@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/github-copilot-CYkjeTi3.mjs

@@ -0,0 +1,208 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-Dd8DIqs-.mjs";
+import { r as getBundledModels } from "./models-SGASygJ3.mjs";
+import { a as getGitHubCopilotBaseUrl, c as normalizeDomain, i as discoverGitHubCopilotApiEndpoint, l as normalizeGitHubCopilotEnterpriseDomain, n as OPENCODE_HEADERS, s as isPublicGitHubHost, t as COPILOT_API_HEADERS } from "./github-copilot-B1yiyVRh.mjs";
+import { scheduler } from "node:timers/promises";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
+/**
+* GitHub Copilot OAuth flow (opencode OAuth app)
+*/
+const CLIENT_ID = "Ov23li8tweQw6odWQebz";
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+function getUrls(domain) {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`
+	};
+}
+async function fetchJson(url, init, fetchImpl) {
+	const response = await fetchImpl(url, init);
+	if (!response.ok) {
+		const text = await response.text();
+		throw new ProviderHttpError(`${response.status} ${response.statusText}: ${text}`, response.status);
+	}
+	return response.json();
+}
+async function startDeviceFlow(domain, fetchImpl) {
+	const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...OPENCODE_HEADERS
+		},
+		body: JSON.stringify({
+			client_id: CLIENT_ID,
+			scope: "read:user"
+		})
+	}, fetchImpl);
+	if (!data || typeof data !== "object") throw new OAuthError("Invalid device code response", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	const deviceCode = data.device_code;
+	const userCode = data.user_code;
+	const verificationUri = data.verification_uri;
+	const interval = data.interval;
+	const expiresIn = data.expires_in;
+	if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof interval !== "number" || typeof expiresIn !== "number") throw new OAuthError("Invalid device code response fields", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn
+	};
+}
+async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, expiresIn, signal, fetchImpl, pollIntervalFloorMs = 1e3, pollIntervalScaleMs = 1e3) {
+	const urls = getUrls(domain);
+	const deadline = Date.now() + expiresIn * 1e3;
+	let intervalMs = Math.max(pollIntervalFloorMs, Math.floor(intervalSeconds * pollIntervalScaleMs));
+	let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;
+	let slowDownResponses = 0;
+	while (Date.now() < deadline) {
+		if (signal?.aborted) throw new LoginCancelledError();
+		const remainingMs = deadline - Date.now();
+		const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);
+		try {
+			await scheduler.wait(waitMs, { signal });
+		} catch {
+			throw new LoginCancelledError();
+		}
+		const raw = await fetchJson(urls.accessTokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				...OPENCODE_HEADERS
+			},
+			body: JSON.stringify({
+				client_id: CLIENT_ID,
+				device_code: deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			})
+		}, fetchImpl);
+		if (raw && typeof raw === "object" && typeof raw.access_token === "string") return raw.access_token;
+		if (raw && typeof raw === "object" && typeof raw.error === "string") {
+			const { error, error_description: description, interval } = raw;
+			if (error === "authorization_pending") continue;
+			if (error === "slow_down") {
+				slowDownResponses += 1;
+				intervalMs = typeof interval === "number" && interval > 0 ? Math.max(pollIntervalFloorMs, interval * pollIntervalScaleMs) : Math.max(pollIntervalFloorMs, intervalMs + 5 * pollIntervalScaleMs);
+				intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;
+				continue;
+			}
+			const descriptionSuffix = description ? `: ${description}` : "";
+			throw new OAuthError(`Device flow failed: ${error}${descriptionSuffix}`, {
+				kind: "polling",
+				provider: "github-copilot"
+			});
+		}
+	}
+	if (slowDownResponses > 0) throw new OAuthError("Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.", {
+		kind: "timeout",
+		provider: "github-copilot"
+	});
+	throw new OAuthError("Device flow timed out", {
+		kind: "timeout",
+		provider: "github-copilot"
+	});
+}
+/** Far-future expiry (10 years). GitHub OAuth tokens are long-lived; no JWT exchange needed. */
+const FAR_FUTURE_MS = Date.now() + 315576e6;
+/**
+* Refresh GitHub Copilot token.
+* With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+*/
+function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, apiEndpoint) {
+	return {
+		refresh: refreshToken,
+		access: refreshToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain,
+		apiEndpoint
+	};
+}
+/**
+* Enable a model for the user's GitHub Copilot account.
+* This is required for some models (like Claude, Grok) before they can be used.
+*/
+async function enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint) {
+	const url = `${apiEndpoint ?? getGitHubCopilotBaseUrl(enterpriseDomain)}/models/${modelId}/policy`;
+	try {
+		return (await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`,
+				...COPILOT_API_HEADERS,
+				"openai-intent": "chat-policy",
+				"x-interaction-type": "chat-policy"
+			},
+			body: JSON.stringify({ state: "enabled" })
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+/**
+* Enable all known GitHub Copilot models that may require policy acceptance.
+* Called after successful login to ensure all models are available.
+*/
+async function enableAllGitHubCopilotModels(token, enterpriseDomain, apiEndpoint, fetchImpl, onProgress) {
+	const wireModelIds = [...new Set(getBundledModels("github-copilot").map((model) => model.requestModelId ?? model.id))];
+	const BATCH_SIZE = 5;
+	for (let i = 0; i < wireModelIds.length; i += BATCH_SIZE) {
+		const batch = wireModelIds.slice(i, i + BATCH_SIZE);
+		await Promise.all(batch.map(async (modelId) => {
+			const success = await enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint);
+			onProgress?.(modelId, success);
+		}));
+	}
+}
+/**
+* Login with GitHub Copilot OAuth (device code flow)
+*
+* @param options.onAuth - Callback with URL and optional instructions (user code)
+* @param options.onPrompt - Callback to prompt user for input
+* @param options.onProgress - Optional progress callback
+* @param options.signal - Optional AbortSignal for cancellation
+*/
+async function loginGitHubCopilot(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = input.trim();
+	const normalizedDomain = normalizeDomain(input);
+	if (trimmed && !normalizedDomain) throw new OAuthError("Invalid GitHub Enterprise URL/domain", {
+		kind: "validation",
+		provider: "github-copilot"
+	});
+	const enterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(normalizedDomain ?? void 0);
+	const domain = normalizedDomain && isPublicGitHubHost(normalizedDomain) ? "github.com" : normalizedDomain ?? "github.com";
+	const device = await startDeviceFlow(domain, fetchImpl);
+	options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);
+	const githubAccessToken = await pollForGitHubAccessToken(domain, device.device_code, device.interval, device.expires_in, options.signal, fetchImpl, options.pollIntervalFloorMs, options.pollIntervalScaleMs);
+	const apiEndpoint = await discoverGitHubCopilotApiEndpoint(githubAccessToken, fetchImpl);
+	const credentials = {
+		refresh: githubAccessToken,
+		access: githubAccessToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain ?? void 0,
+		apiEndpoint
+	};
+	options.onProgress?.("Enabling models...");
+	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? void 0, apiEndpoint, fetchImpl);
+	return credentials;
+}
+//#endregion
+export { loginGitHubCopilot, refreshGitHubCopilotToken };

package/lib/github-copilot-jscUZ8Hf.mjs

@@ -0,0 +1,104 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { n as isRecord } from "./type-guards-B9VVjRDK.mjs";
+import "./utils-DzXZDfYc.mjs";
+const OPENCODE_HEADERS = { "User-Agent": "opencode/1.3.15" };
+/**
+* Copilot API version sent on `api.githubcopilot.com` requests (`/models`,
+* chat endpoints). Newer versions unlock tiered context metadata: `/models`
+* reports the full long-context window in `capabilities.limits` plus per-tier
+* boundaries/prices under `billing.token_prices.{default,long_context}`.
+* Without it the endpoint serves default-tier limits only (e.g. 264k instead
+* of 1M for Claude Opus). Never send this to `api.github.com` REST endpoints —
+* they validate `X-GitHub-Api-Version` against the REST version vocabulary.
+*/
+const COPILOT_API_VERSION = "2026-06-01";
+/** Headers for `api.githubcopilot.com` (capi) requests: discovery, chat, policy. */
+const COPILOT_API_HEADERS = {
+	...OPENCODE_HEADERS,
+	"X-GitHub-Api-Version": COPILOT_API_VERSION
+};
+const PUBLIC_GITHUB_HOSTS = /* @__PURE__ */ new Set([
+	"api.github.com",
+	"github.com",
+	"www.github.com"
+]);
+function isPublicGitHubHost(host) {
+	return PUBLIC_GITHUB_HOSTS.has(host.trim().toLowerCase());
+}
+/** Canonical personal-Copilot API host. */
+const PERSONAL_GITHUB_COPILOT_BASE_URL = "https://api.githubcopilot.com";
+/** `true` when the resolved base URL is the canonical personal-Copilot host. */
+function isPersonalGitHubCopilotBaseUrl(baseUrl) {
+	return baseUrl === PERSONAL_GITHUB_COPILOT_BASE_URL;
+}
+function normalizeGitHubCopilotEnterpriseDomain(input) {
+	const trimmed = input?.trim();
+	if (!trimmed) return void 0;
+	const normalized = normalizeDomain(trimmed) ?? trimmed.toLowerCase();
+	if (!normalized || isPublicGitHubHost(normalized)) return void 0;
+	return normalized;
+}
+function normalizeGitHubCopilotApiEndpoint(input) {
+	const trimmed = input?.trim();
+	if (!trimmed?.startsWith("https://")) return void 0;
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" || !url.hostname) return void 0;
+		return trimmed.replace(/\/+$/, "");
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve the plan-specific Copilot API endpoint advertised for a GitHub token.
+* Login and raw environment-token discovery share this best-effort probe. Pass
+* a `signal` to bound it against the same discovery deadline as `/models`; a
+* stalled probe otherwise blocks discovery indefinitely.
+*/
+async function discoverGitHubCopilotApiEndpoint(token, fetchImpl, signal) {
+	try {
+		const response = await fetchImpl("https://api.github.com/copilot_internal/user", {
+			headers: {
+				Accept: "application/json",
+				Authorization: `token ${token}`,
+				...OPENCODE_HEADERS
+			},
+			signal
+		});
+		if (!response.ok) return void 0;
+		const data = await response.json();
+		if (!isRecord(data) || !isRecord(data.endpoints)) return void 0;
+		const endpoint = data.endpoints.api;
+		return typeof endpoint === "string" ? normalizeGitHubCopilotApiEndpoint(endpoint) : void 0;
+	} catch {
+		return;
+	}
+}
+function parseGitHubCopilotApiKey(apiKeyRaw) {
+	try {
+		const parsed = JSON.parse(apiKeyRaw);
+		if (typeof parsed.token === "string") return {
+			accessToken: parsed.token,
+			enterpriseUrl: typeof parsed.enterpriseUrl === "string" ? normalizeGitHubCopilotEnterpriseDomain(parsed.enterpriseUrl) : void 0,
+			apiEndpoint: typeof parsed.apiEndpoint === "string" ? normalizeGitHubCopilotApiEndpoint(parsed.apiEndpoint) : void 0
+		};
+	} catch {}
+	return { accessToken: apiKeyRaw };
+}
+function normalizeDomain(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		return (trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`)).hostname;
+	} catch {
+		return null;
+	}
+}
+function getGitHubCopilotBaseUrl(enterpriseDomain) {
+	const normalizedEnterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(enterpriseDomain);
+	if (!normalizedEnterpriseDomain) return "https://api.githubcopilot.com";
+	return `https://${normalizedEnterpriseDomain.startsWith("copilot-api.") ? normalizedEnterpriseDomain : `copilot-api.${normalizedEnterpriseDomain}`}`;
+}
+//#endregion
+export { getGitHubCopilotBaseUrl as a, normalizeDomain as c, discoverGitHubCopilotApiEndpoint as i, normalizeGitHubCopilotEnterpriseDomain as l, OPENCODE_HEADERS as n, isPersonalGitHubCopilotBaseUrl as o, PERSONAL_GITHUB_COPILOT_BASE_URL as r, isPublicGitHubHost as s, COPILOT_API_HEADERS as t, parseGitHubCopilotApiKey as u };

package/lib/gitlab-duo-CM7Ref1H.mjs

@@ -0,0 +1,155 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { c as OAuthError } from "./error-Dd8DIqs-.mjs";
+import { i as clearGitLabDuoDirectAccessCache } from "./stream-CRtexYLe.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-CQ5Jo8F-.mjs";
+import { t as generatePKCE } from "./pkce-BlQikGPu.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/gitlab-duo.ts
+const GITLAB_COM_URL = "https://gitlab.com";
+/**
+* Default OAuth client id baked into the bundled GitLab Duo login flow. GitLab
+* authorize requests are rejected outright (`The redirect URI included is not
+* valid`) whenever this client id's registered redirect URI list drifts from
+* `http://localhost:8080/callback`. Users hitting that case can either:
+*
+* - register their own GitLab OAuth application and override the bundled
+*   credentials with `GITLAB_CLIENT_ID` + `GITLAB_REDIRECT_URI`, or
+* - skip OAuth entirely and supply a Personal Access Token via `GITLAB_TOKEN`.
+*
+* @see https://github.com/can1357/oh-my-pi/issues/2424
+*/
+const DEFAULT_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b";
+const OAUTH_SCOPES = ["api"];
+const DEFAULT_CALLBACK_PORT = 8080;
+const DEFAULT_CALLBACK_PATH = "/callback";
+const DEFAULT_CALLBACK_HOSTNAME = "localhost";
+/**
+* Resolve the OAuth client id, preferring `GITLAB_CLIENT_ID` when set so users
+* with their own GitLab OAuth application can bypass the bundled credentials.
+*/
+function resolveClientId() {
+	const env = process.env.GITLAB_CLIENT_ID?.trim();
+	return env && env.length > 0 ? env : DEFAULT_CLIENT_ID;
+}
+/**
+* Resolve callback-server options from `GITLAB_REDIRECT_URI`. When set, the
+* exact string is advertised to GitLab (strict matching), random-port fallback
+* is disabled, and HTTP loopback URIs bind the listener to the URI's host/port
+* so the browser callback lands on us. HTTPS loopback URIs are rejected because
+* the local callback server is plaintext HTTP. Non-loopback URIs bind a random
+* local port — only the paste-code path can complete in that case.
+*/
+function resolveCallbackOptions() {
+	const raw = process.env.GITLAB_REDIRECT_URI?.trim();
+	if (!raw) return {
+		preferredPort: DEFAULT_CALLBACK_PORT,
+		callbackPath: DEFAULT_CALLBACK_PATH,
+		callbackHostname: DEFAULT_CALLBACK_HOSTNAME
+	};
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo"
+		});
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {
+		kind: "configuration",
+		provider: "gitlab-duo"
+	});
+	const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+	if (isLoopback && parsed.protocol !== "http:") throw new OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {
+		kind: "configuration",
+		provider: "gitlab-duo"
+	});
+	const port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
+	return {
+		preferredPort: isLoopback ? port : 0,
+		callbackPath: parsed.pathname || DEFAULT_CALLBACK_PATH,
+		callbackHostname: isLoopback ? parsed.hostname : DEFAULT_CALLBACK_HOSTNAME,
+		redirectUri: raw
+	};
+}
+function mapTokenResponse(payload) {
+	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") throw new OAuthError("GitLab OAuth token response missing required fields", {
+		kind: "validation",
+		provider: "gitlab-duo"
+	});
+	const createdAtMs = typeof payload.created_at === "number" && Number.isFinite(payload.created_at) ? payload.created_at * 1e3 : Date.now();
+	return {
+		access: payload.access_token,
+		refresh: payload.refresh_token,
+		expires: createdAtMs + payload.expires_in * 1e3 - 3e5
+	};
+}
+var GitLabDuoOAuthFlow = class extends OAuthCallbackFlow {
+	#pkce;
+	#clientId;
+	#fetch;
+	constructor(ctrl, pkce, clientId, options) {
+		super(ctrl, options);
+		this.#pkce = pkce;
+		this.#clientId = clientId;
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const authParams = new URLSearchParams({
+			client_id: this.#clientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: OAUTH_SCOPES.join(" "),
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+			state
+		});
+		return {
+			url: `${GITLAB_COM_URL}/oauth/authorize?${authParams.toString()}`,
+			instructions: "Complete GitLab login in browser. If GitLab responds with \"The redirect URI included is not valid\", register your own GitLab OAuth application and set GITLAB_CLIENT_ID + GITLAB_REDIRECT_URI, or use a Personal Access Token via GITLAB_TOKEN."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		const response = await this.#fetch(`${GITLAB_COM_URL}/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.#clientId,
+				grant_type: "authorization_code",
+				code,
+				code_verifier: this.#pkce.verifier,
+				redirect_uri: redirectUri
+			}).toString()
+		});
+		if (!response.ok) throw new OAuthError(`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`, {
+			kind: "token-exchange",
+			provider: "gitlab-duo",
+			status: response.status
+		});
+		clearGitLabDuoDirectAccessCache();
+		return mapTokenResponse(await response.json());
+	}
+};
+async function loginGitLabDuo(callbacks) {
+	return new GitLabDuoOAuthFlow(callbacks, await generatePKCE(), resolveClientId(), resolveCallbackOptions()).login();
+}
+async function refreshGitLabDuoToken(credentials) {
+	const response = await fetch(`${GITLAB_COM_URL}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: resolveClientId(),
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh
+		}).toString()
+	});
+	if (!response.ok) throw new OAuthError(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`, {
+		kind: "token-refresh",
+		provider: "gitlab-duo",
+		status: response.status
+	});
+	clearGitLabDuoDirectAccessCache();
+	return mapTokenResponse(await response.json());
+}
+//#endregion
+export { loginGitLabDuo, refreshGitLabDuoToken };

package/lib/gitlab-duo-akICyfeD.mjs

@@ -0,0 +1,155 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { c as OAuthError } from "./error-B3bevhrs.mjs";
+import { i as clearGitLabDuoDirectAccessCache } from "./stream-C_RAoxJC.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-BEFNf-jf.mjs";
+import { t as generatePKCE } from "./pkce-BlQikGPu.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/gitlab-duo.ts
+const GITLAB_COM_URL = "https://gitlab.com";
+/**
+* Default OAuth client id baked into the bundled GitLab Duo login flow. GitLab
+* authorize requests are rejected outright (`The redirect URI included is not
+* valid`) whenever this client id's registered redirect URI list drifts from
+* `http://localhost:8080/callback`. Users hitting that case can either:
+*
+* - register their own GitLab OAuth application and override the bundled
+*   credentials with `GITLAB_CLIENT_ID` + `GITLAB_REDIRECT_URI`, or
+* - skip OAuth entirely and supply a Personal Access Token via `GITLAB_TOKEN`.
+*
+* @see https://github.com/can1357/oh-my-pi/issues/2424
+*/
+const DEFAULT_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b";
+const OAUTH_SCOPES = ["api"];
+const DEFAULT_CALLBACK_PORT = 8080;
+const DEFAULT_CALLBACK_PATH = "/callback";
+const DEFAULT_CALLBACK_HOSTNAME = "localhost";
+/**
+* Resolve the OAuth client id, preferring `GITLAB_CLIENT_ID` when set so users
+* with their own GitLab OAuth application can bypass the bundled credentials.
+*/
+function resolveClientId() {
+	const env = process.env.GITLAB_CLIENT_ID?.trim();
+	return env && env.length > 0 ? env : DEFAULT_CLIENT_ID;
+}
+/**
+* Resolve callback-server options from `GITLAB_REDIRECT_URI`. When set, the
+* exact string is advertised to GitLab (strict matching), random-port fallback
+* is disabled, and HTTP loopback URIs bind the listener to the URI's host/port
+* so the browser callback lands on us. HTTPS loopback URIs are rejected because
+* the local callback server is plaintext HTTP. Non-loopback URIs bind a random
+* local port — only the paste-code path can complete in that case.
+*/
+function resolveCallbackOptions() {
+	const raw = process.env.GITLAB_REDIRECT_URI?.trim();
+	if (!raw) return {
+		preferredPort: DEFAULT_CALLBACK_PORT,
+		callbackPath: DEFAULT_CALLBACK_PATH,
+		callbackHostname: DEFAULT_CALLBACK_HOSTNAME
+	};
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo"
+		});
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {
+		kind: "configuration",
+		provider: "gitlab-duo"
+	});
+	const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+	if (isLoopback && parsed.protocol !== "http:") throw new OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {
+		kind: "configuration",
+		provider: "gitlab-duo"
+	});
+	const port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
+	return {
+		preferredPort: isLoopback ? port : 0,
+		callbackPath: parsed.pathname || DEFAULT_CALLBACK_PATH,
+		callbackHostname: isLoopback ? parsed.hostname : DEFAULT_CALLBACK_HOSTNAME,
+		redirectUri: raw
+	};
+}
+function mapTokenResponse(payload) {
+	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") throw new OAuthError("GitLab OAuth token response missing required fields", {
+		kind: "validation",
+		provider: "gitlab-duo"
+	});
+	const createdAtMs = typeof payload.created_at === "number" && Number.isFinite(payload.created_at) ? payload.created_at * 1e3 : Date.now();
+	return {
+		access: payload.access_token,
+		refresh: payload.refresh_token,
+		expires: createdAtMs + payload.expires_in * 1e3 - 3e5
+	};
+}
+var GitLabDuoOAuthFlow = class extends OAuthCallbackFlow {
+	#pkce;
+	#clientId;
+	#fetch;
+	constructor(ctrl, pkce, clientId, options) {
+		super(ctrl, options);
+		this.#pkce = pkce;
+		this.#clientId = clientId;
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const authParams = new URLSearchParams({
+			client_id: this.#clientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: OAUTH_SCOPES.join(" "),
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+			state
+		});
+		return {
+			url: `${GITLAB_COM_URL}/oauth/authorize?${authParams.toString()}`,
+			instructions: "Complete GitLab login in browser. If GitLab responds with \"The redirect URI included is not valid\", register your own GitLab OAuth application and set GITLAB_CLIENT_ID + GITLAB_REDIRECT_URI, or use a Personal Access Token via GITLAB_TOKEN."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		const response = await this.#fetch(`${GITLAB_COM_URL}/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.#clientId,
+				grant_type: "authorization_code",
+				code,
+				code_verifier: this.#pkce.verifier,
+				redirect_uri: redirectUri
+			}).toString()
+		});
+		if (!response.ok) throw new OAuthError(`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`, {
+			kind: "token-exchange",
+			provider: "gitlab-duo",
+			status: response.status
+		});
+		clearGitLabDuoDirectAccessCache();
+		return mapTokenResponse(await response.json());
+	}
+};
+async function loginGitLabDuo(callbacks) {
+	return new GitLabDuoOAuthFlow(callbacks, await generatePKCE(), resolveClientId(), resolveCallbackOptions()).login();
+}
+async function refreshGitLabDuoToken(credentials) {
+	const response = await fetch(`${GITLAB_COM_URL}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: resolveClientId(),
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh
+		}).toString()
+	});
+	if (!response.ok) throw new OAuthError(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`, {
+		kind: "token-refresh",
+		provider: "gitlab-duo",
+		status: response.status
+	});
+	clearGitLabDuoDirectAccessCache();
+	return mapTokenResponse(await response.json());
+}
+//#endregion
+export { loginGitLabDuo, refreshGitLabDuoToken };