anypick 1.0.0

package/dist/providers/grok-proxy/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","names":[],"sources":["../../../src/providers/grok-proxy/server.ts"],"sourcesContent":["/**\n * Dual-protocol reverse proxy for Grok CLI OIDC sessions.\n *\n * Compatibility (same base URL for both clients):\n *   • OpenAI   — Codex / OpenAI SDK  →  /v1/chat/completions, /v1/responses, /v1/models\n *   • Anthropic — Claude Code         →  /v1/messages\n *\n * Upstream cli-chat-proxy.grok.com already speaks both shapes; we inject the\n * CLI OIDC Bearer and forward. Model IDs and /v1/models are deliberately\n * passed through without a local catalog, so newly released models work\n * without a AnyPick update. Optional translate mode\n * (GROK_PROXY_TRANSLATE_ANTHROPIC=1) rewrites Anthropic → chat/completions\n * for OpenAI-only upstreams.\n *\n * Clients point BASE_URL here with any dummy API key / auth token.\n */\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';\nimport { GROK_MODELS } from '../../catalog/providers';\nimport { ensureAccessToken, type GrokSession } from './auth';\nimport {\n  anthropicToOpenAI,\n  estimateAnthropicInputTokens,\n  openAIToAnthropic,\n  pipeOpenAIStreamToAnthropic,\n  sanitizeInferenceToolSchemas,\n  type AnthropicMessageRequest,\n  type OpenAIChatResponse,\n} from '../protocol/anthropic';\nimport { HOP_BY_HOP, normalizeLocalApiUrl, readBody, requireProxyAuth } from '../proxy-shared';\nimport { assertLoopbackHost } from '../../utils/network';\nimport { classifyUpstreamFailure, CooldownRegistry } from '../upstream-policy';\n\nexport interface GrokProxyServerOptions {\n  host: string;\n  port: number;\n  authPath: string;\n  upstream?: string;\n  clientVersion?: string;\n  /**\n   * When true, POST /v1/messages is translated to OpenAI chat/completions\n   * instead of passed through. Default: false (native Anthropic upstream).\n   * Also enabled by env GROK_PROXY_TRANSLATE_ANTHROPIC=1.\n   */\n  translateAnthropic?: boolean;\n  /** Per-instance high-entropy secret (PROXY-01) required on credentialed routes. */\n  token?: string;\n  /** Append request traces to this logger. */\n  log?: (line: string) => void;\n  quiet?: boolean;\n}\n\nconst DEFAULT_UPSTREAM = 'https://cli-chat-proxy.grok.com';\nconst DEFAULT_CLIENT_VERSION = '0.2.101';\n\nconst COMPAT_LABEL = 'OpenAI + Anthropic API';\n\nexport function createGrokProxyServer(opts: GrokProxyServerOptions): Server {\n  assertLoopbackHost(opts.host);\n  const upstream = (opts.upstream ?? DEFAULT_UPSTREAM).replace(/\\/$/, '');\n  const clientVersion = opts.clientVersion ?? DEFAULT_CLIENT_VERSION;\n  const translateAnthropic =\n    opts.translateAnthropic ?? process.env.GROK_PROXY_TRANSLATE_ANTHROPIC === '1';\n  const proxyToken = opts.token ?? process.env.ANYPICK_PROXY_TOKEN ?? '';\n  const log =\n    opts.log ?? (opts.quiet ? () => {} : (line: string) => process.stderr.write(`${line}\\n`));\n\n  let cached: GrokSession | undefined;\n  const cooldowns = new CooldownRegistry();\n\n  const server = createServer((req, res) => {\n    void handle(req, res);\n  });\n\n  async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    const url = normalizeLocalApiUrl(req.url ?? '/');\n    const path = url.split('?')[0] ?? '/';\n    const method = req.method ?? 'GET';\n\n    if (!checkCors(req, res)) {\n      return;\n    }\n    if (method === 'OPTIONS') {\n      res.writeHead(204);\n      res.end();\n      return;\n    }\n\n    if ((method === 'GET' || method === 'HEAD') && (path === '/' || path === '/health')) {\n      json(res, 200, {\n        ok: true,\n        service: 'anypick-grok-proxy',\n        compatibility: COMPAT_LABEL,\n        instanceId: process.env.ANYPICK_INSTANCE_ID ?? null,\n        clients: {\n          codex: 'OPENAI_BASE_URL → /v1/chat/completions',\n          claude: 'ANTHROPIC_BASE_URL → /v1/messages',\n        },\n        endpoints: {\n          openai: ['/v1/chat/completions', '/v1/responses', '/v1/models'],\n          anthropic: ['/v1/messages', '/v1/messages/count_tokens'],\n        },\n        translateAnthropic,\n        upstream,\n      });\n      return;\n    }\n\n    // Only /v1/* (OpenAI + Anthropic share this prefix)\n    if (!path.startsWith('/v1/') && path !== '/v1') {\n      json(res, 404, {\n        error: {\n          message: `Not found: ${path}. Codex/OpenAI: /v1/chat/completions · Claude: /v1/messages · models: /v1/models`,\n          type: 'not_found_error',\n        },\n      });\n      return;\n    }\n\n    // Every /v1/* route exercises upstream credential authority (PROXY-01).\n    if (!requireProxyAuth(req, res, proxyToken)) {\n      return;\n    }\n\n    // Claude Code polls this for context sizing. xAI does not implement it;\n    // answer locally so we never spam cli-chat-proxy with 404 traffic.\n    if (method === 'POST' && path === '/v1/messages/count_tokens') {\n      await handleCountTokens(req, res);\n      return;\n    }\n\n    // Optional Anthropic → OpenAI translation for OpenAI-only upstreams\n    if (translateAnthropic && method === 'POST' && path === '/v1/messages') {\n      await handleAnthropicTranslated(req, res);\n      return;\n    }\n\n    // Hub catalog discovery needs a usable OpenAI-shaped list even when\n    // cli-chat-proxy.grok.com returns 404/empty for /v1/models.\n    if ((method === 'GET' || method === 'HEAD') && path === '/v1/models') {\n      await handleListModels(req, res, url, method);\n      return;\n    }\n\n    log(`${method} ${path}`);\n    await proxyPassThrough(req, res, url, method);\n  }\n\n  async function handleCountTokens(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    try {\n      let body: {\n        model?: string;\n        system?: unknown;\n        messages?: unknown;\n        tools?: unknown;\n        [key: string]: unknown;\n      };\n      try {\n        body = JSON.parse((await readBody(req)).toString('utf8') || '{}') as typeof body;\n      } catch {\n        json(res, 400, {\n          type: 'error',\n          error: { type: 'invalid_request_error', message: 'Invalid JSON body' },\n        });\n        return;\n      }\n      const inputTokens = estimateAnthropicInputTokens(body);\n      const model = typeof body.model === 'string' && body.model.trim() ? body.model.trim() : '?';\n      log(`POST /v1/messages/count_tokens → ${inputTokens} (local · ${model})`);\n      json(res, 200, { input_tokens: inputTokens });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      log(`  ✗ count_tokens ${message}`);\n      if (!res.headersSent) {\n        json(res, 502, {\n          type: 'error',\n          error: { type: 'proxy_error', message },\n        });\n      }\n    }\n  }\n\n  /**\n   * Prefer the live upstream catalog. If it is missing or empty, fall back to\n   * the static GROK_MODELS map so Proxy Hub can still publish routes.\n   */\n  async function handleListModels(\n    req: IncomingMessage,\n    res: ServerResponse,\n    url: string,\n    method: string,\n  ): Promise<void> {\n    try {\n      const { token, session } = await ensureAccessToken(opts.authPath, cached);\n      cached = session;\n      const target = `${upstream}${url}`;\n      const headers = buildUpstreamHeaders(req, token, clientVersion);\n      let upstreamRes = await fetchGrok(\n        target,\n        {\n          method,\n          headers,\n          signal: AbortSignal.timeout(12_000),\n          redirect: 'manual',\n        },\n        `${method}:${url}`,\n      );\n\n      if (upstreamRes.status === 401 && cached?.refreshToken) {\n        log('  → 401 on /v1/models, refreshing OIDC token…');\n        const refreshed = await ensureAccessToken(opts.authPath);\n        cached = refreshed.session;\n        const retryHeaders = buildUpstreamHeaders(req, refreshed.token, clientVersion);\n        upstreamRes = await fetchGrok(\n          target,\n          {\n            method,\n            headers: retryHeaders,\n            signal: AbortSignal.timeout(12_000),\n            redirect: 'manual',\n          },\n          `${method}:${url}`,\n        );\n      }\n\n      if (upstreamRes.ok) {\n        const text = await upstreamRes.text();\n        const models = modelIdsFromCatalogBody(text);\n        if (models.length > 0) {\n          log(`  list models ← ${models.length} (upstream)`);\n          // Re-emit a normalized OpenAI list so Hub parsing stays strict.\n          json(res, 200, {\n            object: 'list',\n            data: models.map((id) => ({ id, object: 'model', owned_by: 'xai' })),\n          });\n          return;\n        }\n        log('  list models ← empty upstream; using static GROK_MODELS');\n      } else {\n        log(`  list models ← ${upstreamRes.status}; using static GROK_MODELS`);\n      }\n    } catch (err) {\n      log(\n        `  list models ✗ ${err instanceof Error ? err.message : String(err)}; using static GROK_MODELS`,\n      );\n    }\n\n    const models = staticGrokModelIds();\n    log(`  list models ← ${models.length} (fallback)`);\n    json(res, 200, {\n      object: 'list',\n      data: models.map((id) => ({ id, object: 'model', owned_by: 'xai' })),\n    });\n  }\n\n  /**\n   * Native pass-through (default): inject OIDC Bearer, forward with only the\n   * tool-schema hygiene needed for strict xAI validation.\n   */\n  async function proxyPassThrough(\n    req: IncomingMessage,\n    res: ServerResponse,\n    url: string,\n    method: string,\n  ): Promise<void> {\n    try {\n      const { token, session } = await ensureAccessToken(opts.authPath, cached);\n      cached = session;\n\n      const target = `${upstream}${url}`;\n      const rawBody =\n        method === 'GET' || method === 'HEAD' || method === 'OPTIONS'\n          ? undefined\n          : await readBody(req);\n      const body = rawBody ? sanitizePassThroughBody(pathOf(url), rawBody) : undefined;\n\n      // content-length must match the body we actually send — schema sanitize can\n      // shrink the payload when stripping null tool-schema keywords.\n      const headers = buildUpstreamHeaders(req, token, clientVersion, body?.byteLength);\n      if (body) {\n        headers['content-length'] = String(body.byteLength);\n      }\n\n      const upstreamRes = await fetchGrok(\n        target,\n        {\n          method,\n          headers,\n          body: body && body.length > 0 ? new Uint8Array(body) : undefined,\n          signal: AbortSignal.timeout(600_000),\n          redirect: 'manual',\n        },\n        `${method}:${url}`,\n      );\n\n      if (upstreamRes.status === 401 && cached?.refreshToken) {\n        log('  → 401, refreshing OIDC token…');\n        const refreshed = await ensureAccessToken(opts.authPath);\n        cached = refreshed.session;\n        const retryHeaders = buildUpstreamHeaders(\n          req,\n          refreshed.token,\n          clientVersion,\n          body?.byteLength,\n        );\n        if (body) {\n          retryHeaders['content-length'] = String(body.byteLength);\n        }\n        const retry = await fetchGrok(\n          target,\n          {\n            method,\n            headers: retryHeaders,\n            body: body && body.length > 0 ? new Uint8Array(body) : undefined,\n            signal: AbortSignal.timeout(600_000),\n            redirect: 'manual',\n          },\n          `${method}:${url}`,\n        );\n        await pipeResponse(retry, res, log);\n        return;\n      }\n\n      await pipeResponse(upstreamRes, res, log);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      log(`  ✗ ${msg}`);\n      if (!res.headersSent) {\n        json(res, 502, {\n          error: { message: msg, type: 'proxy_error' },\n        });\n      } else {\n        res.end();\n      }\n    }\n  }\n\n  /**\n   * Translate Anthropic Messages → OpenAI chat/completions (optional mode).\n   */\n  async function handleAnthropicTranslated(\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): Promise<void> {\n    log('POST /v1/messages (translate → chat/completions)');\n    try {\n      const raw = await readBody(req);\n      let body: AnthropicMessageRequest;\n      try {\n        body = JSON.parse(raw.toString('utf8') || '{}') as AnthropicMessageRequest;\n      } catch {\n        json(res, 400, {\n          type: 'error',\n          error: {\n            type: 'invalid_request_error',\n            message: 'Invalid JSON body',\n          },\n        });\n        return;\n      }\n\n      if (!body.model) {\n        json(res, 400, {\n          type: 'error',\n          error: {\n            type: 'invalid_request_error',\n            message: 'model is required',\n          },\n        });\n        return;\n      }\n      if (body.max_tokens == null) {\n        body.max_tokens = 4096;\n      }\n\n      const openaiBody = anthropicToOpenAI(body);\n      const stream = Boolean(body.stream);\n      openaiBody.stream = stream;\n\n      const payload = Buffer.from(JSON.stringify(openaiBody), 'utf8');\n      const { token, session } = await ensureAccessToken(opts.authPath, cached);\n      cached = session;\n\n      const target = `${upstream}/v1/chat/completions`;\n      let upstreamRes = await fetchUpstream(target, token, payload);\n\n      if (upstreamRes.status === 401 && cached?.refreshToken) {\n        log('  → 401, refreshing OIDC token…');\n        const refreshed = await ensureAccessToken(opts.authPath);\n        cached = refreshed.session;\n        upstreamRes = await fetchUpstream(target, refreshed.token, payload);\n      }\n\n      log(`  ← ${upstreamRes.status} (via chat/completions)`);\n\n      if (stream) {\n        if (!upstreamRes.ok) {\n          const errText = await upstreamRes.text();\n          let message = errText;\n          try {\n            const parsed = JSON.parse(errText) as {\n              error?: { message?: string };\n            };\n            message = parsed.error?.message ?? errText;\n          } catch {\n            // keep raw\n          }\n          res.writeHead(upstreamRes.status, {\n            'content-type': 'application/json; charset=utf-8',\n          });\n          res.end(\n            JSON.stringify({\n              type: 'error',\n              error: { type: 'api_error', message },\n            }),\n          );\n          return;\n        }\n\n        res.writeHead(200, {\n          'content-type': 'text/event-stream; charset=utf-8',\n          'cache-control': 'no-cache',\n          connection: 'keep-alive',\n          'x-accel-buffering': 'no',\n        });\n\n        await pipeOpenAIStreamToAnthropic(\n          upstreamRes,\n          (chunk) => {\n            res.write(chunk);\n          },\n          body.model,\n        );\n        res.end();\n        return;\n      }\n\n      const text = await upstreamRes.text();\n      let parsed: OpenAIChatResponse;\n      try {\n        parsed = JSON.parse(text) as OpenAIChatResponse;\n      } catch {\n        json(res, 502, {\n          type: 'error',\n          error: {\n            type: 'api_error',\n            message: `Upstream returned non-JSON: ${text.slice(0, 200)}`,\n          },\n        });\n        return;\n      }\n\n      const converted = openAIToAnthropic(parsed, body.model);\n      if ('type' in converted && converted.type === 'error') {\n        json(res, upstreamRes.status >= 400 ? upstreamRes.status : 502, converted);\n        return;\n      }\n      json(res, upstreamRes.ok ? 200 : upstreamRes.status, converted);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      log(`  ✗ anthropic ${msg}`);\n      if (!res.headersSent) {\n        json(res, 502, {\n          type: 'error',\n          error: { type: 'proxy_error', message: msg },\n        });\n      } else {\n        res.end();\n      }\n    }\n  }\n\n  async function fetchUpstream(target: string, token: string, payload: Buffer): Promise<Response> {\n    return fetchGrok(\n      target,\n      {\n        method: 'POST',\n        headers: {\n          authorization: `Bearer ${token}`,\n          'content-type': 'application/json',\n          accept: 'application/json',\n          'x-grok-client-version': clientVersion,\n          'x-grok-client-identifier': 'anypick-grok-proxy',\n          'user-agent': `anypick-grok-proxy/${clientVersion}`,\n        },\n        body: new Uint8Array(payload),\n        signal: AbortSignal.timeout(600_000),\n        redirect: 'manual',\n      },\n      `POST:${target}`,\n    );\n  }\n\n  async function fetchGrok(target: string, init: RequestInit, route: string): Promise<Response> {\n    const isInference = init.method === 'POST';\n    const key = `grok:${route}`;\n    if (isInference) {\n      const remaining = cooldowns.remainingMs(key);\n      if (remaining > 0) {\n        return new Response(\n          JSON.stringify({\n            error: {\n              type: 'rate_limit_error',\n              message: 'Grok route is cooling down.',\n            },\n          }),\n          {\n            status: 429,\n            headers: {\n              'content-type': 'application/json',\n              'retry-after': String(Math.ceil(remaining / 1000)),\n            },\n          },\n        );\n      }\n    }\n    const response = await fetch(target, init);\n    if (!isInference || response.status !== 429) {\n      return response;\n    }\n    const body = await response.arrayBuffer();\n    const failure = classifyUpstreamFailure(\n      response.status,\n      response.headers,\n      new TextDecoder().decode(body),\n    );\n    if (failure.retryAfterMs) {\n      cooldowns.set(key, failure.retryAfterMs);\n    }\n    return new Response(body, {\n      status: response.status,\n      headers: response.headers,\n    });\n  }\n\n  return server;\n}\n\nfunction buildUpstreamHeaders(\n  req: IncomingMessage,\n  token: string,\n  clientVersion: string,\n  contentLength?: number,\n): Record<string, string> {\n  const headers: Record<string, string> = {\n    authorization: `Bearer ${token}`,\n    'x-grok-client-version': clientVersion,\n    'x-grok-client-identifier': 'anypick-grok-proxy',\n    'user-agent': `anypick-grok-proxy/${clientVersion}`,\n    accept: req.headers.accept ?? 'application/json',\n  };\n\n  if (req.headers['content-type']) {\n    headers['content-type'] = String(req.headers['content-type']);\n  } else if (contentLength && contentLength > 0) {\n    headers['content-type'] = 'application/json';\n  }\n\n  // Claude sends anthropic-version; forward it for native Anthropic upstream\n  if (req.headers['anthropic-version']) {\n    headers['anthropic-version'] = String(req.headers['anthropic-version']);\n  }\n  if (req.headers['anthropic-beta']) {\n    headers['anthropic-beta'] = String(req.headers['anthropic-beta']);\n  }\n\n  // Forward select client headers but never client Authorization / x-api-key\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (!v || HOP_BY_HOP.has(k.toLowerCase())) {\n      continue;\n    }\n    if (k.toLowerCase() === 'authorization') {\n      continue;\n    }\n    if (k.toLowerCase().startsWith('x-grok-')) {\n      continue;\n    }\n    if (k.toLowerCase() === 'x-api-key') {\n      continue;\n    }\n    if (k.toLowerCase() === 'anthropic-version') {\n      continue;\n    }\n    if (k.toLowerCase() === 'anthropic-beta') {\n      continue;\n    }\n    if (Array.isArray(v)) {\n      headers[k] = v.join(', ');\n    } else {\n      headers[k] = v;\n    }\n  }\n\n  return headers;\n}\n\nasync function pipeResponse(\n  upstreamRes: Response,\n  res: ServerResponse,\n  log: (line: string) => void,\n): Promise<void> {\n  // Buffer small error bodies so the hub log shows the real upstream reason\n  // (e.g. xAI schema validation) without replaying multi-MB success streams.\n  if (upstreamRes.status >= 400) {\n    const errText = await upstreamRes.text();\n    const snippet = errText.replaceAll(/[\\r\\n\\t]+/gu, ' ').slice(0, 400);\n    log(`  ← ${upstreamRes.status} ${snippet}`);\n    const outHeaders: Record<string, string> = {};\n    upstreamRes.headers.forEach((value, key) => {\n      if (HOP_BY_HOP.has(key.toLowerCase()) || key.toLowerCase() === 'content-encoding') {\n        return;\n      }\n      if (key.toLowerCase() === 'content-length') {\n        return;\n      }\n      outHeaders[key] = value;\n    });\n    const payload = Buffer.from(errText, 'utf8');\n    outHeaders['content-length'] = String(payload.byteLength);\n    res.writeHead(upstreamRes.status, outHeaders);\n    res.end(payload);\n    return;\n  }\n\n  log(`  ← ${upstreamRes.status}`);\n  const outHeaders: Record<string, string> = {};\n  upstreamRes.headers.forEach((value, key) => {\n    if (HOP_BY_HOP.has(key.toLowerCase())) {\n      return;\n    }\n    if (key.toLowerCase() === 'content-encoding') {\n      return;\n    }\n    outHeaders[key] = value;\n  });\n\n  res.writeHead(upstreamRes.status, outHeaders);\n\n  if (!upstreamRes.body) {\n    res.end();\n    return;\n  }\n\n  // Mirror opencode-proxy/stream.ts: honor backpressure and cancel xAI when the\n  // hub/client hangs up. Without this, concurrent Claude tool rounds leave\n  // half-open upstream streams and the hub logs \"Premature close\".\n  let bytes = 0;\n  let clientGone = false;\n  const onClose = () => {\n    clientGone = true;\n    void upstreamRes.body?.cancel().catch(() => {});\n  };\n  res.once('close', onClose);\n  const reader = upstreamRes.body.getReader() as ReadableStreamDefaultReader<Uint8Array>;\n  try {\n    while (!clientGone && !res.writableEnded && !res.destroyed) {\n      const { done, value } = await reader.read();\n      if (done) {\n        break;\n      }\n      if (!value?.byteLength) {\n        continue;\n      }\n      bytes += value.byteLength;\n      if (!res.write(Buffer.from(value))) {\n        if (!(await waitForDrain(res))) {\n          clientGone = true;\n          void reader.cancel().catch(() => {});\n          break;\n        }\n      }\n    }\n    if (clientGone) {\n      log(`  ✗ client disconnected after ${bytes} bytes`);\n    }\n  } catch (err) {\n    if (!clientGone && !isBenignStreamError(err)) {\n      log(\n        `  ✗ stream interrupted after ${bytes} bytes: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  } finally {\n    res.removeListener('close', onClose);\n    try {\n      reader.releaseLock();\n    } catch {\n      // already released / cancelled\n    }\n    if (!res.writableEnded) {\n      res.end();\n    }\n  }\n}\n\nfunction waitForDrain(res: ServerResponse): Promise<boolean> {\n  if (res.writableEnded || res.destroyed || res.socket?.destroyed) {\n    return Promise.resolve(false);\n  }\n  if (!res.writableNeedDrain) {\n    return Promise.resolve(true);\n  }\n  return new Promise((resolve) => {\n    const done = (ok: boolean) => {\n      res.removeListener('drain', onDrain);\n      res.removeListener('close', onFail);\n      res.removeListener('error', onFail);\n      resolve(ok);\n    };\n    const onDrain = () => done(true);\n    const onFail = () => done(false);\n    res.once('drain', onDrain);\n    res.once('close', onFail);\n    res.once('error', onFail);\n  });\n}\n\nfunction isBenignStreamError(err: unknown): boolean {\n  if (!err || typeof err !== 'object') {\n    return false;\n  }\n  const value = err as { name?: string; code?: string; message?: string };\n  if (value.name === 'AbortError' || value.code === 'ABORT_ERR') {\n    return true;\n  }\n  if (value.code === 'ERR_STREAM_PREMATURE_CLOSE') {\n    return true;\n  }\n  return (\n    typeof value.message === 'string' &&\n    /aborted|premature close|ECONNRESET|EPIPE|socket hang up/i.test(value.message)\n  );\n}\n\nfunction checkCors(req: IncomingMessage, res: ServerResponse): boolean {\n  const origin = req.headers.origin;\n  if (origin) {\n    try {\n      const parsed = new URL(origin);\n      const loopback =\n        (parsed.hostname === 'localhost' ||\n          parsed.hostname === '127.0.0.1' ||\n          parsed.hostname === '[::1]') &&\n        (parsed.protocol === 'http:' || parsed.protocol === 'https:');\n      if (!loopback) {\n        json(res, 403, {\n          error: {\n            type: 'forbidden_origin',\n            message: 'Only loopback browser origins are allowed.',\n          },\n        });\n        return false;\n      }\n      res.setHeader('access-control-allow-origin', origin);\n      res.setHeader('vary', 'Origin');\n    } catch {\n      json(res, 403, {\n        error: { type: 'forbidden_origin', message: 'Invalid browser origin.' },\n      });\n      return false;\n    }\n  }\n  res.setHeader('access-control-allow-methods', 'GET,POST,OPTIONS,HEAD');\n  res.setHeader(\n    'access-control-allow-headers',\n    [\n      'authorization',\n      'content-type',\n      'x-api-key',\n      'openai-beta',\n      'openai-organization',\n      'anthropic-version',\n      'anthropic-beta',\n    ].join(','),\n  );\n  return true;\n}\n\n/** Canonical ids from the static map (unique, stable order). */\nexport function staticGrokModelIds(): string[] {\n  return [...new Set(Object.values(GROK_MODELS).filter((id) => id.trim().length > 0))];\n}\n\n/** Accept OpenAI `{ data:[{id}] }`, `{ models:[] }`, or a bare string array. */\nexport function modelIdsFromCatalogBody(text: string): string[] {\n  let value: unknown;\n  try {\n    value = JSON.parse(text) as unknown;\n  } catch {\n    return [];\n  }\n  if (Array.isArray(value)) {\n    return value\n      .map((entry) =>\n        typeof entry === 'string'\n          ? entry\n          : entry && typeof entry === 'object'\n            ? (entry as { id?: unknown }).id\n            : undefined,\n      )\n      .filter((id): id is string => typeof id === 'string' && id.trim().length > 0);\n  }\n  if (!value || typeof value !== 'object') {\n    return [];\n  }\n  const record = value as { data?: unknown; models?: unknown };\n  const list = Array.isArray(record.data)\n    ? record.data\n    : Array.isArray(record.models)\n      ? record.models\n      : null;\n  if (!list) {\n    return [];\n  }\n  return list\n    .map((entry) =>\n      typeof entry === 'string'\n        ? entry\n        : entry && typeof entry === 'object'\n          ? (entry as { id?: unknown }).id\n          : undefined,\n    )\n    .filter((id): id is string => typeof id === 'string' && id.trim().length > 0);\n}\n\nfunction json(res: ServerResponse, status: number, body: unknown): void {\n  const raw = JSON.stringify(body);\n  res.writeHead(status, {\n    'content-type': 'application/json; charset=utf-8',\n    'content-length': Buffer.byteLength(raw),\n  });\n  res.end(raw);\n}\n\nfunction pathOf(url: string): string {\n  return url.split('?')[0] ?? url;\n}\n\n/**\n * Claude Code (and some MCP tool packs) put `\"required\": null` on tool\n * input_schema. xAI schema validation rejects that; strip null keywords\n * before the body leaves the loopback proxy.\n */\nfunction sanitizePassThroughBody(path: string, body: Buffer): Buffer {\n  if (body.length === 0) {\n    return body;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body.toString('utf8')) as unknown;\n  } catch {\n    return body;\n  }\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    return body;\n  }\n  const { body: next, changed } = sanitizeInferenceToolSchemas(\n    path,\n    parsed as Record<string, unknown>,\n  );\n  return changed ? Buffer.from(JSON.stringify(next), 'utf8') : body;\n}\n\nexport function listenGrokProxy(\n  opts: GrokProxyServerOptions,\n): Promise<{ server: Server; endpoint: string; port: number }> {\n  const server = createGrokProxyServer(opts);\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(opts.port, opts.host, () => {\n      const addr = server.address();\n      if (!addr || typeof addr === 'string') {\n        reject(new Error('Failed to bind Grok proxy'));\n        return;\n      }\n      const endpoint = `http://${opts.host}:${addr.port}`;\n      resolve({ server, endpoint, port: addr.port });\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAE/B,IAAM,eAAe;AAErB,SAAgB,sBAAsB,MAAsC;CAC1E,mBAAmB,KAAK,IAAI;CAC5B,MAAM,YAAY,KAAK,YAAY,iBAAA,CAAkB,QAAQ,OAAO,EAAE;CACtE,MAAM,gBAAgB,KAAK,iBAAiB;CAC5C,MAAM,qBACJ,KAAK,sBAAsB,QAAQ,IAAI,mCAAmC;CAC5E,MAAM,aAAa,KAAK,SAAS,QAAQ,IAAI,uBAAuB;CACpE,MAAM,MACJ,KAAK,QAAQ,KAAK,cAAc,CAAC,KAAK,SAAiB,QAAQ,OAAO,MAAM,GAAG,KAAK,GAAG;CAEzF,IAAI;CACJ,MAAM,YAAY,IAAI,iBAAiB;CAEvC,MAAM,SAAS,cAAc,KAAK,QAAQ;EACxC,OAAY,KAAK,GAAG;CACtB,CAAC;CAED,eAAe,OAAO,KAAsB,KAAoC;EAC9E,MAAM,MAAM,qBAAqB,IAAI,OAAO,GAAG;EAC/C,MAAM,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM;EAClC,MAAM,SAAS,IAAI,UAAU;EAE7B,IAAI,CAAC,UAAU,KAAK,GAAG,GACrB;EAEF,IAAI,WAAW,WAAW;GACxB,IAAI,UAAU,GAAG;GACjB,IAAI,IAAI;GACR;EACF;EAEA,KAAK,WAAW,SAAS,WAAW,YAAY,SAAS,OAAO,SAAS,YAAY;GACnF,KAAK,KAAK,KAAK;IACb,IAAI;IACJ,SAAS;IACT,eAAe;IACf,YAAY,QAAQ,IAAI,uBAAuB;IAC/C,SAAS;KACP,OAAO;KACP,QAAQ;IACV;IACA,WAAW;KACT,QAAQ;MAAC;MAAwB;MAAiB;KAAY;KAC9D,WAAW,CAAC,gBAAgB,2BAA2B;IACzD;IACA;IACA;GACF,CAAC;GACD;EACF;EAGA,IAAI,CAAC,KAAK,WAAW,MAAM,KAAK,SAAS,OAAO;GAC9C,KAAK,KAAK,KAAK,EACb,OAAO;IACL,SAAS,cAAc,KAAK;IAC5B,MAAM;GACR,EACF,CAAC;GACD;EACF;EAGA,IAAI,CAAC,iBAAiB,KAAK,KAAK,UAAU,GACxC;EAKF,IAAI,WAAW,UAAU,SAAS,6BAA6B;GAC7D,MAAM,kBAAkB,KAAK,GAAG;GAChC;EACF;EAGA,IAAI,sBAAsB,WAAW,UAAU,SAAS,gBAAgB;GACtE,MAAM,0BAA0B,KAAK,GAAG;GACxC;EACF;EAIA,KAAK,WAAW,SAAS,WAAW,WAAW,SAAS,cAAc;GACpE,MAAM,iBAAiB,KAAK,KAAK,KAAK,MAAM;GAC5C;EACF;EAEA,IAAI,GAAG,OAAO,GAAG,MAAM;EACvB,MAAM,iBAAiB,KAAK,KAAK,KAAK,MAAM;CAC9C;CAEA,eAAe,kBAAkB,KAAsB,KAAoC;EACzF,IAAI;GACF,IAAI;GAOJ,IAAI;IACF,OAAO,KAAK,OAAO,MAAM,SAAS,GAAG,EAAA,CAAG,SAAS,MAAM,KAAK,IAAI;GAClE,QAAQ;IACN,KAAK,KAAK,KAAK;KACb,MAAM;KACN,OAAO;MAAE,MAAM;MAAyB,SAAS;KAAoB;IACvE,CAAC;IACD;GACF;GACA,MAAM,cAAc,6BAA6B,IAAI;GACrD,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI;GACxF,IAAI,oCAAoC,YAAY,YAAY,MAAM,EAAE;GACxE,KAAK,KAAK,KAAK,EAAE,cAAc,YAAY,CAAC;EAC9C,SAAS,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC/D,IAAI,oBAAoB,SAAS;GACjC,IAAI,CAAC,IAAI,aACP,KAAK,KAAK,KAAK;IACb,MAAM;IACN,OAAO;KAAE,MAAM;KAAe;IAAQ;GACxC,CAAC;EAEL;CACF;;;;;CAMA,eAAe,iBACb,KACA,KACA,KACA,QACe;EACf,IAAI;GACF,MAAM,EAAE,OAAO,YAAY,MAAM,kBAAkB,KAAK,UAAU,MAAM;GACxE,SAAS;GACT,MAAM,SAAS,GAAG,WAAW;GAE7B,IAAI,cAAc,MAAM,UACtB,QACA;IACE;IACA,SALY,qBAAqB,KAAK,OAAO,aAK7C;IACA,QAAQ,YAAY,QAAQ,IAAM;IAClC,UAAU;GACZ,GACA,GAAG,OAAO,GAAG,KACf;GAEA,IAAI,YAAY,WAAW,OAAO,QAAQ,cAAc;IACtD,IAAI,+CAA+C;IACnD,MAAM,YAAY,MAAM,kBAAkB,KAAK,QAAQ;IACvD,SAAS,UAAU;IAEnB,cAAc,MAAM,UAClB,QACA;KACE;KACA,SALiB,qBAAqB,KAAK,UAAU,OAAO,aAKnD;KACT,QAAQ,YAAY,QAAQ,IAAM;KAClC,UAAU;IACZ,GACA,GAAG,OAAO,GAAG,KACf;GACF;GAEA,IAAI,YAAY,IAAI;IAElB,MAAM,SAAS,wBAAwB,MADpB,YAAY,KAAK,CACO;IAC3C,IAAI,OAAO,SAAS,GAAG;KACrB,IAAI,mBAAmB,OAAO,OAAO,YAAY;KAEjD,KAAK,KAAK,KAAK;MACb,QAAQ;MACR,MAAM,OAAO,KAAK,QAAQ;OAAE;OAAI,QAAQ;OAAS,UAAU;MAAM,EAAE;KACrE,CAAC;KACD;IACF;IACA,IAAI,0DAA0D;GAChE,OACE,IAAI,mBAAmB,YAAY,OAAO,2BAA2B;EAEzE,SAAS,KAAK;GACZ,IACE,mBAAmB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,2BACtE;EACF;EAEA,MAAM,SAAS,mBAAmB;EAClC,IAAI,mBAAmB,OAAO,OAAO,YAAY;EACjD,KAAK,KAAK,KAAK;GACb,QAAQ;GACR,MAAM,OAAO,KAAK,QAAQ;IAAE;IAAI,QAAQ;IAAS,UAAU;GAAM,EAAE;EACrE,CAAC;CACH;;;;;CAMA,eAAe,iBACb,KACA,KACA,KACA,QACe;EACf,IAAI;GACF,MAAM,EAAE,OAAO,YAAY,MAAM,kBAAkB,KAAK,UAAU,MAAM;GACxE,SAAS;GAET,MAAM,SAAS,GAAG,WAAW;GAC7B,MAAM,UACJ,WAAW,SAAS,WAAW,UAAU,WAAW,YAChD,KAAA,IACA,MAAM,SAAS,GAAG;GACxB,MAAM,OAAO,UAAU,wBAAwB,OAAO,GAAG,GAAG,OAAO,IAAI,KAAA;GAIvE,MAAM,UAAU,qBAAqB,KAAK,OAAO,eAAe,MAAM,UAAU;GAChF,IAAI,MACF,QAAQ,oBAAoB,OAAO,KAAK,UAAU;GAGpD,MAAM,cAAc,MAAM,UACxB,QACA;IACE;IACA;IACA,MAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,WAAW,IAAI,IAAI,KAAA;IACvD,QAAQ,YAAY,QAAQ,GAAO;IACnC,UAAU;GACZ,GACA,GAAG,OAAO,GAAG,KACf;GAEA,IAAI,YAAY,WAAW,OAAO,QAAQ,cAAc;IACtD,IAAI,iCAAiC;IACrC,MAAM,YAAY,MAAM,kBAAkB,KAAK,QAAQ;IACvD,SAAS,UAAU;IACnB,MAAM,eAAe,qBACnB,KACA,UAAU,OACV,eACA,MAAM,UACR;IACA,IAAI,MACF,aAAa,oBAAoB,OAAO,KAAK,UAAU;IAazD,MAAM,aAAa,MAXC,UAClB,QACA;KACE;KACA,SAAS;KACT,MAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,WAAW,IAAI,IAAI,KAAA;KACvD,QAAQ,YAAY,QAAQ,GAAO;KACnC,UAAU;IACZ,GACA,GAAG,OAAO,GAAG,KACf,GAC0B,KAAK,GAAG;IAClC;GACF;GAEA,MAAM,aAAa,aAAa,KAAK,GAAG;EAC1C,SAAS,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC3D,IAAI,OAAO,KAAK;GAChB,IAAI,CAAC,IAAI,aACP,KAAK,KAAK,KAAK,EACb,OAAO;IAAE,SAAS;IAAK,MAAM;GAAc,EAC7C,CAAC;QAED,IAAI,IAAI;EAEZ;CACF;;;;CAKA,eAAe,0BACb,KACA,KACe;EACf,IAAI,kDAAkD;EACtD,IAAI;GACF,MAAM,MAAM,MAAM,SAAS,GAAG;GAC9B,IAAI;GACJ,IAAI;IACF,OAAO,KAAK,MAAM,IAAI,SAAS,MAAM,KAAK,IAAI;GAChD,QAAQ;IACN,KAAK,KAAK,KAAK;KACb,MAAM;KACN,OAAO;MACL,MAAM;MACN,SAAS;KACX;IACF,CAAC;IACD;GACF;GAEA,IAAI,CAAC,KAAK,OAAO;IACf,KAAK,KAAK,KAAK;KACb,MAAM;KACN,OAAO;MACL,MAAM;MACN,SAAS;KACX;IACF,CAAC;IACD;GACF;GACA,IAAI,KAAK,cAAc,MACrB,KAAK,aAAa;GAGpB,MAAM,aAAa,kBAAkB,IAAI;GACzC,MAAM,SAAS,QAAQ,KAAK,MAAM;GAClC,WAAW,SAAS;GAEpB,MAAM,UAAU,OAAO,KAAK,KAAK,UAAU,UAAU,GAAG,MAAM;GAC9D,MAAM,EAAE,OAAO,YAAY,MAAM,kBAAkB,KAAK,UAAU,MAAM;GACxE,SAAS;GAET,MAAM,SAAS,GAAG,SAAS;GAC3B,IAAI,cAAc,MAAM,cAAc,QAAQ,OAAO,OAAO;GAE5D,IAAI,YAAY,WAAW,OAAO,QAAQ,cAAc;IACtD,IAAI,iCAAiC;IACrC,MAAM,YAAY,MAAM,kBAAkB,KAAK,QAAQ;IACvD,SAAS,UAAU;IACnB,cAAc,MAAM,cAAc,QAAQ,UAAU,OAAO,OAAO;GACpE;GAEA,IAAI,OAAO,YAAY,OAAO,wBAAwB;GAEtD,IAAI,QAAQ;IACV,IAAI,CAAC,YAAY,IAAI;KACnB,MAAM,UAAU,MAAM,YAAY,KAAK;KACvC,IAAI,UAAU;KACd,IAAI;MAIF,UAHe,KAAK,MAAM,OAGhB,CAAA,CAAO,OAAO,WAAW;KACrC,QAAQ,CAER;KACA,IAAI,UAAU,YAAY,QAAQ,EAChC,gBAAgB,kCAClB,CAAC;KACD,IAAI,IACF,KAAK,UAAU;MACb,MAAM;MACN,OAAO;OAAE,MAAM;OAAa;MAAQ;KACtC,CAAC,CACH;KACA;IACF;IAEA,IAAI,UAAU,KAAK;KACjB,gBAAgB;KAChB,iBAAiB;KACjB,YAAY;KACZ,qBAAqB;IACvB,CAAC;IAED,MAAM,4BACJ,cACC,UAAU;KACT,IAAI,MAAM,KAAK;IACjB,GACA,KAAK,KACP;IACA,IAAI,IAAI;IACR;GACF;GAEA,MAAM,OAAO,MAAM,YAAY,KAAK;GACpC,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,IAAI;GAC1B,QAAQ;IACN,KAAK,KAAK,KAAK;KACb,MAAM;KACN,OAAO;MACL,MAAM;MACN,SAAS,+BAA+B,KAAK,MAAM,GAAG,GAAG;KAC3D;IACF,CAAC;IACD;GACF;GAEA,MAAM,YAAY,kBAAkB,QAAQ,KAAK,KAAK;GACtD,IAAI,UAAU,aAAa,UAAU,SAAS,SAAS;IACrD,KAAK,KAAK,YAAY,UAAU,MAAM,YAAY,SAAS,KAAK,SAAS;IACzE;GACF;GACA,KAAK,KAAK,YAAY,KAAK,MAAM,YAAY,QAAQ,SAAS;EAChE,SAAS,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAC3D,IAAI,iBAAiB,KAAK;GAC1B,IAAI,CAAC,IAAI,aACP,KAAK,KAAK,KAAK;IACb,MAAM;IACN,OAAO;KAAE,MAAM;KAAe,SAAS;IAAI;GAC7C,CAAC;QAED,IAAI,IAAI;EAEZ;CACF;CAEA,eAAe,cAAc,QAAgB,OAAe,SAAoC;EAC9F,OAAO,UACL,QACA;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IAChB,QAAQ;IACR,yBAAyB;IACzB,4BAA4B;IAC5B,cAAc,sBAAsB;GACtC;GACA,MAAM,IAAI,WAAW,OAAO;GAC5B,QAAQ,YAAY,QAAQ,GAAO;GACnC,UAAU;EACZ,GACA,QAAQ,QACV;CACF;CAEA,eAAe,UAAU,QAAgB,MAAmB,OAAkC;EAC5F,MAAM,cAAc,KAAK,WAAW;EACpC,MAAM,MAAM,QAAQ;EACpB,IAAI,aAAa;GACf,MAAM,YAAY,UAAU,YAAY,GAAG;GAC3C,IAAI,YAAY,GACd,OAAO,IAAI,SACT,KAAK,UAAU,EACb,OAAO;IACL,MAAM;IACN,SAAS;GACX,EACF,CAAC,GACD;IACE,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,eAAe,OAAO,KAAK,KAAK,YAAY,GAAI,CAAC;IACnD;GACF,CACF;EAEJ;EACA,MAAM,WAAW,MAAM,MAAM,QAAQ,IAAI;EACzC,IAAI,CAAC,eAAe,SAAS,WAAW,KACtC,OAAO;EAET,MAAM,OAAO,MAAM,SAAS,YAAY;EACxC,MAAM,UAAU,wBACd,SAAS,QACT,SAAS,SACT,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAC/B;EACA,IAAI,QAAQ,cACV,UAAU,IAAI,KAAK,QAAQ,YAAY;EAEzC,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ,SAAS;GACjB,SAAS,SAAS;EACpB,CAAC;CACH;CAEA,OAAO;AACT;AAEA,SAAS,qBACP,KACA,OACA,eACA,eACwB;CACxB,MAAM,UAAkC;EACtC,eAAe,UAAU;EACzB,yBAAyB;EACzB,4BAA4B;EAC5B,cAAc,sBAAsB;EACpC,QAAQ,IAAI,QAAQ,UAAU;CAChC;CAEA,IAAI,IAAI,QAAQ,iBACd,QAAQ,kBAAkB,OAAO,IAAI,QAAQ,eAAe;MACvD,IAAI,iBAAiB,gBAAgB,GAC1C,QAAQ,kBAAkB;CAI5B,IAAI,IAAI,QAAQ,sBACd,QAAQ,uBAAuB,OAAO,IAAI,QAAQ,oBAAoB;CAExE,IAAI,IAAI,QAAQ,mBACd,QAAQ,oBAAoB,OAAO,IAAI,QAAQ,iBAAiB;CAIlE,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,IAAI,OAAO,GAAG;EAChD,IAAI,CAAC,KAAK,WAAW,IAAI,EAAE,YAAY,CAAC,GACtC;EAEF,IAAI,EAAE,YAAY,MAAM,iBACtB;EAEF,IAAI,EAAE,YAAY,CAAC,CAAC,WAAW,SAAS,GACtC;EAEF,IAAI,EAAE,YAAY,MAAM,aACtB;EAEF,IAAI,EAAE,YAAY,MAAM,qBACtB;EAEF,IAAI,EAAE,YAAY,MAAM,kBACtB;EAEF,IAAI,MAAM,QAAQ,CAAC,GACjB,QAAQ,KAAK,EAAE,KAAK,IAAI;OAExB,QAAQ,KAAK;CAEjB;CAEA,OAAO;AACT;AAEA,eAAe,aACb,aACA,KACA,KACe;CAGf,IAAI,YAAY,UAAU,KAAK;EAC7B,MAAM,UAAU,MAAM,YAAY,KAAK;EACvC,MAAM,UAAU,QAAQ,WAAW,eAAe,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG;EACnE,IAAI,OAAO,YAAY,OAAO,GAAG,SAAS;EAC1C,MAAM,aAAqC,CAAC;EAC5C,YAAY,QAAQ,SAAS,OAAO,QAAQ;GAC1C,IAAI,WAAW,IAAI,IAAI,YAAY,CAAC,KAAK,IAAI,YAAY,MAAM,oBAC7D;GAEF,IAAI,IAAI,YAAY,MAAM,kBACxB;GAEF,WAAW,OAAO;EACpB,CAAC;EACD,MAAM,UAAU,OAAO,KAAK,SAAS,MAAM;EAC3C,WAAW,oBAAoB,OAAO,QAAQ,UAAU;EACxD,IAAI,UAAU,YAAY,QAAQ,UAAU;EAC5C,IAAI,IAAI,OAAO;EACf;CACF;CAEA,IAAI,OAAO,YAAY,QAAQ;CAC/B,MAAM,aAAqC,CAAC;CAC5C,YAAY,QAAQ,SAAS,OAAO,QAAQ;EAC1C,IAAI,WAAW,IAAI,IAAI,YAAY,CAAC,GAClC;EAEF,IAAI,IAAI,YAAY,MAAM,oBACxB;EAEF,WAAW,OAAO;CACpB,CAAC;CAED,IAAI,UAAU,YAAY,QAAQ,UAAU;CAE5C,IAAI,CAAC,YAAY,MAAM;EACrB,IAAI,IAAI;EACR;CACF;CAKA,IAAI,QAAQ;CACZ,IAAI,aAAa;CACjB,MAAM,gBAAgB;EACpB,aAAa;EACb,YAAiB,MAAM,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;CAChD;CACA,IAAI,KAAK,SAAS,OAAO;CACzB,MAAM,SAAS,YAAY,KAAK,UAAU;CAC1C,IAAI;EACF,OAAO,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC,IAAI,WAAW;GAC1D,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MACF;GAEF,IAAI,CAAC,OAAO,YACV;GAEF,SAAS,MAAM;GACf,IAAI,CAAC,IAAI,MAAM,OAAO,KAAK,KAAK,CAAC;QAC3B,CAAE,MAAM,aAAa,GAAG,GAAI;KAC9B,aAAa;KACb,OAAY,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;KACnC;IACF;;EAEJ;EACA,IAAI,YACF,IAAI,iCAAiC,MAAM,OAAO;CAEtD,SAAS,KAAK;EACZ,IAAI,CAAC,cAAc,CAAC,oBAAoB,GAAG,GACzC,IACE,gCAAgC,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GACjG;CAEJ,UAAU;EACR,IAAI,eAAe,SAAS,OAAO;EACnC,IAAI;GACF,OAAO,YAAY;EACrB,QAAQ,CAER;EACA,IAAI,CAAC,IAAI,eACP,IAAI,IAAI;CAEZ;AACF;AAEA,SAAS,aAAa,KAAuC;CAC3D,IAAI,IAAI,iBAAiB,IAAI,aAAa,IAAI,QAAQ,WACpD,OAAO,QAAQ,QAAQ,KAAK;CAE9B,IAAI,CAAC,IAAI,mBACP,OAAO,QAAQ,QAAQ,IAAI;CAE7B,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,QAAQ,OAAgB;GAC5B,IAAI,eAAe,SAAS,OAAO;GACnC,IAAI,eAAe,SAAS,MAAM;GAClC,IAAI,eAAe,SAAS,MAAM;GAClC,QAAQ,EAAE;EACZ;EACA,MAAM,gBAAgB,KAAK,IAAI;EAC/B,MAAM,eAAe,KAAK,KAAK;EAC/B,IAAI,KAAK,SAAS,OAAO;EACzB,IAAI,KAAK,SAAS,MAAM;EACxB,IAAI,KAAK,SAAS,MAAM;CAC1B,CAAC;AACH;AAEA,SAAS,oBAAoB,KAAuB;CAClD,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,OAAO;CAET,MAAM,QAAQ;CACd,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,aAChD,OAAO;CAET,IAAI,MAAM,SAAS,8BACjB,OAAO;CAET,OACE,OAAO,MAAM,YAAY,YACzB,2DAA2D,KAAK,MAAM,OAAO;AAEjF;AAEA,SAAS,UAAU,KAAsB,KAA8B;CACrE,MAAM,SAAS,IAAI,QAAQ;CAC3B,IAAI,QACF,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,MAAM;EAM7B,IAAI,GAJD,OAAO,aAAa,eACnB,OAAO,aAAa,eACpB,OAAO,aAAa,aACrB,OAAO,aAAa,WAAW,OAAO,aAAa,YACvC;GACb,KAAK,KAAK,KAAK,EACb,OAAO;IACL,MAAM;IACN,SAAS;GACX,EACF,CAAC;GACD,OAAO;EACT;EACA,IAAI,UAAU,+BAA+B,MAAM;EACnD,IAAI,UAAU,QAAQ,QAAQ;CAChC,QAAQ;EACN,KAAK,KAAK,KAAK,EACb,OAAO;GAAE,MAAM;GAAoB,SAAS;EAA0B,EACxE,CAAC;EACD,OAAO;CACT;CAEF,IAAI,UAAU,gCAAgC,uBAAuB;CACrE,IAAI,UACF,gCACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,GAAG,CACZ;CACA,OAAO;AACT;;AAGA,SAAgB,qBAA+B;CAC7C,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,WAAW,CAAC,CAAC,QAAQ,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACrF;;AAGA,SAAgB,wBAAwB,MAAwB;CAC9D,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI;CACzB,QAAQ;EACN,OAAO,CAAC;CACV;CACA,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MACJ,KAAK,UACJ,OAAO,UAAU,WACb,QACA,SAAS,OAAO,UAAU,WACvB,MAA2B,KAC5B,KAAA,CACR,CAAC,CACA,QAAQ,OAAqB,OAAO,OAAO,YAAY,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;CAEhF,IAAI,CAAC,SAAS,OAAO,UAAU,UAC7B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,OAAO,MAAM,QAAQ,OAAO,IAAI,IAClC,OAAO,OACP,MAAM,QAAQ,OAAO,MAAM,IACzB,OAAO,SACP;CACN,IAAI,CAAC,MACH,OAAO,CAAC;CAEV,OAAO,KACJ,KAAK,UACJ,OAAO,UAAU,WACb,QACA,SAAS,OAAO,UAAU,WACvB,MAA2B,KAC5B,KAAA,CACR,CAAC,CACA,QAAQ,OAAqB,OAAO,OAAO,YAAY,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;AAChF;AAEA,SAAS,KAAK,KAAqB,QAAgB,MAAqB;CACtE,MAAM,MAAM,KAAK,UAAU,IAAI;CAC/B,IAAI,UAAU,QAAQ;EACpB,gBAAgB;EAChB,kBAAkB,OAAO,WAAW,GAAG;CACzC,CAAC;CACD,IAAI,IAAI,GAAG;AACb;AAEA,SAAS,OAAO,KAAqB;CACnC,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM;AAC9B;;;;;;AAOA,SAAS,wBAAwB,MAAc,MAAsB;CACnE,IAAI,KAAK,WAAW,GAClB,OAAO;CAET,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;CAC3C,QAAQ;EACN,OAAO;CACT;CACA,IAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAC/D,OAAO;CAET,MAAM,EAAE,MAAM,MAAM,YAAY,6BAC9B,MACA,MACF;CACA,OAAO,UAAU,OAAO,KAAK,KAAK,UAAU,IAAI,GAAG,MAAM,IAAI;AAC/D;AAEA,SAAgB,gBACd,MAC6D;CAC7D,MAAM,SAAS,sBAAsB,IAAI;CACzC,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO,KAAK,MAAM,KAAK,YAAY;GACxC,MAAM,OAAO,OAAO,QAAQ;GAC5B,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;IACrC,uBAAO,IAAI,MAAM,2BAA2B,CAAC;IAC7C;GACF;GACA,MAAM,WAAW,UAAU,KAAK,KAAK,GAAG,KAAK;GAC7C,QAAQ;IAAE;IAAQ;IAAU,MAAM,KAAK;GAAK,CAAC;EAC/C,CAAC;CACH,CAAC;AACH"}

package/dist/providers/grok.d.ts

@@ -0,0 +1,38 @@
+import type { Account, AccountMeta, LiveAuthStatus, Provider, ProxyContext, ProxyHubBackendContext, ProxyHubBackendHandle, ProxyHandle, ProxyStatus, SourceAdapter } from '../types.js';
+export declare class GrokProvider implements Provider {
+    private readonly home;
+    readonly id = "grok";
+    readonly name = "xAI Grok";
+    readonly shortName = "Grok";
+    readonly description = "Manages ~/.grok/auth.json + OpenAI/Anthropic compat proxy (Codex + Claude)";
+    readonly defaultProxyPort = 8080;
+    readonly proxyCompatibility = "OpenAI + Anthropic API";
+    roleDefaults(): Record<string, string>;
+    suggestModels(): Record<string, string>;
+    roleFriendlyModels(): readonly string[];
+    staticFallbackModels(): readonly string[];
+    constructor(home?: string);
+    sourceAdapter(account: Account): SourceAdapter;
+    poolSourceAdapter(): SourceAdapter;
+    createProxyHubBackend(ctx: ProxyHubBackendContext): Promise<ProxyHubBackendHandle>;
+    private get authPath();
+    detectLive(): Promise<LiveAuthStatus>;
+    backup(destDir: string): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>>;
+    restore(srcDir: string): Promise<void>;
+    describeSnapshot(srcDir: string): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>>;
+    /**
+     * Delete local Grok auth.json only — does NOT revoke OIDC tokens server-side.
+     */
+    clearLive(): Promise<void>;
+    /**
+     * Refresh OIDC tokens inside a snapshot dir (auth.json).
+     */
+    refreshAuth(authDir: string): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>>;
+    snapshotMatchesLive(snapshotDir: string): Promise<boolean>;
+    startProxy(ctx: ProxyContext): Promise<ProxyHandle>;
+    stopProxy(ctx: ProxyContext): Promise<void>;
+    proxyStatus(ctx: ProxyContext): Promise<ProxyStatus>;
+    readProxyLogs(ctx: ProxyContext, lines?: number): Promise<string>;
+}
+export declare const grokProvider: GrokProvider;
+//# sourceMappingURL=grok.d.ts.map

package/dist/providers/grok.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.d.ts","sourceRoot":"","sources":["../../src/providers/grok.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,aAAa,EACd,MAAM,UAAU,CAAC;AAgClB,qBAAa,YAAa,YAAW,QAAQ;IA4B/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IA3BjC,QAAQ,CAAC,EAAE,UAAU;IACrB,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,SAAS,UAAU;IAC5B,QAAQ,CAAC,WAAW,gFAC2D;IAC/E,QAAQ,CAAC,gBAAgB,QAAgB;IACzC,QAAQ,CAAC,kBAAkB,4BAA4B;IAKvD,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAErC;IAED,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEtC;IAED,kBAAkB,IAAI,SAAS,MAAM,EAAE,CAEtC;IAED,oBAAoB,IAAI,SAAS,MAAM,EAAE,CAExC;IAED,YAA6B,IAAI,SAAY,EAAI;IAEjD,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAE7C;IAED,iBAAiB,IAAI,aAAa,CAEjC;IAEK,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAmBvF;IAED,OAAO,KAAK,QAAQ,GAEnB;IAEK,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAmB1C;IAEK,MAAM,CACV,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAarE;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAEK,gBAAgB,CACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAerE;IAED;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAS/B;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CASrE;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/D;IAIK,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA8GxD;IAEK,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAEK,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBzD;IAEK,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlE;CACF;AA6BD,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/providers/grok.js

@@ -0,0 +1,250 @@
+import { AnyPickError } from "../utils/errors.js";
+import { backupRequiredFile, ensureDir, pathExists, readJsonFile, restoreRequiredFile } from "../utils/fs.js";
+import { waitForHttp } from "../utils/process/health.js";
+import { isProcessRunning, readPidFile, spawnDetached, stopPidFile } from "../utils/process/pid.js";
+import { assertLoopbackHost } from "../utils/network.js";
+import { grokAccountAdapter, poolAdapterFor } from "../sources/account-adapters.js";
+import { rolesFromLiveDiscovery } from "./model-policy.js";
+import { closeProxyHubBackend } from "./proxy-hub-backend.js";
+import { snapshotMatchesLiveDefault } from "./auth-fingerprint.js";
+import { listenGrokProxy } from "./grok-proxy/server.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+//#region src/providers/grok.ts
+/**
+* xAI Grok CLI / Grok Build
+*
+* Live auth: ~/.grok/auth.json (OIDC)
+*
+* Built-in dual-protocol proxy:
+*   OpenAI  (/v1/chat/completions)  → Codex
+*   Anthropic (/v1/messages)        → Claude Code
+* Injects CLI OIDC token and forwards to cli-chat-proxy.grok.com.
+* No external binary required.
+*/
+var DEFAULT_PORT = 8080;
+var GrokProvider = class {
+	home;
+	id = "grok";
+	name = "xAI Grok";
+	shortName = "Grok";
+	description = "Manages ~/.grok/auth.json + OpenAI/Anthropic compat proxy (Codex + Claude)";
+	defaultProxyPort = DEFAULT_PORT;
+	proxyCompatibility = "OpenAI + Anthropic API";
+	roleDefaults() {
+		return rolesFromLiveDiscovery();
+	}
+	suggestModels() {
+		return {};
+	}
+	roleFriendlyModels() {
+		return [];
+	}
+	staticFallbackModels() {
+		return [];
+	}
+	constructor(home = homedir()) {
+		this.home = home;
+	}
+	sourceAdapter(account) {
+		return grokAccountAdapter(account);
+	}
+	poolSourceAdapter() {
+		return poolAdapterFor(this.id, this);
+	}
+	async createProxyHubBackend(ctx) {
+		if (ctx.accounts.length !== 1) throw new AnyPickError("Grok multi-account pools are not available through Proxy Hub yet.", "POOL_NOT_ENABLED");
+		const account = ctx.accounts[0];
+		const options = account.proxy.options ?? {};
+		const { server, endpoint } = await listenGrokProxy({
+			host: "127.0.0.1",
+			port: 0,
+			authPath: join(account.snapshotDir, "auth.json"),
+			upstream: typeof options.upstream === "string" ? options.upstream : void 0,
+			clientVersion: typeof options.clientVersion === "string" ? options.clientVersion : void 0,
+			token: ctx.token,
+			log: ctx.log
+		});
+		return {
+			endpoint,
+			close: () => closeProxyHubBackend(server)
+		};
+	}
+	get authPath() {
+		return process.env.GROK_AUTH_PATH ?? join(this.home, ".grok", "auth.json");
+	}
+	async detectLive() {
+		const path = this.authPath;
+		if (!await pathExists(path)) return { present: false };
+		try {
+			const data = await readJsonFile(path);
+			const sessions = Object.values(data).filter((v) => v && typeof v === "object");
+			if (sessions.length === 0) return { present: false };
+			return {
+				present: true,
+				identity: firstEmail(sessions)
+			};
+		} catch {
+			return {
+				present: true,
+				details: "auth.json present (unreadable)"
+			};
+		}
+	}
+	async backup(destDir) {
+		const dest = join(destDir, "auth.json");
+		await backupRequiredFile(this.authPath, dest, "Grok auth.json");
+		try {
+			const data = await readJsonFile(dest);
+			return { identity: firstEmail(Object.values(data).filter((v) => v && typeof v === "object")) };
+		} catch {
+			return {};
+		}
+	}
+	async restore(srcDir) {
+		await restoreRequiredFile(join(srcDir, "auth.json"), this.authPath, "auth.json");
+	}
+	async describeSnapshot(srcDir) {
+		const path = join(srcDir, "auth.json");
+		if (!await pathExists(path)) return {};
+		try {
+			const data = await readJsonFile(path);
+			return { identity: firstEmail(Object.values(data).filter((v) => v && typeof v === "object")) };
+		} catch {
+			return {};
+		}
+	}
+	/**
+	* Delete local Grok auth.json only — does NOT revoke OIDC tokens server-side.
+	*/
+	async clearLive() {
+		const { rm } = await import("node:fs/promises");
+		for (const p of [this.authPath, `${this.authPath}.lock`]) try {
+			await rm(p, { force: true });
+		} catch {}
+	}
+	/**
+	* Refresh OIDC tokens inside a snapshot dir (auth.json).
+	*/
+	async refreshAuth(authDir) {
+		const path = join(authDir, "auth.json");
+		if (!await pathExists(path)) throw new Error(`No auth.json in ${authDir}`);
+		const { loadGrokSession, refreshSession } = await import("./grok-proxy/auth.js");
+		return { identity: (await refreshSession(path, await loadGrokSession(path))).email };
+	}
+	async snapshotMatchesLive(snapshotDir) {
+		return snapshotMatchesLiveDefault("grok", snapshotDir);
+	}
+	async startProxy(ctx) {
+		const host = ctx.config.host ?? "127.0.0.1";
+		assertLoopbackHost(host);
+		const port = ctx.config.port ?? DEFAULT_PORT;
+		const mainJs = resolveProxyMain();
+		if (!await pathExists(mainJs)) throw new AnyPickError(`Grok proxy entry not found at ${mainJs}. Run: pnpm build`, "PROXY_BINARY_MISSING");
+		await ensureDir(ctx.runtimeDir);
+		const logPath = join(ctx.runtimeDir, "proxy.log");
+		const pidPath = join(ctx.runtimeDir, "proxy.pid");
+		await writeFile(logPath, "", { mode: 384 });
+		const authPath = await pathExists(this.authPath) ? this.authPath : join(ctx.snapshotDir, "auth.json");
+		if (!await pathExists(authPath)) throw new AnyPickError("No Grok auth available to start proxy. Save/login first.", "NO_LIVE_AUTH");
+		const clientVersion = (typeof ctx.config.options?.clientVersion === "string" ? ctx.config.options.clientVersion : void 0) ?? process.env.GROK_CLIENT_VERSION ?? "0.2.101";
+		const upstream = (typeof ctx.config.options?.upstream === "string" ? ctx.config.options.upstream : void 0) ?? process.env.GROK_PROXY_UPSTREAM ?? "https://cli-chat-proxy.grok.com";
+		const endpoint = `http://${host}:${port}`;
+		const { pid, instanceId } = await spawnDetached(process.execPath, [
+			mainJs,
+			"--port",
+			String(port),
+			"--host",
+			host,
+			"--auth-path",
+			authPath,
+			"--upstream",
+			upstream,
+			"--client-version",
+			clientVersion
+		], {
+			logPath,
+			pidPath,
+			endpoint,
+			provider: "grok",
+			account: ctx.accountName,
+			env: {
+				...process.env,
+				GROK_AUTH_PATH: authPath,
+				...ctx.token ? { ANYPICK_PROXY_TOKEN: ctx.token } : {},
+				ANYPICK_PROXY_LOG: logPath
+			}
+		});
+		if (!await waitForHttp(`${endpoint}/health`, {
+			timeoutMs: 5e3,
+			requirePid: pid,
+			expectInstanceId: instanceId
+		}) || !isProcessRunning(pid)) {
+			const { readFile } = await import("node:fs/promises");
+			let tail = "";
+			try {
+				tail = (await readFile(logPath, "utf8")).split(/\r?\n/).slice(-20).join("\n");
+			} catch {}
+			if (isProcessRunning(pid)) try {
+				process.kill(pid, "SIGTERM");
+			} catch {}
+			throw new AnyPickError(`Grok proxy failed to bind ${host}:${port}.${tail ? `\n${tail}` : ""}`, "PROXY_START_FAILED");
+		}
+		return {
+			endpoint,
+			compatibility: this.proxyCompatibility,
+			pid,
+			instanceId,
+			token: ctx.token,
+			logPath
+		};
+	}
+	async stopProxy(ctx) {
+		await stopPidFile(join(ctx.runtimeDir, "proxy.pid"));
+	}
+	async proxyStatus(ctx) {
+		const pidPath = join(ctx.runtimeDir, "proxy.pid");
+		const logPath = join(ctx.runtimeDir, "proxy.log");
+		const pid = await readPidFile(pidPath);
+		const running = pid != null && isProcessRunning(pid);
+		const host = ctx.config.host ?? "127.0.0.1";
+		const port = ctx.config.port ?? DEFAULT_PORT;
+		return {
+			enabled: ctx.config.enabled,
+			running,
+			endpoint: running ? `http://${host}:${port}` : void 0,
+			compatibility: this.proxyCompatibility,
+			pid: running ? pid ?? void 0 : void 0,
+			logPath: await pathExists(logPath) ? logPath : void 0,
+			detail: running ? void 0 : ctx.config.enabled ? "stopped" : "disabled"
+		};
+	}
+	async readProxyLogs(ctx, lines = 50) {
+		const logPath = join(ctx.runtimeDir, "proxy.log");
+		if (!await pathExists(logPath)) return "(no log file yet)";
+		const { readFile } = await import("node:fs/promises");
+		return (await readFile(logPath, "utf8")).split(/\r?\n/).slice(-lines).join("\n");
+	}
+};
+function resolveProxyMain() {
+	const here = fileURLToPath(new URL(".", import.meta.url));
+	const primary = join(here, "grok-proxy", "main.js");
+	if (existsSync(primary)) return primary;
+	const fromSrc = join(here, "..", "..", "dist", "providers", "grok-proxy", "main.js");
+	if (existsSync(fromSrc)) return fromSrc;
+	return primary;
+}
+function firstEmail(sessions) {
+	for (const s of sessions) {
+		if (typeof s.email === "string" && s.email) return s.email;
+		if (typeof s.user_id === "string" && s.user_id) return s.user_id;
+	}
+}
+var grokProvider = new GrokProvider();
+//#endregion
+export { GrokProvider, grokProvider };
+
+//# sourceMappingURL=grok.js.map

package/dist/providers/grok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.js","names":[],"sources":["../../src/providers/grok.ts"],"sourcesContent":["import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { fileURLToPath } from 'node:url';\nimport type {\n  Account,\n  AccountMeta,\n  LiveAuthStatus,\n  Provider,\n  ProxyContext,\n  ProxyHubBackendContext,\n  ProxyHubBackendHandle,\n  ProxyHandle,\n  ProxyStatus,\n  SourceAdapter,\n} from '../types';\nimport { grokAccountAdapter, poolAdapterFor } from '../sources/account-adapters';\nimport { backupRequiredFile, pathExists, readJsonFile, restoreRequiredFile } from '../utils/fs';\nimport {\n  isProcessRunning,\n  readPidFile,\n  spawnDetached,\n  stopPidFile,\n  waitForHttp,\n} from '../utils/process';\nimport { AnyPickError } from '../utils/errors';\nimport { snapshotMatchesLiveDefault } from './auth-fingerprint';\nimport { ensureDir } from '../utils/fs';\nimport { writeFile } from 'node:fs/promises';\nimport { assertLoopbackHost } from '../utils/network';\nimport { rolesFromLiveDiscovery } from './model-policy';\nimport { listenGrokProxy } from './grok-proxy/server';\nimport { closeProxyHubBackend } from './proxy-hub-backend';\n\n/**\n * xAI Grok CLI / Grok Build\n *\n * Live auth: ~/.grok/auth.json (OIDC)\n *\n * Built-in dual-protocol proxy:\n *   OpenAI  (/v1/chat/completions)  → Codex\n *   Anthropic (/v1/messages)        → Claude Code\n * Injects CLI OIDC token and forwards to cli-chat-proxy.grok.com.\n * No external binary required.\n */\nconst DEFAULT_PORT = 8080;\n\nexport class GrokProvider implements Provider {\n  readonly id = 'grok';\n  readonly name = 'xAI Grok';\n  readonly shortName = 'Grok';\n  readonly description =\n    'Manages ~/.grok/auth.json + OpenAI/Anthropic compat proxy (Codex + Claude)';\n  readonly defaultProxyPort = DEFAULT_PORT;\n  readonly proxyCompatibility = 'OpenAI + Anthropic API';\n\n  // Prefer the running proxy's /v1/models (account-scoped). Static maps are the\n  // offline fallback so tray/TUI still offer a usable catalog when the proxy is\n  // stopped or discovery fails.\n  roleDefaults(): Record<string, string> {\n    return rolesFromLiveDiscovery();\n  }\n\n  suggestModels(): Record<string, string> {\n    return {};\n  }\n\n  roleFriendlyModels(): readonly string[] {\n    return [];\n  }\n\n  staticFallbackModels(): readonly string[] {\n    return [];\n  }\n\n  constructor(private readonly home = homedir()) {}\n\n  sourceAdapter(account: Account): SourceAdapter {\n    return grokAccountAdapter(account);\n  }\n\n  poolSourceAdapter(): SourceAdapter {\n    return poolAdapterFor(this.id, this);\n  }\n\n  async createProxyHubBackend(ctx: ProxyHubBackendContext): Promise<ProxyHubBackendHandle> {\n    if (ctx.accounts.length !== 1) {\n      throw new AnyPickError(\n        'Grok multi-account pools are not available through Proxy Hub yet.',\n        'POOL_NOT_ENABLED',\n      );\n    }\n    const account = ctx.accounts[0];\n    const options = account.proxy.options ?? {};\n    const { server, endpoint } = await listenGrokProxy({\n      host: '127.0.0.1',\n      port: 0,\n      authPath: join(account.snapshotDir, 'auth.json'),\n      upstream: typeof options.upstream === 'string' ? options.upstream : undefined,\n      clientVersion: typeof options.clientVersion === 'string' ? options.clientVersion : undefined,\n      token: ctx.token,\n      log: ctx.log,\n    });\n    return { endpoint, close: () => closeProxyHubBackend(server) };\n  }\n\n  private get authPath(): string {\n    return process.env.GROK_AUTH_PATH ?? join(this.home, '.grok', 'auth.json');\n  }\n\n  async detectLive(): Promise<LiveAuthStatus> {\n    const path = this.authPath;\n    if (!(await pathExists(path))) {\n      return { present: false };\n    }\n    try {\n      const data = await readJsonFile<Record<string, unknown>>(path);\n      const sessions = Object.values(data).filter((v) => v && typeof v === 'object') as Record<\n        string,\n        unknown\n      >[];\n      if (sessions.length === 0) {\n        return { present: false };\n      }\n      const identity = firstEmail(sessions);\n      return { present: true, identity };\n    } catch {\n      return { present: true, details: 'auth.json present (unreadable)' };\n    }\n  }\n\n  async backup(\n    destDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    const dest = join(destDir, 'auth.json');\n    await backupRequiredFile(this.authPath, dest, 'Grok auth.json');\n    try {\n      const data = await readJsonFile<Record<string, unknown>>(dest);\n      const sessions = Object.values(data).filter((v) => v && typeof v === 'object') as Record<\n        string,\n        unknown\n      >[];\n      return { identity: firstEmail(sessions) };\n    } catch {\n      return {};\n    }\n  }\n\n  async restore(srcDir: string): Promise<void> {\n    await restoreRequiredFile(join(srcDir, 'auth.json'), this.authPath, 'auth.json');\n  }\n\n  async describeSnapshot(\n    srcDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    const path = join(srcDir, 'auth.json');\n    if (!(await pathExists(path))) {\n      return {};\n    }\n    try {\n      const data = await readJsonFile<Record<string, unknown>>(path);\n      const sessions = Object.values(data).filter((v) => v && typeof v === 'object') as Record<\n        string,\n        unknown\n      >[];\n      return { identity: firstEmail(sessions) };\n    } catch {\n      return {};\n    }\n  }\n\n  /**\n   * Delete local Grok auth.json only — does NOT revoke OIDC tokens server-side.\n   */\n  async clearLive(): Promise<void> {\n    const { rm } = await import('node:fs/promises');\n    for (const p of [this.authPath, `${this.authPath}.lock`]) {\n      try {\n        await rm(p, { force: true });\n      } catch {\n        // ignore\n      }\n    }\n  }\n\n  /**\n   * Refresh OIDC tokens inside a snapshot dir (auth.json).\n   */\n  async refreshAuth(\n    authDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    const path = join(authDir, 'auth.json');\n    if (!(await pathExists(path))) {\n      throw new Error(`No auth.json in ${authDir}`);\n    }\n    const { loadGrokSession, refreshSession } = await import('./grok-proxy/auth');\n    const session = await loadGrokSession(path);\n    const updated = await refreshSession(path, session);\n    return { identity: updated.email };\n  }\n\n  async snapshotMatchesLive(snapshotDir: string): Promise<boolean> {\n    return snapshotMatchesLiveDefault('grok', snapshotDir);\n  }\n\n  // ── Built-in proxy ──────────────────────────────────────────────\n\n  async startProxy(ctx: ProxyContext): Promise<ProxyHandle> {\n    const host = ctx.config.host ?? '127.0.0.1';\n    assertLoopbackHost(host);\n    const port = ctx.config.port ?? DEFAULT_PORT;\n    const mainJs = resolveProxyMain();\n    if (!(await pathExists(mainJs))) {\n      throw new AnyPickError(\n        `Grok proxy entry not found at ${mainJs}. Run: pnpm build`,\n        'PROXY_BINARY_MISSING',\n      );\n    }\n\n    await ensureDir(ctx.runtimeDir);\n    const logPath = join(ctx.runtimeDir, 'proxy.log');\n    const pidPath = join(ctx.runtimeDir, 'proxy.pid');\n    await writeFile(logPath, '', { mode: 0o600 });\n\n    // Prefer live auth (already restored on switch); fall back to snapshot.\n    const authPath = (await pathExists(this.authPath))\n      ? this.authPath\n      : join(ctx.snapshotDir, 'auth.json');\n\n    if (!(await pathExists(authPath))) {\n      throw new AnyPickError(\n        'No Grok auth available to start proxy. Save/login first.',\n        'NO_LIVE_AUTH',\n      );\n    }\n\n    const clientVersion =\n      (typeof ctx.config.options?.clientVersion === 'string'\n        ? ctx.config.options.clientVersion\n        : undefined) ??\n      process.env.GROK_CLIENT_VERSION ??\n      '0.2.101';\n\n    const upstream =\n      (typeof ctx.config.options?.upstream === 'string'\n        ? ctx.config.options.upstream\n        : undefined) ??\n      process.env.GROK_PROXY_UPSTREAM ??\n      'https://cli-chat-proxy.grok.com';\n\n    const endpoint = `http://${host}:${port}`;\n    const { pid, instanceId } = await spawnDetached(\n      process.execPath,\n      [\n        mainJs,\n        '--port',\n        String(port),\n        '--host',\n        host,\n        '--auth-path',\n        authPath,\n        '--upstream',\n        upstream,\n        '--client-version',\n        clientVersion,\n      ],\n      {\n        logPath,\n        pidPath,\n        endpoint,\n        provider: 'grok',\n        account: ctx.accountName,\n        env: {\n          ...process.env,\n          GROK_AUTH_PATH: authPath,\n          ...(ctx.token ? { ANYPICK_PROXY_TOKEN: ctx.token } : {}),\n          ANYPICK_PROXY_LOG: logPath,\n        },\n      },\n    );\n\n    const ready = await waitForHttp(`${endpoint}/health`, {\n      timeoutMs: 5000,\n      requirePid: pid,\n      expectInstanceId: instanceId,\n    });\n\n    if (!ready || !isProcessRunning(pid)) {\n      const { readFile } = await import('node:fs/promises');\n      let tail = '';\n      try {\n        const raw = await readFile(logPath, 'utf8');\n        tail = raw.split(/\\r?\\n/).slice(-20).join('\\n');\n      } catch {\n        // ignore\n      }\n      if (isProcessRunning(pid)) {\n        try {\n          process.kill(pid, 'SIGTERM');\n        } catch {\n          // ignore\n        }\n      }\n      throw new AnyPickError(\n        `Grok proxy failed to bind ${host}:${port}.${tail ? `\\n${tail}` : ''}`,\n        'PROXY_START_FAILED',\n      );\n    }\n\n    return {\n      endpoint,\n      compatibility: this.proxyCompatibility,\n      pid,\n      instanceId,\n      token: ctx.token,\n      logPath,\n    };\n  }\n\n  async stopProxy(ctx: ProxyContext): Promise<void> {\n    await stopPidFile(join(ctx.runtimeDir, 'proxy.pid'));\n  }\n\n  async proxyStatus(ctx: ProxyContext): Promise<ProxyStatus> {\n    const pidPath = join(ctx.runtimeDir, 'proxy.pid');\n    const logPath = join(ctx.runtimeDir, 'proxy.log');\n    const pid = await readPidFile(pidPath);\n    const running = pid != null && isProcessRunning(pid);\n    const host = ctx.config.host ?? '127.0.0.1';\n    const port = ctx.config.port ?? DEFAULT_PORT;\n\n    return {\n      enabled: ctx.config.enabled,\n      running,\n      endpoint: running ? `http://${host}:${port}` : undefined,\n      compatibility: this.proxyCompatibility,\n      pid: running ? (pid ?? undefined) : undefined,\n      logPath: (await pathExists(logPath)) ? logPath : undefined,\n      detail: running ? undefined : ctx.config.enabled ? 'stopped' : 'disabled',\n    };\n  }\n\n  async readProxyLogs(ctx: ProxyContext, lines = 50): Promise<string> {\n    const logPath = join(ctx.runtimeDir, 'proxy.log');\n    if (!(await pathExists(logPath))) {\n      return '(no log file yet)';\n    }\n    const { readFile } = await import('node:fs/promises');\n    const raw = await readFile(logPath, 'utf8');\n    return raw.split(/\\r?\\n/).slice(-lines).join('\\n');\n  }\n}\n\nfunction resolveProxyMain(): string {\n  // dist/providers/grok.js → dist/providers/grok-proxy/main.js\n  // When running via tsx from src/, fall back to dist build output.\n  const here = fileURLToPath(new URL('.', import.meta.url));\n  const primary = join(here, 'grok-proxy', 'main.js');\n  if (existsSync(primary)) {\n    return primary;\n  }\n  const fromSrc = join(here, '..', '..', 'dist', 'providers', 'grok-proxy', 'main.js');\n  if (existsSync(fromSrc)) {\n    return fromSrc;\n  }\n  return primary;\n}\n\nfunction firstEmail(sessions: Record<string, unknown>[]): string | undefined {\n  for (const s of sessions) {\n    if (typeof s.email === 'string' && s.email) {\n      return s.email;\n    }\n    if (typeof s.user_id === 'string' && s.user_id) {\n      return s.user_id;\n    }\n  }\n  return undefined;\n}\n\nexport const grokProvider = new GrokProvider();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAM,eAAe;AAErB,IAAa,eAAb,MAA8C;CA4Bf;CA3B7B,KAAc;CACd,OAAgB;CAChB,YAAqB;CACrB,cACE;CACF,mBAA4B;CAC5B,qBAA8B;CAK9B,eAAuC;EACrC,OAAO,uBAAuB;CAChC;CAEA,gBAAwC;EACtC,OAAO,CAAC;CACV;CAEA,qBAAwC;EACtC,OAAO,CAAC;CACV;CAEA,uBAA0C;EACxC,OAAO,CAAC;CACV;CAEA,YAAY,OAAwB,QAAQ,GAAG;EAAlB,KAAA,OAAA;CAAmB;CAEhD,cAAc,SAAiC;EAC7C,OAAO,mBAAmB,OAAO;CACnC;CAEA,oBAAmC;EACjC,OAAO,eAAe,KAAK,IAAI,IAAI;CACrC;CAEA,MAAM,sBAAsB,KAA6D;EACvF,IAAI,IAAI,SAAS,WAAW,GAC1B,MAAM,IAAI,aACR,qEACA,kBACF;EAEF,MAAM,UAAU,IAAI,SAAS;EAC7B,MAAM,UAAU,QAAQ,MAAM,WAAW,CAAC;EAC1C,MAAM,EAAE,QAAQ,aAAa,MAAM,gBAAgB;GACjD,MAAM;GACN,MAAM;GACN,UAAU,KAAK,QAAQ,aAAa,WAAW;GAC/C,UAAU,OAAO,QAAQ,aAAa,WAAW,QAAQ,WAAW,KAAA;GACpE,eAAe,OAAO,QAAQ,kBAAkB,WAAW,QAAQ,gBAAgB,KAAA;GACnF,OAAO,IAAI;GACX,KAAK,IAAI;EACX,CAAC;EACD,OAAO;GAAE;GAAU,aAAa,qBAAqB,MAAM;EAAE;CAC/D;CAEA,IAAY,WAAmB;EAC7B,OAAO,QAAQ,IAAI,kBAAkB,KAAK,KAAK,MAAM,SAAS,WAAW;CAC3E;CAEA,MAAM,aAAsC;EAC1C,MAAM,OAAO,KAAK;EAClB,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB,OAAO,EAAE,SAAS,MAAM;EAE1B,IAAI;GACF,MAAM,OAAO,MAAM,aAAsC,IAAI;GAC7D,MAAM,WAAW,OAAO,OAAO,IAAI,CAAC,CAAC,QAAQ,MAAM,KAAK,OAAO,MAAM,QAAQ;GAI7E,IAAI,SAAS,WAAW,GACtB,OAAO,EAAE,SAAS,MAAM;GAG1B,OAAO;IAAE,SAAS;IAAM,UADP,WAAW,QACJ;GAAS;EACnC,QAAQ;GACN,OAAO;IAAE,SAAS;IAAM,SAAS;GAAiC;EACpE;CACF;CAEA,MAAM,OACJ,SACqE;EACrE,MAAM,OAAO,KAAK,SAAS,WAAW;EACtC,MAAM,mBAAmB,KAAK,UAAU,MAAM,gBAAgB;EAC9D,IAAI;GACF,MAAM,OAAO,MAAM,aAAsC,IAAI;GAK7D,OAAO,EAAE,UAAU,WAJF,OAAO,OAAO,IAAI,CAAC,CAAC,QAAQ,MAAM,KAAK,OAAO,MAAM,QAIvC,CAAQ,EAAE;EAC1C,QAAQ;GACN,OAAO,CAAC;EACV;CACF;CAEA,MAAM,QAAQ,QAA+B;EAC3C,MAAM,oBAAoB,KAAK,QAAQ,WAAW,GAAG,KAAK,UAAU,WAAW;CACjF;CAEA,MAAM,iBACJ,QACqE;EACrE,MAAM,OAAO,KAAK,QAAQ,WAAW;EACrC,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB,OAAO,CAAC;EAEV,IAAI;GACF,MAAM,OAAO,MAAM,aAAsC,IAAI;GAK7D,OAAO,EAAE,UAAU,WAJF,OAAO,OAAO,IAAI,CAAC,CAAC,QAAQ,MAAM,KAAK,OAAO,MAAM,QAIvC,CAAQ,EAAE;EAC1C,QAAQ;GACN,OAAO,CAAC;EACV;CACF;;;;CAKA,MAAM,YAA2B;EAC/B,MAAM,EAAE,OAAO,MAAM,OAAO;EAC5B,KAAK,MAAM,KAAK,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,MAAM,GACrD,IAAI;GACF,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;EAC7B,QAAQ,CAER;CAEJ;;;;CAKA,MAAM,YACJ,SACqE;EACrE,MAAM,OAAO,KAAK,SAAS,WAAW;EACtC,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB,MAAM,IAAI,MAAM,mBAAmB,SAAS;EAE9C,MAAM,EAAE,iBAAiB,mBAAmB,MAAM,OAAO;EAGzD,OAAO,EAAE,WAAU,MADG,eAAe,MAAM,MADrB,gBAAgB,IAAI,CACQ,EAAA,CACvB,MAAM;CACnC;CAEA,MAAM,oBAAoB,aAAuC;EAC/D,OAAO,2BAA2B,QAAQ,WAAW;CACvD;CAIA,MAAM,WAAW,KAAyC;EACxD,MAAM,OAAO,IAAI,OAAO,QAAQ;EAChC,mBAAmB,IAAI;EACvB,MAAM,OAAO,IAAI,OAAO,QAAQ;EAChC,MAAM,SAAS,iBAAiB;EAChC,IAAI,CAAE,MAAM,WAAW,MAAM,GAC3B,MAAM,IAAI,aACR,iCAAiC,OAAO,oBACxC,sBACF;EAGF,MAAM,UAAU,IAAI,UAAU;EAC9B,MAAM,UAAU,KAAK,IAAI,YAAY,WAAW;EAChD,MAAM,UAAU,KAAK,IAAI,YAAY,WAAW;EAChD,MAAM,UAAU,SAAS,IAAI,EAAE,MAAM,IAAM,CAAC;EAG5C,MAAM,WAAY,MAAM,WAAW,KAAK,QAAQ,IAC5C,KAAK,WACL,KAAK,IAAI,aAAa,WAAW;EAErC,IAAI,CAAE,MAAM,WAAW,QAAQ,GAC7B,MAAM,IAAI,aACR,4DACA,cACF;EAGF,MAAM,iBACH,OAAO,IAAI,OAAO,SAAS,kBAAkB,WAC1C,IAAI,OAAO,QAAQ,gBACnB,KAAA,MACJ,QAAQ,IAAI,uBACZ;EAEF,MAAM,YACH,OAAO,IAAI,OAAO,SAAS,aAAa,WACrC,IAAI,OAAO,QAAQ,WACnB,KAAA,MACJ,QAAQ,IAAI,uBACZ;EAEF,MAAM,WAAW,UAAU,KAAK,GAAG;EACnC,MAAM,EAAE,KAAK,eAAe,MAAM,cAChC,QAAQ,UACR;GACE;GACA;GACA,OAAO,IAAI;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF,GACA;GACE;GACA;GACA;GACA,UAAU;GACV,SAAS,IAAI;GACb,KAAK;IACH,GAAG,QAAQ;IACX,gBAAgB;IAChB,GAAI,IAAI,QAAQ,EAAE,qBAAqB,IAAI,MAAM,IAAI,CAAC;IACtD,mBAAmB;GACrB;EACF,CACF;EAQA,IAAI,CAAC,MANe,YAAY,GAAG,SAAS,UAAU;GACpD,WAAW;GACX,YAAY;GACZ,kBAAkB;EACpB,CAAC,KAEa,CAAC,iBAAiB,GAAG,GAAG;GACpC,MAAM,EAAE,aAAa,MAAM,OAAO;GAClC,IAAI,OAAO;GACX,IAAI;IAEF,QAAO,MADW,SAAS,SAAS,MAAM,EAAA,CAC/B,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI;GAChD,QAAQ,CAER;GACA,IAAI,iBAAiB,GAAG,GACtB,IAAI;IACF,QAAQ,KAAK,KAAK,SAAS;GAC7B,QAAQ,CAER;GAEF,MAAM,IAAI,aACR,6BAA6B,KAAK,GAAG,KAAK,GAAG,OAAO,KAAK,SAAS,MAClE,oBACF;EACF;EAEA,OAAO;GACL;GACA,eAAe,KAAK;GACpB;GACA;GACA,OAAO,IAAI;GACX;EACF;CACF;CAEA,MAAM,UAAU,KAAkC;EAChD,MAAM,YAAY,KAAK,IAAI,YAAY,WAAW,CAAC;CACrD;CAEA,MAAM,YAAY,KAAyC;EACzD,MAAM,UAAU,KAAK,IAAI,YAAY,WAAW;EAChD,MAAM,UAAU,KAAK,IAAI,YAAY,WAAW;EAChD,MAAM,MAAM,MAAM,YAAY,OAAO;EACrC,MAAM,UAAU,OAAO,QAAQ,iBAAiB,GAAG;EACnD,MAAM,OAAO,IAAI,OAAO,QAAQ;EAChC,MAAM,OAAO,IAAI,OAAO,QAAQ;EAEhC,OAAO;GACL,SAAS,IAAI,OAAO;GACpB;GACA,UAAU,UAAU,UAAU,KAAK,GAAG,SAAS,KAAA;GAC/C,eAAe,KAAK;GACpB,KAAK,UAAW,OAAO,KAAA,IAAa,KAAA;GACpC,SAAU,MAAM,WAAW,OAAO,IAAK,UAAU,KAAA;GACjD,QAAQ,UAAU,KAAA,IAAY,IAAI,OAAO,UAAU,YAAY;EACjE;CACF;CAEA,MAAM,cAAc,KAAmB,QAAQ,IAAqB;EAClE,MAAM,UAAU,KAAK,IAAI,YAAY,WAAW;EAChD,IAAI,CAAE,MAAM,WAAW,OAAO,GAC5B,OAAO;EAET,MAAM,EAAE,aAAa,MAAM,OAAO;EAElC,QAAO,MADW,SAAS,SAAS,MAAM,EAAA,CAC/B,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;CACnD;AACF;AAEA,SAAS,mBAA2B;CAGlC,MAAM,OAAO,cAAc,IAAI,IAAI,KAAK,OAAO,KAAK,GAAG,CAAC;CACxD,MAAM,UAAU,KAAK,MAAM,cAAc,SAAS;CAClD,IAAI,WAAW,OAAO,GACpB,OAAO;CAET,MAAM,UAAU,KAAK,MAAM,MAAM,MAAM,QAAQ,aAAa,cAAc,SAAS;CACnF,IAAI,WAAW,OAAO,GACpB,OAAO;CAET,OAAO;AACT;AAEA,SAAS,WAAW,UAAyD;CAC3E,KAAK,MAAM,KAAK,UAAU;EACxB,IAAI,OAAO,EAAE,UAAU,YAAY,EAAE,OACnC,OAAO,EAAE;EAEX,IAAI,OAAO,EAAE,YAAY,YAAY,EAAE,SACrC,OAAO,EAAE;CAEb;AAEF;AAEA,IAAa,eAAe,IAAI,aAAa"}

package/dist/providers/index.d.ts

@@ -0,0 +1,14 @@
+import type { ProviderRegistry } from '../core/registry.js';
+import { codexProvider } from './codex.js';
+import { claudeProvider } from './claude.js';
+import { geminiProvider } from './gemini.js';
+import { grokProvider } from './grok.js';
+import { kiroProvider } from './kiro.js';
+import { opencodeProvider } from './opencode.js';
+/**
+ * Register built-in providers. Call once at CLI startup.
+ * To add a provider: implement Provider, import here, register().
+ */
+export declare function registerBuiltinProviders(registry: ProviderRegistry): void;
+export { claudeProvider, codexProvider, geminiProvider, grokProvider, kiroProvider, opencodeProvider, };
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAOzE;AAED,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,CAAC"}

package/dist/providers/index.js

@@ -0,0 +1,23 @@
+import { geminiProvider } from "./gemini.js";
+import { codexProvider } from "./codex.js";
+import { claudeProvider } from "./claude.js";
+import { grokProvider } from "./grok.js";
+import { kiroProvider } from "./kiro.js";
+import { opencodeProvider } from "./opencode.js";
+//#region src/providers/index.ts
+/**
+* Register built-in providers. Call once at CLI startup.
+* To add a provider: implement Provider, import here, register().
+*/
+function registerBuiltinProviders(registry) {
+	registry.register(claudeProvider);
+	registry.register(codexProvider);
+	registry.register(geminiProvider);
+	registry.register(grokProvider);
+	registry.register(kiroProvider);
+	registry.register(opencodeProvider);
+}
+//#endregion
+export { claudeProvider, codexProvider, geminiProvider, grokProvider, kiroProvider, opencodeProvider, registerBuiltinProviders };
+
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/providers/index.ts"],"sourcesContent":["import type { ProviderRegistry } from '../core/registry';\nimport { codexProvider } from './codex';\nimport { claudeProvider } from './claude';\nimport { geminiProvider } from './gemini';\nimport { grokProvider } from './grok';\nimport { kiroProvider } from './kiro';\nimport { opencodeProvider } from './opencode';\n\n/**\n * Register built-in providers. Call once at CLI startup.\n * To add a provider: implement Provider, import here, register().\n */\nexport function registerBuiltinProviders(registry: ProviderRegistry): void {\n  registry.register(claudeProvider);\n  registry.register(codexProvider);\n  registry.register(geminiProvider);\n  registry.register(grokProvider);\n  registry.register(kiroProvider);\n  registry.register(opencodeProvider);\n}\n\nexport {\n  claudeProvider,\n  codexProvider,\n  geminiProvider,\n  grokProvider,\n  kiroProvider,\n  opencodeProvider,\n};\n"],"mappings":";;;;;;;;;;;AAYA,SAAgB,yBAAyB,UAAkC;CACzE,SAAS,SAAS,cAAc;CAChC,SAAS,SAAS,aAAa;CAC/B,SAAS,SAAS,cAAc;CAChC,SAAS,SAAS,YAAY;CAC9B,SAAS,SAAS,YAAY;CAC9B,SAAS,SAAS,gBAAgB;AACpC"}

package/dist/providers/kiro-secret-store.d.ts

@@ -0,0 +1,39 @@
+/**
+ * kiro-cli's secret store.
+ *
+ * Since kiro-cli 2.x the login is no longer a file under ~/.aws/sso/cache. It
+ * lives in the OS keychain, mirrored into an `auth_kv` table in kiro-cli's own
+ * SQLite database, and kiro-cli reads the keychain *first* — so switching a Kiro
+ * account has to write both tiers. Restoring only the database would be
+ * silently ignored while a stale keychain item is still readable, which is the
+ * worst possible outcome: anypick reports a switch that did not happen.
+ *
+ * Every access mirrors what kiro-cli itself does — `/usr/bin/security` and
+ * `INSERT OR REPLACE INTO auth_kv` — so an item anypick writes carries the same
+ * keychain ACL and kiro-cli reads it back without an authorization prompt.
+ *
+ * The secret never crosses `argv`: `security(1)` is driven through its `-i`
+ * stdin mode, and the value is passed as hex (`-X`) because `-i` unquoting
+ * mangles backslashes, which JSON escapes contain.
+ */
+/** Login kinds kiro-cli stores, each under its own keychain service name. */
+export declare const KIRO_SECRET_KEYS: readonly ['kirocli:social:token', 'kirocli:odic:token', 'kirocli:odic:device-registration', 'kirocli:external-idp:token'];
+/** Keyed by the names in `KIRO_SECRET_KEYS`; absent keys are simply not stored. */
+export type KiroSecrets = Record<string, string>;
+/** kiro-cli's data directory, following the same platform rules it does. */
+export declare function kiroSecretDbPath(home?: string): string;
+/** Every secret kiro-cli currently holds. Empty when it is not logged in. */
+export declare function readKiroSecrets(home?: string): Promise<KiroSecrets>;
+/** Replace the stored login. Writes both tiers; the keychain is best-effort. */
+export declare function writeKiroSecrets(secrets: KiroSecrets, home?: string): Promise<void>;
+/** Forget the local login. Does not call Kiro/AWS logout. */
+export declare function clearKiroSecrets(home?: string): Promise<void>;
+/**
+ * A human label for the stored login.
+ *
+ * The token carries no email — the only per-account signal is the profile id at
+ * the tail of `profile_arn`, so it is paired with the identity provider to give
+ * something a person can tell two Google logins apart by.
+ */
+export declare function kiroSecretIdentity(secrets: KiroSecrets): string | undefined;
+//# sourceMappingURL=kiro-secret-store.d.ts.map

package/dist/providers/kiro-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-secret-store.d.ts","sourceRoot":"","sources":["../../src/providers/kiro-secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,YAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kCAAkC,EAClC,4BAA4B,CACpB,CAAC;AAEX,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAUjD,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,SAAY,GAAG,MAAM,CAczD;AAED,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,IAAI,SAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAuB5E;AAED,gFAAgF;AAChF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5F;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,IAAI,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CA4B3E"}