npm - dsh-plugin-subscriptions - Versions diffs - 0.1.0 - Mend

dsh-plugin-subscriptions 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (44) hide show

package/README.md +93 -0
package/README.zh.md +93 -0
package/cordis.patch.yml +12 -0
package/lib/auth/jwt.d.ts +10 -0
package/lib/auth/jwt.js +25 -0
package/lib/auth/oauth-flow.d.ts +91 -0
package/lib/auth/oauth-flow.js +227 -0
package/lib/auth/pkce.d.ts +31 -0
package/lib/auth/pkce.js +35 -0
package/lib/auth/rpc.d.ts +51 -0
package/lib/auth/rpc.js +83 -0
package/lib/auth/store.d.ts +90 -0
package/lib/auth/store.js +137 -0
package/lib/client/SubscriptionsSection.d.ts +30 -0
package/lib/client/SubscriptionsSection.js +290 -0
package/lib/client/index.d.ts +31 -0
package/lib/client/index.js +35 -0
package/lib/client/locales.d.ts +45 -0
package/lib/client/locales.js +43 -0
package/lib/client.js +546 -0
package/lib/client.js.map +1 -0
package/lib/index.d.ts +34 -0
package/lib/index.js +2932 -0
package/lib/providers/claude.d.ts +60 -0
package/lib/providers/claude.js +243 -0
package/lib/providers/codex.d.ts +96 -0
package/lib/providers/codex.js +391 -0
package/lib/providers/common.d.ts +185 -0
package/lib/providers/common.js +302 -0
package/lib/providers/grok.d.ts +90 -0
package/lib/providers/grok.js +337 -0
package/lib/tools/image-generate.d.ts +60 -0
package/lib/tools/image-generate.js +142 -0
package/lib/tools/x-search.d.ts +58 -0
package/lib/tools/x-search.js +195 -0
package/lib/translate/anthropic.d.ts +120 -0
package/lib/translate/anthropic.js +370 -0
package/lib/translate/resolved.d.ts +35 -0
package/lib/translate/resolved.js +40 -0
package/lib/translate/responses.d.ts +127 -0
package/lib/translate/responses.js +352 -0
package/lib/translate/sse.d.ts +21 -0
package/lib/translate/sse.js +56 -0
package/package.json +83 -0

package/lib/index.js ADDED Viewed

@@ -0,0 +1,2932 @@
+import z from "@deepseek-ai/schemastery";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError } from "@deepseek-ai/dsh-llm";
+import { createServer } from "node:http";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+//#region src/auth/pkce.ts
+/**
+* Base64url-encode without padding.
+* @param buffer - raw bytes.
+* @returns the RFC 4648 §5 encoding.
+*/
+function base64url(buffer) {
+	return buffer.toString("base64url");
+}
+/**
+* Mint a fresh PKCE pair (32-byte verifier, S256 challenge).
+* @returns the pair for one authorization attempt.
+*/
+function createPkce() {
+	const verifier = base64url(randomBytes(32));
+	return {
+		verifier,
+		challenge: base64url(createHash("sha256").update(verifier).digest())
+	};
+}
+/**
+* Mint a URL-safe random token (default 16 bytes) for OAuth `state`.
+* @param bytes - entropy length.
+* @returns base64url-encoded random bytes.
+*/
+function randomToken(bytes = 16) {
+	return base64url(randomBytes(bytes));
+}
+/**
+* Mint lowercase-hex random bytes (for Grok's `nonce` parameter).
+* @param bytes - entropy length; the hex string is twice as long.
+* @returns hex-encoded random bytes.
+*/
+function randomHex(bytes = 8) {
+	return randomBytes(bytes).toString("hex");
+}
+//#endregion
+//#region src/auth/oauth-flow.ts
+/** Default attempt lifetime: three minutes for the user to complete login. */
+const DEFAULT_FLOW_TIMEOUT_MS = 18e4;
+const SUCCESS_PAGE = "<!doctype html><html><head><meta charset=\"utf-8\"><title>Login successful</title></head><body style=\"font-family:sans-serif\"><h1>Login successful</h1><p>You can close this tab and return to DeepSeek Harness.</p></body></html>";
+function failurePage(detail) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>Login failed</title></head><body style="font-family:sans-serif"><h1>Login failed</h1><p>${detail.replace(/[<>&]/g, "")}</p></body></html>`;
+}
+/**
+* Loopback addresses one listen host covers. `localhost` resolves to ::1 or
+* 127.0.0.1 depending on the client, and Node binds exactly one of them per
+* listen call — a browser picking the other family gets connection-refused
+* and the login times out, so both families must serve the callback.
+*/
+function listenHosts(host) {
+	return host === "localhost" ? ["127.0.0.1", "::1"] : [host];
+}
+/** True when the address family does not exist on this machine (safe to skip), unlike a taken port. */
+function familyUnavailable(error) {
+	const code = error.code;
+	return code === "EADDRNOTAVAIL" || code === "EPROTONOSUPPORT";
+}
+/**
+* Listen on the first port of the spec free on every loopback family;
+* rejects when every port fails. Ephemeral ports (0) are retried so each
+* family can be re-bound onto the first family's assigned port.
+*/
+async function listen(handler, spec) {
+	const hosts = listenHosts(spec.host);
+	const candidates = spec.ports.flatMap((port) => port === 0 ? [
+		0,
+		0,
+		0
+	] : [port]);
+	let lastError;
+	for (const candidate of candidates) {
+		const servers = [];
+		let port = candidate;
+		let unusable = false;
+		for (const host of hosts) {
+			const server = createServer(handler);
+			try {
+				await new Promise((resolve, reject) => {
+					const onError = (error) => reject(error);
+					server.once("error", onError);
+					server.listen(port, host, () => {
+						server.removeListener("error", onError);
+						resolve();
+					});
+				});
+				const address = server.address();
+				if (address === null) throw new Error(`callback server on ${host}:${port} has no address`);
+				if (port === 0) port = address.port;
+				servers.push(server);
+			} catch (error) {
+				server.close();
+				if (familyUnavailable(error)) continue;
+				lastError = error;
+				unusable = true;
+				break;
+			}
+		}
+		if (unusable || servers.length === 0) {
+			for (const server of servers) server.close();
+			continue;
+		}
+		return {
+			servers,
+			port
+		};
+	}
+	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`callback server could not listen on ${spec.host} (ports ${spec.ports.join(", ")})`);
+}
+/**
+* Own the set of in-flight login attempts, keyed by provider. One attempt per
+* provider at a time; an attempt removes itself when it settles.
+*/
+var OAuthFlowManager = class {
+	attempts = /* @__PURE__ */ new Map();
+	/**
+	* Whether a login attempt is running for one provider.
+	* @param provider - the provider route.
+	* @returns true while an attempt is waiting for its code.
+	*/
+	isBusy(provider) {
+		return this.attempts.has(provider);
+	}
+	/**
+	* The pending attempt for one provider, when any.
+	* @param provider - the provider route.
+	* @returns the in-flight attempt, or `undefined`.
+	*/
+	pending(provider) {
+		return this.attempts.get(provider);
+	}
+	/**
+	* Start a login attempt: mint PKCE/state, open the loopback callback
+	* server, and build the authorize URL.
+	* @param provider - the provider route (one attempt at a time).
+	* @param spec - static flow facts for this provider.
+	* @returns the live attempt; its `waitCode()` settles the login.
+	* @throws when an attempt is already running or no callback port is free.
+	*/
+	async start(provider, spec) {
+		if (this.attempts.has(provider)) throw new Error(`a ${provider} login attempt is already in progress`);
+		const input = {
+			redirectUri: "",
+			state: randomToken(16),
+			pkce: createPkce(),
+			nonce: randomHex(8)
+		};
+		const timeoutMs = spec.timeoutMs ?? DEFAULT_FLOW_TIMEOUT_MS;
+		let resolveCode;
+		let rejectCode;
+		const codePromise = new Promise((resolve, reject) => {
+			resolveCode = resolve;
+			rejectCode = reject;
+		});
+		let settled = false;
+		let timer;
+		let servers = [];
+		const handler = (request, response) => {
+			const url = new URL(request.url ?? "/", "http://localhost");
+			if (url.pathname !== spec.callbackPath) {
+				response.writeHead(404, { "content-type": "text/plain" });
+				response.end("not found");
+				return;
+			}
+			const errorDescription = url.searchParams.get("error_description") ?? url.searchParams.get("error");
+			if (errorDescription !== null) {
+				response.writeHead(200, { "content-type": "text/html" });
+				response.end(failurePage(errorDescription));
+				settle(/* @__PURE__ */ new Error(`authorization failed: ${errorDescription}`));
+				return;
+			}
+			if (url.searchParams.get("state") !== input.state) {
+				response.writeHead(400, { "content-type": "text/plain" });
+				response.end("state mismatch");
+				return;
+			}
+			const code = url.searchParams.get("code");
+			if (code === null || code.length === 0) {
+				response.writeHead(400, { "content-type": "text/plain" });
+				response.end("missing authorization code");
+				return;
+			}
+			response.writeHead(200, { "content-type": "text/html" });
+			response.end(SUCCESS_PAGE);
+			settle(void 0, code);
+		};
+		const settle = (error, code) => {
+			if (settled) return;
+			settled = true;
+			if (timer !== void 0) clearTimeout(timer);
+			for (const server of servers) {
+				server.close();
+				server.closeAllConnections();
+			}
+			this.attempts.delete(provider);
+			if (error !== void 0) rejectCode(error);
+			else if (code !== void 0) resolveCode(code);
+		};
+		const bound = await listen(handler, spec.listen);
+		servers = bound.servers;
+		input.redirectUri = `http://${spec.listen.host}:${bound.port}${spec.callbackPath}`;
+		timer = setTimeout(() => {
+			settle(/* @__PURE__ */ new Error(`login timed out after ${Math.round(timeoutMs / 1e3)}s`));
+		}, timeoutMs);
+		timer.unref();
+		const attempt = {
+			authorizeUrl: spec.buildAuthorizeUrl(input),
+			redirectUri: input.redirectUri,
+			pkce: input.pkce,
+			state: input.state,
+			waitCode: () => codePromise,
+			manual(rawInput) {
+				if (settled) throw new Error(`the ${provider} login attempt already finished`);
+				const trimmed = rawInput.trim();
+				let code;
+				let pastedState;
+				if (/^https?:\/\//i.test(trimmed)) {
+					const url = new URL(trimmed);
+					code = url.searchParams.get("code") ?? void 0;
+					pastedState = url.searchParams.get("state") ?? void 0;
+				} else if (trimmed.includes("code=")) {
+					const params = new URLSearchParams(trimmed);
+					code = params.get("code") ?? void 0;
+					pastedState = params.get("state") ?? void 0;
+				} else if (trimmed.length > 0 && !/\s/.test(trimmed)) code = trimmed;
+				if (code === void 0 || code.length === 0) throw new Error("no authorization code found in the pasted input");
+				if (pastedState !== void 0 && pastedState !== input.state) throw new Error("state mismatch: the pasted URL belongs to a different login attempt");
+				settle(void 0, code);
+			},
+			cancel() {
+				settle(/* @__PURE__ */ new Error("login cancelled"));
+			}
+		};
+		this.attempts.set(provider, attempt);
+		return attempt;
+	}
+};
+//#endregion
+//#region src/auth/store.ts
+/** Every provider route, in display order. */
+const PROVIDER_IDS = [
+	"codex",
+	"claude",
+	"grok"
+];
+/**
+* Absolute path of the auth store file.
+* @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
+*/
+function authFilePath() {
+	return dshHomePath("plugins", "subscriptions", "auth.json");
+}
+/** Store location used before the plugin was renamed; migrated on first read. */
+function legacyAuthFilePath() {
+	return dshHomePath("plugins", "router", "auth.json");
+}
+/** Check that one durable entry carries the fields every session needs. */
+function assertSessionShape(provider, value) {
+	if (typeof value !== "object" || value === null) throw new Error(`subscriptions auth store: entry "${provider}" is not an object; fix or delete the store file`);
+	const entry = value;
+	if (typeof entry.accessToken !== "string" || entry.accessToken.length === 0 || typeof entry.refreshToken !== "string" || entry.refreshToken.length === 0 || typeof entry.expiresAt !== "number" || !Number.isFinite(entry.expiresAt)) throw new Error(`subscriptions auth store: entry "${provider}" is missing accessToken/refreshToken/expiresAt; fix or delete the store file`);
+}
+/**
+* Read the whole store. A missing file is an empty store; malformed JSON or a
+* malformed entry throws, because silently discarding tokens would strand the
+* user without a diagnosis.
+* @param path - store file path; defaults to {@link authFilePath}.
+* @returns the parsed session map.
+*/
+async function loadStore(path = authFilePath()) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		if (path !== authFilePath()) return {};
+		try {
+			text = await readFile(legacyAuthFilePath(), "utf8");
+		} catch (legacyError) {
+			if (legacyError.code === "ENOENT") return {};
+			throw legacyError;
+		}
+		const migrated = parseStore(text, legacyAuthFilePath());
+		await writeStore(migrated, path);
+		await rm(legacyAuthFilePath(), { force: true });
+		return migrated;
+	}
+	return parseStore(text, path);
+}
+/** Parse and validate store JSON read from `path`. */
+function parseStore(text, path) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error(`subscriptions auth store at ${path} is not valid JSON; fix or delete the file`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`subscriptions auth store at ${path} must be a JSON object keyed by provider; fix or delete the file`);
+	const store = parsed;
+	for (const provider of PROVIDER_IDS) {
+		const entry = store[provider];
+		if (entry !== void 0) assertSessionShape(provider, entry);
+	}
+	return store;
+}
+/** Persist the whole store atomically with owner-only permissions. */
+async function writeStore(store, path) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+	try {
+		await writeFile(tmp, JSON.stringify(store, null, 2), { mode: 384 });
+		await chmod(tmp, 384);
+		await rename(tmp, path);
+	} catch (error) {
+		await rm(tmp, { force: true });
+		throw error;
+	}
+}
+/**
+* Read one provider's session.
+* @param provider - the provider route.
+* @param path - store file path; defaults to {@link authFilePath}.
+* @returns the stored session, or `undefined` when logged out.
+*/
+async function getSession(provider, path = authFilePath()) {
+	return (await loadStore(path))[provider];
+}
+/**
+* Write one provider's session, preserving the others.
+* @param provider - the provider route.
+* @param session - the fresh session from a login or refresh.
+* @param path - store file path; defaults to {@link authFilePath}.
+*/
+async function saveSession(provider, session, path = authFilePath()) {
+	const store = await loadStore(path);
+	store[provider] = session;
+	await writeStore(store, path);
+}
+/**
+* Delete one provider's session (logout).
+* @param provider - the provider route.
+* @param path - store file path; defaults to {@link authFilePath}.
+*/
+async function deleteSession(provider, path = authFilePath()) {
+	const store = await loadStore(path);
+	if (store[provider] === void 0) return;
+	delete store[provider];
+	await writeStore(store, path);
+}
+//#endregion
+//#region src/auth/rpc.ts
+/** The RPC channel this plugin registers on the host connection. */
+const SUBSCRIPTIONS_AUTH_CHANNEL = "/subscriptions-auth";
+/** Payload carried no usable provider id — an RPC client bug, not a server failure. */
+var BadRequest = class extends Error {};
+function ok(value) {
+	return {
+		ok: true,
+		value
+	};
+}
+function failure(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (error instanceof BadRequest) return {
+		ok: false,
+		error: {
+			code: "bad-request",
+			message,
+			details: { issues: [] }
+		}
+	};
+	return {
+		ok: false,
+		error: {
+			code: "internal",
+			message,
+			details: {}
+		}
+	};
+}
+function readProvider(payload) {
+	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
+	const provider = payload.provider;
+	if (typeof provider !== "string" || !PROVIDER_IDS.includes(provider)) throw new BadRequest(`payload.provider must be one of ${PROVIDER_IDS.join(", ")}`);
+	return provider;
+}
+function readString(payload, field) {
+	const value = payload[field];
+	if (typeof value !== "string" || value.length === 0) throw new BadRequest(`payload.${field} must be a non-empty string`);
+	return value;
+}
+async function dispatch(controller, endpoint, payload) {
+	switch (endpoint) {
+		case "status": {
+			const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
+			return ok({ providers: Object.fromEntries(entries) });
+		}
+		case "login": return ok(await controller.login(readProvider(payload)));
+		case "manual": {
+			const provider = readProvider(payload);
+			await controller.manual(provider, readString(payload, "input"));
+			return ok({ ok: true });
+		}
+		case "cancel":
+			await controller.cancel(readProvider(payload));
+			return ok({ ok: true });
+		case "logout":
+			await controller.logout(readProvider(payload));
+			return ok({ ok: true });
+		default: throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
+	}
+}
+/**
+* Register the `/subscriptions-auth` RPC channel when a host connection exists.
+* @param ctx - the plugin context (headless profiles have no `connection`).
+* @param controller - the auth operations backing the endpoints.
+*/
+function registerAuthRpc(ctx, controller) {
+	ctx.inject(["connection"], (ctx$1) => {
+		const connection = ctx$1.get("connection");
+		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload) => {
+			try {
+				return await dispatch(controller, endpoint, payload);
+			} catch (error) {
+				return failure(error);
+			}
+		}, { authority: "loopback" }), "dsh-plugin-subscriptions: /subscriptions-auth rpc channel");
+	});
+}
+//#endregion
+//#region src/providers/common.ts
+/**
+* Validate a configured model catalog (mirrors llm-deepseek's resolveModels).
+* @param models - raw configured entries.
+* @param label - diagnostic prefix naming the provider.
+* @returns the validated entries.
+*/
+function validateModels(models, label) {
+	const seen = /* @__PURE__ */ new Set();
+	return models.map((model) => {
+		if (model.id.length === 0) throw new Error(`${label}: catalog model ids must be non-empty`);
+		if (model.name !== void 0 && model.name.length === 0) throw new Error(`${label}: catalog model "${model.id}" has an empty name`);
+		if (model.contextWindow !== void 0 && (!Number.isInteger(model.contextWindow) || model.contextWindow <= 0)) throw new Error(`${label}: catalog model "${model.id}" contextWindow must be a positive integer`);
+		if (model.maxTokens !== void 0 && (!Number.isInteger(model.maxTokens) || model.maxTokens <= 0)) throw new Error(`${label}: catalog model "${model.id}" maxTokens must be a positive integer`);
+		if (model.inputModalities !== void 0 && (model.inputModalities.length === 0 || model.inputModalities.some((modality) => modality !== "text" && modality !== "image"))) throw new Error(`${label}: catalog model "${model.id}" inputModalities must be a non-empty list of "text"/"image"`);
+		if (seen.has(model.id)) throw new Error(`${label}: duplicate catalog model "${model.id}"`);
+		seen.add(model.id);
+		return {
+			id: model.id,
+			...model.name === void 0 ? {} : { name: model.name },
+			...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
+			...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens },
+			...model.inputModalities === void 0 ? {} : { inputModalities: [...model.inputModalities] }
+		};
+	});
+}
+/**
+* Build an LlmError from a non-2xx provider response, reading and truncating
+* the body for the message and mapping the status to a stable code.
+* @param response - the failed response.
+* @param label - diagnostic prefix naming the provider API.
+* @returns the classified error.
+*/
+async function httpLlmError(response, label) {
+	let body = "";
+	try {
+		body = (await response.text()).slice(0, 500);
+	} catch {}
+	const message = body.length > 0 ? `${label} error (HTTP ${String(response.status)}): ${body}` : `${label} error (HTTP ${String(response.status)})`;
+	let code;
+	if (response.status === 401 || response.status === 403) code = "AUTH";
+	else if (isQuotaExceededError(body)) code = QUOTA_EXCEEDED_CODE;
+	else if (response.status === 429) code = "RATE_LIMIT";
+	else if (response.status === 400 && isContextWindowExceededError(body)) code = CONTEXT_WINDOW_EXCEEDED_CODE;
+	else if (response.status === 408 || response.status === 504) code = "TIMEOUT";
+	else if (response.status >= 500) code = "SERVER";
+	else code = `HTTP_${String(response.status)}`;
+	const retryAfter = response.headers.get("retry-after");
+	let providerRetryAfterMs;
+	if (retryAfter !== null) {
+		const seconds = Number(retryAfter);
+		if (Number.isFinite(seconds) && seconds > 0) providerRetryAfterMs = seconds * 1e3;
+	}
+	return new LlmError(message, code, {
+		status: response.status,
+		...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs }
+	});
+}
+/**
+* Create an idle watchdog chained to the caller's signal.
+* @param caller - the request's own abort signal, when present.
+* @param timeoutMs - maximum idle interval while a stream read is outstanding.
+* @returns the watchdog; always {@link IdleWatchdog.stop} it when the stream ends.
+*/
+function idleWatchdog(caller, timeoutMs) {
+	const controller = new AbortController();
+	let expired = false;
+	let timer;
+	const arm = () => {
+		if (timer !== void 0) clearTimeout(timer);
+		timer = setTimeout(() => {
+			expired = true;
+			controller.abort(/* @__PURE__ */ new Error(`stream idle timeout after ${String(timeoutMs)}ms`));
+		}, timeoutMs);
+		timer.unref();
+	};
+	const onCallerAbort = () => controller.abort(caller?.reason);
+	if (caller?.aborted === true) controller.abort(caller.reason);
+	else caller?.addEventListener("abort", onCallerAbort, { once: true });
+	arm();
+	return {
+		signal: controller.signal,
+		pulse: arm,
+		stop() {
+			if (timer !== void 0) clearTimeout(timer);
+			caller?.removeEventListener("abort", onCallerAbort);
+		},
+		timedOut: () => expired
+	};
+}
+/**
+* Classify a thrown fetch failure. Caller cancellation maps to ABORTED, idle
+* expiry to TIMEOUT, and everything else (DNS, TLS, refused connection) to
+* TRANSPORT with the cause chained.
+* @param label - diagnostic prefix naming the provider API.
+* @param error - the thrown value.
+* @param watchdog - the request's idle watchdog.
+* @param caller - the request's own abort signal, when present.
+* @returns the classified error.
+*/
+function mapFetchFailure(label, error, watchdog, caller) {
+	if (watchdog.timedOut()) return new LlmError(`${label} stream idle timeout`, "TIMEOUT", { cause: error });
+	if (caller?.aborted === true) return new LlmError(`${label} request aborted by caller`, "ABORTED", { cause: error });
+	if (error instanceof LlmError) return error;
+	return new LlmError(`${label} request failed`, "TRANSPORT", { cause: error });
+}
+/** OAuth token-endpoint failure carrying the provider's `error` code when it sent one. */
+var OAuthEndpointError = class extends Error {
+	/** HTTP status of the token endpoint response. */
+	status;
+	/** The provider's OAuth `error` code (e.g. `invalid_grant`), when present. */
+	oauthCode;
+	constructor(message, status, oauthCode) {
+		super(message);
+		this.name = "OAuthEndpointError";
+		this.status = status;
+		this.oauthCode = oauthCode;
+	}
+};
+/**
+* Read an OAuth JSON error body into an {@link OAuthEndpointError}.
+* @param response - the failed token-endpoint response.
+* @param label - diagnostic prefix naming the provider.
+* @returns the error to throw.
+*/
+async function oauthEndpointError(response, label) {
+	let oauthCode;
+	let detail = "";
+	try {
+		const parsed = await response.json();
+		oauthCode = typeof parsed.error === "string" ? parsed.error : void 0;
+		detail = typeof parsed.error_description === "string" ? parsed.error_description : oauthCode ?? "";
+	} catch {}
+	return new OAuthEndpointError(detail.length > 0 ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}` : `${label} token endpoint error (HTTP ${String(response.status)})`, response.status, oauthCode);
+}
+/**
+* Per-provider session freshness: loads the stored session, refreshes
+* proactively inside the preempt window or on demand after a 401, and
+* coalesces concurrent refreshes behind one in-flight promise. Permanent
+* refresh failures delete the stored session and surface INVALID_CREDENTIAL
+* with a re-login hint; transient failures fall back to a still-valid token.
+*/
+var TokenManager = class {
+	inflight;
+	constructor(options) {
+		this.options = options;
+		this.options = options;
+	}
+	/**
+	* Read the stored session without any refresh side effect. Catalog queries
+	* (`listModels`) use this to decide whether the provider is logged in.
+	* @returns the stored session, or `undefined` when logged out.
+	*/
+	peek() {
+		return this.options.load();
+	}
+	/**
+	* Whether a session is currently stored (cheap; never refreshes).
+	* @returns true when logged in.
+	*/
+	async hasSession() {
+		return await this.options.load() !== void 0;
+	}
+	/**
+	* Resolve a usable session, refreshing proactively or on demand.
+	* @param forceRefresh - refresh regardless of expiry (used after a 401).
+	* @returns the persisted session to send.
+	* @throws LlmError MISSING_CREDENTIAL when logged out, INVALID_CREDENTIAL
+	*   when the refresh grant is permanently rejected.
+	*/
+	async session(forceRefresh = false) {
+		const session = await this.options.load();
+		if (session === void 0) throw new LlmError(`dsh-plugin-subscriptions: not logged in to ${this.options.displayName}; log in via Settings → Subscriptions in the dsh web app`, "MISSING_CREDENTIAL");
+		if (!forceRefresh && session.expiresAt - Date.now() > this.options.preemptMs) return session;
+		this.inflight ??= this.doRefresh(session).finally(() => {
+			this.inflight = void 0;
+		});
+		try {
+			return await this.inflight;
+		} catch (error) {
+			if (this.options.isPermanent(error)) {
+				await this.options.remove();
+				this.options.onRemoved?.();
+				throw new LlmError(`${this.options.displayName} login expired or was revoked; log in again via Settings → Subscriptions`, "INVALID_CREDENTIAL", { cause: error });
+			}
+			if (!forceRefresh && session.expiresAt > Date.now()) return session;
+			throw error instanceof LlmError ? error : new LlmError(`${this.options.displayName} token refresh failed`, "AUTH", { cause: error });
+		}
+	}
+	async doRefresh(session) {
+		const current = await this.options.load();
+		if (current !== void 0 && current.accessToken !== session.accessToken && current.expiresAt - Date.now() > this.options.preemptMs) return current;
+		const next = await this.options.refresh(current ?? session);
+		await this.options.save(next);
+		return next;
+	}
+};
+/** How long a discovered catalog is trusted before re-fetching. */
+const DISCOVERY_TTL_MS = 5 * 6e4;
+/**
+* TTL cache for one provider's discovered model catalog. Only `listModels`
+* populates it (via {@link get}); `resolveModel` reads {@link cached} so it
+* never performs network I/O. A 401 during a fetch must call
+* {@link invalidate}.
+*/
+var ModelCatalogCache = class {
+	entry;
+	constructor(ttlMs = DISCOVERY_TTL_MS) {
+		this.ttlMs = ttlMs;
+	}
+	/**
+	* The cached catalog when fresh, without fetching.
+	* @returns the cached models, or `undefined` when absent or stale.
+	*/
+	cached() {
+		if (this.entry === void 0 || Date.now() - this.entry.at >= this.ttlMs) return void 0;
+		return this.entry.models;
+	}
+	/**
+	* Return the cached catalog when fresh, otherwise fetch and cache it.
+	* @param fetcher - performs the provider's model-list request.
+	* @returns the discovered models.
+	*/
+	async get(fetcher) {
+		const cached = this.cached();
+		if (cached !== void 0) return cached;
+		const models = await fetcher();
+		this.entry = {
+			at: Date.now(),
+			models
+		};
+		return models;
+	}
+	/** Drop the cached catalog (e.g. after a 401 proved the credential changed). */
+	invalidate() {
+		this.entry = void 0;
+	}
+};
+//#endregion
+//#region src/auth/jwt.ts
+/** Minimal JWT payload decoding for claims extraction (no signature verification). */
+/**
+* Decode a JWT payload without verifying the signature. Used only to read
+* account claims from `id_token`s issued over the provider's own TLS channel
+* during a code exchange we initiated — never to authorize anything.
+* @param token - the compact JWT string.
+* @returns the parsed payload object, or `undefined` when the token is not a
+*   well-formed JWT with a JSON object payload.
+*/
+function decodeJwtPayload(token) {
+	const parts = token.split(".");
+	if (parts.length < 2) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	return parsed;
+}
+//#endregion
+//#region src/translate/resolved.ts
+/**
+* Resolve every ImageBlock's attachment reference to inline base64 bytes.
+* Messages without images pass through unchanged. A request carrying an image
+* with no attachment service available fails loudly rather than silently
+* dropping the image.
+* @param messages - the request's conversation messages.
+* @param attachments - the deployment's attachment service, when mounted.
+* @param signal - cancellation for the storage reads.
+* @returns the same messages with image blocks resolved for the translators.
+*/
+async function resolveImages(messages, attachments, signal) {
+	if (!messages.some((message) => message.content.some((block) => block.type === "image"))) return messages;
+	if (attachments === void 0) throw new LlmError("dsh-plugin-subscriptions: the request carries an image but no attachments service is mounted; image input requires the harness attachment store", "UNSUPPORTED");
+	return Promise.all(messages.map(async (message) => ({
+		role: message.role,
+		content: await Promise.all(message.content.map(async (block) => {
+			if (block.type !== "image") return block;
+			const stored = await attachments.readImage(block.attachment, signal);
+			return {
+				type: "image",
+				mediaType: stored.ref.mediaType,
+				dataBase64: Buffer.from(stored.data).toString("base64")
+			};
+		}))
+	})));
+}
+//#endregion
+//#region src/translate/sse.ts
+/**
+* Decode an SSE byte stream into events.
+* @param stream - raw response bytes; reads may split anywhere, including mid-UTF-8 sequence.
+* @param onActivity - called on every received chunk and comment line; drives the idle watchdog.
+* @returns events in arrival order.
+*/
+async function* parseSse(stream, onActivity) {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let pending = "";
+	let dataLines = [];
+	let eventName;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) return;
+			onActivity?.();
+			pending += decoder.decode(value, { stream: true });
+			let newline = pending.indexOf("\n");
+			while (newline >= 0) {
+				let line = pending.slice(0, newline);
+				pending = pending.slice(newline + 1);
+				newline = pending.indexOf("\n");
+				if (line.endsWith("\r")) line = line.slice(0, -1);
+				if (line.length === 0) {
+					if (dataLines.length > 0) yield {
+						data: dataLines.join("\n"),
+						...eventName === void 0 ? {} : { event: eventName }
+					};
+					dataLines = [];
+					eventName = void 0;
+				} else if (line.startsWith(":")) onActivity?.();
+				else if (line.startsWith("data:")) dataLines.push(line.slice(5).replace(/^ /, ""));
+				else if (line.startsWith("event:")) eventName = line.slice(6).replace(/^ /, "");
+			}
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
+//#endregion
+//#region src/translate/responses.ts
+/** Flatten a tool result's content to plain text for `function_call_output`. */
+function toolResultText$1(block) {
+	return block.content.map((part) => part.type === "text" ? part.text : "").join("");
+}
+/**
+* Convert harness messages into Responses `instructions` + `input` items.
+* System-role messages become `instructions`; an explicit `system` argument
+* wins over them when both exist. Reasoning blocks are not replayed (v1).
+* Images must arrive pre-resolved ({@link TranslatableMessage}); an unresolved
+* ImageBlock is skipped because its bytes are unreachable here.
+* @param messages - ordered conversation messages with resolved images.
+* @param system - explicit system prompt, which takes precedence.
+* @returns request fields ready to merge into the request body.
+*/
+function toResponsesInput(messages, system) {
+	const input = [];
+	const systemTexts = [];
+	for (const message of messages) {
+		if (message.role === "system") {
+			for (const block of message.content) if (block.type === "text") systemTexts.push(block.text);
+			continue;
+		}
+		const role = message.role;
+		let content = [];
+		const flushMessage = () => {
+			if (content.length === 0) return;
+			input.push({
+				type: "message",
+				role,
+				content
+			});
+			content = [];
+		};
+		for (const block of message.content) switch (block.type) {
+			case "text":
+				content.push({
+					type: role === "assistant" ? "output_text" : "input_text",
+					text: block.text
+				});
+				break;
+			case "tool-call":
+				flushMessage();
+				input.push({
+					type: "function_call",
+					call_id: String(block.id),
+					name: block.name,
+					arguments: block.arguments
+				});
+				break;
+			case "tool-result":
+				flushMessage();
+				input.push({
+					type: "function_call_output",
+					call_id: String(block.toolCallId),
+					output: toolResultText$1(block)
+				});
+				break;
+			case "image":
+				if ("dataBase64" in block) content.push({
+					type: "input_image",
+					image_url: `data:${block.mediaType};base64,${block.dataBase64}`
+				});
+				break;
+			default: break;
+		}
+		flushMessage();
+	}
+	const instructions = system ?? (systemTexts.length > 0 ? systemTexts.join("\n\n") : void 0);
+	return {
+		...instructions === void 0 ? {} : { instructions },
+		input
+	};
+}
+/**
+* Map harness tool schemas to Responses function tools.
+* @param tools - tool schemas from the request.
+* @returns Responses `tools` array entries.
+*/
+function toResponsesTools(tools) {
+	return tools.map((tool) => ({
+		type: "function",
+		name: tool.name,
+		description: tool.description,
+		parameters: tool.parameters
+	}));
+}
+/**
+* Map Responses usage to disjoint harness counts (cached input is subtracted
+* out of `inputTokens` and reported as `cacheReadTokens`).
+* @param usage - wire usage from `response.completed`.
+* @returns harness token usage.
+*/
+function mapResponsesUsage(usage) {
+	const cached = usage.input_tokens_details?.cached_tokens;
+	const reasoning = usage.output_tokens_details?.reasoning_tokens;
+	return {
+		inputTokens: usage.input_tokens - (cached ?? 0),
+		outputTokens: usage.output_tokens,
+		...cached !== void 0 ? { cacheReadTokens: cached } : {},
+		...reasoning !== void 0 ? { reasoningTokens: reasoning } : {}
+	};
+}
+/**
+* Classify a Responses failure payload into a thrown LlmError.
+* @param code - provider error code, when present.
+* @param message - provider error message, when present.
+* @returns the mapped error (context overflow, quota, otherwise SERVER).
+*/
+function responsesFailure(code, message) {
+	const text = message ?? code ?? "the provider reported a failed response";
+	const detail = `${code ?? ""} ${message ?? ""}`;
+	if (code === "context_window_exceeded" || isContextWindowExceededError(detail)) return new LlmError(text, CONTEXT_WINDOW_EXCEEDED_CODE);
+	if (code !== void 0 && /insufficient|quota/i.test(code) || isQuotaExceededError(detail)) return new LlmError(text, QUOTA_EXCEEDED_CODE);
+	return new LlmError(text, "SERVER");
+}
+/** Assemble the final ContentBlock for one open block. */
+function closeBlock$1(block) {
+	switch (block.kind) {
+		case "text": return {
+			type: "text",
+			text: block.text
+		};
+		case "reasoning": return {
+			type: "reasoning",
+			text: block.text
+		};
+		case "tool-call": return {
+			type: "tool-call",
+			id: CallId(block.callId),
+			name: block.name ?? "",
+			arguments: block.text
+		};
+	}
+}
+/**
+* Push-model Responses SSE translator: feed each parsed event object to
+* {@link push} and collect the emitted harness StreamChunks. Block indexes
+* are allocated in first-seen order; `usage` is emitted before the terminal
+* `finish`, and nothing is emitted after it. Terminal provider failures
+* throw {@link LlmError}.
+*/
+var ResponsesStreamTranslator = class {
+	blocks = /* @__PURE__ */ new Map();
+	order = [];
+	nextIndex = 0;
+	sawToolCall = false;
+	/** Set once `response.completed` produced the terminal finish chunk. */
+	terminated = false;
+	open(key, kind, chunks, callId = "", name$1) {
+		const block = {
+			index: this.nextIndex++,
+			kind,
+			text: "",
+			callId,
+			...name$1 === void 0 ? {} : { name: name$1 }
+		};
+		this.blocks.set(key, block);
+		this.order.push(block);
+		chunks.push({
+			type: "block-start",
+			index: block.index,
+			blockType: kind
+		});
+		return block;
+	}
+	textBlock(key, chunks) {
+		return this.blocks.get(key) ?? this.open(key, "text", chunks);
+	}
+	reasoningBlock(key, chunks) {
+		return this.blocks.get(key) ?? this.open(key, "reasoning", chunks);
+	}
+	close(key, chunks) {
+		const block = this.blocks.get(key);
+		if (block === void 0) return;
+		this.blocks.delete(key);
+		chunks.push({
+			type: "block-end",
+			index: block.index,
+			block: closeBlock$1(block)
+		});
+	}
+	/** Close every still-open block for one output item (prefix match on the key). */
+	closeItem(itemId, chunks) {
+		for (const key of [...this.blocks.keys()]) if (key.startsWith(`${itemId}:`)) this.close(key, chunks);
+	}
+	/** Close every still-open block (provider ended the response without done events). */
+	closeAll(chunks) {
+		for (const block of this.order) this.closeKeyIfOpen(block, chunks);
+	}
+	closeKeyIfOpen(block, chunks) {
+		for (const [key, candidate] of this.blocks) if (candidate === block) {
+			this.blocks.delete(key);
+			chunks.push({
+				type: "block-end",
+				index: block.index,
+				block: closeBlock$1(block)
+			});
+			return;
+		}
+	}
+	/**
+	* Process one parsed Responses SSE event.
+	* @param event - the parsed event object.
+	* @returns the StreamChunks this event produced (possibly none).
+	*/
+	push(event) {
+		if (this.terminated) return [];
+		const chunks = [];
+		switch (event.type) {
+			case "response.output_item.added": {
+				const item = event.item;
+				if (item?.type === "function_call" && item.id !== void 0) {
+					this.sawToolCall = true;
+					const callId = item.call_id ?? "";
+					const block = this.open(`${item.id}:call`, "tool-call", chunks, callId, item.name);
+					chunks.push({
+						type: "tool-call-delta",
+						index: block.index,
+						id: CallId(callId),
+						...item.name === void 0 ? {} : { name: item.name },
+						argumentsDelta: ""
+					});
+				}
+				return chunks;
+			}
+			case "response.output_text.delta": {
+				const key = `${event.item_id ?? ""}:text:${String(event.content_index ?? 0)}`;
+				const block = this.textBlock(key, chunks);
+				block.text += event.delta ?? "";
+				chunks.push({
+					type: "text-delta",
+					index: block.index,
+					text: event.delta ?? ""
+				});
+				return chunks;
+			}
+			case "response.reasoning_summary_text.delta":
+			case "response.reasoning_text.delta": {
+				const sub = event.summary_index ?? event.content_index ?? 0;
+				const key = `${event.item_id ?? ""}:reason:${String(sub)}`;
+				const block = this.reasoningBlock(key, chunks);
+				block.text += event.delta ?? "";
+				chunks.push({
+					type: "reasoning-delta",
+					index: block.index,
+					text: event.delta ?? ""
+				});
+				return chunks;
+			}
+			case "response.function_call_arguments.delta": {
+				const key = `${event.item_id ?? ""}:call`;
+				let block = this.blocks.get(key);
+				if (block === void 0) {
+					this.sawToolCall = true;
+					block = this.open(key, "tool-call", chunks);
+				}
+				block.text += event.delta ?? "";
+				chunks.push({
+					type: "tool-call-delta",
+					index: block.index,
+					id: CallId(block.callId),
+					...block.name === void 0 ? {} : { name: block.name },
+					argumentsDelta: event.delta ?? ""
+				});
+				return chunks;
+			}
+			case "response.output_item.done": {
+				const item = event.item;
+				if (item === void 0 || item.id === void 0) return chunks;
+				if (item.type === "function_call") {
+					const key = `${item.id}:call`;
+					const block = this.blocks.get(key);
+					if (block !== void 0 && block.text.length === 0 && item.arguments !== void 0) block.text = item.arguments;
+					this.close(key, chunks);
+				} else if (item.type === "message") {
+					if (![...this.blocks.keys()].some((key) => key.startsWith(`${item.id}:text:`))) for (const [partIndex, part] of (item.content ?? []).entries()) {
+						if (part?.type !== "output_text" || typeof part.text !== "string" || part.text.length === 0) continue;
+						const block = this.open(`${item.id}:text:${partIndex}`, "text", chunks);
+						block.text = part.text;
+						this.close(`${item.id}:text:${partIndex}`, chunks);
+					}
+					this.closeItem(item.id, chunks);
+				} else this.closeItem(item.id, chunks);
+				return chunks;
+			}
+			case "response.completed": {
+				this.terminated = true;
+				this.closeAll(chunks);
+				const usage = event.response?.usage;
+				if (usage !== void 0) chunks.push({
+					type: "usage",
+					usage: mapResponsesUsage(usage)
+				});
+				if (this.order.length === 0) chunks.push({
+					type: "finish",
+					reason: {
+						kind: "error",
+						failure: {
+							message: "model returned a completed response with no content",
+							code: EMPTY_RESPONSE_CODE
+						}
+					}
+				});
+				else chunks.push({
+					type: "finish",
+					reason: { kind: this.sawToolCall ? "tool-calls" : "stop" }
+				});
+				return chunks;
+			}
+			case "response.failed": throw responsesFailure(event.response?.error?.code, event.response?.error?.message);
+			case "response.incomplete": throw responsesFailure(event.response?.incomplete_details?.reason, event.response?.error?.message ?? `the provider reported an incomplete response (${event.response?.incomplete_details?.reason ?? "unknown reason"})`);
+			case "error": throw responsesFailure(event.code, event.message);
+			default: return chunks;
+		}
+	}
+};
+/**
+* Consume a Responses SSE byte stream and yield harness StreamChunks.
+* @param stream - raw response body.
+* @param onActivity - transport-activity callback for the idle watchdog.
+* @returns the chunk stream; throws when the stream ends before `response.completed`.
+*/
+async function* streamResponses(stream, onActivity) {
+	const translator = new ResponsesStreamTranslator();
+	for await (const sseEvent of parseSse(stream, onActivity)) {
+		let event;
+		try {
+			event = JSON.parse(sseEvent.data);
+		} catch {
+			throw new LlmError(`malformed SSE payload: ${sseEvent.data.slice(0, 120)}`, "MALFORMED_RESPONSE");
+		}
+		yield* translator.push(event);
+		if (translator.terminated) return;
+	}
+	throw new LlmError("Responses SSE stream ended before response.completed", "STREAM_CLOSED");
+}
+//#endregion
+//#region src/providers/codex.ts
+const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const CODEX_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CODEX_API_URL = "https://chatgpt.com/backend-api/codex/responses";
+const CODEX_SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const CODEX_CALLBACK_PATH = "/auth/callback";
+const CODEX_CONTEXT_WINDOW = 4e5;
+const CODEX_DEFAULT_MAX_TOKENS = 128e3;
+/** Refresh when the access token has less than this much life left. */
+const CODEX_PREEMPT_MS = 5 * 6e4;
+/** Default instruction when the request carries no system prompt. */
+const DEFAULT_CODEX_INSTRUCTIONS = "You are Codex, a coding agent based on GPT-5. Help the user with their software engineering tasks.";
+/** Refresh-grant rejections that mean the login is gone for good. */
+const PERMANENT_REFRESH_CODES = new Set([
+	"refresh_token_expired",
+	"refresh_token_reused",
+	"refresh_token_invalidated",
+	"invalid_grant"
+]);
+const CODEX_EFFORTS = [
+	{
+		id: ReasoningEffortId("minimal"),
+		name: "Minimal"
+	},
+	{
+		id: ReasoningEffortId("low"),
+		name: "Low"
+	},
+	{
+		id: ReasoningEffortId("medium"),
+		name: "Medium"
+	},
+	{
+		id: ReasoningEffortId("high"),
+		name: "High"
+	},
+	{
+		id: ReasoningEffortId("xhigh"),
+		name: "Extra High"
+	}
+];
+const CODEX_DEFAULT_EFFORT = ReasoningEffortId("high");
+/** Every gpt-5.x codex model accepts image input. */
+const CODEX_MODALITIES = ["text", "image"];
+/** Static codex flow facts for the OAuth flow engine. */
+const codexFlow = {
+	callbackPath: CODEX_CALLBACK_PATH,
+	listen: {
+		host: "localhost",
+		ports: [1455, 1457]
+	},
+	buildAuthorizeUrl({ redirectUri, state, pkce }) {
+		return `${CODEX_AUTHORIZE_URL}?${new URLSearchParams({
+			response_type: "code",
+			client_id: CODEX_CLIENT_ID,
+			redirect_uri: redirectUri,
+			scope: CODEX_SCOPE,
+			code_challenge: pkce.challenge,
+			code_challenge_method: "S256",
+			state,
+			id_token_add_organizations: "true",
+			codex_cli_simplified_flow: "true",
+			originator: "codex_cli_rs"
+		}).toString()}`;
+	}
+};
+/** Pull `chatgpt_account_id` out of an id token payload. */
+function accountIdOf(idToken) {
+	const auth = (idToken === void 0 ? void 0 : decodeJwtPayload(idToken))?.["https://api.openai.com/auth"];
+	const accountId = typeof auth === "object" && auth !== null ? auth.chatgpt_account_id : void 0;
+	if (typeof accountId !== "string" || accountId.length === 0) throw new Error("codex login did not return a chatgpt account id; cannot use the subscription");
+	return accountId;
+}
+/**
+* Decode the user-identity claims of a codex id token (pure, cheap — no
+* verification, same trust posture as {@link accountIdOf}). Claim paths
+* mirror codex-rs `login/src/token_data.rs`: the email is the top-level
+* `email` claim, falling back to `https://api.openai.com/profile`.email; the
+* plan is `https://api.openai.com/auth`.chatgpt_plan_type.
+* @param idToken - a stored or freshly issued id token, when present.
+* @returns whichever claims the token carried; empty when undecodable.
+*/
+function codexProfileClaims(idToken) {
+	const payload = idToken === void 0 ? void 0 : decodeJwtPayload(idToken);
+	if (payload === void 0) return {};
+	const profile = payload["https://api.openai.com/profile"];
+	const profileEmail = typeof profile === "object" && profile !== null ? profile.email : void 0;
+	const email = payload.email ?? profileEmail;
+	const auth = payload["https://api.openai.com/auth"];
+	const plan = typeof auth === "object" && auth !== null ? auth.chatgpt_plan_type : void 0;
+	return {
+		...typeof email === "string" && email.length > 0 ? { emailAddress: email } : {},
+		...typeof plan === "string" && plan.length > 0 ? { planType: plan } : {}
+	};
+}
+/** Build a session from a token response; expires_in wins, JWT exp is the fallback. */
+function codexSession(tokens, fallback) {
+	if (typeof tokens.access_token !== "string" || tokens.access_token.length === 0) throw new Error("codex token endpoint returned no access token");
+	const refreshToken = tokens.refresh_token ?? fallback?.refreshToken;
+	if (refreshToken === void 0) throw new Error("codex token endpoint returned no refresh token");
+	let expiresAt;
+	if (typeof tokens.expires_in === "number" && tokens.expires_in > 0) expiresAt = Date.now() + tokens.expires_in * 1e3;
+	else {
+		const exp = decodeJwtPayload(tokens.access_token)?.exp;
+		if (typeof exp === "number" && exp > 0) expiresAt = exp * 1e3;
+	}
+	if (expiresAt === void 0) throw new Error("codex token endpoint returned no usable expiry");
+	const idToken = tokens.id_token ?? fallback?.idToken;
+	const claims = {
+		...fallback?.emailAddress === void 0 ? {} : { emailAddress: fallback.emailAddress },
+		...fallback?.planType === void 0 ? {} : { planType: fallback.planType },
+		...codexProfileClaims(tokens.id_token)
+	};
+	return {
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt,
+		accountId: tokens.id_token === void 0 && fallback !== void 0 ? fallback.accountId : accountIdOf(tokens.id_token),
+		...idToken === void 0 ? {} : { idToken },
+		...claims
+	};
+}
+/**
+* Exchange an authorization code for a codex session (form-encoded grant).
+* @param code - the authorization code from the callback.
+* @param verifier - the PKCE verifier minted for the attempt.
+* @param redirectUri - the attempt's redirect URI.
+* @returns the session to store.
+*/
+async function exchangeCodexCode(code, verifier, redirectUri) {
+	const response = await fetch(CODEX_TOKEN_URL, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: redirectUri,
+			client_id: CODEX_CLIENT_ID,
+			code_verifier: verifier
+		}).toString()
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "codex");
+	return codexSession(await response.json());
+}
+/**
+* Refresh a codex session (JSON grant — unlike the code exchange).
+* @param session - the stored session.
+* @returns the fresh session to store.
+*/
+async function refreshCodex(session) {
+	const response = await fetch(CODEX_TOKEN_URL, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			client_id: CODEX_CLIENT_ID,
+			grant_type: "refresh_token",
+			refresh_token: session.refreshToken
+		})
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "codex");
+	return codexSession(await response.json(), session);
+}
+/**
+* Whether a codex refresh failure means the login is permanently gone.
+* @param error - the thrown refresh error.
+* @returns true when re-login is the only fix.
+*/
+function isCodexPermanentRefreshError(error) {
+	return error instanceof OAuthEndpointError && error.oauthCode !== void 0 && PERMANENT_REFRESH_CODES.has(error.oauthCode);
+}
+const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
+/**
+* Client version sent on the /models catalog request. The backend gates the
+* visible model list by client version: versions below ~0.101 get an empty
+* list, while current codex CLI releases get the full catalog — keep this in
+* the range of current codex CLI releases.
+*/
+const CODEX_CLIENT_VERSION = "0.147.0";
+/** Display name for a wire reasoning-effort value. */
+function effortName(effort) {
+	return effort === "xhigh" ? "Extra High" : effort.charAt(0).toUpperCase() + effort.slice(1);
+}
+/**
+* Fetch the live codex model catalog with the session's auth headers.
+* @param session - the stored session (used as-is; never refreshed here).
+* @param fetchFn - fetch implementation (injectable for tests).
+* @returns discovered models: hidden entries dropped, sorted by priority.
+*/
+async function fetchCodexModels(session, fetchFn = fetch) {
+	const response = await fetchFn(`${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`, { headers: {
+		"authorization": `Bearer ${session.accessToken}`,
+		"chatgpt-account-id": session.accountId,
+		"originator": "codex_cli_rs",
+		"accept": "application/json",
+		...attributionHeaders()
+	} });
+	if (!response.ok) throw await oauthEndpointError(response, "codex models");
+	const payload = await response.json();
+	if (!Array.isArray(payload.models)) throw new Error("codex models endpoint returned no models array");
+	const discovered = [];
+	for (const entry of payload.models) {
+		if (typeof entry.slug !== "string" || entry.slug.length === 0) continue;
+		if (entry.visibility === "hide" || entry.visibility === "none") continue;
+		const efforts = (entry.supported_reasoning_levels ?? []).filter((level) => typeof level.effort === "string" && level.effort.length > 0).map((level) => ({
+			id: ReasoningEffortId(level.effort),
+			name: effortName(level.effort),
+			...level.description === void 0 ? {} : { description: level.description }
+		}));
+		const defaultEffort = typeof entry.default_reasoning_level === "string" && entry.default_reasoning_level.length > 0 && efforts.some((effort) => effort.id === ReasoningEffortId(entry.default_reasoning_level)) ? ReasoningEffortId(entry.default_reasoning_level) : void 0;
+		discovered.push({
+			id: entry.slug,
+			name: typeof entry.display_name === "string" && entry.display_name.length > 0 ? entry.display_name : entry.slug,
+			...typeof entry.description === "string" && entry.description.length > 0 ? { description: entry.description } : {},
+			...typeof entry.context_window === "number" && entry.context_window > 0 ? { contextWindow: entry.context_window } : {},
+			...typeof entry.priority === "number" ? { priority: entry.priority } : {},
+			...efforts.length > 0 ? { reasoning: {
+				efforts,
+				...defaultEffort === void 0 ? {} : { defaultEffort }
+			} } : {}
+		});
+	}
+	discovered.sort((a, b) => (a.priority ?? Number.MAX_SAFE_INTEGER) - (b.priority ?? Number.MAX_SAFE_INTEGER));
+	if (discovered.length === 0) throw new Error(`codex models endpoint returned an empty catalog (client_version ${CODEX_CLIENT_VERSION})`);
+	return discovered;
+}
+/** Codex wire adapter: one instance serves the `codex` provider route. */
+var CodexAdapter = class extends LlmAdapter {
+	catalog = new ModelCatalogCache();
+	constructor(options) {
+		super();
+		this.options = options;
+	}
+	providerInfo(provider) {
+		return {
+			id: provider,
+			name: "ChatGPT (Codex)"
+		};
+	}
+	staticModels(provider) {
+		return this.options.models.map((model) => ({
+			provider,
+			id: model.id,
+			name: model.name ?? model.id,
+			inputModalities: model.inputModalities ?? CODEX_MODALITIES
+		}));
+	}
+	async listModels(provider) {
+		const session = await this.options.tokens.peek();
+		if (session === void 0) return [];
+		if (!this.options.discovery) return this.staticModels(provider);
+		try {
+			return (await this.catalog.get(() => fetchCodexModels(session, this.options.fetchFn))).map((model) => ({
+				provider,
+				id: model.id,
+				name: model.name,
+				...model.description === void 0 ? {} : { description: model.description },
+				inputModalities: CODEX_MODALITIES
+			}));
+		} catch (error) {
+			if (error instanceof OAuthEndpointError && error.status === 401) this.catalog.invalidate();
+			this.options.onWarn?.(`codex model discovery failed; using the built-in catalog (${errorChain(error)})`);
+			return this.staticModels(provider);
+		}
+	}
+	resolveModel(provider, model) {
+		const discovered = this.options.discovery ? this.catalog.cached()?.find((entry) => entry.id === model) : void 0;
+		const configured = this.options.models.find((entry) => entry.id === model);
+		return Promise.resolve({
+			provider,
+			id: model,
+			name: discovered?.name ?? configured?.name ?? model,
+			...discovered?.description === void 0 ? {} : { description: discovered.description },
+			inputModalities: configured?.inputModalities ?? CODEX_MODALITIES,
+			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? CODEX_CONTEXT_WINDOW },
+			defaultMaxTokens: configured?.maxTokens ?? CODEX_DEFAULT_MAX_TOKENS,
+			reasoning: discovered?.reasoning ?? {
+				efforts: CODEX_EFFORTS,
+				defaultEffort: CODEX_DEFAULT_EFFORT
+			}
+		});
+	}
+	async *stream(options) {
+		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+		try {
+			let session = await this.options.tokens.session();
+			let response = await this.request(options, session, watchdog.signal);
+			if (response.status === 401) {
+				session = await this.options.tokens.session(true);
+				response = await this.request(options, session, watchdog.signal);
+			}
+			if (!response.ok) throw await httpLlmError(response, "codex API");
+			if (response.body === null) throw new LlmError("codex API returned no response body", EMPTY_RESPONSE_CODE);
+			yield* streamResponses(response.body, () => {
+				watchdog.pulse();
+			});
+		} catch (error) {
+			throw mapFetchFailure("codex API", error, watchdog, options.signal);
+		} finally {
+			watchdog.stop();
+		}
+	}
+	async request(options, session, signal) {
+		const { instructions, input } = toResponsesInput(await resolveImages(options.messages, this.options.resolveAttachments?.(), signal), options.system);
+		const body = {
+			model: options.model,
+			instructions: instructions ?? DEFAULT_CODEX_INSTRUCTIONS,
+			input,
+			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toResponsesTools(options.tools) } : {},
+			tool_choice: "auto",
+			parallel_tool_calls: true,
+			...options.reasoningEffort !== void 0 ? { reasoning: {
+				effort: String(options.reasoningEffort),
+				summary: "auto"
+			} } : {},
+			store: false,
+			stream: true,
+			include: ["reasoning.encrypted_content"],
+			...options.sessionId !== void 0 ? { prompt_cache_key: String(options.sessionId) } : {}
+		};
+		return fetch(CODEX_API_URL, {
+			method: "POST",
+			headers: {
+				"authorization": `Bearer ${session.accessToken}`,
+				"chatgpt-account-id": session.accountId,
+				"originator": "codex_cli_rs",
+				"session-id": randomUUID(),
+				"accept": "text/event-stream",
+				"content-type": "application/json",
+				...attributionHeaders()
+			},
+			body: JSON.stringify(body),
+			signal
+		});
+	}
+};
+//#endregion
+//#region src/translate/anthropic.ts
+/**
+* The Claude Code identity block. The subscription endpoint rejects requests
+* that do not present as Claude Code, so this block is REQUIRED as the first
+* system entry on every request.
+*/
+const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+/** Flatten a tool result's content to plain text for `tool_result`. */
+function toolResultText(block) {
+	return block.content.map((part) => part.type === "text" ? part.text : "").join("");
+}
+/** Parse a tool call's raw JSON arguments into Anthropic's object-shaped `input`. */
+function parseToolInput(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
+		return {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Convert harness messages into Anthropic messages. Consecutive same-role
+* messages merge into one message with multiple content blocks; tool results
+* arrive as user messages with `tool_result` blocks; system-role messages are
+* handled by {@link toAnthropicSystem} and skipped here. Reasoning blocks are
+* not replayed (v1). Images must arrive pre-resolved
+* ({@link TranslatableMessage}); an unresolved ImageBlock is skipped because
+* its bytes are unreachable here.
+* @param messages - ordered conversation messages with resolved images.
+* @returns Anthropic messages in conversation order.
+*/
+function toAnthropicMessages(messages) {
+	const out = [];
+	for (const message of messages) {
+		if (message.role === "system") continue;
+		const role = message.role;
+		const blocks = [];
+		for (const block of message.content) switch (block.type) {
+			case "text":
+				blocks.push({
+					type: "text",
+					text: block.text
+				});
+				break;
+			case "tool-call":
+				blocks.push({
+					type: "tool_use",
+					id: String(block.id),
+					name: block.name,
+					input: parseToolInput(block.arguments)
+				});
+				break;
+			case "tool-result":
+				blocks.push({
+					type: "tool_result",
+					tool_use_id: String(block.toolCallId),
+					content: toolResultText(block),
+					...block.isError === true ? { is_error: true } : {}
+				});
+				break;
+			case "image":
+				if ("dataBase64" in block) blocks.push({
+					type: "image",
+					source: {
+						type: "base64",
+						media_type: block.mediaType,
+						data: block.dataBase64
+					}
+				});
+				break;
+			default: break;
+		}
+		if (blocks.length === 0) continue;
+		const last = out[out.length - 1];
+		if (last !== void 0 && last.role === role) last.content.push(...blocks);
+		else out.push({
+			role,
+			content: blocks
+		});
+	}
+	return out;
+}
+/**
+* Build the Anthropic `system` array: the mandatory Claude Code identity
+* block, then the explicit system prompt, then any system-role messages.
+* @param system - explicit system prompt, when set.
+* @param messages - conversation messages; their system-role text is appended.
+* @returns the system content blocks.
+*/
+function toAnthropicSystem(system, messages) {
+	const blocks = [{
+		type: "text",
+		text: CLAUDE_CODE_IDENTITY
+	}];
+	if (system !== void 0 && system.length > 0) blocks.push({
+		type: "text",
+		text: system
+	});
+	for (const message of messages ?? []) {
+		if (message.role !== "system") continue;
+		for (const block of message.content) if (block.type === "text") blocks.push({
+			type: "text",
+			text: block.text
+		});
+	}
+	return blocks;
+}
+/**
+* Map harness tool schemas to Anthropic tools.
+* @param tools - tool schemas from the request.
+* @returns Anthropic `tools` array entries.
+*/
+function toAnthropicTools(tools) {
+	return tools.map((tool) => ({
+		name: tool.name,
+		description: tool.description,
+		input_schema: tool.parameters
+	}));
+}
+/** Assemble the final ContentBlock for one open block. */
+function closeBlock(block) {
+	switch (block.kind) {
+		case "text": return {
+			type: "text",
+			text: block.text
+		};
+		case "reasoning": return {
+			type: "reasoning",
+			text: block.text
+		};
+		case "tool-call": return {
+			type: "tool-call",
+			id: CallId(block.callId),
+			name: block.name ?? "",
+			arguments: block.text
+		};
+	}
+}
+/**
+* Classify an Anthropic `error` event into a thrown LlmError.
+* @param error - the wire error object.
+* @returns the mapped error.
+*/
+function anthropicFailure(error) {
+	const type = error?.type ?? "unknown_error";
+	const message = error?.message ?? `Anthropic reported ${type}`;
+	if (type === "invalid_request_error" && /prompt is too long/i.test(message)) return new LlmError(message, CONTEXT_WINDOW_EXCEEDED_CODE);
+	if (type === "rate_limit_error") return new LlmError(message, "RATE_LIMIT");
+	if (type === "authentication_error") return new LlmError(message, "AUTH");
+	return new LlmError(message, "SERVER");
+}
+/**
+* Push-model Anthropic SSE translator: feed each parsed event object to
+* {@link push} and collect the emitted harness StreamChunks. Block indexes
+* are allocated in first-seen order; `usage` is emitted before the terminal
+* `finish`, and nothing is emitted after it. `error` events throw
+* {@link LlmError}.
+*/
+var AnthropicStreamTranslator = class {
+	blocks = /* @__PURE__ */ new Map();
+	nextIndex = 0;
+	sawAnyBlock = false;
+	pendingUsage;
+	outputTokens;
+	stopReason = "stop";
+	usageEmitted = false;
+	/** Set once `message_stop` produced the terminal finish chunk. */
+	terminated = false;
+	open(wireIndex, kind, chunks, callId = "", name$1) {
+		const block = {
+			index: this.nextIndex++,
+			kind,
+			text: "",
+			callId,
+			...name$1 === void 0 ? {} : { name: name$1 }
+		};
+		this.blocks.set(wireIndex, block);
+		this.sawAnyBlock = true;
+		chunks.push({
+			type: "block-start",
+			index: block.index,
+			blockType: kind
+		});
+		return block;
+	}
+	emitUsage(chunks) {
+		if (this.usageEmitted) return;
+		this.usageEmitted = true;
+		const usage = {
+			inputTokens: this.pendingUsage?.inputTokens ?? 0,
+			outputTokens: this.outputTokens ?? 0,
+			...this.pendingUsage?.cacheReadTokens !== void 0 ? { cacheReadTokens: this.pendingUsage.cacheReadTokens } : {},
+			...this.pendingUsage?.cacheWriteTokens !== void 0 ? { cacheWriteTokens: this.pendingUsage.cacheWriteTokens } : {}
+		};
+		chunks.push({
+			type: "usage",
+			usage
+		});
+	}
+	/**
+	* Process one parsed Anthropic SSE event.
+	* @param event - the parsed event object.
+	* @returns the StreamChunks this event produced (possibly none).
+	*/
+	push(event) {
+		if (this.terminated) return [];
+		const chunks = [];
+		switch (event.type) {
+			case "message_start": {
+				const usage = event.message?.usage;
+				if (usage !== void 0) {
+					this.pendingUsage = {
+						inputTokens: usage.input_tokens ?? 0,
+						...usage.cache_read_input_tokens !== void 0 ? { cacheReadTokens: usage.cache_read_input_tokens } : {},
+						...usage.cache_creation_input_tokens !== void 0 ? { cacheWriteTokens: usage.cache_creation_input_tokens } : {}
+					};
+					this.outputTokens = usage.output_tokens ?? this.outputTokens;
+				}
+				return chunks;
+			}
+			case "content_block_start": {
+				const wireIndex = event.index ?? 0;
+				const block = event.content_block;
+				switch (block?.type) {
+					case "text":
+						this.open(wireIndex, "text", chunks);
+						break;
+					case "thinking":
+						this.open(wireIndex, "reasoning", chunks);
+						break;
+					case "tool_use": {
+						const opened = this.open(wireIndex, "tool-call", chunks, block.id ?? "", block.name);
+						chunks.push({
+							type: "tool-call-delta",
+							index: opened.index,
+							id: CallId(opened.callId),
+							...block.name === void 0 ? {} : { name: block.name },
+							argumentsDelta: ""
+						});
+						break;
+					}
+					default: break;
+				}
+				return chunks;
+			}
+			case "content_block_delta": {
+				const wireIndex = event.index ?? 0;
+				const block = this.blocks.get(wireIndex);
+				const delta = event.delta;
+				if (block === void 0 || delta === void 0) return chunks;
+				switch (delta.type) {
+					case "text_delta":
+						block.text += delta.text ?? "";
+						chunks.push({
+							type: "text-delta",
+							index: block.index,
+							text: delta.text ?? ""
+						});
+						break;
+					case "thinking_delta":
+						block.text += delta.thinking ?? "";
+						chunks.push({
+							type: "reasoning-delta",
+							index: block.index,
+							text: delta.thinking ?? ""
+						});
+						break;
+					case "input_json_delta":
+						block.text += delta.partial_json ?? "";
+						chunks.push({
+							type: "tool-call-delta",
+							index: block.index,
+							id: CallId(block.callId),
+							...block.name === void 0 ? {} : { name: block.name },
+							argumentsDelta: delta.partial_json ?? ""
+						});
+						break;
+					default: break;
+				}
+				return chunks;
+			}
+			case "content_block_stop": {
+				const wireIndex = event.index ?? 0;
+				const block = this.blocks.get(wireIndex);
+				if (block === void 0) return chunks;
+				this.blocks.delete(wireIndex);
+				chunks.push({
+					type: "block-end",
+					index: block.index,
+					block: closeBlock(block)
+				});
+				return chunks;
+			}
+			case "message_delta":
+				if (event.usage?.output_tokens !== void 0) this.outputTokens = event.usage.output_tokens;
+				switch (event.delta?.stop_reason) {
+					case "end_turn":
+					case "stop_sequence":
+						this.stopReason = "stop";
+						break;
+					case "tool_use":
+						this.stopReason = "tool-calls";
+						break;
+					case "max_tokens":
+						this.stopReason = "max-tokens";
+						break;
+					default: break;
+				}
+				return chunks;
+			case "message_stop":
+				this.terminated = true;
+				for (const [wireIndex, block] of [...this.blocks]) {
+					this.blocks.delete(wireIndex);
+					chunks.push({
+						type: "block-end",
+						index: block.index,
+						block: closeBlock(block)
+					});
+				}
+				this.emitUsage(chunks);
+				if (this.stopReason === "stop" && !this.sawAnyBlock) chunks.push({
+					type: "finish",
+					reason: {
+						kind: "error",
+						failure: {
+							message: "model returned a completed response with no content",
+							code: EMPTY_RESPONSE_CODE
+						}
+					}
+				});
+				else chunks.push({
+					type: "finish",
+					reason: { kind: this.stopReason }
+				});
+				return chunks;
+			case "error": throw anthropicFailure(event.error);
+			default: return chunks;
+		}
+	}
+};
+/**
+* Consume an Anthropic SSE byte stream and yield harness StreamChunks.
+* @param stream - raw response body.
+* @param onActivity - transport-activity callback for the idle watchdog.
+* @returns the chunk stream; throws when the stream ends before `message_stop`.
+*/
+async function* streamAnthropic(stream, onActivity) {
+	const translator = new AnthropicStreamTranslator();
+	for await (const sseEvent of parseSse(stream, onActivity)) {
+		let event;
+		try {
+			event = JSON.parse(sseEvent.data);
+		} catch {
+			throw new LlmError(`malformed SSE payload: ${sseEvent.data.slice(0, 120)}`, "MALFORMED_RESPONSE");
+		}
+		yield* translator.push(event);
+		if (translator.terminated) return;
+	}
+	throw new LlmError("Anthropic SSE stream ended before message_stop", "STREAM_CLOSED");
+}
+//#endregion
+//#region src/providers/claude.ts
+const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+const CLAUDE_API_URL = "https://api.anthropic.com/v1/messages?beta=true";
+const CLAUDE_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+const CLAUDE_SCOPE = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+const CLAUDE_CALLBACK_PATH = "/callback";
+const CLAUDE_CONTEXT_WINDOW = 2e5;
+const CLAUDE_DEFAULT_MAX_TOKENS = 32e3;
+/** Refresh when the access token has less than this much life left. */
+const CLAUDE_PREEMPT_MS = 5 * 6e4;
+/**
+* The subscription endpoint only serves requests presenting as Claude Code,
+* so these headers impersonate the CLI; the harness attribution user-agent
+* cannot be sent here (one user-agent slot, and the CLI's wins).
+*/
+const CLAUDE_CLI_USER_AGENT = "claude-cli/2.1.97 (external, cli)";
+const CLAUDE_BETA_FLAGS = "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27";
+/** Static claude flow facts for the OAuth flow engine. */
+const claudeFlow = {
+	callbackPath: CLAUDE_CALLBACK_PATH,
+	listen: {
+		host: "localhost",
+		ports: [0]
+	},
+	buildAuthorizeUrl({ redirectUri, state, pkce }) {
+		return `${CLAUDE_AUTHORIZE_URL}?${new URLSearchParams({
+			code: "true",
+			client_id: CLAUDE_CLIENT_ID,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: CLAUDE_SCOPE,
+			code_challenge: pkce.challenge,
+			code_challenge_method: "S256",
+			state
+		}).toString()}`;
+	}
+};
+/** Best-effort account profile; login must not fail when this does. */
+async function fetchClaudeProfile(accessToken) {
+	try {
+		const response = await fetch(CLAUDE_PROFILE_URL, { headers: { authorization: `Bearer ${accessToken}` } });
+		if (!response.ok) return {};
+		const profile = await response.json();
+		const account = typeof profile.account === "object" && profile.account !== null ? profile.account : {};
+		const email = profile.emailAddress ?? profile.email ?? account.email_address ?? account.email;
+		const subscription = profile.subscriptionType ?? profile.subscription_type ?? account.subscription_type;
+		return {
+			...typeof email === "string" && email.length > 0 ? { emailAddress: email } : {},
+			...typeof subscription === "string" && subscription.length > 0 ? { subscriptionType: subscription } : {}
+		};
+	} catch {
+		return {};
+	}
+}
+/** Build a session from a token response. */
+async function claudeSession(tokens, fallbackRefreshToken, withProfile) {
+	if (typeof tokens.access_token !== "string" || tokens.access_token.length === 0) throw new Error("claude token endpoint returned no access token");
+	const refreshToken = tokens.refresh_token ?? fallbackRefreshToken;
+	if (refreshToken === void 0) throw new Error("claude token endpoint returned no refresh token");
+	if (typeof tokens.expires_in !== "number" || tokens.expires_in <= 0) throw new Error("claude token endpoint returned no usable expiry");
+	const profile = withProfile ? await fetchClaudeProfile(tokens.access_token) : {};
+	return {
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt: Date.now() + tokens.expires_in * 1e3,
+		scopes: tokens.scope ?? CLAUDE_SCOPE,
+		...profile
+	};
+}
+/**
+* Exchange an authorization code for a claude session (JSON grant).
+* @param code - the authorization code from the callback.
+* @param verifier - the PKCE verifier minted for the attempt.
+* @param redirectUri - the attempt's redirect URI.
+* @param state - the attempt's state (echoed to the token endpoint).
+* @returns the session to store.
+*/
+async function exchangeClaudeCode(code, verifier, redirectUri, state) {
+	const response = await fetch(CLAUDE_TOKEN_URL, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: redirectUri,
+			client_id: CLAUDE_CLIENT_ID,
+			code_verifier: verifier,
+			state
+		})
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "claude");
+	return claudeSession(await response.json(), void 0, true);
+}
+/**
+* Refresh a claude session (JSON grant echoing the issued scope).
+* @param session - the stored session.
+* @returns the fresh session to store.
+*/
+async function refreshClaude(session) {
+	const response = await fetch(CLAUDE_TOKEN_URL, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "refresh_token",
+			refresh_token: session.refreshToken,
+			client_id: CLAUDE_CLIENT_ID,
+			scope: session.scopes
+		})
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "claude");
+	return {
+		...await claudeSession(await response.json(), session.refreshToken, false),
+		...session.emailAddress === void 0 ? {} : { emailAddress: session.emailAddress },
+		...session.subscriptionType === void 0 ? {} : { subscriptionType: session.subscriptionType }
+	};
+}
+/**
+* Whether a claude refresh failure means the login is permanently gone.
+* @param error - the thrown refresh error.
+* @returns true when re-login is the only fix.
+*/
+function isClaudePermanentRefreshError(error) {
+	return error instanceof OAuthEndpointError && (error.oauthCode === "invalid_grant" || error.oauthCode === "invalid_token");
+}
+/** The Claude 4.5 family accepts image input. */
+const CLAUDE_MODALITIES = ["text", "image"];
+/** Claude wire adapter: one instance serves the `claude` provider route. */
+var ClaudeAdapter = class extends LlmAdapter {
+	constructor(options) {
+		super();
+		this.options = options;
+	}
+	providerInfo(provider) {
+		return {
+			id: provider,
+			name: "Claude (Subscription)"
+		};
+	}
+	async listModels(provider) {
+		if (!await this.options.tokens.hasSession()) return [];
+		return this.options.models.map((model) => ({
+			provider,
+			id: model.id,
+			name: model.name ?? model.id,
+			inputModalities: model.inputModalities ?? CLAUDE_MODALITIES
+		}));
+	}
+	resolveModel(provider, model) {
+		const configured = this.options.models.find((entry) => entry.id === model);
+		return Promise.resolve({
+			provider,
+			id: model,
+			name: configured?.name ?? model,
+			inputModalities: configured?.inputModalities ?? CLAUDE_MODALITIES,
+			context: { contextWindow: configured?.contextWindow ?? CLAUDE_CONTEXT_WINDOW },
+			defaultMaxTokens: configured?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS
+		});
+	}
+	async *stream(options) {
+		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+		try {
+			let session = await this.options.tokens.session();
+			let response = await this.request(options, session, watchdog.signal);
+			if (response.status === 401) {
+				session = await this.options.tokens.session(true);
+				response = await this.request(options, session, watchdog.signal);
+			}
+			if (!response.ok) throw await httpLlmError(response, "claude API");
+			if (response.body === null) throw new LlmError("claude API returned no response body", EMPTY_RESPONSE_CODE);
+			yield* streamAnthropic(response.body, () => {
+				watchdog.pulse();
+			});
+		} catch (error) {
+			throw mapFetchFailure("claude API", error, watchdog, options.signal);
+		} finally {
+			watchdog.stop();
+		}
+	}
+	async request(options, session, signal) {
+		const messages = await resolveImages(options.messages, this.options.resolveAttachments?.(), signal);
+		const body = {
+			model: options.model,
+			max_tokens: options.maxTokens ?? this.options.models.find((entry) => entry.id === options.model)?.maxTokens ?? CLAUDE_DEFAULT_MAX_TOKENS,
+			system: toAnthropicSystem(options.system, messages),
+			messages: toAnthropicMessages(messages),
+			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toAnthropicTools(options.tools) } : {},
+			stream: true,
+			...options.sessionId !== void 0 ? { metadata: { user_id: String(options.sessionId) } } : {}
+		};
+		return fetch(CLAUDE_API_URL, {
+			method: "POST",
+			headers: {
+				"authorization": `Bearer ${session.accessToken}`,
+				"anthropic-version": "2023-06-01",
+				"anthropic-beta": CLAUDE_BETA_FLAGS,
+				"user-agent": CLAUDE_CLI_USER_AGENT,
+				"x-app": "cli",
+				"anthropic-dangerous-direct-browser-access": "true",
+				"accept": "text/event-stream",
+				"content-type": "application/json"
+			},
+			body: JSON.stringify(body),
+			signal
+		});
+	}
+};
+//#endregion
+//#region src/providers/grok.ts
+const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const GROK_DISCOVERY_URL = "https://auth.x.ai/.well-known/openid-configuration";
+const GROK_API_URL = "https://api.x.ai/v1/responses";
+const GROK_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const GROK_CALLBACK_PATH = "/callback";
+const GROK_CONTEXT_WINDOW = 256e3;
+const GROK_DEFAULT_MAX_TOKENS = 32e3;
+/** Refresh when the access token has less than this much life left. */
+const GROK_PREEMPT_MS = 2 * 6e4;
+/** A discovered URL must be https on x.ai or a subdomain; anything else is a hostile document. */
+function assertXaiEndpoint(url, field) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`grok OIDC discovery returned an invalid ${field}`);
+	}
+	if (parsed.protocol !== "https:" || parsed.hostname !== "x.ai" && !parsed.hostname.endsWith(".x.ai")) throw new Error(`grok OIDC discovery returned a non-x.ai ${field}: ${url}`);
+	return url;
+}
+let discoveryCache;
+/**
+* Resolve the xAI OIDC endpoints (cached after the first fetch).
+* @returns validated authorization and token endpoints.
+*/
+async function grokDiscovery() {
+	if (discoveryCache !== void 0) return discoveryCache;
+	const response = await fetch(GROK_DISCOVERY_URL);
+	if (!response.ok) throw await oauthEndpointError(response, "grok OIDC discovery");
+	const document = await response.json();
+	if (typeof document.authorization_endpoint !== "string" || typeof document.token_endpoint !== "string") throw new Error("grok OIDC discovery document is missing endpoints");
+	discoveryCache = {
+		authorizationEndpoint: assertXaiEndpoint(document.authorization_endpoint, "authorization_endpoint"),
+		tokenEndpoint: assertXaiEndpoint(document.token_endpoint, "token_endpoint")
+	};
+	return discoveryCache;
+}
+/**
+* Build the grok flow facts for the OAuth flow engine (async because the
+* authorize URL comes from OIDC discovery).
+* @returns the flow spec for one attempt.
+*/
+async function grokFlow() {
+	const discovery = await grokDiscovery();
+	return {
+		callbackPath: GROK_CALLBACK_PATH,
+		listen: {
+			host: "127.0.0.1",
+			ports: [56121]
+		},
+		buildAuthorizeUrl({ redirectUri, state, pkce, nonce }) {
+			const params = new URLSearchParams({
+				response_type: "code",
+				client_id: GROK_CLIENT_ID,
+				redirect_uri: redirectUri,
+				scope: GROK_SCOPE,
+				code_challenge: pkce.challenge,
+				code_challenge_method: "S256",
+				state,
+				nonce,
+				plan: "generic",
+				referrer: "dsh-plugin-subscriptions"
+			});
+			return `${discovery.authorizationEndpoint}?${params.toString()}`;
+		}
+	};
+}
+/** Pick a display account from an id token's claims. */
+function grokAccount(idToken) {
+	const payload = idToken === void 0 ? void 0 : decodeJwtPayload(idToken);
+	const claim = payload?.email ?? payload?.preferred_username ?? payload?.name ?? payload?.sub;
+	return typeof claim === "string" && claim.length > 0 ? claim : void 0;
+}
+/** Build a session from a token response. */
+function grokSession(tokens, tokenEndpoint, fallbackRefreshToken) {
+	if (typeof tokens.access_token !== "string" || tokens.access_token.length === 0) throw new Error("grok token endpoint returned no access token");
+	const refreshToken = tokens.refresh_token ?? fallbackRefreshToken;
+	if (refreshToken === void 0) throw new Error("grok token endpoint returned no refresh token");
+	if (typeof tokens.expires_in !== "number" || tokens.expires_in <= 0) throw new Error("grok token endpoint returned no usable expiry");
+	const account = grokAccount(tokens.id_token);
+	return {
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt: Date.now() + tokens.expires_in * 1e3,
+		tokenEndpoint,
+		...typeof tokens.scope === "string" ? { scopes: tokens.scope } : {},
+		...account === void 0 ? {} : { account }
+	};
+}
+/**
+* Exchange an authorization code for a grok session (form-encoded grant that
+* echoes the PKCE challenge as well as the verifier, per the xAI flow).
+* A 403 here means the X plan lacks the API OAuth entitlement.
+* @param code - the authorization code from the callback.
+* @param verifier - the PKCE verifier minted for the attempt.
+* @param redirectUri - the attempt's redirect URI.
+* @param challenge - the PKCE challenge sent at authorize time.
+* @returns the session to store.
+*/
+async function exchangeGrokCode(code, verifier, redirectUri, challenge) {
+	const discovery = await grokDiscovery();
+	const response = await fetch(discovery.tokenEndpoint, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: GROK_CLIENT_ID,
+			code,
+			redirect_uri: redirectUri,
+			code_verifier: verifier,
+			code_challenge: challenge,
+			code_challenge_method: "S256"
+		}).toString()
+	});
+	if (response.status === 403) throw new OAuthEndpointError("grok token endpoint refused the exchange (HTTP 403): your X plan does not include the API OAuth entitlement; an X Premium or xAI subscription with API access is required", 403);
+	if (!response.ok) throw await oauthEndpointError(response, "grok");
+	return grokSession(await response.json(), discovery.tokenEndpoint);
+}
+/**
+* Refresh a grok session (form-encoded grant).
+* @param session - the stored session.
+* @returns the fresh session to store.
+*/
+async function refreshGrok(session) {
+	const response = await fetch(session.tokenEndpoint, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			client_id: GROK_CLIENT_ID,
+			refresh_token: session.refreshToken
+		}).toString()
+	});
+	if (!response.ok) throw await oauthEndpointError(response, "grok");
+	const next = grokSession(await response.json(), session.tokenEndpoint, session.refreshToken);
+	return {
+		...next,
+		...session.account === void 0 ? {} : { account: session.account },
+		...next.scopes === void 0 && session.scopes !== void 0 ? { scopes: session.scopes } : {}
+	};
+}
+/**
+* Whether a grok refresh failure means the login is permanently gone.
+* @param error - the thrown refresh error.
+* @returns true when re-login is the only fix.
+*/
+function isGrokPermanentRefreshError(error) {
+	return error instanceof OAuthEndpointError && error.oauthCode === "invalid_grant";
+}
+const GROK_MODELS_URL = "https://api.x.ai/v1/models";
+/**
+* Input modalities for one grok model: chat models (grok-4 family) accept
+* images; code and embedding models are text-only.
+*/
+function grokModalities(id) {
+	return /code|embed/i.test(id) ? ["text"] : ["text", "image"];
+}
+/**
+* The /v1/models list also serves generation models that cannot chat
+* (grok-imagine-image*, grok-imagine-video*) and embedding models; the picker
+* must not offer them. Heuristic over the id substring, verified against the
+* live catalog (grok-build-0.1 and the grok-4 family pass).
+*/
+function isChatModel(id) {
+	return !/imagine|image-|video|embed/i.test(id);
+}
+/**
+* Fetch the live grok model list.
+* @param session - the stored session (used as-is; never refreshed here).
+* @param fetchFn - fetch implementation (injectable for tests).
+* @returns discovered chat models in endpoint order (id doubles as the name).
+*/
+async function fetchGrokModels(session, fetchFn = fetch) {
+	const response = await fetchFn(GROK_MODELS_URL, { headers: {
+		"authorization": `Bearer ${session.accessToken}`,
+		"accept": "application/json",
+		...attributionHeaders()
+	} });
+	if (!response.ok) throw await oauthEndpointError(response, "grok models");
+	const payload = await response.json();
+	if (!Array.isArray(payload.data)) throw new Error("grok models endpoint returned no data array");
+	const seen = /* @__PURE__ */ new Set();
+	const discovered = [];
+	for (const entry of payload.data) {
+		if (typeof entry.id !== "string" || entry.id.length === 0 || seen.has(entry.id)) continue;
+		if (!isChatModel(entry.id)) continue;
+		seen.add(entry.id);
+		discovered.push({
+			id: entry.id,
+			name: entry.id
+		});
+	}
+	if (discovered.length === 0) throw new Error("grok models endpoint returned an empty catalog");
+	return discovered;
+}
+/** Grok wire adapter: one instance serves the `grok` provider route. */
+var GrokAdapter = class extends LlmAdapter {
+	catalog = new ModelCatalogCache();
+	constructor(options) {
+		super();
+		this.options = options;
+	}
+	providerInfo(provider) {
+		return {
+			id: provider,
+			name: "Grok (Subscription)"
+		};
+	}
+	staticModels(provider) {
+		return this.options.models.map((model) => ({
+			provider,
+			id: model.id,
+			name: model.name ?? model.id,
+			inputModalities: model.inputModalities ?? grokModalities(model.id)
+		}));
+	}
+	async listModels(provider) {
+		const session = await this.options.tokens.peek();
+		if (session === void 0) return [];
+		if (!this.options.discovery) return this.staticModels(provider);
+		try {
+			return (await this.catalog.get(() => fetchGrokModels(session, this.options.fetchFn))).map((model) => ({
+				provider,
+				id: model.id,
+				name: model.name,
+				inputModalities: grokModalities(model.id)
+			}));
+		} catch (error) {
+			if (error instanceof OAuthEndpointError && error.status === 401) this.catalog.invalidate();
+			this.options.onWarn?.(`grok model discovery failed; using the built-in catalog (${errorChain(error)})`);
+			return this.staticModels(provider);
+		}
+	}
+	resolveModel(provider, model) {
+		const discovered = this.options.discovery ? this.catalog.cached()?.find((entry) => entry.id === model) : void 0;
+		const configured = this.options.models.find((entry) => entry.id === model);
+		return Promise.resolve({
+			provider,
+			id: model,
+			name: discovered?.name ?? configured?.name ?? model,
+			inputModalities: configured?.inputModalities ?? grokModalities(model),
+			context: { contextWindow: configured?.contextWindow ?? GROK_CONTEXT_WINDOW },
+			defaultMaxTokens: configured?.maxTokens ?? GROK_DEFAULT_MAX_TOKENS
+		});
+	}
+	async *stream(options) {
+		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
+		try {
+			let session = await this.options.tokens.session();
+			let response = await this.request(options, session, watchdog.signal);
+			if (response.status === 401) {
+				session = await this.options.tokens.session(true);
+				response = await this.request(options, session, watchdog.signal);
+			}
+			if (!response.ok) throw await httpLlmError(response, "grok API");
+			if (response.body === null) throw new LlmError("grok API returned no response body", EMPTY_RESPONSE_CODE);
+			yield* streamResponses(response.body, () => {
+				watchdog.pulse();
+			});
+		} catch (error) {
+			throw mapFetchFailure("grok API", error, watchdog, options.signal);
+		} finally {
+			watchdog.stop();
+		}
+	}
+	async request(options, session, signal) {
+		const { instructions, input } = toResponsesInput(await resolveImages(options.messages, this.options.resolveAttachments?.(), signal), options.system);
+		const body = {
+			model: options.model,
+			...instructions === void 0 ? {} : { instructions },
+			input,
+			...options.tools !== void 0 && options.tools.length > 0 ? { tools: toResponsesTools(options.tools) } : {},
+			tool_choice: "auto",
+			parallel_tool_calls: true,
+			...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
+			store: false,
+			stream: true
+		};
+		return fetch(GROK_API_URL, {
+			method: "POST",
+			headers: {
+				"authorization": `Bearer ${session.accessToken}`,
+				"accept": "text/event-stream",
+				"content-type": "application/json",
+				...attributionHeaders()
+			},
+			body: JSON.stringify(body),
+			signal
+		});
+	}
+};
+//#endregion
+//#region src/tools/x-search.ts
+/** Endpoint the search request is posted to. */
+const X_SEARCH_URL = "https://api.x.ai/v1/responses";
+/** Grok model the search runs on (a catalog model of the grok provider). */
+const X_SEARCH_MODEL = "grok-4";
+/** xAI caps each handle filter list at ten entries. */
+const MAX_HANDLES = 10;
+/**
+* Validate and assemble the request facts from tool arguments. Throws plain
+* Errors for argument problems the schema DSL cannot express (non-empty
+* query, handle caps, mutually exclusive filters).
+*/
+function buildXSearchRequest(args) {
+	const query = args.query.trim();
+	if (query.length === 0) throw new Error("x_search: query must be a non-empty string");
+	const allowed = normalizeHandles(args.allowed_x_handles, "allowed_x_handles");
+	const excluded = normalizeHandles(args.excluded_x_handles, "excluded_x_handles");
+	if (allowed.length > 0 && excluded.length > 0) throw new Error("x_search: allowed_x_handles and excluded_x_handles cannot be used together");
+	const tool = { type: "x_search" };
+	if (allowed.length > 0) tool.allowed_x_handles = allowed;
+	if (excluded.length > 0) tool.excluded_x_handles = excluded;
+	if (args.from_date !== void 0 && args.from_date.trim().length > 0) tool.from_date = args.from_date.trim();
+	if (args.to_date !== void 0 && args.to_date.trim().length > 0) tool.to_date = args.to_date.trim();
+	if (args.enable_image_understanding === true) tool.enable_image_understanding = true;
+	if (args.enable_video_understanding === true) tool.enable_video_understanding = true;
+	return {
+		query,
+		tool
+	};
+}
+/** Strip `@` prefixes, drop blanks, and enforce the provider's handle cap. */
+function normalizeHandles(value, field) {
+	if (value === void 0) return [];
+	const handles = value.map((handle) => handle.trim().replace(/^@+/, "")).filter((handle) => handle.length > 0);
+	if (handles.length > MAX_HANDLES) throw new Error(`x_search: ${field} supports at most ${MAX_HANDLES} handles`);
+	return handles;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Extract the answer text and citation URLs from a Responses payload: the
+* `output_text` shortcut or message output parts for the answer, and both
+* top-level `citations` and inline `url_citation` annotations for sources.
+*/
+function parseXSearchResponse(payload) {
+	const body = isRecord(payload) ? payload : {};
+	let answer = typeof body.output_text === "string" ? body.output_text.trim() : "";
+	const citations = [];
+	const push = (url) => {
+		if (typeof url === "string" && url.length > 0 && !citations.includes(url)) citations.push(url);
+	};
+	if (Array.isArray(body.citations)) for (const citation of body.citations) push(citation);
+	const parts = [];
+	if (Array.isArray(body.output)) for (const item of body.output) {
+		if (!isRecord(item) || item.type !== "message" || !Array.isArray(item.content)) continue;
+		for (const part of item.content) {
+			if (!isRecord(part)) continue;
+			if ((part.type === "output_text" || part.type === "text") && typeof part.text === "string" && part.text.trim().length > 0) parts.push(part.text.trim());
+			if (Array.isArray(part.annotations)) {
+				for (const annotation of part.annotations) if (isRecord(annotation) && annotation.type === "url_citation") push(annotation.url);
+			}
+		}
+	}
+	if (answer.length === 0) answer = parts.join("\n\n");
+	return {
+		answer,
+		citations
+	};
+}
+/** Bound a call-card title's query. */
+function truncate$1(text, max = 60) {
+	return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+/**
+* Build the `x_search` tool definition.
+* @param options - grok session source and fetch implementation.
+* @returns the tool to register on `ctx.tools`.
+*/
+function createXSearchTool(options) {
+	return defineTool({
+		name: "x_search",
+		description: "Search X (Twitter) posts, profiles, and threads using the grok subscription's hosted xAI x_search. Use this for current discussion, reactions, or claims on X rather than general web pages.",
+		parameters: {
+			query: {
+				type: "string",
+				required: true,
+				description: "What to look up on X."
+			},
+			allowed_x_handles: {
+				type: "array",
+				items: { type: "string" },
+				description: "X handles to include exclusively (max 10)."
+			},
+			excluded_x_handles: {
+				type: "array",
+				items: { type: "string" },
+				description: "X handles to exclude (max 10)."
+			},
+			from_date: {
+				type: "string",
+				description: "Optional start date in YYYY-MM-DD format."
+			},
+			to_date: {
+				type: "string",
+				description: "Optional end date in YYYY-MM-DD format."
+			},
+			enable_image_understanding: {
+				type: "boolean",
+				description: "Whether xAI should analyze images attached to matching posts."
+			},
+			enable_video_understanding: {
+				type: "boolean",
+				description: "Whether xAI should analyze videos attached to matching posts."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				properties: {
+					answer: {
+						type: "string",
+						required: true
+					},
+					citations: {
+						type: "array",
+						items: { type: "string" },
+						required: true
+					}
+				},
+				additionalProperties: false
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.citations.length > 0 ? `${value.answer}\n\nSources:\n${value.citations.map((citation) => `- ${citation}`).join("\n")}` : value.answer
+			}],
+			presentationMeta: (_args, value) => ({
+				answer: value.answer,
+				citations: value.citations
+			})
+		},
+		presentCall: (args) => ({
+			card: "generic",
+			title: `x_search: ${truncate$1(args.query)}`,
+			kind: "search"
+		}),
+		presentResult: (_args, result) => {
+			if (result.isError || !isRecord(result.meta)) return void 0;
+			return {
+				card: "web",
+				kind: "search",
+				sources: (Array.isArray(result.meta.citations) ? result.meta.citations : []).filter((citation) => typeof citation === "string").map((url) => ({ url })),
+				...typeof result.meta.answer === "string" && result.meta.answer.length > 0 ? { answer: result.meta.answer } : {},
+				truncated: false
+			};
+		},
+		async execute(args, exec) {
+			const request = buildXSearchRequest(args);
+			const session = await options.tokens.session();
+			const response = await (options.fetchFn ?? fetch)(X_SEARCH_URL, {
+				method: "POST",
+				headers: {
+					"authorization": `Bearer ${session.accessToken}`,
+					"content-type": "application/json",
+					"accept": "application/json"
+				},
+				body: JSON.stringify({
+					model: X_SEARCH_MODEL,
+					input: [{
+						role: "user",
+						content: request.query
+					}],
+					tools: [request.tool],
+					store: false
+				}),
+				signal: exec.signal
+			});
+			if (!response.ok) throw await httpLlmError(response, "x_search");
+			return parseXSearchResponse(await response.json());
+		}
+	});
+}
+//#endregion
+//#region src/tools/image-generate.ts
+/** Endpoint the generation request is posted to. */
+const IMAGE_GENERATE_URL = "https://chatgpt.com/backend-api/codex/images/generations";
+/** The image model the codex subscription endpoint serves. */
+const IMAGE_GENERATE_MODEL = "gpt-image-2";
+/**
+* Assemble the request body from tool arguments (hand-checks the non-empty
+* prompt the schema DSL cannot express).
+*/
+function buildImageGenerateBody(args) {
+	const prompt = args.prompt.trim();
+	if (prompt.length === 0) throw new Error("image_generate: prompt must be a non-empty string");
+	return {
+		prompt,
+		model: IMAGE_GENERATE_MODEL,
+		...args.size === void 0 ? {} : { size: args.size },
+		...args.quality === void 0 ? {} : { quality: args.quality }
+	};
+}
+/**
+* Parse the generations response into decodable images. Throws when the
+* payload carries no usable `b64_json` entries.
+*/
+function parseImageGenerateResponse(payload) {
+	const body = typeof payload === "object" && payload !== null ? payload : {};
+	const entries = Array.isArray(body.data) ? body.data : [];
+	const images = [];
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		if (typeof record.b64_json !== "string" || record.b64_json.length === 0) continue;
+		images.push({
+			data: Buffer.from(record.b64_json, "base64"),
+			...typeof record.revised_prompt === "string" && record.revised_prompt.length > 0 ? { revisedPrompt: record.revised_prompt } : {}
+		});
+	}
+	if (images.length === 0) throw new Error("image_generate: the response carried no image data");
+	return images;
+}
+/** Directory the generated PNG files are written to. */
+function imagesDirectory() {
+	return dshHomePath("plugins", "subscriptions", "images");
+}
+/** Timestamped, collision-safe file name for one generated image. */
+function imageFileName(index) {
+	return `image-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}-${index}.png`;
+}
+/** Bound a call-card title's prompt. */
+function truncate(text, max = 60) {
+	return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+/**
+* Build the `image_generate` tool definition.
+* @param options - codex session source, fetch implementation, and image directory.
+* @returns the tool to register on `ctx.tools`.
+*/
+function createImageGenerateTool(options) {
+	return defineTool({
+		name: "image_generate",
+		description: "Generate an image with the ChatGPT subscription (gpt-image-2) and save it as a PNG file. Returns the saved file paths.",
+		parameters: {
+			prompt: {
+				type: "string",
+				required: true,
+				description: "What the image should show."
+			},
+			size: {
+				type: "string",
+				enum: [
+					"1024x1024",
+					"1024x1536",
+					"1536x1024",
+					"auto"
+				],
+				description: "Image dimensions; omit for the provider default."
+			},
+			quality: {
+				type: "string",
+				enum: [
+					"low",
+					"medium",
+					"high",
+					"auto"
+				],
+				description: "Rendering quality; omit for the provider default."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				properties: {
+					paths: {
+						type: "array",
+						items: { type: "string" },
+						required: true
+					},
+					revisedPrompt: { type: "string" }
+				},
+				additionalProperties: false
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Saved ${value.paths.length} image(s):\n${value.paths.map((path) => `- ${path}`).join("\n")}` + (value.revisedPrompt === void 0 ? "" : `\n\nRevised prompt: ${value.revisedPrompt}`)
+			}]
+		},
+		presentCall: (args) => ({
+			card: "generic",
+			title: `image_generate: ${truncate(args.prompt)}`
+		}),
+		async execute(args, exec) {
+			const body = buildImageGenerateBody(args);
+			const session = await options.tokens.session();
+			const response = await (options.fetchFn ?? fetch)(IMAGE_GENERATE_URL, {
+				method: "POST",
+				headers: {
+					"authorization": `Bearer ${session.accessToken}`,
+					"chatgpt-account-id": session.accountId,
+					"originator": "codex_cli_rs",
+					"content-type": "application/json",
+					"accept": "application/json"
+				},
+				body: JSON.stringify(body),
+				signal: exec.signal
+			});
+			if (!response.ok) throw await httpLlmError(response, "image_generate");
+			const images = parseImageGenerateResponse(await response.json());
+			const directory = options.imagesDir ?? imagesDirectory();
+			await mkdir(directory, { recursive: true });
+			const paths = [];
+			for (const [index, image] of images.entries()) {
+				const path = join(directory, imageFileName(index));
+				await writeFile(path, image.data);
+				paths.push(path);
+			}
+			const revisedPrompt = images.find((image) => image.revisedPrompt !== void 0)?.revisedPrompt;
+			return {
+				paths,
+				...revisedPrompt === void 0 ? {} : { revisedPrompt }
+			};
+		}
+	});
+}
+//#endregion
+//#region src/index.ts
+const name = "dsh-plugin-subscriptions";
+const inject = ["llm"];
+/** Default maximum provider idle time while one stream read is outstanding. */
+const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 3e5;
+const providerIdSchema = z.union([
+	"codex",
+	"claude",
+	"grok"
+]);
+const modelEntrySchema = z.object({
+	id: z.string().required(),
+	name: z.string(),
+	contextWindow: z.number().step(1).min(1),
+	maxTokens: z.number().step(1).min(1),
+	inputModalities: z.array(z.union(["text", "image"]))
+});
+const Config = z.object({
+	providers: z.array(providerIdSchema).default([
+		"codex",
+		"claude",
+		"grok"
+	]),
+	streamIdleTimeoutMs: z.number().min(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
+	models: z.object({
+		codex: z.array(modelEntrySchema),
+		claude: z.array(modelEntrySchema),
+		grok: z.array(modelEntrySchema)
+	})
+});
+/** Built-in catalogs used when the config does not override a provider's models. */
+const DEFAULT_MODELS = {
+	codex: [
+		{
+			id: "gpt-5.1-codex",
+			name: "GPT-5.1 Codex"
+		},
+		{
+			id: "gpt-5.1-codex-mini",
+			name: "GPT-5.1 Codex Mini"
+		},
+		{
+			id: "gpt-5.1",
+			name: "GPT-5.1"
+		}
+	],
+	claude: [
+		{
+			id: "claude-opus-4-5",
+			name: "Claude Opus 4.5",
+			maxTokens: 64e3
+		},
+		{
+			id: "claude-sonnet-4-5",
+			name: "Claude Sonnet 4.5"
+		},
+		{
+			id: "claude-haiku-4-5",
+			name: "Claude Haiku 4.5"
+		}
+	],
+	grok: [
+		{
+			id: "grok-4",
+			name: "Grok 4"
+		},
+		{
+			id: "grok-4-fast-reasoning",
+			name: "Grok 4 Fast Reasoning"
+		},
+		{
+			id: "grok-code-fast-1",
+			name: "Grok Code Fast 1"
+		}
+	]
+};
+/** Validate and detach the model catalog for every provider. */
+function resolveCatalog(models) {
+	const resolve = (provider) => {
+		const configured = models?.[provider];
+		return validateModels(configured !== void 0 && configured.length > 0 ? configured : DEFAULT_MODELS[provider], `${name}: models.${provider}`);
+	};
+	return {
+		codex: resolve("codex"),
+		claude: resolve("claude"),
+		grok: resolve("grok")
+	};
+}
+/** The display account of a stored session, for the status endpoint. */
+function accountOf(provider, session) {
+	if (session === void 0) return void 0;
+	switch (provider) {
+		case "codex": {
+			const codex = session;
+			return codex.emailAddress ?? codexProfileClaims(codex.idToken).emailAddress ?? codex.accountId;
+		}
+		case "claude": return session.emailAddress;
+		case "grok": return session.account;
+	}
+}
+/** The subscription detail of a stored session (plan type), for the status endpoint. */
+function planOf(provider, session) {
+	if (session === void 0) return void 0;
+	switch (provider) {
+		case "codex": {
+			const codex = session;
+			return codex.planType ?? codexProfileClaims(codex.idToken).planType;
+		}
+		case "claude": return session.subscriptionType;
+		case "grok": return;
+	}
+}
+/**
+* Auth operations behind the `/subscriptions-auth` RPC channel: start/complete
+* OAuth attempts in the background, feed pasted codes, cancel, and log out.
+*/
+var SubscriptionsAuthController = class {
+	/** Last login failure per provider, surfaced as `detail` until the next success. */
+	lastError = /* @__PURE__ */ new Map();
+	constructor(flows, onAuthChanged) {
+		this.flows = flows;
+		this.onAuthChanged = onAuthChanged;
+	}
+	async status(provider) {
+		const session = await getSession(provider);
+		const account = accountOf(provider, session);
+		const detail = this.lastError.get(provider) ?? planOf(provider, session);
+		return {
+			loggedIn: session !== void 0,
+			busy: this.flows.isBusy(provider),
+			...session === void 0 ? {} : { expiresAt: session.expiresAt },
+			...account === void 0 ? {} : { account },
+			...detail === void 0 ? {} : { detail }
+		};
+	}
+	async login(provider) {
+		const spec = provider === "grok" ? await grokFlow() : provider === "claude" ? claudeFlow : codexFlow;
+		const attempt = await this.flows.start(provider, spec);
+		this.complete(provider, attempt);
+		return { authorizeUrl: attempt.authorizeUrl };
+	}
+	/** Drive one attempt to a stored session; records failures for the status endpoint. */
+	async complete(provider, attempt) {
+		try {
+			const code = await attempt.waitCode();
+			const session = await this.exchange(provider, code, attempt);
+			await this.persist(provider, session);
+			this.lastError.delete(provider);
+			this.onAuthChanged(provider);
+		} catch (error) {
+			if (!(error instanceof Error && error.message === "login cancelled")) this.lastError.set(provider, errorChain(error));
+		}
+	}
+	exchange(provider, code, attempt) {
+		switch (provider) {
+			case "codex": return exchangeCodexCode(code, attempt.pkce.verifier, attempt.redirectUri);
+			case "claude": return exchangeClaudeCode(code, attempt.pkce.verifier, attempt.redirectUri, attempt.state);
+			case "grok": return exchangeGrokCode(code, attempt.pkce.verifier, attempt.redirectUri, attempt.pkce.challenge);
+		}
+	}
+	persist(provider, session) {
+		switch (provider) {
+			case "codex": return saveSession("codex", session);
+			case "claude": return saveSession("claude", session);
+			case "grok": return saveSession("grok", session);
+		}
+	}
+	manual(provider, input) {
+		const attempt = this.flows.pending(provider);
+		if (attempt === void 0) return Promise.reject(/* @__PURE__ */ new Error(`no ${provider} login attempt is in progress`));
+		attempt.manual(input);
+		return Promise.resolve();
+	}
+	cancel(provider) {
+		this.flows.pending(provider)?.cancel();
+		return Promise.resolve();
+	}
+	async logout(provider) {
+		this.flows.pending(provider)?.cancel();
+		await deleteSession(provider);
+		this.lastError.delete(provider);
+		this.onAuthChanged(provider);
+	}
+};
+function apply(ctx, config) {
+	const providers = [...new Set(config.providers ?? [...PROVIDER_IDS])];
+	const streamIdleTimeoutMs = config.streamIdleTimeoutMs ?? DEFAULT_STREAM_IDLE_TIMEOUT_MS;
+	if (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0) throw new Error(`${name}: streamIdleTimeoutMs must be a positive finite number`);
+	const catalog = resolveCatalog(config.models);
+	const overridden = new Set(PROVIDER_IDS.filter((provider) => (config.models?.[provider]?.length ?? 0) > 0));
+	const flows = new OAuthFlowManager();
+	const onWarn = (message) => {
+		ctx.logger.warn(`dsh-plugin-subscriptions: ${message}`);
+	};
+	const resolveAttachments = () => ctx.get("attachments");
+	const handles = /* @__PURE__ */ new Map();
+	const authChanged = (provider) => {
+		handles.get(provider)?.replace([provider]);
+	};
+	let codexTokens;
+	let grokTokens;
+	for (const provider of providers) switch (provider) {
+		case "codex": {
+			const tokens = new TokenManager({
+				displayName: "ChatGPT (Codex)",
+				preemptMs: CODEX_PREEMPT_MS,
+				load: () => getSession("codex"),
+				save: (session) => saveSession("codex", session),
+				remove: () => deleteSession("codex"),
+				refresh: refreshCodex,
+				isPermanent: isCodexPermanentRefreshError,
+				onRemoved: () => {
+					authChanged("codex");
+				}
+			});
+			codexTokens = tokens;
+			handles.set("codex", ctx.llm.registerAdapter(["codex"], new CodexAdapter({
+				models: catalog.codex,
+				streamIdleTimeoutMs,
+				tokens,
+				discovery: !overridden.has("codex"),
+				onWarn,
+				resolveAttachments
+			})));
+			break;
+		}
+		case "claude": {
+			const tokens = new TokenManager({
+				displayName: "Claude (Subscription)",
+				preemptMs: CLAUDE_PREEMPT_MS,
+				load: () => getSession("claude"),
+				save: (session) => saveSession("claude", session),
+				remove: () => deleteSession("claude"),
+				refresh: refreshClaude,
+				isPermanent: isClaudePermanentRefreshError,
+				onRemoved: () => {
+					authChanged("claude");
+				}
+			});
+			handles.set("claude", ctx.llm.registerAdapter(["claude"], new ClaudeAdapter({
+				models: catalog.claude,
+				streamIdleTimeoutMs,
+				tokens,
+				resolveAttachments
+			})));
+			break;
+		}
+		case "grok": {
+			const tokens = new TokenManager({
+				displayName: "Grok (Subscription)",
+				preemptMs: GROK_PREEMPT_MS,
+				load: () => getSession("grok"),
+				save: (session) => saveSession("grok", session),
+				remove: () => deleteSession("grok"),
+				refresh: refreshGrok,
+				isPermanent: isGrokPermanentRefreshError,
+				onRemoved: () => {
+					authChanged("grok");
+				}
+			});
+			grokTokens = tokens;
+			handles.set("grok", ctx.llm.registerAdapter(["grok"], new GrokAdapter({
+				models: catalog.grok,
+				streamIdleTimeoutMs,
+				tokens,
+				discovery: !overridden.has("grok"),
+				onWarn,
+				resolveAttachments
+			})));
+			break;
+		}
+	}
+	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged));
+	ctx.inject(["tools"], (toolsCtx) => {
+		if (grokTokens !== void 0) toolsCtx.tools.register(createXSearchTool({ tokens: grokTokens }));
+		if (codexTokens !== void 0) toolsCtx.tools.register(createImageGenerateTool({ tokens: codexTokens }));
+	});
+}
+//#endregion
+export { Config, DEFAULT_STREAM_IDLE_TIMEOUT_MS, apply, inject, name };