`;
           return `${clickText} -> ${hrefFallbackUrl} (recovered via href fallback)`;
         }
       } catch (err) {
-        logger$e.warn("Failed href fallback after click, returning generic click result:", err);
+        logger$g.warn("Failed href fallback after click, returning generic click result:", err);
       }
     }
   }
@@ -15805,7 +15830,7 @@ async function tryAutoDismissCartDialog(wc) {
       return result;
     }
   } catch (err) {
-    logger$e.warn("Failed to auto-dismiss cart dialog, falling back to dialog actions:", err);
+    logger$g.warn("Failed to auto-dismiss cart dialog, falling back to dialog actions:", err);
   }
   return null;
 }
@@ -18088,7 +18113,7 @@ async function executeAction(name, args, ctx) {
               )
             ]);
           } catch (err) {
-            logger$e.warn("Failed to extract content for read_page, falling back to lighter recovery:", err);
+            logger$g.warn("Failed to extract content for read_page, falling back to lighter recovery:", err);
             content = null;
           }
           if (!content || content.content.length === 0) {
@@ -18105,12 +18130,12 @@ async function executeAction(name, args, ctx) {
                     new Promise((resolve) => setTimeout(() => resolve(null), 3e3))
                   ]);
                 } catch (err) {
-                  logger$e.warn("Failed to re-extract content after iframe consent dismissal:", err);
+                  logger$g.warn("Failed to re-extract content after iframe consent dismissal:", err);
                   content = null;
                 }
               }
             } catch (err) {
-              logger$e.warn("Failed iframe consent dismissal during read_page recovery:", err);
+              logger$g.warn("Failed iframe consent dismissal during read_page recovery:", err);
             }
           }
           if (content && content.content.length > 0) {
@@ -18523,7 +18548,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
           try {
             page = await extractContent(wc);
           } catch (err) {
-            logger$e.warn("Failed to extract content for suggest:", err);
+            logger$g.warn("Failed to extract content for suggest:", err);
             return "Could not read page. Try navigate to a working URL.";
           }
           const suggestions = [];
@@ -19972,7 +19997,7 @@ Exception: ${result.exceptionDetails}`);
     }
   );
 }
-const logger$d = createLogger("VaultShared");
+const logger$f = createLogger("VaultShared");
 const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
@@ -20066,7 +20091,7 @@ function createVaultIO(vaultFilename, encrypt2, decrypt2) {
       cachedEntries = JSON.parse(json);
       return cachedEntries;
     } catch (err) {
-      logger$d.error("Failed to load vault:", err);
+      logger$f.error("Failed to load vault:", err);
       throw new Error("Could not unlock the vault. Check OS secret storage availability.");
     }
   }
@@ -20149,7 +20174,7 @@ function createAuditLog(filename, maxEntries) {
       } catch {
       }
     } catch (err) {
-      logger$d.error("Failed to write audit log:", err);
+      logger$f.error("Failed to write audit log:", err);
     }
   }
   function readAuditLog2(limit = 100) {
@@ -20159,7 +20184,7 @@ function createAuditLog(filename, maxEntries) {
       const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
       return lines.slice(-Math.min(limit, maxEntries)).map((line) => JSON.parse(line)).reverse();
     } catch (err) {
-      logger$d.error("Failed to read audit log:", err);
+      logger$f.error("Failed to read audit log:", err);
       return [];
     }
   }
@@ -20263,7 +20288,7 @@ async function requestConsent(request) {
 }
 const AUDIT_FILENAME = "vessel-vault-audit.jsonl";
 const MAX_ENTRIES = 1e3;
-const logger$c = createLogger("VaultAudit");
+const logger$e = createLogger("VaultAudit");
 function getAuditPath() {
   return path$1.join(electron.app.getPath("userData"), AUDIT_FILENAME);
 }
@@ -20277,7 +20302,7 @@ function appendAuditEntry(entry) {
     });
     fs$1.chmodSync(auditPath, 384);
   } catch (err) {
-    logger$c.error("Failed to write audit log:", err);
+    logger$e.error("Failed to write audit log:", err);
   }
 }
 function readAuditLog$1(limit = 100) {
@@ -20287,7 +20312,7 @@ function readAuditLog$1(limit = 100) {
     const lines = fs$1.readFileSync(auditPath, "utf-8").split("\n").filter((l) => l.trim());
     return lines.slice(-Math.min(limit, MAX_ENTRIES)).map((line) => JSON.parse(line)).reverse();
   } catch (err) {
-    logger$c.error("Failed to read audit log:", err);
+    logger$e.error("Failed to read audit log:", err);
     return [];
   }
 }
@@ -20455,7 +20480,7 @@ async function requestHumanVaultConsent(request) {
 }
 let httpServer = null;
 let mcpAuthToken = null;
-const logger$b = createLogger("MCP");
+const logger$d = createLogger("MCP");
 const MCP_AUTH_FILENAME = "mcp-auth.json";
 function getMcpAuthFilePath() {
   const configDir = process.env.VESSEL_CONFIG_DIR || path$1.join(
@@ -20492,7 +20517,7 @@ function writeMcpAuthFile(endpoint, token) {
     );
     fs$1.chmodSync(filePath2, 384);
   } catch (err) {
-    logger$b.warn("Failed to write auth file:", err);
+    logger$d.warn("Failed to write auth file:", err);
   }
 }
 function clearMcpAuthFile() {
@@ -20518,7 +20543,7 @@ function clearMcpAuthFile() {
     );
     fs$1.chmodSync(filePath2, 384);
   } catch (err) {
-    logger$b.warn("Failed to clear auth file:", err);
+    logger$d.warn("Failed to clear auth file:", err);
   }
 }
 function regenerateMcpAuthToken() {
@@ -20628,7 +20653,7 @@ async function getPostActionState(tabManager, name) {
         }
       }
     } catch (err) {
-      logger$b.warn("Failed to compute post-action state warning:", err);
+      logger$d.warn("Failed to compute post-action state warning:", err);
     }
     return `${warning}
 [state: url=${wc.getURL()}, canGoBack=${tab.canGoBack()}, canGoForward=${tab.canGoForward()}, loading=${wc.isLoading()}]`;
@@ -20733,7 +20758,7 @@ async function waitForConditionMcp(wc, text, selector, timeoutMs) {
         }
       })()
     `).catch((err) => {
-      logger$b.warn("Failed to gather wait_for timeout diagnostic:", err);
+      logger$d.warn("Failed to gather wait_for timeout diagnostic:", err);
       return null;
     });
     if (typeof diagnostic === "string" && diagnostic.trim()) {
@@ -20820,7 +20845,7 @@ function registerTools(server, tabManager, runtime2) {
           const page = await extractContent(wc);
           pageType = detectPageType(page);
         } catch (err) {
-          logger$b.warn("Failed to detect page type for tool scoring, falling back to GENERAL:", err);
+          logger$d.warn("Failed to detect page type for tool scoring, falling back to GENERAL:", err);
         }
       }
       const scored = TOOL_DEFINITIONS.map((def) => {
@@ -22220,7 +22245,7 @@ ${JSON.stringify(otherHighlights, null, 2)}`
             void 0,
             h.color
           ).catch(
-            (err) => logger$b.warn("Failed to restore highlight after removal:", err)
+            (err) => logger$d.warn("Failed to restore highlight after removal:", err)
           );
         }
       }
@@ -23076,7 +23101,7 @@ ${flow.steps.map((s, i) => `  ${i === 0 ? "→" : " "} ${s.label}`).join("\n")}`
       try {
         page = await extractContent(wc);
       } catch (err) {
-        logger$b.warn("Failed to extract page while generating suggestions:", err);
+        logger$d.warn("Failed to extract page while generating suggestions:", err);
         return asTextResponse(
           "Could not read page. Try navigate to a working URL."
         );
@@ -23687,7 +23712,7 @@ ${JSON.stringify(tableJson, null, 2)}`;
         try {
           targetDomain = new URL(tab.state.url).hostname;
         } catch (err) {
-          logger$b.warn("Failed to parse active tab URL for vault_status:", err);
+          logger$d.warn("Failed to parse active tab URL for vault_status:", err);
           return asErrorTextResponse("Could not parse active tab URL");
         }
       }
@@ -23755,7 +23780,7 @@ Use vault_login to fill the login form. Credentials are filled directly — you
       try {
         hostname = new URL(tab.state.url).hostname;
       } catch (err) {
-        logger$b.warn("Failed to parse active tab URL for vault_login:", err);
+        logger$d.warn("Failed to parse active tab URL for vault_login:", err);
         return asErrorTextResponse("Could not parse active tab URL");
       }
       const matches = findEntriesForDomain(`https://${hostname}`);
@@ -23851,7 +23876,7 @@ Use vault_login to fill the login form. Credentials are filled directly — you
       try {
         hostname = new URL(tab.state.url).hostname;
       } catch (err) {
-        logger$b.warn("Failed to parse active tab URL for vault_totp:", err);
+        logger$d.warn("Failed to parse active tab URL for vault_totp:", err);
         return asErrorTextResponse("Could not parse active tab URL");
       }
       const matches = findEntriesForDomain(`https://${hostname}`);
@@ -24199,7 +24224,7 @@ function startMcpServer(tabManager, runtime2, port) {
         await mcpServer.connect(transport);
         await transport.handleRequest(req, res);
       } catch (error) {
-        logger$b.error("Error handling request:", error);
+        logger$d.error("Error handling request:", error);
         if (!res.headersSent) {
           res.writeHead(500, { "Content-Type": "application/json" });
           res.end(
@@ -24218,7 +24243,7 @@ function startMcpServer(tabManager, runtime2, port) {
     };
     server.once("error", (error) => {
       const message = error.code === "EADDRINUSE" ? `Port ${port} is already in use. MCP server not started.` : error.message;
-      logger$b.error("Server error:", error);
+      logger$d.error("Server error:", error);
       clearMcpAuthFile();
       setMcpHealth({
         configuredPort: port,
@@ -24250,7 +24275,7 @@ function startMcpServer(tabManager, runtime2, port) {
         message: `MCP server listening on ${endpoint}.`
       });
       if (process.env.VESSEL_DEBUG_MCP === "1" || process.env.VESSEL_DEBUG_MCP === "true") {
-        logger$b.info(`Server listening on ${endpoint} (auth enabled)`);
+        logger$d.info(`Server listening on ${endpoint} (auth enabled)`);
       }
       if (mcpAuthToken) {
         writeMcpAuthFile(endpoint, mcpAuthToken);
@@ -24289,7 +24314,7 @@ function stopMcpServer() {
         message: "MCP server is stopped."
       });
       if (process.env.VESSEL_DEBUG_MCP === "1" || process.env.VESSEL_DEBUG_MCP === "true") {
-        logger$b.info("Server stopped");
+        logger$d.info("Server stopped");
       }
       resolve();
     });
@@ -24310,7 +24335,7 @@ const KIT_ID_UNSAFE_CHAR_PATTERN = /[\/\\\0]/;
 function isSafeAutomationKitId(id) {
   return id.length > 0 && !KIT_ID_UNSAFE_CHAR_PATTERN.test(id);
 }
-const logger$a = createLogger("KitRegistry");
+const logger$c = createLogger("KitRegistry");
 function getUserKitsDir() {
   return path$1.join(electron.app.getPath("userData"), "kits");
 }
@@ -24348,10 +24373,10 @@ function getInstalledKits() {
       if (isValidKit(parsed)) {
         kits.push(parsed);
       } else {
-        logger$a.warn(`Skipping invalid kit file: ${file}`);
+        logger$c.warn(`Skipping invalid kit file: ${file}`);
       }
     } catch (err) {
-      logger$a.warn(`Failed to read kit file: ${file}`, err);
+      logger$c.warn(`Failed to read kit file: ${file}`, err);
     }
   }
   return kits;
@@ -24460,7 +24485,7 @@ function getActiveTabInfo(tabManager) {
   if (wc.isDestroyed()) return null;
   return { tab, wc };
 }
-const logger$9 = createLogger("Scheduler");
+const logger$b = createLogger("Scheduler");
 let jobs = [];
 let pollInterval = null;
 let alignStartTimeout = null;
@@ -24493,7 +24518,7 @@ function saveJobs() {
     });
     fs$1.chmodSync(jobsPath, 384);
   } catch (err) {
-    logger$9.warn("Failed to save jobs:", err);
+    logger$b.warn("Failed to save jobs:", err);
   }
 }
 function normalizeJob(job, now = /* @__PURE__ */ new Date()) {
@@ -24617,7 +24642,7 @@ async function fireJob(job, windowState, runtime2) {
   };
   startActivity();
   if (!settings2.chatProvider) {
-    logger$9.warn(`Job "${job.kitName}" skipped — no chat provider configured`);
+    logger$b.warn(`Job "${job.kitName}" skipped — no chat provider configured`);
     appendActivity(
       "Chat provider not configured. Open Settings (Ctrl+,) to choose a provider."
     );
@@ -24625,7 +24650,7 @@ async function fireJob(job, windowState, runtime2) {
     return;
   }
   if (process.env.VESSEL_DEBUG_SCHEDULER === "1" || process.env.VESSEL_DEBUG_SCHEDULER === "true") {
-    logger$9.info(`Firing scheduled job: ${job.kitName} (${job.id})`);
+    logger$b.info(`Firing scheduled job: ${job.kitName} (${job.id})`);
   }
   try {
     const provider = createProvider(settings2.chatProvider);
@@ -24678,7 +24703,7 @@ function tick(windowState, runtime2) {
     saveJobs();
     broadcastFn?.(Channels.SCHEDULE_JOBS_UPDATE, jobs);
     void fireJob(job, windowState, runtime2).catch((err) => {
-      logger$9.warn("Unexpected error firing job:", err);
+      logger$b.warn("Unexpected error firing job:", err);
     }).finally(fireNext);
   };
   fireNext();
@@ -25280,7 +25305,7 @@ function renderReportAsMarkdown(report, traces) {
   }
   return sections.join("\n");
 }
-const logger$8 = createLogger("ResearchIPC");
+const logger$a = createLogger("ResearchIPC");
 function registerResearchHandlers(getOrchestrator) {
   electron.ipcMain.handle(Channels.RESEARCH_STATE_GET, () => {
     return getOrchestrator().getState();
@@ -25299,7 +25324,7 @@ function registerResearchHandlers(getOrchestrator) {
         await getOrchestrator().startBrief(trimmedQuery);
         return { accepted: true };
       } catch (err) {
-        logger$8.error("RESEARCH_START_BRIEF failed", err);
+        logger$a.error("RESEARCH_START_BRIEF failed", err);
         return { accepted: false, reason: "error" };
       }
     }
@@ -25316,7 +25341,7 @@ function registerResearchHandlers(getOrchestrator) {
       orchestrator.confirmBrief();
       return { accepted: true };
     } catch (err) {
-      logger$8.error("RESEARCH_CONFIRM_BRIEF failed", err);
+      logger$a.error("RESEARCH_CONFIRM_BRIEF failed", err);
       return { accepted: false, reason: "error" };
     }
   });
@@ -25337,11 +25362,11 @@ function registerResearchHandlers(getOrchestrator) {
           options.includeTraces
         );
         orchestrator.executeSubAgents().catch((err) => {
-          logger$8.error("Background sub-agent execution failed", err);
+          logger$a.error("Background sub-agent execution failed", err);
         });
         return { accepted: true };
       } catch (err) {
-        logger$8.error("RESEARCH_APPROVE_OBJECTIVES failed", err);
+        logger$a.error("RESEARCH_APPROVE_OBJECTIVES failed", err);
         return { accepted: false, reason: "error" };
       }
     }
@@ -25391,7 +25416,7 @@ function registerResearchHandlers(getOrchestrator) {
       await promises.writeFile(filePath2, markdown, "utf-8");
       return { accepted: true, savedPath: filePath2 };
     } catch (err) {
-      logger$8.error("RESEARCH_EXPORT_REPORT failed", err);
+      logger$a.error("RESEARCH_EXPORT_REPORT failed", err);
       return { accepted: false, reason: "error" };
     }
   });
@@ -25486,7 +25511,7 @@ RULES:
 4. Omit empty arrays entirely (contradictions, gaps) — do not include "contradictions": [] if there are none.
 5. Do not use emojis.`;
 }
-const logger$7 = createLogger("ResearchOrchestrator");
+const logger$9 = createLogger("ResearchOrchestrator");
 const MAX_THREADS = 5;
 const MAX_TRACE_ARGS_CHARS = 1200;
 const MAX_TRACE_RESULT_CHARS = 2e3;
@@ -25675,7 +25700,7 @@ class ResearchOrchestrator {
   }
   stopAndSynthesizeCurrentFindings() {
     if (this.state.phase !== "executing") {
-      logger$7.warn("Not executing, ignoring stopAndSynthesizeCurrentFindings");
+      logger$9.warn("Not executing, ignoring stopAndSynthesizeCurrentFindings");
       return;
     }
     this.stopRequested = true;
@@ -25709,23 +25734,23 @@ class ResearchOrchestrator {
   async startBrief(userQuery) {
     const query = userQuery.trim();
     if (!query) {
-      logger$7.warn("Ignoring empty Research Desk query");
+      logger$9.warn("Ignoring empty Research Desk query");
       return;
     }
     if (this.state.phase !== "idle") {
-      logger$7.warn("Research already in progress, ignoring startBrief");
+      logger$9.warn("Research already in progress, ignoring startBrief");
       return;
     }
     this.state = this.initialState();
     this.state.originalQuery = query;
     this.state.startedAt = (/* @__PURE__ */ new Date()).toISOString();
     this.setPhase("briefing");
-    logger$7.info(`Brief started for query: ${query.slice(0, 120)}`);
+    logger$9.info(`Brief started for query: ${query.slice(0, 120)}`);
   }
   // ── phase: briefing → planning ─────────────────────────────────
   confirmBrief() {
     if (this.state.phase !== "briefing") {
-      logger$7.warn("Not in briefing phase, ignoring confirmBrief");
+      logger$9.warn("Not in briefing phase, ignoring confirmBrief");
       return;
     }
     this.setPhase("planning");
@@ -25733,7 +25758,7 @@ class ResearchOrchestrator {
   // ── phase: planning → awaiting_approval ────────────────────────
   setObjectives(objectives) {
     if (this.state.phase !== "planning") {
-      logger$7.warn("Not in planning phase, ignoring setObjectives");
+      logger$9.warn("Not in planning phase, ignoring setObjectives");
       return;
     }
     const threads = objectives.threads.slice(0, MAX_THREADS).map(mergeBlockedSourceDomains);
@@ -25762,11 +25787,11 @@ class ResearchOrchestrator {
     try {
       const parsed = JSON.parse(json);
       if (typeof parsed.researchQuestion !== "string" || !parsed.researchQuestion.trim()) {
-        logger$7.warn("Missing researchQuestion in objectives JSON");
+        logger$9.warn("Missing researchQuestion in objectives JSON");
         return false;
       }
       if (!Array.isArray(parsed.threads) || parsed.threads.length === 0) {
-        logger$7.warn("Missing or empty threads array in objectives JSON");
+        logger$9.warn("Missing or empty threads array in objectives JSON");
         return false;
       }
       const threads = parsed.threads.map((t, i) => {
@@ -25784,7 +25809,7 @@ class ResearchOrchestrator {
         };
       }).filter((thread) => thread.question && thread.searchQueries.length > 0).slice(0, MAX_THREADS);
       if (threads.length === 0) {
-        logger$7.warn("Objectives JSON did not contain any valid research threads");
+        logger$9.warn("Objectives JSON did not contain any valid research threads");
         return false;
       }
       const objectives = {
@@ -25795,17 +25820,17 @@ class ResearchOrchestrator {
         totalSourceBudget: threads.reduce((sum, t) => sum + t.sourceBudget, 0)
       };
       this.setObjectives(objectives);
-      logger$7.info(`Parsed ${objectives.threads.length} threads from objectives`);
+      logger$9.info(`Parsed ${objectives.threads.length} threads from objectives`);
       return true;
     } catch (err) {
-      logger$7.warn("Failed to parse objectives JSON", err);
+      logger$9.warn("Failed to parse objectives JSON", err);
       return false;
     }
   }
   // ── phase: awaiting_approval → executing ───────────────────────
   approveObjectives(mode, includeTraces) {
     if (this.state.phase !== "awaiting_approval") {
-      logger$7.warn("Not awaiting approval, ignoring approveObjectives");
+      logger$9.warn("Not awaiting approval, ignoring approveObjectives");
       return;
     }
     if (mode) this.state.supervisionMode = mode;
@@ -25840,7 +25865,7 @@ class ResearchOrchestrator {
       this.state.threads.map((thread) => {
         if (this.state.phase !== "executing") return null;
         return this.runSubAgent(thread, tabMutex).catch((err) => {
-          logger$7.error(`Sub-agent "${thread.label}" failed`, err);
+          logger$9.error(`Sub-agent "${thread.label}" failed`, err);
           return {
             threadLabel: thread.label,
             threadQuestion: thread.question,
@@ -25869,7 +25894,7 @@ class ResearchOrchestrator {
     try {
       await this.synthesizeReport();
     } catch (err) {
-      logger$7.error("Auto-synthesis failed", err);
+      logger$9.error("Auto-synthesis failed", err);
       this.state.error = `Synthesis failed: ${String(err)}`;
       this.setPhase("delivered");
     }
@@ -25980,7 +26005,7 @@ Start by searching for: ${thread.searchQueries.join(" or ")}`;
         try {
           this.tabManager.closeTab(tabId);
         } catch (err) {
-          logger$7.warn(`Failed to close sub-agent tab ${tabId}`, err);
+          logger$9.warn(`Failed to close sub-agent tab ${tabId}`, err);
         }
       }
     }
@@ -25989,7 +26014,7 @@ Start by searching for: ${thread.searchQueries.join(" or ")}`;
       try {
         claims = await this.extractClaimsFromTranscript(thread, transcript);
       } catch (err) {
-        logger$7.warn(`Claim extraction failed for "${thread.label}"`, err);
+        logger$9.warn(`Claim extraction failed for "${thread.label}"`, err);
       }
     }
     if (this.state.phase === "executing" && this.state.includeTraces) {
@@ -26079,7 +26104,7 @@ ${transcript.slice(0, 32e3)}`;
         (claim) => claim.claim && claim.sourceUrl && claim.extractedQuote
       );
     } catch {
-      logger$7.warn(`Failed to parse claims JSON for "${thread.label}"`);
+      logger$9.warn(`Failed to parse claims JSON for "${thread.label}"`);
       return [];
     }
   }
@@ -26164,7 +26189,7 @@ ${transcript.slice(0, 32e3)}`;
         objectives
       };
     } catch (err) {
-      logger$7.warn("Failed to parse synthesis JSON, using sourced fallback report", err);
+      logger$9.warn("Failed to parse synthesis JSON, using sourced fallback report", err);
       return buildFallbackReport(objectives, findings, String(err));
     }
   }
@@ -26903,7 +26928,7 @@ function createFindInPageBridge(tabManager, chromeView) {
     }
   };
 }
-const logger$6 = createLogger("PrivateWindow");
+const logger$8 = createLogger("PrivateWindow");
 const privateWindows = /* @__PURE__ */ new Set();
 function layoutPrivateViews(state2) {
   const { window: win, chromeView, tabManager } = state2;
@@ -27126,7 +27151,7 @@ function createPrivateWindow() {
       privateSession.clearStorageData(),
       privateSession.clearCache()
     ]).catch((error) => {
-      logger$6.warn("Failed to clear private browsing session:", error);
+      logger$8.warn("Failed to clear private browsing session:", error);
     });
   });
   privateWindows.add(state2);
@@ -27136,7 +27161,7 @@ function createPrivateWindow() {
   });
   loadPrivateRenderer(chromeView);
   win.show();
-  logger$6.info("Private browsing window opened");
+  logger$8.info("Private browsing window opened");
   return state2;
 }
 const secondaryWindows = /* @__PURE__ */ new Set();
@@ -27836,7 +27861,7 @@ function registerSecurityHandlers(tabManager) {
     tabManager.goBackToSafety(tabId);
   });
 }
-const logger$5 = createLogger("CodexIPC");
+const logger$7 = createLogger("CodexIPC");
 function registerCodexHandlers() {
   electron.ipcMain.handle(Channels.CODEX_START_AUTH, async (event) => {
     assertTrustedIpcSender(event);
@@ -27851,7 +27876,7 @@ function registerCodexHandlers() {
       try {
         wc.send(Channels.CODEX_AUTH_STATUS, { status, error: error || null });
       } catch {
-        logger$5.warn("Codex auth status send failed — window may be closed");
+        logger$7.warn("Codex auth status send failed — window may be closed");
       }
     };
     try {
@@ -27863,7 +27888,7 @@ function registerCodexHandlers() {
         accountId: tokens.accountId
       };
     } catch (err) {
-      logger$5.error("Codex auth failed:", err);
+      logger$7.error("Codex auth failed:", err);
       return {
         ok: false,
         error: err instanceof Error ? err.message : "Unknown error"
@@ -27881,6 +27906,119 @@ function registerCodexHandlers() {
     return { ok: true };
   });
 }
+const logger$6 = createLogger("OpenRouterOAuth");
+const AUTH_BASE_URL = "https://openrouter.ai/auth";
+const KEY_EXCHANGE_URL = "https://openrouter.ai/api/v1/auth/keys";
+const AUTH_TIMEOUT_MS = 5 * 60 * 1e3;
+const PREFERRED_PORT = 1460;
+const FALLBACK_PORT = 1461;
+async function exchangeCodeForApiKey(code, codeVerifier) {
+  const response = await fetch(KEY_EXCHANGE_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      code,
+      code_verifier: codeVerifier,
+      code_challenge_method: "S256"
+    })
+  });
+  if (!response.ok) {
+    let errorMsg = `OpenRouter key exchange failed: ${response.status}`;
+    try {
+      const payload2 = await response.json();
+      if (typeof payload2.error === "string") {
+        errorMsg = payload2.error;
+      } else if (typeof payload2.message === "string") {
+        errorMsg = payload2.message;
+      }
+    } catch {
+    }
+    throw new Error(errorMsg);
+  }
+  const payload = await response.json();
+  if (typeof payload.key !== "string" || !payload.key.trim()) {
+    throw new Error("OpenRouter did not return an API key");
+  }
+  return payload.key.trim();
+}
+const openRouterOAuth = createLocalPkceOAuthFlow({
+  name: "OpenRouter",
+  logger: logger$6,
+  preferredPorts: [PREFERRED_PORT, FALLBACK_PORT],
+  timeoutMs: AUTH_TIMEOUT_MS,
+  callbackPath: (state2) => `/auth/openrouter/callback/${state2}`,
+  readState: (url) => decodeURIComponent(url.pathname.split("/").pop() || ""),
+  buildAuthorizeUrl: ({ callbackUrl, pkce }) => {
+    const params = new URLSearchParams({
+      callback_url: callbackUrl,
+      code_challenge: pkce.codeChallenge,
+      code_challenge_method: "S256"
+    });
+    return `${AUTH_BASE_URL}?${params.toString()}`;
+  },
+  exchangeCode: ({ code, codeVerifier }) => exchangeCodeForApiKey(code, codeVerifier),
+  successHtml: () => `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>Vessel OpenRouter Setup</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#111;color:#eee}</style></head>
+<body><div style="text-align:center"><h1>OpenRouter connected</h1><p>Vessel is ready. You can close this tab.</p></div></body></html>`,
+  openHosts: ["openrouter.ai"]
+});
+function startOpenRouterOAuth(onStatus) {
+  return openRouterOAuth.start(onStatus);
+}
+function cancelOpenRouterOAuth() {
+  openRouterOAuth.cancel();
+}
+const logger$5 = createLogger("OpenRouterIPC");
+function registerOpenRouterHandlers(applySettingChange) {
+  electron.ipcMain.handle(Channels.OPENROUTER_START_AUTH, async (event) => {
+    assertTrustedIpcSender(event);
+    const wc = event.sender;
+    if (!wc || wc.isDestroyed()) {
+      return {
+        ok: false,
+        error: "No active window found for sender"
+      };
+    }
+    const sendStatus = (status, error) => {
+      try {
+        wc.send(Channels.OPENROUTER_AUTH_STATUS, { status, error: error || null });
+      } catch {
+        logger$5.warn("OpenRouter auth status send failed - window may be closed");
+      }
+    };
+    try {
+      const apiKey = await startOpenRouterOAuth(sendStatus);
+      const openRouterConfig = {
+        id: "openrouter",
+        apiKey,
+        hasApiKey: true,
+        model: PROVIDERS.openrouter.defaultModel,
+        baseUrl: PROVIDERS.openrouter.defaultBaseUrl,
+        reasoningEffort: "off"
+      };
+      await applySettingChange("chatProvider", openRouterConfig);
+      return {
+        ok: true,
+        providerId: "openrouter",
+        model: openRouterConfig.model
+      };
+    } catch (err) {
+      logger$5.error("OpenRouter auth failed:", err);
+      return {
+        ok: false,
+        error: err instanceof Error ? err.message : "Unknown error"
+      };
+    }
+  });
+  electron.ipcMain.handle(Channels.OPENROUTER_CANCEL_AUTH, (event) => {
+    assertTrustedIpcSender(event);
+    cancelOpenRouterOAuth();
+    return { ok: true };
+  });
+}
 const SUPPORT_API = process.env.VESSEL_SUPPORT_API || process.env.VESSEL_PREMIUM_API || "https://vesselpremium.quantaintellect.com";
 const MAX_FEEDBACK_MESSAGE_LENGTH = 5e3;
 const FEEDBACK_REQUEST_TIMEOUT_MS = 15e3;
@@ -28250,6 +28388,26 @@ function registerIpcHandlers(windowState, runtime2) {
     const count = await getActiveHighlightCountSafe();
     sendToRendererViews(Channels.HIGHLIGHT_COUNT_UPDATE, count);
   };
+  const applySettingChange = async (key2, value) => {
+    const updatedSettings = setSetting(key2, value);
+    trackSettingChanged(key2);
+    if (key2 === "approvalMode") {
+      runtime2.setApprovalMode(value);
+    }
+    if (key2 === "mcpPort") {
+      await stopMcpServer();
+      await startMcpServer(tabManager, runtime2, updatedSettings.mcpPort);
+    }
+    if (key2 === "chatProvider" && researchOrchestrator) {
+      try {
+        researchOrchestrator.setProvider(createProvider(value));
+      } catch {
+      }
+    }
+    const rendererSettings = getRendererSettings();
+    sendToRendererViews(Channels.SETTINGS_UPDATE, rendererSettings);
+    return rendererSettings;
+  };
   runtime2.setUpdateListener((state2) => {
     scheduleRuntimeUpdate(state2);
   });
@@ -28600,24 +28758,7 @@ function registerIpcHandlers(windowState, runtime2) {
       throw new Error(`Unknown setting key: ${key2}`);
     }
     const settingsKey = key2;
-    const updatedSettings = setSetting(settingsKey, value);
-    trackSettingChanged(key2);
-    if (key2 === "approvalMode") {
-      runtime2.setApprovalMode(value);
-    }
-    if (key2 === "mcpPort") {
-      await stopMcpServer();
-      await startMcpServer(tabManager, runtime2, updatedSettings.mcpPort);
-    }
-    if (key2 === "chatProvider" && researchOrchestrator) {
-      try {
-        researchOrchestrator.setProvider(createProvider(value));
-      } catch {
-      }
-    }
-    const rendererSettings = getRendererSettings();
-    sendToRendererViews(Channels.SETTINGS_UPDATE, rendererSettings);
-    return rendererSettings;
+    return applySettingChange(settingsKey, value);
   });
   electron.ipcMain.handle(Channels.AGENT_RUNTIME_GET, (event) => {
     requireTrusted(event);
@@ -28806,6 +28947,7 @@ function registerIpcHandlers(windowState, runtime2) {
   registerHumanVaultHandlers();
   registerWindowControlHandlers(mainWindow);
   registerCodexHandlers();
+  registerOpenRouterHandlers(applySettingChange);
   electron.ipcMain.handle(Channels.AUTOMATION_GET_INSTALLED, (event) => {
     requireTrusted(event);
     return getInstalledKits();