@wrongstack/cli 0.301.0 → 0.302.2

package/dist/{chunk-O7XNGCRT.js → chunk-FJVCVZIV.js}

@@ -1,12 +1,12 @@
-import {
-  LOCAL_LLM_PRESETS,
-  runLiveProviderPicker
-} from "./chunk-MHF2IJDE.js";
 import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-PYTFS4MC.js";
+} from "./chunk-SSSJQVUY.js";
+import {
+  LOCAL_LLM_PRESETS,
+  runLiveProviderPicker
+} from "./chunk-C5NXM2SI.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -15,432 +15,717 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-PJHET45A.js";
+} from "./chunk-SZ42FYPT.js";
 
-// src/auth-menu/oauth-menu.ts
-import { color as color3 } from "@wrongstack/core/utils";
+// src/auth-menu/local.ts
+import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
+import { color as color2 } from "@wrongstack/core/utils";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
-// src/auth-menu/anthropic-oauth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { color } from "@wrongstack/core/utils";
-import { FetchError, ParseError } from "@wrongstack/core/types";
-var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
-var REDIRECT_PORT = 53692;
-var REDIRECT_HOST = "127.0.0.1";
-var REDIRECT_PATH = "/callback";
-var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
-var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-var CLAUDE_PROVIDER_ID = "anthropic-oauth";
-var CLAUDE_BASE_URL = "https://api.anthropic.com";
-function base64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function generatePkce() {
-  const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function buildAuthorizeUrl(challenge, verifier) {
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLIENT_ID,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: SCOPES,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    state: verifier
-  });
-  return `${AUTHORIZE_URL}?${params.toString()}`;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
+// src/auth-menu/auth-menu-audit.ts
+import { DefaultSecretScrubber } from "@wrongstack/core/security";
+var NOOP_AUDIT_LOGGER = {
+  emit: () => {
   }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
+};
+function decideAuthLocalEvents(opts) {
+  const events = [];
+  if (opts.probeSkip) {
+    events.push({
+      type: "auth.local.probe_skip",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      requestedShape: opts.probeSkip.shape
+    });
   }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
+  if (opts.probeFailedSave) {
+    events.push({
+      type: "auth.local.probe_failed_save",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      probeStatus: opts.probeFailedSave.status,
+      ...opts.probeFailedSave.detail !== void 0 ? { probeDetail: opts.probeFailedSave.detail } : {}
+    });
   }
-  return { code: value };
-}
-async function readTokens(res, op, url) {
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new FetchError({
-      message: `Claude token ${op} failed (${res.status}): ${text || res.statusText}`,
-      status: res.status,
-      context: { provider: "anthropic-oauth", op, url }
+  if (opts.newModels === null) return events;
+  const hadPriorAllowlist = opts.previousModels !== void 0 && opts.previousModels.length > 0;
+  if (hadPriorAllowlist && opts.newModels.length === 0) {
+    events.push({
+      type: "auth.local.clear",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      previousModels: opts.previousModels
     });
+    return events;
   }
-  const json = await res.json();
-  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-    throw new ParseError({
-      message: `Claude token ${op} response missing fields`,
-      source: "anthropic-oauth-token-response",
-      context: { op }
+  if (!hadPriorAllowlist && opts.newModels.length > 0) {
+    if (opts.previousModels !== void 0) {
+      events.push({
+        type: "auth.local.undo",
+        providerId: opts.providerId,
+        baseUrl: opts.baseUrl,
+        restoredModels: [...opts.newModels]
+      });
+    } else {
+      events.push({
+        type: "auth.local.add",
+        providerId: opts.providerId,
+        baseUrl: opts.baseUrl,
+        models: [...opts.newModels],
+        ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
+      });
+    }
+    return events;
+  }
+  if (hadPriorAllowlist && opts.newModels.length > 0) {
+    events.push({
+      type: "auth.local.add",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      models: [...opts.newModels],
+      ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
     });
+    return events;
   }
-  return {
-    access: json.access_token,
-    refresh: json.refresh_token,
-    expires: Date.now() + json.expires_in * 1e3
-  };
+  return events;
 }
-async function exchangeAuthorizationCode(code, state, verifier, signal) {
-  const res = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      state,
-      redirect_uri: REDIRECT_URI,
-      code_verifier: verifier
-    }),
-    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
+
+// src/auth-menu/helpers.ts
+async function loadProviders(deps) {
+  return loadConfigProviders(deps.profileConfigPath, deps.vault, {
+    warn: (msg) => deps.renderer.writeWarning(msg),
+    profileConfigPath: deps.profileConfigPath
   });
-  return readTokens(res, "exchange", TOKEN_URL);
 }
-async function fetchClaudeModels(accessToken, signal) {
-  try {
-    const res = await fetch(`${CLAUDE_BASE_URL}/v1/models?limit=100`, {
-      headers: {
-        accept: "application/json",
-        authorization: `Bearer ${accessToken}`,
-        "anthropic-version": "2023-06-01",
-        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20"
-      },
-      signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
-    });
-    if (!res.ok) return [];
-    const json = await res.json();
-    const ids = (json?.data ?? []).map((m) => m.id).filter((id) => typeof id === "string" && id.startsWith("claude-"));
-    return ids;
-  } catch {
-    return [];
+
+// src/auth-menu/shared.ts
+import { color } from "@wrongstack/core/utils";
+function renderProviderLine(renderer, id, cfg, idx) {
+  const keys = normalizeKeys(cfg);
+  const active = activeLabel(cfg, keys);
+  const firstKey = keys[0];
+  let summary;
+  if (keys.length === 0) {
+    summary = color.dim("(no keys)");
+  } else if (keys.length === 1) {
+    summary = maskedKey(firstKey?.apiKey ?? "");
+  } else {
+    const activeKeyObj = active != null ? keys.find((k) => k.label === active) : void 0;
+    summary = `${color.dim(`${keys.length} keys`)} ${color.dim("active:")} ${color.bold(active ?? "?")} ` + maskedKey(activeKeyObj?.apiKey ?? firstKey?.apiKey ?? "");
   }
+  const fam = cfg.family ? color.dim(`[${cfg.family}]`) : "";
+  const aliasHint = cfg.type && cfg.type !== id ? color.dim(`\u2192 ${cfg.type}`) : "";
+  renderer.write(
+    `    ${color.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
+`
+  );
 }
-async function runClaudeOAuthLogin(deps, opts = {}) {
-  const providerId = opts.providerId ?? CLAUDE_PROVIDER_ID;
-  const { verifier, challenge } = generatePkce();
-  const state = verifier;
-  const authorizeUrl = buildAuthorizeUrl(challenge, verifier);
-  const osc8 = (url) => `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
-  const ac = new AbortController();
-  const onSig = () => ac.abort();
-  const external = opts.signal;
-  const onExternalAbort = () => ac.abort();
-  if (external) {
-    if (external.aborted) ac.abort();
-    else external.addEventListener("abort", onExternalAbort, { once: true });
+function renderProviderHeader(renderer, providerId, cfg) {
+  const keys = normalizeKeys(cfg);
+  const active = activeLabel(cfg, keys);
+  renderer.write(
+    `
+${color.bold(providerId)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}
+`
+  );
+  const details = [
+    color.dim(`  type:    ${cfg.type ?? providerId}`),
+    color.dim(`  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}`),
+    color.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}`)
+  ];
+  if (cfg.envVars && cfg.envVars.length > 0) {
+    details.push(color.dim(`  envVars: ${cfg.envVars.join(", ")}`));
+  }
+  if (cfg.models && cfg.models.length > 0) {
+    details.push(color.dim(`  models:  ${cfg.models.join(", ")}`));
+  }
+  renderer.write(details.join("\n") + "\n");
+  if (keys.length === 0) {
+    renderer.write(color.dim("  (no keys saved)\n"));
   } else {
-    process.on("SIGINT", onSig);
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      if (key) renderKeyLine(renderer, key, i + 1, active);
+    }
   }
-  const server = await startLoopbackServer(state, [REDIRECT_PORT], ac.signal, REDIRECT_PATH, REDIRECT_HOST);
-  deps.renderer.write(
-    color.bold(`
-  Sign in with Claude \u2014 ${color.cyan(providerId)}
-`) + color.dim("  Uses your Claude Pro/Max subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Claude Code client is against\n") + color.amber("    Anthropic\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth anthropic") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
-`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${osc8(authorizeUrl)}
-`) + color.bold(`  ${"\u2500".repeat(56)}
-
-`)
+}
+function renderKeyLine(renderer, key, idx, active) {
+  const marker = key.label === active ? color.green("\u25CF") : color.dim("\u25CB");
+  renderer.write(
+    `  ${color.dim(`${idx}.`.padStart(4))} ${marker} ${key.label.padEnd(20)} ${maskedKey(key.apiKey)}  ${color.dim(key.createdAt)}
+`
   );
-  if (server.bound) {
-    openBrowser(authorizeUrl);
-    deps.renderer.write(
-      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim("  (Listening on http://localhost:53692 \u2014 press Ctrl+C to cancel.)\n")
-    );
-  } else {
-    deps.renderer.write(
-      color.amber("  \u26A0 Could not start the local callback listener (port 53692 in use).\n") + color.dim("  After signing in, paste the full redirect URL (or the code) below.\n")
-    );
+}
+function renderActions(renderer, keysLength) {
+  renderer.write(`
+  ${color.dim("Actions:")}
+`);
+  renderer.write(`    ${color.bold("a")}        Add another key
+`);
+  if (keysLength > 0) {
+    renderer.write(`    ${color.bold("u")} <n>    Update key <n>
+`);
+    renderer.write(`    ${color.bold("d")} <n>    Delete key <n>
+`);
+    renderer.write(`    ${color.bold("s")} <n>    Set key <n> as active
+`);
   }
-  let code;
-  try {
-    if (server.bound) {
-      const got = await server.waitForCode();
-      if (ac.signal.aborted) {
-        deps.renderer.write(color.dim("  Cancelled.\n"));
-        return 1;
-      }
-      if (got) code = got.code;
+  renderer.write(`    ${color.bold("f")}        Edit family
+`);
+  renderer.write(
+    `    ${color.bold("B")}        Edit baseUrl ${color.dim("(capital B \u2014 b is Back)")}
+`
+  );
+  renderer.write(`    ${color.bold("m")}        Edit visible model list
+`);
+  renderer.write(`    ${color.bold("x")}        Remove this provider entirely
+`);
+  renderer.write(`    ${color.bold("b")}        Back
+`);
+  renderer.write(`    ${color.bold("q")}        Quit
+`);
+}
+function renderTopMenu(renderer, providers) {
+  renderer.write(`
+${color.bold("WrongStack")} ${color.dim("\u2014 API key manager")}
+
+`);
+  const ids = Object.keys(providers).sort();
+  if (ids.length === 0) {
+    renderer.write(color.dim("  No providers configured yet.\n"));
+    renderer.write(
+      color.dim(
+        "  Use (a) to add one from the models.dev catalog, (l) for a local server, or (c) for a custom provider.\n"
+      )
+    );
+  } else {
+    renderer.write(`  ${color.dim("Saved providers:")}
+`);
+    let idx = 1;
+    for (const id of ids) {
+      const cfg = providers[id];
+      if (!cfg) continue;
+      renderProviderLine(renderer, id, cfg, idx);
+      idx++;
     }
-    if (!code) {
-      const input = (await deps.reader.readLine(
-        `
-  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
-      )).trim();
-      if (input.toLowerCase() === "q" || input === "") {
-        deps.renderer.write(color.dim("  Cancelled.\n"));
-        return 1;
-      }
-      const parsed = parseAuthorizationInput(input);
-      if (parsed.state && parsed.state !== state) {
-        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
-        return 1;
-      }
-      code = parsed.code;
+  }
+  renderer.write(`
+  ${color.dim("Actions:")}
+`);
+  renderer.write(`    ${color.bold("a")}  Add a provider (from catalog)
+`);
+  renderer.write(
+    `    ${color.bold("l")}  Add a local server ${color.dim("(OmniRoute / Ollama / vLLM / LM Studio)")}
+`
+  );
+  renderer.write(`    ${color.bold("c")}  Add a custom provider
+`);
+  renderer.write(
+    `    ${color.bold("s")}  Login with OAuth ${color.dim("(ChatGPT / Claude / Copilot)")}
+`
+  );
+  if (ids.length > 0) {
+    renderer.write(
+      `    ${color.dim("1-")}${color.dim(String(ids.length))}  ${color.bold("Manage a provider")}
+`
+    );
+  }
+  renderer.write(`    ${color.bold("q")}  Quit
+`);
+}
+async function readKeyInput(deps, intent) {
+  const key = (await deps.reader.readSecret(
+    `  ${color.amber("?")} ${intent} ${color.dim("(hidden, paste OK)")}: `
+  )).trim();
+  if (!key) {
+    deps.renderer.writeError("No key entered.");
+    return void 0;
+  }
+  return key;
+}
+async function confirm(deps, question) {
+  const answer = (await deps.reader.readLine(`  ${color.amber("?")} ${question} ${color.dim("[y/N/q]")} `)).trim().toLowerCase();
+  if (answer === "q" || answer === "quit") return null;
+  return answer === "y" || answer === "yes";
+}
+function suggestLabel(usedLabels) {
+  const candidate = "default";
+  if (!usedLabels.has(candidate)) return candidate;
+  let n = 2;
+  while (usedLabels.has(`key${n}`)) n++;
+  return `key${n}`;
+}
+function validateFamily(raw) {
+  const valid = ["anthropic", "openai", "openai-compatible", "google"];
+  return valid.includes(raw) ? raw : null;
+}
+
+// src/auth-menu/local.ts
+var PRESET_BY_ID = new Map(LOCAL_LLM_PRESETS.map((p) => [p.id, p]));
+async function runAuthLocal(deps, opts = {}) {
+  const scrubber = deps.secretScrubber ?? new DefaultSecretScrubber2();
+  const audit = opts.audit ?? NOOP_AUDIT_LOGGER;
+  const preset = opts.name ? PRESET_BY_ID.get(opts.name.toLowerCase()) : void 0;
+  if (opts.name && !preset) {
+    deps.renderer.writeError(
+      `Unknown local server "${opts.name}". Valid: ${LOCAL_LLM_PRESETS.map((p) => p.id).join(", ")}.`
+    );
+    return 1;
+  }
+  const chosen = preset ?? await pickLocalPreset(deps);
+  if (!chosen) {
+    return 0;
+  }
+  const baseUrl = opts.baseUrl?.trim() || chosen.defaultBaseUrl;
+  let apiKey;
+  if (opts.apiKey !== void 0) {
+    apiKey = opts.apiKey.trim() || void 0;
+  } else if (chosen.noAuth) {
+    apiKey = void 0;
+  } else if (opts.skipKey) {
+    apiKey = void 0;
+  } else {
+    apiKey = await promptOptionalKey(deps, chosen);
+  }
+  let probe;
+  let probeFailedAndSaved = false;
+  if (!opts.noProbe) {
+    probe = await probeLocalLlm({
+      baseUrl,
+      apiKey,
+      noAuth: chosen.noAuth,
+      presetLabel: chosen.label,
+      scrubber,
+      fetchImpl: opts.fetchImpl,
+      timeoutMs: opts.probeTimeoutMs
+    });
+    renderProbeResult(deps, probe);
+    if (opts.probeOnly) {
+      return 0;
     }
-    if (!code) {
-      deps.renderer.writeError("  No authorization code received.");
-      return 1;
+    if (!probe.ok) {
+      if (chosen.noAuth) {
+        deps.renderer.write(
+          color2.dim(
+            `  Saving ${chosen.label} anyway \u2014 keyless local gateway needs no key and discovers models when it comes up.
+`
+          )
+        );
+        probeFailedAndSaved = true;
+      } else {
+        const saveAnyway = await promptSaveAnyway(deps);
+        if (!saveAnyway) {
+          deps.renderer.write(color2.dim("  Cancelled. Nothing saved.\n"));
+          return 0;
+        }
+        probeFailedAndSaved = true;
+      }
     }
-    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
-    const tokens = await exchangeAuthorizationCode(code, state, verifier, ac.signal);
-    const models = await fetchClaudeModels(tokens.access, ac.signal);
-    const saved = await saveClaudeTokens(deps, providerId, tokens, models);
-    if (!saved) return 1;
-    deps.renderer.write(color.green("\n  \u2713 Signed in with Claude!\n"));
-    const modelHint = models[0];
-    deps.renderer.writeInfo(
-      `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
-` + (modelHint ? `  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
-` : `  No model list was discovered; choose a model before starting a run.
-`) + color.dim("  Tokens refresh automatically before they expire.\n")
+  }
+  const resolvedModels = resolveModelList(opts.models, probe, scrubber);
+  const label = opts.label?.trim() || "default";
+  const providers = await loadProviders(deps);
+  const existing = providers[chosen.id];
+  const previousModels = existing?.models ? [...existing.models] : existing?.models === void 0 ? void 0 : [...existing.models];
+  const usedLabels = new Set(existing ? normalizeKeys(existing).map((k) => k.label) : []);
+  let finalLabel = label;
+  if (usedLabels.has(finalLabel)) {
+    let n = 2;
+    while (usedLabels.has(`${label}-${n}`)) n++;
+    finalLabel = `${label}-${n}`;
+    deps.renderer.writeInfo(`Label collided; saving as "${finalLabel}".`);
+  }
+  try {
+    await mutateConfigProviders(
+      deps.profileConfigPath,
+      deps.vault,
+      (all) => {
+        const p = all[chosen.id] ?? { type: chosen.id };
+        if (!p.type) p.type = chosen.id;
+        if (!p.family) p.family = "openai-compatible";
+        if (!p.baseUrl) p.baseUrl = baseUrl;
+        if (!p.envVars) p.envVars = [];
+        if (resolvedModels !== null) {
+          p.models = [...resolvedModels];
+        }
+        if (apiKey) {
+          const list = normalizeKeys(p);
+          list.push({ label: finalLabel, apiKey, createdAt: nowIso() });
+          writeKeysBack(p, list);
+          if (!p.activeKey) p.activeKey = finalLabel;
+        }
+        all[chosen.id] = p;
+      },
+      deps.profileConfigPath
     );
-    return 0;
   } catch (err) {
-    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
-    deps.renderer.writeError(`  Login failed: ${msg}`);
+    deps.renderer.writeError(`Failed to save ${chosen.id}: ${err.message}`);
     return 1;
-  } finally {
-    server.close();
-    if (external) external.removeEventListener("abort", onExternalAbort);
-    else process.off("SIGINT", onSig);
   }
+  const events = decideAuthLocalEvents({
+    providerId: chosen.id,
+    baseUrl,
+    previousModels,
+    newModels: resolvedModels,
+    keyLabel: apiKey ? finalLabel : void 0,
+    probeFailedSave: probeFailedAndSaved && probe ? {
+      status: probe.status,
+      ...probe.detail !== void 0 ? { detail: probe.detail } : {}
+    } : void 0
+  });
+  for (const event of events) {
+    audit.emit(event);
+  }
+  if (apiKey) {
+    deps.renderer.write(
+      `  ${color2.green("\u2713")} Saved ${color2.bold(chosen.id)}/${color2.bold(finalLabel)} \u2192 ${color2.cyan(baseUrl)}
+`
+    );
+  } else {
+    deps.renderer.write(
+      `  ${color2.green("\u2713")} Saved ${color2.bold(chosen.id)} (no key) \u2192 ${color2.cyan(baseUrl)}
+`
+    );
+  }
+  const firstModel = resolvedModels && resolvedModels.length > 0 ? resolvedModels[0] : null;
+  const modelHint = firstModel ? color2.cyan(firstModel) : color2.dim("<model-id>");
+  deps.renderer.write(
+    color2.dim(`  Launch: wstack --provider ${chosen.id} --model ${modelHint} "<task>"
+`)
+  );
+  return 0;
 }
-async function saveClaudeTokens(deps, providerId, tokens, models) {
-  const entry = {
-    label: "oauth-default",
-    apiKey: tokens.access,
-    createdAt: nowIso(),
-    authMethod: "oauth",
-    expiresAt: new Date(tokens.expires).toISOString(),
-    refreshToken: tokens.refresh,
-    tokenType: "bearer",
-    scope: SCOPES
-  };
-  try {
-    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
-      const existing = all[providerId];
-      const p = existing ? { ...existing } : { type: providerId };
-      p.family = "anthropic-oauth";
-      if (!p.baseUrl) p.baseUrl = CLAUDE_BASE_URL;
-      if (models.length > 0) p.models = models;
-      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
-      keys.push(entry);
-      writeKeysBack(p, keys);
-      p.activeKey = entry.label;
-      all[providerId] = p;
-    }, deps.profileConfigPath);
-    return true;
-  } catch (err) {
-    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
-    return false;
+function resolveModelList(models, probe, scrubber) {
+  if (models === void 0) return null;
+  const trimmed = models.trim();
+  if (trimmed.length === 0) return [];
+  const hasProbeIds = probe?.status === "ok" && (probe.modelIds?.length ?? 0) > 0;
+  const probeIds = hasProbeIds ? probe?.modelIds ?? [] : [];
+  if (trimmed === "first") {
+    if (probeIds.length === 0) return null;
+    return [scrubber.scrub(probeIds[0])];
   }
+  if (/^\d+$/.test(trimmed)) {
+    if (probeIds.length === 0) return null;
+    const n = Math.min(Number.parseInt(trimmed, 10), probeIds.length);
+    return probeIds.slice(0, n).map((id) => scrubber.scrub(id));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of trimmed.split(",")) {
+    const id = scrubber.scrub(raw.trim());
+    if (id.length === 0) continue;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
 }
+function renderProbeResult(deps, probe, opts = {}) {
+  const label = opts.presetLabel ? ` ${color2.bold(opts.presetLabel)}` : "";
+  const elapsed = probe.elapsedMs !== void 0 ? ` ${color2.dim(`(${probe.elapsedMs}ms)`)}` : "";
+  switch (probe.status) {
+    case "ok": {
+      const models = probe.modelCount !== void 0 ? color2.dim(`, ${probe.modelCount} model${probe.modelCount === 1 ? "" : "s"}`) : "";
+      deps.renderer.write(`  ${color2.green("\u25CF")} ${label} health probe ok${models}${elapsed}
+`);
+      break;
+    }
+    case "timeout": {
+      deps.renderer.write(
+        `  ${color2.red("\u25CF")} ${label} health probe timed out${elapsed}
+    ${color2.dim("The server did not respond within the timeout.")}
+    ${color2.dim("Is the local server running? Check the port and try again.")}
+`
+      );
+      break;
+    }
+    case "unreachable": {
+      const detail = probe.detail ? ` ${color2.dim(`(${probe.detail})`)}` : "";
+      deps.renderer.write(
+        `  ${color2.red("\u25CF")} ${label} server unreachable${detail}
+    ${color2.dim("Could not connect. Common causes:")}
+    ${color2.dim("  - The local server is not running")}
+    ${color2.dim("  - The port is blocked by a firewall")}
+    ${color2.dim("  - The base URL is wrong")}
+`
+      );
+      break;
+    }
+    case "http_error": {
+      const status = probe.httpStatus !== void 0 ? ` HTTP ${probe.httpStatus}` : "";
+      const detail = probe.detail ? ` ${color2.dim(`\u2014 ${probe.detail}`)}` : "";
+      deps.renderer.write(`  ${color2.yellow("\u25CF")} ${label} health probe got${status}${detail}
+`);
+      break;
+    }
+    case "invalid_response": {
+      deps.renderer.write(
+        `  ${color2.yellow("\u25CF")} ${label} health probe returned an unexpected shape
+` + (probe.detail ? `    ${color2.dim(probe.detail)}
+` : "")
+      );
+      break;
+    }
+    case "skipped": {
+      break;
+    }
+  }
+}
+async function promptSaveAnyway(deps) {
+  const answer = (await deps.reader.readLine(
+    `
+${color2.amber("?")} ${color2.bold("Save anyway?")} ${color2.dim("[y/N]")}: `
+  )).trim().toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+async function pickLocalPreset(deps) {
+  deps.renderer.write(
+    `
+${color2.bold("Local LLM servers")} ${color2.dim("\u2014 pick one to pre-fill the base URL")}
 
-// src/auth-menu/github-copilot-oauth.ts
-import { color as color2 } from "@wrongstack/core/utils";
-import { FetchError as FetchError2, ParseError as ParseError2 } from "@wrongstack/core/types";
-import { copilotBaseUrlFromToken, refreshCopilotToken } from "@wrongstack/providers";
-var CLIENT_ID2 = "Iv1.b507a08c87ecfe98";
-var DEVICE_CODE_URL = "https://github.com/login/device/code";
-var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var COPILOT_HEADERS = {
-  "User-Agent": "GitHubCopilotChat/0.35.0",
-  "Editor-Version": "vscode/1.107.0",
-  "Editor-Plugin-Version": "copilot-chat/0.35.0",
-  "Copilot-Integration-Id": "vscode-chat"
-};
-var COPILOT_API_VERSION = "2026-06-01";
-var COPILOT_PROVIDER_ID = "github-copilot";
-function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
-    if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
-    const t = setTimeout(resolve, ms);
-    signal.addEventListener(
-      "abort",
-      () => {
-        clearTimeout(t);
-        reject(new DOMException("Aborted", "AbortError"));
-      },
-      { once: true }
+`
+  );
+  let idx = 1;
+  for (const entry of LOCAL_LLM_PRESETS) {
+    const auth = entry.noAuth ? color2.dim("(no auth)") : color2.dim("(optional auth)");
+    deps.renderer.write(
+      `    ${color2.dim(`${idx}.`.padStart(4))} ${color2.bold(entry.label.padEnd(12))} ${color2.cyan(entry.defaultBaseUrl.padEnd(34))} ${auth}
+`
     );
-  });
+    deps.renderer.write(`        ${color2.dim(entry.hint)}
+`);
+    idx++;
+  }
+  const answer = (await deps.reader.readLine(
+    `
+${color2.amber("?")} Pick ${color2.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to quit)`)}: `
+  )).trim().toLowerCase();
+  if (!answer || answer === "q" || answer === "quit") return void 0;
+  const num = Number.parseInt(answer, 10);
+  if (!Number.isNaN(num) && num >= 1 && num <= LOCAL_LLM_PRESETS.length) {
+    return LOCAL_LLM_PRESETS[num - 1];
+  }
+  const byId = LOCAL_LLM_PRESETS.find((p) => p.id === answer);
+  if (byId) return byId;
+  deps.renderer.writeError(`Unknown selection: "${answer}"`);
+  return void 0;
 }
-async function startDeviceFlow(signal) {
-  const res = await fetch(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: {
-      accept: "application/json",
-      "content-type": "application/x-www-form-urlencoded",
-      "user-agent": COPILOT_HEADERS["User-Agent"]
-    },
-    body: new URLSearchParams({ client_id: CLIENT_ID2, scope: "read:user" }).toString(),
-    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15e3)]) : AbortSignal.timeout(15e3)
+async function promptOptionalKey(deps, preset) {
+  const answer = (await deps.reader.readSecret(
+    `  ${color2.amber("?")} ${color2.bold(preset.label)} API key ${color2.dim("(hidden \u2014 Enter to skip if auth is disabled on the server)")}: `
+  )).trim();
+  if (!answer) return void 0;
+  return answer;
+}
+
+// src/auth-menu/oauth-menu.ts
+import { color as color5 } from "@wrongstack/core/utils";
+
+// src/auth-menu/anthropic-oauth.ts
+import { createHash, randomBytes } from "node:crypto";
+import {
+  FetchError,
+  ParseError
+} from "@wrongstack/core/types";
+import { color as color3 } from "@wrongstack/core/utils";
+var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+var REDIRECT_PORT = 53692;
+var REDIRECT_HOST = "127.0.0.1";
+var REDIRECT_PATH = "/callback";
+var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
+var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+var CLAUDE_PROVIDER_ID = "anthropic-oauth";
+var CLAUDE_BASE_URL = "https://api.anthropic.com";
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function buildAuthorizeUrl(challenge, verifier) {
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLIENT_ID,
+    response_type: "code",
+    redirect_uri: REDIRECT_URI,
+    scope: SCOPES,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state: verifier
   });
+  return `${AUTHORIZE_URL}?${params.toString()}`;
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value) return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? void 0,
+      state: url.searchParams.get("state") ?? void 0
+    };
+  } catch {
+  }
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    return { code, state };
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0
+    };
+  }
+  return { code: value };
+}
+async function readTokens(res, op, url) {
   if (!res.ok) {
-    throw new FetchError2({
-      message: `GitHub device-code request failed (${res.status})`,
+    const text = await res.text().catch(() => "");
+    throw new FetchError({
+      message: `Claude token ${op} failed (${res.status}): ${text || res.statusText}`,
       status: res.status,
-      context: { provider: "github-copilot", op: "device-code", url: DEVICE_CODE_URL }
+      context: { provider: "anthropic-oauth", op, url }
     });
   }
   const json = await res.json();
-  if (!json?.device_code || !json.user_code || !json.verification_uri || typeof json.expires_in !== "number") {
-    throw new ParseError2({
-      message: "Invalid device-code response",
-      source: "github-copilot-device-code-response"
+  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    throw new ParseError({
+      message: `Claude token ${op} response missing fields`,
+      source: "anthropic-oauth-token-response",
+      context: { op }
     });
   }
   return {
-    device_code: json.device_code,
-    user_code: json.user_code,
-    verification_uri: json.verification_uri,
-    interval: json.interval ?? 5,
-    expires_in: json.expires_in
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1e3
   };
 }
-async function pollForGitHubToken(device, signal) {
-  let intervalMs = device.interval * 1e3;
-  const expiresAt = Date.now() + device.expires_in * 1e3;
-  while (Date.now() < expiresAt) {
-    await sleep(intervalMs, signal);
-    const res = await fetch(ACCESS_TOKEN_URL, {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/x-www-form-urlencoded",
-        "user-agent": COPILOT_HEADERS["User-Agent"]
-      },
-      body: new URLSearchParams({
-        client_id: CLIENT_ID2,
-        device_code: device.device_code,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-      }).toString(),
-      signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
-    });
-    const json = await res.json().catch(() => ({}));
-    if (json.access_token) return json.access_token;
-    if (json.error === "authorization_pending") continue;
-    if (json.error === "slow_down") {
-      intervalMs += 5e3;
-      continue;
-    }
-    throw new Error(`Device flow failed: ${json.error ?? "unknown error"}`);
-  }
-  throw new FetchError2({
-    message: "Device code expired \u2014 please restart the login.",
-    status: 408,
-    // Request Timeout
-    context: { provider: "github-copilot", op: "device-code-poll", reason: "expired" }
+async function exchangeAuthorizationCode(code, state, verifier, signal) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      state,
+      redirect_uri: REDIRECT_URI,
+      code_verifier: verifier
+    }),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
   });
+  return readTokens(res, "exchange", TOKEN_URL);
 }
-function isUsableCopilotChatModel(item) {
-  if (typeof item.id !== "string" || item.id.length === 0) return false;
-  const cap = item.capabilities;
-  if (cap?.type !== "chat") return false;
-  if (cap.supports?.tool_calls !== true) return false;
-  const eps = item.supported_endpoints;
-  if (Array.isArray(eps) && !eps.includes("/chat/completions")) return false;
-  if (item.policy?.state === "disabled") return false;
-  if (item.vendor === "Experimental") return false;
-  return true;
-}
-async function fetchCopilotModels(copilotToken, signal) {
+async function fetchClaudeModels(accessToken, signal) {
   try {
-    const base = copilotBaseUrlFromToken(copilotToken);
-    const res = await fetch(`${base}/models`, {
+    const res = await fetch(`${CLAUDE_BASE_URL}/v1/models?limit=100`, {
       headers: {
         accept: "application/json",
-        authorization: `Bearer ${copilotToken}`,
-        "X-GitHub-Api-Version": COPILOT_API_VERSION,
-        ...COPILOT_HEADERS
+        authorization: `Bearer ${accessToken}`,
+        "anthropic-version": "2023-06-01",
+        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20"
       },
       signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
     });
     if (!res.ok) return [];
     const json = await res.json();
-    const data = json?.data;
-    if (!Array.isArray(data)) return [];
-    const usable = data.filter(isUsableCopilotChatModel);
-    usable.sort((a, b) => copilotModelRank(a) - copilotModelRank(b));
-    return usable.map((m) => m.id);
+    const ids = (json?.data ?? []).map((m) => m.id).filter((id) => typeof id === "string" && id.startsWith("claude-"));
+    return ids;
   } catch {
     return [];
   }
 }
-function copilotModelRank(item) {
-  if (item.is_chat_default === true) return 0;
-  if (item.is_chat_fallback === true) return 1;
-  return 2;
-}
-async function runCopilotOAuthLogin(deps, opts = {}) {
-  const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
+async function runClaudeOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? CLAUDE_PROVIDER_ID;
+  const { verifier, challenge } = generatePkce();
+  const state = verifier;
+  const authorizeUrl = buildAuthorizeUrl(challenge, verifier);
+  const osc8 = (url) => `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
   const ac = new AbortController();
   const onSig = () => ac.abort();
-  const onExternalAbort = () => ac.abort();
   const external = opts.signal;
+  const onExternalAbort = () => ac.abort();
   if (external) {
     if (external.aborted) ac.abort();
     else external.addEventListener("abort", onExternalAbort, { once: true });
   } else {
     process.on("SIGINT", onSig);
   }
-  try {
-    deps.renderer.write(
-      color2.bold(`
-  Sign in with GitHub Copilot \u2014 ${color2.cyan(providerId)}
-`) + color2.dim("  Uses your GitHub Copilot subscription (not an API key).\n") + color2.amber("  \u26A0 Using Copilot outside its official editor integrations may violate\n") + color2.amber("    GitHub\u2019s Terms \u2014 your account could be rate-limited or banned.\n\n")
-    );
-    const device = await startDeviceFlow(ac.signal);
-    deps.renderer.write(
-      color2.bold(`  ${"\u2500".repeat(56)}
-`) + color2.bold("  Open this URL and enter the code:\n") + color2.cyan(`  ${device.verification_uri}
-`) + color2.bold("  Code: ") + color2.green(color2.bold(device.user_code)) + "\n" + color2.bold(`  ${"\u2500".repeat(56)}
+  const server = await startLoopbackServer(
+    state,
+    [REDIRECT_PORT],
+    ac.signal,
+    REDIRECT_PATH,
+    REDIRECT_HOST
+  );
+  deps.renderer.write(
+    color3.bold(`
+  Sign in with Claude \u2014 ${color3.cyan(providerId)}
+`) + color3.dim("  Uses your Claude Pro/Max subscription (not an API key).\n") + color3.amber("  \u26A0 Using a subscription outside the official Claude Code client is against\n") + color3.amber("    Anthropic\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color3.dim("    Sanctioned programmatic use = an API key: ") + color3.bold("wstack auth anthropic") + color3.dim("\n\n") + color3.bold(`  ${"\u2500".repeat(56)}
+`) + color3.bold("  Open this URL in your browser to sign in:\n") + color3.cyan(`  ${osc8(authorizeUrl)}
+`) + color3.bold(`  ${"\u2500".repeat(56)}
 
 `)
+  );
+  if (server.bound) {
+    openBrowser(authorizeUrl);
+    deps.renderer.write(
+      color3.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color3.dim("  (Listening on http://localhost:53692 \u2014 press Ctrl+C to cancel.)\n")
     );
-    openBrowser(device.verification_uri);
-    deps.renderer.write(color2.dim("  Waiting for you to authorize in the browser...\n"));
-    const githubToken = await pollForGitHubToken(device, ac.signal);
-    deps.renderer.write(color2.dim("  Authorized. Fetching your Copilot token...\n"));
-    const copilot = await refreshCopilotToken(githubToken, ac.signal);
-    const models = await fetchCopilotModels(copilot.token, ac.signal);
-    const saved = await saveCopilotTokens(
-      deps,
-      providerId,
-      copilot.token,
-      githubToken,
-      copilot.expires,
-      models
+  } else {
+    deps.renderer.write(
+      color3.amber("  \u26A0 Could not start the local callback listener (port 53692 in use).\n") + color3.dim("  After signing in, paste the full redirect URL (or the code) below.\n")
     );
+  }
+  let code;
+  try {
+    if (server.bound) {
+      const got = await server.waitForCode();
+      if (ac.signal.aborted) {
+        deps.renderer.write(color3.dim("  Cancelled.\n"));
+        return 1;
+      }
+      if (got) code = got.code;
+    }
+    if (!code) {
+      const input = (await deps.reader.readLine(
+        `
+  ${color3.amber("?")} Paste the redirect URL or code ${color3.dim("(or q to cancel)")}: `
+      )).trim();
+      if (input.toLowerCase() === "q" || input === "") {
+        deps.renderer.write(color3.dim("  Cancelled.\n"));
+        return 1;
+      }
+      const parsed = parseAuthorizationInput(input);
+      if (parsed.state && parsed.state !== state) {
+        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
+        return 1;
+      }
+      code = parsed.code;
+    }
+    if (!code) {
+      deps.renderer.writeError("  No authorization code received.");
+      return 1;
+    }
+    deps.renderer.write(color3.dim("\n  Exchanging authorization code for tokens...\n"));
+    const tokens = await exchangeAuthorizationCode(code, state, verifier, ac.signal);
+    const models = await fetchClaudeModels(tokens.access, ac.signal);
+    const saved = await saveClaudeTokens(deps, providerId, tokens, models);
     if (!saved) return 1;
-    deps.renderer.write(color2.green("\n  \u2713 Signed in with GitHub Copilot!\n"));
-    const modelHint = models[0] ?? "gpt-4o";
+    deps.renderer.write(color3.green("\n  \u2713 Signed in with Claude!\n"));
+    const modelHint = models[0];
     deps.renderer.writeInfo(
-      `  Saved as provider ${color2.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
-  Use: ${color2.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
-` + color2.dim("  The Copilot token refreshes automatically.\n")
+      `  Saved as provider ${color3.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
+` + (modelHint ? `  Use: ${color3.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` : `  No model list was discovered; choose a model before starting a run.
+`) + color3.dim("  Tokens refresh automatically before they expire.\n")
     );
     return 0;
   } catch (err) {
@@ -448,602 +733,351 @@ async function runCopilotOAuthLogin(deps, opts = {}) {
     deps.renderer.writeError(`  Login failed: ${msg}`);
     return 1;
   } finally {
-    if (external) {
-      external.removeEventListener("abort", onExternalAbort);
-    } else {
-      process.off("SIGINT", onSig);
-    }
+    server.close();
+    if (external) external.removeEventListener("abort", onExternalAbort);
+    else process.off("SIGINT", onSig);
   }
 }
-async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
+async function saveClaudeTokens(deps, providerId, tokens, models) {
   const entry = {
     label: "oauth-default",
-    apiKey: copilotToken,
+    apiKey: tokens.access,
     createdAt: nowIso(),
     authMethod: "oauth",
-    expiresAt: new Date(expires).toISOString(),
-    refreshToken: githubToken,
-    tokenType: "bearer"
+    expiresAt: new Date(tokens.expires).toISOString(),
+    refreshToken: tokens.refresh,
+    tokenType: "bearer",
+    scope: SCOPES
   };
   try {
-    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
-      const existing = all[providerId];
-      const p = existing ? { ...existing } : { type: providerId };
-      p.family = "github-copilot";
-      if (!p.baseUrl) p.baseUrl = copilotBaseUrlFromToken(copilotToken);
-      if (models.length > 0) p.models = models;
-      else if (!p.models || p.models.length === 0) p.models = ["gpt-4o"];
-      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
-      keys.push(entry);
-      writeKeysBack(p, keys);
-      p.activeKey = entry.label;
-      all[providerId] = p;
-    }, deps.profileConfigPath);
-    return true;
-  } catch (err) {
-    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
-    return false;
-  }
-}
-
-// src/auth-menu/oauth-menu.ts
-function renderOAuthLoginOptions(deps, indent = "    ") {
-  deps.renderer.write(
-    `${indent}${color3.bold("OAuth login options")} ${color3.dim("(subscription sign-in)")}
-${indent}${color3.bold("chatgpt")}  ChatGPT Plus/Pro  ${color3.dim("(\u2192 openai-codex)")}
-${indent}${color3.bold("claude")}   Claude Pro/Max    ${color3.dim("(\u2192 anthropic-oauth)")}
-${indent}${color3.bold("copilot")}  GitHub Copilot    ${color3.dim("(\u2192 github-copilot)")}
-`
-  );
-}
-var OAUTH_ALIASES = {
-  chatgpt: ["chatgpt", "openai", "codex", "codex-cli", "openai-codex", "chatgpt-plus", "plus", "pro"],
-  claude: ["claude", "anthropic", "claude-pro", "claude-max", "anthropic-oauth", "max"],
-  copilot: ["copilot", "github", "gh", "github-copilot"]
-};
-var OAUTH_NUMERIC = { "1": "chatgpt", "2": "claude", "3": "copilot" };
-function resolveOAuthKind(choice, opts = {}) {
-  const pick = choice.trim().toLowerCase();
-  if (!pick) return void 0;
-  if (opts.allowNumeric !== false && OAUTH_NUMERIC[pick]) return OAUTH_NUMERIC[pick];
-  for (const [kind, aliases] of Object.entries(OAUTH_ALIASES)) {
-    if (aliases.includes(pick)) return kind;
-  }
-  return void 0;
-}
-async function runOAuthLoginChoice(deps, choice, opts = {}) {
-  const kind = resolveOAuthKind(choice, opts);
-  if (!kind) return false;
-  await runOAuthLoginKind(deps, kind);
-  return true;
-}
-async function runOAuthLoginKind(deps, kind) {
-  if (kind === "claude") return runClaudeOAuthLogin(deps);
-  if (kind === "copilot") return runCopilotOAuthLogin(deps);
-  return runCodexOAuthLogin(deps);
-}
-async function runOAuthLoginMenu(deps) {
-  deps.renderer.write(
-    `
-  ${color3.bold("Login with OAuth:")}
-` + color3.amber("  \u26A0 Subscription tokens used outside official clients may violate provider\n") + color3.amber("    Terms \u2014 your account could be rate-limited or banned. An API key is the\n") + color3.dim("    sanctioned path for programmatic use.\n") + `    ${color3.bold("1")}  ChatGPT Plus/Pro  ${color3.dim("(\u2192 openai-codex)")}
-    ${color3.bold("2")}  Claude Pro/Max    ${color3.dim("(\u2192 anthropic-oauth)")}
-    ${color3.bold("3")}  GitHub Copilot    ${color3.dim("(\u2192 github-copilot)")}
-`
-  );
-  const pick = await deps.reader.readLine(`  ${color3.amber("?")} Pick ${color3.dim("(or b to go back)")}: `);
-  await runOAuthLoginChoice(deps, pick);
-}
-
-// src/auth-menu/local.ts
-import { color as color5 } from "@wrongstack/core/utils";
-import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
-
-// src/auth-menu/helpers.ts
-async function loadProviders(deps) {
-  return loadConfigProviders(deps.profileConfigPath, deps.vault, {
-    warn: (msg) => deps.renderer.writeWarning(msg),
-    profileConfigPath: deps.profileConfigPath
-  });
-}
-
-// src/auth-menu/shared.ts
-import { color as color4 } from "@wrongstack/core/utils";
-function renderProviderLine(renderer, id, cfg, idx) {
-  const keys = normalizeKeys(cfg);
-  const active = activeLabel(cfg, keys);
-  const firstKey = keys[0];
-  let summary;
-  if (keys.length === 0) {
-    summary = color4.dim("(no keys)");
-  } else if (keys.length === 1) {
-    summary = maskedKey(firstKey?.apiKey ?? "");
-  } else {
-    const activeKeyObj = active != null ? keys.find((k) => k.label === active) : void 0;
-    summary = `${color4.dim(`${keys.length} keys`)} ${color4.dim("active:")} ${color4.bold(active ?? "?")} ` + maskedKey(activeKeyObj?.apiKey ?? firstKey?.apiKey ?? "");
-  }
-  const fam = cfg.family ? color4.dim(`[${cfg.family}]`) : "";
-  const aliasHint = cfg.type && cfg.type !== id ? color4.dim(`\u2192 ${cfg.type}`) : "";
-  renderer.write(
-    `    ${color4.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
-`
-  );
-}
-function renderProviderHeader(renderer, providerId, cfg) {
-  const keys = normalizeKeys(cfg);
-  const active = activeLabel(cfg, keys);
-  renderer.write(
-    `
-${color4.bold(providerId)} ${cfg.family ? color4.dim(`[${cfg.family}]`) : color4.amber("[no family]")}
-`
-  );
-  const details = [
-    color4.dim(`  type:    ${cfg.type ?? providerId}`),
-    color4.dim(`  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}`),
-    color4.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}`)
-  ];
-  if (cfg.envVars && cfg.envVars.length > 0) {
-    details.push(color4.dim(`  envVars: ${cfg.envVars.join(", ")}`));
-  }
-  if (cfg.models && cfg.models.length > 0) {
-    details.push(color4.dim(`  models:  ${cfg.models.join(", ")}`));
-  }
-  renderer.write(details.join("\n") + "\n");
-  if (keys.length === 0) {
-    renderer.write(color4.dim("  (no keys saved)\n"));
-  } else {
-    for (let i = 0; i < keys.length; i++) {
-      const key = keys[i];
-      if (key) renderKeyLine(renderer, key, i + 1, active);
-    }
-  }
-}
-function renderKeyLine(renderer, key, idx, active) {
-  const marker = key.label === active ? color4.green("\u25CF") : color4.dim("\u25CB");
-  renderer.write(
-    `  ${color4.dim(`${idx}.`.padStart(4))} ${marker} ${key.label.padEnd(20)} ${maskedKey(key.apiKey)}  ${color4.dim(key.createdAt)}
-`
-  );
-}
-function renderActions(renderer, keysLength) {
-  renderer.write(`
-  ${color4.dim("Actions:")}
-`);
-  renderer.write(`    ${color4.bold("a")}        Add another key
-`);
-  if (keysLength > 0) {
-    renderer.write(`    ${color4.bold("u")} <n>    Update key <n>
-`);
-    renderer.write(`    ${color4.bold("d")} <n>    Delete key <n>
-`);
-    renderer.write(`    ${color4.bold("s")} <n>    Set key <n> as active
-`);
-  }
-  renderer.write(`    ${color4.bold("f")}        Edit family
-`);
-  renderer.write(`    ${color4.bold("B")}        Edit baseUrl ${color4.dim("(capital B \u2014 b is Back)")}
-`);
-  renderer.write(`    ${color4.bold("m")}        Edit visible model list
-`);
-  renderer.write(`    ${color4.bold("x")}        Remove this provider entirely
-`);
-  renderer.write(`    ${color4.bold("b")}        Back
-`);
-  renderer.write(`    ${color4.bold("q")}        Quit
-`);
-}
-function renderTopMenu(renderer, providers) {
-  renderer.write(`
-${color4.bold("WrongStack")} ${color4.dim("\u2014 API key manager")}
-
-`);
-  const ids = Object.keys(providers).sort();
-  if (ids.length === 0) {
-    renderer.write(color4.dim("  No providers configured yet.\n"));
-    renderer.write(
-      color4.dim(
-        "  Use (a) to add one from the models.dev catalog, (l) for a local server, or (c) for a custom provider.\n"
-      )
-    );
-  } else {
-    renderer.write(`  ${color4.dim("Saved providers:")}
-`);
-    let idx = 1;
-    for (const id of ids) {
-      const cfg = providers[id];
-      if (!cfg) continue;
-      renderProviderLine(renderer, id, cfg, idx);
-      idx++;
-    }
-  }
-  renderer.write(`
-  ${color4.dim("Actions:")}
-`);
-  renderer.write(`    ${color4.bold("a")}  Add a provider (from catalog)
-`);
-  renderer.write(
-    `    ${color4.bold("l")}  Add a local server ${color4.dim("(OmniRoute / Ollama / vLLM / LM Studio)")}
-`
-  );
-  renderer.write(`    ${color4.bold("c")}  Add a custom provider
-`);
-  renderer.write(
-    `    ${color4.bold("s")}  Login with OAuth ${color4.dim("(ChatGPT / Claude / Copilot)")}
-`
-  );
-  if (ids.length > 0) {
-    renderer.write(
-      `    ${color4.dim("1-")}${color4.dim(String(ids.length))}  ${color4.bold("Manage a provider")}
-`
+    await mutateConfigProviders(
+      deps.profileConfigPath,
+      deps.vault,
+      (all) => {
+        const existing = all[providerId];
+        const p = existing ? { ...existing } : { type: providerId };
+        p.family = "anthropic-oauth";
+        if (!p.baseUrl) p.baseUrl = CLAUDE_BASE_URL;
+        if (models.length > 0) p.models = models;
+        const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+        keys.push(entry);
+        writeKeysBack(p, keys);
+        p.activeKey = entry.label;
+        all[providerId] = p;
+      },
+      deps.profileConfigPath
     );
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
   }
-  renderer.write(`    ${color4.bold("q")}  Quit
-`);
-}
-async function readKeyInput(deps, intent) {
-  const key = (await deps.reader.readSecret(
-    `  ${color4.amber("?")} ${intent} ${color4.dim("(hidden, paste OK)")}: `
-  )).trim();
-  if (!key) {
-    deps.renderer.writeError("No key entered.");
-    return void 0;
-  }
-  return key;
-}
-async function confirm(deps, question) {
-  const answer = (await deps.reader.readLine(`  ${color4.amber("?")} ${question} ${color4.dim("[y/N/q]")} `)).trim().toLowerCase();
-  if (answer === "q" || answer === "quit") return null;
-  return answer === "y" || answer === "yes";
-}
-function suggestLabel(usedLabels) {
-  const candidate = "default";
-  if (!usedLabels.has(candidate)) return candidate;
-  let n = 2;
-  while (usedLabels.has(`key${n}`)) n++;
-  return `key${n}`;
-}
-function validateFamily(raw) {
-  const valid = ["anthropic", "openai", "openai-compatible", "google"];
-  return valid.includes(raw) ? raw : null;
 }
 
-// src/auth-menu/local.ts
-import { probeLocalLlm } from "@wrongstack/runtime/probe";
-
-// src/auth-menu/auth-menu-audit.ts
-import { DefaultSecretScrubber } from "@wrongstack/core/security";
-var NOOP_AUDIT_LOGGER = {
-  emit: () => {
-  }
+// src/auth-menu/github-copilot-oauth.ts
+import {
+  FetchError as FetchError2,
+  ParseError as ParseError2
+} from "@wrongstack/core/types";
+import { color as color4 } from "@wrongstack/core/utils";
+import { copilotBaseUrlFromToken, refreshCopilotToken } from "@wrongstack/providers";
+var CLIENT_ID2 = "Iv1.b507a08c87ecfe98";
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var COPILOT_HEADERS = {
+  "User-Agent": "GitHubCopilotChat/0.35.0",
+  "Editor-Version": "vscode/1.107.0",
+  "Editor-Plugin-Version": "copilot-chat/0.35.0",
+  "Copilot-Integration-Id": "vscode-chat"
 };
-function decideAuthLocalEvents(opts) {
-  const events = [];
-  if (opts.probeSkip) {
-    events.push({
-      type: "auth.local.probe_skip",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      requestedShape: opts.probeSkip.shape
-    });
-  }
-  if (opts.probeFailedSave) {
-    events.push({
-      type: "auth.local.probe_failed_save",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      probeStatus: opts.probeFailedSave.status,
-      ...opts.probeFailedSave.detail !== void 0 ? { probeDetail: opts.probeFailedSave.detail } : {}
-    });
-  }
-  if (opts.newModels === null) return events;
-  const hadPriorAllowlist = opts.previousModels !== void 0 && opts.previousModels.length > 0;
-  if (hadPriorAllowlist && opts.newModels.length === 0) {
-    events.push({
-      type: "auth.local.clear",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      previousModels: opts.previousModels
+var COPILOT_API_VERSION = "2026-06-01";
+var COPILOT_PROVIDER_ID = "github-copilot";
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
+    const t = setTimeout(resolve, ms);
+    signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new DOMException("Aborted", "AbortError"));
+      },
+      { once: true }
+    );
+  });
+}
+async function startDeviceFlow(signal) {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/x-www-form-urlencoded",
+      "user-agent": COPILOT_HEADERS["User-Agent"]
+    },
+    body: new URLSearchParams({ client_id: CLIENT_ID2, scope: "read:user" }).toString(),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15e3)]) : AbortSignal.timeout(15e3)
+  });
+  if (!res.ok) {
+    throw new FetchError2({
+      message: `GitHub device-code request failed (${res.status})`,
+      status: res.status,
+      context: { provider: "github-copilot", op: "device-code", url: DEVICE_CODE_URL }
     });
-    return events;
-  }
-  if (!hadPriorAllowlist && opts.newModels.length > 0) {
-    if (opts.previousModels !== void 0) {
-      events.push({
-        type: "auth.local.undo",
-        providerId: opts.providerId,
-        baseUrl: opts.baseUrl,
-        restoredModels: [...opts.newModels]
-      });
-    } else {
-      events.push({
-        type: "auth.local.add",
-        providerId: opts.providerId,
-        baseUrl: opts.baseUrl,
-        models: [...opts.newModels],
-        ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
-      });
-    }
-    return events;
   }
-  if (hadPriorAllowlist && opts.newModels.length > 0) {
-    events.push({
-      type: "auth.local.add",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      models: [...opts.newModels],
-      ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
+  const json = await res.json();
+  if (!json?.device_code || !json.user_code || !json.verification_uri || typeof json.expires_in !== "number") {
+    throw new ParseError2({
+      message: "Invalid device-code response",
+      source: "github-copilot-device-code-response"
     });
-    return events;
   }
-  return events;
+  return {
+    device_code: json.device_code,
+    user_code: json.user_code,
+    verification_uri: json.verification_uri,
+    interval: json.interval ?? 5,
+    expires_in: json.expires_in
+  };
 }
-
-// src/auth-menu/local.ts
-var PRESET_BY_ID = new Map(LOCAL_LLM_PRESETS.map((p) => [p.id, p]));
-async function runAuthLocal(deps, opts = {}) {
-  const scrubber = deps.secretScrubber ?? new DefaultSecretScrubber2();
-  const audit = opts.audit ?? NOOP_AUDIT_LOGGER;
-  const preset = opts.name ? PRESET_BY_ID.get(opts.name.toLowerCase()) : void 0;
-  if (opts.name && !preset) {
-    deps.renderer.writeError(
-      `Unknown local server "${opts.name}". Valid: ${LOCAL_LLM_PRESETS.map((p) => p.id).join(", ")}.`
-    );
-    return 1;
-  }
-  const chosen = preset ?? await pickLocalPreset(deps);
-  if (!chosen) {
-    return 0;
-  }
-  const baseUrl = opts.baseUrl?.trim() || chosen.defaultBaseUrl;
-  let apiKey;
-  if (opts.apiKey !== void 0) {
-    apiKey = opts.apiKey.trim() || void 0;
-  } else if (chosen.noAuth) {
-    apiKey = void 0;
-  } else if (opts.skipKey) {
-    apiKey = void 0;
-  } else {
-    apiKey = await promptOptionalKey(deps, chosen);
-  }
-  let probe;
-  let probeFailedAndSaved = false;
-  if (!opts.noProbe) {
-    probe = await probeLocalLlm({
-      baseUrl,
-      apiKey,
-      noAuth: chosen.noAuth,
-      presetLabel: chosen.label,
-      scrubber,
-      fetchImpl: opts.fetchImpl,
-      timeoutMs: opts.probeTimeoutMs
+async function pollForGitHubToken(device, signal) {
+  let intervalMs = device.interval * 1e3;
+  const expiresAt = Date.now() + device.expires_in * 1e3;
+  while (Date.now() < expiresAt) {
+    await sleep(intervalMs, signal);
+    const res = await fetch(ACCESS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded",
+        "user-agent": COPILOT_HEADERS["User-Agent"]
+      },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID2,
+        device_code: device.device_code,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }).toString(),
+      signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
     });
-    renderProbeResult(deps, probe);
-    if (opts.probeOnly) {
-      return 0;
-    }
-    if (!probe.ok) {
-      if (chosen.noAuth) {
-        deps.renderer.write(
-          color5.dim(
-            `  Saving ${chosen.label} anyway \u2014 keyless local gateway needs no key and discovers models when it comes up.
-`
-          )
-        );
-        probeFailedAndSaved = true;
-      } else {
-        const saveAnyway = await promptSaveAnyway(deps);
-        if (!saveAnyway) {
-          deps.renderer.write(color5.dim("  Cancelled. Nothing saved.\n"));
-          return 0;
-        }
-        probeFailedAndSaved = true;
-      }
+    const json = await res.json().catch(() => ({}));
+    if (json.access_token) return json.access_token;
+    if (json.error === "authorization_pending") continue;
+    if (json.error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
     }
+    throw new Error(`Device flow failed: ${json.error ?? "unknown error"}`);
   }
-  const resolvedModels = resolveModelList(opts.models, probe, scrubber);
-  const label = opts.label?.trim() || "default";
-  const providers = await loadProviders(deps);
-  const existing = providers[chosen.id];
-  const previousModels = existing?.models ? [...existing.models] : existing?.models === void 0 ? void 0 : [...existing.models];
-  const usedLabels = new Set(existing ? normalizeKeys(existing).map((k) => k.label) : []);
-  let finalLabel = label;
-  if (usedLabels.has(finalLabel)) {
-    let n = 2;
-    while (usedLabels.has(`${label}-${n}`)) n++;
-    finalLabel = `${label}-${n}`;
-    deps.renderer.writeInfo(`Label collided; saving as "${finalLabel}".`);
-  }
+  throw new FetchError2({
+    message: "Device code expired \u2014 please restart the login.",
+    status: 408,
+    // Request Timeout
+    context: { provider: "github-copilot", op: "device-code-poll", reason: "expired" }
+  });
+}
+function isUsableCopilotChatModel(item) {
+  if (typeof item.id !== "string" || item.id.length === 0) return false;
+  const cap = item.capabilities;
+  if (cap?.type !== "chat") return false;
+  if (cap.supports?.tool_calls !== true) return false;
+  const eps = item.supported_endpoints;
+  if (Array.isArray(eps) && !eps.includes("/chat/completions")) return false;
+  if (item.policy?.state === "disabled") return false;
+  if (item.vendor === "Experimental") return false;
+  return true;
+}
+async function fetchCopilotModels(copilotToken, signal) {
   try {
-    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
-      const p = all[chosen.id] ?? { type: chosen.id };
-      if (!p.type) p.type = chosen.id;
-      if (!p.family) p.family = "openai-compatible";
-      if (!p.baseUrl) p.baseUrl = baseUrl;
-      if (!p.envVars) p.envVars = [];
-      if (resolvedModels !== null) {
-        p.models = [...resolvedModels];
-      }
-      if (apiKey) {
-        const list = normalizeKeys(p);
-        list.push({ label: finalLabel, apiKey, createdAt: nowIso() });
-        writeKeysBack(p, list);
-        if (!p.activeKey) p.activeKey = finalLabel;
-      }
-      all[chosen.id] = p;
-    }, deps.profileConfigPath);
-  } catch (err) {
-    deps.renderer.writeError(`Failed to save ${chosen.id}: ${err.message}`);
-    return 1;
+    const base = copilotBaseUrlFromToken(copilotToken);
+    const res = await fetch(`${base}/models`, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${copilotToken}`,
+        "X-GitHub-Api-Version": COPILOT_API_VERSION,
+        ...COPILOT_HEADERS
+      },
+      signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
+    });
+    if (!res.ok) return [];
+    const json = await res.json();
+    const data = json?.data;
+    if (!Array.isArray(data)) return [];
+    const usable = data.filter(isUsableCopilotChatModel);
+    usable.sort((a, b) => copilotModelRank(a) - copilotModelRank(b));
+    return usable.map((m) => m.id);
+  } catch {
+    return [];
   }
-  const events = decideAuthLocalEvents({
-    providerId: chosen.id,
-    baseUrl,
-    previousModels,
-    newModels: resolvedModels,
-    keyLabel: apiKey ? finalLabel : void 0,
-    probeFailedSave: probeFailedAndSaved && probe ? {
-      status: probe.status,
-      ...probe.detail !== void 0 ? { detail: probe.detail } : {}
-    } : void 0
-  });
-  for (const event of events) {
-    audit.emit(event);
+}
+function copilotModelRank(item) {
+  if (item.is_chat_default === true) return 0;
+  if (item.is_chat_fallback === true) return 1;
+  return 2;
+}
+async function runCopilotOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
+  const ac = new AbortController();
+  const onSig = () => ac.abort();
+  const onExternalAbort = () => ac.abort();
+  const external = opts.signal;
+  if (external) {
+    if (external.aborted) ac.abort();
+    else external.addEventListener("abort", onExternalAbort, { once: true });
+  } else {
+    process.on("SIGINT", onSig);
   }
-  if (apiKey) {
+  try {
     deps.renderer.write(
-      `  ${color5.green("\u2713")} Saved ${color5.bold(chosen.id)}/${color5.bold(finalLabel)} \u2192 ${color5.cyan(baseUrl)}
-`
+      color4.bold(`
+  Sign in with GitHub Copilot \u2014 ${color4.cyan(providerId)}
+`) + color4.dim("  Uses your GitHub Copilot subscription (not an API key).\n") + color4.amber("  \u26A0 Using Copilot outside its official editor integrations may violate\n") + color4.amber("    GitHub\u2019s Terms \u2014 your account could be rate-limited or banned.\n\n")
     );
-  } else {
+    const device = await startDeviceFlow(ac.signal);
     deps.renderer.write(
-      `  ${color5.green("\u2713")} Saved ${color5.bold(chosen.id)} (no key) \u2192 ${color5.cyan(baseUrl)}
-`
+      color4.bold(`  ${"\u2500".repeat(56)}
+`) + color4.bold("  Open this URL and enter the code:\n") + color4.cyan(`  ${device.verification_uri}
+`) + color4.bold("  Code: ") + color4.green(color4.bold(device.user_code)) + "\n" + color4.bold(`  ${"\u2500".repeat(56)}
+
+`)
+    );
+    openBrowser(device.verification_uri);
+    deps.renderer.write(color4.dim("  Waiting for you to authorize in the browser...\n"));
+    const githubToken = await pollForGitHubToken(device, ac.signal);
+    deps.renderer.write(color4.dim("  Authorized. Fetching your Copilot token...\n"));
+    const copilot = await refreshCopilotToken(githubToken, ac.signal);
+    const models = await fetchCopilotModels(copilot.token, ac.signal);
+    const saved = await saveCopilotTokens(
+      deps,
+      providerId,
+      copilot.token,
+      githubToken,
+      copilot.expires,
+      models
+    );
+    if (!saved) return 1;
+    deps.renderer.write(color4.green("\n  \u2713 Signed in with GitHub Copilot!\n"));
+    const modelHint = models[0] ?? "gpt-4o";
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color4.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
+  Use: ${color4.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` + color4.dim("  The Copilot token refreshes automatically.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    if (external) {
+      external.removeEventListener("abort", onExternalAbort);
+    } else {
+      process.off("SIGINT", onSig);
+    }
+  }
+}
+async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: copilotToken,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(expires).toISOString(),
+    refreshToken: githubToken,
+    tokenType: "bearer"
+  };
+  try {
+    await mutateConfigProviders(
+      deps.profileConfigPath,
+      deps.vault,
+      (all) => {
+        const existing = all[providerId];
+        const p = existing ? { ...existing } : { type: providerId };
+        p.family = "github-copilot";
+        if (!p.baseUrl) p.baseUrl = copilotBaseUrlFromToken(copilotToken);
+        if (models.length > 0) p.models = models;
+        else if (!p.models || p.models.length === 0) p.models = ["gpt-4o"];
+        const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+        keys.push(entry);
+        writeKeysBack(p, keys);
+        p.activeKey = entry.label;
+        all[providerId] = p;
+      },
+      deps.profileConfigPath
     );
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
   }
-  const firstModel = resolvedModels && resolvedModels.length > 0 ? resolvedModels[0] : null;
-  const modelHint = firstModel ? color5.cyan(firstModel) : color5.dim("<model-id>");
+}
+
+// src/auth-menu/oauth-menu.ts
+function renderOAuthLoginOptions(deps, indent = "    ") {
   deps.renderer.write(
-    color5.dim(
-      `  Launch: wstack --provider ${chosen.id} --model ${modelHint} "<task>"
+    `${indent}${color5.bold("OAuth login options")} ${color5.dim("(subscription sign-in)")}
+${indent}${color5.bold("chatgpt")}  ChatGPT Plus/Pro  ${color5.dim("(\u2192 openai-codex)")}
+${indent}${color5.bold("claude")}   Claude Pro/Max    ${color5.dim("(\u2192 anthropic-oauth)")}
+${indent}${color5.bold("copilot")}  GitHub Copilot    ${color5.dim("(\u2192 github-copilot)")}
 `
-    )
   );
-  return 0;
 }
-function resolveModelList(models, probe, scrubber) {
-  if (models === void 0) return null;
-  const trimmed = models.trim();
-  if (trimmed.length === 0) return [];
-  const hasProbeIds = probe?.status === "ok" && (probe.modelIds?.length ?? 0) > 0;
-  const probeIds = hasProbeIds ? probe?.modelIds ?? [] : [];
-  if (trimmed === "first") {
-    if (probeIds.length === 0) return null;
-    return [scrubber.scrub(probeIds[0])];
-  }
-  if (/^\d+$/.test(trimmed)) {
-    if (probeIds.length === 0) return null;
-    const n = Math.min(Number.parseInt(trimmed, 10), probeIds.length);
-    return probeIds.slice(0, n).map((id) => scrubber.scrub(id));
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const raw of trimmed.split(",")) {
-    const id = scrubber.scrub(raw.trim());
-    if (id.length === 0) continue;
-    if (seen.has(id)) continue;
-    seen.add(id);
-    out.push(id);
+var OAUTH_ALIASES = {
+  chatgpt: [
+    "chatgpt",
+    "openai",
+    "codex",
+    "codex-cli",
+    "openai-codex",
+    "chatgpt-plus",
+    "plus",
+    "pro"
+  ],
+  claude: ["claude", "anthropic", "claude-pro", "claude-max", "anthropic-oauth", "max"],
+  copilot: ["copilot", "github", "gh", "github-copilot"]
+};
+var OAUTH_NUMERIC = {
+  "1": "chatgpt",
+  "2": "claude",
+  "3": "copilot"
+};
+function resolveOAuthKind(choice, opts = {}) {
+  const pick = choice.trim().toLowerCase();
+  if (!pick) return void 0;
+  if (opts.allowNumeric !== false && OAUTH_NUMERIC[pick]) return OAUTH_NUMERIC[pick];
+  for (const [kind, aliases] of Object.entries(OAUTH_ALIASES)) {
+    if (aliases.includes(pick)) return kind;
   }
-  return out;
+  return void 0;
 }
-function renderProbeResult(deps, probe, opts = {}) {
-  const label = opts.presetLabel ? ` ${color5.bold(opts.presetLabel)}` : "";
-  const elapsed = probe.elapsedMs !== void 0 ? ` ${color5.dim(`(${probe.elapsedMs}ms)`)}` : "";
-  switch (probe.status) {
-    case "ok": {
-      const models = probe.modelCount !== void 0 ? color5.dim(`, ${probe.modelCount} model${probe.modelCount === 1 ? "" : "s"}`) : "";
-      deps.renderer.write(
-        `  ${color5.green("\u25CF")} ${label} health probe ok${models}${elapsed}
-`
-      );
-      break;
-    }
-    case "timeout": {
-      deps.renderer.write(
-        `  ${color5.red("\u25CF")} ${label} health probe timed out${elapsed}
-    ${color5.dim("The server did not respond within the timeout.")}
-    ${color5.dim("Is the local server running? Check the port and try again.")}
-`
-      );
-      break;
-    }
-    case "unreachable": {
-      const detail = probe.detail ? ` ${color5.dim(`(${probe.detail})`)}` : "";
-      deps.renderer.write(
-        `  ${color5.red("\u25CF")} ${label} server unreachable${detail}
-    ${color5.dim("Could not connect. Common causes:")}
-    ${color5.dim("  - The local server is not running")}
-    ${color5.dim("  - The port is blocked by a firewall")}
-    ${color5.dim("  - The base URL is wrong")}
-`
-      );
-      break;
-    }
-    case "http_error": {
-      const status = probe.httpStatus !== void 0 ? ` HTTP ${probe.httpStatus}` : "";
-      const detail = probe.detail ? ` ${color5.dim(`\u2014 ${probe.detail}`)}` : "";
-      deps.renderer.write(
-        `  ${color5.yellow("\u25CF")} ${label} health probe got${status}${detail}
-`
-      );
-      break;
-    }
-    case "invalid_response": {
-      deps.renderer.write(
-        `  ${color5.yellow("\u25CF")} ${label} health probe returned an unexpected shape
-` + (probe.detail ? `    ${color5.dim(probe.detail)}
-` : "")
-      );
-      break;
-    }
-    case "skipped": {
-      break;
-    }
-  }
+async function runOAuthLoginChoice(deps, choice, opts = {}) {
+  const kind = resolveOAuthKind(choice, opts);
+  if (!kind) return false;
+  await runOAuthLoginKind(deps, kind);
+  return true;
 }
-async function promptSaveAnyway(deps) {
-  const answer = (await deps.reader.readLine(
-    `
-${color5.amber("?")} ${color5.bold("Save anyway?")} ${color5.dim("[y/N]")}: `
-  )).trim().toLowerCase();
-  return answer === "y" || answer === "yes";
+async function runOAuthLoginKind(deps, kind) {
+  if (kind === "claude") return runClaudeOAuthLogin(deps);
+  if (kind === "copilot") return runCopilotOAuthLogin(deps);
+  return runCodexOAuthLogin(deps);
 }
-async function pickLocalPreset(deps) {
+async function runOAuthLoginMenu(deps) {
   deps.renderer.write(
     `
-${color5.bold("Local LLM servers")} ${color5.dim("\u2014 pick one to pre-fill the base URL")}
-
+  ${color5.bold("Login with OAuth:")}
+` + color5.amber("  \u26A0 Subscription tokens used outside official clients may violate provider\n") + color5.amber("    Terms \u2014 your account could be rate-limited or banned. An API key is the\n") + color5.dim("    sanctioned path for programmatic use.\n") + `    ${color5.bold("1")}  ChatGPT Plus/Pro  ${color5.dim("(\u2192 openai-codex)")}
+    ${color5.bold("2")}  Claude Pro/Max    ${color5.dim("(\u2192 anthropic-oauth)")}
+    ${color5.bold("3")}  GitHub Copilot    ${color5.dim("(\u2192 github-copilot)")}
 `
   );
-  let idx = 1;
-  for (const entry of LOCAL_LLM_PRESETS) {
-    const auth = entry.noAuth ? color5.dim("(no auth)") : color5.dim("(optional auth)");
-    deps.renderer.write(
-      `    ${color5.dim(`${idx}.`.padStart(4))} ${color5.bold(entry.label.padEnd(12))} ${color5.cyan(entry.defaultBaseUrl.padEnd(34))} ${auth}
-`
-    );
-    deps.renderer.write(
-      `        ${color5.dim(entry.hint)}
-`
-    );
-    idx++;
-  }
-  const answer = (await deps.reader.readLine(
-    `
-${color5.amber("?")} Pick ${color5.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to quit)`)}: `
-  )).trim().toLowerCase();
-  if (!answer || answer === "q" || answer === "quit") return void 0;
-  const num = Number.parseInt(answer, 10);
-  if (!Number.isNaN(num) && num >= 1 && num <= LOCAL_LLM_PRESETS.length) {
-    return LOCAL_LLM_PRESETS[num - 1];
-  }
-  const byId = LOCAL_LLM_PRESETS.find((p) => p.id === answer);
-  if (byId) return byId;
-  deps.renderer.writeError(`Unknown selection: "${answer}"`);
-  return void 0;
-}
-async function promptOptionalKey(deps, preset) {
-  const answer = (await deps.reader.readSecret(
-    `  ${color5.amber("?")} ${color5.bold(preset.label)} API key ${color5.dim("(hidden \u2014 Enter to skip if auth is disabled on the server)")}: `
-  )).trim();
-  if (!answer) return void 0;
-  return answer;
+  const pick = await deps.reader.readLine(
+    `  ${color5.amber("?")} Pick ${color5.dim("(or b to go back)")}: `
+  );
+  await runOAuthLoginChoice(deps, pick);
 }
 
 // src/auth-menu/add-provider.ts
+import * as fs from "node:fs/promises";
 import { atomicWrite, color as color6 } from "@wrongstack/core/utils";
 import { catalogProviderIdFor, PROVIDER_DEFINITIONS } from "@wrongstack/providers";
-import * as fs from "node:fs/promises";
 
 // src/provider-id.ts
 function nextCustomProviderId(existing) {
@@ -1245,27 +1279,32 @@ async function addKeyForProvider(providerId, deps, template) {
   if (!label) return false;
   const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
   if (!apiKey) return false;
-  await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
-    const existingProv = all[providerId] ?? {
-      type: providerId,
-      ...template
-    };
-    if (!existingProv.type) existingProv.type = providerId;
-    if (!existingProv.family && template.family) {
-      existingProv.family = template.family;
-    }
-    if (!existingProv.baseUrl && template.baseUrl) {
-      existingProv.baseUrl = template.baseUrl;
-    }
-    if (!existingProv.envVars && template.envVars) {
-      existingProv.envVars = template.envVars;
-    }
-    const list = normalizeKeys(existingProv);
-    list.push({ label, apiKey, createdAt: nowIso() });
-    writeKeysBack(existingProv, list);
-    if (!existingProv.activeKey) existingProv.activeKey = label;
-    all[providerId] = existingProv;
-  }, deps.profileConfigPath);
+  await mutateConfigProviders(
+    deps.profileConfigPath,
+    deps.vault,
+    (all) => {
+      const existingProv = all[providerId] ?? {
+        type: providerId,
+        ...template
+      };
+      if (!existingProv.type) existingProv.type = providerId;
+      if (!existingProv.family && template.family) {
+        existingProv.family = template.family;
+      }
+      if (!existingProv.baseUrl && template.baseUrl) {
+        existingProv.baseUrl = template.baseUrl;
+      }
+      if (!existingProv.envVars && template.envVars) {
+        existingProv.envVars = template.envVars;
+      }
+      const list = normalizeKeys(existingProv);
+      list.push({ label, apiKey, createdAt: nowIso() });
+      writeKeysBack(existingProv, list);
+      if (!existingProv.activeKey) existingProv.activeKey = label;
+      all[providerId] = existingProv;
+    },
+    deps.profileConfigPath
+  );
   deps.renderer.write(
     `  ${color6.green("\u2713")} Saved ${color6.bold(providerId)}/${color6.bold(label)}.
 `
@@ -1316,6 +1355,7 @@ async function promptForLabel(deps, usedLabels) {
 }
 
 export {
+  runClaudeOAuthLogin,
   loadProviders,
   renderProviderHeader,
   renderActions,
@@ -1323,8 +1363,8 @@ export {
   readKeyInput,
   confirm,
   validateFamily,
-  runClaudeOAuthLogin,
   runCopilotOAuthLogin,
+  runAuthLocal,
   resolveOAuthKind,
   runOAuthLoginKind,
   runOAuthLoginMenu,
@@ -1332,7 +1372,6 @@ export {
   addFromCatalog,
   addKeyForCatalogProvider,
   addCustomProvider,
-  addKeyForProvider,
-  runAuthLocal
+  addKeyForProvider
 };
-//# sourceMappingURL=chunk-O7XNGCRT.js.map
+//# sourceMappingURL=chunk-FJVCVZIV.js.map