@spinabot/brigade 1.2.2 → 1.3.0

package/dist/core/auth-bridge.js

@@ -52,51 +52,101 @@ function readBrigadeCredentials(agentId) {
         // Fall through to env-backed bootstrap.
     }
     for (const profile of Object.values(parsed.profiles ?? {})) {
-        if (!profile?.provider || profile.type !== "api_key")
+        if (!profile?.provider)
             continue;
-        const resolvedKey = resolveProfileKey(profile);
-        if (!resolvedKey)
+        if (out[profile.provider] !== undefined)
+            continue; // first-wins per provider
+        // Subscription credentials (OAuth login / setup-token) pass straight
+        // through — Pi's AuthStorage handles {type:"oauth"} (auto-refresh) and
+        // detects an `sk-ant-oat…` token to switch to Bearer auth.
+        if (profile.type === "oauth" || profile.type === "token") {
+            const cred = subscriptionProfileToCredential(profile);
+            if (cred)
+                out[profile.provider] = cred;
             continue;
-        // First-wins per provider — matches Primitive #1's no-cooldown path.
-        if (out[profile.provider] === undefined) {
-            out[profile.provider] = { type: "api_key", key: resolvedKey };
         }
+        if (profile.type !== "api_key")
+            continue;
+        const resolvedKey = resolveProfileKey(profile);
+        if (resolvedKey)
+            out[profile.provider] = { type: "api_key", key: resolvedKey };
     }
-    // Env-backed bootstrap. If a user has ANTHROPIC_API_KEY (etc) exported
-    // in their shell but never ran `brigade onboard`, Pi's registry would
-    // hide the provider unless we surface that key here. Profile-stored keys
-    // take precedence — env is only consulted when a provider has no profile
-    // entry.
+    // Env-backed bootstrap. If a user has ANTHROPIC_API_KEY (or the OAuth-token
+    // fallback ANTHROPIC_OAUTH_TOKEN) exported but never ran `brigade onboard`,
+    // surface it so Pi's registry exposes the provider. Profile-stored creds
+    // take precedence — env is only consulted when a provider has no profile.
     for (const provider of PROVIDERS) {
-        if (!provider.envVar || provider.noAuth)
+        if (provider.noAuth)
             continue;
         if (out[provider.id] !== undefined)
             continue;
-        const apiKey = process.env[provider.envVar];
-        if (!apiKey)
-            continue;
-        out[provider.id] = { type: "api_key", key: apiKey };
+        const envNames = [provider.envVar, ...(provider.envVarFallbacks ?? [])];
+        for (const name of envNames) {
+            if (!name)
+                continue;
+            const value = process.env[name];
+            if (!value)
+                continue;
+            out[provider.id] = { type: "api_key", key: value };
+            break;
+        }
     }
     return out;
 }
-function resolveProfileKey(profile) {
-    if (profile.key && profile.key.length > 0)
-        return profile.key;
-    const ref = profile.keyRef;
+// Resolve a literal-or-ref secret value (key / access / refresh / token).
+// String refs are the legacy `${ENV_VAR}` form; object refs (BrigadeSecretRef)
+// resolve only env source synchronously — file/exec backends are out of scope
+// for the bridge's sync build.
+function resolveRefValue(value, ref) {
+    if (value && value.length > 0)
+        return value;
     if (!ref)
         return "";
-    // String form (legacy): `${ENV_VAR}` literal. Matches the regex agent-loop
-    // uses for the same shape.
     if (typeof ref === "string") {
         const m = /^\$\{([A-Z_][A-Z0-9_]*)\}$/.exec(ref);
         if (m && m[1])
             return process.env[m[1]] ?? "";
         return ref;
     }
-    // BrigadeSecretRef object form: only env-source is resolvable synchronously.
-    if (ref.source === "env" && ref.id) {
+    if (ref.source === "env" && ref.id)
         return process.env[ref.id] ?? "";
-    }
     return "";
 }
+function resolveProfileKey(profile) {
+    return resolveRefValue(profile.key, profile.keyRef);
+}
+// Map an OAuth-login / setup-token profile to a Pi credential. OAuth →
+// {type:"oauth", access, refresh, expires} (Pi auto-refreshes); token →
+// {type:"api_key", key} so Pi's value-based `sk-ant-oat` Bearer detection
+// fires. Returns null when no secret resolves.
+function subscriptionProfileToCredential(profile) {
+    if (profile.type === "oauth") {
+        const access = resolveRefValue(profile.access, profile.accessRef);
+        if (!access)
+            return null;
+        const refresh = resolveRefValue(profile.refresh, profile.refreshRef);
+        // A durable oauth profile CAN lack `expires` (the Claude/Codex CLI-login
+        // path). Coerce a missing/garbage value to 0 so Pi treats the access token
+        // as expired and refreshes via the refresh token immediately. Spread
+        // `metadata` FIRST so the known oauth fields always win — it carries the
+        // extras (Copilot enterprise refresh + availableModelIds) Pi needs.
+        const expires = typeof profile.expires === "number" && Number.isFinite(profile.expires)
+            ? profile.expires
+            : 0;
+        return {
+            ...(profile.metadata && typeof profile.metadata === "object" ? profile.metadata : {}),
+            type: "oauth",
+            access,
+            refresh: refresh || undefined,
+            expires,
+        };
+    }
+    if (profile.type === "token") {
+        const token = resolveRefValue(profile.token, profile.tokenRef);
+        if (!token)
+            return null;
+        return { type: "api_key", key: token };
+    }
+    return null;
+}
 //# sourceMappingURL=auth-bridge.js.map

package/dist/core/auth-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-bridge.js","sourceRoot":"","sources":["../../src/core/auth-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAkBnD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,gBAAgB;IACvE,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAGf,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,WAAW,CAAC;YACzB,QAAQ,CAAI,MAAyD;gBACnE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2CAA2C;IAC3C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAgC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QAC/D,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,qEAAqE;QACrE,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,SAAS;IACT,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;YAAE,SAAS;QAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,SAAS;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoB;IAC7C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,2EAA2E;IAC3E,2BAA2B;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,6EAA6E;IAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"auth-bridge.js","sourceRoot":"","sources":["../../src/core/auth-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA8BnD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,gBAAgB;IACvE,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAGf,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,WAAW,CAAC;YACzB,QAAQ,CAAI,MAAyD;gBACnE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,OAAO,MAAM,CAAC;YAChB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,2CAA2C;IAC3C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAgC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,OAAO,EAAE,QAAQ;YAAE,SAAS;QACjC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,0BAA0B;QAC7E,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,IAAI;gBAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACzC,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,WAAW;YAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM;YAAE,SAAS;QAC9B,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,SAAS;QAC7C,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACnD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,+BAA+B;AAC/B,SAAS,eAAe,CACtB,KAAyB,EACzB,GAA6E;IAE7E,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoB;IAC7C,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,+CAA+C;AAC/C,SAAS,+BAA+B,CAAC,OAAoB;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;YACrE,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,CAAC,CAAC;QACR,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/integrations/cli-login.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Reuse an already-logged-in CLI's stored credential.
+ *
+ * Brigade can adopt the token that a vendor's own CLI already minted on this
+ * machine — so an operator who has logged into Claude Code or Codex can connect
+ * Brigade with no browser flow and no API key. We read the CLI's on-disk
+ * credential file directly (file-based only for v1) and hand it back in a normalized
+ * shape the onboarding flow persists via the standard profile helpers.
+ *
+ * Everything here is DEFENSIVE: any missing file, parse failure, or malformed
+ * shape returns `null`. We never throw — a failed read just means "no CLI login
+ * present" and onboarding falls through to the key / fresh-login path.
+ *
+ * // TODO: macOS keychain (Claude Code-credentials / Codex Auth) — file-based only for v1.
+ */
+/** Normalized credential returned by a CLI-login reader. */
+export type CliLogin = {
+    provider: string;
+    type: "oauth";
+    access: string;
+    refresh: string;
+    expires?: number;
+    accountId?: string;
+} | {
+    provider: string;
+    type: "token";
+    token: string;
+    expires?: number;
+};
+/**
+ * Read Claude Code's stored login from `~/.claude/.credentials.json`.
+ *
+ * Shape: `{ claudeAiOauth: { accessToken, refreshToken, expiresAt } }`.
+ * When a refresh token is present we return an `oauth` credential (Pi can
+ * refresh it); otherwise a `token` credential carrying just the access token.
+ * Returns `null` on any missing file / parse error / absent access token.
+ */
+export declare function readClaudeCliLogin(): CliLogin | null;
+/**
+ * Read Codex's stored login from `${CODEX_HOME || ~/.codex}/auth.json`.
+ *
+ * Shape: `{ tokens: { access_token, refresh_token, account_id } }`. Codex
+ * doesn't store an explicit expiry, so we decode the `exp` claim from the
+ * access token JWT (×1000 → epoch-ms). If decoding fails we fall back to the
+ * file's mtime + 1 hour — a conservative TTL that triggers a refresh sooner
+ * rather than later. Returns `null` on any missing file / parse error / absent
+ * access token.
+ */
+export declare function readCodexCliLogin(): CliLogin | null;
+//# sourceMappingURL=cli-login.d.ts.map

package/dist/integrations/cli-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-login.d.ts","sourceRoot":"","sources":["../../src/integrations/cli-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,4DAA4D;AAC5D,MAAM,MAAM,QAAQ,GACjB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1G;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,QAAQ,GAAG,IAAI,CAmBpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,QAAQ,GAAG,IAAI,CAkCnD"}

package/dist/integrations/cli-login.js

@@ -0,0 +1,114 @@
+/**
+ * Reuse an already-logged-in CLI's stored credential.
+ *
+ * Brigade can adopt the token that a vendor's own CLI already minted on this
+ * machine — so an operator who has logged into Claude Code or Codex can connect
+ * Brigade with no browser flow and no API key. We read the CLI's on-disk
+ * credential file directly (file-based only for v1) and hand it back in a normalized
+ * shape the onboarding flow persists via the standard profile helpers.
+ *
+ * Everything here is DEFENSIVE: any missing file, parse failure, or malformed
+ * shape returns `null`. We never throw — a failed read just means "no CLI login
+ * present" and onboarding falls through to the key / fresh-login path.
+ *
+ * // TODO: macOS keychain (Claude Code-credentials / Codex Auth) — file-based only for v1.
+ */
+import * as fs from "node:fs";
+import { homedir } from "node:os";
+import * as path from "node:path";
+/**
+ * Read Claude Code's stored login from `~/.claude/.credentials.json`.
+ *
+ * Shape: `{ claudeAiOauth: { accessToken, refreshToken, expiresAt } }`.
+ * When a refresh token is present we return an `oauth` credential (Pi can
+ * refresh it); otherwise a `token` credential carrying just the access token.
+ * Returns `null` on any missing file / parse error / absent access token.
+ */
+export function readClaudeCliLogin() {
+    try {
+        const credPath = path.join(homedir(), ".claude", ".credentials.json");
+        if (!fs.existsSync(credPath))
+            return null;
+        const parsed = JSON.parse(fs.readFileSync(credPath, "utf8"));
+        const oauth = parsed.claudeAiOauth;
+        const access = oauth?.accessToken;
+        if (!access)
+            return null;
+        const refresh = oauth?.refreshToken;
+        const expires = oauth?.expiresAt;
+        if (refresh) {
+            return { provider: "anthropic", type: "oauth", access, refresh, expires };
+        }
+        return { provider: "anthropic", type: "token", token: access, expires };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read Codex's stored login from `${CODEX_HOME || ~/.codex}/auth.json`.
+ *
+ * Shape: `{ tokens: { access_token, refresh_token, account_id } }`. Codex
+ * doesn't store an explicit expiry, so we decode the `exp` claim from the
+ * access token JWT (×1000 → epoch-ms). If decoding fails we fall back to the
+ * file's mtime + 1 hour — a conservative TTL that triggers a refresh sooner
+ * rather than later. Returns `null` on any missing file / parse error / absent
+ * access token.
+ */
+export function readCodexCliLogin() {
+    try {
+        const codexHome = process.env.CODEX_HOME || path.join(homedir(), ".codex");
+        const authPath = path.join(codexHome, "auth.json");
+        if (!fs.existsSync(authPath))
+            return null;
+        const parsed = JSON.parse(fs.readFileSync(authPath, "utf8"));
+        const tokens = parsed.tokens;
+        const access = tokens?.access_token;
+        const refresh = tokens?.refresh_token;
+        if (!access || !refresh)
+            return null;
+        let expires = decodeJwtExp(access);
+        if (expires === undefined) {
+            try {
+                expires = fs.statSync(authPath).mtimeMs + 3600_000;
+            }
+            catch {
+                /* mtime unavailable — leave expires undefined */
+            }
+        }
+        const accountId = tokens?.account_id;
+        return {
+            provider: "openai-codex",
+            type: "oauth",
+            access,
+            refresh,
+            expires,
+            ...(accountId ? { accountId } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decode the `exp` claim (seconds) of a JWT and return it as epoch-ms, or
+ * `undefined` if the token isn't a parseable three-part JWT with a numeric
+ * `exp`. Base64url-decodes the middle (payload) segment.
+ */
+function decodeJwtExp(jwt) {
+    try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3)
+            return undefined;
+        const payloadJson = Buffer.from(parts[1], "base64url").toString("utf8");
+        const payload = JSON.parse(payloadJson);
+        if (typeof payload.exp === "number" && Number.isFinite(payload.exp)) {
+            return payload.exp * 1000;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=cli-login.js.map

package/dist/integrations/cli-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-login.js","sourceRoot":"","sources":["../../src/integrations/cli-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAOlC;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IACjC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,EAAE,YAAY,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,EAAE,SAAS,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAChC,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAE1D,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,YAAY,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,EAAE,aAAa,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAErC,IAAI,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACJ,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACR,iDAAiD;YAClD,CAAC;QACF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,CAAC;QACrC,OAAO;YACN,QAAQ,EAAE,cAAc;YACxB,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO;YACP,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAChC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAqB,CAAC;QAC5D,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACrE,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC"}

package/dist/integrations/custom-provider.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Custom (catalog-defined) provider registration.
+ *
+ * Some providers ship a key + a known Anthropic-compatible (or OpenAI-
+ * compatible) endpoint we already know from the catalog — GLM, Kimi, Qwen,
+ * MiniMax, DeepSeek. Pi-AI doesn't bundle these as built-in providers, so we
+ * register them dynamically via the `~/.brigade/models.json` mechanism, the
+ * same way Ollama is registered. Each catalog model id becomes a Pi model
+ * routed through the provider's `baseUrl` + `api`.
+ *
+ * We MERGE rather than overwrite — the user (or other providers) may have
+ * existing entries in the file we shouldn't clobber.
+ */
+export declare function writeCustomProviderToModelsJson(modelsJsonPath: string, p: {
+    id: string;
+    baseUrl: string;
+    api: "openai-completions" | "anthropic-messages";
+    apiKey: string;
+    models: string[];
+}): Promise<void>;
+//# sourceMappingURL=custom-provider.d.ts.map

package/dist/integrations/custom-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider.d.ts","sourceRoot":"","sources":["../../src/integrations/custom-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,wBAAsB,+BAA+B,CACpD,cAAc,EAAE,MAAM,EACtB,CAAC,EAAE;IACF,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB,GACC,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/integrations/custom-provider.js

@@ -0,0 +1,65 @@
+/**
+ * Custom (catalog-defined) provider registration.
+ *
+ * Some providers ship a key + a known Anthropic-compatible (or OpenAI-
+ * compatible) endpoint we already know from the catalog — GLM, Kimi, Qwen,
+ * MiniMax, DeepSeek. Pi-AI doesn't bundle these as built-in providers, so we
+ * register them dynamically via the `~/.brigade/models.json` mechanism, the
+ * same way Ollama is registered. Each catalog model id becomes a Pi model
+ * routed through the provider's `baseUrl` + `api`.
+ *
+ * We MERGE rather than overwrite — the user (or other providers) may have
+ * existing entries in the file we shouldn't clobber.
+ */
+import * as fs from "node:fs/promises";
+import path from "node:path";
+import { tryGetRuntimeContext } from "../storage/runtime-context.js";
+export async function writeCustomProviderToModelsJson(modelsJsonPath, p) {
+    let existing = { providers: {} };
+    try {
+        const raw = await fs.readFile(modelsJsonPath, "utf8");
+        existing = JSON.parse(raw);
+        if (!existing.providers)
+            existing.providers = {};
+    }
+    catch {
+        // File missing or unparseable — start fresh. Pi treats an absent file as no config.
+    }
+    existing.providers[p.id] = {
+        baseUrl: p.baseUrl,
+        api: p.api,
+        apiKey: p.apiKey,
+        models: p.models.map((id) => ({ id, name: id })),
+    };
+    // In convex mode resolveModelsPath routes to the OS cache dir, which may
+    // not exist yet on a fresh machine — a bare write would ENOENT. Filesystem
+    // mode: ~/.brigade always exists by this point, so the mkdir is a no-op.
+    await fs.mkdir(path.dirname(modelsJsonPath), { recursive: true });
+    await fs.writeFile(modelsJsonPath, JSON.stringify(existing, null, 2), "utf8");
+    // The coding-plan apiKey is written PLAINTEXT into models.json. Lock the
+    // file down to owner-only on POSIX so a shared-host neighbour can't read the
+    // key (mirrors the `chmodIfPosix` pattern in src/auth/profiles.ts). No-op on
+    // Windows (NTFS perms model differs) and best-effort on filesystems that
+    // don't support chmod (e.g. mounted FAT32).
+    if (process.platform !== "win32") {
+        try {
+            await fs.chmod(modelsJsonPath, 0o600);
+        }
+        catch {
+            // Filesystem may not support chmod — non-fatal.
+        }
+    }
+    // Convex mode — the file just written lives in the OS cache (resolveModelsPath
+    // routed it there) and is a regenerable mirror; the durable copy is the
+    // sealed "models" blob. Push it so a fresh machine re-materialises the
+    // catalog at boot.
+    const rctx = tryGetRuntimeContext();
+    if (rctx?.mode === "convex") {
+        await rctx.store.auth
+            .writeAuthFileBlob("main", "models", existing)
+            .catch((err) => {
+            console.error(`brigade: models catalog write to convex failed — ${err.message}`);
+        });
+    }
+}
+//# sourceMappingURL=custom-provider.js.map

package/dist/integrations/custom-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider.js","sourceRoot":"","sources":["../../src/integrations/custom-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,cAAsB,EACtB,CAMC;IAED,IAAI,QAAQ,GAAwC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACtE,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACtD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,oFAAoF;IACrF,CAAC;IAED,QAAQ,CAAC,SAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;QAC3B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;KAChD,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAE9E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4CAA4C;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC;YACJ,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,gDAAgD;QACjD,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,uEAAuE;IACvE,mBAAmB;IACnB,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI;aACnB,iBAAiB,CAAC,MAAM,EAAE,QAAiB,EAAE,QAAmC,CAAC;aACjF,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;YACrB,OAAO,CAAC,KAAK,CAAC,oDAAoD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;AACF,CAAC"}

package/dist/integrations/provider-discovery.d.ts

@@ -63,4 +63,34 @@ export interface LiveCloudModel {
  * never throws. Pricing → `cost.input` is per-Mtok (OpenRouter quotes per-token).
  */
 export declare function listOpenRouterModels(): Promise<LiveCloudModel[]>;
+/** Last-fetched live models for a subscription provider, or `undefined` if never fetched. */
+export declare function getCachedSubscriptionModels(providerId: string): LiveCloudModel[] | undefined;
+/**
+ * GitHub Copilot's per-account model catalog. The token embeds the proxy host
+ * (`proxy-ep=…`) which `getGitHubCopilotBaseUrl` rewrites to the api host; we GET
+ * `${baseUrl}/models` with Copilot's required editor headers (a plain
+ * Authorization isn't enough — the endpoint 400s without the editor/integration
+ * headers). Keeps only models the account can actually pick (model_picker_enabled,
+ * policy not disabled, tool_calls not explicitly off). Never throws — returns the
+ * last good cache or `[]` so the caller falls back to Pi's bundled catalog.
+ */
+export declare function fetchGitHubCopilotModels(copilotToken: string): Promise<LiveCloudModel[]>;
+/**
+ * Models a Claude Pro/Max SUBSCRIPTION can use. There is NO live per-account
+ * models endpoint for a subscription OAuth token: Anthropic scopes that token to
+ * inference only, so `GET /v1/models` returns 401/403 (verified). Instead we
+ * surface Pi's bundled Anthropic catalog — it IS the current Claude model family
+ * and updates as Pi ships new models — so the picker is always populated and
+ * current with ZERO network round-trip (no guaranteed-fail request, no timeout)
+ * on every sign-in. (GitHub Copilot DOES expose a live per-account list, so that
+ * path stays a real fetch; Anthropic subscriptions simply don't have one.)
+ */
+export declare function fetchAnthropicSubscriptionModels(): LiveCloudModel[];
+/**
+ * Warm the live cache for a subscription provider right after OAuth login so the
+ * model picker has the account's CURRENT models ready. Best-effort: any failure is
+ * swallowed (login must never block on this). `codex` has no live list endpoint —
+ * it falls through to Pi's bundled catalog, so this is a no-op for it.
+ */
+export declare function prefetchSubscriptionModels(providerId: string, oauthAccessToken: string): Promise<void>;
 //# sourceMappingURL=provider-discovery.d.ts.map

package/dist/integrations/provider-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-discovery.d.ts","sourceRoot":"","sources":["../../src/integrations/provider-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,mBAAmB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC/B,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAyED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF;AAKD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAsDtE"}
+{"version":3,"file":"provider-discovery.d.ts","sourceRoot":"","sources":["../../src/integrations/provider-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,MAAM,WAAW,mBAAmB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC/B,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAyED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF;AAKD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAsDtE;AAeD,6FAA6F;AAC7F,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,EAAE,GAAG,SAAS,CAG5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiE9F;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,IAAI,cAAc,EAAE,CA4BnE;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe5G"}

package/dist/integrations/provider-discovery.js

@@ -14,6 +14,7 @@
  * `integrations/ollama.ts` (native /api/tags); this module is for cloud +
  * OpenAI-compatible HTTP endpoints.
  */
+import { getModels } from "@earendil-works/pi-ai";
 const TIMEOUT_MS = 5000;
 const EMPTY = { exists: false, meta: {} };
 /** OpenRouter's public model list — no key needed, rich metadata. */
@@ -163,4 +164,158 @@ export async function listOpenRouterModels() {
         return openRouterListCache?.models ?? [];
     }
 }
+/* ──────────────────────── subscription live catalogs ──────────────────────── */
+/**
+ * Live model catalogs for OAuth subscription providers (GitHub Copilot,
+ * Anthropic Claude Pro/Max). Same shape + degrade-to-cache contract as
+ * `listOpenRouterModels`, but keyed by providerId because there are several
+ * subscription providers (OpenRouter is a singleton). The onboarding picker
+ * reads the cache after login via `getCachedSubscriptionModels` and joins the
+ * static Pi catalog by id for richer metadata.
+ */
+const SUBSCRIPTION_MODELS_TTL_MS = 5 * 60_000;
+const subscriptionModelsCache = new Map();
+/** Last-fetched live models for a subscription provider, or `undefined` if never fetched. */
+export function getCachedSubscriptionModels(providerId) {
+    const e = subscriptionModelsCache.get(providerId);
+    return e ? e.models : undefined;
+}
+/**
+ * GitHub Copilot's per-account model catalog. The token embeds the proxy host
+ * (`proxy-ep=…`) which `getGitHubCopilotBaseUrl` rewrites to the api host; we GET
+ * `${baseUrl}/models` with Copilot's required editor headers (a plain
+ * Authorization isn't enough — the endpoint 400s without the editor/integration
+ * headers). Keeps only models the account can actually pick (model_picker_enabled,
+ * policy not disabled, tool_calls not explicitly off). Never throws — returns the
+ * last good cache or `[]` so the caller falls back to Pi's bundled catalog.
+ */
+export async function fetchGitHubCopilotModels(copilotToken) {
+    const now = Date.now();
+    const cached = subscriptionModelsCache.get("github-copilot");
+    if (cached && now - cached.at < SUBSCRIPTION_MODELS_TTL_MS) {
+        return cached.models;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+        const { getGitHubCopilotBaseUrl } = await import("@earendil-works/pi-ai/oauth");
+        const baseUrl = getGitHubCopilotBaseUrl(copilotToken);
+        const res = await fetch(`${baseUrl}/models`, {
+            signal: controller.signal,
+            headers: {
+                Accept: "application/json",
+                Authorization: `Bearer ${copilotToken}`,
+                "User-Agent": "GitHubCopilotChat/0.35.0",
+                "Editor-Version": "vscode/1.107.0",
+                "Editor-Plugin-Version": "copilot-chat/0.35.0",
+                "Copilot-Integration-Id": "vscode-chat",
+                "X-GitHub-Api-Version": "2026-06-01",
+            },
+        });
+        if (!res.ok)
+            return cached?.models ?? [];
+        const body = (await res.json());
+        const list = body?.data;
+        if (!Array.isArray(list))
+            return cached?.models ?? [];
+        const out = [];
+        for (const raw of list) {
+            const item = raw;
+            const id = typeof item.id === "string" ? item.id : undefined;
+            if (!id)
+                continue;
+            // Selectability gate (mirrors Pi's own `isSelectableCopilotModel`): only
+            // surface models the account is allowed to pick. Every access is guarded —
+            // the response is untyped.
+            const policy = item.policy;
+            const capabilities = item.capabilities;
+            const supports = capabilities?.supports;
+            if (item.model_picker_enabled !== true)
+                continue;
+            if (policy?.state === "disabled")
+                continue;
+            if (supports?.tool_calls === false)
+                continue;
+            const maxCtx = capabilities?.limits?.max_context_window_tokens;
+            const contextWindow = typeof maxCtx === "number" && maxCtx > 0 ? maxCtx : undefined;
+            const name = typeof item.name === "string" && item.name.length > 0 ? item.name : id;
+            const input = supports?.vision ? ["text", "image"] : ["text"];
+            out.push({
+                provider: "github-copilot",
+                id,
+                name,
+                ...(contextWindow !== undefined ? { contextWindow } : {}),
+                // Copilot's list doesn't flag reasoning here — leave false; the static
+                // catalog join in onboarding fills the richer fields when Pi knows it.
+                reasoning: false,
+                input,
+            });
+        }
+        subscriptionModelsCache.set("github-copilot", { at: now, models: out });
+        return out;
+    }
+    catch {
+        return cached?.models ?? [];
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Models a Claude Pro/Max SUBSCRIPTION can use. There is NO live per-account
+ * models endpoint for a subscription OAuth token: Anthropic scopes that token to
+ * inference only, so `GET /v1/models` returns 401/403 (verified). Instead we
+ * surface Pi's bundled Anthropic catalog — it IS the current Claude model family
+ * and updates as Pi ships new models — so the picker is always populated and
+ * current with ZERO network round-trip (no guaranteed-fail request, no timeout)
+ * on every sign-in. (GitHub Copilot DOES expose a live per-account list, so that
+ * path stays a real fetch; Anthropic subscriptions simply don't have one.)
+ */
+export function fetchAnthropicSubscriptionModels() {
+    const now = Date.now();
+    const cached = subscriptionModelsCache.get("anthropic");
+    if (cached && now - cached.at < SUBSCRIPTION_MODELS_TTL_MS) {
+        return cached.models;
+    }
+    let out = [];
+    try {
+        const catalog = getModels("anthropic");
+        out = catalog.map((m) => ({
+            provider: "anthropic",
+            id: m.id,
+            name: m.name ?? m.id,
+            contextWindow: m.contextWindow,
+            reasoning: m.reasoning ?? false,
+            input: m.input ?? ["text"],
+        }));
+    }
+    catch {
+        out = [];
+    }
+    subscriptionModelsCache.set("anthropic", { at: now, models: out });
+    return out;
+}
+/**
+ * Warm the live cache for a subscription provider right after OAuth login so the
+ * model picker has the account's CURRENT models ready. Best-effort: any failure is
+ * swallowed (login must never block on this). `codex` has no live list endpoint —
+ * it falls through to Pi's bundled catalog, so this is a no-op for it.
+ */
+export async function prefetchSubscriptionModels(providerId, oauthAccessToken) {
+    try {
+        if (providerId === "github-copilot") {
+            await fetchGitHubCopilotModels(oauthAccessToken);
+            return;
+        }
+        if (providerId === "anthropic") {
+            // No network — populates the cache from Pi's current Anthropic catalog.
+            fetchAnthropicSubscriptionModels();
+            return;
+        }
+        // Other subscription providers (codex) have no live endpoint — no-op.
+    }
+    catch {
+        // Best-effort warm-up — never blocks login; picker falls back to the catalog.
+    }
+}
 //# sourceMappingURL=provider-discovery.js.map