aura-code 0.6.3 → 0.10.1

package/dist/plugins/types.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Claude Code plugin compatibility — shared types.
+ *
+ * Aura loads plugins in the Claude Code plugin format so the existing
+ * ecosystem (marketplaces with hundreds of published plugins) works here:
+ *
+ *   <plugin>/
+ *     .claude-plugin/plugin.json     — manifest {name, version, description}
+ *     commands/<name>.md             — slash commands (frontmatter + prompt)
+ *     agents/<name>.md               — agent definitions (frontmatter + system prompt)
+ *     skills/<name>/SKILL.md         — skills (frontmatter + prompt body)
+ *     hooks/hooks.json               — PreToolUse/PostToolUse/… hook commands
+ *     .mcp.json                      — MCP servers (NOT supported — warned at load)
+ *
+ * Marketplaces are git repos with .claude-plugin/marketplace.json listing
+ * plugins by name + source.
+ */
+export interface PluginManifest {
+    name: string;
+    version?: string;
+    description?: string;
+    author?: string;
+}
+/** A slash command from commands/<name>.md — invoked as /name or /plugin:name. */
+export interface PluginCommand {
+    /** Invocation name (file basename; subdirs join with ":", e.g. "git:commit"). */
+    name: string;
+    pluginName: string;
+    description?: string;
+    /** Hint shown in listings, e.g. "[pr-number]". */
+    argumentHint?: string;
+    /** Prompt template body ($ARGUMENTS / $1..$9 / !`cmd` are expanded). */
+    body: string;
+    filePath: string;
+}
+/** An agent from agents/<name>.md — its body becomes the task's system preamble. */
+export interface PluginAgent {
+    name: string;
+    pluginName: string;
+    description?: string;
+    systemPrompt: string;
+    filePath: string;
+}
+/** A skill from skills/<name>/SKILL.md — exposed like a command in aura. */
+export interface PluginSkill {
+    name: string;
+    pluginName: string;
+    description?: string;
+    body: string;
+    dir: string;
+}
+export type HookEvent = 'PreToolUse' | 'PostToolUse';
+/** One flattened hook: event + optional tool matcher + shell command. */
+export interface HookEntry {
+    event: HookEvent;
+    /** Regex over the tool name (Claude Code names like "Bash" and aura names both match). */
+    matcher?: string;
+    command: string;
+    /** Seconds before the hook process is killed (default 60). */
+    timeout?: number;
+    pluginName: string;
+    /** Absolute plugin dir — substituted for ${CLAUDE_PLUGIN_ROOT} in command. */
+    pluginRoot: string;
+}
+export interface LoadedPlugin {
+    name: string;
+    /** Absolute path of the installed plugin directory. */
+    path: string;
+    manifest: PluginManifest;
+    commands: PluginCommand[];
+    agents: PluginAgent[];
+    skills: PluginSkill[];
+    hooks: HookEntry[];
+    /** Count of MCP servers declared in .mcp.json (unsupported, surfaced as a warning). */
+    mcpServerCount: number;
+}
+/** Entry in a marketplace.json plugin list. */
+export interface MarketplacePluginEntry {
+    name: string;
+    description?: string;
+    /** Relative path within the marketplace repo, "owner/repo", a git URL, or {source, repo|url|path}. */
+    source: unknown;
+}
+export interface Marketplace {
+    name: string;
+    /** Absolute path of the cloned marketplace repo. */
+    path: string;
+    description?: string;
+    plugins: MarketplacePluginEntry[];
+}

package/dist/plugins/types.js

@@ -0,0 +1,20 @@
+"use strict";
+/**
+ * Claude Code plugin compatibility — shared types.
+ *
+ * Aura loads plugins in the Claude Code plugin format so the existing
+ * ecosystem (marketplaces with hundreds of published plugins) works here:
+ *
+ *   <plugin>/
+ *     .claude-plugin/plugin.json     — manifest {name, version, description}
+ *     commands/<name>.md             — slash commands (frontmatter + prompt)
+ *     agents/<name>.md               — agent definitions (frontmatter + system prompt)
+ *     skills/<name>/SKILL.md         — skills (frontmatter + prompt body)
+ *     hooks/hooks.json               — PreToolUse/PostToolUse/… hook commands
+ *     .mcp.json                      — MCP servers (NOT supported — warned at load)
+ *
+ * Marketplaces are git repos with .claude-plugin/marketplace.json listing
+ * plugins by name + source.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/plugins/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/providers/anthropic-oauth-draft.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Anthropic OAuth PKCE flow - standalone draft for human review.
+ *
+ * Ported from ~/.hermes/hermes-agent/agent/anthropic_adapter.py
+ * (Hermes-native PKCE OAuth flow section) and the token-refresh logic.
+ *
+ * This is NOT wired into factory.ts or any existing provider registration.
+ * It is a draft only.
+ *
+ * Key functions:
+ *   - generatePkce()          -> PKCE code_verifier + code_challenge (S256)
+ *   - buildAuthorizationUrl() -> OAuth authorize URL with PKCE challenge
+ *   - exchangeCodeForToken()  -> POST authorization code to token endpoint
+ *   - refreshOAuthToken()     -> POST refresh_token grant
+ *   - readCredentials()       -> Read stored OAuth creds from disk
+ *   - writeCredentials()      -> Persist OAuth creds to disk
+ *   - runOAuthLogin()         -> Full interactive PKCE flow (CLI)
+ *
+ * Credentials are stored at ~/.aura/.anthropic_oauth.json
+ *
+ * Verified against source (grep on anthropic_adapter.py, byte-for-byte):
+ *   client_id, redirect_uri, scope all match lines 1371/1381/1382.
+ */
+export interface PkcePair {
+    /** PKCE code_verifier (random URL-safe base64, 43 chars). */
+    verifier: string;
+    /** PKCE code_challenge = base64url(sha256(verifier)). */
+    challenge: string;
+}
+export interface OAuthCredentials {
+    /** The access token (JWT or opaque bearer token). */
+    accessToken: string;
+    /** The refresh token (single-use - rotated on each refresh). */
+    refreshToken: string;
+    /** Expiry as milliseconds since Unix epoch. */
+    expiresAtMs: number;
+    /** OAuth scopes granted (persisted across refreshes when known). */
+    scopes?: string[];
+}
+/**
+ * Generate a PKCE code_verifier and S256 code_challenge.
+ *
+ * - verifier: 32 random bytes, base64url-encoded (no padding) = 43 chars
+ * - challenge: base64url(sha256(verifier)), no padding
+ */
+export declare function generatePkce(): PkcePair;
+/**
+ * Build the Anthropic OAuth authorize URL with PKCE parameters.
+ *
+ * The user opens this URL in a browser, authenticates with their
+ * Claude Pro/Max subscription, and receives an authorization code.
+ */
+export declare function buildAuthorizationUrl(challenge: string, state: string): string;
+/**
+ * Exchange an authorization code for tokens.
+ *
+ * Tries platform.claude.com first, falls back to console.anthropic.com
+ * (which may 404 for some deployments but remains as a legacy fallback).
+ *
+ * @param code     The authorization code from the redirect.
+ * @param verifier The PKCE code_verifier that pairs with the challenge.
+ * @param state    The OAuth state parameter (for CSRF validation).
+ */
+export declare function exchangeCodeForToken(code: string, verifier: string, state: string): Promise<OAuthCredentials>;
+/**
+ * Refresh an Anthropic OAuth token using the refresh_token grant.
+ *
+ * The refresh token is single-use: a successful refresh rotates the
+ * pair and invalidates the old refresh token. Callers must persist
+ * the returned credentials.
+ *
+ * Tries both endpoints with JSON body.
+ *
+ * @param currentRefreshToken The current refresh_token.
+ */
+export declare function refreshOAuthToken(currentRefreshToken: string): Promise<OAuthCredentials>;
+/**
+ * Read Aura's stored OAuth credentials from disk.
+ *
+ * Returns null if the file does not exist, is not valid JSON,
+ * or does not contain an accessToken.
+ */
+export declare function readCredentials(): Promise<OAuthCredentials | null>;
+/**
+ * Write OAuth credentials to disk atomically.
+ *
+ * Uses a temp-file + rename strategy to avoid corruption from
+ * concurrent writers or partial writes.
+ *
+ * @param creds The credentials to persist.
+ */
+export declare function writeCredentials(creds: OAuthCredentials): Promise<void>;
+/**
+ * Check whether credentials have a non-expired access token.
+ *
+ * Allows a 60-second buffer before actual expiry to avoid
+ * edge-case races where the token expires mid-request.
+ */
+export declare function isTokenValid(creds: OAuthCredentials): boolean;
+/**
+ * Run the full interactive OAuth PKCE login flow.
+ *
+ * 1. Generate PKCE verifier/challenge + OAuth state
+ * 2. Print the authorize URL for the user to open in a browser
+ * 3. Prompt for the authorization code (from the redirect URI fragment)
+ * 4. Validate CSRF state
+ * 5. Exchange the code for tokens
+ * 6. Persist credentials to ~/.aura/.anthropic_oauth.json
+ *
+ * @param options.onAuthUrl  Called with the URL so the caller can display it
+ *                           or open a browser. Defaults to console.log.
+ * @param options.onPrompt   Called to get user input. Defaults to a readline
+ *                           prompt on stdin.
+ * @returns The credentials on success, or null if the user cancelled.
+ */
+export declare function runOAuthLogin(options?: {
+    onAuthUrl?: (url: string) => void;
+    onPrompt?: (message: string) => Promise<string>;
+}): Promise<OAuthCredentials | null>;

package/dist/providers/anthropic-oauth-draft.js

@@ -0,0 +1,414 @@
+"use strict";
+/**
+ * Anthropic OAuth PKCE flow - standalone draft for human review.
+ *
+ * Ported from ~/.hermes/hermes-agent/agent/anthropic_adapter.py
+ * (Hermes-native PKCE OAuth flow section) and the token-refresh logic.
+ *
+ * This is NOT wired into factory.ts or any existing provider registration.
+ * It is a draft only.
+ *
+ * Key functions:
+ *   - generatePkce()          -> PKCE code_verifier + code_challenge (S256)
+ *   - buildAuthorizationUrl() -> OAuth authorize URL with PKCE challenge
+ *   - exchangeCodeForToken()  -> POST authorization code to token endpoint
+ *   - refreshOAuthToken()     -> POST refresh_token grant
+ *   - readCredentials()       -> Read stored OAuth creds from disk
+ *   - writeCredentials()      -> Persist OAuth creds to disk
+ *   - runOAuthLogin()         -> Full interactive PKCE flow (CLI)
+ *
+ * Credentials are stored at ~/.aura/.anthropic_oauth.json
+ *
+ * Verified against source (grep on anthropic_adapter.py, byte-for-byte):
+ *   client_id, redirect_uri, scope all match lines 1371/1381/1382.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePkce = generatePkce;
+exports.buildAuthorizationUrl = buildAuthorizationUrl;
+exports.exchangeCodeForToken = exchangeCodeForToken;
+exports.refreshOAuthToken = refreshOAuthToken;
+exports.readCredentials = readCredentials;
+exports.writeCredentials = writeCredentials;
+exports.isTokenValid = isTokenValid;
+exports.runOAuthLogin = runOAuthLogin;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs/promises"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const readline_1 = require("readline");
+// -- Constants (matching Anthropic's OAuth infrastructure) -----------
+/** Anthropic OAuth client ID - shared across Claude Code, pi-ai, OpenCode, Hermes. */
+const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+/**
+ * Token endpoint URLs. platform.claude.com is the primary;
+ * console.anthropic.com is the legacy fallback (now 404s on some paths).
+ */
+const OAUTH_TOKEN_URLS = [
+    'https://platform.claude.com/v1/oauth/token',
+    'https://console.anthropic.com/v1/oauth/token',
+];
+/** Redirect URI registered for this client_id (PKCE public client). */
+const OAUTH_REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';
+/** OAuth scopes requested - inference, profile, and API-key creation. */
+const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference';
+/** Where Aura stores its own OAuth credentials (separate from Hermes/Claude Code). */
+function getOauthFilePath() {
+    return path.join(os.homedir(), '.aura', '.anthropic_oauth.json');
+}
+/** User-Agent fragment for Claude Code version spoofing. */
+const CLAUDE_CODE_VERSION_FALLBACK = '2.1.74';
+// -- PKCE: code_verifier / code_challenge (S256) ---------------------
+/**
+ * Generate a PKCE code_verifier and S256 code_challenge.
+ *
+ * - verifier: 32 random bytes, base64url-encoded (no padding) = 43 chars
+ * - challenge: base64url(sha256(verifier)), no padding
+ */
+function generatePkce() {
+    const verifier = crypto
+        .randomBytes(32)
+        .toString('base64url')
+        .replace(/=+$/, '');
+    const challenge = crypto
+        .createHash('sha256')
+        .update(verifier)
+        .digest()
+        .toString('base64url')
+        .replace(/=+$/, '');
+    return { verifier, challenge };
+}
+// -- Authorization URL construction ----------------------------------
+/**
+ * Build the Anthropic OAuth authorize URL with PKCE parameters.
+ *
+ * The user opens this URL in a browser, authenticates with their
+ * Claude Pro/Max subscription, and receives an authorization code.
+ */
+function buildAuthorizationUrl(challenge, state) {
+    const params = new URLSearchParams({
+        code: 'true',
+        client_id: OAUTH_CLIENT_ID,
+        response_type: 'code',
+        redirect_uri: OAUTH_REDIRECT_URI,
+        scope: OAUTH_SCOPES,
+        code_challenge: challenge,
+        code_challenge_method: 'S256',
+        state,
+    });
+    return `https://claude.ai/oauth/authorize?${params.toString()}`;
+}
+// -- Token exchange (authorization_code grant) -----------------------
+/**
+ * Exchange an authorization code for tokens.
+ *
+ * Tries platform.claude.com first, falls back to console.anthropic.com
+ * (which may 404 for some deployments but remains as a legacy fallback).
+ *
+ * @param code     The authorization code from the redirect.
+ * @param verifier The PKCE code_verifier that pairs with the challenge.
+ * @param state    The OAuth state parameter (for CSRF validation).
+ */
+async function exchangeCodeForToken(code, verifier, state) {
+    const body = JSON.stringify({
+        grant_type: 'authorization_code',
+        client_id: OAUTH_CLIENT_ID,
+        code,
+        state,
+        redirect_uri: OAUTH_REDIRECT_URI,
+        code_verifier: verifier,
+    });
+    const headers = {
+        'Content-Type': 'application/json',
+        'User-Agent': `claude-cli/${CLAUDE_CODE_VERSION_FALLBACK} (external, cli)`,
+    };
+    let lastError;
+    for (const endpoint of OAUTH_TOKEN_URLS) {
+        try {
+            const resp = await fetch(endpoint, {
+                method: 'POST',
+                headers,
+                body,
+                signal: AbortSignal.timeout(15_000),
+            });
+            if (!resp.ok) {
+                const text = await resp.text().catch(() => '');
+                lastError = new Error(`Token exchange failed at ${endpoint}: HTTP ${resp.status} - ${text.slice(0, 500)}`);
+                continue;
+            }
+            const result = (await resp.json());
+            const accessToken = result.access_token;
+            if (!accessToken) {
+                throw new Error('Token exchange response missing access_token');
+            }
+            const expiresIn = result.expires_in ?? 3600;
+            const expiresAtMs = Date.now() + expiresIn * 1000;
+            return {
+                accessToken,
+                refreshToken: result.refresh_token ?? '',
+                expiresAtMs,
+                scopes: result.scope ? result.scope.split(' ') : undefined,
+            };
+        }
+        catch (err) {
+            lastError = err;
+            continue;
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error('Token exchange failed on all endpoints');
+}
+// -- Token refresh (refresh_token grant) -----------------------------
+/**
+ * Refresh an Anthropic OAuth token using the refresh_token grant.
+ *
+ * The refresh token is single-use: a successful refresh rotates the
+ * pair and invalidates the old refresh token. Callers must persist
+ * the returned credentials.
+ *
+ * Tries both endpoints with JSON body.
+ *
+ * @param currentRefreshToken The current refresh_token.
+ */
+async function refreshOAuthToken(currentRefreshToken) {
+    if (!currentRefreshToken) {
+        throw new Error('currentRefreshToken is required');
+    }
+    const body = JSON.stringify({
+        grant_type: 'refresh_token',
+        refresh_token: currentRefreshToken,
+        client_id: OAUTH_CLIENT_ID,
+    });
+    const headers = {
+        'Content-Type': 'application/json',
+        'User-Agent': `claude-cli/${CLAUDE_CODE_VERSION_FALLBACK} (external, cli)`,
+    };
+    let lastError;
+    for (const endpoint of OAUTH_TOKEN_URLS) {
+        try {
+            const resp = await fetch(endpoint, {
+                method: 'POST',
+                headers,
+                body,
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!resp.ok) {
+                const text = await resp.text().catch(() => '');
+                lastError = new Error(`Token refresh failed at ${endpoint}: HTTP ${resp.status} - ${text.slice(0, 500)}`);
+                continue;
+            }
+            const result = (await resp.json());
+            const accessToken = result.access_token;
+            if (!accessToken) {
+                throw new Error('Refresh response missing access_token');
+            }
+            const nextRefresh = result.refresh_token || currentRefreshToken;
+            const expiresIn = result.expires_in ?? 3600;
+            const expiresAtMs = Date.now() + expiresIn * 1000;
+            return {
+                accessToken,
+                refreshToken: nextRefresh,
+                expiresAtMs,
+                scopes: result.scope ? result.scope.split(' ') : undefined,
+            };
+        }
+        catch (err) {
+            lastError = err;
+            continue;
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error('Token refresh failed on all endpoints');
+}
+// -- Credential persistence (~/.aura/.anthropic_oauth.json) ----------
+/**
+ * Read Aura's stored OAuth credentials from disk.
+ *
+ * Returns null if the file does not exist, is not valid JSON,
+ * or does not contain an accessToken.
+ */
+async function readCredentials() {
+    const filePath = getOauthFilePath();
+    try {
+        const raw = await fs.readFile(filePath, 'utf-8');
+        const data = JSON.parse(raw);
+        if (data.accessToken) {
+            return {
+                accessToken: data.accessToken,
+                refreshToken: data.refreshToken ?? '',
+                expiresAtMs: data.expiresAtMs ?? 0,
+                scopes: data.scopes,
+            };
+        }
+    }
+    catch {
+        // File doesn't exist, is unreadable, or invalid JSON - not an error
+    }
+    return null;
+}
+/**
+ * Write OAuth credentials to disk atomically.
+ *
+ * Uses a temp-file + rename strategy to avoid corruption from
+ * concurrent writers or partial writes.
+ *
+ * @param creds The credentials to persist.
+ */
+async function writeCredentials(creds) {
+    const filePath = getOauthFilePath();
+    // Read existing file to preserve any extra fields
+    let existing = {};
+    try {
+        const raw = await fs.readFile(filePath, 'utf-8');
+        existing = JSON.parse(raw);
+    }
+    catch {
+        // File doesn't exist yet - start fresh
+    }
+    const stored = {
+        ...existing,
+        accessToken: creds.accessToken,
+        refreshToken: creds.refreshToken,
+        expiresAtMs: creds.expiresAtMs,
+    };
+    // Preserve previously-stored scopes when not provided in the new creds
+    if (creds.scopes) {
+        stored.scopes = creds.scopes;
+    }
+    else if (existing.scopes) {
+        stored.scopes = existing.scopes;
+    }
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    const tmpPath = filePath + '.tmp.' + process.pid + '.' + crypto.randomBytes(4).toString('hex');
+    const content = JSON.stringify(stored, null, 2);
+    try {
+        await fs.writeFile(tmpPath, content, { mode: 0o600, flag: 'wx' });
+        await fs.rename(tmpPath, filePath);
+    }
+    catch (err) {
+        // Clean up temp file on failure
+        try {
+            await fs.unlink(tmpPath);
+        }
+        catch {
+            // best-effort cleanup
+        }
+        throw err;
+    }
+}
+// -- Token validity check --------------------------------------------
+/**
+ * Check whether credentials have a non-expired access token.
+ *
+ * Allows a 60-second buffer before actual expiry to avoid
+ * edge-case races where the token expires mid-request.
+ */
+function isTokenValid(creds) {
+    const { expiresAtMs } = creds;
+    if (!expiresAtMs) {
+        // No expiry set (managed keys) - valid if token is present
+        return Boolean(creds.accessToken);
+    }
+    // 60-second buffer
+    return Date.now() < expiresAtMs - 60_000;
+}
+// -- Full interactive OAuth PKCE login flow --------------------------
+/**
+ * Run the full interactive OAuth PKCE login flow.
+ *
+ * 1. Generate PKCE verifier/challenge + OAuth state
+ * 2. Print the authorize URL for the user to open in a browser
+ * 3. Prompt for the authorization code (from the redirect URI fragment)
+ * 4. Validate CSRF state
+ * 5. Exchange the code for tokens
+ * 6. Persist credentials to ~/.aura/.anthropic_oauth.json
+ *
+ * @param options.onAuthUrl  Called with the URL so the caller can display it
+ *                           or open a browser. Defaults to console.log.
+ * @param options.onPrompt   Called to get user input. Defaults to a readline
+ *                           prompt on stdin.
+ * @returns The credentials on success, or null if the user cancelled.
+ */
+async function runOAuthLogin(options) {
+    const prompt = options?.onPrompt ?? defaultPrompt;
+    const showUrl = options?.onAuthUrl ?? ((url) => console.log(url));
+    const { verifier, challenge } = generatePkce();
+    const oauthState = crypto.randomBytes(32).toString('base64url');
+    const authUrl = buildAuthorizationUrl(challenge, oauthState);
+    showUrl(authUrl);
+    const authCode = await prompt('Authorization code: ');
+    if (!authCode) {
+        console.error('No code entered.');
+        return null;
+    }
+    // Parse code#state from the redirect fragment
+    const splits = authCode.split('#');
+    const code = splits[0];
+    const receivedState = splits.length > 1 ? splits[1] : '';
+    // Validate state to prevent CSRF (RFC 6749 section 10.12)
+    if (receivedState !== oauthState) {
+        console.error('OAuth state mismatch - possible CSRF, aborting.');
+        return null;
+    }
+    try {
+        const creds = await exchangeCodeForToken(code, verifier, receivedState);
+        await writeCredentials(creds);
+        return creds;
+    }
+    catch (err) {
+        console.error('Token exchange failed:', err instanceof Error ? err.message : String(err));
+        return null;
+    }
+}
+// -- Internal helpers ------------------------------------------------
+/**
+ * Default stdin prompt using Node.js readline.
+ */
+function defaultPrompt(message) {
+    const rl = (0, readline_1.createInterface)({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(message, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+//# sourceMappingURL=anthropic-oauth-draft.js.map

package/dist/providers/anthropic-oauth-draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-oauth-draft.js","sourceRoot":"","sources":["../../src/providers/anthropic-oauth-draft.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EH,oCAcC;AAUD,sDAaC;AAcD,oDA+DC;AAeD,8CA6DC;AAUD,0CAoBC;AAUD,4CA4CC;AAUD,oCAUC;AAoBD,sCAuCC;AA9aD,+CAAiC;AACjC,gDAAkC;AAClC,uCAAyB;AACzB,2CAA6B;AAC7B,uCAA2C;AAE3C,uEAAuE;AAEvE,sFAAsF;AACtF,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D;;;GAGG;AACH,MAAM,gBAAgB,GAAG;IACvB,4CAA4C;IAC5C,8CAA8C;CAC/C,CAAC;AAEF,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAE/E,yEAAyE;AACzE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAEtE,sFAAsF;AACtF,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,4DAA4D;AAC5D,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AAqC9C,uEAAuE;AAEvE;;;;;GAKG;AACH,SAAgB,YAAY;IAC1B,MAAM,QAAQ,GAAG,MAAM;SACpB,WAAW,CAAC,EAAE,CAAC;SACf,QAAQ,CAAC,WAAW,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtB,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,EAAE;SACR,QAAQ,CAAC,WAAW,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,uEAAuE;AAEvE;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,SAAiB,EAAE,KAAa;IACpE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,kBAAkB;QAChC,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,KAAK;KACN,CAAC,CAAC;IAEH,OAAO,qCAAqC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;GASG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,QAAgB,EAChB,KAAa;IAEb,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,eAAe;QAC1B,IAAI;QACJ,KAAK;QACL,YAAY,EAAE,kBAAkB;QAChC,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;IAEH,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,cAAc,4BAA4B,kBAAkB;KAC3E,CAAC;IAEF,IAAI,SAAkB,CAAC;IAEvB,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,KAAK,CACnB,4BAA4B,QAAQ,UAAU,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAE5D,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;YACxC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;YAElD,OAAO;gBACL,WAAW;gBACX,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;gBACxC,WAAW;gBACX,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,SAAS,YAAY,KAAK;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC1D,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CAAC,mBAA2B;IACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,mBAAmB;QAClC,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IAEH,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,cAAc,4BAA4B,kBAAkB;KAC3E,CAAC;IAEF,IAAI,SAAkB,CAAC;IAEvB,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,KAAK,CACnB,2BAA2B,QAAQ,UAAU,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACnF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAE5D,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;YACxC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,IAAI,mBAAmB,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;YAElD,OAAO;gBACL,WAAW;gBACX,YAAY,EAAE,WAAW;gBACzB,WAAW;gBACX,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,SAAS,YAAY,KAAK;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AACzD,CAAC;AAED,uEAAuE;AAEvE;;;;;GAKG;AACI,KAAK,UAAU,eAAe;IACnC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,IAAI,GAAsB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IAEpC,kDAAkD;IAClD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,MAAM,MAAM,GAAgD;QAC1D,GAAG,QAAQ;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;IAEF,uEAAuE;IACvE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAkB,CAAC;IAC9C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gCAAgC;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAuB;IAClD,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAE9B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,2DAA2D;QAC3D,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,mBAAmB;IACnB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC;AAC3C,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,aAAa,CAAC,OAGnC;IACC,MAAM,MAAM,GAAG,OAAO,EAAE,QAAQ,IAAI,aAAa,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,EAAE,SAAS,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE7D,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzD,0DAA0D;IAC1D,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE;;GAEG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAc,EAAE,EAAE;YACtC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/providers/anthropic.d.ts

@@ -1,3 +1,4 @@
+import Anthropic from '@anthropic-ai/sdk';
 import type { LLMProvider, ProviderConfig, ToolDefinition, HistoryMessage, LLMResponse, StreamChunk } from './types.js';
 export declare class AnthropicProvider implements LLMProvider {
     name: string;
@@ -5,7 +6,9 @@ export declare class AnthropicProvider implements LLMProvider {
     model: string;
     private client;
     private maxTokens;
-    constructor(config: ProviderConfig);
+    constructor(config: ProviderConfig, providerName?: string);
     complete(system: string, history: HistoryMessage[], tools: ToolDefinition[]): Promise<LLMResponse>;
     stream(system: string, history: HistoryMessage[], tools: ToolDefinition[]): AsyncGenerator<StreamChunk>;
 }
+export declare function toCachedSystem(system: string): Anthropic.TextBlockParam[];
+export declare function toCachedTools(tools: ToolDefinition[]): Anthropic.Tool[];