@xiaoso/dsh-tool-plus 0.1.16 → 0.1.17-beta.0

package/lib/event-stream-BKEtb45Y.mjs

@@ -1,167 +0,0 @@
-import { installBunShim as __installBunShim } from "./bun-shim.mjs";
-__installBunShim();
-import { s as ProviderResponseError, w as classifyMessage } from "./error-O63pC8zg.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/utils/event-stream.ts
-var EventStream = class {
-	queue = [];
-	waiting = [];
-	done = false;
-	/** True once finalResultPromise has been resolved or rejected. */
-	resultSettled = false;
-	#failed = false;
-	#error = void 0;
-	/**
-	* Consumer-side local operations currently in flight for this stream — a
-	* provider transport waiting on a server-requested local tool bridge
-	* (e.g. the Cursor exec channel) before it can send the result upstream.
-	* While non-zero, event silence is attributable to our own pending work,
-	* not a provider stall; idle watchdogs consult {@link hasPendingLocalWork}.
-	*/
-	#pendingLocalWork = 0;
-	/**
-	* A downstream stream whose local work also counts as ours — set when this
-	* stream forwards another stream's events (e.g. the Cursor discovered-id
-	* retry drains an inner stream), so the watchdog on this stream sees the
-	* inner exec bridge's busy state instead of aborting a healthy tool run.
-	*/
-	#localWorkDelegate;
-	finalResultPromise;
-	resolveFinalResult;
-	rejectFinalResult;
-	isComplete;
-	extractResult;
-	constructor(isComplete, extractResult) {
-		const { promise, resolve, reject } = Promise.withResolvers();
-		promise.catch(() => {});
-		this.finalResultPromise = promise;
-		this.resolveFinalResult = resolve;
-		this.rejectFinalResult = reject;
-		this.isComplete = isComplete;
-		this.extractResult = extractResult;
-	}
-	push(event) {
-		if (this.done) return;
-		if (this.isComplete(event)) {
-			this.done = true;
-			this.resultSettled = true;
-			this.resolveFinalResult(this.extractResult(event));
-		}
-		const waiter = this.waiting.shift();
-		if (waiter) waiter.resolve({
-			value: event,
-			done: false
-		});
-		else this.queue.push(event);
-	}
-	deliver(event) {
-		const waiter = this.waiting.shift();
-		if (waiter) waiter.resolve({
-			value: event,
-			done: false
-		});
-		else this.queue.push(event);
-	}
-	end(result) {
-		this.done = true;
-		if (result !== void 0) {
-			this.resultSettled = true;
-			this.resolveFinalResult(result);
-		} else if (!this.resultSettled) {
-			this.resultSettled = true;
-			this.rejectFinalResult(new ProviderResponseError("Stream ended without a final result", { kind: "envelope" }));
-		}
-		while (this.waiting.length > 0) this.waiting.shift().resolve({
-			value: void 0,
-			done: true
-		});
-	}
-	endWaiting() {
-		while (this.waiting.length > 0) this.waiting.shift().resolve({
-			value: void 0,
-			done: true
-		});
-	}
-	fail(err) {
-		if (this.done) return;
-		this.done = true;
-		this.#failed = true;
-		this.#error = err;
-		this.resultSettled = true;
-		this.rejectFinalResult(err);
-		while (this.waiting.length > 0) this.waiting.shift().reject(err);
-	}
-	async *[Symbol.asyncIterator]() {
-		while (true) if (this.queue.length > 0) yield this.queue.shift();
-		else if (this.#failed) throw this.#error;
-		else if (this.done) return;
-		else {
-			const result = await new Promise((resolve, reject) => this.waiting.push({
-				resolve,
-				reject
-			}));
-			if (result.done) return;
-			yield result.value;
-		}
-	}
-	result() {
-		return this.finalResultPromise;
-	}
-	/** True while local work tracked via {@link trackLocalWork} — on this stream or a forwarded delegate — is pending. */
-	get hasPendingLocalWork() {
-		return this.#pendingLocalWork > 0 || (this.#localWorkDelegate?.hasPendingLocalWork ?? false);
-	}
-	/**
-	* Count `source`'s pending local work as this stream's own. Used when this
-	* stream forwards another's events (Cursor discovered-id retry) so the
-	* watchdog does not abort a live tool run happening on the inner stream.
-	* Pass `undefined` to detach once forwarding ends.
-	*/
-	forwardLocalWorkFrom(source) {
-		this.#localWorkDelegate = source;
-	}
-	/**
-	* Track a local-work promise so idle watchdogs on this stream do not treat
-	* the event silence while it is pending as a provider stall.
-	*/
-	async trackLocalWork(work) {
-		this.#pendingLocalWork++;
-		try {
-			return await work;
-		} finally {
-			this.#pendingLocalWork--;
-		}
-	}
-};
-var AssistantMessageEventStream = class extends EventStream {
-	constructor() {
-		super((event) => event.type === "done" || event.type === "error", (event) => {
-			if (event.type === "done") return event.message;
-			else if (event.type === "error") return event.error;
-			throw new ProviderResponseError("Unexpected event type for final result", { kind: "envelope" });
-		});
-	}
-	push(event) {
-		if (this.done) return;
-		if (event.type === "error" && event.error.stopReason === "error") classifyMessage(event.error);
-		if (this.isComplete(event)) {
-			this.done = true;
-			this.resultSettled = true;
-			this.resolveFinalResult(this.extractResult(event));
-		}
-		this.deliver(event);
-	}
-	end(result) {
-		this.done = true;
-		if (result !== void 0) {
-			if (result.stopReason === "error") classifyMessage(result);
-			this.resultSettled = true;
-			this.resolveFinalResult(result);
-		} else if (!this.resultSettled) {
-			this.resultSettled = true;
-			this.rejectFinalResult(new ProviderResponseError("Stream ended without a final result", { kind: "envelope" }));
-		}
-		this.endWaiting();
-	}
-};
-//#endregion
-export { AssistantMessageEventStream as t };

package/lib/gemini-headers-Co9cVvex.mjs

@@ -1,54 +0,0 @@
-import { installBunShim as __installBunShim } from "./bun-shim.mjs";
-__installBunShim();
-//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/wire/gemini-headers.ts
-/**
-* Build a User-Agent string that identifies as Gemini CLI to unlock higher rate limits.
-* Uses the same format as the official Gemini CLI (v0.35+):
-* GeminiCLI/VERSION/MODEL (PLATFORM; ARCH; SURFACE)
-*/
-function getGeminiCliUserAgent(modelId = "gemini-3.1-pro-preview") {
-	return `GeminiCLI/${process.env.PI_AI_GEMINI_CLI_VERSION || "0.46.0"}/${modelId} (${process.platform === "win32" ? "win32" : process.platform}; ${process.arch === "x64" ? "x64" : process.arch}; terminal)`;
-}
-const getGeminiCliHeaders = (modelId) => ({
-	"User-Agent": getGeminiCliUserAgent(modelId),
-	"Client-Metadata": "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI"
-});
-/** Current Antigravity client version: env override → manifest-discovered → pinned fallback. */
-function getAntigravityVersion() {
-	return process.env.PI_AI_ANTIGRAVITY_VERSION || "2.8.0";
-}
-/** Antigravity `User-Agent` header value; rebuilt when the discovered version changes. */
-function getAntigravityUserAgent() {
-	const version = getAntigravityVersion();
-	const cl = process.env.PI_AI_ANTIGRAVITY_CL || "963137146";
-	return `antigravity/hub/${version} (aidev_client; os_type=${process.env.PI_AI_ANTIGRAVITY_OS || "darwin"}; arch=${process.env.PI_AI_ANTIGRAVITY_ARCH || "arm64"}; cl=${cl})`;
-}
-const ANTIGRAVITY_MODEL_WIRE_PROFILES = {
-	"gemini-3.5-flash-extra-low": {
-		modelEnum: "MODEL_PLACEHOLDER_M187",
-		maxOutputTokens: 65536
-	},
-	"gemini-3.5-flash-low": {
-		modelEnum: "MODEL_PLACEHOLDER_M20",
-		maxOutputTokens: 65536
-	},
-	"gemini-3-flash-agent": {
-		modelEnum: "MODEL_PLACEHOLDER_M132",
-		maxOutputTokens: 65536
-	},
-	"gemini-3.1-pro-low": {
-		modelEnum: "MODEL_PLACEHOLDER_M36",
-		maxOutputTokens: 65535
-	},
-	"gemini-pro-agent": {
-		modelEnum: "MODEL_PLACEHOLDER_M16",
-		maxOutputTokens: 65535
-	},
-	"claude-sonnet-4-6": { maxOutputTokens: 64e3 },
-	"claude-opus-4-6-thinking": { maxOutputTokens: 64e3 }
-};
-function getAntigravityModelWireProfile(wireModelId) {
-	return ANTIGRAVITY_MODEL_WIRE_PROFILES[wireModelId];
-}
-//#endregion
-export { getAntigravityUserAgent as n, getGeminiCliHeaders as r, getAntigravityModelWireProfile as t };

package/lib/google-auth-qAN-6DMW.mjs

@@ -1,232 +0,0 @@
-import { installBunShim as __installBunShim } from "./bun-shim.mjs";
-__installBunShim();
-import { $ as isEnoent, P as $envpos, b as debug } from "./src-AELUUb5U.mjs";
-import { f as OAuthError, h as MissingApiKeyError, t as ConfigurationError } from "./error-O63pC8zg.mjs";
-import { n as raceWithSignal } from "./abort-DZ54CaKU.mjs";
-import * as path$1 from "node:path";
-import * as os from "node:os";
-import { Buffer } from "node:buffer";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/google-auth.ts
-/**
-* Application Default Credentials (ADC) resolution for Vertex AI.
-*
-* Replaces `google-auth-library` with a direct WebCrypto + REST implementation.
-* Sources, in priority order:
-*   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
-*     or `type: "authorized_user"` (refresh-token exchange).
-*   2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).
-*   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
-*
-* Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry
-* (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
-*/
-const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
-const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";
-const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
-const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
-const tokenCache = /* @__PURE__ */ new Map();
-const inflight = /* @__PURE__ */ new Map();
-function getRefreshSkewMs() {
-	return $envpos("GOOGLE_VERTEX_REFRESH_SKEW_MS", 6e4);
-}
-function userAdcPath() {
-	return path$1.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
-}
-async function readJsonFile(filePath) {
-	try {
-		return await Bun.file(filePath).json();
-	} catch (err) {
-		if (isEnoent(err)) return void 0;
-		throw err;
-	}
-}
-async function loadAdcCredentials() {
-	const gacPath = Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
-	if (gacPath) {
-		const creds = await readJsonFile(gacPath);
-		if (!creds) throw new ConfigurationError(`GOOGLE_APPLICATION_CREDENTIALS points to a missing file: ${gacPath}`);
-		return {
-			source: `gac:${gacPath}`,
-			creds
-		};
-	}
-	const userPath = userAdcPath();
-	const creds = await readJsonFile(userPath);
-	if (creds) return {
-		source: `user:${userPath}`,
-		creds
-	};
-}
-function base64UrlEncode(bytes) {
-	const buf = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
-	return Buffer.from(buf.buffer, buf.byteOffset, buf.byteLength).toString("base64url");
-}
-function pemToPkcs8(pem) {
-	const body = pem.replace(/-----BEGIN [^-]+-----/g, "").replace(/-----END [^-]+-----/g, "").replace(/\s+/g, "");
-	if (!body) throw new ConfigurationError("Invalid PEM: empty body");
-	return Uint8Array.fromBase64(body);
-}
-async function signJwtRs256(claims, privateKeyPem, keyId) {
-	const header = {
-		alg: "RS256",
-		typ: "JWT"
-	};
-	if (keyId) header.kid = keyId;
-	const payload = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
-	const key = await globalThis.crypto.subtle.importKey("pkcs8", pemToPkcs8(privateKeyPem), {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return `${payload}.${base64UrlEncode(new Uint8Array(await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload))))}`;
-}
-async function exchangeJwtForToken(creds, signal, fetchImpl) {
-	const now = Math.floor(Date.now() / 1e3);
-	const assertion = await signJwtRs256({
-		iss: creds.client_email,
-		scope: CLOUD_PLATFORM_SCOPE,
-		aud: OAUTH_TOKEN_URL,
-		exp: now + 3600,
-		iat: now
-	}, creds.private_key, creds.private_key_id);
-	const body = new URLSearchParams({
-		grant_type: JWT_BEARER_GRANT,
-		assertion
-	});
-	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
-}
-async function exchangeRefreshToken(creds, signal, fetchImpl) {
-	const body = new URLSearchParams({
-		client_id: creds.client_id,
-		client_secret: creds.client_secret,
-		refresh_token: creds.refresh_token,
-		grant_type: "refresh_token"
-	});
-	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
-}
-async function fetchMetadataToken(signal, fetchImpl) {
-	const timeout = AbortSignal.timeout(2e3);
-	const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
-	try {
-		const response = await fetchImpl(METADATA_TOKEN_URL, {
-			method: "GET",
-			headers: { "Metadata-Flavor": "Google" },
-			signal: combined
-		});
-		if (!response.ok) return void 0;
-		return await response.json();
-	} catch {
-		return;
-	}
-}
-async function postForToken(url, body, signal, fetchImpl) {
-	const response = await fetchImpl(url, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: body.toString(),
-		signal
-	});
-	if (!response.ok) {
-		const detail = await response.text().catch(() => "");
-		throw new OAuthError(`Google OAuth token exchange failed (${response.status}): ${detail}`, {
-			kind: "token-exchange",
-			provider: "google-vertex",
-			status: response.status
-		});
-	}
-	return await response.json();
-}
-async function resolveAccessTokenUncached(signal, fetchImpl) {
-	const adc = await loadAdcCredentials();
-	if (adc) {
-		const creds = adc.creds;
-		let token;
-		if (creds.type === "impersonated_service_account") {
-			const targetPrincipal = /(?<target>[^/]+):(generateAccessToken|generateIdToken)$/.exec(creds.service_account_impersonation_url)?.groups?.target;
-			if (!targetPrincipal) throw new RangeError(`Cannot extract target principal from ${creds.service_account_impersonation_url}`);
-			const sourceToken = creds.source_credentials.type === "service_account" ? await exchangeJwtForToken(creds.source_credentials, signal, fetchImpl) : await exchangeRefreshToken(creds.source_credentials, signal, fetchImpl);
-			const response = await fetchImpl(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${targetPrincipal}:generateAccessToken`, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					Authorization: `Bearer ${sourceToken.access_token}`
-				},
-				body: JSON.stringify({
-					delegates: creds.delegates ?? [],
-					scope: [CLOUD_PLATFORM_SCOPE],
-					lifetime: "3600s"
-				}),
-				signal
-			});
-			if (!response.ok) {
-				const detail = await response.text().catch(() => "");
-				throw new OAuthError(`Google Impersonation token exchange failed (${response.status}): ${detail}`, {
-					kind: "token-exchange",
-					provider: "google-vertex",
-					status: response.status
-				});
-			}
-			const data = await response.json();
-			const expiresIn = Math.max(0, Math.floor((new Date(data.expireTime).getTime() - Date.now()) / 1e3));
-			token = {
-				access_token: data.accessToken,
-				expires_in: expiresIn,
-				token_type: "Bearer"
-			};
-		} else token = creds.type === "service_account" ? await exchangeJwtForToken(creds, signal, fetchImpl) : await exchangeRefreshToken(creds, signal, fetchImpl);
-		return {
-			source: adc.source,
-			token
-		};
-	}
-	const metadata = await fetchMetadataToken(signal, fetchImpl);
-	if (metadata) return {
-		source: "metadata",
-		token: metadata
-	};
-	throw new MissingApiKeyError(void 0, "Vertex AI requires Application Default Credentials. Set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or run on a GCE/Cloud Run instance with a service account.");
-}
-/**
-* Bound for the detached (signal-free) shared token resolution: a hung OAuth
-* exchange or metadata fetch must not pin the inflight slot forever — every
-* later call would await the stuck promise until process restart.
-*/
-const SHARED_TOKEN_RESOLVE_TIMEOUT_MS = 3e4;
-/**
-* Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
-* The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.
-*/
-async function getVertexAccessToken(options) {
-	const explicitToken = Bun.env.GOOGLE_CLOUD_ACCESS_TOKEN || Bun.env.CLOUDSDK_AUTH_ACCESS_TOKEN;
-	if (explicitToken) return explicitToken;
-	const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
-	const skew = getRefreshSkewMs();
-	const now = Date.now();
-	for (const [source, cached] of tokenCache) {
-		if (cached.expiresAtMs - skew > now) return cached.token;
-		tokenCache.delete(source);
-	}
-	const cacheKey = "vertex-adc";
-	const existing = inflight.get(cacheKey);
-	if (existing) return raceWithSignal(existing, options?.signal);
-	const promise = (async () => {
-		try {
-			const { source, token } = await resolveAccessTokenUncached(AbortSignal.timeout(SHARED_TOKEN_RESOLVE_TIMEOUT_MS), fetchImpl);
-			const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1e3);
-			tokenCache.set(source, {
-				token: token.access_token,
-				expiresAtMs
-			});
-			debug("vertex.adc acquired access token", {
-				source,
-				expiresInSec: token.expires_in
-			});
-			return token.access_token;
-		} finally {
-			inflight.delete(cacheKey);
-		}
-	})();
-	inflight.set(cacheKey, promise);
-	return raceWithSignal(promise, options?.signal);
-}
-//#endregion
-export { getVertexAccessToken as t };