catui-agent 1.0.0-beta.0

package/dist/core/lib/ai/src/utils/json-parse.d.ts

@@ -0,0 +1,14 @@
+/**
+ * [WHO]: parseStreamingJson
+ * [FROM]: Depends on partial-json
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/json-parse.ts -
+ */
+/**
+ * Attempts to parse potentially incomplete JSON during streaming.
+ * Always returns a valid object, even if the JSON is incomplete.
+ *
+ * @param partialJson The partial JSON string from streaming
+ * @returns Parsed object or empty object if parsing fails
+ */
+export declare function parseStreamingJson<T = any>(partialJson: string | undefined): T;

package/dist/core/lib/ai/src/utils/json-parse.js

@@ -0,0 +1 @@
+var u=Object.defineProperty;var e=(r,t)=>u(r,"name",{value:t,configurable:!0});import{parse as c}from"partial-json";function a(r){if(!r||r.trim()==="")return{};try{return JSON.parse(r)}catch{try{return c(r)??{}}catch{return{}}}}e(a,"parseStreamingJson");export{a as parseStreamingJson};

package/dist/core/lib/ai/src/utils/oauth/anthropic.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Anthropic OAuth flow (Claude Pro/Max)
+ */
+/**
+ * [WHO]: anthropicOAuthProvider
+ * [FROM]: Depends on ./pkce.js
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/anthropic.ts -
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from "./types.js";
+/**
+ * Login with Anthropic OAuth (device code flow)
+ *
+ * @param onAuthUrl - Callback to handle the authorization URL (e.g., open browser)
+ * @param onPromptCode - Callback to prompt user for the authorization code
+ */
+export declare function loginAnthropic(onAuthUrl: (url: string) => void, onPromptCode: () => Promise<string>): Promise<OAuthCredentials>;
+/**
+ * Refresh Anthropic OAuth token
+ */
+export declare function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials>;
+export declare const anthropicOAuthProvider: OAuthProviderInterface;

package/dist/core/lib/ai/src/utils/oauth/anthropic.js

@@ -0,0 +1 @@
+var g=Object.defineProperty;var r=(e,t)=>g(e,"name",{value:t,configurable:!0});import{generatePKCE as y}from"./pkce.js";const w=r(e=>atob(e),"decode"),c=w("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl"),x="https://claude.ai/oauth/authorize",h="https://console.anthropic.com/v1/oauth/token",p="https://console.anthropic.com/oauth/code/callback",T="org:create_api_key user:profile user:inference";async function m(e,t){const{verifier:o,challenge:n}=await y(),d=new URLSearchParams({code:"true",client_id:c,response_type:"code",redirect_uri:p,scope:T,code_challenge:n,code_challenge_method:"S256",state:o}),_=`${x}?${d.toString()}`;e(_);const i=(await t()).split("#"),u=i[0],f=i[1],s=await fetch(h,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({grant_type:"authorization_code",client_id:c,code:u,state:f,redirect_uri:p,code_verifier:o})});if(!s.ok){const k=await s.text();throw new Error(`Token exchange failed: ${k}`)}const a=await s.json(),l=Date.now()+a.expires_in*1e3-300*1e3;return{refresh:a.refresh_token,access:a.access_token,expires:l}}r(m,"loginAnthropic");async function E(e){const t=await fetch(h,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({grant_type:"refresh_token",client_id:c,refresh_token:e})});if(!t.ok){const n=await t.text();throw new Error(`Anthropic token refresh failed: ${n}`)}const o=await t.json();return{refresh:o.refresh_token,access:o.access_token,expires:Date.now()+o.expires_in*1e3-300*1e3}}r(E,"refreshAnthropicToken");const C={id:"anthropic",name:"Anthropic (Claude Pro/Max)",async login(e){return m(t=>e.onAuth({url:t}),()=>e.onPrompt({message:"Paste the authorization code:"}))},async refreshToken(e){return E(e.refresh)},getApiKey(e){return e.access}};export{C as anthropicOAuthProvider,m as loginAnthropic,E as refreshAnthropicToken};

package/dist/core/lib/ai/src/utils/oauth/decode-credential.d.ts

@@ -0,0 +1,12 @@
+/**
+ * [WHO]: decodeOAuthCredentialSegment
+ * [FROM]: No dependencies
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/decode-credential.ts — build-time OAuth id/secret embedding
+ */
+/**
+ * Decode base64-embedded OAuth client id or secret at module load.
+ * Unreplaced placeholders (e.g. YOUR_CLIENT_ID_HERE) are not valid base64 and must never be passed to
+ * `atob` — Node throws InvalidCharacterError and crashes any CLI that imports the OAuth module (e.g. --help).
+ */
+export declare function decodeOAuthCredentialSegment(s: string): string;

package/dist/core/lib/ai/src/utils/oauth/decode-credential.js

@@ -0,0 +1 @@
+var n=Object.defineProperty;var r=(e,t)=>n(e,"name",{value:t,configurable:!0});function u(e){const t=e.trim();if(t.length===0||/YOUR_|PLACEHOLDER|REPLACE_ME/i.test(t))return t;try{return atob(t)}catch{return t}}r(u,"decodeOAuthCredentialSegment");export{u as decodeOAuthCredentialSegment};

package/dist/core/lib/ai/src/utils/oauth/github-copilot.d.ts

@@ -0,0 +1,35 @@
+/**
+ * GitHub Copilot OAuth flow
+ */
+/**
+ * [WHO]: normalizeDomain, getGitHubCopilotBaseUrl, githubCopilotOAuthProvider
+ * [FROM]: Depends on ../../models.js
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/github-copilot.ts -
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from "./types.js";
+export declare function normalizeDomain(input: string): string | null;
+export declare function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string;
+/**
+ * Refresh GitHub Copilot token
+ */
+export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string): Promise<OAuthCredentials>;
+/**
+ * Login with GitHub Copilot OAuth (device code flow)
+ *
+ * @param options.onAuth - Callback with URL and optional instructions (user code)
+ * @param options.onPrompt - Callback to prompt user for input
+ * @param options.onProgress - Optional progress callback
+ * @param options.signal - Optional AbortSignal for cancellation
+ */
+export declare function loginGitHubCopilot(options: {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+}): Promise<OAuthCredentials>;
+export declare const githubCopilotOAuthProvider: OAuthProviderInterface;

package/dist/core/lib/ai/src/utils/oauth/github-copilot.js

@@ -0,0 +1 @@
+var b=Object.defineProperty;var s=(e,t)=>b(e,"name",{value:t,configurable:!0});import{getModels as v}from"../../models.js";const _=s(e=>atob(e),"decode"),h=_("SXYxLmI1MDdhMDhjODdlY2ZlOTg="),w={"User-Agent":"GitHubCopilotChat/0.35.0","Editor-Version":"vscode/1.107.0","Editor-Plugin-Version":"copilot-chat/0.35.0","Copilot-Integration-Id":"vscode-chat"};function m(e){const t=e.trim();if(!t)return null;try{return(t.includes("://")?new URL(t):new URL(`https://${t}`)).hostname}catch{return null}}s(m,"normalizeDomain");function d(e){return{deviceCodeUrl:`https://${e}/login/device/code`,accessTokenUrl:`https://${e}/login/oauth/access_token`,copilotTokenUrl:`https://api.${e}/copilot_internal/v2/token`}}s(d,"getUrls");function C(e){const t=e.match(/proxy-ep=([^;]+)/);return t?`https://${t[1].replace(/^proxy\./,"api.")}`:null}s(C,"getBaseUrlFromToken");function y(e,t){if(e){const o=C(e);if(o)return o}return t?`https://copilot-api.${t}`:"https://api.individual.githubcopilot.com"}s(y,"getGitHubCopilotBaseUrl");async function u(e,t){const o=await fetch(e,t);if(!o.ok){const r=await o.text();throw new Error(`${o.status} ${o.statusText}: ${r}`)}return o.json()}s(u,"fetchJson");async function U(e){const t=d(e),o=await u(t.deviceCodeUrl,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json","User-Agent":"GitHubCopilotChat/0.35.0"},body:JSON.stringify({client_id:h,scope:"read:user"})});if(!o||typeof o!="object")throw new Error("Invalid device code response");const r=o.device_code,n=o.user_code,i=o.verification_uri,a=o.interval,c=o.expires_in;if(typeof r!="string"||typeof n!="string"||typeof i!="string"||typeof a!="number"||typeof c!="number")throw new Error("Invalid device code response fields");return{device_code:r,user_code:n,verification_uri:i,interval:a,expires_in:c}}s(U,"startDeviceFlow");function f(e,t){return new Promise((o,r)=>{if(t?.aborted){r(new Error("Login cancelled"));return}const n=setTimeout(o,e);t?.addEventListener("abort",()=>{clearTimeout(n),r(new Error("Login cancelled"))},{once:!0})})}s(f,"abortableSleep");async function E(e,t,o,r,n){const i=d(e),a=Date.now()+r*1e3;let c=Math.max(1e3,Math.floor(o*1e3));for(;Date.now()<a;){if(n?.aborted)throw new Error("Login cancelled");const l=await u(i.accessTokenUrl,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json","User-Agent":"GitHubCopilotChat/0.35.0"},body:JSON.stringify({client_id:h,device_code:t,grant_type:"urn:ietf:params:oauth:grant-type:device_code"})});if(l&&typeof l=="object"&&typeof l.access_token=="string")return l.access_token;if(l&&typeof l=="object"&&typeof l.error=="string"){const p=l.error;if(p==="authorization_pending"){await f(c,n);continue}if(p==="slow_down"){c+=5e3,await f(c,n);continue}throw new Error(`Device flow failed: ${p}`)}await f(c,n)}throw new Error("Device flow timed out")}s(E,"pollForGitHubAccessToken");async function g(e,t){const r=d(t||"github.com"),n=await u(r.copilotTokenUrl,{headers:{Accept:"application/json",Authorization:`Bearer ${e}`,...w}});if(!n||typeof n!="object")throw new Error("Invalid Copilot token response");const i=n.token,a=n.expires_at;if(typeof i!="string"||typeof a!="number")throw new Error("Invalid Copilot token response fields");return{refresh:e,access:i,expires:a*1e3-300*1e3,enterpriseUrl:t}}s(g,"refreshGitHubCopilotToken");async function x(e,t,o){const n=`${y(e,o)}/models/${t}/policy`;try{return(await fetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`,...w,"openai-intent":"chat-policy","x-interaction-type":"chat-policy"},body:JSON.stringify({state:"enabled"})})).ok}catch{return!1}}s(x,"enableGitHubCopilotModel");async function T(e,t,o){const r=v("github-copilot");await Promise.all(r.map(async n=>{const i=await x(e,n.id,t);o?.(n.id,i)}))}s(T,"enableAllGitHubCopilotModels");async function A(e){const t=await e.onPrompt({message:"GitHub Enterprise URL/domain (blank for github.com)",placeholder:"company.ghe.com",allowEmpty:!0});if(e.signal?.aborted)throw new Error("Login cancelled");const o=t.trim(),r=m(t);if(o&&!r)throw new Error("Invalid GitHub Enterprise URL/domain");const n=r||"github.com",i=await U(n);e.onAuth(i.verification_uri,`Enter code: ${i.user_code}`);const a=await E(n,i.device_code,i.interval,i.expires_in,e.signal),c=await g(a,r??void 0);return e.onProgress?.("Enabling models..."),await T(c.access,r??void 0),c}s(A,"loginGitHubCopilot");const $={id:"github-copilot",name:"GitHub Copilot",async login(e){return A({onAuth:s((t,o)=>e.onAuth({url:t,instructions:o}),"onAuth"),onPrompt:e.onPrompt,onProgress:e.onProgress,signal:e.signal})},async refreshToken(e){const t=e;return g(t.refresh,t.enterpriseUrl)},getApiKey(e){return e.access},modifyModels(e,t){const o=t,r=o.enterpriseUrl?m(o.enterpriseUrl)??void 0:void 0,n=y(o.access,r);return e.map(i=>i.provider==="github-copilot"?{...i,baseUrl:n}:i)}};export{y as getGitHubCopilotBaseUrl,$ as githubCopilotOAuthProvider,A as loginGitHubCopilot,m as normalizeDomain,g as refreshGitHubCopilotToken};

package/dist/core/lib/ai/src/utils/oauth/google-antigravity.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
+ * Uses different OAuth credentials than google-gemini-cli for access to additional models.
+ *
+ * NOTE: This module uses Node.js http.createServer for the OAuth callback.
+ * It is only intended for CLI use, not browser environments.
+ */
+/**
+ * [WHO]: antigravityOAuthProvider
+ * [FROM]: Depends on ./pkce.js
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/google-antigravity.ts -
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from "./types.js";
+/**
+ * Refresh Antigravity token
+ */
+export declare function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;
+/**
+ * Login with Antigravity OAuth
+ *
+ * @param onAuth - Callback with URL and optional instructions
+ * @param onProgress - Optional progress callback
+ * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.
+ *                            Races with browser callback - whichever completes first wins.
+ */
+export declare function loginAntigravity(onAuth: (info: {
+    url: string;
+    instructions?: string;
+}) => void, onProgress?: (message: string) => void, onManualCodeInput?: () => Promise<string>): Promise<OAuthCredentials>;
+export declare const antigravityOAuthProvider: OAuthProviderInterface;

package/dist/core/lib/ai/src/utils/oauth/google-antigravity.js

@@ -0,0 +1 @@
+var T=Object.defineProperty;var l=(t,e)=>T(t,"name",{value:e,configurable:!0});import{decodeOAuthCredentialSegment as _}from"./decode-credential.js";import{generatePKCE as j}from"./pkce.js";let w=null,y=null;typeof process<"u"&&(process.versions?.node||process.versions?.bun)&&(y=import("node:http").then(t=>{w=t.createServer}));const E=_("YOUR_CLIENT_ID_HERE"),C=_("YOUR_CLIENT_SECRET_HERE"),S="http://localhost:51121/oauth-callback",R=["https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/userinfo.email","https://www.googleapis.com/auth/userinfo.profile","https://www.googleapis.com/auth/cclog","https://www.googleapis.com/auth/experimentsandconfigs"],O="https://accounts.google.com/o/oauth2/v2/auth",v="https://oauth2.googleapis.com/token",b="rising-fact-p41fc";async function U(){if(w||(y&&await y,w))return w;throw new Error("Antigravity OAuth is only available in Node.js environments")}l(U,"getNodeCreateServer");async function x(){const t=await U();return new Promise((e,n)=>{let r=null,h=!1;const i=t((o,c)=>{const p=new URL(o.url||"","http://localhost:51121");if(p.pathname==="/oauth-callback"){const u=p.searchParams.get("code"),d=p.searchParams.get("state"),m=p.searchParams.get("error");if(m){c.writeHead(400,{"Content-Type":"text/html"}),c.end(`<html><body><h1>Authentication Failed</h1><p>Error: ${m}</p><p>You can close this window.</p></body></html>`);return}u&&d?(c.writeHead(200,{"Content-Type":"text/html"}),c.end("<html><body><h1>Authentication Successful</h1><p>You can close this window and return to the terminal.</p></body></html>"),r={code:u,state:d}):(c.writeHead(400,{"Content-Type":"text/html"}),c.end("<html><body><h1>Authentication Failed</h1><p>Missing code or state parameter.</p></body></html>"))}else c.writeHead(404),c.end()});i.on("error",o=>{n(o)}),i.listen(51121,"127.0.0.1",()=>{e({server:i,cancelWait:l(()=>{h=!0},"cancelWait"),waitForCode:l(async()=>{const o=l(()=>new Promise(c=>setTimeout(c,100)),"sleep");for(;!r&&!h;)await o();return r},"waitForCode")})})})}l(x,"startCallbackServer");function k(t){const e=t.trim();if(!e)return{};try{const n=new URL(e);return{code:n.searchParams.get("code")??void 0,state:n.searchParams.get("state")??void 0}}catch{return{}}}l(k,"parseRedirectUrl");async function N(t,e){const n={Authorization:`Bearer ${t}`,"Content-Type":"application/json","User-Agent":"google-api-nodejs-client/9.15.1","X-Goog-Api-Client":"google-cloud-sdk vscode_cloudshelleditor/0.1","Client-Metadata":JSON.stringify({ideType:"IDE_UNSPECIFIED",platform:"PLATFORM_UNSPECIFIED",pluginType:"GEMINI"})},r=["https://cloudcode-pa.googleapis.com","https://daily-cloudcode-pa.sandbox.googleapis.com"];e?.("Checking for existing project...");for(const h of r)try{const i=await fetch(`${h}/v1internal:loadCodeAssist`,{method:"POST",headers:n,body:JSON.stringify({metadata:{ideType:"IDE_UNSPECIFIED",platform:"PLATFORM_UNSPECIFIED",pluginType:"GEMINI"}})});if(i.ok){const o=await i.json();if(typeof o.cloudaicompanionProject=="string"&&o.cloudaicompanionProject)return o.cloudaicompanionProject;if(o.cloudaicompanionProject&&typeof o.cloudaicompanionProject=="object"&&o.cloudaicompanionProject.id)return o.cloudaicompanionProject.id}}catch{}return e?.("Using default project..."),b}l(N,"discoverProject");async function F(t){try{const e=await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json",{headers:{Authorization:`Bearer ${t}`}});if(e.ok)return(await e.json()).email}catch{}}l(F,"getUserEmail");async function D(t,e){const n=await fetch(v,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:E,client_secret:C,refresh_token:t,grant_type:"refresh_token"})});if(!n.ok){const h=await n.text();throw new Error(`Antigravity token refresh failed: ${h}`)}const r=await n.json();return{refresh:r.refresh_token||t,access:r.access_token,expires:Date.now()+r.expires_in*1e3-300*1e3,projectId:e}}l(D,"refreshAntigravityToken");async function L(t,e,n){const{verifier:r,challenge:h}=await j();e?.("Starting local server for OAuth callback...");const i=await x();let o;try{const c=new URLSearchParams({client_id:E,response_type:"code",redirect_uri:S,scope:R.join(" "),code_challenge:h,code_challenge_method:"S256",state:r,access_type:"offline",prompt:"consent"}),p=`${O}?${c.toString()}`;if(t({url:p,instructions:"Complete the sign-in in your browser."}),e?.("Waiting for OAuth callback..."),n){let s,f;const A=n().then(a=>{s=a,i.cancelWait()}).catch(a=>{f=a instanceof Error?a:new Error(String(a)),i.cancelWait()}),g=await i.waitForCode();if(f)throw f;if(g?.code){if(g.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");o=g.code}else if(s){const a=k(s);if(a.state&&a.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");o=a.code}if(!o){if(await A,f)throw f;if(s){const a=k(s);if(a.state&&a.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");o=a.code}}}else{const s=await i.waitForCode();if(s?.code){if(s.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");o=s.code}}if(!o)throw new Error("No authorization code received");e?.("Exchanging authorization code for tokens...");const u=await fetch(v,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:E,client_secret:C,code:o,grant_type:"authorization_code",redirect_uri:S,code_verifier:r})});if(!u.ok){const s=await u.text();throw new Error(`Token exchange failed: ${s}`)}const d=await u.json();if(!d.refresh_token)throw new Error("No refresh token received. Please try again.");e?.("Getting user info...");const m=await F(d.access_token),P=await N(d.access_token,e),I=Date.now()+d.expires_in*1e3-300*1e3;return{refresh:d.refresh_token,access:d.access_token,expires:I,projectId:P,email:m}}finally{i.server.close()}}l(L,"loginAntigravity");const z={id:"google-antigravity",name:"Antigravity (Gemini 3, Claude, GPT-OSS)",usesCallbackServer:!0,async login(t){return L(t.onAuth,t.onProgress,t.onManualCodeInput)},async refreshToken(t){const e=t;if(!e.projectId)throw new Error("Antigravity credentials missing projectId");return D(e.refresh,e.projectId)},getApiKey(t){const e=t;return JSON.stringify({token:e.access,projectId:e.projectId})}};export{z as antigravityOAuthProvider,L as loginAntigravity,D as refreshAntigravityToken};

package/dist/core/lib/ai/src/utils/oauth/google-gemini-cli.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Gemini CLI OAuth flow (Google Cloud Code Assist)
+ * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)
+ *
+ * NOTE: This module uses Node.js http.createServer for the OAuth callback.
+ * It is only intended for CLI use, not browser environments.
+ */
+/**
+ * [WHO]: geminiCliOAuthProvider
+ * [FROM]: Depends on ./pkce.js
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/google-gemini-cli.ts -
+ */
+import type { OAuthCredentials, OAuthProviderInterface } from "./types.js";
+/**
+ * Refresh Google Cloud Code Assist token
+ */
+export declare function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;
+/**
+ * Login with Gemini CLI (Google Cloud Code Assist) OAuth
+ *
+ * @param onAuth - Callback with URL and optional instructions
+ * @param onProgress - Optional progress callback
+ * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.
+ *                            Races with browser callback - whichever completes first wins.
+ */
+export declare function loginGeminiCli(onAuth: (info: {
+    url: string;
+    instructions?: string;
+}) => void, onProgress?: (message: string) => void, onManualCodeInput?: () => Promise<string>): Promise<OAuthCredentials>;
+export declare const geminiCliOAuthProvider: OAuthProviderInterface;

package/dist/core/lib/ai/src/utils/oauth/google-gemini-cli.js

@@ -0,0 +1 @@
+var L=Object.defineProperty;var c=(e,t)=>L(e,"name",{value:t,configurable:!0});import{decodeOAuthCredentialSegment as I}from"./decode-credential.js";import{generatePKCE as j}from"./pkce.js";let g=null,C=null;typeof process<"u"&&(process.versions?.node||process.versions?.bun)&&(C=import("node:http").then(e=>{g=e.createServer}));const O=I("YOUR_CLIENT_ID_HERE"),P=I("YOUR_CLIENT_SECRET_HERE"),S="http://localhost:8085/oauth2callback",D=["https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/userinfo.email","https://www.googleapis.com/auth/userinfo.profile"],U="https://accounts.google.com/o/oauth2/v2/auth",R="https://oauth2.googleapis.com/token",T="https://cloudcode-pa.googleapis.com";async function G(){if(g||(C&&await C,g))return g;throw new Error("Gemini CLI OAuth is only available in Node.js environments")}c(G,"getNodeCreateServer");async function b(){const e=await G();return new Promise((t,o)=>{let r=null,a=!1;const n=e((l,i)=>{const p=new URL(l.url||"","http://localhost:8085");if(p.pathname==="/oauth2callback"){const u=p.searchParams.get("code"),s=p.searchParams.get("state"),f=p.searchParams.get("error");if(f){i.writeHead(400,{"Content-Type":"text/html"}),i.end(`<html><body><h1>Authentication Failed</h1><p>Error: ${f}</p><p>You can close this window.</p></body></html>`);return}u&&s?(i.writeHead(200,{"Content-Type":"text/html"}),i.end("<html><body><h1>Authentication Successful</h1><p>You can close this window and return to the terminal.</p></body></html>"),r={code:u,state:s}):(i.writeHead(400,{"Content-Type":"text/html"}),i.end("<html><body><h1>Authentication Failed</h1><p>Missing code or state parameter.</p></body></html>"))}else i.writeHead(404),i.end()});n.on("error",l=>{o(l)}),n.listen(8085,"127.0.0.1",()=>{t({server:n,cancelWait:c(()=>{a=!0},"cancelWait"),waitForCode:c(async()=>{const l=c(()=>new Promise(i=>setTimeout(i,100)),"sleep");for(;!r&&!a;)await l();return r},"waitForCode")})})})}c(b,"startCallbackServer");function v(e){const t=e.trim();if(!t)return{};try{const o=new URL(t);return{code:o.searchParams.get("code")??void 0,state:o.searchParams.get("state")??void 0}}catch{return{}}}c(v,"parseRedirectUrl");const y="free-tier",k="legacy-tier",x="standard-tier";function N(e){return new Promise(t=>setTimeout(t,e))}c(N,"wait");function $(e){return!e||e.length===0?{id:k}:e.find(o=>o.isDefault)??{id:k}}c($,"getDefaultTier");function F(e){if(!e||typeof e!="object"||!("error"in e))return!1;const t=e.error;return!t?.details||!Array.isArray(t.details)?!1:t.details.some(o=>o.reason==="SECURITY_POLICY_VIOLATED")}c(F,"isVpcScAffectedUser");async function J(e,t,o){let r=0;for(;;){r>0&&(o?.(`Waiting for project provisioning (attempt ${r+1})...`),await N(5e3));const a=await fetch(`${T}/v1internal/${e}`,{method:"GET",headers:t});if(!a.ok)throw new Error(`Failed to poll operation: ${a.status} ${a.statusText}`);const n=await a.json();if(n.done)return n;r+=1}}c(J,"pollOperation");async function H(e,t){const o=process.env.GOOGLE_CLOUD_PROJECT||process.env.GOOGLE_CLOUD_PROJECT_ID,r={Authorization:`Bearer ${e}`,"Content-Type":"application/json","User-Agent":"google-api-nodejs-client/9.15.1","X-Goog-Api-Client":"gl-node/22.17.0"};t?.("Checking for existing Cloud Code Assist project...");const a=await fetch(`${T}/v1internal:loadCodeAssist`,{method:"POST",headers:r,body:JSON.stringify({cloudaicompanionProject:o,metadata:{ideType:"IDE_UNSPECIFIED",platform:"PLATFORM_UNSPECIFIED",pluginType:"GEMINI",duetProject:o}})});let n;if(a.ok)n=await a.json();else{let w;try{w=await a.clone().json()}catch{w=void 0}if(F(w))n={currentTier:{id:x}};else{const E=await a.text();throw new Error(`loadCodeAssist failed: ${a.status} ${a.statusText}: ${E}`)}}if(n.currentTier){if(n.cloudaicompanionProject)return n.cloudaicompanionProject;if(o)return o;throw new Error("This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. See https://goo.gle/gemini-cli-auth-docs#workspace-gca")}const i=$(n.allowedTiers)?.id??y;if(i!==y&&!o)throw new Error("This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. See https://goo.gle/gemini-cli-auth-docs#workspace-gca");t?.("Provisioning Cloud Code Assist project (this may take a moment)...");const p={tierId:i,metadata:{ideType:"IDE_UNSPECIFIED",platform:"PLATFORM_UNSPECIFIED",pluginType:"GEMINI"}};i!==y&&o&&(p.cloudaicompanionProject=o,p.metadata.duetProject=o);const u=await fetch(`${T}/v1internal:onboardUser`,{method:"POST",headers:r,body:JSON.stringify(p)});if(!u.ok){const w=await u.text();throw new Error(`onboardUser failed: ${u.status} ${u.statusText}: ${w}`)}let s=await u.json();!s.done&&s.name&&(s=await J(s.name,r,t));const f=s.response?.cloudaicompanionProject?.id;if(f)return f;if(o)return o;throw new Error("Could not discover or provision a Google Cloud project. Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. See https://goo.gle/gemini-cli-auth-docs#workspace-gca")}c(H,"discoverProject");async function Y(e){try{const t=await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json",{headers:{Authorization:`Bearer ${e}`}});if(t.ok)return(await t.json()).email}catch{}}c(Y,"getUserEmail");async function z(e,t){const o=await fetch(R,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:O,client_secret:P,refresh_token:e,grant_type:"refresh_token"})});if(!o.ok){const a=await o.text();throw new Error(`Google Cloud token refresh failed: ${a}`)}const r=await o.json();return{refresh:r.refresh_token||e,access:r.access_token,expires:Date.now()+r.expires_in*1e3-300*1e3,projectId:t}}c(z,"refreshGoogleCloudToken");async function M(e,t,o){const{verifier:r,challenge:a}=await j();t?.("Starting local server for OAuth callback...");const n=await b();let l;try{const i=new URLSearchParams({client_id:O,response_type:"code",redirect_uri:S,scope:D.join(" "),code_challenge:a,code_challenge_method:"S256",state:r,access_type:"offline",prompt:"consent"}),p=`${U}?${i.toString()}`;if(e({url:p,instructions:"Complete the sign-in in your browser."}),t?.("Waiting for OAuth callback..."),o){let h,m;const A=o().then(d=>{h=d,n.cancelWait()}).catch(d=>{m=d instanceof Error?d:new Error(String(d)),n.cancelWait()}),_=await n.waitForCode();if(m)throw m;if(_?.code){if(_.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");l=_.code}else if(h){const d=v(h);if(d.state&&d.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");l=d.code}if(!l){if(await A,m)throw m;if(h){const d=v(h);if(d.state&&d.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");l=d.code}}}else{const h=await n.waitForCode();if(h?.code){if(h.state!==r)throw new Error("OAuth state mismatch - possible CSRF attack");l=h.code}}if(!l)throw new Error("No authorization code received");t?.("Exchanging authorization code for tokens...");const u=await fetch(R,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:O,client_secret:P,code:l,grant_type:"authorization_code",redirect_uri:S,code_verifier:r})});if(!u.ok){const h=await u.text();throw new Error(`Token exchange failed: ${h}`)}const s=await u.json();if(!s.refresh_token)throw new Error("No refresh token received. Please try again.");t?.("Getting user info...");const f=await Y(s.access_token),w=await H(s.access_token,t),E=Date.now()+s.expires_in*1e3-300*1e3;return{refresh:s.refresh_token,access:s.access_token,expires:E,projectId:w,email:f}}finally{n.server.close()}}c(M,"loginGeminiCli");const V={id:"google-gemini-cli",name:"Google Cloud Code Assist (Gemini CLI)",usesCallbackServer:!0,async login(e){return M(e.onAuth,e.onProgress,e.onManualCodeInput)},async refreshToken(e){const t=e;if(!t.projectId)throw new Error("Google Cloud credentials missing projectId");return z(t.refresh,t.projectId)},getApiKey(e){const t=e;return JSON.stringify({token:t.access,projectId:t.projectId})}};export{V as geminiCliOAuthProvider,M as loginGeminiCli,z as refreshGoogleCloudToken};

package/dist/core/lib/ai/src/utils/oauth/index.d.ts

@@ -0,0 +1,60 @@
+/**
+ * [WHO]: OAuth credential management - loginAnthropic, refreshAnthropicToken, loginGitHubCopilot, loginGoogleGeminiCli, loginOpenAICodex
+ * [FROM]: Depends on ./anthropic, ./github-copilot, ./google-antigravity, ./google-gemini-cli, ./openai-codex, ../http-proxy
+ * [TO]: Consumed by core/lib/ai/src/index.ts, AI providers
+ * [HERE]: core/lib/ai/src/utils/oauth/index.ts - OAuth credential management for AI providers
+ *
+ * Handles login, token refresh, and credential storage for:
+ * Anthropic, GitHub Copilot, Google Cloud Code Assist, Antigravity
+ */
+import "../http-proxy.js";
+export { anthropicOAuthProvider, loginAnthropic, refreshAnthropicToken } from "./anthropic.js";
+export { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken, } from "./github-copilot.js";
+export { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-antigravity.js";
+export { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-gemini-cli.js";
+export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
+export * from "./types.js";
+import type { OAuthCredentials, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types.js";
+/**
+ * Get an OAuth provider by ID
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Register a custom OAuth provider
+ */
+export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
+/**
+ * Unregister an OAuth provider.
+ *
+ * If the provider is built-in, restores the built-in implementation.
+ * Custom providers are removed completely.
+ */
+export declare function unregisterOAuthProvider(id: string): void;
+/**
+ * Reset OAuth providers to built-ins.
+ */
+export declare function resetOAuthProviders(): void;
+/**
+ * Get all registered OAuth providers
+ */
+export declare function getOAuthProviders(): OAuthProviderInterface[];
+/**
+ * @deprecated Use getOAuthProviders() which returns OAuthProviderInterface[]
+ */
+export declare function getOAuthProviderInfoList(): OAuthProviderInfo[];
+/**
+ * Refresh token for any OAuth provider.
+ * @deprecated Use getOAuthProvider(id).refreshToken() instead
+ */
+export declare function refreshOAuthToken(providerId: OAuthProviderId, credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/**
+ * Get API key for a provider from OAuth credentials.
+ * Automatically refreshes expired tokens.
+ *
+ * @returns API key string and updated credentials, or null if no credentials
+ * @throws Error if refresh fails
+ */
+export declare function getOAuthApiKey(providerId: OAuthProviderId, credentials: Record<string, OAuthCredentials>): Promise<{
+    newCredentials: OAuthCredentials;
+    apiKey: string;
+} | null>;

package/dist/core/lib/ai/src/utils/oauth/index.js

@@ -0,0 +1 @@
+var p=Object.defineProperty;var e=(r,o)=>p(r,"name",{value:o,configurable:!0});import"../http-proxy.js";import{anthropicOAuthProvider as _,loginAnthropic as D,refreshAnthropicToken as I}from"./anthropic.js";import{getGitHubCopilotBaseUrl as R,githubCopilotOAuthProvider as $,loginGitHubCopilot as B,normalizeDomain as L,refreshGitHubCopilotToken as z}from"./github-copilot.js";import{antigravityOAuthProvider as M,loginAntigravity as N,refreshAntigravityToken as S}from"./google-antigravity.js";import{geminiCliOAuthProvider as j,loginGeminiCli as q,refreshGoogleCloudToken as J}from"./google-gemini-cli.js";import{loginOpenAICodex as W,openaiCodexOAuthProvider as X,refreshOpenAICodexToken as Y}from"./openai-codex.js";export*from"./types.js";import{anthropicOAuthProvider as a}from"./anthropic.js";import{githubCopilotOAuthProvider as s}from"./github-copilot.js";import{antigravityOAuthProvider as A}from"./google-antigravity.js";import{geminiCliOAuthProvider as l}from"./google-gemini-cli.js";import{openaiCodexOAuthProvider as d}from"./openai-codex.js";const u=[a,s,l,A,d],i=new Map(u.map(r=>[r.id,r]));function h(r){return i.get(r)}e(h,"getOAuthProvider");function y(r){i.set(r.id,r)}e(y,"registerOAuthProvider");function k(r){const o=u.find(t=>t.id===r);if(o){i.set(r,o);return}i.delete(r)}e(k,"unregisterOAuthProvider");function T(){i.clear();for(const r of u)i.set(r.id,r)}e(T,"resetOAuthProviders");function m(){return Array.from(i.values())}e(m,"getOAuthProviders");function b(){return m().map(r=>({id:r.id,name:r.name,available:!0}))}e(b,"getOAuthProviderInfoList");async function G(r,o){const t=h(r);if(!t)throw new Error(`Unknown OAuth provider: ${r}`);return t.refreshToken(o)}e(G,"refreshOAuthToken");async function U(r,o){const t=h(r);if(!t)throw new Error(`Unknown OAuth provider: ${r}`);let n=o[r];if(!n)return null;if(Date.now()>=n.expires)try{n=await t.refreshToken(n)}catch{throw new Error(`Failed to refresh OAuth token for ${r}`)}const f=t.getApiKey(n);return{newCredentials:n,apiKey:f}}e(U,"getOAuthApiKey");export{_ as anthropicOAuthProvider,M as antigravityOAuthProvider,j as geminiCliOAuthProvider,R as getGitHubCopilotBaseUrl,U as getOAuthApiKey,h as getOAuthProvider,b as getOAuthProviderInfoList,m as getOAuthProviders,$ as githubCopilotOAuthProvider,D as loginAnthropic,N as loginAntigravity,q as loginGeminiCli,B as loginGitHubCopilot,W as loginOpenAICodex,L as normalizeDomain,X as openaiCodexOAuthProvider,I as refreshAnthropicToken,S as refreshAntigravityToken,z as refreshGitHubCopilotToken,J as refreshGoogleCloudToken,G as refreshOAuthToken,Y as refreshOpenAICodexToken,y as registerOAuthProvider,T as resetOAuthProviders,k as unregisterOAuthProvider};

package/dist/core/lib/ai/src/utils/oauth/openai-codex.d.ts

@@ -0,0 +1,39 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow
+ *
+ * NOTE: This module uses Node.js crypto and http for the OAuth callback.
+ * It is only intended for CLI use, not browser environments.
+ */
+/**
+ * [WHO]: openaiCodexOAuthProvider
+ * [FROM]: Depends on ./pkce.js
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/openai-codex.ts -
+ */
+import type { OAuthCredentials, OAuthPrompt, OAuthProviderInterface } from "./types.js";
+/**
+ * Login with OpenAI Codex OAuth
+ *
+ * @param options.onAuth - Called with URL and instructions when auth starts
+ * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)
+ * @param options.onProgress - Optional progress messages
+ * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.
+ *                                    Races with browser callback - whichever completes first wins.
+ *                                    Useful for showing paste input immediately alongside browser flow.
+ * @param options.originator - OAuth originator parameter (defaults to "catui")
+ */
+export declare function loginOpenAICodex(options: {
+    onAuth: (info: {
+        url: string;
+        instructions?: string;
+    }) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    originator?: string;
+}): Promise<OAuthCredentials>;
+/**
+ * Refresh OpenAI Codex OAuth token
+ */
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;
+export declare const openaiCodexOAuthProvider: OAuthProviderInterface;

package/dist/core/lib/ai/src/utils/oauth/openai-codex.js

@@ -0,0 +1,11 @@
+var C=Object.defineProperty;var s=(e,t)=>C(e,"name",{value:t,configurable:!0});let h=null,f=null;typeof process<"u"&&(process.versions?.node||process.versions?.bun)&&(import("node:crypto").then(e=>{h=e.randomBytes}),import("node:http").then(e=>{f=e}));import{generatePKCE as P}from"./pkce.js";const p="app_EMoamEEZ73f0CkXaXp7hrann",k="https://auth.openai.com/oauth/authorize",y="https://auth.openai.com/oauth/token",_="http://localhost:1455/auth/callback",A="openid profile email offline_access",E="https://api.openai.com/auth",I=`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Authentication successful</title>
+</head>
+<body>
+  <p>Authentication successful. Return to your terminal to continue.</p>
+</body>
+</html>`;function S(){if(!h)throw new Error("OpenAI Codex OAuth is only available in Node.js environments");return h(16).toString("hex")}s(S,"createState");function m(e){const t=e.trim();if(!t)return{};try{const o=new URL(t);return{code:o.searchParams.get("code")??void 0,state:o.searchParams.get("state")??void 0}}catch{}if(t.includes("#")){const[o,a]=t.split("#",2);return{code:o,state:a}}if(t.includes("code=")){const o=new URLSearchParams(t);return{code:o.get("code")??void 0,state:o.get("state")??void 0}}return{code:t}}s(m,"parseAuthorizationInput");function T(e){try{const t=e.split(".");if(t.length!==3)return null;const o=t[1]??"",a=atob(o);return JSON.parse(a)}catch{return null}}s(T,"decodeJwt");async function v(e,t,o=_){const a=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",client_id:p,code:e,code_verifier:t,redirect_uri:o})});if(!a.ok){const n=await a.text().catch(()=>"");return console.error("[openai-codex] code->token failed:",a.status,n),{type:"failed"}}const r=await a.json();return!r.access_token||!r.refresh_token||typeof r.expires_in!="number"?(console.error("[openai-codex] token response missing fields:",r),{type:"failed"}):{type:"success",access:r.access_token,refresh:r.refresh_token,expires:Date.now()+r.expires_in*1e3}}s(v,"exchangeAuthorizationCode");async function O(e){try{const t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:p})});if(!t.ok){const a=await t.text().catch(()=>"");return console.error("[openai-codex] Token refresh failed:",t.status,a),{type:"failed"}}const o=await t.json();return!o.access_token||!o.refresh_token||typeof o.expires_in!="number"?(console.error("[openai-codex] Token refresh response missing fields:",o),{type:"failed"}):{type:"success",access:o.access_token,refresh:o.refresh_token,expires:Date.now()+o.expires_in*1e3}}catch(t){return console.error("[openai-codex] Token refresh error:",t),{type:"failed"}}}s(O,"refreshAccessToken");async function R(e="catui"){const{verifier:t,challenge:o}=await P(),a=S(),r=new URL(k);return r.searchParams.set("response_type","code"),r.searchParams.set("client_id",p),r.searchParams.set("redirect_uri",_),r.searchParams.set("scope",A),r.searchParams.set("code_challenge",o),r.searchParams.set("code_challenge_method","S256"),r.searchParams.set("state",a),r.searchParams.set("id_token_add_organizations","true"),r.searchParams.set("codex_cli_simplified_flow","true"),r.searchParams.set("originator",e),{verifier:t,state:a,url:r.toString()}}s(R,"createAuthorizationFlow");function b(e){if(!f)throw new Error("OpenAI Codex OAuth is only available in Node.js environments");let t=null,o=!1;const a=f.createServer((r,n)=>{try{const c=new URL(r.url||"","http://localhost");if(c.pathname!=="/auth/callback"){n.statusCode=404,n.end("Not found");return}if(c.searchParams.get("state")!==e){n.statusCode=400,n.end("State mismatch");return}const l=c.searchParams.get("code");if(!l){n.statusCode=400,n.end("Missing authorization code");return}n.statusCode=200,n.setHeader("Content-Type","text/html; charset=utf-8"),n.end(I),t=l}catch{n.statusCode=500,n.end("Internal error")}});return new Promise(r=>{a.listen(1455,"127.0.0.1",()=>{r({close:s(()=>a.close(),"close"),cancelWait:s(()=>{o=!0},"cancelWait"),waitForCode:s(async()=>{const n=s(()=>new Promise(c=>setTimeout(c,100)),"sleep");for(let c=0;c<600;c+=1){if(t)return{code:t};if(o)return null;await n()}return null},"waitForCode")})}).on("error",n=>{console.error("[openai-codex] Failed to bind http://127.0.0.1:1455 (",n.code,") Falling back to manual paste."),r({close:s(()=>{try{a.close()}catch{}},"close"),cancelWait:s(()=>{},"cancelWait"),waitForCode:s(async()=>null,"waitForCode")})})})}s(b,"startLocalOAuthServer");function x(e){const a=T(e)?.[E]?.chatgpt_account_id;return typeof a=="string"&&a.length>0?a:null}s(x,"getAccountId");async function L(e){const{verifier:t,state:o,url:a}=await R(e.originator),r=await b(o);e.onAuth({url:a,instructions:"A browser window should open. Complete login to finish."});let n;try{if(e.onManualCodeInput){let u,d;const g=e.onManualCodeInput().then(i=>{u=i,r.cancelWait()}).catch(i=>{d=i instanceof Error?i:new Error(String(i)),r.cancelWait()}),w=await r.waitForCode();if(d)throw d;if(w?.code)n=w.code;else if(u){const i=m(u);if(i.state&&i.state!==o)throw new Error("State mismatch");n=i.code}if(!n){if(await g,d)throw d;if(u){const i=m(u);if(i.state&&i.state!==o)throw new Error("State mismatch");n=i.code}}}else{const u=await r.waitForCode();u?.code&&(n=u.code)}if(!n){const u=await e.onPrompt({message:"Paste the authorization code (or full redirect URL):"}),d=m(u);if(d.state&&d.state!==o)throw new Error("State mismatch");n=d.code}if(!n)throw new Error("Missing authorization code");const c=await v(n,t);if(c.type!=="success")throw new Error("Token exchange failed");const l=x(c.access);if(!l)throw new Error("Failed to extract accountId from token");return{access:c.access,refresh:c.refresh,expires:c.expires,accountId:l}}finally{r.close()}}s(L,"loginOpenAICodex");async function U(e){const t=await O(e);if(t.type!=="success")throw new Error("Failed to refresh OpenAI Codex token");const o=x(t.access);if(!o)throw new Error("Failed to extract accountId from token");return{access:t.access,refresh:t.refresh,expires:t.expires,accountId:o}}s(U,"refreshOpenAICodexToken");const M={id:"openai-codex",name:"ChatGPT Plus/Pro (Codex Subscription)",usesCallbackServer:!0,async login(e){return L({onAuth:e.onAuth,onPrompt:e.onPrompt,onProgress:e.onProgress,onManualCodeInput:e.onManualCodeInput})},async refreshToken(e){return U(e.refresh)},getApiKey(e){return e.access}};export{L as loginOpenAICodex,M as openaiCodexOAuthProvider,U as refreshOpenAICodexToken};

package/dist/core/lib/ai/src/utils/oauth/pkce.d.ts

@@ -0,0 +1,18 @@
+/**
+ * PKCE utilities using Web Crypto API.
+ * Works in both Node.js 20+ and browsers.
+ */
+/**
+ * [WHO]: Extension interface
+ * [FROM]: No external dependencies
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/pkce.ts -
+ */
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;

package/dist/core/lib/ai/src/utils/oauth/pkce.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var r=(n,e)=>i(n,"name",{value:e,configurable:!0});function o(n){let e="";for(const t of n)e+=String.fromCharCode(t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}r(o,"base64urlEncode");async function f(){const n=new Uint8Array(32);crypto.getRandomValues(n);const e=o(n),c=new TextEncoder().encode(e),a=await crypto.subtle.digest("SHA-256",c),s=o(new Uint8Array(a));return{verifier:e,challenge:s}}r(f,"generatePKCE");export{f as generatePKCE};

package/dist/core/lib/ai/src/utils/oauth/types.d.ts

@@ -0,0 +1,52 @@
+/**
+ * [WHO]: OAuthLoginCallbacks, OAuthProviderInterface, OAuthProviderInfo
+ * [FROM]: No external dependencies
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/oauth/types.ts -
+ */
+import type { Api, Model } from "../../types.js";
+export type OAuthCredentials = {
+    refresh: string;
+    access: string;
+    expires: number;
+    [key: string]: unknown;
+};
+export type OAuthProviderId = string;
+/** @deprecated Use OAuthProviderId instead */
+export type OAuthProvider = OAuthProviderId;
+export type OAuthPrompt = {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+};
+export type OAuthAuthInfo = {
+    url: string;
+    instructions?: string;
+};
+export interface OAuthLoginCallbacks {
+    onAuth: (info: OAuthAuthInfo) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    signal?: AbortSignal;
+}
+export interface OAuthProviderInterface {
+    readonly id: OAuthProviderId;
+    readonly name: string;
+    /** Run the login flow, return credentials to persist */
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+    /** Whether login uses a local callback server and supports manual code input. */
+    usesCallbackServer?: boolean;
+    /** Refresh expired credentials, return updated credentials to persist */
+    refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    /** Convert credentials to API key string for the provider */
+    getApiKey(credentials: OAuthCredentials): string;
+    /** Optional: modify models for this provider (e.g., update baseUrl) */
+    modifyModels?(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[];
+}
+/** @deprecated Use OAuthProviderInterface instead */
+export interface OAuthProviderInfo {
+    id: OAuthProviderId;
+    name: string;
+    available: boolean;
+}

package/dist/core/lib/ai/src/utils/overflow.d.ts

@@ -0,0 +1,57 @@
+/**
+ * [WHO]: isContextOverflow, getOverflowPatterns
+ * [FROM]: No external dependencies
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/overflow.ts -
+ */
+import type { AssistantMessage } from "../types.js";
+/**
+ * Check if an assistant message represents a context overflow error.
+ *
+ * This handles two cases:
+ * 1. Error-based overflow: Most providers return stopReason "error" with a
+ *    specific error message pattern.
+ * 2. Silent overflow: Some providers accept overflow requests and return
+ *    successfully. For these, we check if usage.input exceeds the context window.
+ *
+ * ## Reliability by Provider
+ *
+ * **Reliable detection (returns error with detectable message):**
+ * - Anthropic: "prompt is too long: X tokens > Y maximum"
+ * - OpenAI (Completions & Responses): "exceeds the context window"
+ * - Google Gemini: "input token count exceeds the maximum"
+ * - xAI (Grok): "maximum prompt length is X but request contains Y"
+ * - Groq: "reduce the length of the messages"
+ * - Cerebras: 400/413 status code (no body)
+ * - Mistral: 400/413 status code (no body)
+ * - OpenRouter (all backends): "maximum context length is X tokens"
+ * - llama.cpp: "exceeds the available context size"
+ * - LM Studio: "greater than the context length"
+ * - Kimi For Coding: "exceeded model token limit: X (requested: Y)"
+ *
+ * **Unreliable detection:**
+ * - z.ai: Sometimes accepts overflow silently (detectable via usage.input > contextWindow),
+ *   sometimes returns rate limit errors. Pass contextWindow param to detect silent overflow.
+ * - Ollama: Silently truncates input without error. Cannot be detected via this function.
+ *   The response will have usage.input < expected, but we don't know the expected value.
+ *
+ * ## Custom Providers
+ *
+ * If you've added custom models via settings.json, this function may not detect
+ * overflow errors from those providers. To add support:
+ *
+ * 1. Send a request that exceeds the model's context window
+ * 2. Check the errorMessage in the response
+ * 3. Create a regex pattern that matches the error
+ * 4. The pattern should be added to OVERFLOW_PATTERNS in this file, or
+ *    check the errorMessage yourself before calling this function
+ *
+ * @param message - The assistant message to check
+ * @param contextWindow - Optional context window size for detecting silent overflow (z.ai)
+ * @returns true if the message indicates a context overflow
+ */
+export declare function isContextOverflow(message: AssistantMessage, contextWindow?: number): boolean;
+/**
+ * Get the overflow patterns for testing purposes.
+ */
+export declare function getOverflowPatterns(): RegExp[];

package/dist/core/lib/ai/src/utils/overflow.js

@@ -0,0 +1 @@
+var r=Object.defineProperty;var o=(e,t)=>r(e,"name",{value:t,configurable:!0});const n=[/prompt is too long/i,/input is too long for requested model/i,/exceeds the context window/i,/input token count.*exceeds the maximum/i,/maximum prompt length is \d+/i,/reduce the length of the messages/i,/maximum context length is \d+ tokens/i,/exceeds the limit of \d+/i,/exceeds the available context size/i,/greater than the context length/i,/context window exceeds limit/i,/exceeded model token limit/i,/context[_ ]length[_ ]exceeded/i,/too many tokens/i,/token limit exceeded/i];function u(e,t){return!!(e.stopReason==="error"&&e.errorMessage&&(n.some(i=>i.test(e.errorMessage))||/^4(00|13)\s*(status code)?\s*\(no body\)/i.test(e.errorMessage))||t&&e.stopReason==="stop"&&e.usage.input+e.usage.cacheRead>t)}o(u,"isContextOverflow");function c(){return[...n]}o(c,"getOverflowPatterns");export{c as getOverflowPatterns,u as isContextOverflow};

package/dist/core/lib/ai/src/utils/sanitize-unicode.d.ts

@@ -0,0 +1,16 @@
+/**
+ * [WHO]: sanitizeSurrogates function - removes unpaired Unicode surrogate characters
+ * [FROM]: No external dependencies
+ * [TO]: Consumed by AI providers for JSON-safe text
+ * [HERE]: core/lib/ai/src/utils/sanitize-unicode.ts - Unicode sanitization utility
+ *
+ * Unpaired surrogates cause JSON serialization errors in many API providers.
+ * Valid emoji with properly paired surrogates are preserved.
+ */
+/**
+ * [WHO]: sanitizeSurrogates
+ * [FROM]: No external dependencies
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/sanitize-unicode.ts -
+ */
+export declare function sanitizeSurrogates(text: string): string;

package/dist/core/lib/ai/src/utils/sanitize-unicode.js

@@ -0,0 +1 @@
+var e=Object.defineProperty;var F=(u,D)=>e(u,"name",{value:D,configurable:!0});function t(u){return u.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g,"")}F(t,"sanitizeSurrogates");export{t as sanitizeSurrogates};

package/dist/core/lib/ai/src/utils/typebox-helpers.d.ts

@@ -0,0 +1,22 @@
+/**
+ * [WHO]: StringEnum
+ * [FROM]: Depends on @sinclair/typebox
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/typebox-helpers.ts -
+ */
+import { type TUnsafe } from "@sinclair/typebox";
+/**
+ * Creates a string enum schema compatible with Google's API and other providers
+ * that don't support anyOf/const patterns.
+ *
+ * @example
+ * const OperationSchema = StringEnum(["add", "subtract", "multiply", "divide"], {
+ *   description: "The operation to perform"
+ * });
+ *
+ * type Operation = Static<typeof OperationSchema>; // "add" | "subtract" | "multiply" | "divide"
+ */
+export declare function StringEnum<T extends readonly string[]>(values: T, options?: {
+    description?: string;
+    default?: T[number];
+}): TUnsafe<T[number]>;

package/dist/core/lib/ai/src/utils/typebox-helpers.js

@@ -0,0 +1 @@
+var n=Object.defineProperty;var t=(r,e)=>n(r,"name",{value:e,configurable:!0});import{Type as i}from"@sinclair/typebox";function f(r,e){return i.Unsafe({type:"string",enum:[...r],...e?.description&&{description:e.description},...e?.default&&{default:e.default}})}t(f,"StringEnum");export{f as StringEnum};

package/dist/core/lib/ai/src/utils/validation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * [WHO]: validateToolCall, validateToolArguments
+ * [FROM]: Depends on ajv, ajv-formats
+ * [TO]: Consumed by core/lib/ai/src/index.ts
+ * [HERE]: core/lib/ai/src/utils/validation.ts -
+ */
+import type { Tool, ToolCall } from "../types.js";
+/**
+ * Finds a tool by name and validates the tool call arguments against its TypeBox schema
+ * @param tools Array of tool definitions
+ * @param toolCall The tool call from the LLM
+ * @returns The validated arguments
+ * @throws Error if tool is not found or validation fails
+ */
+export declare function validateToolCall(tools: Tool[], toolCall: ToolCall): any;
+/**
+ * Validates tool call arguments against the tool's TypeBox schema
+ * @param tool The tool definition with TypeBox schema
+ * @param toolCall The tool call from the LLM
+ * @returns The validated (and potentially coerced) arguments
+ * @throws Error with formatted message if validation fails
+ */
+export declare function validateToolArguments(tool: Tool, toolCall: ToolCall): any;

package/dist/core/lib/ai/src/utils/validation.js

@@ -0,0 +1,6 @@
+var l=Object.defineProperty;var a=(n,r)=>l(n,"name",{value:r,configurable:!0});import i from"ajv";import u from"ajv-formats";const f=i.default||i,g=u.default||u,p=globalThis,c=p.chrome?.runtime?.id!==void 0;let s=null;if(!c)try{s=new f({allErrors:!0,strict:!1,coerceTypes:!0}),g(s)}catch{console.warn("AJV validation disabled due to CSP restrictions")}function T(n,r){const e=n.find(t=>t.name===r.name);if(!e)throw new Error(`Tool "${r.name}" not found`);return h(e,r)}a(T,"validateToolCall");function h(n,r){if(!s||c)return r.arguments;const e=s.compile(n.parameters),t=structuredClone(r.arguments);if(e(t))return t;const d=e.errors?.map(o=>`  - ${o.instancePath?o.instancePath.substring(1):o.params.missingProperty||"root"}: ${o.message}`).join(`
+`)||"Unknown validation error",m=`Validation failed for tool "${r.name}":
+${d}
+
+Received arguments:
+${JSON.stringify(r.arguments,null,2)}`;throw new Error(m)}a(h,"validateToolArguments");export{h as validateToolArguments,T as validateToolCall};