@visual-z/xeno 0.8.4 → 0.9.0

package/src/runtime/oauth.ts

@@ -1,853 +0,0 @@
-/**
- * Subscription OAuth: PKCE, authorization-code exchange, refresh, identity.
- *
- * Ported from pi (earendil-works/pi, MIT) — packages/ai/src/auth/oauth/pkce.ts
- * and packages/ai/src/auth/oauth/anthropic.ts / openai-codex.ts / github-copilot.ts.
- *
- * D18 is the one place this is NOT a port: Anthropic OAuth requests send
- * `Authorization: Bearer` and `anthropic-beta: oauth-2025-04-20`, identify as
- * `xeno/<version>`, and never as `claude-cli`. A subscription endpoint that
- * rejects an honest User-Agent is reported, not papered over.
- *
- * Tokens, refresh tokens and `code_verifier` stay out of errors and logs.
- * Failures name the HTTP status, never the body that might echo a secret.
- */
-
-import { createServer, type Server } from "node:http";
-import { pollDeviceCode } from "./oauth-device.ts";
-import { parseDeviceAuthorization, parseOAuthTokens } from "../core/oauth-fields.ts";
-import { XENO_VERSION } from "./version.ts";
-
-/**
- * Minutes subtracted from server expiry so a request issued at the edge
- * refreshes first. Copied from pi's Anthropic client; a zero margin fails
- * at the boundary, which is the request that most needed to succeed.
- */
-export const OAUTH_EXPIRY_MARGIN_MS = 5 * 60 * 1000;
-
-export const SUBSCRIPTION_NOTICE =
-  "This uses first-party client credentials. The terms-of-service risk is on your account, not this project.";
-
-export const SUBSCRIPTION_OPTIONS = [
-  { id: "claude-pro", provider: "anthropic", label: "Claude Pro/Max" },
-  { id: "codex", provider: "openai-codex", label: "ChatGPT Plus/Pro (Codex)" },
-  { id: "github-copilot", provider: "github-copilot", label: "GitHub Copilot" },
-  { id: "grok", provider: "xai-grok", label: "Grok (official account)" },
-] as const;
-
-export type SubscriptionId = (typeof SUBSCRIPTION_OPTIONS)[number]["id"];
-
-export interface OAuthCredential {
-  type: "oauth";
-  access: string;
-  refresh: string;
-  expires: number;
-  accountId?: string;
-  enterpriseUrl?: string;
-}
-
-export interface PkcePair {
-  verifier: string;
-  challenge: string;
-}
-
-/** Call signature only — `typeof fetch` also has `preconnect`, which a test spy does not. */
-export type OAuthFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-
-export type CallbackOutcome = { ok: true; code: string } | { ok: false; reason: string };
-
-export interface CallbackServer {
-  readonly host: string;
-  readonly port: number;
-  waitForCode(): Promise<CallbackOutcome>;
-  close(): Promise<void>;
-}
-
-export interface RefreshEffects {
-  fetch: OAuthFetch;
-  now: () => number;
-  signal?: AbortSignal;
-}
-
-export interface OAuthInteraction {
-  notify: (message: string) => void;
-  prompt: (message: string, signal: AbortSignal) => Promise<string>;
-  fetch: OAuthFetch;
-  signal: AbortSignal;
-  now?: () => number;
-  openBrowser?: (url: string) => void;
-}
-
-const decode = (s: string) => atob(s);
-// First-party client IDs, stored the same way pi stores them. They are not
-// credentials we were issued; the ToS risk is the user's. See the card.
-const ANTHROPIC_CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
-const COPILOT_CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
-const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-
-const ANTHROPIC_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-const ANTHROPIC_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
-export const ANTHROPIC_CALLBACK_PORT = 53692;
-export const ANTHROPIC_CALLBACK_PATH = "/callback";
-export const ANTHROPIC_REDIRECT_URI = `http://localhost:${ANTHROPIC_CALLBACK_PORT}${ANTHROPIC_CALLBACK_PATH}`;
-const ANTHROPIC_SCOPES =
-  "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-
-const OPENAI_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
-export const OPENAI_CALLBACK_PORT = 1455;
-export const OPENAI_CALLBACK_PATH = "/auth/callback";
-export const OPENAI_REDIRECT_URI = `http://localhost:${OPENAI_CALLBACK_PORT}${OPENAI_CALLBACK_PATH}`;
-const OPENAI_SCOPE = "openid profile email offline_access";
-const OPENAI_JWT_CLAIM = "https://api.openai.com/auth";
-
-// Official Grok Build config.rs / device_code.rs, verified 2026-10-07.
-// This is the public first-party client, with xeno attribution retained (D18).
-const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
-const GROK_AUTH_ORIGIN = "https://auth.x.ai";
-const GROK_TOKEN_URL = `${GROK_AUTH_ORIGIN}/oauth2/token`;
-// Only inference and refresh scopes: xeno does not store remote conversations/workspaces.
-const GROK_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-export const GROK_PROVIDER = "xai-grok";
-export const GROK_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
-/** Official HTTP timeout: issuer requests cannot keep a cancelled or expired grant hanging indefinitely. */
-const GROK_REQUEST_TIMEOUT_MS = 15_000;
-/**
- * The proxy's version gate reads only `x-grok-client-version`
- * (grok-build xai-grok-sampler/src/client.rs; agent/proxy_headers.rs: "required
- * by the proxy's version-gate check"); without it every inference is HTTP 426
- * "version (none) is outdated". It names the protocol revision xeno speaks,
- * not xeno's own version -- the User-Agent and client identifier still say
- * xeno (D18). Pinned, not fetched: a registry lookup would put a network
- * call in front of every session. 1.0.46 is what CLIProxyAPI and Cherry
- * Studio send (minimum 1.0.13 as of 2026-10-09; stable 1.0.50). When the
- * minimum passes it, 426 comes back and grokVersionHint() says so.
- */
-export const GROK_PROTOCOL_VERSION = "1.0.46";
-/** Shown when the proxy's version gate refuses a request. */
-export function grokVersionHint(status: number | undefined, provider: string): string | undefined {
-  return status === 426 && provider === GROK_PROVIDER
-    ? `the Grok proxy now requires a newer client protocol than xeno sends (${GROK_PROTOCOL_VERSION}); update xeno, or use the xai provider with XAI_API_KEY meanwhile`
-    : undefined;
-}
-
-async function grokPost(url: string, fields: Record<string, string>, effects: Pick<RefreshEffects, "fetch" | "signal">): Promise<{ status: number; json: unknown }> {
-  const timeout = AbortSignal.timeout(GROK_REQUEST_TIMEOUT_MS);
-  const signal = effects.signal ? AbortSignal.any([effects.signal, timeout]) : timeout;
-  try {
-    const response = await effects.fetch(url, { method: "POST", redirect: "error", signal,
-      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": `xeno/${XENO_VERSION}` },
-      body: new URLSearchParams(fields) });
-    let json: unknown;
-    try { json = await response.json(); } catch { json = undefined; }
-    return { status: response.status, json };
-  } catch {
-    // Network errors can include request details; never expose a credential-bearing body.
-    throw new Error(effects.signal?.aborted ? "Login cancelled" : "Grok authentication request failed");
-  }
-}
-
-export async function loginGrok(interaction: OAuthInteraction, sleep?: Parameters<typeof pollDeviceCode>[0]["sleep"]): Promise<OAuthCredential> {
-  const started = await grokPost(`${GROK_AUTH_ORIGIN}/oauth2/device/code`,
-    { client_id: GROK_CLIENT_ID, scope: GROK_SCOPE, referrer: "xeno" }, interaction);
-  if (started.status < 200 || started.status >= 300) throw new Error(`Grok device code request failed (HTTP ${started.status})`);
-  const device = parseDeviceAuthorization(started.json, [GROK_AUTH_ORIGIN, "https://accounts.x.ai"]);
-  if (!device) throw new Error("Grok device code response was incomplete or untrusted");
-  interaction.signal.throwIfAborted();
-  const url = device.verificationUriComplete ?? device.verificationUri;
-  interaction.notify(`Open ${url}\nand enter code: ${device.userCode}`);
-  tryOpen(url, interaction.openBrowser);
-  return pollDeviceCode<OAuthCredential>({
-    expiresInSeconds: device.expiresIn, waitBeforeFirstPoll: true, signal: interaction.signal,
-    ...(device.interval !== undefined ? { intervalSeconds: device.interval } : {}), ...(sleep ? { sleep } : {}),
-    poll: async () => {
-      const got = await grokPost(GROK_TOKEN_URL,
-        { client_id: GROK_CLIENT_ID, device_code: device.deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" }, interaction);
-      const body = asRecord(got.json);
-      // RFC 8628 errors use HTTP 400; they are polling states, never completed logins.
-      if (got.status === 400 && body?.["error"] === "authorization_pending") return { status: "pending" };
-      if (got.status === 400 && body?.["error"] === "slow_down") return { status: "slow_down" };
-      if (got.status < 200 || got.status >= 300) return { status: "failed", message: `Grok device login failed (HTTP ${got.status})` };
-      const fields = parseOAuthTokens(got.json);
-      if (!fields) return { status: "failed", message: "Grok token response was incomplete" };
-      interaction.signal.throwIfAborted();
-      return { status: "complete", value: { type: "oauth", access: fields.access, refresh: fields.refresh,
-        expires: expiryFromExpiresIn(fields.expiresIn, (interaction.now ?? Date.now)()) } };
-    },
-  });
-}
-
-async function refreshGrok(refresh: string, effects: RefreshEffects): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
-  try {
-    const got = await grokPost(GROK_TOKEN_URL, { client_id: GROK_CLIENT_ID, grant_type: "refresh_token", refresh_token: refresh }, effects);
-    if (effects.signal?.aborted) return { ok: false, reason: "Login cancelled" };
-    if (got.status < 200 || got.status >= 300) return { ok: false, reason: `HTTP ${got.status}` };
-    const fields = parseOAuthTokens(got.json, refresh);
-    if (!fields) return { ok: false, reason: "unexpected body" };
-    return { ok: true, credential: { type: "oauth", access: fields.access, refresh: fields.refresh,
-      expires: expiryFromExpiresIn(fields.expiresIn, effects.now()) } };
-  } catch { return { ok: false, reason: "Grok token refresh failed" }; }
-}
-
-export function isSubscriptionLogin(id: string): boolean {
-  return subscriptionById(id) !== undefined;
-}
-
-export function subscriptionById(id: string): (typeof SUBSCRIPTION_OPTIONS)[number] | undefined {
-  // Separate account providers accept their catalog identity too; anthropic still means an API key.
-  return SUBSCRIPTION_OPTIONS.find(o => o.id === id || (o.provider === id && o.provider !== "anthropic"));
-}
-
-export function expiryFromExpiresIn(expiresIn: number, now: number): number {
-  return now + expiresIn * 1000 - OAUTH_EXPIRY_MARGIN_MS;
-}
-
-function base64urlEncode(bytes: Uint8Array): string {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-
-/**
- * Generate PKCE code verifier and challenge.
- * Ported from pi (earendil-works/pi, MIT) — packages/ai/src/auth/oauth/pkce.ts
- */
-export async function generatePKCE(): Promise<PkcePair> {
-  const verifierBytes = new Uint8Array(32);
-  crypto.getRandomValues(verifierBytes);
-  const verifier = base64urlEncode(verifierBytes);
-  const data = new TextEncoder().encode(verifier);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const challenge = base64urlEncode(new Uint8Array(hashBuffer));
-  return { verifier, challenge };
-}
-
-/** Independent of the PKCE verifier so the verifier is never printed in the URL. */
-export function generateState(): string {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return base64urlEncode(bytes);
-}
-
-export function anthropicOAuthHeaders(): Record<string, string> {
-  return {
-    "user-agent": `xeno/${XENO_VERSION}`,
-    "anthropic-beta": "oauth-2025-04-20",
-  };
-}
-
-export async function dispatchAnthropicOAuthRequest(
-  accessToken: string,
-  opts: { fetch: OAuthFetch; url: string },
-): Promise<Response> {
-  return opts.fetch(opts.url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      ...anthropicOAuthHeaders(),
-    },
-  });
-}
-
-export function anthropicAuthorizeUrl(opts: { challenge: string; state: string }): string {
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: ANTHROPIC_CLIENT_ID,
-    response_type: "code",
-    redirect_uri: ANTHROPIC_REDIRECT_URI,
-    scope: ANTHROPIC_SCOPES,
-    code_challenge: opts.challenge,
-    code_challenge_method: "S256",
-    state: opts.state,
-  });
-  return `${ANTHROPIC_AUTHORIZE_URL}?${params.toString()}`;
-}
-
-export function openaiCodexAuthorizeUrl(opts: { challenge: string; state: string }): string {
-  const url = new URL(OPENAI_AUTHORIZE_URL);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", OPENAI_CODEX_CLIENT_ID);
-  url.searchParams.set("redirect_uri", OPENAI_REDIRECT_URI);
-  url.searchParams.set("scope", OPENAI_SCOPE);
-  url.searchParams.set("code_challenge", opts.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", opts.state);
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", "xeno");
-  return url.toString();
-}
-
-function htmlPage(title: string, body: string): string {
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>${title}</title></head><body><h1>${title}</h1><p>${body}</p></body></html>`;
-}
-
-export async function startCallbackServer(opts: {
-  expectedState: string;
-  host: string;
-  port: number;
-  path: string;
-}): Promise<CallbackServer> {
-  // Binding anything other than loopback would expose the authorization code
-  // to the local network. localhost is refused too: it can resolve to ::1
-  // and listen on every interface depending on the stack.
-  if (opts.host !== "127.0.0.1") {
-    throw new Error("OAuth callback must bind 127.0.0.1");
-  }
-
-  let settle: ((value: CallbackOutcome) => void) | undefined;
-  const waitForCodePromise = new Promise<CallbackOutcome>((resolve) => {
-    let settled = false;
-    settle = (value) => {
-      if (settled) return;
-      settled = true;
-      resolve(value);
-    };
-  });
-
-  const server: Server = createServer((req, res) => {
-    try {
-      const url = new URL(req.url ?? "", "http://127.0.0.1");
-      if (url.pathname !== opts.path) {
-        res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(htmlPage("Not found", "Callback route not found."));
-        return;
-      }
-      const error = url.searchParams.get("error");
-      if (error) {
-        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(htmlPage("Authentication failed", "The provider returned an error."));
-        return;
-      }
-      const state = url.searchParams.get("state");
-      const code = url.searchParams.get("code");
-      if (!code || !state) {
-        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(htmlPage("Authentication failed", "Missing code or state."));
-        return;
-      }
-      if (state !== opts.expectedState) {
-        // CSRF: any local process can POST here. Rejecting is the whole point
-        // of state. Do not settle waitForCode with this code.
-        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(htmlPage("Authentication failed", "State mismatch."));
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(htmlPage("Authentication successful", "You can close this window."));
-      settle?.({ ok: true, code });
-    } catch {
-      res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Internal error");
-    }
-  });
-
-  await new Promise<void>((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(opts.port, opts.host, () => resolve());
-  });
-
-  const addr = server.address();
-  if (addr === null || typeof addr === "string") {
-    server.close();
-    throw new Error("OAuth callback server has no address");
-  }
-
-  let closed = false;
-  const close = (): Promise<void> => {
-    if (closed) return Promise.resolve();
-    closed = true;
-    settle?.({ ok: false, reason: "cancelled" });
-    return new Promise((resolve) => {
-      server.close(() => resolve());
-    });
-  };
-
-  return {
-    host: opts.host,
-    port: addr.port,
-    waitForCode: () => waitForCodePromise,
-    close,
-  };
-}
-
-async function readJson(
-  fetchImpl: OAuthFetch,
-  url: string,
-  init: RequestInit,
-): Promise<{ ok: true; json: unknown } | { ok: false; status: number }> {
-  const response = await fetchImpl(url, init);
-  if (!response.ok) return { ok: false, status: response.status };
-  try {
-    return { ok: true, json: await response.json() };
-  } catch {
-    return { ok: false, status: response.status };
-  }
-}
-
-function asRecord(value: unknown): Record<string, unknown> | null {
-  return typeof value === "object" && value !== null ? (value as Record<string, unknown>) : null;
-}
-
-function tokenFields(json: unknown): { access: string; refresh: string; expiresIn: number } | null {
-  const rec = asRecord(json);
-  if (rec === null) return null;
-  const access = rec["access_token"];
-  const refresh = rec["refresh_token"];
-  const expiresIn = rec["expires_in"];
-  if (typeof access !== "string" || typeof refresh !== "string" || typeof expiresIn !== "number") {
-    return null;
-  }
-  return { access, refresh, expiresIn };
-}
-
-export async function exchangeAnthropicCode(opts: {
-  code: string;
-  state: string;
-  verifier: string;
-  redirectUri: string;
-  fetch: OAuthFetch;
-  signal?: AbortSignal;
-  now?: () => number;
-}): Promise<OAuthCredential> {
-  const init: RequestInit = {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      grant_type: "authorization_code",
-      client_id: ANTHROPIC_CLIENT_ID,
-      code: opts.code,
-      state: opts.state,
-      redirect_uri: opts.redirectUri,
-      code_verifier: opts.verifier,
-    }),
-  };
-  if (opts.signal !== undefined) init.signal = opts.signal;
-  const got = await readJson(opts.fetch, ANTHROPIC_TOKEN_URL, init);
-  if (!got.ok) throw new Error(`Anthropic token exchange failed (HTTP ${got.status})`);
-  const fields = tokenFields(got.json);
-  if (fields === null) throw new Error("Anthropic token exchange returned an unexpected body");
-  const now = opts.now ?? Date.now;
-  return {
-    type: "oauth",
-    access: fields.access,
-    refresh: fields.refresh,
-    expires: expiryFromExpiresIn(fields.expiresIn, now()),
-  };
-}
-
-async function refreshAnthropic(
-  refreshToken: string,
-  opts: RefreshEffects,
-): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
-  const init: RequestInit = {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      grant_type: "refresh_token",
-      client_id: ANTHROPIC_CLIENT_ID,
-      refresh_token: refreshToken,
-    }),
-  };
-  if (opts.signal !== undefined) init.signal = opts.signal;
-  const got = await readJson(opts.fetch, ANTHROPIC_TOKEN_URL, init);
-  if (!got.ok) return { ok: false, reason: `HTTP ${got.status}` };
-  const fields = tokenFields(got.json);
-  if (fields === null) return { ok: false, reason: "unexpected body" };
-  return {
-    ok: true,
-    credential: {
-      type: "oauth",
-      access: fields.access,
-      refresh: fields.refresh,
-      expires: expiryFromExpiresIn(fields.expiresIn, opts.now()),
-    },
-  };
-}
-
-export async function exchangeOpenAICode(opts: {
-  code: string;
-  verifier: string;
-  redirectUri: string;
-  fetch: OAuthFetch;
-  signal?: AbortSignal;
-  now?: () => number;
-}): Promise<OAuthCredential> {
-  const init: RequestInit = {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: OPENAI_CODEX_CLIENT_ID,
-      code: opts.code,
-      code_verifier: opts.verifier,
-      redirect_uri: opts.redirectUri,
-    }),
-  };
-  if (opts.signal !== undefined) init.signal = opts.signal;
-  const got = await readJson(opts.fetch, OPENAI_TOKEN_URL, init);
-  if (!got.ok) throw new Error(`OpenAI Codex token exchange failed (HTTP ${got.status})`);
-  const fields = tokenFields(got.json);
-  if (fields === null) throw new Error("OpenAI Codex token exchange returned an unexpected body");
-  return credentialsFromOpenAIToken(fields, opts.now ?? Date.now);
-}
-
-async function refreshOpenAI(
-  refreshToken: string,
-  opts: RefreshEffects,
-): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
-  const init: RequestInit = {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: OPENAI_CODEX_CLIENT_ID,
-    }),
-  };
-  if (opts.signal !== undefined) init.signal = opts.signal;
-  const got = await readJson(opts.fetch, OPENAI_TOKEN_URL, init);
-  if (!got.ok) return { ok: false, reason: `HTTP ${got.status}` };
-  const fields = tokenFields(got.json);
-  if (fields === null) return { ok: false, reason: "unexpected body" };
-  try {
-    return { ok: true, credential: credentialsFromOpenAIToken(fields, opts.now) };
-  } catch {
-    return { ok: false, reason: "token missing account id" };
-  }
-}
-
-function credentialsFromOpenAIToken(
-  fields: { access: string; refresh: string; expiresIn: number },
-  now: () => number,
-): OAuthCredential {
-  const accountId = accountIdFromJwt(fields.access);
-  const cred: OAuthCredential = {
-    type: "oauth",
-    access: fields.access,
-    refresh: fields.refresh,
-    expires: expiryFromExpiresIn(fields.expiresIn, now()),
-  };
-  if (accountId !== null) return { ...cred, accountId };
-  throw new Error("OpenAI Codex token missing account id");
-}
-
-function accountIdFromJwt(token: string): string | null {
-  try {
-    const parts = token.split(".");
-    const payload = parts[1];
-    if (parts.length !== 3 || payload === undefined) return null;
-    const json = JSON.parse(atob(payload)) as unknown;
-    const rec = asRecord(json);
-    const auth = rec === null ? null : asRecord(rec[OPENAI_JWT_CLAIM]);
-    const id = auth?.["chatgpt_account_id"];
-    return typeof id === "string" && id.length > 0 ? id : null;
-  } catch {
-    return null;
-  }
-}
-
-async function refreshCopilot(
-  githubToken: string,
-  opts: RefreshEffects,
-  enterpriseUrl?: string,
-): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
-  const domain = enterpriseUrl && enterpriseUrl.length > 0 ? enterpriseUrl : "github.com";
-  const url = `https://api.${domain}/copilot_internal/v2/token`;
-  const init: RequestInit = {
-    headers: {
-      Accept: "application/json",
-      Authorization: `Bearer ${githubToken}`,
-    },
-  };
-  if (opts.signal !== undefined) init.signal = opts.signal;
-  const got = await readJson(opts.fetch, url, init);
-  if (!got.ok) return { ok: false, reason: `HTTP ${got.status}` };
-  const rec = asRecord(got.json);
-  const token = rec?.["token"];
-  const expiresAt = rec?.["expires_at"];
-  if (typeof token !== "string" || typeof expiresAt !== "number") {
-    return { ok: false, reason: "unexpected body" };
-  }
-  const cred: OAuthCredential = {
-    type: "oauth",
-    access: token,
-    refresh: githubToken,
-    expires: expiresAt * 1000 - OAUTH_EXPIRY_MARGIN_MS,
-  };
-  if (enterpriseUrl !== undefined && enterpriseUrl.length > 0) {
-    return { ok: true, credential: { ...cred, enterpriseUrl } };
-  }
-  return { ok: true, credential: cred };
-}
-
-export async function refreshOAuthCredential(
-  provider: string,
-  credential: OAuthCredential,
-  opts: RefreshEffects,
-): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
-  switch (provider) {
-    case "anthropic":
-      return refreshAnthropic(credential.refresh, opts);
-    case "openai":
-    case "openai-codex":
-      return refreshOpenAI(credential.refresh, opts);
-    case "github-copilot":
-      return refreshCopilot(credential.refresh, opts, credential.enterpriseUrl);
-    case GROK_PROVIDER:
-      return refreshGrok(credential.refresh, opts);
-    default:
-      return { ok: false, reason: `no oauth refresh for ${provider}` };
-  }
-}
-
-export function parseAuthorizationInput(input: string): { code?: string; state?: string } {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    const parsed: { code?: string; state?: string } = {};
-    const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (code) parsed.code = code;
-    if (state) parsed.state = state;
-    return parsed;
-  } catch {
-    // not a URL
-  }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    const parsed: { code?: string; state?: string } = {};
-    if (code) parsed.code = code;
-    if (state) parsed.state = state;
-    return parsed;
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    const parsed: { code?: string; state?: string } = {};
-    const code = params.get("code");
-    const state = params.get("state");
-    if (code) parsed.code = code;
-    if (state) parsed.state = state;
-    return parsed;
-  }
-  return { code: value };
-}
-
-async function raceCode(
-  server: CallbackServer,
-  interaction: OAuthInteraction,
-  expectedState: string,
-): Promise<string> {
-  const manualAbort = new AbortController();
-  const onAbort = (): void => {
-    void server.close();
-  };
-  interaction.signal.addEventListener("abort", onAbort, { once: true });
-  if (interaction.signal.aborted) onAbort();
-  try {
-    const pastePromise = interaction
-      .prompt(
-        "Complete login in the browser, or paste the redirect URL here:",
-        manualAbort.signal,
-      )
-      .then((input) => ({ kind: "paste" as const, input }))
-      .catch((err: unknown) => ({ kind: "paste-error" as const, err }));
-    const callbackPromise = server.waitForCode().then((got) => ({ kind: "callback" as const, got }));
-    const first = await Promise.race([pastePromise, callbackPromise]);
-    if (first.kind === "callback" && first.got.ok) return first.got.code;
-    if (first.kind === "paste-error") {
-      throw first.err instanceof Error ? first.err : new Error("login cancelled");
-    }
-    if (first.kind === "paste") {
-      const parsed = parseAuthorizationInput(first.input);
-      if (parsed.state !== undefined && parsed.state !== expectedState) {
-        throw new Error("OAuth state mismatch");
-      }
-      if (!parsed.code) throw new Error("Missing authorization code");
-      return parsed.code;
-    }
-    // Callback settled without a code: wait for paste if it is still coming.
-    const paste = await pastePromise;
-    if (paste.kind === "paste-error") {
-      throw paste.err instanceof Error ? paste.err : new Error("login cancelled");
-    }
-    const parsed = parseAuthorizationInput(paste.input);
-    if (parsed.state !== undefined && parsed.state !== expectedState) {
-      throw new Error("OAuth state mismatch");
-    }
-    if (!parsed.code) throw new Error("Missing authorization code");
-    return parsed.code;
-  } finally {
-    interaction.signal.removeEventListener("abort", onAbort);
-    manualAbort.abort();
-    await server.close();
-  }
-}
-
-function tryOpen(url: string, openBrowser?: (url: string) => void): void {
-  if (openBrowser) {
-    openBrowser(url);
-    return;
-  }
-  try {
-    Bun.spawn(["open", url], { stdout: "ignore", stderr: "ignore", stdin: "ignore" });
-  } catch {
-    // Headless or remote: the printed URL is the fallback.
-  }
-}
-
-export async function loginAnthropic(interaction: OAuthInteraction): Promise<OAuthCredential> {
-  const pkce = await generatePKCE();
-  const state = generateState();
-  const url = anthropicAuthorizeUrl({ challenge: pkce.challenge, state });
-  const server = await startCallbackServer({
-    expectedState: state,
-    host: "127.0.0.1",
-    port: ANTHROPIC_CALLBACK_PORT,
-    path: ANTHROPIC_CALLBACK_PATH,
-  });
-  interaction.notify(url);
-  interaction.notify("If the browser is on another machine, paste the final redirect URL.");
-  tryOpen(url, interaction.openBrowser);
-  const code = await raceCode(server, interaction, state);
-  const exchange: Parameters<typeof exchangeAnthropicCode>[0] = {
-    code,
-    state,
-    verifier: pkce.verifier,
-    redirectUri: ANTHROPIC_REDIRECT_URI,
-    fetch: interaction.fetch,
-    signal: interaction.signal,
-  };
-  if (interaction.now !== undefined) exchange.now = interaction.now;
-  return exchangeAnthropicCode(exchange);
-}
-
-export async function loginOpenAICodex(interaction: OAuthInteraction): Promise<OAuthCredential> {
-  const pkce = await generatePKCE();
-  const state = generateState();
-  const url = openaiCodexAuthorizeUrl({ challenge: pkce.challenge, state });
-  const server = await startCallbackServer({
-    expectedState: state,
-    host: "127.0.0.1",
-    port: OPENAI_CALLBACK_PORT,
-    path: OPENAI_CALLBACK_PATH,
-  });
-  interaction.notify(url);
-  interaction.notify("If the browser is on another machine, paste the final redirect URL.");
-  tryOpen(url, interaction.openBrowser);
-  const code = await raceCode(server, interaction, state);
-  const exchange: Parameters<typeof exchangeOpenAICode>[0] = {
-    code,
-    verifier: pkce.verifier,
-    redirectUri: OPENAI_REDIRECT_URI,
-    fetch: interaction.fetch,
-    signal: interaction.signal,
-  };
-  if (interaction.now !== undefined) exchange.now = interaction.now;
-  return exchangeOpenAICode(exchange);
-}
-
-export async function loginGitHubCopilot(interaction: OAuthInteraction): Promise<OAuthCredential> {
-  const init: RequestInit = {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded",
-    },
-    body: new URLSearchParams({
-      client_id: COPILOT_CLIENT_ID,
-      scope: "read:user",
-    }),
-    signal: interaction.signal,
-  };
-  const started = await readJson(interaction.fetch, "https://github.com/login/device/code", init);
-  if (!started.ok) throw new Error(`GitHub device code request failed (HTTP ${started.status})`);
-  const rec = asRecord(started.json);
-  const deviceCode = rec?.["device_code"];
-  const userCode = rec?.["user_code"];
-  const verificationUri = rec?.["verification_uri"];
-  const interval = rec?.["interval"];
-  const expiresIn = rec?.["expires_in"];
-  if (
-    typeof deviceCode !== "string" ||
-    typeof userCode !== "string" ||
-    typeof verificationUri !== "string" ||
-    typeof expiresIn !== "number"
-  ) {
-    throw new Error("GitHub device code response was incomplete");
-  }
-  let parsedUri: URL;
-  try {
-    parsedUri = new URL(verificationUri);
-  } catch {
-    throw new Error("Untrusted verification_uri in device code response");
-  }
-  if (parsedUri.protocol !== "https:" && parsedUri.protocol !== "http:") {
-    throw new Error("Untrusted verification_uri in device code response");
-  }
-  interaction.notify(`Open ${parsedUri.href} and enter code: ${userCode}`);
-  const pollOpts: Parameters<typeof pollDeviceCode<string>>[0] = {
-    expiresInSeconds: expiresIn,
-    waitBeforeFirstPoll: true,
-    signal: interaction.signal,
-    poll: async () => {
-      const tokenInit: RequestInit = {
-        method: "POST",
-        headers: {
-          Accept: "application/json",
-          "Content-Type": "application/x-www-form-urlencoded",
-        },
-        body: new URLSearchParams({
-          client_id: COPILOT_CLIENT_ID,
-          device_code: deviceCode,
-          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        }),
-        signal: interaction.signal,
-      };
-      const raw = await readJson(interaction.fetch, "https://github.com/login/oauth/access_token", tokenInit);
-      if (!raw.ok) return { status: "failed", message: `GitHub device token failed (HTTP ${raw.status})` };
-      const body = asRecord(raw.json);
-      if (body !== null && typeof body["access_token"] === "string") {
-        return { status: "complete", value: body["access_token"] };
-      }
-      const err = body?.["error"];
-      if (err === "authorization_pending") return { status: "pending" };
-      if (err === "slow_down") {
-        const next = body?.["interval"];
-        return typeof next === "number" ? { status: "slow_down", intervalSeconds: next } : { status: "slow_down" };
-      }
-      if (typeof err === "string") return { status: "failed", message: `Device flow failed: ${err}` };
-      return { status: "failed", message: "Invalid device token response" };
-    },
-  };
-  if (typeof interval === "number") pollOpts.intervalSeconds = interval;
-  const githubToken = await pollDeviceCode(pollOpts);
-  const refreshed = await refreshCopilot(githubToken, {
-    fetch: interaction.fetch,
-    now: interaction.now ?? Date.now,
-    signal: interaction.signal,
-  });
-  if (!refreshed.ok) throw new Error(`GitHub Copilot token exchange failed (${refreshed.reason})`);
-  return refreshed.credential;
-}
-
-export async function loginSubscription(
-  id: SubscriptionId,
-  interaction: OAuthInteraction,
-): Promise<{ provider: string; credential: OAuthCredential }> {
-  switch (id) {
-    case "claude-pro":
-      return { provider: "anthropic", credential: await loginAnthropic(interaction) };
-    case "codex":
-      return { provider: "openai-codex", credential: await loginOpenAICodex(interaction) };
-    case "github-copilot":
-      return { provider: "github-copilot", credential: await loginGitHubCopilot(interaction) };
-    case "grok":
-      return { provider: GROK_PROVIDER, credential: await loginGrok(interaction) };
-    default: {
-      const never: never = id;
-      throw new Error(`unknown subscription login: ${String(never)}`);
-    }
-  }
-}