npm - nolo-cli - Versions diffs - 0.8.0 → 0.9.0 - Mend

nolo-cli 0.8.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (183) hide show

package/_executeModel-UD44KGZ4.js +203 -0
package/action-ZJWE3Y5S.js +28 -0
package/addContentAction-TVDBNJM5.js +26 -0
package/addDialogAgentAction-EKH774VT.js +68 -0
package/agentDeleteCommand-TCPEFJTF.js +327 -0
package/agentEmailCommands-CZ3UILZ4.js +626 -0
package/agentListCommands-SJKO2FFB.js +223 -0
package/agentMachineCommands-PSNABISZ.js +425 -0
package/agentPullCommand-O2MTUAFR.js +122 -0
package/agentRecordCommands-MH2JKFHS.js +94 -0
package/agentRunCommand-4KH6MIZR.js +110 -0
package/agentRunControl-K4VKNEHF.js +57 -0
package/agentRuntimeLocal-SKHJUWSS.js +104 -0
package/agentSlice-3WXXN4VK.js +42 -0
package/authCommand-PXFX6JDT.js +581 -0
package/authCommands-356AYWEK.js +35 -0
package/chunk-2EISRLRC.js +238 -0
package/chunk-2FTTDCD4.js +675 -0
package/chunk-2K2ECKSG.js +222 -0
package/chunk-2PUGVR6E.js +19 -0
package/chunk-3ASDTTEI.js +1774 -0
package/chunk-3EUW3WEO.js +8 -0
package/chunk-3LY4F7SV.js +9293 -0
package/chunk-3TZDXYSF.js +71 -0
package/chunk-3WYQEUBI.js +34 -0
package/chunk-4CQLVGRV.js +50 -0
package/chunk-4IJYA27C.js +342 -0
package/chunk-4K2KKCSD.js +577 -0
package/chunk-4SN6J65J.js +38 -0
package/chunk-4VNS5WPM.js +42 -0
package/chunk-4ZDM73SD.js +34 -0
package/chunk-5CS33IBL.js +301 -0
package/chunk-5KLGBAAR.js +386 -0
package/chunk-5MIDPSSK.js +206 -0
package/chunk-5MMAK75Q.js +15 -0
package/chunk-5PJ3VWCS.js +360 -0
package/chunk-63SLEOLK.js +175 -0
package/chunk-63W5N6P3.js +150 -0
package/chunk-6GANEXVO.js +231 -0
package/chunk-6HYVJV7B.js +102 -0
package/chunk-6WD3OOJS.js +20 -0
package/chunk-7OOXPE3N.js +628 -0
package/chunk-7QRKCBOP.js +1078 -0
package/chunk-ATNTHIZI.js +13 -0
package/chunk-AUQ747NZ.js +902 -0
package/chunk-AVMKZHBC.js +85 -0
package/chunk-AZPCASRE.js +36 -0
package/chunk-BBYVOSU2.js +792 -0
package/chunk-C3RUNRHT.js +51 -0
package/chunk-CF2WZF4N.js +134 -0
package/chunk-CF7PE763.js +10 -0
package/chunk-CKOJQDKR.js +198 -0
package/chunk-COMXDWNM.js +807 -0
package/chunk-CPB2YM4D.js +171 -0
package/chunk-CWMSB67P.js +34 -0
package/chunk-DCOA4QSN.js +105 -0
package/chunk-DFFIZ25G.js +30 -0
package/chunk-DWLEOOGR.js +8 -0
package/chunk-DZ3XJVET.js +231 -0
package/chunk-EHLHSX7R.js +1433 -0
package/chunk-ELRRLDWI.js +478 -0
package/chunk-EXTIQUCI.js +482 -0
package/chunk-EYEEHCU4.js +3066 -0
package/chunk-G3SUCT4W.js +8 -0
package/chunk-G43KEVSC.js +1447 -0
package/chunk-GAKEBQD6.js +30 -0
package/chunk-GBRG75BQ.js +86 -0
package/chunk-GG4AJPSR.js +191 -0
package/chunk-H33743XH.js +25 -0
package/chunk-HNMXYYJR.js +12 -0
package/chunk-I42VC5KR.js +15 -0
package/chunk-IDZTNRP2.js +85 -0
package/chunk-ISNCLGUZ.js +146 -0
package/chunk-IWX4UW2E.js +548 -0
package/chunk-JBTJAPUF.js +35 -0
package/chunk-JEXVIMYZ.js +55 -0
package/chunk-JRKKFRAV.js +537 -0
package/chunk-JZPBVBIY.js +94 -0
package/chunk-KKY4B2Q2.js +21 -0
package/chunk-KOCA5FCS.js +4750 -0
package/chunk-KQHGZWSV.js +63 -0
package/chunk-KTVVPRJS.js +138 -0
package/chunk-KUG52IAP.js +8 -0
package/chunk-KX6YBIHG.js +8 -0
package/chunk-LARL2V6G.js +9017 -0
package/chunk-LCBAMY2M.js +60 -0
package/chunk-LM6IYQ3F.js +16 -0
package/chunk-M76ECQRD.js +13658 -0
package/chunk-MGOJ5R6J.js +113 -0
package/chunk-MKMWT7SA.js +27196 -0
package/chunk-MRC4Q34M.js +188 -0
package/chunk-OLZBQWZU.js +6 -0
package/chunk-OPZYGHUC.js +89 -0
package/chunk-OWOHNGCN.js +50 -0
package/chunk-PAKN26FP.js +239 -0
package/chunk-PCWC3JTN.js +91 -0
package/chunk-PG5PNA7Y.js +939 -0
package/chunk-Q2YZULBH.js +104 -0
package/chunk-QSJ3HFEF.js +8 -0
package/chunk-QYXLLLGL.js +4519 -0
package/chunk-ROWQEJRP.js +139 -0
package/chunk-S7Z2HMCN.js +25 -0
package/chunk-SBR32ZZS.js +1901 -0
package/chunk-SH2CFQOH.js +3391 -0
package/chunk-SL35K7AH.js +226 -0
package/chunk-TILFE6LV.js +381 -0
package/chunk-TSS3XJY4.js +2052 -0
package/chunk-U4TRT5V4.js +246 -0
package/chunk-U6VC4MU4.js +8 -0
package/chunk-UAD2WT54.js +64 -0
package/chunk-UUJDGGAK.js +421 -0
package/chunk-VF4K2QE6.js +21 -0
package/chunk-VHBWHNVT.js +59 -0
package/chunk-VIDPVFP3.js +20 -0
package/chunk-VP4WJWKW.js +8882 -0
package/chunk-W4NVOSFF.js +37 -0
package/chunk-WKM6FH35.js +190 -0
package/chunk-WWC7I6TA.js +8 -0
package/chunk-X7W4TNB4.js +1550 -0
package/chunk-XE635NI4.js +1948 -0
package/chunk-XKIMRZO2.js +221 -0
package/chunk-XS466O7S.js +933 -0
package/chunk-Y5GCAMGP.js +9 -0
package/chunk-YBWOP46I.js +3272 -0
package/chunk-YPRZSPF3.js +148 -0
package/chunk-YYUCRDOK.js +69 -0
package/chunk-Z4NR32XR.js +50 -0
package/chunk-ZIG5LJ7X.js +24765 -0
package/chunk-ZNFJWEN4.js +56 -0
package/chunk-ZQ2UM4KG.js +2878 -0
package/cliExecutor-DNE7TCC4.js +36 -0
package/clipboardy-BVE3LVEH.js +12001 -0
package/createAgentAutomationAction-63OIP6X5.js +866 -0
package/createDialogAction-ZLYZDYBB.js +54 -0
package/createPageAction-AL5FSDCK.js +171 -0
package/db-HCJ5PRB5.js +271 -0
package/dbSlice-PR44QPXY.js +60 -0
package/deleteFile-4SKGPHOZ.js +41 -0
package/dialogCommands-F6YI5742.js +63 -0
package/dialogSlice-JSBNZRLR.js +148 -0
package/docCreateCommands-4CTO7ERT.js +219 -0
package/docDeleteCommands-VBWERDRG.js +180 -0
package/docReadCommands-KNP4MFYB.js +133 -0
package/docStore-ADP5VYY4.js +98 -0
package/docUpdateCommands-4BCBJQHA.js +317 -0
package/fetchMessages-U6ZHN56A.js +17 -0
package/getPricing-3E6UNPKL.js +30 -0
package/handleSendMessageAction-IJDQ6ARA.js +185 -0
package/index.js +188 -112943
package/lib-FYYBQIXS.js +19839 -0
package/localDialogRead-Z5UTAJPU.js +26 -0
package/localFirstLog-DHNOY2NA.js +19 -0
package/localRuntimeAuthority-TEGCOWX4.js +471 -0
package/localRuntimeDb-LGDF6FQP.js +12 -0
package/machineCommands-EA3M4XTN.js +779 -0
package/machineInfo-M6KB6HZN.js +10 -0
package/machineWsRunDispatch-NAPKE5ZA.js +110 -0
package/memoryCommands-O4MIPIWQ.js +476 -0
package/models-4OPOOLFS.js +9 -0
package/offlineMarxistsAgentCommand-BCPJITJL.js +242 -0
package/package.json +3 -25
package/read-RIJCIVKX.js +17 -0
package/readDocTool-GZD2N3LO.js +16 -0
package/readlineWorkspace-KMWT4T4S.js +5509 -0
package/removeDialogAgentAction-GJQJNDW6.js +73 -0
package/runAgentClientLoop-U5Q6NDTJ.js +291 -0
package/runtimeDoctorCommands-LRHLPDRC.js +289 -0
package/setDialogExtraReferencesAction-M7OQG54N.js +60 -0
package/setPrimaryDialogAgentAction-46UNFJDL.js +80 -0
package/settingSlice-FVUUH4JA.js +199 -0
package/skillSummaryMarker-42HKSXYY.js +9 -0
package/slateToRenderMarkdown-Y5IYN73U.js +7 -0
package/slateUtils-2M7MUTWX.js +19 -0
package/spaceCommands-E2CFRPZJ.js +454 -0
package/spaceSlice-L3R6IMXE.js +147 -0
package/streamAgentChatTurn-UBDAOQWE.js +4528 -0
package/tableCommands-GOFP7QKA.js +1286 -0
package/toolApiClient-QI3YBNWB.js +26 -0
package/tools-TMJXZTCA.js +85 -0
package/tuiSummaryLlmCaller-RV3THLZF.js +78 -0
package/understanding-GQKNDDWM.js +271 -0
package/updateCommands-VOSPKXFF.js +31 -0
package/updateDialogTitleAction-ZTWRDXI2.js +188 -0

package/chunk-EHLHSX7R.js ADDED Viewed

@@ -0,0 +1,1433 @@
+import {
+  writeOAuthCredential
+} from "./chunk-JZPBVBIY.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+// packages/cli/oauth/callback-server.ts
+import { createServer } from "node:http";
+var DEFAULT_CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+function parseQuery(url) {
+  const questionIndex = url.indexOf("?");
+  if (questionIndex < 0) return {};
+  const search = url.slice(questionIndex + 1);
+  const params = new URLSearchParams(search);
+  const result = {};
+  for (const [key, value] of params) {
+    result[key] = value;
+  }
+  return result;
+}
+var SUCCESS_HTML = `<!doctype html>
+<html><head><meta charset="utf-8"><title>Authorization complete</title></head>
+<body><h2>Authorization complete</h2><p>You can close this tab and return to the terminal.</p></body></html>`;
+var ERROR_HTML = `<!doctype html>
+<html><head><meta charset="utf-8"><title>Authorization error</title></head>
+<body><h2>Authorization error</h2><p>No authorization code was received. Please try again.</p></body></html>`;
+function startCallbackServerOnPort(options) {
+  const hostname = options.hostname ?? "localhost";
+  const timeoutMs = options.timeoutMs ?? DEFAULT_CALLBACK_TIMEOUT_MS;
+  const now = options.now ?? Date.now;
+  return new Promise((resolve, reject) => {
+    const deadline = now() + timeoutMs;
+    let result = null;
+    let resultResolve = null;
+    let resultReject = null;
+    let settled = false;
+    let listening = false;
+    const codePromise = new Promise((res, rej) => {
+      resultResolve = res;
+      resultReject = rej;
+    });
+    const timeoutTimer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      const err = new Error(`OAuth callback timed out after ${Math.round(timeoutMs / 1e3)}s`);
+      server.close();
+      resultReject?.(err);
+    }, Math.max(0, deadline - now()));
+    const server = createServer((req, res) => {
+      if (!req.url) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(ERROR_HTML);
+        return;
+      }
+      const query = parseQuery(req.url);
+      const code = query.code;
+      if (!code) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(ERROR_HTML);
+        return;
+      }
+      result = { code, ...query.state ? { state: query.state } : {} };
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(SUCCESS_HTML);
+      if (!settled) {
+        settled = true;
+        clearTimeout(timeoutTimer);
+        server.close();
+        resultResolve?.(result);
+      }
+    });
+    server.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutTimer);
+      server.close();
+      if (listening) {
+        resultReject?.(err);
+      } else {
+        reject(err);
+      }
+    });
+    server.listen(options.port, hostname, () => {
+      listening = true;
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        const err = new Error("OAuth callback server did not bind a TCP port.");
+        settled = true;
+        clearTimeout(timeoutTimer);
+        server.close();
+        reject(err);
+        return;
+      }
+      resolve({
+        server,
+        port: address.port,
+        waitForCode: () => codePromise,
+        close: () => {
+          clearTimeout(timeoutTimer);
+          settled = true;
+          return new Promise((res) => server.close(() => res()));
+        }
+      });
+    });
+  });
+}
+function isAddressInUse(error) {
+  return !!error && typeof error === "object" && "code" in error && error.code === "EADDRINUSE";
+}
+async function startCallbackServer(options) {
+  try {
+    return await startCallbackServerOnPort(options);
+  } catch (error) {
+    if (!options.fallbackToRandomPort || options.port === 0 || !isAddressInUse(error)) {
+      throw error;
+    }
+    return startCallbackServerOnPort({ ...options, port: 0 });
+  }
+}
+// packages/cli/oauth/pkce.ts
+import { createHash, randomBytes } from "node:crypto";
+var PKCE_VERIFIER_LENGTH = 64;
+function generatePkceVerifier(length = PKCE_VERIFIER_LENGTH) {
+  if (length < 43 || length > 128) {
+    throw new Error("PKCE verifier length must be between 43 and 128 characters.");
+  }
+  return randomBytes(length).toString("base64url").slice(0, length);
+}
+function computePkceChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function generatePkcePair(length = PKCE_VERIFIER_LENGTH) {
+  const verifier = generatePkceVerifier(length);
+  return {
+    verifier,
+    challenge: computePkceChallenge(verifier),
+    method: "S256"
+  };
+}
+// packages/cli/oauth/flows/antigravity.ts
+var decode = (s) => Buffer.from(s, "base64").toString("utf8");
+var CLIENT_ID = decode(
+  "MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ=="
+);
+var CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+var CALLBACK_PORT = 51121;
+var CALLBACK_PATH = "/oauth-callback";
+var SCOPES = [
+  "https://www.googleapis.com/auth/cloud-platform",
+  "https://www.googleapis.com/auth/userinfo.email",
+  "https://www.googleapis.com/auth/userinfo.profile",
+  "https://www.googleapis.com/auth/cclog",
+  "https://www.googleapis.com/auth/experimentsandconfigs"
+];
+var AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_URL = "https://oauth2.googleapis.com/token";
+var USERINFO_URL = "https://www.googleapis.com/oauth2/v1/userinfo?alt=json";
+var CLOUD_CODE_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+var TIER_LEGACY = "legacy-tier";
+var PROJECT_ONBOARD_MAX_ATTEMPTS = 5;
+var PROJECT_ONBOARD_INTERVAL_MS = 2e3;
+var ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
+var ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
+  ideType: "ANTIGRAVITY",
+  platform: "PLATFORM_UNSPECIFIED",
+  pluginType: "GEMINI"
+});
+function readProjectId(value) {
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  if (value && typeof value === "object" && typeof value.id === "string" && value.id.length > 0) {
+    return value.id;
+  }
+  return void 0;
+}
+function getDefaultTierId(allowedTiers) {
+  if (!allowedTiers || allowedTiers.length === 0) {
+    return TIER_LEGACY;
+  }
+  const defaultTier = allowedTiers.find(
+    (tier) => tier.isDefault && typeof tier.id === "string" && tier.id.length > 0
+  );
+  if (defaultTier?.id) {
+    return defaultTier.id;
+  }
+  return TIER_LEGACY;
+}
+async function sleep(ms) {
+  const { promise, resolve } = Promise.withResolvers();
+  setTimeout(resolve, ms);
+  return promise;
+}
+async function onboardProjectWithRetries(fetchImpl, endpoint, headers, onboardBody, onProgress) {
+  for (let attempt = 1; attempt <= PROJECT_ONBOARD_MAX_ATTEMPTS; attempt += 1) {
+    if (attempt > 1) {
+      onProgress?.(
+        `Waiting for project provisioning (attempt ${attempt}/${PROJECT_ONBOARD_MAX_ATTEMPTS})...`
+      );
+      await sleep(PROJECT_ONBOARD_INTERVAL_MS);
+    }
+    const onboardResponse = await fetchImpl(
+      `${endpoint}/v1internal:onboardUser`,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(onboardBody)
+      }
+    );
+    if (!onboardResponse.ok) {
+      const errorText = await onboardResponse.text();
+      throw new Error(
+        `onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`
+      );
+    }
+    const operation = await onboardResponse.json();
+    if (!operation.done) {
+      continue;
+    }
+    const projectId = readProjectId(operation.response?.cloudaicompanionProject);
+    if (projectId) {
+      return projectId;
+    }
+  }
+  throw new Error(
+    `onboardUser did not return a provisioned project id after ${PROJECT_ONBOARD_MAX_ATTEMPTS} attempts`
+  );
+}
+async function discoverProject(fetchImpl, accessToken, onProgress) {
+  const headers = {
+    Authorization: `Bearer ${accessToken}`,
+    "Content-Type": "application/json"
+  };
+  onProgress?.("Checking for existing project...");
+  const endpoint = CLOUD_CODE_ENDPOINT;
+  const loadResponse = await fetchImpl(`${endpoint}/v1internal:loadCodeAssist`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA
+    })
+  });
+  if (!loadResponse.ok) {
+    const errorText = await loadResponse.text();
+    throw new Error(
+      `loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`
+    );
+  }
+  const loadPayload = await loadResponse.json();
+  const existingProject = readProjectId(loadPayload.cloudaicompanionProject);
+  if (existingProject) {
+    return existingProject;
+  }
+  const tierId = getDefaultTierId(loadPayload.allowedTiers);
+  onProgress?.("Provisioning project...");
+  const onboardBody = {
+    tierId,
+    metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA
+  };
+  return onboardProjectWithRetries(
+    fetchImpl,
+    endpoint,
+    headers,
+    onboardBody,
+    onProgress
+  );
+}
+async function getUserEmail(fetchImpl, accessToken) {
+  try {
+    const response = await fetchImpl(USERINFO_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) return void 0;
+    const data = await response.json();
+    return typeof data.email === "string" ? data.email : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function generateState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+async function runAntigravityOAuthLogin(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const redirectUri = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;
+  let handle;
+  try {
+    handle = await startCallbackServer({
+      port: CALLBACK_PORT,
+      hostname: "127.0.0.1",
+      timeoutMs: 5 * 6e4
+    });
+  } catch (err) {
+    throw new Error(
+      `Failed to start Antigravity OAuth callback server on ${CALLBACK_PORT}: ${toErrorMessage(err)}`
+    );
+  }
+  try {
+    const state = generateState();
+    const pkce = await generatePkcePair();
+    const authParams = new URLSearchParams({
+      client_id: CLIENT_ID,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      scope: SCOPES.join(" "),
+      state,
+      access_type: "offline",
+      prompt: "consent"
+    });
+    const authUrl = `${AUTH_URL}?${authParams.toString()}`;
+    output.log(
+      `Open the following URL in your browser to log in to Antigravity:
+  ${authUrl}`
+    );
+    if (deps.openBrowser) {
+      try {
+        await deps.openBrowser(authUrl);
+      } catch (err) {
+        error.error(
+          `Failed to open browser automatically: ${toErrorMessage(err)}`
+        );
+      }
+    }
+    const callback = await handle.waitForCode();
+    const tokenResponse = await fetchImpl(TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID,
+        client_secret: CLIENT_SECRET,
+        code: callback.code,
+        grant_type: "authorization_code",
+        redirect_uri: redirectUri
+      })
+    });
+    if (!tokenResponse.ok) {
+      const body = await tokenResponse.text();
+      throw new Error(`Antigravity token exchange failed: ${body}`);
+    }
+    const tokenData = await tokenResponse.json();
+    if (!tokenData.refresh_token) {
+      throw new Error("No refresh token received. Please try again.");
+    }
+    const email = await getUserEmail(fetchImpl, tokenData.access_token);
+    const projectId = await discoverProject(
+      fetchImpl,
+      tokenData.access_token,
+      (message) => output.log(message)
+    );
+    const now = (deps.now ?? Date.now)();
+    return {
+      provider: "antigravity",
+      accessToken: tokenData.access_token,
+      refreshToken: tokenData.refresh_token,
+      expiresAt: now + tokenData.expires_in * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS,
+      scope: tokenData.scope,
+      obtainedAt: now,
+      metadata: {
+        projectId,
+        email
+      }
+    };
+  } finally {
+    await handle.close();
+  }
+}
+async function refreshAntigravityOAuthToken(credential) {
+  if (!credential.refreshToken) {
+    throw new Error("Antigravity credential has no refresh_token");
+  }
+  const fetchImpl = fetch;
+  const projectId = credential.metadata?.projectId ?? void 0;
+  const response = await fetchImpl(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: CLIENT_ID,
+      client_secret: CLIENT_SECRET,
+      refresh_token: credential.refreshToken,
+      grant_type: "refresh_token"
+    })
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`Antigravity token refresh failed: ${body}`);
+  }
+  const data = await response.json();
+  const now = Date.now();
+  return {
+    ...credential,
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token || credential.refreshToken,
+    expiresAt: now + data.expires_in * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS,
+    scope: data.scope ?? credential.scope,
+    obtainedAt: now
+  };
+}
+// packages/cli/oauth/flows/openai-codex.ts
+import { createHash as createHash2 } from "node:crypto";
+var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var OPENAI_CODEX_SCOPES = [
+  "openid",
+  "profile",
+  "email",
+  "offline_access",
+  "api.connectors.read",
+  "api.connectors.invoke"
+];
+var OPENAI_CODEX_DEVICE_AUTH_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+var OPENAI_CODEX_DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+var OPENAI_CODEX_DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
+var OPENAI_CODEX_DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+var OPENAI_CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+var OPENAI_CODEX_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+var OPENAI_CODEX_ORIGINATOR = "codex_cli_rs";
+var OPENAI_CODEX_CALLBACK_PORT = 1455;
+var OPENAI_CODEX_CALLBACK_PATH = "/auth/callback";
+var OPENAI_CODEX_CALLBACK_URL = `http://localhost:${OPENAI_CODEX_CALLBACK_PORT}${OPENAI_CODEX_CALLBACK_PATH}`;
+var AUTHORIZATION_CODE_GRANT_TYPE = "authorization_code";
+var REFRESH_TOKEN_GRANT_TYPE = "refresh_token";
+var DEVICE_CODE_DEFAULT_INTERVAL_MS = 5e3;
+var DEVICE_POLL_SAFETY_MARGIN_MS = 3e3;
+var DEVICE_MAX_POLLS = 120;
+async function postJson(fetchImpl, url, body, deps) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  deps?.output?.log?.(`[oauth:openai-codex] POST ${url} -> ${response.status}`);
+  return response;
+}
+async function postForm(fetchImpl, url, body, deps) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(body).toString()
+  });
+  deps?.output?.log?.(`[oauth:openai-codex] POST ${url} -> ${response.status}`);
+  return response;
+}
+async function parseJsonResponse(response) {
+  const text = await response.text().catch(() => "");
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return {};
+  }
+}
+function scopeString(scopes = OPENAI_CODEX_SCOPES) {
+  return scopes.join(" ");
+}
+function base64UrlDecode(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+var OPENAI_AUTH_CLAIM = "https://api.openai.com/auth";
+var OPENAI_PROFILE_CLAIM = "https://api.openai.com/profile";
+function readClaimString(claim, key) {
+  if (!claim || typeof claim !== "object") return void 0;
+  const value = claim[key];
+  return typeof value === "string" && value ? value : void 0;
+}
+function decodeOpenAiIdToken(idToken) {
+  if (!idToken) return {};
+  const parts = idToken.split(".");
+  if (parts.length < 2) return {};
+  try {
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    const authClaim = payload[OPENAI_AUTH_CLAIM];
+    const profileClaim = payload[OPENAI_PROFILE_CLAIM];
+    return {
+      chatgptAccountId: readClaimString(authClaim, "chatgpt_account_id") ?? (typeof payload["chatgpt_account_id"] === "string" ? payload["chatgpt_account_id"] : void 0),
+      email: readClaimString(profileClaim, "email") ?? (typeof payload["email"] === "string" ? payload["email"] : void 0),
+      payload
+    };
+  } catch {
+    return {};
+  }
+}
+function tokenResponseToCredential(token, now) {
+  const fromAccess = decodeOpenAiIdToken(token.accessToken);
+  const fromId = decodeOpenAiIdToken(token.idToken);
+  const decoded = {
+    chatgptAccountId: fromAccess.chatgptAccountId ?? fromId.chatgptAccountId,
+    email: fromAccess.email ?? fromId.email
+  };
+  const expiresAt = typeof token.expiresIn === "number" && token.expiresIn > 0 ? now + token.expiresIn * 1e3 : void 0;
+  return {
+    provider: "chatgpt",
+    accessToken: token.accessToken,
+    ...token.refreshToken ? { refreshToken: token.refreshToken } : {},
+    ...expiresAt ? { expiresAt } : {},
+    ...token.scope ? { scope: token.scope } : {},
+    ...token.idToken ? { idToken: token.idToken } : {},
+    ...decoded.chatgptAccountId ? { accountId: decoded.chatgptAccountId } : {},
+    obtainedAt: now
+  };
+}
+function extractTokenResponse(data) {
+  const accessToken = data["access_token"];
+  if (typeof accessToken !== "string" || !accessToken) return null;
+  const expiresInRaw = data["expires_in"];
+  return {
+    accessToken,
+    ...typeof data["refresh_token"] === "string" ? { refreshToken: data["refresh_token"] } : {},
+    ...typeof expiresInRaw === "number" ? { expiresIn: expiresInRaw } : {},
+    ...typeof data["scope"] === "string" ? { scope: data["scope"] } : {},
+    ...typeof data["id_token"] === "string" ? { idToken: data["id_token"] } : {}
+  };
+}
+async function startDeviceCodeFlow(deps) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const response = await postJson(
+    fetchImpl,
+    OPENAI_CODEX_DEVICE_AUTH_URL,
+    { client_id: OPENAI_CODEX_CLIENT_ID },
+    deps
+  );
+  if (!response.ok) {
+    const data2 = await parseJsonResponse(response);
+    throw new Error(
+      `OpenAI device-code start failed (HTTP ${response.status}): ${JSON.stringify(data2)}`
+    );
+  }
+  const data = await parseJsonResponse(response);
+  const deviceAuthId = data["device_auth_id"];
+  const userCode = data["user_code"];
+  if (typeof deviceAuthId !== "string" || !deviceAuthId) {
+    throw new Error("OpenAI device-code start response did not include a device_auth_id.");
+  }
+  if (typeof userCode !== "string" || !userCode) {
+    throw new Error("OpenAI device-code start response did not include a user_code.");
+  }
+  const intervalRaw = data["interval"];
+  const intervalSec = typeof intervalRaw === "number" ? intervalRaw : Number.parseInt(String(intervalRaw ?? "5"), 10) || 5;
+  return {
+    deviceAuthId,
+    userCode,
+    intervalMs: Math.max(1, intervalSec) * 1e3 + DEVICE_POLL_SAFETY_MARGIN_MS
+  };
+}
+async function pollDeviceCodeToken(args) {
+  const fetchImpl = args.deps?.fetchImpl ?? fetch;
+  const sleep3 = args.sleep ?? args.deps?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const intervalMs = args.intervalMs ?? DEVICE_CODE_DEFAULT_INTERVAL_MS;
+  const maxPolls = args.maxPolls ?? DEVICE_MAX_POLLS;
+  for (let poll = 0; poll < maxPolls; poll++) {
+    await sleep3(poll === 0 ? Math.min(intervalMs, DEVICE_CODE_DEFAULT_INTERVAL_MS) : intervalMs);
+    const response = await postJson(
+      fetchImpl,
+      OPENAI_CODEX_DEVICE_TOKEN_URL,
+      { device_auth_id: args.deviceAuthId, user_code: args.userCode },
+      args.deps
+    );
+    if (response.status === 403 || response.status === 404) {
+      args.onPending?.();
+      continue;
+    }
+    const data = await parseJsonResponse(response);
+    if (!response.ok) {
+      throw new Error(
+        `OpenAI device-code poll failed (HTTP ${response.status}): ${JSON.stringify(data)}`
+      );
+    }
+    const authorizationCode = data["authorization_code"];
+    const codeVerifier = data["code_verifier"];
+    if (typeof authorizationCode !== "string" || !authorizationCode) {
+      throw new Error("OpenAI device-code poll response missing authorization_code.");
+    }
+    if (typeof codeVerifier !== "string" || !codeVerifier) {
+      throw new Error("OpenAI device-code poll response missing code_verifier.");
+    }
+    return { authorizationCode, codeVerifier };
+  }
+  throw new Error("OpenAI device-code flow timed out waiting for user authorization.");
+}
+async function runOpenAiCodexDeviceCode(deps = {}) {
+  const now = deps.now ?? Date.now;
+  const start = await startDeviceCodeFlow(deps);
+  deps.output?.log?.("Authorize nolo-cli for ChatGPT / OpenAI Codex:");
+  deps.output?.log?.(OPENAI_CODEX_DEVICE_VERIFICATION_URL);
+  deps.output?.log?.(`Enter code: ${start.userCode}`);
+  if (deps.openBrowser) {
+    const opened = await deps.openBrowser(OPENAI_CODEX_DEVICE_VERIFICATION_URL);
+    if (!opened) deps.output?.log?.("Could not open a browser automatically. Open the URL above.");
+  } else {
+    deps.output?.log?.("Open the URL above in a browser and enter the code to approve.");
+  }
+  const { authorizationCode, codeVerifier } = await pollDeviceCodeToken({
+    deviceAuthId: start.deviceAuthId,
+    userCode: start.userCode,
+    deps,
+    intervalMs: start.intervalMs,
+    sleep: deps.sleep,
+    onPending: () => {
+      deps.output?.log?.("[oauth:openai-codex] Waiting for authorization...");
+    }
+  });
+  const credential = await exchangeCodexAuthorizationCode({
+    code: authorizationCode,
+    codeVerifier,
+    redirectUri: OPENAI_CODEX_DEVICE_REDIRECT_URI,
+    deps,
+    now
+  });
+  writeOAuthCredential("chatgpt", credential);
+  deps.output?.log?.(
+    `Saved ChatGPT OAuth credential (account=${credential.accountId ?? "unknown"}).`
+  );
+  return credential;
+}
+async function exchangeCodexAuthorizationCode(args) {
+  const fetchImpl = args.deps?.fetchImpl ?? fetch;
+  const now = args.now ?? Date.now;
+  const response = await postForm(
+    fetchImpl,
+    OPENAI_CODEX_TOKEN_URL,
+    {
+      grant_type: AUTHORIZATION_CODE_GRANT_TYPE,
+      code: args.code,
+      redirect_uri: args.redirectUri,
+      client_id: OPENAI_CODEX_CLIENT_ID,
+      code_verifier: args.codeVerifier
+    },
+    args.deps
+  );
+  const data = await parseJsonResponse(response);
+  if (!response.ok) {
+    throw new Error(
+      `OpenAI authorization-code exchange failed (HTTP ${response.status}): ${JSON.stringify(data)}`
+    );
+  }
+  const token = extractTokenResponse(data);
+  if (!token) {
+    throw new Error(`OpenAI authorization-code exchange returned no token: ${JSON.stringify(data)}`);
+  }
+  return tokenResponseToCredential(token, now());
+}
+async function exchangeAuthorizationCode(args) {
+  return exchangeCodexAuthorizationCode({
+    code: args.code,
+    codeVerifier: args.pkce.verifier,
+    redirectUri: OPENAI_CODEX_CALLBACK_URL,
+    deps: args.deps,
+    now: args.now
+  });
+}
+async function runOpenAiCodexBrowserPkce(deps = {}) {
+  const now = deps.now ?? Date.now;
+  const pkce = generatePkcePair();
+  const state = createHash2("sha256").update(`${now()}-${Math.random()}`).digest("base64url");
+  const callback = await startCallbackServer({
+    port: OPENAI_CODEX_CALLBACK_PORT,
+    now
+  });
+  try {
+    const authorizeUrl = new URL(OPENAI_CODEX_AUTHORIZE_URL);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", OPENAI_CODEX_CLIENT_ID);
+    authorizeUrl.searchParams.set("redirect_uri", OPENAI_CODEX_CALLBACK_URL);
+    authorizeUrl.searchParams.set("scope", scopeString());
+    authorizeUrl.searchParams.set("code_challenge", pkce.challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", pkce.method);
+    authorizeUrl.searchParams.set("id_token_add_organizations", "true");
+    authorizeUrl.searchParams.set("codex_cli_simplified_flow", "true");
+    authorizeUrl.searchParams.set("originator", OPENAI_CODEX_ORIGINATOR);
+    authorizeUrl.searchParams.set("state", state);
+    const authorizeUrlString = authorizeUrl.toString();
+    deps.output?.log?.("Authorize nolo-cli for ChatGPT / OpenAI Codex:");
+    deps.output?.log?.(authorizeUrlString);
+    if (deps.openBrowser) {
+      const opened = await deps.openBrowser(authorizeUrlString);
+      if (!opened) deps.output?.log?.("Could not open a browser automatically. Open the URL above.");
+    }
+    const result = await callback.waitForCode();
+    if (result.state && result.state !== state) {
+      throw new Error("OpenAI browser PKCE flow state mismatch.");
+    }
+    const credential = await exchangeAuthorizationCode({
+      code: result.code,
+      state,
+      pkce,
+      deps,
+      now
+    });
+    writeOAuthCredential("chatgpt", credential);
+    deps.output?.log?.(
+      `Saved ChatGPT OAuth credential (account=${credential.accountId ?? "unknown"}).`
+    );
+    return credential;
+  } finally {
+    await callback.close().catch(() => {
+    });
+  }
+}
+var refreshOpenAiCodexToken = async (credential, deps = {}) => {
+  if (!credential.refreshToken) {
+    throw new Error("Cannot refresh ChatGPT OAuth token without a refresh_token.");
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const now = deps.now ?? Date.now;
+  const response = await postForm(
+    fetchImpl,
+    OPENAI_CODEX_TOKEN_URL,
+    {
+      grant_type: REFRESH_TOKEN_GRANT_TYPE,
+      refresh_token: credential.refreshToken,
+      client_id: OPENAI_CODEX_CLIENT_ID,
+      scope: scopeString()
+    },
+    deps
+  );
+  const data = await parseJsonResponse(response);
+  if (!response.ok) {
+    throw new Error(
+      `OpenAI token refresh failed (HTTP ${response.status}): ${JSON.stringify(data)}`
+    );
+  }
+  const token = extractTokenResponse(data);
+  if (!token) {
+    throw new Error(`OpenAI token refresh returned no token: ${JSON.stringify(data)}`);
+  }
+  const refreshed = tokenResponseToCredential(token, now());
+  return {
+    ...refreshed,
+    refreshToken: refreshed.refreshToken ?? credential.refreshToken,
+    accountId: refreshed.accountId ?? credential.accountId
+  };
+};
+// packages/cli/oauth/flows/xai.ts
+var XAI_OAUTH_ISSUER = "https://auth.x.ai";
+var XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
+var XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+var XAI_OAUTH_REDIRECT_HOST = "127.0.0.1";
+var XAI_OAUTH_REDIRECT_PORT = 56121;
+var XAI_OAUTH_REDIRECT_PATH = "/callback";
+var XAI_OAUTH_DOCS_URL = "https://hermes-agent.nousresearch.com/docs/guides/xai-grok-oauth";
+var XAI_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS = 5e3;
+var XAI_DEVICE_CODE_MIN_INTERVAL_MS = 1e3;
+var XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS = 5e3;
+var XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS = 5 * 6e4;
+var ACCESS_TOKEN_CLIENT_SKEW_MS2 = 5 * 60 * 1e3;
+var DISCOVERY_TIMEOUT_MS = 15e3;
+var TOKEN_REQUEST_TIMEOUT_MS = 2e4;
+function validateXAIEndpoint(url, field) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid xAI ${field}: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Invalid xAI ${field}: ${url}`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!host || host !== "x.ai" && !host.endsWith(".x.ai")) {
+    throw new Error(`Invalid xAI ${field}: ${url}`);
+  }
+  return url;
+}
+function isLikelyHtmlOrCloudflareChallenge(response, bodyText) {
+  const contentType = response.headers.get("content-type") ?? "";
+  return response.headers.get("cf-mitigated") === "challenge" || /text\/html/i.test(contentType) || /<!doctype html|<html\b/i.test(bodyText) || /\b(?:cloudflare|attention required|just a moment|enable javascript and cookies|challenge-platform)\b/i.test(
+    bodyText
+  );
+}
+async function readJsonBody(response, context) {
+  let text = "";
+  try {
+    text = await response.text();
+  } catch (error) {
+    throw new Error(
+      `${context}: failed to read response body: ${toErrorMessage(error)}`
+    );
+  }
+  if (!text.trim()) {
+    if (!response.ok) {
+      throw new Error(`${context} failed (${response.status}): empty response body`);
+    }
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(text);
+    if (!isRecord(parsed)) {
+      throw new Error(`${context} returned non-object JSON`);
+    }
+    return parsed;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith(context)) {
+      throw error;
+    }
+    if (isLikelyHtmlOrCloudflareChallenge(response, text)) {
+      throw new Error(
+        `${context} failed (${response.status}): xAI returned an HTML/Cloudflare challenge instead of OAuth JSON`
+      );
+    }
+    throw new Error(
+      `${context} returned invalid JSON: ${toErrorMessage(error)}`
+    );
+  }
+}
+async function xaiOAuthDiscovery(fetchImpl, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DISCOVERY_TIMEOUT_MS;
+  let response;
+  try {
+    response = await fetchImpl(XAI_OAUTH_DISCOVERY_URL, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    throw new Error(
+      `xAI OIDC discovery failed: ${toErrorMessage(error)}`
+    );
+  }
+  if (response.status !== 200) {
+    throw new Error(`xAI OIDC discovery returned status ${response.status}.`);
+  }
+  const obj = await readJsonBody(response, "xAI OIDC discovery");
+  const authorizationEndpoint = asTrimmedString(obj.authorization_endpoint);
+  const tokenEndpoint = asTrimmedString(obj.token_endpoint);
+  if (!authorizationEndpoint || !tokenEndpoint) {
+    throw new Error("xAI OIDC discovery response was missing required endpoints.");
+  }
+  validateXAIEndpoint(authorizationEndpoint, "authorization_endpoint");
+  validateXAIEndpoint(tokenEndpoint, "token_endpoint");
+  const deviceAuthorizationEndpoint = asTrimmedString(
+    obj.device_authorization_endpoint
+  );
+  if (options.requireDeviceAuthorization) {
+    if (!deviceAuthorizationEndpoint) {
+      throw new Error(
+        "xAI OIDC discovery response was missing device_authorization_endpoint."
+      );
+    }
+    validateXAIEndpoint(deviceAuthorizationEndpoint, "device_authorization_endpoint");
+  } else if (deviceAuthorizationEndpoint) {
+    validateXAIEndpoint(deviceAuthorizationEndpoint, "device_authorization_endpoint");
+  }
+  return {
+    authorization_endpoint: authorizationEndpoint,
+    token_endpoint: tokenEndpoint,
+    ...deviceAuthorizationEndpoint ? { device_authorization_endpoint: deviceAuthorizationEndpoint } : {}
+  };
+}
+function buildXAIAuthorizeUrl(opts) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: XAI_OAUTH_CLIENT_ID,
+    redirect_uri: opts.redirectUri,
+    scope: XAI_OAUTH_SCOPE,
+    code_challenge: opts.codeChallenge,
+    code_challenge_method: "S256",
+    state: opts.state,
+    nonce: opts.nonce,
+    plan: "generic",
+    referrer: "nolo-cli"
+  });
+  return `${opts.authorizationEndpoint}?${params.toString()}`;
+}
+function generateState2() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+function parsePositiveSecondsToMs(value, fallbackMs) {
+  const sec = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : NaN;
+  if (!Number.isFinite(sec) || sec <= 0) return fallbackMs;
+  return Math.max(1, Math.floor(sec * 1e3));
+}
+function parseOAuthTokenPayload(data, context, options = {}) {
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new Error(`${context} missing access_token`);
+  }
+  const refreshToken = typeof data.refresh_token === "string" && data.refresh_token ? data.refresh_token : void 0;
+  if (options.requireRefreshToken && !refreshToken) {
+    throw new Error(`${context} missing refresh_token`);
+  }
+  const expiresIn = asOptionalFiniteNumber(data.expires_in);
+  if (expiresIn === void 0) {
+    throw new Error(`${context} missing expires_in`);
+  }
+  return {
+    accessToken: data.access_token,
+    ...refreshToken ? { refreshToken } : {},
+    expiresIn,
+    scope: typeof data.scope === "string" ? data.scope : void 0,
+    idToken: typeof data.id_token === "string" ? data.id_token : void 0
+  };
+}
+function tokenToCredential(token, now) {
+  const expiresIn = token.expiresIn;
+  return {
+    provider: "xai",
+    accessToken: token.accessToken,
+    refreshToken: token.refreshToken,
+    expiresAt: now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS2,
+    scope: token.scope,
+    idToken: token.idToken,
+    obtainedAt: now
+  };
+}
+async function exchangeXAIToken(fetchImpl, code, redirectUri, verifier) {
+  const discovery = await xaiOAuthDiscovery(fetchImpl);
+  const tokenEndpoint = validateXAIEndpoint(discovery.token_endpoint, "token_endpoint");
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: XAI_OAUTH_CLIENT_ID,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: verifier
+  });
+  let response;
+  try {
+    response = await fetchImpl(tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body,
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `xAI token exchange failed: ${toErrorMessage(error)}`
+    );
+  }
+  const data = await readJsonBody(response, "xAI token exchange");
+  if (!response.ok) {
+    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
+    throw new Error(
+      `xAI token exchange failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  return parseOAuthTokenPayload(data, "xAI token exchange response", {
+    requireRefreshToken: true
+  });
+}
+async function requestXaiDeviceCode(fetchImpl, deviceAuthorizationEndpoint) {
+  const endpoint = validateXAIEndpoint(
+    deviceAuthorizationEndpoint,
+    "device_authorization_endpoint"
+  );
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams({
+        client_id: XAI_OAUTH_CLIENT_ID,
+        scope: XAI_OAUTH_SCOPE
+      }),
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `xAI device code request failed: ${toErrorMessage(error)}`
+    );
+  }
+  const data = await readJsonBody(response, "xAI device code request");
+  if (!response.ok) {
+    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
+    throw new Error(
+      `xAI device code request failed (${response.status})${detail ? `: ${detail}` : ""}`
+    );
+  }
+  const deviceCode = asTrimmedString(data.device_code);
+  const userCode = asTrimmedString(data.user_code);
+  const verificationUri = asTrimmedString(data.verification_uri);
+  const verificationUriComplete = asTrimmedString(
+    data.verification_uri_complete
+  );
+  if (!deviceCode || !userCode || !verificationUri) {
+    throw new Error(
+      "xAI device code response is missing device_code, user_code, or verification_uri"
+    );
+  }
+  validateXAIEndpoint(verificationUri, "verification_uri");
+  if (verificationUriComplete) {
+    validateXAIEndpoint(verificationUriComplete, "verification_uri_complete");
+  }
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...verificationUriComplete ? { verificationUriComplete } : {},
+    expiresInMs: parsePositiveSecondsToMs(
+      data.expires_in,
+      XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS
+    ),
+    intervalMs: Math.max(
+      parsePositiveSecondsToMs(data.interval, XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS),
+      XAI_DEVICE_CODE_MIN_INTERVAL_MS
+    )
+  };
+}
+async function pollXaiDeviceCodeToken(args) {
+  const tokenEndpoint = validateXAIEndpoint(args.tokenEndpoint, "token_endpoint");
+  const deadlineMs = args.now() + args.expiresInMs;
+  let intervalMs = args.intervalMs;
+  while (args.now() < deadlineMs) {
+    const remainingMs = Math.max(0, deadlineMs - args.now());
+    const delayMs = Math.min(Math.max(intervalMs, XAI_DEVICE_CODE_MIN_INTERVAL_MS), remainingMs);
+    if (delayMs > 0) {
+      await args.sleep(delayMs);
+    }
+    if (args.now() >= deadlineMs) break;
+    let response;
+    try {
+      response = await args.fetchImpl(tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: XAI_DEVICE_CODE_GRANT_TYPE,
+          client_id: XAI_OAUTH_CLIENT_ID,
+          device_code: args.deviceCode
+        }),
+        signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+      });
+    } catch (error) {
+      const message = toErrorMessage(error);
+      if (/abort|timeout/i.test(message)) {
+        throw new Error(`xAI device token poll aborted or timed out: ${message}`);
+      }
+      throw new Error(`xAI device token poll failed: ${message}`);
+    }
+    let data;
+    try {
+      data = await readJsonBody(response, "xAI device token exchange");
+    } catch (error) {
+      throw error;
+    }
+    if (response.ok) {
+      return parseOAuthTokenPayload(data, "xAI device token exchange response", {
+        requireRefreshToken: true
+      });
+    }
+    const oauthError = typeof data.error === "string" ? data.error : "";
+    if (oauthError === "authorization_pending") {
+      continue;
+    }
+    if (oauthError === "slow_down") {
+      intervalMs += XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS;
+      continue;
+    }
+    if (oauthError === "access_denied" || oauthError === "authorization_denied") {
+      throw new Error("xAI device authorization was denied");
+    }
+    if (oauthError === "expired_token") {
+      throw new Error("xAI device code expired. Re-run the login.");
+    }
+    const detail = typeof data.error_description === "string" && data.error_description || oauthError || "";
+    throw new Error(
+      `xAI device token exchange failed (${response.status})${detail ? `: ${detail}` : ""}`
+    );
+  }
+  throw new Error("xAI device authorization timed out");
+}
+async function runXaiOAuthLogin(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const redirectUri = `http://${XAI_OAUTH_REDIRECT_HOST}:${XAI_OAUTH_REDIRECT_PORT}${XAI_OAUTH_REDIRECT_PATH}`;
+  let handle;
+  try {
+    handle = await startCallbackServer({
+      port: XAI_OAUTH_REDIRECT_PORT,
+      hostname: XAI_OAUTH_REDIRECT_HOST,
+      timeoutMs: 5 * 6e4
+    });
+  } catch (err) {
+    throw new Error(
+      `Failed to start xAI OAuth callback server on ${XAI_OAUTH_REDIRECT_PORT}: ${toErrorMessage(err)}`
+    );
+  }
+  try {
+    const state = generateState2();
+    const pkce = await generatePkcePair();
+    const nonce = crypto.randomUUID().replace(/-/g, "");
+    const discovery = await xaiOAuthDiscovery(fetchImpl);
+    const authUrl = buildXAIAuthorizeUrl({
+      authorizationEndpoint: discovery.authorization_endpoint,
+      redirectUri,
+      codeChallenge: pkce.challenge,
+      state,
+      nonce
+    });
+    output.log(
+      `Open the following URL in your browser to log in to xAI Grok (SuperGrok):
+  ${authUrl}
+Docs: ${XAI_OAUTH_DOCS_URL}`
+    );
+    if (deps.openBrowser) {
+      try {
+        await deps.openBrowser(authUrl);
+      } catch (err) {
+        error.error(
+          `Failed to open browser automatically: ${toErrorMessage(err)}`
+        );
+      }
+    }
+    const callback = await handle.waitForCode();
+    const token = await exchangeXAIToken(
+      fetchImpl,
+      callback.code,
+      redirectUri,
+      pkce.verifier
+    );
+    const now = (deps.now ?? Date.now)();
+    return tokenToCredential(token, now);
+  } finally {
+    await handle.close();
+  }
+}
+async function runXaiOAuthDeviceCode(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
+  const discovery = await xaiOAuthDiscovery(fetchImpl, {
+    requireDeviceAuthorization: true
+  });
+  const deviceAuthorizationEndpoint = discovery.device_authorization_endpoint;
+  if (!deviceAuthorizationEndpoint) {
+    throw new Error("xAI OIDC discovery missing device_authorization_endpoint");
+  }
+  const start = await requestXaiDeviceCode(fetchImpl, deviceAuthorizationEndpoint);
+  const browserUrl = start.verificationUriComplete ?? start.verificationUri;
+  const expiresMinutes = Math.max(1, Math.round(start.expiresInMs / 6e4));
+  output.log("Authorize nolo-cli for xAI Grok (device code / headless):");
+  output.log(`  URL: ${start.verificationUri}`);
+  if (start.verificationUriComplete) {
+    output.log(`  Complete URL: ${start.verificationUriComplete}`);
+  }
+  output.log(`  Code: ${start.userCode}`);
+  output.log(
+    `  Code expires in ~${expiresMinutes} minute(s). Never share the code or tokens.`
+  );
+  if (deps.openBrowser) {
+    try {
+      const opened = await deps.openBrowser(browserUrl);
+      if (!opened) {
+        output.log("Could not open a browser automatically. Open the URL above.");
+      }
+    } catch (err) {
+      error.error(
+        `Failed to open browser automatically: ${toErrorMessage(err)}`
+      );
+    }
+  } else {
+    output.log("Open the URL above in a browser and enter the code to approve.");
+  }
+  const token = await pollXaiDeviceCodeToken({
+    fetchImpl,
+    tokenEndpoint: discovery.token_endpoint,
+    deviceCode: start.deviceCode,
+    expiresInMs: start.expiresInMs,
+    intervalMs: start.intervalMs,
+    sleep: sleep3,
+    now
+  });
+  return tokenToCredential(token, now());
+}
+async function refreshXaiOAuthToken(credential) {
+  if (!credential.refreshToken) {
+    throw new Error("xAI credential has no refresh_token");
+  }
+  const fetchImpl = fetch;
+  const discovery = await xaiOAuthDiscovery(fetchImpl);
+  const tokenEndpoint = validateXAIEndpoint(discovery.token_endpoint, "token_endpoint");
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: XAI_OAUTH_CLIENT_ID,
+    refresh_token: credential.refreshToken
+  });
+  let response;
+  try {
+    response = await fetchImpl(tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body,
+      signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `xAI token refresh failed: ${toErrorMessage(error)}`
+    );
+  }
+  const data = await readJsonBody(response, "xAI token refresh");
+  if (!response.ok) {
+    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
+    throw new Error(
+      `xAI token refresh failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new Error("xAI token refresh response missing access_token");
+  }
+  const expiresIn = asOptionalFiniteNumber(data.expires_in);
+  if (expiresIn === void 0) {
+    throw new Error("xAI token refresh response missing expires_in");
+  }
+  const newRefresh = typeof data.refresh_token === "string" && data.refresh_token ? data.refresh_token : credential.refreshToken;
+  const now = Date.now();
+  return {
+    ...credential,
+    accessToken: data.access_token,
+    refreshToken: newRefresh,
+    expiresAt: now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS2,
+    obtainedAt: now
+  };
+}
+// packages/cli/oauth/flows/cursor.ts
+var CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
+var CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
+var CURSOR_REFRESH_URL = "https://api2.cursor.sh/auth/exchange_user_api_key";
+var POLL_MAX_ATTEMPTS = 150;
+var POLL_BASE_DELAY_MS = 1e3;
+var POLL_MAX_DELAY_MS = 1e4;
+var POLL_BACKOFF_MULTIPLIER = 1.2;
+var POLL_MAX_CONSECUTIVE_ERRORS = 3;
+var ACCESS_TOKEN_CLIENT_SKEW_MS3 = 5 * 60 * 1e3;
+function decodeJwtExp(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return void 0;
+    const payload = parts[1];
+    if (!payload) return void 0;
+    const decoded = JSON.parse(
+      Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
+    );
+    if (decoded && typeof decoded === "object" && typeof decoded.exp === "number") {
+      return decoded.exp * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS3;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function sleep2(ms, signal) {
+  if (signal) {
+    return new Promise((resolve, reject) => {
+      if (signal.aborted) {
+        reject(new Error("Aborted"));
+        return;
+      }
+      const timer = setTimeout(resolve, ms);
+      signal.addEventListener(
+        "abort",
+        () => {
+          clearTimeout(timer);
+          reject(new Error("Aborted"));
+        },
+        { once: true }
+      );
+    });
+  }
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function pollCursorAuth(uuid, verifier, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleepFn = deps.sleepFn ?? ((ms) => sleep2(ms));
+  let delay = POLL_BASE_DELAY_MS;
+  let consecutiveErrors = 0;
+  for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
+    await sleepFn(delay);
+    let response;
+    try {
+      response = await fetchImpl(
+        `${CURSOR_POLL_URL}?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`
+      );
+    } catch {
+      consecutiveErrors++;
+      if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) {
+        throw new Error("Too many consecutive network errors during Cursor auth polling");
+      }
+      continue;
+    }
+    if (response.status === 404) {
+      consecutiveErrors = 0;
+      delay = Math.min(delay * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY_MS);
+      continue;
+    }
+    if (response.ok) {
+      const data = await response.json();
+      if (typeof data.accessToken !== "string" || typeof data.refreshToken !== "string") {
+        throw new Error("Cursor poll response missing accessToken or refreshToken");
+      }
+      return { accessToken: data.accessToken, refreshToken: data.refreshToken };
+    }
+    consecutiveErrors++;
+    if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) {
+      throw new Error(`Cursor auth poll failed: ${response.status}`);
+    }
+  }
+  throw new Error("Cursor authentication polling timed out");
+}
+async function runCursorOAuthLogin(deps = {}) {
+  const output = deps.output ?? console;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const pkce = generatePkcePair();
+  const uuid = crypto.randomUUID();
+  const params = new URLSearchParams({
+    challenge: pkce.challenge,
+    uuid,
+    mode: "login",
+    redirectTarget: "cli"
+  });
+  const loginUrl = `${CURSOR_LOGIN_URL}?${params.toString()}`;
+  output.log(
+    `
+Open this URL in your browser to authorize Cursor:
+${loginUrl}
+Waiting for browser authentication... (polling ${CURSOR_POLL_URL})`
+  );
+  const openBrowser = deps.openBrowser;
+  if (openBrowser) {
+    try {
+      await openBrowser(loginUrl);
+    } catch {
+    }
+  }
+  const { accessToken, refreshToken } = await pollCursorAuth(uuid, pkce.verifier, {
+    fetchImpl,
+    ...deps.sleep ? { sleepFn: deps.sleep } : {}
+  });
+  const now = deps.now?.() ?? Date.now();
+  const expiresAt = decodeJwtExp(accessToken) ?? now + 3600 * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS3;
+  return {
+    provider: "cursor",
+    accessToken,
+    refreshToken,
+    expiresAt,
+    obtainedAt: now
+  };
+}
+var cursorRefresh = async (credential, deps = {}) => {
+  if (!credential.refreshToken) {
+    throw new Error("Cursor credential has no refresh_token");
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const response = await fetchImpl(CURSOR_REFRESH_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${credential.refreshToken}`,
+      "Content-Type": "application/json"
+    },
+    body: "{}",
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (!response.ok) {
+    let detail = "";
+    try {
+      detail = (await response.text()).trim();
+    } catch {
+    }
+    throw new Error(
+      `Cursor token refresh failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  const data = await response.json();
+  if (typeof data.accessToken !== "string" || !data.accessToken) {
+    throw new Error("Cursor token refresh response missing accessToken");
+  }
+  const now = deps.now?.() ?? Date.now();
+  const expiresAt = decodeJwtExp(data.accessToken) ?? now + 3600 * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS3;
+  const newRefresh = typeof data.refreshToken === "string" && data.refreshToken ? data.refreshToken : credential.refreshToken;
+  return {
+    ...credential,
+    provider: "cursor",
+    accessToken: data.accessToken,
+    refreshToken: newRefresh,
+    expiresAt,
+    obtainedAt: now
+  };
+};
+export {
+  startCallbackServer,
+  generatePkcePair,
+  runAntigravityOAuthLogin,
+  refreshAntigravityOAuthToken,
+  runOpenAiCodexDeviceCode,
+  runOpenAiCodexBrowserPkce,
+  refreshOpenAiCodexToken,
+  runXaiOAuthLogin,
+  runXaiOAuthDeviceCode,
+  refreshXaiOAuthToken,
+  runCursorOAuthLogin,
+  cursorRefresh
+};