@xiaoso/dsh-tool-plus 0.1.16 → 0.1.17-beta.0

package/lib/factory-droid-ChhmsGWb.mjs

@@ -0,0 +1,71 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { _ as LoginCancelledError, h as OAuthError } from "./error-8LVo7tug.mjs";
+import "./utils-C_Ncya1r.mjs";
+import { h as isRecord } from "./cascade-BWjRTD1q.mjs";
+import { l as factoryDroidApiBaseUrl, p as resolveFactoryDroidInferenceRegion } from "./id-EJwVLDHE.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/factory-droid.ts
+/** Resolve canonical Factory identity; residency chooses the host, inference scope chooses eligible routes. */
+const attachFactoryDroidRegion = async (credentials, context) => {
+	if (context.signal?.aborted) throw new LoginCancelledError("Login cancelled");
+	if (!isRecord(context.raw) || typeof context.raw.refresh_token !== "string" || !credentials.refresh) throw new OAuthError("Factory token response missing refresh token", { kind: "validation" });
+	const selectedOrg = typeof context.raw.organization_id === "string" ? context.raw.organization_id : context.stored?.activeOrganizationId;
+	const sameOrg = !Boolean(credentials.orgId && context.stored?.orgId && credentials.orgId !== context.stored.orgId) && (!selectedOrg || !context.stored?.activeOrganizationId || selectedOrg === context.stored.activeOrganizationId);
+	const identity = {
+		...credentials,
+		activeOrganizationId: selectedOrg,
+		orgId: credentials.orgId ?? (sameOrg ? context.stored?.orgId : void 0),
+		region: sameOrg ? context.stored?.region : void 0,
+		inferenceRegion: sameOrg ? context.stored?.inferenceRegion : void 0
+	};
+	const timeout = AbortSignal.timeout(15e3);
+	const signal = context.signal ? AbortSignal.any([context.signal, timeout]) : timeout;
+	try {
+		const response = await context.fetch(`${factoryDroidApiBaseUrl(identity.region)}/api/cli/whoami`, {
+			headers: {
+				Authorization: `Bearer ${credentials.access}`,
+				Accept: "application/json",
+				...identity.orgId ? { "X-Factory-Org-Id": identity.orgId } : {}
+			},
+			signal
+		});
+		if (!response.ok && context.phase === "login") throw new OAuthError(`Factory identity check failed (${response.status}): ${await response.text()}`, {
+			kind: "validation",
+			provider: context.provider,
+			status: response.status
+		});
+		if (response.ok) {
+			const body = await response.json();
+			if (isRecord(body)) {
+				const orgId = typeof body.orgId === "string" && body.orgId ? body.orgId : identity.orgId;
+				if (context.phase === "login" && !orgId) throw new OAuthError("Factory login did not resolve an organization", {
+					kind: "validation",
+					provider: context.provider
+				});
+				const carried = !orgId || !identity.orgId || orgId === identity.orgId ? identity : void 0;
+				const region = body.region === "eu" || body.region === "global" ? body.region : carried?.region;
+				const inferenceRegion = body.inferenceRegion === "global" || body.inferenceRegion === "eu" || body.inferenceRegion === "us" ? body.inferenceRegion : resolveFactoryDroidInferenceRegion({
+					region,
+					inferenceRegion: carried?.inferenceRegion
+				});
+				return {
+					...identity,
+					orgId,
+					region,
+					inferenceRegion
+				};
+			}
+		}
+	} catch (error) {
+		if (context.signal?.aborted) throw new LoginCancelledError("Login cancelled");
+		if (context.phase === "login") throw error;
+	}
+	if (context.signal?.aborted) throw new LoginCancelledError("Login cancelled");
+	if (context.phase === "login" && !identity.orgId) throw new OAuthError("Factory login did not resolve an organization", {
+		kind: "validation",
+		provider: context.provider
+	});
+	return identity;
+};
+//#endregion
+export { attachFactoryDroidRegion };

package/lib/{fs-promises-shim-B2YFWkcd.mjs → fs-promises-shim-CANAxFWh.mjs}

@@ -7,6 +7,14 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
 var __exportAll = (all, no_symbols) => {
 	let target = {};
 	for (var name in all) __defProp(target, name, {
@@ -27,6 +35,7 @@ var __copyProps = (to, from, except, desc) => {
 	return to;
 };
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 //#endregion
 //#region src/tools/shared/fs-promises-shim.ts
 /**
@@ -55,4 +64,4 @@ async function exists(path) {
 	}
 }
 //#endregion
-export { fs_promises_shim_exports as n, __exportAll as r, exists as t };
+export { __toCommonJS as a, __exportAll as i, fs_promises_shim_exports as n, __esmMin as r, exists as t };

package/lib/{github-copilot-BMEcw8N1.mjs → github-copilot-QwevdT30.mjs}

@@ -1,10 +1,10 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { V as ProviderHttpError, f as OAuthError, g as OnPromptRequiredError, m as LoginCancelledError } from "./error-O63pC8zg.mjs";
-import { r as getBundledModels } from "./models-DnXMYGcJ.mjs";
-import { _ as normalizeCopilotIntegrationId, f as discoverGitHubCopilotApiEndpoint, h as isPublicGitHubHost, o as wrapFetchForCopilotFallback, p as getGitHubCopilotBaseUrl, r as resolveCopilotIntegrationIdOverride, s as COPILOT_API_HEADERS, v as normalizeDomain, y as normalizeGitHubCopilotEnterpriseDomain } from "./github-copilot-headers-DnjGEbko.mjs";
+import { X as ProviderHttpError, _ as LoginCancelledError, h as OAuthError, y as OnPromptRequiredError } from "./error-8LVo7tug.mjs";
+import { r as getBundledModels } from "./models-DCpDT_im.mjs";
+import { _ as isPublicGitHubHost, a as resolveCopilotIntegrationIdOverride, b as normalizeDomain, c as wrapFetchForCopilotFallback, h as getGitHubCopilotBaseUrl, l as COPILOT_API_HEADERS, m as discoverGitHubCopilotApiEndpoint, x as normalizeGitHubCopilotEnterpriseDomain, y as normalizeCopilotIntegrationId } from "./github-copilot-headers-CAUZ0rUD.mjs";
 import { scheduler } from "node:timers/promises";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/github-copilot.ts
 /**
 * GitHub Copilot OAuth flow (OpenCode OAuth app, minimal read:user grant).
 *

package/lib/{github-copilot-headers-DnjGEbko.mjs → github-copilot-headers-CAUZ0rUD.mjs}

@@ -1,9 +1,9 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { C as warn, N as $env } from "./src-AELUUb5U.mjs";
-import { n as isRecord } from "./type-guards-CttAANEx.mjs";
-import "./utils-I4I8azHN.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/wire/github-copilot.ts
+import { H as $env, k as warn, p as LRUCache } from "./src-BhinCSpi.mjs";
+import { h as isRecord } from "./cascade-BWjRTD1q.mjs";
+import "./utils-DrDwmNtu.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.12.6/node_modules/@oh-my-pi/pi-catalog/src/wire/github-copilot.ts
 const COPILOT_CLI_USER_AGENT = `copilot/1.0.82`;
 /** Headers sent by Copilot CLI to GitHub API and OAuth endpoints. */
 const COPILOT_GITHUB_HEADERS = { "User-Agent": COPILOT_CLI_USER_AGENT };
@@ -164,7 +164,7 @@ function getGitHubCopilotBaseUrl(enterpriseDomain) {
 	return `https://${normalizedEnterpriseDomain.startsWith("copilot-api.") ? normalizedEnterpriseDomain : `copilot-api.${normalizedEnterpriseDomain}`}`;
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/github-copilot-headers.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/providers/github-copilot-headers.ts
 function resolveGitHubCopilotBaseUrl(baseUrl, apiKey) {
 	if (!apiKey) return baseUrl;
 	const { enterpriseUrl, apiEndpoint } = parseGitHubCopilotApiKey(apiKey);
@@ -200,37 +200,149 @@ function explicitCopilotIntegrationId(headers) {
 function resolveCopilotRequestIdentity(headers, explicit, env = $env) {
 	return normalizeCopilotIntegrationId(explicit) ?? normalizeCopilotIntegrationId(explicitCopilotIntegrationId(headers)) ?? resolveCopilotIntegrationIdOverride(env);
 }
+const copilotWorkingIntegrationCache = new LRUCache({ max: 50 });
 /**
-* Reissue chat-surface Copilot 403s once as the Copilot CLI.
+* Normalize the effective request host for cache isolation. Custom
+* `model.baseUrl` values survive `resolveGitHubCopilotBaseUrl`, so two proxies
+* fronting different org policies must not share a learned identity even when
+* the token envelope matches.
+*/
+function normalizeCopilotCacheBaseUrl(baseUrl) {
+	const trimmed = baseUrl?.trim().replace(/\/+$/, "") ?? "";
+	if (!trimmed) return "";
+	try {
+		const url = new URL(trimmed);
+		return `${url.protocol}//${url.host.toLowerCase()}${url.pathname.replace(/\/+$/, "")}${url.search}${url.hash}`;
+	} catch {
+		return trimmed.toLowerCase();
+	}
+}
+/**
+* Stable cache key for a raw Copilot API key envelope on one effective host.
+* Hashes the bearer with `Bun.hash` (repo-approved hashing API; same
+* credential-scoped pattern as the GitLab Duo and Codex account keys) so token
+* bytes never sit in the map as keys; enterprise/business routing inputs and
+* the normalized effective base URL participate so the same token on two hosts
+* does not share an entry.
+*/
+function getCopilotIntegrationCacheKey(apiKeyRaw, baseUrl) {
+	if (!apiKeyRaw) return void 0;
+	const trimmed = apiKeyRaw.trim();
+	if (!trimmed) return void 0;
+	const parsed = parseGitHubCopilotApiKey(trimmed);
+	if (!parsed.accessToken) return void 0;
+	const fingerprint = Bun.hash(parsed.accessToken).toString(36);
+	return `${parsed.enterpriseUrl ?? ""}\0${parsed.apiEndpoint ?? ""}\0${normalizeCopilotCacheBaseUrl(baseUrl)}\0${fingerprint}`;
+}
+/** Cached working identity for a cache key, if one was learned. */
+function getCachedCopilotIntegrationId(cacheKey) {
+	if (!cacheKey) return void 0;
+	return normalizeCopilotIntegrationId(copilotWorkingIntegrationCache.get(cacheKey));
+}
+/**
+* Remember the identity that cleared the identity gate for a credential.
+* Every store refreshes recency, so hot credentials survive eviction.
+*/
+function rememberCopilotWorkingIntegrationId(cacheKey, integrationId) {
+	const normalized = normalizeCopilotIntegrationId(integrationId);
+	if (!cacheKey || !normalized) return;
+	copilotWorkingIntegrationCache.set(cacheKey, normalized);
+}
+/** Clear one cached identity, or the whole cache when no key is given. */
+function clearCopilotIntegrationCache(cacheKey) {
+	if (cacheKey === void 0) copilotWorkingIntegrationCache.clear();
+	else copilotWorkingIntegrationCache.delete(cacheKey);
+}
+/**
+* True when a response is a client-identity denial: HTTP 403, or HTTP 400
+* carrying `code: "model_not_supported"`. Reads a clone so the caller's body
+* stays intact. Unreadable 400s are not denials.
+*/
+async function isCopilotIdentityDenied(response) {
+	if (response.status === 403) return true;
+	if (response.status !== 400) return false;
+	try {
+		return (await response.clone().json())?.error?.code === "model_not_supported";
+	} catch {
+		return false;
+	}
+}
+/**
+* Reissue Copilot client-identity denials once with the other surface.
 *
 * Chat is the default surface (`COPILOT_CHAT_INTEGRATION_ID`) because Business
 * organizations that gate premium models per client surface commonly allow
-* chat while blocking CLI/agentic clients (issue #11372). The retry fires
-* only for requests carrying the chat default and only when the caller
-* resolved no explicit identity — an explicit choice is never second-guessed.
-* The denied body is drained before reissuing, and the retry carries the CLI
-* identity so the guard passes it through: at most two requests, never a loop.
+* chat while blocking CLI/agentic clients (issue #11372). Other Business and
+* Enterprise orgs do the opposite and reject the chat identity — as an HTTP 403
+* or, on `api.business.githubcopilot.com`, an HTTP 400 `model_not_supported`
+* (issue #11669). Both denials retry once as the CLI. The retry fires only for
+* requests carrying the chat default and only when the caller resolved no
+* explicit identity — an explicit choice is never second-guessed. The denied
+* body is drained before reissuing, and the retry carries the CLI identity so
+* the guard passes it through: at most two requests, never a loop.
+*
+* When `cacheKey` is set, a 2xx retry remembers its identity via
+* `rememberCopilotWorkingIntegrationId`, so later streams for the same
+* credential start at the working shape. A cached CLI start that is itself
+* denied (stale after an org-policy flip) retries once as chat and relearns.
+* Only a 2xx retry proves its identity — 401s deny every identity equally and
+* 408/429/5xx are transport-retryable (the transport resends the *original*
+* headers), so those must never be recorded as working. Any non-2xx retry
+* clears the entry instead: the next stream rediscovers rather than pinning a
+* shape that just failed.
 */
-function wrapFetchForCopilotFallback(base, enabled, integrationId) {
+function wrapFetchForCopilotFallback(base, enabled, integrationId, cacheKey, cacheSnapshot) {
 	const inner = base ?? fetch;
 	if (!enabled) return inner;
+	const cliIntegrationId = COPILOT_CAPI_IDENTITY_HEADERS["Copilot-Integration-Id"];
 	return async (input, init) => {
+		const cachedBeforeRequest = cacheSnapshot === void 0 ? getCachedCopilotIntegrationId(cacheKey) : normalizeCopilotIntegrationId(cacheSnapshot);
 		const response = await inner(input, init);
-		if (response.status !== 403) return response;
+		if (response.status !== 403 && response.status !== 400) return response;
 		if (input instanceof Request) return response;
 		if (normalizeCopilotIntegrationId(integrationId) !== void 0) return response;
 		const outgoing = new Headers(init?.headers);
-		if (outgoing.get("Copilot-Integration-Id") !== "copilot-chat") return response;
-		try {
-			await response.arrayBuffer();
-		} catch {}
-		warn("GitHub Copilot chat identity denied (HTTP 403); retrying once as the Copilot CLI");
-		const retryHeaders = new Headers(outgoing);
-		retryHeaders.set("Copilot-Integration-Id", COPILOT_CAPI_IDENTITY_HEADERS["Copilot-Integration-Id"]);
-		return inner(input, {
-			...init,
-			headers: retryHeaders
-		});
+		const outgoingId = outgoing.get("Copilot-Integration-Id");
+		if (outgoingId === "copilot-chat") {
+			if (await isCopilotIdentityDenied(response)) {
+				try {
+					await response.arrayBuffer();
+				} catch {}
+				warn(`GitHub Copilot chat identity denied (HTTP ${response.status}); retrying once as the Copilot CLI`);
+				const retryHeaders = new Headers(outgoing);
+				retryHeaders.set("Copilot-Integration-Id", cliIntegrationId);
+				const retry = await inner(input, {
+					...init,
+					headers: retryHeaders
+				});
+				if (cacheKey) {
+					if (retry.ok) rememberCopilotWorkingIntegrationId(cacheKey, cliIntegrationId);
+					else clearCopilotIntegrationCache(cacheKey);
+				}
+				return retry;
+			}
+			return response;
+		}
+		if (outgoingId === cliIntegrationId && cacheKey) {
+			if (cachedBeforeRequest !== cliIntegrationId) return response;
+			if (await isCopilotIdentityDenied(response)) {
+				try {
+					await response.arrayBuffer();
+				} catch {}
+				warn(`GitHub Copilot CLI identity denied (HTTP ${response.status}); retrying once as ${COPILOT_CHAT_INTEGRATION_ID}`);
+				const retryHeaders = new Headers(outgoing);
+				retryHeaders.set("Copilot-Integration-Id", COPILOT_CHAT_INTEGRATION_ID);
+				const retry = await inner(input, {
+					...init,
+					headers: retryHeaders
+				});
+				if (retry.ok) rememberCopilotWorkingIntegrationId(cacheKey, COPILOT_CHAT_INTEGRATION_ID);
+				else clearCopilotIntegrationCache(cacheKey);
+				return retry;
+			}
+			return response;
+		}
+		return response;
 	};
 }
 function inferCopilotInitiator(messages) {
@@ -296,7 +408,7 @@ function buildCopilotDynamicHeaders(params) {
 		"X-Initiator": initiator,
 		"X-Interaction-Type": `conversation-${initiator}`
 	};
-	headers["Copilot-Integration-Id"] = normalizeCopilotIntegrationId(params.integrationId) ?? "copilot-chat";
+	headers["Copilot-Integration-Id"] = normalizeCopilotIntegrationId(params.integrationId) ?? normalizeCopilotIntegrationId(params.cachedIntegrationId) ?? (params.enterpriseUrl ? COPILOT_CAPI_IDENTITY_HEADERS["Copilot-Integration-Id"] : "copilot-chat");
 	if (params.hasImages) headers["Copilot-Vision-Request"] = "true";
 	return {
 		headers,
@@ -309,4 +421,4 @@ function buildCopilotDynamicHeaders(params) {
 	};
 }
 //#endregion
-export { normalizeCopilotIntegrationId as _, resolveGitHubCopilotBaseUrl as a, parseGitHubCopilotApiKey as b, COPILOT_CHAT_INTEGRATION_ID as c, PERSONAL_GITHUB_COPILOT_BASE_URL as d, discoverGitHubCopilotApiEndpoint as f, mergeCopilotApiHeaders as g, isPublicGitHubHost as h, resolveCopilotRequestIdentity as i, COPILOT_DISCOVERY_HEADERS as l, isPersonalGitHubCopilotBaseUrl as m, hasCopilotVisionInput as n, wrapFetchForCopilotFallback as o, getGitHubCopilotBaseUrl as p, resolveCopilotIntegrationIdOverride as r, COPILOT_API_HEADERS as s, buildCopilotDynamicHeaders as t, COPILOT_GITHUB_HEADERS as u, normalizeDomain as v, normalizeGitHubCopilotEnterpriseDomain as y };
+export { parseGitHubCopilotApiKey as S, isPublicGitHubHost as _, resolveCopilotIntegrationIdOverride as a, normalizeDomain as b, wrapFetchForCopilotFallback as c, COPILOT_DISCOVERY_HEADERS as d, COPILOT_GITHUB_HEADERS as f, isPersonalGitHubCopilotBaseUrl as g, getGitHubCopilotBaseUrl as h, hasCopilotVisionInput as i, COPILOT_API_HEADERS as l, discoverGitHubCopilotApiEndpoint as m, getCachedCopilotIntegrationId as n, resolveCopilotRequestIdentity as o, PERSONAL_GITHUB_COPILOT_BASE_URL as p, getCopilotIntegrationCacheKey as r, resolveGitHubCopilotBaseUrl as s, buildCopilotDynamicHeaders as t, COPILOT_CHAT_INTEGRATION_ID as u, mergeCopilotApiHeaders as v, normalizeGitHubCopilotEnterpriseDomain as x, normalizeCopilotIntegrationId as y };

package/lib/{gitlab-duo-DnHqJjFY.mjs → gitlab-duo-DigV7k_o.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { i as clearGitLabDuoDirectAccessCache } from "./stream-AVOoe5Hj.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/gitlab-duo.ts
+import { t as clearGitLabDuoDirectAccessCache } from "./stream-D2ivg3GH.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/gitlab-duo.ts
 /** GitLab Duo OAuth residue: invalidate direct-access credentials after token rotation. */
 const gitLabDuoClearCacheHook = async (credentials) => {
 	clearGitLabDuoDirectAccessCache();

package/lib/{google-antigravity-B1mSckrK.mjs → google-antigravity-D-oe0r8A.mjs}

@@ -1,14 +1,13 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { f as OAuthError, m as LoginCancelledError } from "./error-O63pC8zg.mjs";
-import { n as raceWithSignal } from "./abort-DZ54CaKU.mjs";
-import { n as getAntigravityUserAgent } from "./gemini-headers-Co9cVvex.mjs";
-import { n as formatGoogleValidationRequiredMessage, t as extractGoogleValidationUrl } from "./google-validation-BEkNs-Bx.mjs";
-import { n as throwIfLoginCancelled, t as oauthFetch } from "./google-oauth-shared-BctLpVUN.mjs";
+import { _ as LoginCancelledError, h as OAuthError } from "./error-8LVo7tug.mjs";
+import { n as raceWithSignal } from "./abort-BTblp0Rt.mjs";
+import { a as getAntigravityUserAgent, n as formatGoogleValidationRequiredMessage, t as extractGoogleValidationUrl } from "./google-validation-CdvRj4ec.mjs";
+import { n as throwIfLoginCancelled, t as oauthFetch } from "./google-oauth-shared-CvgVIUwJ.mjs";
 import { type } from "@oh-my-pi/omptype";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-antigravity.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-antigravity.ts
 /**
-* Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
+* Google Antigravity OAuth flow (Gemini, Claude, GPT-OSS via Google Cloud)
 * Uses different OAuth credentials than google-gemini-cli for access to additional models.
 */
 const CLOUD_CODE_ASSIST_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";

package/lib/{google-gemini-cli-DJwThCCn.mjs → google-gemini-cli-CQBHgGJT.mjs}

@@ -1,11 +1,10 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { N as $env } from "./src-AELUUb5U.mjs";
-import { f as OAuthError } from "./error-O63pC8zg.mjs";
-import { r as getGeminiCliHeaders } from "./gemini-headers-Co9cVvex.mjs";
-import { n as formatGoogleValidationRequiredMessage, t as extractGoogleValidationUrl } from "./google-validation-BEkNs-Bx.mjs";
-import { n as throwIfLoginCancelled, t as oauthFetch } from "./google-oauth-shared-BctLpVUN.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-gemini-cli.ts
+import { H as $env } from "./src-BhinCSpi.mjs";
+import { h as OAuthError } from "./error-8LVo7tug.mjs";
+import { n as formatGoogleValidationRequiredMessage, o as getGeminiCliHeaders, t as extractGoogleValidationUrl } from "./google-validation-CdvRj4ec.mjs";
+import { n as throwIfLoginCancelled, t as oauthFetch } from "./google-oauth-shared-CvgVIUwJ.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-gemini-cli.ts
 /**
 * Gemini CLI OAuth flow (Google Cloud Code Assist)
 * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)

package/lib/{google-oauth-shared-BctLpVUN.mjs → google-oauth-shared-CvgVIUwJ.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { f as OAuthError, m as LoginCancelledError } from "./error-O63pC8zg.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-oauth-shared.ts
+import { _ as LoginCancelledError, h as OAuthError } from "./error-8LVo7tug.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/google-oauth-shared.ts
 /**
 * Shared OAuth flow for Google-style providers (Gemini CLI, Antigravity).
 *

package/lib/google-validation-CdvRj4ec.mjs

@@ -0,0 +1,126 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.12.6/node_modules/@oh-my-pi/pi-catalog/src/wire/gemini-headers.ts
+/**
+* Build a User-Agent string that identifies as Gemini CLI to unlock higher rate limits.
+* Uses the same format as the official Gemini CLI (v0.35+):
+* GeminiCLI/VERSION/MODEL (PLATFORM; ARCH; SURFACE)
+*/
+function getGeminiCliUserAgent(modelId = "gemini-3.1-pro-preview") {
+	return `GeminiCLI/${process.env.PI_AI_GEMINI_CLI_VERSION || "0.46.0"}/${modelId} (${process.platform === "win32" ? "win32" : process.platform}; ${process.arch === "x64" ? "x64" : process.arch}; terminal)`;
+}
+const getGeminiCliHeaders = (modelId) => ({
+	"User-Agent": getGeminiCliUserAgent(modelId),
+	"Client-Metadata": "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI"
+});
+const ANTIGRAVITY_VERSION_MANIFEST_URL = "https://antigravity-hub-auto-updater-974169037036.us-central1.run.app/manifest/latest-arm64-mac.yml";
+const ANTIGRAVITY_VERSION_FETCH_TIMEOUT_MS = 5e3;
+/** Failed manifest lookups are not retried before this delay, so request paths never stall per call. */
+const ANTIGRAVITY_VERSION_RETRY_MS = 6e5;
+let discoveredAntigravityVersion = null;
+let antigravityVersionFetch = null;
+let antigravityVersionFailedAt;
+/** Current Antigravity client version: env override → manifest-discovered → pinned fallback. */
+function getAntigravityVersion() {
+	return process.env.PI_AI_ANTIGRAVITY_VERSION || discoveredAntigravityVersion || "2.19.1";
+}
+/**
+* Extracts the client version from an electron-builder update manifest.
+* Returns null when no well-formed `version:` line is present.
+*/
+function parseAntigravityManifestVersion(yamlText) {
+	for (const line of yamlText.split(/\r?\n/)) {
+		const match = /^\s*version\s*:\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))\s*(?:#.*)?$/.exec(line);
+		if (!match) continue;
+		const version = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+		return /^\d+\.\d+\.\d+$/.test(version) ? version : null;
+	}
+	return null;
+}
+/**
+* Resolves the latest Antigravity release from the official update manifest.
+* Success is cached for the process lifetime; failures are silent (the pinned
+* fallback stays valid) and suppress further lookups for
+* `ANTIGRAVITY_VERSION_RETRY_MS`. Skipped entirely when PI_AI_ANTIGRAVITY_VERSION is set.
+*
+* The lookup is shared by concurrent callers, so it is bounded only by its own
+* timeout; `signal` ends this caller's wait without cancelling the lookup.
+*/
+function ensureAntigravityVersion(fetcher = fetch, signal) {
+	if (process.env.PI_AI_ANTIGRAVITY_VERSION || discoveredAntigravityVersion) return Promise.resolve();
+	if (!antigravityVersionFetch) {
+		if (antigravityVersionFailedAt !== void 0 && Date.now() - antigravityVersionFailedAt < ANTIGRAVITY_VERSION_RETRY_MS) return Promise.resolve();
+		antigravityVersionFetch = (async () => {
+			try {
+				const response = await fetcher(ANTIGRAVITY_VERSION_MANIFEST_URL, {
+					headers: {
+						"Cache-Control": "no-cache",
+						"User-Agent": "electron-builder"
+					},
+					signal: AbortSignal.timeout(ANTIGRAVITY_VERSION_FETCH_TIMEOUT_MS)
+				});
+				if (response.ok) discoveredAntigravityVersion = parseAntigravityManifestVersion(await response.text());
+			} catch {} finally {
+				antigravityVersionFetch = null;
+				if (!discoveredAntigravityVersion) antigravityVersionFailedAt = Date.now();
+			}
+		})();
+	}
+	const lookup = antigravityVersionFetch;
+	if (!signal) return lookup;
+	if (signal.aborted) return Promise.resolve();
+	const { promise: aborted, resolve } = Promise.withResolvers();
+	const onAbort = () => resolve();
+	signal.addEventListener("abort", onAbort, { once: true });
+	return Promise.race([lookup, aborted]).finally(() => signal.removeEventListener("abort", onAbort));
+}
+/** Antigravity `User-Agent` header value; rebuilt when the discovered version changes. */
+function getAntigravityUserAgent() {
+	const version = getAntigravityVersion();
+	const cl = process.env.PI_AI_ANTIGRAVITY_CL || "963137146";
+	return `antigravity/hub/${version} (aidev_client; os_type=${process.env.PI_AI_ANTIGRAVITY_OS || "darwin"}; arch=${process.env.PI_AI_ANTIGRAVITY_ARCH || "arm64"}; cl=${cl})`;
+}
+const ANTIGRAVITY_MODEL_WIRE_PROFILES = {
+	"gemini-3.5-flash-extra-low": {
+		modelEnum: "MODEL_PLACEHOLDER_M187",
+		maxOutputTokens: 65536
+	},
+	"gemini-3.5-flash-low": {
+		modelEnum: "MODEL_PLACEHOLDER_M20",
+		maxOutputTokens: 65536
+	},
+	"gemini-3-flash-agent": {
+		modelEnum: "MODEL_PLACEHOLDER_M132",
+		maxOutputTokens: 65536
+	},
+	"gemini-3.1-pro-low": {
+		modelEnum: "MODEL_PLACEHOLDER_M36",
+		maxOutputTokens: 65535
+	},
+	"gemini-pro-agent": {
+		modelEnum: "MODEL_PLACEHOLDER_M16",
+		maxOutputTokens: 65535
+	},
+	"claude-sonnet-4-6": { maxOutputTokens: 64e3 },
+	"claude-opus-4-6-thinking": { maxOutputTokens: 64e3 }
+};
+function getAntigravityModelWireProfile(wireModelId) {
+	return ANTIGRAVITY_MODEL_WIRE_PROFILES[wireModelId];
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/utils/google-validation.ts
+function extractGoogleValidationUrl(errorBody) {
+	if (!errorBody.includes("VALIDATION_REQUIRED")) return void 0;
+	const start = errorBody.indexOf("{");
+	if (start === -1) return void 0;
+	try {
+		return (JSON.parse(errorBody.slice(start)).error?.details?.find((d) => d.reason === "VALIDATION_REQUIRED" && typeof d.metadata?.validation_url === "string"))?.metadata?.validation_url;
+	} catch {
+		return;
+	}
+}
+function formatGoogleValidationRequiredMessage(validationUrl, nextAction, email) {
+	return `Account verification required${email ? ` for ${email}` : ""}. Visit ${validationUrl} to continue, then ${nextAction}.`;
+}
+//#endregion
+export { getAntigravityUserAgent as a, getAntigravityModelWireProfile as i, formatGoogleValidationRequiredMessage as n, getGeminiCliHeaders as o, ensureAntigravityVersion as r, extractGoogleValidationUrl as t };