@within-7/minto 0.4.0 → 0.4.2

package/dist/services/mintoAuth.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/services/mintoAuth.ts"],
+  "sourcesContent": ["/**\n * Minto Login Service\n *\n * Single source of truth for the login domain:\n * - Login API call + Zod validation\n * - LiteLLM model discovery + deduplication\n * - Model auto-configuration via ModelManager\n * - Smart model pointer assignment\n *\n * Security: No account info stored locally. Only LiteLLM API key is persisted\n * via the credential store. Login state is inferred from credential presence.\n */\n\nimport { z } from 'zod'\nimport { MACRO } from '@constants/macros'\nimport { setApiKey, getApiKey, deleteApiKey } from '@utils/credentials/index'\nimport { getModelManager, reloadModelManager } from '@utils/model'\nimport type { ModelPointerType } from '@utils/configSchema'\nimport { t } from '@i18n'\nimport * as readline from 'readline'\n\n// \u2500\u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst MintoLoginResponseSchema = z.object({\n  user: z.string(),\n  profile: z.object({\n    userId: z.string(),\n    staff: z.string(),\n    email: z.string(),\n    permission: z.array(z.string()),\n    status: z.string(),\n  }),\n  model: z.object({\n    base_url: z.string(),\n    api_key: z.string(),\n    qwen_asr_api_key: z.string().optional(),\n  }),\n})\n\ntype MintoLoginResponse = z.infer<typeof MintoLoginResponseSchema>\n\nconst LiteLLMModelInfoSchema = z.object({\n  model_name: z.string(),\n  litellm_params: z.record(z.unknown()).optional().default({}),\n  model_info: z\n    .object({\n      id: z.string().optional(),\n      key: z.string().optional(),\n      max_tokens: z.number().optional(),\n      max_input_tokens: z.number().optional(),\n      max_output_tokens: z.number().optional(),\n      input_cost_per_token: z.number().optional(),\n      output_cost_per_token: z.number().optional(),\n      litellm_provider: z.string().optional(),\n      mode: z.string().optional(),\n    })\n    .optional()\n    .default({}),\n})\n\ntype LiteLLMModelInfo = z.infer<typeof LiteLLMModelInfoSchema>\n\nconst LiteLLMModelListResponseSchema = z.object({\n  data: z.array(LiteLLMModelInfoSchema),\n})\n\nexport interface LoginResult {\n  user: string\n  modelsConfigured: number\n  modelNames: string[]\n  aiterVoiceConfigured?: boolean\n}\n\n// \u2500\u2500\u2500 CREDENTIAL_KEY \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst LITELLM_CREDENTIAL_KEY = 'minto-litellm'\n\n// \u2500\u2500\u2500 Core API Functions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * POST login request to Minto auth API.\n * Returns parsed + validated response.\n */\nexport async function mintoLogin(\n  user: string,\n  password: string,\n): Promise<MintoLoginResponse> {\n  const url = MACRO.LOGIN_API_URL\n  const res = await fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({ user, password }),\n  })\n\n  if (res.status === 401 || res.status === 403) {\n    throw new Error(t('commands.login.invalidCredentials'))\n  }\n  if (!res.ok) {\n    throw new Error(\n      `${t('commands.login.failed')}: HTTP ${res.status} ${res.statusText}`,\n    )\n  }\n\n  const json = await res.json()\n  return MintoLoginResponseSchema.parse(json)\n}\n\n/**\n * Fetch available models from LiteLLM /model/info endpoint.\n */\nexport async function fetchLiteLLMModels(\n  baseUrl: string,\n  apiKey: string,\n): Promise<LiteLLMModelInfo[]> {\n  // Normalize base URL \u2014 strip trailing slash\n  const base = baseUrl.replace(/\\/+$/, '')\n  const url = `${base}/model/info`\n\n  const res = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!res.ok) {\n    throw new Error(\n      `${t('commands.login.fetchModelsFailed')}: HTTP ${res.status}`,\n    )\n  }\n\n  const json = await res.json()\n  const parsed = LiteLLMModelListResponseSchema.parse(json)\n  return parsed.data\n}\n\n/**\n * Deduplicate LiteLLM models by base model name.\n * Strips provider/ prefix (e.g., \"openai/gpt-4o\" \u2192 \"gpt-4o\").\n * Keeps the first occurrence per base name.\n */\nexport function deduplicateLiteLLMModels(\n  models: LiteLLMModelInfo[],\n): LiteLLMModelInfo[] {\n  const seen = new Map<string, LiteLLMModelInfo>()\n\n  for (const model of models) {\n    const baseName = getBaseModelName(model.model_name)\n    if (!seen.has(baseName)) {\n      seen.set(baseName, model)\n    }\n  }\n\n  return [...seen.values()]\n}\n\n/**\n * Strip provider prefix from model name.\n * \"openai/gpt-4o\" \u2192 \"gpt-4o\", \"claude-sonnet-4\" \u2192 \"claude-sonnet-4\"\n */\nfunction getBaseModelName(modelName: string): string {\n  const slashIdx = modelName.indexOf('/')\n  return slashIdx >= 0 ? modelName.slice(slashIdx + 1) : modelName\n}\n\n/**\n * Sort models by total cost (input + output cost per token), cheapest first.\n * Models without pricing info are treated as free (cost = 0).\n */\nexport function sortModelsByCost(\n  models: LiteLLMModelInfo[],\n): LiteLLMModelInfo[] {\n  return [...models].sort((a, b) => {\n    const costA =\n      (a.model_info?.input_cost_per_token ?? 0) +\n      (a.model_info?.output_cost_per_token ?? 0)\n    const costB =\n      (b.model_info?.input_cost_per_token ?? 0) +\n      (b.model_info?.output_cost_per_token ?? 0)\n    return costA - costB\n  })\n}\n\n/**\n * Heuristic model pointer assignment.\n * Matches model names to roles based on known patterns.\n * Main model prioritizes cost-effective models (glm-5, qwen-3.5-plus).\n */\nexport function assignModelPointers(\n  modelNames: string[],\n): Record<ModelPointerType, string> {\n  const find = (...patterns: string[]): string | null => {\n    for (const pattern of patterns) {\n      const match = modelNames.find(n =>\n        n.toLowerCase().includes(pattern.toLowerCase()),\n      )\n      if (match) return match\n    }\n    return null\n  }\n\n  const fallback = modelNames[0] ?? ''\n\n  const main =\n    find('glm-5', 'qwen-3.5-plus', 'claude-sonnet', 'gpt-4o') ?? fallback\n  const task = find('claude-sonnet', 'gpt-4o-mini', 'glm-5') ?? main\n  const reasoning = find('o3', 'o1', 'deepseek-r1') ?? main\n  const quick = find('gpt-4o-mini', 'claude-haiku', 'qwen-3.5-plus') ?? task\n  const compact = quick\n\n  return { main, task, reasoning, quick, compact }\n}\n\n// \u2500\u2500\u2500 AiTer Voice Input Configuration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Configure AiTer voice input when running in AiTer environment.\n * Uses `aiter settings set voiceInput` CLI command.\n */\nasync function configureAiterVoiceInput(\n  qwenAsrApiKey: string,\n): Promise<boolean> {\n  if (process.env.AITER_TERMINAL !== '1') return false\n\n  const { execFile } = await import('child_process')\n  const { promisify } = await import('util')\n  const execFileAsync = promisify(execFile)\n\n  const voiceInputConfig = JSON.stringify({\n    enabled: true,\n    provider: 'qwen-asr',\n    qwenApiKey: qwenAsrApiKey,\n    qwenRegion: 'cn',\n  })\n\n  try {\n    await execFileAsync('aiter', [\n      'settings',\n      'set',\n      'voiceInput',\n      voiceInputConfig,\n    ])\n    return true\n  } catch {\n    return false\n  }\n}\n\n// \u2500\u2500\u2500 Full Login Flow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Complete login flow:\n * 1. Authenticate via login API\n * 2. Verify account active\n * 3. Store API key securely\n * 4. Clear previously login-configured models (by baseURL match)\n * 5. Fetch + deduplicate LiteLLM models\n * 6. Add model profiles via ModelManager\n * 7. Assign model pointers\n */\nexport async function performLogin(\n  user: string,\n  password: string,\n  onProgress?: (phase: string) => void,\n): Promise<LoginResult> {\n  // Phase 1: Login\n  onProgress?.(t('commands.login.loggingIn'))\n  const loginResponse = await mintoLogin(user, password)\n\n  // Phase 2: Check account active\n  if (loginResponse.profile.status !== 'active') {\n    throw new Error(t('commands.login.inactive'))\n  }\n\n  // Phase 3: Store API key securely (not account info)\n  await setApiKey(LITELLM_CREDENTIAL_KEY, loginResponse.model.api_key)\n\n  // Phase 4: Clear previous login-configured models (baseURL match)\n  onProgress?.(t('commands.login.configuringModels'))\n  const mm = getModelManager()\n  const existingModels = mm.getAllConfiguredModels()\n  const loginBaseURL = loginResponse.model.base_url.replace(/\\/+$/, '')\n\n  for (const model of existingModels) {\n    if (model.baseURL && model.baseURL.replace(/\\/+$/, '') === loginBaseURL) {\n      mm.removeModel(model.modelName)\n    }\n  }\n\n  // Phase 5: Fetch models from LiteLLM\n  onProgress?.(t('commands.login.fetchingModels'))\n  let litellmModels: LiteLLMModelInfo[]\n  try {\n    litellmModels = await fetchLiteLLMModels(\n      loginResponse.model.base_url,\n      loginResponse.model.api_key,\n    )\n  } catch (err) {\n    // Partial success: logged in but model fetch failed\n    return {\n      user: loginResponse.user,\n      modelsConfigured: 0,\n      modelNames: [],\n    }\n  }\n\n  // Phase 6: Deduplicate, sort by cost (cheapest first), and add models\n  const deduplicated = sortModelsByCost(deduplicateLiteLLMModels(litellmModels))\n  const configuredNames: string[] = []\n\n  for (const model of deduplicated) {\n    const baseName = getBaseModelName(model.model_name)\n    const maxOutputTokens = model.model_info?.max_output_tokens ?? 4096\n    const maxInputTokens = model.model_info?.max_input_tokens ?? 128000\n\n    try {\n      await mm.addModel({\n        name: baseName,\n        provider: 'custom-openai',\n        modelName: baseName,\n        baseURL: loginBaseURL,\n        apiKey: `encrypted:${LITELLM_CREDENTIAL_KEY}`,\n        maxTokens: maxOutputTokens,\n        contextLength: maxInputTokens,\n      })\n      configuredNames.push(baseName)\n    } catch {\n      // Skip duplicate \u2014 defensive, shouldn't happen after cleanup\n    }\n  }\n\n  // Phase 7: Assign model pointers\n  if (configuredNames.length > 0) {\n    const pointers = assignModelPointers(configuredNames)\n    for (const [pointer, modelName] of Object.entries(pointers)) {\n      try {\n        mm.setPointer(pointer as ModelPointerType, modelName)\n      } catch {\n        // Skip if model not found (shouldn't happen)\n      }\n    }\n  }\n\n  reloadModelManager()\n\n  // Phase 8: Configure AiTer voice input if in AiTer environment\n  let aiterVoiceConfigured = false\n  if (loginResponse.model.qwen_asr_api_key) {\n    aiterVoiceConfigured = await configureAiterVoiceInput(\n      loginResponse.model.qwen_asr_api_key,\n    )\n  }\n\n  return {\n    user: loginResponse.user,\n    modelsConfigured: configuredNames.length,\n    modelNames: configuredNames,\n    aiterVoiceConfigured,\n  }\n}\n\n// \u2500\u2500\u2500 Login Status Check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Check if user is logged in (has stored LiteLLM credential).\n */\nexport async function isLoggedIn(): Promise<boolean> {\n  const key = await getApiKey(LITELLM_CREDENTIAL_KEY)\n  return key !== null\n}\n\n/**\n * Logout: remove stored credential.\n */\nexport async function logout(): Promise<void> {\n  await deleteApiKey(LITELLM_CREDENTIAL_KEY)\n}\n\n// \u2500\u2500\u2500 CLI Handler \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Handle `minto login` CLI command.\n * Uses readline for interactive input when user/password not provided.\n */\nexport async function handleLoginCLI(\n  user?: string,\n  password?: string,\n): Promise<void> {\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stdout,\n  })\n\n  const ask = (prompt: string): Promise<string> =>\n    new Promise(resolve => rl.question(prompt, resolve))\n\n  const askPassword = (prompt: string): Promise<string> =>\n    new Promise(resolve => {\n      // Mask password input\n      process.stdout.write(prompt)\n      const stdin = process.stdin\n      const wasRaw = stdin.isRaw\n      if (stdin.setRawMode) stdin.setRawMode(true)\n      stdin.resume()\n\n      let pwd = ''\n      const onData = (ch: Buffer) => {\n        const c = ch.toString('utf8')\n        if (c === '\\n' || c === '\\r') {\n          if (stdin.setRawMode) stdin.setRawMode(wasRaw ?? false)\n          stdin.removeListener('data', onData)\n          process.stdout.write('\\n')\n          resolve(pwd)\n        } else if (c === '\\u0003') {\n          // Ctrl-C\n          process.exit(1)\n        } else if (c === '\\u007f' || c === '\\b') {\n          // Backspace\n          if (pwd.length > 0) {\n            pwd = pwd.slice(0, -1)\n            process.stdout.write('\\b \\b')\n          }\n        } else {\n          pwd += c\n          process.stdout.write('*')\n        }\n      }\n      stdin.on('data', onData)\n    })\n\n  try {\n    if (!user) {\n      user = await ask('Username: ')\n    }\n    if (!password) {\n      password = await askPassword('Password: ')\n    }\n\n    rl.close()\n\n    console.log(`\\n${t('commands.login.loggingIn')}...`)\n\n    const result = await performLogin(user, password, phase => {\n      console.log(`  ${phase}...`)\n    })\n\n    console.log(`\\n\u2713 ${t('commands.login.success')}`)\n    console.log(`  User: ${result.user}`)\n    console.log(\n      `  ${t('commands.login.modelsConfigured')}: ${result.modelsConfigured}`,\n    )\n    if (result.modelNames.length > 0) {\n      console.log(`  Models: ${result.modelNames.join(', ')}`)\n    }\n    if (result.aiterVoiceConfigured) {\n      console.log(`  AiTer voice input: configured`)\n    }\n  } catch (err) {\n    rl.close()\n    console.error(\n      `\\n\u2717 ${t('commands.login.failed')}: ${err instanceof Error ? err.message : String(err)}`,\n    )\n    process.exit(1)\n  }\n}\n"],
+  "mappings": "AAaA,SAAS,SAAS;AAClB,SAAS,aAAa;AACtB,SAAS,WAAW,WAAW,oBAAoB;AACnD,SAAS,iBAAiB,0BAA0B;AAEpD,SAAS,SAAS;AAClB,YAAY,cAAc;AAI1B,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO;AAAA,IAChB,QAAQ,EAAE,OAAO;AAAA,IACjB,OAAO,EAAE,OAAO;AAAA,IAChB,OAAO,EAAE,OAAO;AAAA,IAChB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC9B,QAAQ,EAAE,OAAO;AAAA,EACnB,CAAC;AAAA,EACD,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,SAAS,EAAE,OAAO;AAAA,IAClB,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,CAAC;AACH,CAAC;AAID,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,YAAY,EAAE,OAAO;AAAA,EACrB,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3D,YAAY,EACT,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,IACxB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,IACtC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,IACvC,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1C,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,IACtC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,EACA,SAAS,EACT,QAAQ,CAAC,CAAC;AACf,CAAC;AAID,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,MAAM,sBAAsB;AACtC,CAAC;AAWD,MAAM,yBAAyB;AAQ/B,eAAsB,WACpB,MACA,UAC6B;AAC7B,QAAM,MAAM,MAAM;AAClB,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAAA,EACzC,CAAC;AAED,MAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,UAAM,IAAI,MAAM,EAAE,mCAAmC,CAAC;AAAA,EACxD;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,GAAG,EAAE,uBAAuB,CAAC,UAAU,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,SAAO,yBAAyB,MAAM,IAAI;AAC5C;AAKA,eAAsB,mBACpB,SACA,QAC6B;AAE7B,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AACvC,QAAM,MAAM,GAAG,IAAI;AAEnB,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,GAAG,EAAE,kCAAkC,CAAC,UAAU,IAAI,MAAM;AAAA,IAC9D;AAAA,EACF;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAM,SAAS,+BAA+B,MAAM,IAAI;AACxD,SAAO,OAAO;AAChB;AAOO,SAAS,yBACd,QACoB;AACpB,QAAM,OAAO,oBAAI,IAA8B;AAE/C,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,iBAAiB,MAAM,UAAU;AAClD,QAAI,CAAC,KAAK,IAAI,QAAQ,GAAG;AACvB,WAAK,IAAI,UAAU,KAAK;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAC1B;AAMA,SAAS,iBAAiB,WAA2B;AACnD,QAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,SAAO,YAAY,IAAI,UAAU,MAAM,WAAW,CAAC,IAAI;AACzD;AAMO,SAAS,iBACd,QACoB;AACpB,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAChC,UAAM,SACH,EAAE,YAAY,wBAAwB,MACtC,EAAE,YAAY,yBAAyB;AAC1C,UAAM,SACH,EAAE,YAAY,wBAAwB,MACtC,EAAE,YAAY,yBAAyB;AAC1C,WAAO,QAAQ;AAAA,EACjB,CAAC;AACH;AAOO,SAAS,oBACd,YACkC;AAClC,QAAM,OAAO,IAAI,aAAsC;AACrD,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,WAAW;AAAA,QAAK,OAC5B,EAAE,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MAChD;AACA,UAAI,MAAO,QAAO;AAAA,IACpB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,WAAW,CAAC,KAAK;AAElC,QAAM,OACJ,KAAK,SAAS,iBAAiB,iBAAiB,QAAQ,KAAK;AAC/D,QAAM,OAAO,KAAK,iBAAiB,eAAe,OAAO,KAAK;AAC9D,QAAM,YAAY,KAAK,MAAM,MAAM,aAAa,KAAK;AACrD,QAAM,QAAQ,KAAK,eAAe,gBAAgB,eAAe,KAAK;AACtE,QAAM,UAAU;AAEhB,SAAO,EAAE,MAAM,MAAM,WAAW,OAAO,QAAQ;AACjD;AAQA,eAAe,yBACb,eACkB;AAClB,MAAI,QAAQ,IAAI,mBAAmB,IAAK,QAAO;AAE/C,QAAM,EAAE,SAAS,IAAI,MAAM,OAAO,eAAe;AACjD,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,MAAM;AACzC,QAAM,gBAAgB,UAAU,QAAQ;AAExC,QAAM,mBAAmB,KAAK,UAAU;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,YAAY;AAAA,EACd,CAAC;AAED,MAAI;AACF,UAAM,cAAc,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAcA,eAAsB,aACpB,MACA,UACA,YACsB;AAEtB,eAAa,EAAE,0BAA0B,CAAC;AAC1C,QAAM,gBAAgB,MAAM,WAAW,MAAM,QAAQ;AAGrD,MAAI,cAAc,QAAQ,WAAW,UAAU;AAC7C,UAAM,IAAI,MAAM,EAAE,yBAAyB,CAAC;AAAA,EAC9C;AAGA,QAAM,UAAU,wBAAwB,cAAc,MAAM,OAAO;AAGnE,eAAa,EAAE,kCAAkC,CAAC;AAClD,QAAM,KAAK,gBAAgB;AAC3B,QAAM,iBAAiB,GAAG,uBAAuB;AACjD,QAAM,eAAe,cAAc,MAAM,SAAS,QAAQ,QAAQ,EAAE;AAEpE,aAAW,SAAS,gBAAgB;AAClC,QAAI,MAAM,WAAW,MAAM,QAAQ,QAAQ,QAAQ,EAAE,MAAM,cAAc;AACvE,SAAG,YAAY,MAAM,SAAS;AAAA,IAChC;AAAA,EACF;AAGA,eAAa,EAAE,+BAA+B,CAAC;AAC/C,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM;AAAA,MACpB,cAAc,MAAM;AAAA,MACpB,cAAc,MAAM;AAAA,IACtB;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO;AAAA,MACL,MAAM,cAAc;AAAA,MACpB,kBAAkB;AAAA,MAClB,YAAY,CAAC;AAAA,IACf;AAAA,EACF;AAGA,QAAM,eAAe,iBAAiB,yBAAyB,aAAa,CAAC;AAC7E,QAAM,kBAA4B,CAAC;AAEnC,aAAW,SAAS,cAAc;AAChC,UAAM,WAAW,iBAAiB,MAAM,UAAU;AAClD,UAAM,kBAAkB,MAAM,YAAY,qBAAqB;AAC/D,UAAM,iBAAiB,MAAM,YAAY,oBAAoB;AAE7D,QAAI;AACF,YAAM,GAAG,SAAS;AAAA,QAChB,MAAM;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,QAAQ,aAAa,sBAAsB;AAAA,QAC3C,WAAW;AAAA,QACX,eAAe;AAAA,MACjB,CAAC;AACD,sBAAgB,KAAK,QAAQ;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,WAAW,oBAAoB,eAAe;AACpD,eAAW,CAAC,SAAS,SAAS,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC3D,UAAI;AACF,WAAG,WAAW,SAA6B,SAAS;AAAA,MACtD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,qBAAmB;AAGnB,MAAI,uBAAuB;AAC3B,MAAI,cAAc,MAAM,kBAAkB;AACxC,2BAAuB,MAAM;AAAA,MAC3B,cAAc,MAAM;AAAA,IACtB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,cAAc;AAAA,IACpB,kBAAkB,gBAAgB;AAAA,IAClC,YAAY;AAAA,IACZ;AAAA,EACF;AACF;AAOA,eAAsB,aAA+B;AACnD,QAAM,MAAM,MAAM,UAAU,sBAAsB;AAClD,SAAO,QAAQ;AACjB;AAKA,eAAsB,SAAwB;AAC5C,QAAM,aAAa,sBAAsB;AAC3C;AAQA,eAAsB,eACpB,MACA,UACe;AACf,QAAM,KAAK,SAAS,gBAAgB;AAAA,IAClC,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,QAAM,MAAM,CAAC,WACX,IAAI,QAAQ,aAAW,GAAG,SAAS,QAAQ,OAAO,CAAC;AAErD,QAAM,cAAc,CAAC,WACnB,IAAI,QAAQ,aAAW;AAErB,YAAQ,OAAO,MAAM,MAAM;AAC3B,UAAM,QAAQ,QAAQ;AACtB,UAAM,SAAS,MAAM;AACrB,QAAI,MAAM,WAAY,OAAM,WAAW,IAAI;AAC3C,UAAM,OAAO;AAEb,QAAI,MAAM;AACV,UAAM,SAAS,CAAC,OAAe;AAC7B,YAAM,IAAI,GAAG,SAAS,MAAM;AAC5B,UAAI,MAAM,QAAQ,MAAM,MAAM;AAC5B,YAAI,MAAM,WAAY,OAAM,WAAW,UAAU,KAAK;AACtD,cAAM,eAAe,QAAQ,MAAM;AACnC,gBAAQ,OAAO,MAAM,IAAI;AACzB,gBAAQ,GAAG;AAAA,MACb,WAAW,MAAM,KAAU;AAEzB,gBAAQ,KAAK,CAAC;AAAA,MAChB,WAAW,MAAM,UAAY,MAAM,MAAM;AAEvC,YAAI,IAAI,SAAS,GAAG;AAClB,gBAAM,IAAI,MAAM,GAAG,EAAE;AACrB,kBAAQ,OAAO,MAAM,OAAO;AAAA,QAC9B;AAAA,MACF,OAAO;AACL,eAAO;AACP,gBAAQ,OAAO,MAAM,GAAG;AAAA,MAC1B;AAAA,IACF;AACA,UAAM,GAAG,QAAQ,MAAM;AAAA,EACzB,CAAC;AAEH,MAAI;AACF,QAAI,CAAC,MAAM;AACT,aAAO,MAAM,IAAI,YAAY;AAAA,IAC/B;AACA,QAAI,CAAC,UAAU;AACb,iBAAW,MAAM,YAAY,YAAY;AAAA,IAC3C;AAEA,OAAG,MAAM;AAET,YAAQ,IAAI;AAAA,EAAK,EAAE,0BAA0B,CAAC,KAAK;AAEnD,UAAM,SAAS,MAAM,aAAa,MAAM,UAAU,WAAS;AACzD,cAAQ,IAAI,KAAK,KAAK,KAAK;AAAA,IAC7B,CAAC;AAED,YAAQ,IAAI;AAAA,SAAO,EAAE,wBAAwB,CAAC,EAAE;AAChD,YAAQ,IAAI,WAAW,OAAO,IAAI,EAAE;AACpC,YAAQ;AAAA,MACN,KAAK,EAAE,iCAAiC,CAAC,KAAK,OAAO,gBAAgB;AAAA,IACvE;AACA,QAAI,OAAO,WAAW,SAAS,GAAG;AAChC,cAAQ,IAAI,aAAa,OAAO,WAAW,KAAK,IAAI,CAAC,EAAE;AAAA,IACzD;AACA,QAAI,OAAO,sBAAsB;AAC/B,cAAQ,IAAI,iCAAiC;AAAA,IAC/C;AAAA,EACF,SAAS,KAAK;AACZ,OAAG,MAAM;AACT,YAAQ;AAAA,MACN;AAAA,SAAO,EAAE,uBAAuB,CAAC,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACxF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;",
+  "names": []
+}

package/dist/services/oauth.js

@@ -6,7 +6,7 @@ import { openBrowser } from "../utils/browser.js";
 import { logError } from "../utils/log.js";
 import { resetAnthropicClient } from "./claude.js";
 import {
-  getGlobalConfig,
+  getMutableGlobalConfig,
   saveGlobalConfig,
   normalizeApiKeyForConfig
 } from "../utils/config.js";
@@ -78,7 +78,7 @@ class OAuthService {
         emailAddress: account.email_address,
         organizationUuid: organization?.uuid
       };
-      const config = getGlobalConfig();
+      const config = getMutableGlobalConfig();
       config.oauthAccount = accountInfo;
       saveGlobalConfig(config);
     }
@@ -222,7 +222,7 @@ async function createAndStoreApiKey(accessToken) {
     }
     if (createApiKeyResp.ok && apiKeyData && apiKeyData.raw_key) {
       const apiKey = apiKeyData.raw_key;
-      const config = getGlobalConfig();
+      const config = getMutableGlobalConfig();
       if (!config.customApiKeyResponses) {
         config.customApiKeyResponses = { approved: [], rejected: [] };
       }

package/dist/services/oauth.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/services/oauth.ts"],
-  "sourcesContent": ["import * as crypto from 'crypto'\nimport * as http from 'http'\nimport { IncomingMessage, ServerResponse } from 'http'\nimport * as url from 'url'\n\nimport { OAUTH_CONFIG } from '@constants/oauth'\nimport { openBrowser } from '@utils/browser'\nimport { logError } from '@utils/log'\nimport { resetAnthropicClient } from './claude'\nimport {\n  AccountInfo,\n  getGlobalConfig,\n  saveGlobalConfig,\n  normalizeApiKeyForConfig,\n} from '@utils/config'\n\n// Base64URL encoding function (RFC 4648)\nfunction base64URLEncode(buffer: Buffer): string {\n  return buffer\n    .toString('base64')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nfunction generateCodeVerifier(): string {\n  return base64URLEncode(crypto.randomBytes(32))\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n  return base64URLEncode(Buffer.from(digest))\n}\n\ntype OAuthTokenExchangeResponse = {\n  access_token: string\n  account?: {\n    uuid: string\n    email_address: string\n  }\n  organization?: {\n    uuid: string\n    name: string\n  }\n}\n\nexport type OAuthResult = {\n  accessToken: string\n}\n\nexport class OAuthService {\n  private server: http.Server | null = null\n  private codeVerifier: string\n  private expectedState: string | null = null\n  private pendingCodePromise: {\n    resolve: (result: {\n      authorizationCode: string\n      useManualRedirect: boolean\n    }) => void\n    reject: (err: Error) => void\n  } | null = null\n\n  constructor() {\n    this.codeVerifier = generateCodeVerifier()\n  }\n\n  private generateAuthUrls(\n    codeChallenge: string,\n    state: string,\n  ): { autoUrl: string; manualUrl: string } {\n    function makeUrl(isManual: boolean): string {\n      const authUrl = new URL(OAUTH_CONFIG.AUTHORIZE_URL)\n      authUrl.searchParams.append('client_id', OAUTH_CONFIG.CLIENT_ID)\n      authUrl.searchParams.append('response_type', 'code')\n      authUrl.searchParams.append(\n        'redirect_uri',\n        isManual\n          ? OAUTH_CONFIG.MANUAL_REDIRECT_URL\n          : `http://localhost:${OAUTH_CONFIG.REDIRECT_PORT}/callback`,\n      )\n      authUrl.searchParams.append('scope', OAUTH_CONFIG.SCOPES.join(' '))\n      authUrl.searchParams.append('code_challenge', codeChallenge)\n      authUrl.searchParams.append('code_challenge_method', 'S256')\n      authUrl.searchParams.append('state', state)\n      return authUrl.toString()\n    }\n\n    return {\n      autoUrl: makeUrl(false),\n      manualUrl: makeUrl(true),\n    }\n  }\n\n  async startOAuthFlow(\n    authURLHandler: (url: string) => Promise<void>,\n  ): Promise<OAuthResult> {\n    const codeChallenge = await generateCodeChallenge(this.codeVerifier)\n    const state = base64URLEncode(crypto.randomBytes(32))\n    this.expectedState = state\n    const { autoUrl, manualUrl } = this.generateAuthUrls(codeChallenge, state)\n\n    const onReady = async () => {\n      await authURLHandler(manualUrl)\n      await openBrowser(autoUrl)\n    }\n\n    const { authorizationCode, useManualRedirect } = await new Promise<{\n      authorizationCode: string\n      useManualRedirect: boolean\n    }>((resolve, reject) => {\n      this.pendingCodePromise = { resolve, reject }\n      this.startLocalServer(state, onReady)\n    })\n\n    // Exchange code for tokens\n    const {\n      access_token: accessToken,\n      account,\n      organization,\n    } = await this.exchangeCodeForTokens(\n      authorizationCode,\n      state,\n      useManualRedirect,\n    )\n\n    // Store account info\n    if (account) {\n      const accountInfo: AccountInfo = {\n        accountUuid: account.uuid,\n        emailAddress: account.email_address,\n        organizationUuid: organization?.uuid,\n      }\n      const config = getGlobalConfig()\n      config.oauthAccount = accountInfo\n      saveGlobalConfig(config)\n    }\n\n    return { accessToken }\n  }\n\n  private startLocalServer(state: string, onReady?: () => void): void {\n    if (this.server) {\n      this.closeServer()\n    }\n    this.server = http.createServer(\n      (req: IncomingMessage, res: ServerResponse) => {\n        const parsedUrl = url.parse(req.url || '', true)\n\n        if (parsedUrl.pathname === '/callback') {\n          const authorizationCode = parsedUrl.query.code as string\n          const returnedState = parsedUrl.query.state as string\n\n          if (!authorizationCode) {\n            res.writeHead(400)\n            res.end('Authorization code not found')\n            if (this.pendingCodePromise) {\n              this.pendingCodePromise.reject(\n                new Error('No authorization code received'),\n              )\n            }\n            return\n          }\n\n          if (returnedState !== state) {\n            res.writeHead(400)\n            res.end('Invalid state parameter')\n            if (this.pendingCodePromise) {\n              this.pendingCodePromise.reject(\n                new Error('Invalid state parameter'), // Possible CSRF attack\n              )\n            }\n            return\n          }\n\n          res.writeHead(302, {\n            Location: OAUTH_CONFIG.SUCCESS_URL,\n          })\n          res.end()\n\n          this.processCallback({\n            authorizationCode,\n            state,\n            useManualRedirect: false,\n          })\n        } else {\n          res.writeHead(404)\n          res.end()\n        }\n      },\n    )\n\n    this.server.listen(OAUTH_CONFIG.REDIRECT_PORT, async () => {\n      onReady?.()\n    })\n\n    this.server.on('error', (err: Error) => {\n      const portError = err as NodeJS.ErrnoException\n      if (portError.code === 'EADDRINUSE') {\n        const error = new Error(\n          `Port ${OAUTH_CONFIG.REDIRECT_PORT} is already in use. Please ensure no other applications are using this port.`,\n        )\n        logError(error)\n        this.closeServer()\n        if (this.pendingCodePromise) {\n          this.pendingCodePromise.reject(error)\n        }\n        return\n      } else {\n        logError(err)\n        this.closeServer()\n        if (this.pendingCodePromise) {\n          this.pendingCodePromise.reject(err)\n        }\n        return\n      }\n    })\n  }\n\n  private async exchangeCodeForTokens(\n    authorizationCode: string,\n    state: string,\n    useManualRedirect: boolean = false,\n  ): Promise<OAuthTokenExchangeResponse> {\n    const requestBody = {\n      grant_type: 'authorization_code',\n      code: authorizationCode,\n      redirect_uri: useManualRedirect\n        ? OAUTH_CONFIG.MANUAL_REDIRECT_URL\n        : `http://localhost:${OAUTH_CONFIG.REDIRECT_PORT}/callback`,\n      client_id: OAUTH_CONFIG.CLIENT_ID,\n      code_verifier: this.codeVerifier,\n      state,\n    }\n\n    const response = await fetch(OAUTH_CONFIG.TOKEN_URL, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(requestBody),\n      signal: AbortSignal.timeout(30_000),\n    })\n\n    if (!response.ok) {\n      throw new Error(`Token exchange failed: ${response.statusText}`)\n    }\n\n    const data = await response.json()\n    return data\n  }\n\n  processCallback({\n    authorizationCode,\n    state,\n    useManualRedirect,\n  }: {\n    authorizationCode: string\n    state: string\n    useManualRedirect: boolean\n  }): void {\n    this.closeServer()\n\n    if (state !== this.expectedState) {\n      if (this.pendingCodePromise) {\n        this.pendingCodePromise.reject(\n          new Error('Invalid state parameter'), // Possible CSRF attack\n        )\n        this.pendingCodePromise = null\n      }\n      return\n    }\n\n    if (this.pendingCodePromise) {\n      this.pendingCodePromise.resolve({ authorizationCode, useManualRedirect })\n      this.pendingCodePromise = null\n    }\n  }\n\n  private closeServer(): void {\n    if (this.server) {\n      this.server.close()\n      this.server = null\n    }\n  }\n}\n\nexport async function createAndStoreApiKey(\n  accessToken: string,\n): Promise<string | null> {\n  try {\n    // Call create_api_key endpoint\n    const createApiKeyResp = await fetch(OAUTH_CONFIG.API_KEY_URL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${accessToken}` },\n      signal: AbortSignal.timeout(30_000),\n    })\n\n    let apiKeyData\n    let errorText = ''\n\n    try {\n      apiKeyData = await createApiKeyResp.json()\n    } catch (_e) {\n      // If response is not valid JSON, get as text for error logging\n      errorText = await createApiKeyResp.text()\n    }\n\n    if (createApiKeyResp.ok && apiKeyData && apiKeyData.raw_key) {\n      const apiKey = apiKeyData.raw_key\n\n      // Store in global config\n      const config = getGlobalConfig()\n\n      // Note: API key is now managed per model profile\n\n      // Add to approved list\n      if (!config.customApiKeyResponses) {\n        config.customApiKeyResponses = { approved: [], rejected: [] }\n      }\n      if (!config.customApiKeyResponses.approved) {\n        config.customApiKeyResponses.approved = []\n      }\n\n      const normalizedKey = normalizeApiKeyForConfig(apiKey)\n      if (!config.customApiKeyResponses.approved.includes(normalizedKey)) {\n        config.customApiKeyResponses.approved.push(normalizedKey)\n      }\n\n      // Save config\n      saveGlobalConfig(config)\n\n      // Reset the Anthropic client to force creation with new API key\n      resetAnthropicClient()\n\n      return apiKey\n    }\n\n    return null\n  } catch (error) {\n    throw error\n  }\n}\n"],
-  "mappings": "AAAA,YAAY,YAAY;AACxB,YAAY,UAAU;AAEtB,YAAY,SAAS;AAErB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AACrC;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,gBAAgB,QAAwB;AAC/C,SAAO,OACJ,SAAS,QAAQ,EACjB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,SAAS,uBAA+B;AACtC,SAAO,gBAAgB,OAAO,YAAY,EAAE,CAAC;AAC/C;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,OAAO,KAAK,MAAM,CAAC;AAC5C;AAkBO,MAAM,aAAa;AAAA,EAChB,SAA6B;AAAA,EAC7B;AAAA,EACA,gBAA+B;AAAA,EAC/B,qBAMG;AAAA,EAEX,cAAc;AACZ,SAAK,eAAe,qBAAqB;AAAA,EAC3C;AAAA,EAEQ,iBACN,eACA,OACwC;AACxC,aAAS,QAAQ,UAA2B;AAC1C,YAAM,UAAU,IAAI,IAAI,aAAa,aAAa;AAClD,cAAQ,aAAa,OAAO,aAAa,aAAa,SAAS;AAC/D,cAAQ,aAAa,OAAO,iBAAiB,MAAM;AACnD,cAAQ,aAAa;AAAA,QACnB;AAAA,QACA,WACI,aAAa,sBACb,oBAAoB,aAAa,aAAa;AAAA,MACpD;AACA,cAAQ,aAAa,OAAO,SAAS,aAAa,OAAO,KAAK,GAAG,CAAC;AAClE,cAAQ,aAAa,OAAO,kBAAkB,aAAa;AAC3D,cAAQ,aAAa,OAAO,yBAAyB,MAAM;AAC3D,cAAQ,aAAa,OAAO,SAAS,KAAK;AAC1C,aAAO,QAAQ,SAAS;AAAA,IAC1B;AAEA,WAAO;AAAA,MACL,SAAS,QAAQ,KAAK;AAAA,MACtB,WAAW,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,eACJ,gBACsB;AACtB,UAAM,gBAAgB,MAAM,sBAAsB,KAAK,YAAY;AACnE,UAAM,QAAQ,gBAAgB,OAAO,YAAY,EAAE,CAAC;AACpD,SAAK,gBAAgB;AACrB,UAAM,EAAE,SAAS,UAAU,IAAI,KAAK,iBAAiB,eAAe,KAAK;AAEzE,UAAM,UAAU,YAAY;AAC1B,YAAM,eAAe,SAAS;AAC9B,YAAM,YAAY,OAAO;AAAA,IAC3B;AAEA,UAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,IAAI,QAGxD,CAAC,SAAS,WAAW;AACtB,WAAK,qBAAqB,EAAE,SAAS,OAAO;AAC5C,WAAK,iBAAiB,OAAO,OAAO;AAAA,IACtC,CAAC;AAGD,UAAM;AAAA,MACJ,cAAc;AAAA,MACd;AAAA,MACA;AAAA,IACF,IAAI,MAAM,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,QAAI,SAAS;AACX,YAAM,cAA2B;AAAA,QAC/B,aAAa,QAAQ;AAAA,QACrB,cAAc,QAAQ;AAAA,QACtB,kBAAkB,cAAc;AAAA,MAClC;AACA,YAAM,SAAS,gBAAgB;AAC/B,aAAO,eAAe;AACtB,uBAAiB,MAAM;AAAA,IACzB;AAEA,WAAO,EAAE,YAAY;AAAA,EACvB;AAAA,EAEQ,iBAAiB,OAAe,SAA4B;AAClE,QAAI,KAAK,QAAQ;AACf,WAAK,YAAY;AAAA,IACnB;AACA,SAAK,SAAS,KAAK;AAAA,MACjB,CAAC,KAAsB,QAAwB;AAC7C,cAAM,YAAY,IAAI,MAAM,IAAI,OAAO,IAAI,IAAI;AAE/C,YAAI,UAAU,aAAa,aAAa;AACtC,gBAAM,oBAAoB,UAAU,MAAM;AAC1C,gBAAM,gBAAgB,UAAU,MAAM;AAEtC,cAAI,CAAC,mBAAmB;AACtB,gBAAI,UAAU,GAAG;AACjB,gBAAI,IAAI,8BAA8B;AACtC,gBAAI,KAAK,oBAAoB;AAC3B,mBAAK,mBAAmB;AAAA,gBACtB,IAAI,MAAM,gCAAgC;AAAA,cAC5C;AAAA,YACF;AACA;AAAA,UACF;AAEA,cAAI,kBAAkB,OAAO;AAC3B,gBAAI,UAAU,GAAG;AACjB,gBAAI,IAAI,yBAAyB;AACjC,gBAAI,KAAK,oBAAoB;AAC3B,mBAAK,mBAAmB;AAAA,gBACtB,IAAI,MAAM,yBAAyB;AAAA;AAAA,cACrC;AAAA,YACF;AACA;AAAA,UACF;AAEA,cAAI,UAAU,KAAK;AAAA,YACjB,UAAU,aAAa;AAAA,UACzB,CAAC;AACD,cAAI,IAAI;AAER,eAAK,gBAAgB;AAAA,YACnB;AAAA,YACA;AAAA,YACA,mBAAmB;AAAA,UACrB,CAAC;AAAA,QACH,OAAO;AACL,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,aAAa,eAAe,YAAY;AACzD,gBAAU;AAAA,IACZ,CAAC;AAED,SAAK,OAAO,GAAG,SAAS,CAAC,QAAe;AACtC,YAAM,YAAY;AAClB,UAAI,UAAU,SAAS,cAAc;AACnC,cAAM,QAAQ,IAAI;AAAA,UAChB,QAAQ,aAAa,aAAa;AAAA,QACpC;AACA,iBAAS,KAAK;AACd,aAAK,YAAY;AACjB,YAAI,KAAK,oBAAoB;AAC3B,eAAK,mBAAmB,OAAO,KAAK;AAAA,QACtC;AACA;AAAA,MACF,OAAO;AACL,iBAAS,GAAG;AACZ,aAAK,YAAY;AACjB,YAAI,KAAK,oBAAoB;AAC3B,eAAK,mBAAmB,OAAO,GAAG;AAAA,QACpC;AACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,sBACZ,mBACA,OACA,oBAA6B,OACQ;AACrC,UAAM,cAAc;AAAA,MAClB,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,cAAc,oBACV,aAAa,sBACb,oBAAoB,aAAa,aAAa;AAAA,MAClD,WAAW,aAAa;AAAA,MACxB,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,aAAa,WAAW;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,WAAW;AAAA,MAChC,QAAQ,YAAY,QAAQ,GAAM;AAAA,IACpC,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,0BAA0B,SAAS,UAAU,EAAE;AAAA,IACjE;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIS;AACP,SAAK,YAAY;AAEjB,QAAI,UAAU,KAAK,eAAe;AAChC,UAAI,KAAK,oBAAoB;AAC3B,aAAK,mBAAmB;AAAA,UACtB,IAAI,MAAM,yBAAyB;AAAA;AAAA,QACrC;AACA,aAAK,qBAAqB;AAAA,MAC5B;AACA;AAAA,IACF;AAEA,QAAI,KAAK,oBAAoB;AAC3B,WAAK,mBAAmB,QAAQ,EAAE,mBAAmB,kBAAkB,CAAC;AACxE,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEQ,cAAoB;AAC1B,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,MAAM;AAClB,WAAK,SAAS;AAAA,IAChB;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,aACwB;AACxB,MAAI;AAEF,UAAM,mBAAmB,MAAM,MAAM,aAAa,aAAa;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,MAClD,QAAQ,YAAY,QAAQ,GAAM;AAAA,IACpC,CAAC;AAED,QAAI;AACJ,QAAI,YAAY;AAEhB,QAAI;AACF,mBAAa,MAAM,iBAAiB,KAAK;AAAA,IAC3C,SAAS,IAAI;AAEX,kBAAY,MAAM,iBAAiB,KAAK;AAAA,IAC1C;AAEA,QAAI,iBAAiB,MAAM,cAAc,WAAW,SAAS;AAC3D,YAAM,SAAS,WAAW;AAG1B,YAAM,SAAS,gBAAgB;AAK/B,UAAI,CAAC,OAAO,uBAAuB;AACjC,eAAO,wBAAwB,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,MAC9D;AACA,UAAI,CAAC,OAAO,sBAAsB,UAAU;AAC1C,eAAO,sBAAsB,WAAW,CAAC;AAAA,MAC3C;AAEA,YAAM,gBAAgB,yBAAyB,MAAM;AACrD,UAAI,CAAC,OAAO,sBAAsB,SAAS,SAAS,aAAa,GAAG;AAClE,eAAO,sBAAsB,SAAS,KAAK,aAAa;AAAA,MAC1D;AAGA,uBAAiB,MAAM;AAGvB,2BAAqB;AAErB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import * as crypto from 'crypto'\nimport * as http from 'http'\nimport { IncomingMessage, ServerResponse } from 'http'\nimport * as url from 'url'\n\nimport { OAUTH_CONFIG } from '@constants/oauth'\nimport { openBrowser } from '@utils/browser'\nimport { logError } from '@utils/log'\nimport { resetAnthropicClient } from './claude'\nimport {\n  AccountInfo,\n  getMutableGlobalConfig,\n  saveGlobalConfig,\n  normalizeApiKeyForConfig,\n} from '@utils/config'\n\n// Base64URL encoding function (RFC 4648)\nfunction base64URLEncode(buffer: Buffer): string {\n  return buffer\n    .toString('base64')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nfunction generateCodeVerifier(): string {\n  return base64URLEncode(crypto.randomBytes(32))\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n  return base64URLEncode(Buffer.from(digest))\n}\n\ntype OAuthTokenExchangeResponse = {\n  access_token: string\n  account?: {\n    uuid: string\n    email_address: string\n  }\n  organization?: {\n    uuid: string\n    name: string\n  }\n}\n\nexport type OAuthResult = {\n  accessToken: string\n}\n\nexport class OAuthService {\n  private server: http.Server | null = null\n  private codeVerifier: string\n  private expectedState: string | null = null\n  private pendingCodePromise: {\n    resolve: (result: {\n      authorizationCode: string\n      useManualRedirect: boolean\n    }) => void\n    reject: (err: Error) => void\n  } | null = null\n\n  constructor() {\n    this.codeVerifier = generateCodeVerifier()\n  }\n\n  private generateAuthUrls(\n    codeChallenge: string,\n    state: string,\n  ): { autoUrl: string; manualUrl: string } {\n    function makeUrl(isManual: boolean): string {\n      const authUrl = new URL(OAUTH_CONFIG.AUTHORIZE_URL)\n      authUrl.searchParams.append('client_id', OAUTH_CONFIG.CLIENT_ID)\n      authUrl.searchParams.append('response_type', 'code')\n      authUrl.searchParams.append(\n        'redirect_uri',\n        isManual\n          ? OAUTH_CONFIG.MANUAL_REDIRECT_URL\n          : `http://localhost:${OAUTH_CONFIG.REDIRECT_PORT}/callback`,\n      )\n      authUrl.searchParams.append('scope', OAUTH_CONFIG.SCOPES.join(' '))\n      authUrl.searchParams.append('code_challenge', codeChallenge)\n      authUrl.searchParams.append('code_challenge_method', 'S256')\n      authUrl.searchParams.append('state', state)\n      return authUrl.toString()\n    }\n\n    return {\n      autoUrl: makeUrl(false),\n      manualUrl: makeUrl(true),\n    }\n  }\n\n  async startOAuthFlow(\n    authURLHandler: (url: string) => Promise<void>,\n  ): Promise<OAuthResult> {\n    const codeChallenge = await generateCodeChallenge(this.codeVerifier)\n    const state = base64URLEncode(crypto.randomBytes(32))\n    this.expectedState = state\n    const { autoUrl, manualUrl } = this.generateAuthUrls(codeChallenge, state)\n\n    const onReady = async () => {\n      await authURLHandler(manualUrl)\n      await openBrowser(autoUrl)\n    }\n\n    const { authorizationCode, useManualRedirect } = await new Promise<{\n      authorizationCode: string\n      useManualRedirect: boolean\n    }>((resolve, reject) => {\n      this.pendingCodePromise = { resolve, reject }\n      this.startLocalServer(state, onReady)\n    })\n\n    // Exchange code for tokens\n    const {\n      access_token: accessToken,\n      account,\n      organization,\n    } = await this.exchangeCodeForTokens(\n      authorizationCode,\n      state,\n      useManualRedirect,\n    )\n\n    // Store account info\n    if (account) {\n      const accountInfo: AccountInfo = {\n        accountUuid: account.uuid,\n        emailAddress: account.email_address,\n        organizationUuid: organization?.uuid,\n      }\n      const config = getMutableGlobalConfig()\n      config.oauthAccount = accountInfo\n      saveGlobalConfig(config)\n    }\n\n    return { accessToken }\n  }\n\n  private startLocalServer(state: string, onReady?: () => void): void {\n    if (this.server) {\n      this.closeServer()\n    }\n    this.server = http.createServer(\n      (req: IncomingMessage, res: ServerResponse) => {\n        const parsedUrl = url.parse(req.url || '', true)\n\n        if (parsedUrl.pathname === '/callback') {\n          const authorizationCode = parsedUrl.query.code as string\n          const returnedState = parsedUrl.query.state as string\n\n          if (!authorizationCode) {\n            res.writeHead(400)\n            res.end('Authorization code not found')\n            if (this.pendingCodePromise) {\n              this.pendingCodePromise.reject(\n                new Error('No authorization code received'),\n              )\n            }\n            return\n          }\n\n          if (returnedState !== state) {\n            res.writeHead(400)\n            res.end('Invalid state parameter')\n            if (this.pendingCodePromise) {\n              this.pendingCodePromise.reject(\n                new Error('Invalid state parameter'), // Possible CSRF attack\n              )\n            }\n            return\n          }\n\n          res.writeHead(302, {\n            Location: OAUTH_CONFIG.SUCCESS_URL,\n          })\n          res.end()\n\n          this.processCallback({\n            authorizationCode,\n            state,\n            useManualRedirect: false,\n          })\n        } else {\n          res.writeHead(404)\n          res.end()\n        }\n      },\n    )\n\n    this.server.listen(OAUTH_CONFIG.REDIRECT_PORT, async () => {\n      onReady?.()\n    })\n\n    this.server.on('error', (err: Error) => {\n      const portError = err as NodeJS.ErrnoException\n      if (portError.code === 'EADDRINUSE') {\n        const error = new Error(\n          `Port ${OAUTH_CONFIG.REDIRECT_PORT} is already in use. Please ensure no other applications are using this port.`,\n        )\n        logError(error)\n        this.closeServer()\n        if (this.pendingCodePromise) {\n          this.pendingCodePromise.reject(error)\n        }\n        return\n      } else {\n        logError(err)\n        this.closeServer()\n        if (this.pendingCodePromise) {\n          this.pendingCodePromise.reject(err)\n        }\n        return\n      }\n    })\n  }\n\n  private async exchangeCodeForTokens(\n    authorizationCode: string,\n    state: string,\n    useManualRedirect: boolean = false,\n  ): Promise<OAuthTokenExchangeResponse> {\n    const requestBody = {\n      grant_type: 'authorization_code',\n      code: authorizationCode,\n      redirect_uri: useManualRedirect\n        ? OAUTH_CONFIG.MANUAL_REDIRECT_URL\n        : `http://localhost:${OAUTH_CONFIG.REDIRECT_PORT}/callback`,\n      client_id: OAUTH_CONFIG.CLIENT_ID,\n      code_verifier: this.codeVerifier,\n      state,\n    }\n\n    const response = await fetch(OAUTH_CONFIG.TOKEN_URL, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(requestBody),\n      signal: AbortSignal.timeout(30_000),\n    })\n\n    if (!response.ok) {\n      throw new Error(`Token exchange failed: ${response.statusText}`)\n    }\n\n    const data = await response.json()\n    return data\n  }\n\n  processCallback({\n    authorizationCode,\n    state,\n    useManualRedirect,\n  }: {\n    authorizationCode: string\n    state: string\n    useManualRedirect: boolean\n  }): void {\n    this.closeServer()\n\n    if (state !== this.expectedState) {\n      if (this.pendingCodePromise) {\n        this.pendingCodePromise.reject(\n          new Error('Invalid state parameter'), // Possible CSRF attack\n        )\n        this.pendingCodePromise = null\n      }\n      return\n    }\n\n    if (this.pendingCodePromise) {\n      this.pendingCodePromise.resolve({ authorizationCode, useManualRedirect })\n      this.pendingCodePromise = null\n    }\n  }\n\n  private closeServer(): void {\n    if (this.server) {\n      this.server.close()\n      this.server = null\n    }\n  }\n}\n\nexport async function createAndStoreApiKey(\n  accessToken: string,\n): Promise<string | null> {\n  try {\n    // Call create_api_key endpoint\n    const createApiKeyResp = await fetch(OAUTH_CONFIG.API_KEY_URL, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${accessToken}` },\n      signal: AbortSignal.timeout(30_000),\n    })\n\n    let apiKeyData\n    let errorText = ''\n\n    try {\n      apiKeyData = await createApiKeyResp.json()\n    } catch (_e) {\n      // If response is not valid JSON, get as text for error logging\n      errorText = await createApiKeyResp.text()\n    }\n\n    if (createApiKeyResp.ok && apiKeyData && apiKeyData.raw_key) {\n      const apiKey = apiKeyData.raw_key\n\n      // Store in global config\n      const config = getMutableGlobalConfig()\n\n      // Note: API key is now managed per model profile\n\n      // Add to approved list\n      if (!config.customApiKeyResponses) {\n        config.customApiKeyResponses = { approved: [], rejected: [] }\n      }\n      if (!config.customApiKeyResponses.approved) {\n        config.customApiKeyResponses.approved = []\n      }\n\n      const normalizedKey = normalizeApiKeyForConfig(apiKey)\n      if (!config.customApiKeyResponses.approved.includes(normalizedKey)) {\n        config.customApiKeyResponses.approved.push(normalizedKey)\n      }\n\n      // Save config\n      saveGlobalConfig(config)\n\n      // Reset the Anthropic client to force creation with new API key\n      resetAnthropicClient()\n\n      return apiKey\n    }\n\n    return null\n  } catch (error) {\n    throw error\n  }\n}\n"],
+  "mappings": "AAAA,YAAY,YAAY;AACxB,YAAY,UAAU;AAEtB,YAAY,SAAS;AAErB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AACrC;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,gBAAgB,QAAwB;AAC/C,SAAO,OACJ,SAAS,QAAQ,EACjB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,SAAS,uBAA+B;AACtC,SAAO,gBAAgB,OAAO,YAAY,EAAE,CAAC;AAC/C;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,OAAO,KAAK,MAAM,CAAC;AAC5C;AAkBO,MAAM,aAAa;AAAA,EAChB,SAA6B;AAAA,EAC7B;AAAA,EACA,gBAA+B;AAAA,EAC/B,qBAMG;AAAA,EAEX,cAAc;AACZ,SAAK,eAAe,qBAAqB;AAAA,EAC3C;AAAA,EAEQ,iBACN,eACA,OACwC;AACxC,aAAS,QAAQ,UAA2B;AAC1C,YAAM,UAAU,IAAI,IAAI,aAAa,aAAa;AAClD,cAAQ,aAAa,OAAO,aAAa,aAAa,SAAS;AAC/D,cAAQ,aAAa,OAAO,iBAAiB,MAAM;AACnD,cAAQ,aAAa;AAAA,QACnB;AAAA,QACA,WACI,aAAa,sBACb,oBAAoB,aAAa,aAAa;AAAA,MACpD;AACA,cAAQ,aAAa,OAAO,SAAS,aAAa,OAAO,KAAK,GAAG,CAAC;AAClE,cAAQ,aAAa,OAAO,kBAAkB,aAAa;AAC3D,cAAQ,aAAa,OAAO,yBAAyB,MAAM;AAC3D,cAAQ,aAAa,OAAO,SAAS,KAAK;AAC1C,aAAO,QAAQ,SAAS;AAAA,IAC1B;AAEA,WAAO;AAAA,MACL,SAAS,QAAQ,KAAK;AAAA,MACtB,WAAW,QAAQ,IAAI;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,eACJ,gBACsB;AACtB,UAAM,gBAAgB,MAAM,sBAAsB,KAAK,YAAY;AACnE,UAAM,QAAQ,gBAAgB,OAAO,YAAY,EAAE,CAAC;AACpD,SAAK,gBAAgB;AACrB,UAAM,EAAE,SAAS,UAAU,IAAI,KAAK,iBAAiB,eAAe,KAAK;AAEzE,UAAM,UAAU,YAAY;AAC1B,YAAM,eAAe,SAAS;AAC9B,YAAM,YAAY,OAAO;AAAA,IAC3B;AAEA,UAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,IAAI,QAGxD,CAAC,SAAS,WAAW;AACtB,WAAK,qBAAqB,EAAE,SAAS,OAAO;AAC5C,WAAK,iBAAiB,OAAO,OAAO;AAAA,IACtC,CAAC;AAGD,UAAM;AAAA,MACJ,cAAc;AAAA,MACd;AAAA,MACA;AAAA,IACF,IAAI,MAAM,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,QAAI,SAAS;AACX,YAAM,cAA2B;AAAA,QAC/B,aAAa,QAAQ;AAAA,QACrB,cAAc,QAAQ;AAAA,QACtB,kBAAkB,cAAc;AAAA,MAClC;AACA,YAAM,SAAS,uBAAuB;AACtC,aAAO,eAAe;AACtB,uBAAiB,MAAM;AAAA,IACzB;AAEA,WAAO,EAAE,YAAY;AAAA,EACvB;AAAA,EAEQ,iBAAiB,OAAe,SAA4B;AAClE,QAAI,KAAK,QAAQ;AACf,WAAK,YAAY;AAAA,IACnB;AACA,SAAK,SAAS,KAAK;AAAA,MACjB,CAAC,KAAsB,QAAwB;AAC7C,cAAM,YAAY,IAAI,MAAM,IAAI,OAAO,IAAI,IAAI;AAE/C,YAAI,UAAU,aAAa,aAAa;AACtC,gBAAM,oBAAoB,UAAU,MAAM;AAC1C,gBAAM,gBAAgB,UAAU,MAAM;AAEtC,cAAI,CAAC,mBAAmB;AACtB,gBAAI,UAAU,GAAG;AACjB,gBAAI,IAAI,8BAA8B;AACtC,gBAAI,KAAK,oBAAoB;AAC3B,mBAAK,mBAAmB;AAAA,gBACtB,IAAI,MAAM,gCAAgC;AAAA,cAC5C;AAAA,YACF;AACA;AAAA,UACF;AAEA,cAAI,kBAAkB,OAAO;AAC3B,gBAAI,UAAU,GAAG;AACjB,gBAAI,IAAI,yBAAyB;AACjC,gBAAI,KAAK,oBAAoB;AAC3B,mBAAK,mBAAmB;AAAA,gBACtB,IAAI,MAAM,yBAAyB;AAAA;AAAA,cACrC;AAAA,YACF;AACA;AAAA,UACF;AAEA,cAAI,UAAU,KAAK;AAAA,YACjB,UAAU,aAAa;AAAA,UACzB,CAAC;AACD,cAAI,IAAI;AAER,eAAK,gBAAgB;AAAA,YACnB;AAAA,YACA;AAAA,YACA,mBAAmB;AAAA,UACrB,CAAC;AAAA,QACH,OAAO;AACL,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,aAAa,eAAe,YAAY;AACzD,gBAAU;AAAA,IACZ,CAAC;AAED,SAAK,OAAO,GAAG,SAAS,CAAC,QAAe;AACtC,YAAM,YAAY;AAClB,UAAI,UAAU,SAAS,cAAc;AACnC,cAAM,QAAQ,IAAI;AAAA,UAChB,QAAQ,aAAa,aAAa;AAAA,QACpC;AACA,iBAAS,KAAK;AACd,aAAK,YAAY;AACjB,YAAI,KAAK,oBAAoB;AAC3B,eAAK,mBAAmB,OAAO,KAAK;AAAA,QACtC;AACA;AAAA,MACF,OAAO;AACL,iBAAS,GAAG;AACZ,aAAK,YAAY;AACjB,YAAI,KAAK,oBAAoB;AAC3B,eAAK,mBAAmB,OAAO,GAAG;AAAA,QACpC;AACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,sBACZ,mBACA,OACA,oBAA6B,OACQ;AACrC,UAAM,cAAc;AAAA,MAClB,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,cAAc,oBACV,aAAa,sBACb,oBAAoB,aAAa,aAAa;AAAA,MAClD,WAAW,aAAa;AAAA,MACxB,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,aAAa,WAAW;AAAA,MACnD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,WAAW;AAAA,MAChC,QAAQ,YAAY,QAAQ,GAAM;AAAA,IACpC,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,0BAA0B,SAAS,UAAU,EAAE;AAAA,IACjE;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIS;AACP,SAAK,YAAY;AAEjB,QAAI,UAAU,KAAK,eAAe;AAChC,UAAI,KAAK,oBAAoB;AAC3B,aAAK,mBAAmB;AAAA,UACtB,IAAI,MAAM,yBAAyB;AAAA;AAAA,QACrC;AACA,aAAK,qBAAqB;AAAA,MAC5B;AACA;AAAA,IACF;AAEA,QAAI,KAAK,oBAAoB;AAC3B,WAAK,mBAAmB,QAAQ,EAAE,mBAAmB,kBAAkB,CAAC;AACxE,WAAK,qBAAqB;AAAA,IAC5B;AAAA,EACF;AAAA,EAEQ,cAAoB;AAC1B,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,MAAM;AAClB,WAAK,SAAS;AAAA,IAChB;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,aACwB;AACxB,MAAI;AAEF,UAAM,mBAAmB,MAAM,MAAM,aAAa,aAAa;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,MAClD,QAAQ,YAAY,QAAQ,GAAM;AAAA,IACpC,CAAC;AAED,QAAI;AACJ,QAAI,YAAY;AAEhB,QAAI;AACF,mBAAa,MAAM,iBAAiB,KAAK;AAAA,IAC3C,SAAS,IAAI;AAEX,kBAAY,MAAM,iBAAiB,KAAK;AAAA,IAC1C;AAEA,QAAI,iBAAiB,MAAM,cAAc,WAAW,SAAS;AAC3D,YAAM,SAAS,WAAW;AAG1B,YAAM,SAAS,uBAAuB;AAKtC,UAAI,CAAC,OAAO,uBAAuB;AACjC,eAAO,wBAAwB,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,MAC9D;AACA,UAAI,CAAC,OAAO,sBAAsB,UAAU;AAC1C,eAAO,sBAAsB,WAAW,CAAC;AAAA,MAC3C;AAEA,YAAM,gBAAgB,yBAAyB,MAAM;AACrD,UAAI,CAAC,OAAO,sBAAsB,SAAS,SAAS,aAAa,GAAG;AAClE,eAAO,sBAAsB,SAAS,KAAK,aAAa;AAAA,MAC1D;AAGA,uBAAiB,MAAM;AAGvB,2BAAqB;AAErB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/services/openai.js

@@ -7,6 +7,7 @@ import {
   logAPIError
 } from "../utils/debugLogger.js";
 import { logError } from "../utils/log.js";
+import { setStreamingState } from "../utils/streamingState.js";
 import {
   abortableDelay,
   getRetryDelay as sharedGetRetryDelay
@@ -16,6 +17,11 @@ import {
 } from "../utils/userFriendlyError.js";
 import { isOpenAICompatibleProvider } from "../constants/providers.js";
 import { getEffectiveCapabilities } from "../constants/providerRegistry.js";
+import { resolveApiKey } from "../utils/config.js";
+async function resolveModelApiKey(modelProfile) {
+  if (!modelProfile?.apiKey) return "";
+  return await resolveApiKey(modelProfile) ?? modelProfile.apiKey;
+}
 function getRetryDelay(attempt) {
   return sharedGetRetryDelay(attempt);
 }
@@ -26,6 +32,7 @@ var ModelErrorType = /* @__PURE__ */ ((ModelErrorType2) => {
   ModelErrorType2["StreamOptions"] = "stream_options";
   ModelErrorType2["Citations"] = "citations";
   ModelErrorType2["RateLimit"] = "rate_limit";
+  ModelErrorType2["UnsupportedParam"] = "unsupported_param";
   return ModelErrorType2;
 })(ModelErrorType || {});
 function getModelErrorKey(baseURL, model, type) {
@@ -136,6 +143,20 @@ ${description}
       delete opts.stream_options;
     }
   },
+  {
+    type: "unsupported_param" /* UnsupportedParam */,
+    detect: (errMsg) => {
+      const lower = errMsg.toLowerCase();
+      return lower.includes("unsupported") && lower.includes("reasoning_effort") || lower.includes("does not support") && lower.includes("reasoning_effort");
+    },
+    fix: async (opts) => {
+      debugLogger.info("OPENAI_FIX", {
+        action: "remove_reasoning_effort",
+        model: opts.model
+      });
+      delete opts.reasoning_effort;
+    }
+  },
   {
     type: "citations" /* Citations */,
     detect: (errMsg) => errMsg.includes("Extra inputs are not permitted") && errMsg.includes("citations"),
@@ -311,6 +332,15 @@ async function applyModelErrorFixes(opts, baseURL) {
     }
   }
 }
+const API_FETCH_TIMEOUT_MS = parseInt(
+  process.env.API_TIMEOUT_MS || String(120 * 1e3),
+  10
+);
+function withFetchTimeout(signal) {
+  const timeoutSignal = AbortSignal.timeout(API_FETCH_TIMEOUT_MS);
+  if (!signal) return timeoutSignal;
+  return AbortSignal.any([signal, timeoutSignal]);
+}
 async function tryWithEndpointFallback(baseURL, opts, headers, provider, proxy, signal) {
   const endpointsToTry = [];
   if (provider === "minimax") {
@@ -319,6 +349,7 @@ async function tryWithEndpointFallback(baseURL, opts, headers, provider, proxy,
     endpointsToTry.push("/chat/completions");
   }
   let lastError = null;
+  const fetchSignal = withFetchTimeout(signal);
   for (const endpoint of endpointsToTry) {
     try {
       const response = await fetch(`${baseURL}${endpoint}`, {
@@ -326,8 +357,7 @@ async function tryWithEndpointFallback(baseURL, opts, headers, provider, proxy,
         headers,
         body: JSON.stringify(opts.stream ? { ...opts, stream: true } : opts),
         dispatcher: proxy,
-        signal
-        // 🔧 Connect AbortSignal to fetch call
+        signal: fetchSignal
       });
       if (response.ok) {
         return { response, endpoint };
@@ -355,13 +385,13 @@ async function tryWithEndpointFallback(baseURL, opts, headers, provider, proxy,
   }
   throw lastError || new Error("All endpoints failed");
 }
-async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAttempts = 10, signal) {
+async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAttempts = 5, signal) {
   if (attempt >= maxAttempts) {
     throw new Error("Max attempts reached");
   }
   const provider = modelProfile?.provider || "anthropic";
   const baseURL = modelProfile?.baseURL;
-  const apiKey = modelProfile?.apiKey;
+  const apiKey = await resolveModelApiKey(modelProfile);
   const proxy = getGlobalConfig().proxy ? new ProxyAgent(getGlobalConfig().proxy) : void 0;
   const headers = {
     "Content-Type": "application/json"
@@ -381,7 +411,7 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
     model: opts.model,
     provider,
     apiKeyConfigured: !!apiKey,
-    apiKeyPrefix: apiKey ? apiKey.substring(0, 8) : null,
+    apiKeyPrefix: apiKey ? apiKey.substring(0, 4) + "..." : null,
     maxTokens: opts.max_tokens,
     temperature: opts.temperature,
     messageCount: opts.messages?.length || 0,
@@ -391,6 +421,17 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
     modelProfileName: modelProfile?.name
   });
   opts.messages = opts.messages.map((msg) => {
+    if (msg.role === "assistant" && Array.isArray(msg.content)) {
+      const filtered = msg.content.filter(
+        (block) => block.type !== "thinking" && block.type !== "redacted_thinking"
+      );
+      if (filtered.length !== msg.content.length) {
+        return {
+          ...msg,
+          content: filtered.length > 0 ? filtered : [{ type: "text", text: "" }]
+        };
+      }
+    }
     if (msg.role === "tool") {
       if (Array.isArray(msg.content)) {
         return {
@@ -433,8 +474,7 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
           headers,
           body: JSON.stringify({ ...opts, stream: true }),
           dispatcher: proxy,
-          signal
-          // 🔧 CRITICAL FIX: Connect AbortSignal to fetch call
+          signal: withFetchTimeout(signal)
         });
       }
       if (!response2.ok) {
@@ -502,6 +542,13 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
           });
         }
         const delayMs = getRetryDelay(attempt);
+        setStreamingState({
+          phase: "retrying",
+          retryCount: attempt + 1,
+          maxRetries: maxAttempts,
+          errorName: `HTTP ${response2.status}`,
+          retryDelayMs: delayMs
+        });
         debugLogger.warn("API_RETRY", {
           status: response2.status,
           delayMs,
@@ -546,8 +593,7 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
         headers,
         body: JSON.stringify(opts),
         dispatcher: proxy,
-        signal
-        // 🔧 CRITICAL FIX: Connect AbortSignal to non-streaming fetch call
+        signal: withFetchTimeout(signal)
       });
     }
     if (!response.ok) {
@@ -592,6 +638,13 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
         debugLogger.warn("OPENAI_PARSE_ERROR", { status: response.status });
       }
       const delayMs = getRetryDelay(attempt);
+      setStreamingState({
+        phase: "retrying",
+        retryCount: attempt + 1,
+        maxRetries: maxAttempts,
+        errorName: `HTTP ${response.status}`,
+        retryDelayMs: delayMs
+      });
       debugLogger.warn("API_RETRY", {
         status: response.status,
         delayMs,
@@ -626,6 +679,13 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
         throw new Error("Request cancelled by user");
       }
       const delayMs = getRetryDelay(attempt);
+      setStreamingState({
+        phase: "retrying",
+        retryCount: attempt + 1,
+        maxRetries: maxAttempts,
+        errorName: error instanceof Error ? error.message.slice(0, 30) : "network error",
+        retryDelayMs: delayMs
+      });
       debugLogger.warn("API_RETRY", {
         error: "network_error",
         delayMs,
@@ -656,6 +716,10 @@ async function getCompletionWithProfile(modelProfile, opts, attempt = 0, maxAtte
     });
   }
 }
+const STREAM_IDLE_TIMEOUT_MS = parseInt(
+  process.env.STREAM_IDLE_TIMEOUT_MS || String(120 * 1e3),
+  10
+);
 function createStreamProcessor(stream, signal) {
   if (!stream) {
     throw new Error("Stream is null or undefined");
@@ -671,7 +735,22 @@ function createStreamProcessor(stream, signal) {
         }
         let readResult;
         try {
-          readResult = await reader.read();
+          readResult = await Promise.race([
+            reader.read(),
+            new Promise((_, reject) => {
+              const timer = setTimeout(
+                () => reject(
+                  new Error(
+                    `Stream idle timeout: no data received for ${STREAM_IDLE_TIMEOUT_MS / 1e3}s`
+                  )
+                ),
+                STREAM_IDLE_TIMEOUT_MS
+              );
+              signal?.addEventListener("abort", () => clearTimeout(timer), {
+                once: true
+              });
+            })
+          ]);
         } catch (e) {
           if (signal?.aborted) {
             break;
@@ -742,7 +821,7 @@ function streamCompletion(stream, signal) {
 }
 async function callGPT5ResponsesAPI(modelProfile, opts, signal) {
   const baseURL = modelProfile?.baseURL || "https://api.openai.com/v1";
-  const apiKey = modelProfile?.apiKey;
+  const apiKey = await resolveModelApiKey(modelProfile);
   const proxy = getGlobalConfig().proxy ? new ProxyAgent(getGlobalConfig().proxy) : void 0;
   const headers = {
     "Content-Type": "application/json",
@@ -792,14 +871,6 @@ async function callGPT5ResponsesAPI(modelProfile, opts, signal) {
         // Balanced for most coding tasks
       };
     }
-    if (!responsesParams.instructions) {
-      responsesParams.instructions = `You are an expert programmer working in a terminal-based coding environment. Follow these guidelines:
-- Provide clear, concise code solutions
-- Use proper error handling and validation
-- Follow coding best practices and patterns
-- Explain complex logic when necessary
-- Focus on maintainable, readable code`;
-    }
   }
   try {
     const response = await fetch(`${baseURL}/responses`, {
@@ -883,7 +954,7 @@ ${mainContent}`;
     }
   };
 }
-async function getGPT5CompletionWithProfile(modelProfile, opts, attempt = 0, maxAttempts = 10, signal) {
+async function getGPT5CompletionWithProfile(modelProfile, opts, attempt = 0, maxAttempts = 5, signal) {
   const features = getModelFeatures(opts.model);
   const isOfficialOpenAI = !modelProfile.baseURL || modelProfile.baseURL.includes("api.openai.com");
   if (features.supportsResponsesAPI && !opts.stream && isOfficialOpenAI) {