@wrongstack/cli 1.1.1 → 1.1.4

package/dist/chunk-GKGWPFW2.js

@@ -0,0 +1,50 @@
+
+// src/acp-leader/acp-leader-host.ts
+var ACP_LEADER_PROVIDER_ID = "acp";
+var bound;
+var sessionAgents;
+function setAcpLeaderSessionAgents(resolve) {
+  sessionAgents = resolve;
+}
+function acpLeaderSessionAgent(sessionId) {
+  return sessionAgents?.(sessionId);
+}
+function bindAcpLeaderHost(host) {
+  bound = host;
+}
+function acpLeaderHost() {
+  return bound;
+}
+function confirmAcpLeaderThroughEvents() {
+  if (bound) bound = { ...bound, confirmAwaiter: void 0, confirmThroughEvents: true };
+}
+var liveLeaders = /* @__PURE__ */ new Set();
+function trackAcpLeader(leader) {
+  liveLeaders.add(leader);
+}
+async function closeAcpLeaderSessions(timeoutMs = 1500) {
+  if (liveLeaders.size === 0) return;
+  const all = [...liveLeaders];
+  liveLeaders.clear();
+  let timer;
+  await Promise.race([
+    Promise.all(all.map((leader) => leader.closeAll().catch(() => void 0))),
+    new Promise((resolve) => {
+      timer = setTimeout(resolve, timeoutMs);
+      timer.unref?.();
+    })
+  ]);
+  if (timer) clearTimeout(timer);
+}
+
+export {
+  ACP_LEADER_PROVIDER_ID,
+  setAcpLeaderSessionAgents,
+  acpLeaderSessionAgent,
+  bindAcpLeaderHost,
+  acpLeaderHost,
+  confirmAcpLeaderThroughEvents,
+  trackAcpLeader,
+  closeAcpLeaderSessions
+};
+//# sourceMappingURL=chunk-GKGWPFW2.js.map

package/dist/{chunk-RAWHRRUJ.js → chunk-I5LJLKA3.js}

@@ -171,12 +171,11 @@ function decideAuthLocalEvents(opts) {
   return events;
 }
 
-// src/auth-menu/provider-auth-login.ts
-import { color, toErrorMessage } from "@wrongstack/core/utils";
-import {
-  applyProviderAuthOutcome,
-  createBuiltinProviderAuthRegistry
-} from "@wrongstack/providers/oauth";
+// src/auth-menu/local.ts
+import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
+import { color as color2 } from "@wrongstack/core/utils";
+import { authProfileAliasError } from "@wrongstack/providers";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
 // src/auth-menu/helpers.ts
 async function loadProviders(deps) {
@@ -186,125 +185,6 @@ async function loadProviders(deps) {
   });
 }
 
-// src/auth-menu/provider-auth-login.ts
-var defaultRegistry;
-function providerAuthRegistryFor(deps) {
-  if (deps.providerAuthRegistry) return deps.providerAuthRegistry;
-  defaultRegistry ??= createBuiltinProviderAuthRegistry();
-  return defaultRegistry;
-}
-function providerAuthStrategiesFor(deps) {
-  return providerAuthRegistryFor(deps).list();
-}
-function hyperlink(url) {
-  return `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
-}
-async function runProviderAuthLogin(deps, strategyId, opts = {}) {
-  const registry = providerAuthRegistryFor(deps);
-  const strategy = registry.get(strategyId);
-  if (!strategy) {
-    deps.renderer.writeError(`Unknown OAuth login "${strategyId}".`);
-    return 1;
-  }
-  const controller = new AbortController();
-  let sigintCount = 0;
-  const onSigint = () => {
-    sigintCount += 1;
-    if (sigintCount === 1) {
-      deps.renderer.write(
-        color.dim("\n  Cancelling sign-in\u2026 (press Ctrl+C again to force-quit)\n")
-      );
-      controller.abort();
-    } else {
-      process.exit(130);
-    }
-  };
-  const onExternalAbort = () => controller.abort();
-  if (opts.signal) {
-    if (opts.signal.aborted) controller.abort();
-    else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
-  } else {
-    process.on("SIGINT", onSigint);
-  }
-  let session;
-  try {
-    deps.renderer.write(
-      color.bold(`
-  Sign in with ${strategy.label}`) + color.dim(` \u2192 ${opts.providerId ?? strategy.providerId}
-`)
-    );
-    const saved = strategy.id === "chatgpt-api" ? (await loadProviders(deps))[opts.providerId ?? strategy.providerId] : void 0;
-    const credential = saved?.apiKeys?.find((key) => key.label === saved.activeKey) ?? saved?.apiKeys?.[0];
-    session = await registry.begin(
-      strategy.id,
-      { modelsRegistry: deps.modelsRegistry, ...credential ? { credential } : {} },
-      controller.signal
-    );
-    let outcome;
-    if (session.interaction.type === "device_code") {
-      const { verificationUri, userCode } = session.interaction;
-      deps.renderer.write(
-        color.bold("\n  Open this URL and enter the code:\n") + color.cyan(`  ${hyperlink(verificationUri)}
-`) + color.bold(`  Code: ${userCode}
-`) + color.dim("  Waiting for authorization\u2026\n")
-      );
-      openBrowser(verificationUri);
-      outcome = await session.waitForCompletion(controller.signal);
-    } else {
-      const { authorizeUrl, bound } = session.interaction;
-      deps.renderer.write(
-        color.bold("\n  Open this URL in your browser to sign in:\n") + color.cyan(`  ${hyperlink(authorizeUrl)}
-`)
-      );
-      if (bound) {
-        openBrowser(authorizeUrl);
-        deps.renderer.write(color.dim("  Waiting for browser authorization\u2026\n"));
-        outcome = await session.waitForCompletion(controller.signal);
-      } else {
-        const input = (await deps.reader.readLine(
-          `
-  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
-        )).trim();
-        if (!input || input.toLowerCase() === "q") return 1;
-        outcome = await session.completeWithCode(input, controller.signal);
-      }
-    }
-    if (!outcome) {
-      deps.renderer.write(color.dim("  Sign-in cancelled or timed out.\n"));
-      return 1;
-    }
-    controller.signal.throwIfAborted();
-    await mutateConfigProviders(
-      deps.profileConfigPath,
-      deps.vault,
-      (providers) => {
-        controller.signal.throwIfAborted();
-        applyProviderAuthOutcome(providers, outcome, { targetProviderId: opts.providerId });
-      },
-      deps.profileConfigPath
-    );
-    const savedId = opts.providerId ?? outcome.providerId;
-    deps.renderer.write(color.green(`
-  \u2713 Signed in \u2014 saved as ${savedId}.
-`));
-    return 0;
-  } catch (error) {
-    const message = error instanceof DOMException && error.name === "AbortError" ? "Login cancelled." : toErrorMessage(error);
-    deps.renderer.writeError(`  Login failed: ${message}`);
-    return 1;
-  } finally {
-    session?.close();
-    if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
-    else process.off("SIGINT", onSigint);
-  }
-}
-
-// src/auth-menu/local.ts
-import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
-import { color as color3 } from "@wrongstack/core/utils";
-import { authProfileAliasError } from "@wrongstack/providers";
-import { probeLocalLlm } from "@wrongstack/runtime/probe";
-
 // src/auth-menu/local-presets.ts
 import { projectLocalProviderPresets } from "@wrongstack/providers/definitions";
 var LOCAL_LLM_PRESETS = projectLocalProviderPresets();
@@ -318,24 +198,24 @@ function parseAuthMenuIndex(raw) {
 }
 
 // src/auth-menu/shared.ts
-import { color as color2 } from "@wrongstack/core/utils";
+import { color } from "@wrongstack/core/utils";
 function renderProviderLine(renderer, id, cfg, idx) {
   const keys = normalizeKeys(cfg);
   const active = activeLabel(cfg, keys);
   const firstKey = keys[0];
   let summary;
   if (keys.length === 0) {
-    summary = color2.dim("(no keys)");
+    summary = color.dim("(no keys)");
   } else if (keys.length === 1) {
     summary = maskedKey(firstKey?.apiKey ?? "");
   } else {
     const activeKeyObj = active != null ? keys.find((k) => k.label === active) : void 0;
-    summary = `${color2.dim(`${keys.length} keys`)} ${color2.dim("active:")} ${color2.bold(active ?? "?")} ` + maskedKey(activeKeyObj?.apiKey ?? firstKey?.apiKey ?? "");
+    summary = `${color.dim(`${keys.length} keys`)} ${color.dim("active:")} ${color.bold(active ?? "?")} ` + maskedKey(activeKeyObj?.apiKey ?? firstKey?.apiKey ?? "");
   }
-  const fam = cfg.family ? color2.dim(`[${cfg.family}]`) : "";
-  const aliasHint = cfg.type && cfg.type !== id ? color2.dim(`\u2192 ${cfg.type}`) : "";
+  const fam = cfg.family ? color.dim(`[${cfg.family}]`) : "";
+  const aliasHint = cfg.type && cfg.type !== id ? color.dim(`\u2192 ${cfg.type}`) : "";
   renderer.write(
-    `    ${color2.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
+    `    ${color.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
 `
   );
 }
@@ -344,23 +224,23 @@ function renderProviderHeader(renderer, providerId, cfg) {
   const active = activeLabel(cfg, keys);
   renderer.write(
     `
-${color2.bold(providerId)} ${cfg.family ? color2.dim(`[${cfg.family}]`) : color2.amber("[no family]")}
+${color.bold(providerId)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}
 `
   );
   const details = [
-    color2.dim(`  type:    ${cfg.type ?? providerId}`),
-    color2.dim(`  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}`),
-    color2.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}`)
+    color.dim(`  type:    ${cfg.type ?? providerId}`),
+    color.dim(`  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}`),
+    color.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}`)
   ];
   if (cfg.envVars && cfg.envVars.length > 0) {
-    details.push(color2.dim(`  envVars: ${cfg.envVars.join(", ")}`));
+    details.push(color.dim(`  envVars: ${cfg.envVars.join(", ")}`));
   }
   if (cfg.models && cfg.models.length > 0) {
-    details.push(color2.dim(`  models:  ${cfg.models.join(", ")}`));
+    details.push(color.dim(`  models:  ${cfg.models.join(", ")}`));
   }
   renderer.write(details.join("\n") + "\n");
   if (keys.length === 0) {
-    renderer.write(color2.dim("  (no keys saved)\n"));
+    renderer.write(color.dim("  (no keys saved)\n"));
   } else {
     for (let i = 0; i < keys.length; i++) {
       const key = keys[i];
@@ -369,56 +249,56 @@ ${color2.bold(providerId)} ${cfg.family ? color2.dim(`[${cfg.family}]`) : color2
   }
 }
 function renderKeyLine(renderer, key, idx, active) {
-  const marker = key.label === active ? color2.green("\u25CF") : color2.dim("\u25CB");
+  const marker = key.label === active ? color.green("\u25CF") : color.dim("\u25CB");
   renderer.write(
-    `  ${color2.dim(`${idx}.`.padStart(4))} ${marker} ${key.label.padEnd(20)} ${maskedKey(key.apiKey)}  ${color2.dim(key.createdAt)}
+    `  ${color.dim(`${idx}.`.padStart(4))} ${marker} ${key.label.padEnd(20)} ${maskedKey(key.apiKey)}  ${color.dim(key.createdAt)}
 `
   );
 }
 function renderActions(renderer, keysLength) {
   renderer.write(`
-  ${color2.dim("Actions:")}
+  ${color.dim("Actions:")}
 `);
-  renderer.write(`    ${color2.bold("a")}        Add another key
+  renderer.write(`    ${color.bold("a")}        Add another key
 `);
   if (keysLength > 0) {
-    renderer.write(`    ${color2.bold("u")} <n>    Update key <n>
+    renderer.write(`    ${color.bold("u")} <n>    Update key <n>
 `);
-    renderer.write(`    ${color2.bold("d")} <n>    Delete key <n>
+    renderer.write(`    ${color.bold("d")} <n>    Delete key <n>
 `);
-    renderer.write(`    ${color2.bold("s")} <n>    Set key <n> as active
+    renderer.write(`    ${color.bold("s")} <n>    Set key <n> as active
 `);
   }
-  renderer.write(`    ${color2.bold("f")}        Edit family
+  renderer.write(`    ${color.bold("f")}        Edit family
 `);
   renderer.write(
-    `    ${color2.bold("B")}        Edit baseUrl ${color2.dim("(capital B \u2014 b is Back)")}
+    `    ${color.bold("B")}        Edit baseUrl ${color.dim("(capital B \u2014 b is Back)")}
 `
   );
-  renderer.write(`    ${color2.bold("m")}        Edit visible model list
+  renderer.write(`    ${color.bold("m")}        Edit visible model list
 `);
-  renderer.write(`    ${color2.bold("x")}        Remove this provider entirely
+  renderer.write(`    ${color.bold("x")}        Remove this provider entirely
 `);
-  renderer.write(`    ${color2.bold("b")}        Back
+  renderer.write(`    ${color.bold("b")}        Back
 `);
-  renderer.write(`    ${color2.bold("q")}        Quit
+  renderer.write(`    ${color.bold("q")}        Quit
 `);
 }
 function renderTopMenu(renderer, providers) {
   renderer.write(`
-${color2.bold("WrongStack")} ${color2.dim("\u2014 API key manager")}
+${color.bold("WrongStack")} ${color.dim("\u2014 API key manager")}
 
 `);
   const ids = Object.keys(providers).sort();
   if (ids.length === 0) {
-    renderer.write(color2.dim("  No providers configured yet.\n"));
+    renderer.write(color.dim("  No providers configured yet.\n"));
     renderer.write(
-      color2.dim(
+      color.dim(
         "  Use (a) to add one from the models.dev catalog, (l) for a local server, or (c) for a custom provider.\n"
       )
     );
   } else {
-    renderer.write(`  ${color2.dim("Saved providers:")}
+    renderer.write(`  ${color.dim("Saved providers:")}
 `);
     let idx = 1;
     for (const id of ids) {
@@ -429,30 +309,30 @@ ${color2.bold("WrongStack")} ${color2.dim("\u2014 API key manager")}
     }
   }
   renderer.write(`
-  ${color2.dim("Actions:")}
+  ${color.dim("Actions:")}
 `);
-  renderer.write(`    ${color2.bold("a")}  Add a provider (from catalog)
+  renderer.write(`    ${color.bold("a")}  Add a provider (from catalog)
 `);
   renderer.write(
-    `    ${color2.bold("l")}  Add a local server ${color2.dim("(OmniRoute / Ollama / vLLM / LM Studio)")}
+    `    ${color.bold("l")}  Add a local server ${color.dim("(OmniRoute / Ollama / vLLM / LM Studio)")}
 `
   );
-  renderer.write(`    ${color2.bold("c")}  Add a custom provider
+  renderer.write(`    ${color.bold("c")}  Add a custom provider
 `);
-  renderer.write(`    ${color2.bold("s")}  Login with provider OAuth
+  renderer.write(`    ${color.bold("s")}  Login with provider OAuth
 `);
   if (ids.length > 0) {
     renderer.write(
-      `    ${color2.dim("1-")}${color2.dim(String(ids.length))}  ${color2.bold("Manage a provider")}
+      `    ${color.dim("1-")}${color.dim(String(ids.length))}  ${color.bold("Manage a provider")}
 `
     );
   }
-  renderer.write(`    ${color2.bold("q")}  Quit
+  renderer.write(`    ${color.bold("q")}  Quit
 `);
 }
 async function readKeyInput(deps, intent) {
   const key = (await deps.reader.readSecret(
-    `  ${color2.amber("?")} ${intent} ${color2.dim("(hidden, paste OK)")}: `
+    `  ${color.amber("?")} ${intent} ${color.dim("(hidden, paste OK)")}: `
   )).trim();
   if (!key) {
     deps.renderer.writeError("No key entered.");
@@ -461,7 +341,7 @@ async function readKeyInput(deps, intent) {
   return key;
 }
 async function confirm(deps, question) {
-  const answer = (await deps.reader.readLine(`  ${color2.amber("?")} ${question} ${color2.dim("[y/N/q]")} `)).trim().toLowerCase();
+  const answer = (await deps.reader.readLine(`  ${color.amber("?")} ${question} ${color.dim("[y/N/q]")} `)).trim().toLowerCase();
   if (answer === "q" || answer === "quit") return null;
   return answer === "y" || answer === "yes";
 }
@@ -540,7 +420,7 @@ async function runAuthLocal(deps, opts = {}) {
     if (!probe.ok) {
       if (chosen.noAuth) {
         deps.renderer.write(
-          color3.dim(
+          color2.dim(
             `  Saving ${chosen.label} anyway \u2014 keyless local gateway needs no key and discovers models when it comes up.
 `
           )
@@ -549,7 +429,7 @@ async function runAuthLocal(deps, opts = {}) {
       } else {
         const saveAnyway = await promptSaveAnyway(deps);
         if (!saveAnyway) {
-          deps.renderer.write(color3.dim("  Cancelled. Nothing saved.\n"));
+          deps.renderer.write(color2.dim("  Cancelled. Nothing saved.\n"));
           return 0;
         }
         probeFailedAndSaved = true;
@@ -614,19 +494,19 @@ async function runAuthLocal(deps, opts = {}) {
   }
   if (apiKey) {
     deps.renderer.write(
-      `  ${color3.green("\u2713")} Saved ${color3.bold(profileId)}/${color3.bold(finalLabel)} \u2192 ${color3.cyan(baseUrl)}
+      `  ${color2.green("\u2713")} Saved ${color2.bold(profileId)}/${color2.bold(finalLabel)} \u2192 ${color2.cyan(baseUrl)}
 `
     );
   } else {
     deps.renderer.write(
-      `  ${color3.green("\u2713")} Saved ${color3.bold(profileId)} (no key) \u2192 ${color3.cyan(baseUrl)}
+      `  ${color2.green("\u2713")} Saved ${color2.bold(profileId)} (no key) \u2192 ${color2.cyan(baseUrl)}
 `
     );
   }
   const firstModel = resolvedModels && resolvedModels.length > 0 ? resolvedModels[0] : null;
-  const modelHint = firstModel ? color3.cyan(firstModel) : color3.dim("<model-id>");
+  const modelHint = firstModel ? color2.cyan(firstModel) : color2.dim("<model-id>");
   deps.renderer.write(
-    color3.dim(`  Launch: wstack --provider ${profileId} --model ${modelHint} "<task>"
+    color2.dim(`  Launch: wstack --provider ${profileId} --model ${modelHint} "<task>"
 `)
   );
   return 0;
@@ -658,47 +538,47 @@ function resolveModelList(models, probe, scrubber) {
   return out;
 }
 function renderProbeResult(deps, probe, opts = {}) {
-  const label = opts.presetLabel ? ` ${color3.bold(opts.presetLabel)}` : "";
-  const elapsed = probe.elapsedMs !== void 0 ? ` ${color3.dim(`(${probe.elapsedMs}ms)`)}` : "";
+  const label = opts.presetLabel ? ` ${color2.bold(opts.presetLabel)}` : "";
+  const elapsed = probe.elapsedMs !== void 0 ? ` ${color2.dim(`(${probe.elapsedMs}ms)`)}` : "";
   switch (probe.status) {
     case "ok": {
-      const models = probe.modelCount !== void 0 ? color3.dim(`, ${probe.modelCount} model${probe.modelCount === 1 ? "" : "s"}`) : "";
-      deps.renderer.write(`  ${color3.green("\u25CF")} ${label} health probe ok${models}${elapsed}
+      const models = probe.modelCount !== void 0 ? color2.dim(`, ${probe.modelCount} model${probe.modelCount === 1 ? "" : "s"}`) : "";
+      deps.renderer.write(`  ${color2.green("\u25CF")} ${label} health probe ok${models}${elapsed}
 `);
       break;
     }
     case "timeout": {
       deps.renderer.write(
-        `  ${color3.red("\u25CF")} ${label} health probe timed out${elapsed}
-    ${color3.dim("The server did not respond within the timeout.")}
-    ${color3.dim("Is the local server running? Check the port and try again.")}
+        `  ${color2.red("\u25CF")} ${label} health probe timed out${elapsed}
+    ${color2.dim("The server did not respond within the timeout.")}
+    ${color2.dim("Is the local server running? Check the port and try again.")}
 `
       );
       break;
     }
     case "unreachable": {
-      const detail = probe.detail ? ` ${color3.dim(`(${probe.detail})`)}` : "";
+      const detail = probe.detail ? ` ${color2.dim(`(${probe.detail})`)}` : "";
       deps.renderer.write(
-        `  ${color3.red("\u25CF")} ${label} server unreachable${detail}
-    ${color3.dim("Could not connect. Common causes:")}
-    ${color3.dim("  - The local server is not running")}
-    ${color3.dim("  - The port is blocked by a firewall")}
-    ${color3.dim("  - The base URL is wrong")}
+        `  ${color2.red("\u25CF")} ${label} server unreachable${detail}
+    ${color2.dim("Could not connect. Common causes:")}
+    ${color2.dim("  - The local server is not running")}
+    ${color2.dim("  - The port is blocked by a firewall")}
+    ${color2.dim("  - The base URL is wrong")}
 `
       );
       break;
     }
     case "http_error": {
       const status = probe.httpStatus !== void 0 ? ` HTTP ${probe.httpStatus}` : "";
-      const detail = probe.detail ? ` ${color3.dim(`\u2014 ${probe.detail}`)}` : "";
-      deps.renderer.write(`  ${color3.yellow("\u25CF")} ${label} health probe got${status}${detail}
+      const detail = probe.detail ? ` ${color2.dim(`\u2014 ${probe.detail}`)}` : "";
+      deps.renderer.write(`  ${color2.yellow("\u25CF")} ${label} health probe got${status}${detail}
 `);
       break;
     }
     case "invalid_response": {
       deps.renderer.write(
-        `  ${color3.yellow("\u25CF")} ${label} health probe returned an unexpected shape
-` + (probe.detail ? `    ${color3.dim(probe.detail)}
+        `  ${color2.yellow("\u25CF")} ${label} health probe returned an unexpected shape
+` + (probe.detail ? `    ${color2.dim(probe.detail)}
 ` : "")
       );
       break;
@@ -711,31 +591,31 @@ function renderProbeResult(deps, probe, opts = {}) {
 async function promptSaveAnyway(deps) {
   const answer = (await deps.reader.readLine(
     `
-${color3.amber("?")} ${color3.bold("Save anyway?")} ${color3.dim("[y/N]")}: `
+${color2.amber("?")} ${color2.bold("Save anyway?")} ${color2.dim("[y/N]")}: `
   )).trim().toLowerCase();
   return answer === "y" || answer === "yes";
 }
 async function pickLocalPreset(deps) {
   deps.renderer.write(
     `
-${color3.bold("Local LLM servers")} ${color3.dim("\u2014 pick one to pre-fill the base URL")}
+${color2.bold("Local LLM servers")} ${color2.dim("\u2014 pick one to pre-fill the base URL")}
 
 `
   );
   let idx = 1;
   for (const entry of LOCAL_LLM_PRESETS) {
-    const auth = entry.noAuth ? color3.dim("(no auth)") : color3.dim("(optional auth)");
+    const auth = entry.noAuth ? color2.dim("(no auth)") : color2.dim("(optional auth)");
     deps.renderer.write(
-      `    ${color3.dim(`${idx}.`.padStart(4))} ${color3.bold(entry.label.padEnd(12))} ${color3.cyan(entry.defaultBaseUrl.padEnd(34))} ${auth}
+      `    ${color2.dim(`${idx}.`.padStart(4))} ${color2.bold(entry.label.padEnd(12))} ${color2.cyan(entry.defaultBaseUrl.padEnd(34))} ${auth}
 `
     );
-    deps.renderer.write(`        ${color3.dim(entry.hint)}
+    deps.renderer.write(`        ${color2.dim(entry.hint)}
 `);
     idx++;
   }
   const answer = (await deps.reader.readLine(
     `
-${color3.amber("?")} Pick ${color3.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to quit)`)}: `
+${color2.amber("?")} Pick ${color2.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to quit)`)}: `
   )).trim().toLowerCase();
   if (!answer || answer === "q" || answer === "quit") return void 0;
   const num = parseAuthMenuIndex(answer);
@@ -749,12 +629,133 @@ ${color3.amber("?")} Pick ${color3.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to qui
 }
 async function promptOptionalKey(deps, preset) {
   const answer = (await deps.reader.readSecret(
-    `  ${color3.amber("?")} ${color3.bold(preset.label)} API key ${color3.dim("(hidden \u2014 Enter to skip if auth is disabled on the server)")}: `
+    `  ${color2.amber("?")} ${color2.bold(preset.label)} API key ${color2.dim("(hidden \u2014 Enter to skip if auth is disabled on the server)")}: `
   )).trim();
   if (!answer) return void 0;
   return answer;
 }
 
+// src/auth-menu/provider-auth-login.ts
+import { color as color3, toErrorMessage } from "@wrongstack/core/utils";
+import {
+  applyProviderAuthOutcome,
+  createBuiltinProviderAuthRegistry,
+  retiredProviderAuthLoginHint
+} from "@wrongstack/providers/oauth";
+var defaultRegistry;
+function providerAuthRegistryFor(deps) {
+  if (deps.providerAuthRegistry) return deps.providerAuthRegistry;
+  defaultRegistry ??= createBuiltinProviderAuthRegistry();
+  return defaultRegistry;
+}
+function providerAuthStrategiesFor(deps) {
+  return providerAuthRegistryFor(deps).list();
+}
+function hyperlink(url) {
+  return `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
+}
+async function runProviderAuthLogin(deps, strategyId, opts = {}) {
+  const registry = providerAuthRegistryFor(deps);
+  const strategy = registry.get(strategyId);
+  if (!strategy) {
+    deps.renderer.writeError(
+      retiredProviderAuthLoginHint(strategyId) ?? `Unknown OAuth login "${strategyId}".`
+    );
+    return 1;
+  }
+  const controller = new AbortController();
+  let sigintCount = 0;
+  const onSigint = () => {
+    sigintCount += 1;
+    if (sigintCount === 1) {
+      deps.renderer.write(
+        color3.dim("\n  Cancelling sign-in\u2026 (press Ctrl+C again to force-quit)\n")
+      );
+      controller.abort();
+    } else {
+      process.exit(130);
+    }
+  };
+  const onExternalAbort = () => controller.abort();
+  if (opts.signal) {
+    if (opts.signal.aborted) controller.abort();
+    else opts.signal.addEventListener("abort", onExternalAbort, { once: true });
+  } else {
+    process.on("SIGINT", onSigint);
+  }
+  let session;
+  try {
+    deps.renderer.write(
+      color3.bold(`
+  Sign in with ${strategy.label}`) + color3.dim(` \u2192 ${opts.providerId ?? strategy.providerId}
+`)
+    );
+    const saved = strategy.id === "chatgpt-api" ? (await loadProviders(deps))[opts.providerId ?? strategy.providerId] : void 0;
+    const credential = saved?.apiKeys?.find((key) => key.label === saved.activeKey) ?? saved?.apiKeys?.[0];
+    session = await registry.begin(
+      strategy.id,
+      { modelsRegistry: deps.modelsRegistry, ...credential ? { credential } : {} },
+      controller.signal
+    );
+    let outcome;
+    if (session.interaction.type === "device_code") {
+      const { verificationUri, userCode } = session.interaction;
+      deps.renderer.write(
+        color3.bold("\n  Open this URL and enter the code:\n") + color3.cyan(`  ${hyperlink(verificationUri)}
+`) + color3.bold(`  Code: ${userCode}
+`) + color3.dim("  Waiting for authorization\u2026\n")
+      );
+      openBrowser(verificationUri);
+      outcome = await session.waitForCompletion(controller.signal);
+    } else {
+      const { authorizeUrl, bound } = session.interaction;
+      deps.renderer.write(
+        color3.bold("\n  Open this URL in your browser to sign in:\n") + color3.cyan(`  ${hyperlink(authorizeUrl)}
+`)
+      );
+      if (bound) {
+        openBrowser(authorizeUrl);
+        deps.renderer.write(color3.dim("  Waiting for browser authorization\u2026\n"));
+        outcome = await session.waitForCompletion(controller.signal);
+      } else {
+        const input = (await deps.reader.readLine(
+          `
+  ${color3.amber("?")} Paste the redirect URL or code ${color3.dim("(or q to cancel)")}: `
+        )).trim();
+        if (!input || input.toLowerCase() === "q") return 1;
+        outcome = await session.completeWithCode(input, controller.signal);
+      }
+    }
+    if (!outcome) {
+      deps.renderer.write(color3.dim("  Sign-in cancelled or timed out.\n"));
+      return 1;
+    }
+    controller.signal.throwIfAborted();
+    await mutateConfigProviders(
+      deps.profileConfigPath,
+      deps.vault,
+      (providers) => {
+        controller.signal.throwIfAborted();
+        applyProviderAuthOutcome(providers, outcome, { targetProviderId: opts.providerId });
+      },
+      deps.profileConfigPath
+    );
+    const savedId = opts.providerId ?? outcome.providerId;
+    deps.renderer.write(color3.green(`
+  \u2713 Signed in \u2014 saved as ${savedId}.
+`));
+    return 0;
+  } catch (error) {
+    const message = error instanceof DOMException && error.name === "AbortError" ? "Login cancelled." : toErrorMessage(error);
+    deps.renderer.writeError(`  Login failed: ${message}`);
+    return 1;
+  } finally {
+    session?.close();
+    if (opts.signal) opts.signal.removeEventListener("abort", onExternalAbort);
+    else process.off("SIGINT", onSigint);
+  }
+}
+
 // src/auth-menu/oauth-menu.ts
 import { color as color4 } from "@wrongstack/core/utils";
 function renderOAuthLoginOptions(deps, indent = "    ") {
@@ -2001,11 +2002,11 @@ export {
   readKeyInput,
   confirm,
   validateFamily,
-  providerAuthStrategiesFor,
-  runProviderAuthLogin,
   LOCAL_LLM_PRESETS,
   parseAuthMenuIndex,
   runAuthLocal,
+  providerAuthStrategiesFor,
+  runProviderAuthLogin,
   resolveOAuthKind,
   runOAuthLoginKind,
   runOAuthLoginMenu,
@@ -2024,4 +2025,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-RAWHRRUJ.js.map
+//# sourceMappingURL=chunk-I5LJLKA3.js.map