hyperclaw 5.0.0 → 5.0.2

package/dist/node-TWxRm84k.js

@@ -0,0 +1,222 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const chalk = require_chunk.__toESM(require("chalk"));
+const inquirer = require_chunk.__toESM(require("inquirer"));
+const ora = require_chunk.__toESM(require("ora"));
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+
+//#region src/commands/node.ts
+const NODES_FILE = path.default.join(os.default.homedir(), ".hyperclaw", "nodes.json");
+async function loadNodes() {
+	try {
+		return await fs_extra.default.readJson(NODES_FILE);
+	} catch {
+		return [];
+	}
+}
+async function saveNodes(nodes) {
+	await fs_extra.default.ensureDir(path.default.dirname(NODES_FILE));
+	await fs_extra.default.writeJson(NODES_FILE, nodes, { spaces: 2 });
+}
+const TYPE_EMOJI = {
+	local: "💻",
+	remote: "🖥️",
+	android: "📱",
+	raspberrypi: "🍓",
+	docker: "🐳",
+	vm: "☁️"
+};
+const STATUS_COLOR = {
+	online: chalk.default.green,
+	offline: chalk.default.red,
+	unknown: chalk.default.gray,
+	degraded: chalk.default.yellow
+};
+async function nodeList() {
+	const nodes = await loadNodes();
+	console.log(chalk.default.bold.cyan("\n  🖧  HYPERCLAW NODES\n"));
+	console.log(`  ${chalk.default.green("●")} ${chalk.default.white("Local (this machine)".padEnd(22))} ${chalk.default.cyan("[local]")}  ${chalk.default.green("online")}`);
+	console.log(`    ${chalk.default.gray(`Node.js ${process.version}  ${os.default.platform()} ${os.default.arch()}  port 18789`)}`);
+	console.log();
+	if (nodes.length === 0) {
+		console.log(chalk.default.gray("  No additional nodes registered."));
+		console.log(chalk.default.gray("  Add a remote node: hyperclaw node add\n"));
+		return;
+	}
+	for (const node of nodes) {
+		const dot = STATUS_COLOR[node.status]("●");
+		const emoji = TYPE_EMOJI[node.type];
+		const status = STATUS_COLOR[node.status](node.status);
+		console.log(`  ${dot} ${chalk.default.white(node.name.padEnd(22))} ${chalk.default.cyan(`[${node.type}]`)}  ${status}`);
+		if (node.host) console.log(`    ${chalk.default.gray(`${node.host}:${node.port || 18789}`)}`);
+		if (node.androidDeviceId) console.log(`    ${chalk.default.gray(`adb: ${node.androidDeviceId}`)}`);
+		if (node.capabilities.length > 0) console.log(`    ${chalk.default.gray("caps:")} ${node.capabilities.join(", ")}`);
+		if (node.lastSeenAt) {
+			const ago = Math.round((Date.now() - new Date(node.lastSeenAt).getTime()) / 1e3 / 60);
+			console.log(`    ${chalk.default.gray(`last seen: ${ago}m ago`)}`);
+		}
+		console.log();
+	}
+}
+async function nodeAdd() {
+	console.log(chalk.default.bold.cyan("\n  ➕ ADD NODE\n"));
+	const { type } = await inquirer.default.prompt([{
+		type: "list",
+		name: "type",
+		message: "Node type:",
+		choices: [
+			{
+				name: "🖥️  Remote server (SSH)",
+				value: "remote"
+			},
+			{
+				name: "📱  Android device (ADB)",
+				value: "android"
+			},
+			{
+				name: "🍓  Raspberry Pi",
+				value: "raspberrypi"
+			},
+			{
+				name: "🐳  Docker container",
+				value: "docker"
+			},
+			{
+				name: "☁️  VM / cloud instance",
+				value: "vm"
+			}
+		]
+	}]);
+	const { name } = await inquirer.default.prompt([{
+		type: "input",
+		name: "name",
+		message: "Node name:",
+		validate: (v) => !!v.trim() || "Required"
+	}]);
+	let extras = {};
+	if (type === "android") {
+		const { deviceId } = await inquirer.default.prompt([{
+			type: "input",
+			name: "deviceId",
+			message: "ADB device ID (run: adb devices):",
+			validate: (v) => !!v.trim() || "Required"
+		}]);
+		extras.androidDeviceId = deviceId;
+		extras.capabilities = ["channel:host", "always-on"];
+	} else {
+		const { host, port } = await inquirer.default.prompt([{
+			type: "input",
+			name: "host",
+			message: "Hostname or IP:",
+			validate: (v) => !!v.trim() || "Required"
+		}, {
+			type: "number",
+			name: "port",
+			message: "Gateway port:",
+			default: 18789
+		}]);
+		const { caps } = await inquirer.default.prompt([{
+			type: "checkbox",
+			name: "caps",
+			message: "Capabilities:",
+			choices: [
+				{
+					name: "Run agent inference",
+					value: "agent:run",
+					checked: true
+				},
+				{
+					name: "Host channel connections",
+					value: "channel:host"
+				},
+				{
+					name: "Execute code",
+					value: "code:execute"
+				},
+				{
+					name: "GPU acceleration",
+					value: "gpu"
+				},
+				{
+					name: "Always-on (24/7)",
+					value: "always-on"
+				}
+			]
+		}]);
+		extras = {
+			host,
+			port,
+			capabilities: caps
+		};
+	}
+	const node = {
+		id: name.toLowerCase().replace(/\s+/g, "-"),
+		name,
+		type,
+		status: "unknown",
+		addedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		capabilities: extras.capabilities || [],
+		...extras
+	};
+	const nodes = await loadNodes();
+	nodes.push(node);
+	await saveNodes(nodes);
+	console.log(chalk.default.green(`\n  ✔  Node added: ${name}`));
+	console.log(chalk.default.gray("  Run: hyperclaw node probe   to test the connection\n"));
+}
+async function nodeProbe(id) {
+	const nodes = await loadNodes();
+	const targets = id ? nodes.filter((n) => n.id === id) : nodes;
+	console.log(chalk.default.bold.cyan("\n  🔍 PROBING NODES\n"));
+	console.log(`  ${chalk.default.cyan("○")} Local...`);
+	await new Promise((r) => setTimeout(r, 300));
+	console.log(`  ${chalk.default.green("✔")} Local — online (${os.default.platform()} ${os.default.arch()})\n`);
+	for (const node of targets) {
+		const spinner = (0, ora.default)(`  Probing ${node.name} (${node.host || node.androidDeviceId || node.type})...`).start();
+		await new Promise((r) => setTimeout(r, 1e3));
+		try {
+			if (node.host) {
+				const axios = (await import("axios")).default;
+				const res = await axios.get(`http://${node.host}:${node.port || 18789}/api/status`, { timeout: 3e3 });
+				node.status = "online";
+				node.version = res.data?.version;
+				node.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+				spinner.succeed(`${node.name} — online${node.version ? ` (v${node.version})` : ""}`);
+			} else if (node.type === "android") {
+				const { exec } = await import("child_process");
+				const { promisify } = await import("util");
+				const execAsync = promisify(exec);
+				await execAsync(`adb -s ${node.androidDeviceId} shell echo ok`);
+				node.status = "online";
+				node.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+				spinner.succeed(`${node.name} — online (ADB connected)`);
+			} else {
+				node.status = "unknown";
+				spinner.warn(`${node.name} — probe not supported for ${node.type}`);
+			}
+		} catch {
+			node.status = "offline";
+			spinner.fail(`${node.name} — offline / unreachable`);
+		}
+		console.log();
+	}
+	await saveNodes(nodes);
+}
+async function nodeRemove(id) {
+	const nodes = await loadNodes();
+	const idx = nodes.findIndex((n) => n.id === id);
+	if (idx === -1) {
+		console.log(chalk.default.red(`\n  ✖  Node not found: ${id}\n`));
+		return;
+	}
+	nodes.splice(idx, 1);
+	await saveNodes(nodes);
+	console.log(chalk.default.green(`\n  ✔  Node removed: ${id}\n`));
+}
+
+//#endregion
+exports.nodeAdd = nodeAdd;
+exports.nodeList = nodeList;
+exports.nodeProbe = nodeProbe;
+exports.nodeRemove = nodeRemove;

package/dist/nodes-registry-C9dCFwjh.js

@@ -0,0 +1,52 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const events = require_chunk.__toESM(require("events"));
+
+//#region src/services/nodes-registry.ts
+var NodeRegistryImpl, NodeRegistry;
+var init_nodes_registry = require_chunk.__esm({ "src/services/nodes-registry.ts"() {
+	NodeRegistryImpl = class extends events.EventEmitter {
+		nodes = /* @__PURE__ */ new Map();
+		pendingCommands = /* @__PURE__ */ new Map();
+		register(node) {
+			this.nodes.set(node.nodeId, node);
+			this.emit("node:registered", node);
+		}
+		unregister(nodeId) {
+			this.nodes.delete(nodeId);
+			this.emit("node:unregistered", nodeId);
+		}
+		getNodes() {
+			return Array.from(this.nodes.values());
+		}
+		getNode(nodeId) {
+			return this.nodes.get(nodeId);
+		}
+		/** Send a command to a node. Returns result or error. */
+		async sendCommand(nodeId, cmd) {
+			const node = this.nodes.get(nodeId);
+			if (!node) return {
+				ok: false,
+				error: `Node ${nodeId} not connected`
+			};
+			return node.send(cmd);
+		}
+		/** Handle response from a node (called when node replies to a command). */
+		handleCommandResponse(cmdId, result) {
+			const pending = this.pendingCommands.get(cmdId);
+			if (pending) {
+				clearTimeout(pending.timeout);
+				this.pendingCommands.delete(cmdId);
+				pending.resolve(result);
+			}
+		}
+		updateLastSeen(nodeId) {
+			const node = this.nodes.get(nodeId);
+			if (node) node.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+		}
+	};
+	NodeRegistry = new NodeRegistryImpl();
+} });
+
+//#endregion
+init_nodes_registry();
+exports.NodeRegistry = NodeRegistry;

package/dist/nodes-registry-DKRtsbNg.js

@@ -0,0 +1,52 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const events = require_chunk.__toESM(require("events"));
+
+//#region src/services/nodes-registry.ts
+var NodeRegistryImpl, NodeRegistry;
+var init_nodes_registry = require_chunk.__esm({ "src/services/nodes-registry.ts"() {
+	NodeRegistryImpl = class extends events.EventEmitter {
+		nodes = /* @__PURE__ */ new Map();
+		pendingCommands = /* @__PURE__ */ new Map();
+		register(node) {
+			this.nodes.set(node.nodeId, node);
+			this.emit("node:registered", node);
+		}
+		unregister(nodeId) {
+			this.nodes.delete(nodeId);
+			this.emit("node:unregistered", nodeId);
+		}
+		getNodes() {
+			return Array.from(this.nodes.values());
+		}
+		getNode(nodeId) {
+			return this.nodes.get(nodeId);
+		}
+		/** Send a command to a node. Returns result or error. */
+		async sendCommand(nodeId, cmd) {
+			const node = this.nodes.get(nodeId);
+			if (!node) return {
+				ok: false,
+				error: `Node ${nodeId} not connected`
+			};
+			return node.send(cmd);
+		}
+		/** Handle response from a node (called when node replies to a command). */
+		handleCommandResponse(cmdId, result) {
+			const pending = this.pendingCommands.get(cmdId);
+			if (pending) {
+				clearTimeout(pending.timeout);
+				this.pendingCommands.delete(cmdId);
+				pending.resolve(result);
+			}
+		}
+		updateLastSeen(nodeId) {
+			const node = this.nodes.get(nodeId);
+			if (node) node.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+		}
+	};
+	NodeRegistry = new NodeRegistryImpl();
+} });
+
+//#endregion
+init_nodes_registry();
+exports.NodeRegistry = NodeRegistry;

package/dist/oauth-flow-CeaaGAz0.js

@@ -0,0 +1,150 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+const crypto = require_chunk.__toESM(require("crypto"));
+const http = require_chunk.__toESM(require("http"));
+
+//#region src/services/oauth-flow.ts
+const HC_DIR = path.default.join(os.default.homedir(), ".hyperclaw");
+const REDIRECT_PORT = 38789;
+const REDIRECT_PATH = "/oauth/callback";
+const PROVIDERS = {
+	google: {
+		authorize_url: "https://accounts.google.com/o/oauth2/v2/auth",
+		token_url: "https://oauth2.googleapis.com/token",
+		scopes: [
+			"openid",
+			"email",
+			"profile",
+			"https://www.googleapis.com/auth/aiplatform"
+		],
+		client_id: process.env.GOOGLE_OAUTH_CLIENT_ID || "",
+		client_secret: process.env.GOOGLE_OAUTH_CLIENT_SECRET
+	},
+	"google-gmail": {
+		authorize_url: "https://accounts.google.com/o/oauth2/v2/auth",
+		token_url: "https://oauth2.googleapis.com/token",
+		scopes: [
+			"openid",
+			"email",
+			"profile",
+			"https://www.googleapis.com/auth/gmail.modify",
+			"https://mail.google.com/"
+		],
+		client_id: process.env.GOOGLE_OAUTH_CLIENT_ID || "",
+		client_secret: process.env.GOOGLE_OAUTH_CLIENT_SECRET
+	},
+	microsoft: {
+		authorize_url: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+		token_url: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+		scopes: [
+			"openid",
+			"profile",
+			"offline_access",
+			"https://cognitiveservices.azure.com/.default"
+		],
+		client_id: process.env.AZURE_OAUTH_CLIENT_ID || process.env.MICROSOFT_OAUTH_CLIENT_ID || "",
+		client_secret: process.env.AZURE_OAUTH_CLIENT_SECRET || process.env.MICROSOFT_OAUTH_CLIENT_SECRET
+	}
+};
+async function runOAuthFlow(providerId, opts) {
+	const cfg = PROVIDERS[providerId];
+	if (!cfg) throw new Error(`OAuth provider "${providerId}" not configured. Supported: google, google-gmail (Gmail Pub/Sub), microsoft. Anthropic/OpenAI: use "hyperclaw auth add" (API keys) or "hyperclaw auth setup-token anthropic" for Claude Pro/Max.`);
+	const clientId = opts?.clientId || cfg.client_id || process.env.OAUTH_CLIENT_ID;
+	const clientSecret = opts?.clientSecret || cfg.client_secret || process.env.OAUTH_CLIENT_SECRET;
+	const scopes = opts?.scopes || cfg.scopes;
+	if (!clientId) {
+		const hint = providerId === "google" ? "Set GOOGLE_OAUTH_CLIENT_ID or OAUTH_CLIENT_ID. Create at: https://console.cloud.google.com/apis/credentials" : providerId === "microsoft" ? "Set AZURE_OAUTH_CLIENT_ID. Create at: https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade" : "Set OAUTH_CLIENT_ID or pass --client-id";
+		throw new Error(`OAuth client_id required. ${hint}`);
+	}
+	const codeVerifier = crypto.default.randomBytes(32).toString("base64url");
+	const codeChallenge = crypto.default.createHash("sha256").update(codeVerifier).digest("base64url");
+	const authParams = new URLSearchParams({
+		client_id: clientId,
+		redirect_uri: `http://127.0.0.1:${REDIRECT_PORT}${REDIRECT_PATH}`,
+		response_type: "code",
+		scope: scopes.join(" "),
+		code_challenge: codeChallenge,
+		code_challenge_method: "S256",
+		access_type: "offline",
+		prompt: "consent"
+	});
+	const authUrl = `${cfg.authorize_url}?${authParams}`;
+	return new Promise((resolve, reject) => {
+		const server = http.default.createServer(async (req, res) => {
+			const url = new URL(req.url || "/", `http://127.0.0.1`);
+			if (url.pathname !== REDIRECT_PATH) {
+				res.writeHead(404);
+				res.end("Not found");
+				return;
+			}
+			const code = url.searchParams.get("code");
+			const error = url.searchParams.get("error");
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			if (error) {
+				res.writeHead(400);
+				res.end(`<h1>OAuth error</h1><p>${error}</p><p>You can close this tab.</p>`);
+				server.close();
+				reject(new Error(`OAuth error: ${error}`));
+				return;
+			}
+			if (!code) {
+				res.writeHead(400);
+				res.end("<h1>No code received</h1><p>You can close this tab.</p>");
+				server.close();
+				reject(new Error("No authorization code received"));
+				return;
+			}
+			const body = new URLSearchParams({
+				grant_type: "authorization_code",
+				code,
+				redirect_uri: `http://127.0.0.1:${REDIRECT_PORT}${REDIRECT_PATH}`,
+				code_verifier: codeVerifier
+			});
+			if (clientSecret) body.set("client_secret", clientSecret);
+			body.set("client_id", clientId);
+			try {
+				const tokenRes = await fetch(cfg.token_url, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: body.toString()
+				});
+				const tokenData = await tokenRes.json();
+				if (tokenData.error) {
+					res.writeHead(400);
+					res.end(`<h1>Token error</h1><p>${tokenData.error}</p><p>You can close this tab.</p>`);
+					server.close();
+					reject(new Error(tokenData.error_description || tokenData.error));
+					return;
+				}
+				res.writeHead(200);
+				res.end("<h1>Success!</h1><p>HyperClaw has received your tokens. You can close this tab and return to the terminal.</p>");
+				server.close();
+				resolve({
+					access_token: tokenData.access_token,
+					refresh_token: tokenData.refresh_token,
+					expires_in: tokenData.expires_in
+				});
+			} catch (e) {
+				res.writeHead(500);
+				res.end(`<h1>Error</h1><p>${e.message}</p><p>You can close this tab.</p>`);
+				server.close();
+				reject(e);
+			}
+		});
+		server.listen(REDIRECT_PORT, "127.0.0.1", () => {
+			try {
+				const { exec } = require("child_process");
+				const opener = process.platform === "win32" ? `start "" "${authUrl}"` : (process.platform === "darwin" ? "open" : "xdg-open") + ` "${authUrl}"`;
+				exec(opener);
+			} catch {}
+		});
+		server.on("error", (err) => {
+			server.close();
+			reject(err);
+		});
+	});
+}
+
+//#endregion
+exports.runOAuthFlow = runOAuthFlow;

package/dist/oauth-flow-JCfporKq.js

@@ -0,0 +1,150 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+const crypto = require_chunk.__toESM(require("crypto"));
+const http = require_chunk.__toESM(require("http"));
+
+//#region src/services/oauth-flow.ts
+const HC_DIR = path.default.join(os.default.homedir(), ".hyperclaw");
+const REDIRECT_PORT = 38789;
+const REDIRECT_PATH = "/oauth/callback";
+const PROVIDERS = {
+	google: {
+		authorize_url: "https://accounts.google.com/o/oauth2/v2/auth",
+		token_url: "https://oauth2.googleapis.com/token",
+		scopes: [
+			"openid",
+			"email",
+			"profile",
+			"https://www.googleapis.com/auth/aiplatform"
+		],
+		client_id: process.env.GOOGLE_OAUTH_CLIENT_ID || "",
+		client_secret: process.env.GOOGLE_OAUTH_CLIENT_SECRET
+	},
+	"google-gmail": {
+		authorize_url: "https://accounts.google.com/o/oauth2/v2/auth",
+		token_url: "https://oauth2.googleapis.com/token",
+		scopes: [
+			"openid",
+			"email",
+			"profile",
+			"https://www.googleapis.com/auth/gmail.modify",
+			"https://mail.google.com/"
+		],
+		client_id: process.env.GOOGLE_OAUTH_CLIENT_ID || "",
+		client_secret: process.env.GOOGLE_OAUTH_CLIENT_SECRET
+	},
+	microsoft: {
+		authorize_url: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+		token_url: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+		scopes: [
+			"openid",
+			"profile",
+			"offline_access",
+			"https://cognitiveservices.azure.com/.default"
+		],
+		client_id: process.env.AZURE_OAUTH_CLIENT_ID || process.env.MICROSOFT_OAUTH_CLIENT_ID || "",
+		client_secret: process.env.AZURE_OAUTH_CLIENT_SECRET || process.env.MICROSOFT_OAUTH_CLIENT_SECRET
+	}
+};
+async function runOAuthFlow(providerId, opts) {
+	const cfg = PROVIDERS[providerId];
+	if (!cfg) throw new Error(`OAuth provider "${providerId}" not configured. Supported: google, google-gmail (Gmail Pub/Sub), microsoft. Anthropic/OpenAI: use "hyperclaw auth add" (API keys) or "hyperclaw auth setup-token anthropic" for Claude Pro/Max.`);
+	const clientId = opts?.clientId || cfg.client_id || process.env.OAUTH_CLIENT_ID;
+	const clientSecret = opts?.clientSecret || cfg.client_secret || process.env.OAUTH_CLIENT_SECRET;
+	const scopes = opts?.scopes || cfg.scopes;
+	if (!clientId) {
+		const hint = providerId === "google" ? "Set GOOGLE_OAUTH_CLIENT_ID or OAUTH_CLIENT_ID. Create at: https://console.cloud.google.com/apis/credentials" : providerId === "microsoft" ? "Set AZURE_OAUTH_CLIENT_ID. Create at: https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade" : "Set OAUTH_CLIENT_ID or pass --client-id";
+		throw new Error(`OAuth client_id required. ${hint}`);
+	}
+	const codeVerifier = crypto.default.randomBytes(32).toString("base64url");
+	const codeChallenge = crypto.default.createHash("sha256").update(codeVerifier).digest("base64url");
+	const authParams = new URLSearchParams({
+		client_id: clientId,
+		redirect_uri: `http://127.0.0.1:${REDIRECT_PORT}${REDIRECT_PATH}`,
+		response_type: "code",
+		scope: scopes.join(" "),
+		code_challenge: codeChallenge,
+		code_challenge_method: "S256",
+		access_type: "offline",
+		prompt: "consent"
+	});
+	const authUrl = `${cfg.authorize_url}?${authParams}`;
+	return new Promise((resolve, reject) => {
+		const server = http.default.createServer(async (req, res) => {
+			const url = new URL(req.url || "/", `http://127.0.0.1`);
+			if (url.pathname !== REDIRECT_PATH) {
+				res.writeHead(404);
+				res.end("Not found");
+				return;
+			}
+			const code = url.searchParams.get("code");
+			const error = url.searchParams.get("error");
+			res.setHeader("Content-Type", "text/html; charset=utf-8");
+			if (error) {
+				res.writeHead(400);
+				res.end(`<h1>OAuth error</h1><p>${error}</p><p>You can close this tab.</p>`);
+				server.close();
+				reject(new Error(`OAuth error: ${error}`));
+				return;
+			}
+			if (!code) {
+				res.writeHead(400);
+				res.end("<h1>No code received</h1><p>You can close this tab.</p>");
+				server.close();
+				reject(new Error("No authorization code received"));
+				return;
+			}
+			const body = new URLSearchParams({
+				grant_type: "authorization_code",
+				code,
+				redirect_uri: `http://127.0.0.1:${REDIRECT_PORT}${REDIRECT_PATH}`,
+				code_verifier: codeVerifier
+			});
+			if (clientSecret) body.set("client_secret", clientSecret);
+			body.set("client_id", clientId);
+			try {
+				const tokenRes = await fetch(cfg.token_url, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: body.toString()
+				});
+				const tokenData = await tokenRes.json();
+				if (tokenData.error) {
+					res.writeHead(400);
+					res.end(`<h1>Token error</h1><p>${tokenData.error}</p><p>You can close this tab.</p>`);
+					server.close();
+					reject(new Error(tokenData.error_description || tokenData.error));
+					return;
+				}
+				res.writeHead(200);
+				res.end("<h1>Success!</h1><p>HyperClaw has received your tokens. You can close this tab and return to the terminal.</p>");
+				server.close();
+				resolve({
+					access_token: tokenData.access_token,
+					refresh_token: tokenData.refresh_token,
+					expires_in: tokenData.expires_in
+				});
+			} catch (e) {
+				res.writeHead(500);
+				res.end(`<h1>Error</h1><p>${e.message}</p><p>You can close this tab.</p>`);
+				server.close();
+				reject(e);
+			}
+		});
+		server.listen(REDIRECT_PORT, "127.0.0.1", () => {
+			try {
+				const { exec } = require("child_process");
+				const opener = process.platform === "win32" ? `start "" "${authUrl}"` : (process.platform === "darwin" ? "open" : "xdg-open") + ` "${authUrl}"`;
+				exec(opener);
+			} catch {}
+		});
+		server.on("error", (err) => {
+			server.close();
+			reject(err);
+		});
+	});
+}
+
+//#endregion
+exports.runOAuthFlow = runOAuthFlow;