openmausbot 0.1.63 → 0.1.65

package/dist-server/pair-cli.js

@@ -2265,7 +2265,7 @@ function displayText(value, multiline = false) {
 }
 function plainText(question, hidden, context) {
   const { input, output, signal } = context;
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     input.setRawMode?.(hidden);
     const rl = createInterface({ input, terminal: hidden });
     let finished = false;
@@ -2276,7 +2276,7 @@ function plainText(question, hidden, context) {
       rl.close();
       output.write("\n");
       if (error51) reject(error51);
-      else resolve9(answer ?? "");
+      else resolve10(answer ?? "");
     };
     const cancel = () => finish(void 0, signal.reason ?? new SetupCancelled());
     signal.addEventListener("abort", cancel, { once: true });
@@ -17758,6 +17758,7 @@ function saveConfig(patch) {
   }
   if (checkedPatch.vps !== void 0) disk.vps = normalizeVpsConfig(checkedPatch.vps);
   if (checkedPatch.language !== void 0) disk.language = checkedPatch.language;
+  if (checkedPatch.customDomain !== void 0) disk.customDomain = checkedPatch.customDomain;
   if (checkedPatch.defaultModelSelection !== void 0) {
     disk.defaultModelSelection = checkedPatch.defaultModelSelection;
   }
@@ -17948,6 +17949,8 @@ var init_config = __esm({
       effort: external_exports.enum(EFFORT_LEVELS).optional()
     });
     appConfigSchema = external_exports.object({
+      /** Verified by the dedicated domain endpoint, never a generic config patch. */
+      customDomain: external_exports.string().optional(),
       defaultModelSelection: defaultModelSelectionSchema.optional(),
       /** CLI-only launch preferences. Never enable remote access implicitly. */
       cliStartup: external_exports.object({
@@ -17991,7 +17994,7 @@ var init_config = __esm({
     storedAppConfigSchema = appConfigSchema.extend({
       browserProfiles: storedBrowserProfilesSchema.optional()
     });
-    appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true });
+    appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true });
     jsonObjectSchema = external_exports.record(external_exports.string(), external_exports.json());
     DATA_DIR = process.env.OMB_DATA_DIR ?? join3(homedir2(), ".openmausbot");
     LEGACY_DATA_DIR = join3(homedir2(), ".opengrokbot");
@@ -18614,12 +18617,12 @@ function describeSpawnFailure(err, cli) {
 function killCliTree(child, timeoutMs = 5e3) {
   const pid = child.pid;
   if (!pid || child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let timer;
     const done = (stopped) => {
       clearTimeout(timer);
       child.off("close", closed);
-      resolve9(stopped);
+      resolve10(stopped);
     };
     const closed = () => done(true);
     child.once("close", closed);
@@ -18766,6 +18769,10 @@ var init_registry = __esm({
         const instance = this.get(instanceId);
         return instance?.startAuthentication ? instance.startAuthentication() : null;
       }
+      async getAuthentication(instanceId, flowId) {
+        const instance = this.get(instanceId);
+        return instance?.getAuthentication ? instance.getAuthentication(flowId) : null;
+      }
       async completeAuthentication(instanceId, flowId, callbackUrl) {
         const instance = this.get(instanceId);
         if (!instance?.completeAuthentication) return false;
@@ -18838,6 +18845,7 @@ var init_registry = __esm({
               },
               access: driver?.metadata.access ?? "subscription",
               install: driver?.install,
+              authentication: inst.startAuthentication ? { method: inst.getAuthentication ? "device-code" : "browser" } : void 0,
               cli: this.cliByInstance.get(inst.instanceId),
               cliDefault: cliDefaultOf(driver),
               // every copy of the driver's default binary on the augmented PATH —
@@ -19543,7 +19551,7 @@ function createAcpDriver(support11) {
           }
           appendNative(threadId, { dir: "out", source: SOURCE, msg: nativeLogMessage(obj) });
         };
-        const request = (method, params, timeoutMs) => new Promise((resolve9, reject) => {
+        const request = (method, params, timeoutMs) => new Promise((resolve10, reject) => {
           const id = nextId++;
           let timer = null;
           if (timeoutMs) {
@@ -19553,7 +19561,7 @@ function createAcpDriver(support11) {
             }, timeoutMs);
             timer.unref?.();
           }
-          rpcPending.set(id, { resolve: resolve9, reject, timer });
+          rpcPending.set(id, { resolve: resolve10, reject, timer });
           send({ jsonrpc: "2.0", id, method, params });
         });
         const stop = () => killCliTree(child);
@@ -19989,12 +19997,12 @@ ${turn.text}` : turn.text;
       const snapshot = async () => {
         const env = childEnv();
         if (support11.snapshot) return support11.snapshot(env, config2, instanceId);
-        const version2 = await new Promise((resolve9) => {
+        const version2 = await new Promise((resolve10) => {
           execCli(
             config2.cli,
             ["--version"],
             { timeout: 8e3, env },
-            (err, stdout2) => resolve9(err ? null : stdout2.trim())
+            (err, stdout2) => resolve10(err ? null : stdout2.trim())
           );
         });
         if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
@@ -20384,14 +20392,14 @@ var init_antigravity_acp = __esm({
         this.child.stderr.setEncoding("utf8");
         this.child.stderr.on("data", (chunk) => this.consumeDiagnostics(chunk));
         this.child.once("error", (error51) => this.failAll(error51));
-        this.exited = new Promise((resolve9) => {
+        this.exited = new Promise((resolve10) => {
           this.child.once("close", (code, signal) => {
             this.noteStartupDiagnostic(this.diagnosticBuffer);
             this.diagnosticBuffer = "";
             if (!this.closed) this.failAll(new Error(
               `Antigravity ACP exited ${code ?? signal ?? "unexpectedly"}.${this.nativeStartupHint ? ` ${this.nativeStartupHint}` : ""}`
             ));
-            resolve9();
+            resolve10();
           });
         });
       }
@@ -20497,8 +20505,8 @@ var init_antigravity_acp = __esm({
       async closeAndWait(timeoutMs = 5e3) {
         this.close();
         let timer;
-        const timedOut = new Promise((resolve9) => {
-          timer = setTimeout(() => resolve9(false), timeoutMs);
+        const timedOut = new Promise((resolve10) => {
+          timer = setTimeout(() => resolve10(false), timeoutMs);
           timer.unref?.();
         });
         try {
@@ -21007,7 +21015,7 @@ var init_antigravity_runtime = __esm({
     FREE_SPACE_MARGIN = 256 * 1024 * 1024;
     DOWNLOAD_TIMEOUT_MS = 45 * 6e4;
     STAGING_PREFIX = ".install-";
-    wait = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
+    wait = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
     INSTALL_RECORD = ".install-complete.json";
     AntigravitySetupError = class extends Error {
       status = 409;
@@ -21429,13 +21437,13 @@ function computeBackoff(attempt, random = Math.random) {
 function interruptibleDelay(ms, signal) {
   let timer = null;
   let onCancel = null;
-  const promise2 = new Promise((resolve9) => {
-    timer = setTimeout(() => resolve9("elapsed"), Math.max(1, ms));
+  const promise2 = new Promise((resolve10) => {
+    timer = setTimeout(() => resolve10("elapsed"), Math.max(1, ms));
     timer.unref?.();
-    if (signal?.aborted) return resolve9("cancelled");
+    if (signal?.aborted) return resolve10("cancelled");
     onCancel = () => {
       clearTimeout(timer);
-      resolve9("cancelled");
+      resolve10("cancelled");
     };
     signal?.addEventListener("abort", onCancel, { once: true });
   });
@@ -21489,15 +21497,15 @@ import { createServer as createNetServer } from "node:net";
 import { homedir as homedir6, tmpdir as tmpdir2 } from "node:os";
 import { join as join13, dirname as dirname6 } from "node:path";
 function claudeSignedIn(cli, env, run3 = execCli) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     run3(cli, ["auth", "status", "--json"], { timeout: 8e3, env }, (_error, stdout2) => {
       try {
         const status = JSON.parse(stdout2);
-        resolve9(
+        resolve10(
           typeof status === "object" && status !== null && "loggedIn" in status && status.loggedIn === true
         );
       } catch {
-        resolve9(false);
+        resolve10(false);
       }
     });
   });
@@ -21673,9 +21681,9 @@ async function createPermissionBroker(opts) {
       unlinkSync3(candidate);
     } catch {
     }
-    let outcome = await new Promise((resolve9) => {
-      attempt.once("listening", () => resolve9("listening"));
-      attempt.once("error", (error51) => resolve9(error51));
+    let outcome = await new Promise((resolve10) => {
+      attempt.once("listening", () => resolve10("listening"));
+      attempt.once("error", (error51) => resolve10(error51));
       attempt.listen(candidate);
     });
     if (outcome === "listening" && process.platform !== "win32") {
@@ -21912,19 +21920,19 @@ var init_claude = __esm({
         };
         const writeUser = (s, threadId, promptMsg) => {
           if (!s.child.stdin.writable || s.child.stdin.destroyed) return Promise.resolve(false);
-          return new Promise((resolve9) => {
+          return new Promise((resolve10) => {
             try {
               s.child.stdin.write(JSON.stringify(promptMsg) + "\n", (error51) => {
-                if (error51) return resolve9(false);
+                if (error51) return resolve10(false);
                 appendNative(threadId, {
                   dir: "out",
                   source: "claude.sdk.message",
                   msg: diagnosticClaudeUserMessage(promptMsg)
                 });
-                resolve9(true);
+                resolve10(true);
               });
             } catch {
-              resolve9(false);
+              resolve10(false);
             }
           });
         };
@@ -22410,19 +22418,19 @@ var init_claude = __esm({
         };
         const snapshot = async () => {
           const env = claudeEnvironment(void 0, { ...process.env, ...input.environment });
-          const version2 = await new Promise((resolve9) => {
+          const version2 = await new Promise((resolve10) => {
             execCli(
               config2.cli,
               ["--version"],
               { timeout: 8e3, env },
-              (err, stdout2) => resolve9(err ? null : stdout2.trim())
+              (err, stdout2) => resolve10(err ? null : stdout2.trim())
             );
           });
           if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
           const authenticated = await claudeSignedIn(config2.cli, env);
           return { state: "available", version: version2, authenticated, billing: "subscription" };
         };
-        const generateReview = (prompt, signal) => new Promise((resolve9, reject) => {
+        const generateReview = (prompt, signal) => new Promise((resolve10, reject) => {
           const child = spawnCli(
             config2.cli,
             ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"],
@@ -22440,7 +22448,7 @@ var init_claude = __esm({
             clearTimeout(timer);
             signal?.removeEventListener("abort", onAbort);
             if (error51) reject(error51);
-            else resolve9(stdout2.trim());
+            else resolve10(stdout2.trim());
           };
           const onAbort = () => {
             killCliTree(child);
@@ -22551,7 +22559,7 @@ function decodeCodexSelection(id) {
   return { model: id, modelProvider: MODEL_ID2.test(id) ? OFFICIAL_CODEX_PROVIDER : null };
 }
 function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8e3) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const child = spawnCli(cli, ["app-server"], {
       cwd: homedir7(),
       env,
@@ -22568,7 +22576,7 @@ function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8e3) {
       settled = true;
       clearTimeout(timer);
       killCliTree(child);
-      resolve9(catalog);
+      resolve10(catalog);
     };
     const request = (method, params, kind) => {
       const id = nextId++;
@@ -22936,9 +22944,227 @@ var init_codex_instructions = __esm({
   }
 });
 
+// server/drivers/codex-device-auth.ts
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { basename as basename4, dirname as dirname7, isAbsolute as isAbsolute3, join as join16, resolve as resolve6 } from "node:path";
+import { stripVTControlCharacters as stripVTControlCharacters3 } from "node:util";
+function canonicalPath(path3) {
+  try {
+    return realpathSync(path3);
+  } catch {
+    const parent = dirname7(path3);
+    return parent === path3 ? path3 : join16(canonicalPath(parent), basename4(path3));
+  }
+}
+function codexDevicePrompt(output) {
+  const clean = stripVTControlCharacters3(output);
+  const lines = clean.split(/\r?\n/).slice(0, -1).map((line) => line.trim());
+  if (!lines.some((line) => /^https:\/\/auth\.openai\.com\/codex\/device\/?$/.test(line))) return null;
+  const userCode = lines.find((line) => /^[A-Z0-9]{4,8}-[A-Z0-9]{4,8}$/.test(line));
+  return userCode ? { authorizationUrl: DEVICE_URL, userCode } : null;
+}
+function loginFailure(output) {
+  if (/(unexpected argument|unrecognized (argument|option)|unknown option).*device-auth/i.test(output)) {
+    return "This server's Codex CLI needs updating for browser sign-in. Run npm install -g @openai/codex@latest on the server, then try again.";
+  }
+  if (/device.{0,40}(disabled|not enabled|not allowed)|enable.{0,40}device/i.test(output)) {
+    return "Enable device-code login in your ChatGPT security settings or ask your workspace admin to allow it, then try again.";
+  }
+  if (/expired|expiration|timed out/i.test(output)) {
+    return "The ChatGPT sign-in code expired. Start sign-in again for a new code.";
+  }
+  return "ChatGPT sign-in did not finish. Check the server's connection and that device-code login is enabled in ChatGPT, then try again.";
+}
+var DEVICE_URL, MAX_OUTPUT, authenticatingHomes, CodexDeviceAuthController;
+var init_codex_device_auth = __esm({
+  "server/drivers/codex-device-auth.ts"() {
+    "use strict";
+    init_procs();
+    DEVICE_URL = "https://auth.openai.com/codex/device";
+    MAX_OUTPUT = 16384;
+    authenticatingHomes = /* @__PURE__ */ new Set();
+    CodexDeviceAuthController = class {
+      flow = null;
+      disposed = false;
+      options;
+      constructor(options) {
+        this.options = options;
+      }
+      async start() {
+        if (this.disposed) throw new Error("This provider was removed. Refresh Settings before signing in.");
+        if (this.flow?.status.phase === "waiting") {
+          if (this.flow.ready) return { ...this.flow.status, phase: "waiting" };
+          throw new Error("A ChatGPT sign-in is already starting. Please wait for the code.");
+        }
+        await this.flow?.stopping;
+        if (this.disposed) throw new Error("This provider was removed. Refresh Settings before signing in.");
+        const env = this.options.environment();
+        const home = env.HOME || env.USERPROFILE || homedir8();
+        if (!isAbsolute3(home) || env.CODEX_HOME && !isAbsolute3(env.CODEX_HOME)) {
+          throw new Error("Use an absolute HOME and CODEX_HOME path for this server's Codex provider before signing in.");
+        }
+        const homeKey = canonicalPath(resolve6(env.CODEX_HOME || join16(home, ".codex")));
+        if (authenticatingHomes.has(homeKey)) {
+          throw new Error("A ChatGPT sign-in is already running for this server account. Finish or cancel it before starting another.");
+        }
+        authenticatingHomes.add(homeKey);
+        return new Promise((resolveStart, reject) => {
+          const flow = {
+            status: {
+              phase: "waiting",
+              flowId: randomUUID8(),
+              authorizationUrl: null,
+              expiresAt: new Date(Date.now() + (this.options.lifetimeMs ?? 15 * 6e4)).toISOString()
+            },
+            child: null,
+            ready: false,
+            resolve: resolveStart,
+            reject,
+            homeKey,
+            startupTimer: setTimeout(() => this.finish(flow, "failed", "Codex did not provide a sign-in code in time. Check the server connection and update Codex, then try again."), this.options.startupTimeoutMs ?? 3e4),
+            expiryTimer: setTimeout(() => this.finish(flow, "expired", "The ChatGPT sign-in code expired. Start sign-in again."), this.options.lifetimeMs ?? 15 * 6e4)
+          };
+          flow.startupTimer.unref();
+          flow.expiryTimer.unref();
+          this.flow = flow;
+          this.run(flow, ["login", "status"], env, home, (code, output) => {
+            if (code === 0 && /^logged in.*chatgpt\b/im.test(output)) {
+              this.finish(flow, "succeeded");
+            } else if (code === 0 && /^logged in\b/im.test(output)) {
+              this.finish(flow, "failed", "Codex already has a different sign-in method on this server. Ask the server administrator to review it before changing accounts.");
+            } else if (code !== 0 && /^not logged in\b/im.test(output)) {
+              this.run(flow, ["login", "--device-auth"], env, home, (loginCode, loginOutput) => {
+                if (loginCode !== 0 || !flow.ready) {
+                  this.finish(flow, "failed", loginFailure(loginOutput));
+                  return;
+                }
+                flow.startupTimer = setTimeout(() => this.finish(flow, "failed", "Codex finished sign-in but could not confirm the account. Refresh Settings and try again."), this.options.startupTimeoutMs ?? 3e4);
+                flow.startupTimer.unref();
+                this.run(flow, ["login", "status"], env, home, (statusCode, statusOutput) => {
+                  this.finish(
+                    flow,
+                    statusCode === 0 && /^logged in.*chatgpt\b/im.test(statusOutput) ? "succeeded" : "failed",
+                    "Codex finished sign-in but did not confirm a ChatGPT account. Refresh Settings and try again."
+                  );
+                });
+              }, true);
+            } else this.finish(flow, "failed", "Codex could not confirm the existing sign-in on this server. Update Codex and check its login status before trying again.");
+          });
+        });
+      }
+      async get(flowId) {
+        if (!flowId || this.flow?.status.flowId !== flowId) throw new Error("This sign-in is no longer available. Start sign-in again.");
+        return { ...this.flow.status };
+      }
+      async cancel() {
+        if (this.flow?.status.phase === "waiting") this.finish(this.flow, "cancelled", "ChatGPT sign-in cancelled.");
+        await this.flow?.stopping;
+        if (this.flow?.terminationFailed) throw new Error(this.flow.status.message);
+      }
+      async dispose() {
+        this.disposed = true;
+        await this.cancel();
+        this.flow = null;
+      }
+      run(flow, args, env, cwd, done, parsePrompt = false) {
+        if (flow.status.phase !== "waiting") return;
+        let child;
+        try {
+          child = spawnCli(this.options.cli, args, { env: { ...env, NO_COLOR: "1" }, cwd, stdio: ["pipe", "pipe", "pipe"] });
+        } catch {
+          this.finish(flow, "failed", "Codex could not start on this server. Install or update the configured Codex CLI, then try again.");
+          return;
+        }
+        flow.child = child;
+        child.stdin.end();
+        let output = "";
+        const receive = (chunk) => {
+          if (flow.status.phase !== "waiting") return;
+          if (output.length + chunk.length > MAX_OUTPUT) {
+            this.finish(flow, "failed", "Codex returned an unexpected sign-in response. Update the server's Codex CLI and try again.");
+            return;
+          }
+          output += chunk.toString("utf8");
+          const prompt = parsePrompt && !flow.ready ? codexDevicePrompt(output) : null;
+          if (prompt) {
+            flow.status = { ...flow.status, ...prompt };
+            flow.ready = true;
+            clearTimeout(flow.startupTimer);
+            flow.resolve({ ...flow.status, phase: "waiting" });
+          }
+        };
+        child.stdout.on("data", receive);
+        child.stderr.on("data", receive);
+        child.once("error", (error51) => {
+          const message2 = error51.code === "ENOENT" ? "Codex is not installed on this server. Run npm install -g @openai/codex@latest on the server, then try again." : "Codex could not start on this server. Check the configured CLI path and its executable permissions.";
+          this.finish(flow, "failed", message2);
+        });
+        child.once("close", (code) => {
+          if (flow.child === child) flow.child = null;
+          if (flow.status.phase === "waiting") done(code, stripVTControlCharacters3(output));
+          output = "";
+        });
+      }
+      finish(flow, phase, message2) {
+        if (flow.status.phase !== "waiting") return;
+        clearTimeout(flow.startupTimer);
+        clearTimeout(flow.expiryTimer);
+        flow.status = {
+          phase,
+          flowId: flow.status.flowId,
+          authorizationUrl: null,
+          expiresAt: null,
+          ...phase !== "succeeded" && message2 ? { message: message2 } : {}
+        };
+        if (!flow.ready) {
+          if (phase === "succeeded") flow.resolve({ ...flow.status, phase });
+          else flow.reject(new Error(message2 ?? "ChatGPT sign-in did not finish."));
+        }
+        flow.stopping = this.stopChild(flow).catch(() => false).then((stopped) => {
+          const release = () => authenticatingHomes.delete(flow.homeKey);
+          if (stopped) {
+            release();
+            return;
+          }
+          flow.terminationFailed = true;
+          flow.status = { ...flow.status, phase: "failed", message: "Codex could not be stopped on this server. Ask the server administrator to stop the login process before trying again." };
+          const child = flow.child;
+          if (!child || child.exitCode !== null || child.signalCode !== null) release();
+          else child.once("close", release);
+        });
+        if (phase === "succeeded") void this.options.onAuthenticated?.().catch(() => {
+        });
+      }
+      async stopChild(flow) {
+        const child = flow.child;
+        if (!child || await killCliTree(child, this.options.terminateTimeoutMs ?? 1500)) return true;
+        if (process.platform !== "win32" && child.pid) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+            child.kill("SIGKILL");
+          }
+        } else child.kill("SIGKILL");
+        await new Promise((resolveStop) => {
+          if (child.exitCode !== null || child.signalCode !== null) return resolveStop();
+          const timer = setTimeout(resolveStop, 1500);
+          timer.unref();
+          child.once("close", () => {
+            clearTimeout(timer);
+            resolveStop();
+          });
+        });
+        return child.exitCode !== null || child.signalCode !== null;
+      }
+    };
+  }
+});
+
 // server/drivers/codex.ts
 import { existsSync as existsSync6 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 function codexPredatesAstra(version2) {
   const value = version2.trim();
   const match = /\bcodex-cli\s+v?(\d+)\.(\d+)\.(\d+)(?:[-+][0-9a-z.-]+)?(?![\d.])\b/i.exec(value) ?? /^v?(\d+)\.(\d+)\.(\d+)(?:[-+][0-9a-z.-]+)?$/i.exec(value);
@@ -23207,6 +23433,7 @@ var init_codex = __esm({
     init_retry();
     init_native();
     init_codex_instructions();
+    init_codex_device_auth();
     init_codex_catalog();
     DRIVER_KIND3 = "codex";
     ASTRA_MODEL_ID = "gpt-6-astra";
@@ -23260,6 +23487,11 @@ var init_codex = __esm({
           }
         };
         await refreshModels();
+        const authentication = new CodexDeviceAuthController({
+          cli: config2.cli,
+          environment: childEnv,
+          onAuthenticated: refreshModels
+        });
         const listeners = /* @__PURE__ */ new Set();
         const active = /* @__PURE__ */ new Map();
         const emit = (event) => {
@@ -23335,7 +23567,7 @@ var init_codex = __esm({
               );
             }
             const child = spawnCli(config2.cli, appServerArgs, {
-              cwd: turn.cwd ?? homedir8(),
+              cwd: turn.cwd ?? homedir9(),
               env,
               stdio: ["pipe", "pipe", "pipe"]
             });
@@ -23363,7 +23595,7 @@ var init_codex = __esm({
                 msg: codexNativeLogMessage(obj)
               });
             };
-            const request = (method, params, timeoutMs = 6e4) => new Promise((resolve9, reject) => {
+            const request = (method, params, timeoutMs = 6e4) => new Promise((resolve10, reject) => {
               const id = nextId++;
               if (method === "config/read") sensitiveResponseIds.add(id);
               const timer = setTimeout(() => {
@@ -23373,7 +23605,7 @@ var init_codex = __esm({
               rpcPending.set(id, {
                 resolve: (v) => {
                   clearTimeout(timer);
-                  resolve9(v);
+                  resolve10(v);
                 },
                 reject: (e) => {
                   clearTimeout(timer);
@@ -23641,7 +23873,7 @@ var init_codex = __esm({
               let effectiveConfig;
               try {
                 const configured = await request("config/read", {
-                  cwd: turn.cwd ?? homedir8(),
+                  cwd: turn.cwd ?? homedir9(),
                   includeLayers: false
                 });
                 effectiveConfig = configured?.config;
@@ -23685,7 +23917,7 @@ var init_codex = __esm({
                 const selection = decodeCodexSelection(turn.model);
                 const startThread = () => request("thread/start", {
                   developerInstructions,
-                  cwd: turn.cwd ?? homedir8(),
+                  cwd: turn.cwd ?? homedir9(),
                   model: selection.model,
                   ...selection.modelProvider ? { modelProvider: selection.modelProvider } : {},
                   ...approvalParams.thread,
@@ -23752,8 +23984,8 @@ var init_codex = __esm({
                   void settle(false, "shutdown_timeout");
                   return;
                 }
-                await new Promise((resolve9) => {
-                  const timer = setTimeout(resolve9, Math.max(1, Math.round(delayMs * retryScale)));
+                await new Promise((resolve10) => {
+                  const timer = setTimeout(resolve10, Math.max(1, Math.round(delayMs * retryScale)));
                   timer.unref?.();
                 });
                 if (!stopRequested) {
@@ -23781,21 +24013,21 @@ var init_codex = __esm({
         };
         const snapshot = async () => {
           const env = childEnv();
-          const version2 = await new Promise((resolve9) => {
+          const version2 = await new Promise((resolve10) => {
             execCli(
               config2.cli,
               ["--version"],
               { timeout: 8e3, env },
-              (err, stdout2) => resolve9(err ? null : stdout2.trim())
+              (err, stdout2) => resolve10(err ? null : stdout2.trim())
             );
           });
           if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
-          const authenticated = await new Promise((resolve9) => {
+          const authenticated = await new Promise((resolve10) => {
             execCli(
               config2.cli,
               ["login", "status"],
               { timeout: 8e3, env },
-              (err, stdout2, stderr) => resolve9(!err && /^logged in\b/im.test(`${stdout2}
+              (err, stdout2, stderr) => resolve10(!err && /^logged in\b/im.test(`${stdout2}
 ${stderr ?? ""}`))
             );
           });
@@ -23816,6 +24048,9 @@ ${stderr ?? ""}`))
             return models;
           },
           refreshModels,
+          startAuthentication: () => authentication.start(),
+          getAuthentication: (flowId) => authentication.get(flowId),
+          cancelAuthentication: () => authentication.cancel(),
           snapshot,
           adapter: {
             provider: DRIVER_KIND3,
@@ -23853,6 +24088,7 @@ ${stderr ?? ""}`))
             }
           },
           dispose: async () => {
+            await authentication.dispose();
             await Promise.all([...active.values()].map(({ stop }) => stop()));
             listeners.clear();
           }
@@ -24139,11 +24375,11 @@ var init_grok = __esm({
 
 // server/drivers/acp/grok.ts
 import { existsSync as existsSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join16 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { join as join17 } from "node:path";
 function grokHome(env) {
   if (env.GROK_HOME) return env.GROK_HOME;
-  return join16(env.HOME || env.USERPROFILE || homedir9(), ".grok");
+  return join17(env.HOME || env.USERPROFILE || homedir10(), ".grok");
 }
 function unquote2(raw) {
   const value = raw.trim();
@@ -24153,7 +24389,7 @@ function unquote2(raw) {
   return value;
 }
 function readGrokModelCatalog(env = process.env) {
-  const path3 = join16(grokHome(env), "config.toml");
+  const path3 = join17(grokHome(env), "config.toml");
   let text2 = "";
   try {
     text2 = readFileSync9(path3, "utf8");
@@ -24226,7 +24462,7 @@ function ensureGrokInjectSlug(modelId, env = process.env) {
   if (!inject) return modelId;
   const host = localHost(inject.host);
   if (!host) return modelId;
-  const path3 = join16(grokHome(env), "config.toml");
+  const path3 = join17(grokHome(env), "config.toml");
   let text2 = "";
   try {
     text2 = readFileSync9(path3, "utf8");
@@ -24361,7 +24597,7 @@ var init_grok2 = __esm({
       // an unauthenticated CLI is a user action, not something to paper over.
       pickAuthMethod: (methods) => methods.some((m) => m.id === "cached_token") ? "cached_token" : null,
       authFailure: "fail",
-      isAuthenticated: () => existsSync7(join16(homedir9(), ".grok", "auth.json")),
+      isAuthenticated: () => existsSync7(join17(homedir10(), ".grok", "auth.json")),
       // `--append-system-prompt`/`--rules` are accepted by the CLI but do NOT
       // reach the agent-stdio system prompt (verified against 1.0.0), so the
       // persona is prepended codex-style.
@@ -24375,11 +24611,11 @@ ${turn.text}` : turn.text
 
 // server/drivers/acp/gemini.ts
 import { existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join17 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join18 } from "node:path";
 function liveOauthCredential() {
   try {
-    const creds = JSON.parse(readFileSync10(join17(homedir10(), ".gemini", "oauth_creds.json"), "utf8"));
+    const creds = JSON.parse(readFileSync10(join18(homedir11(), ".gemini", "oauth_creds.json"), "utf8"));
     if (typeof creds.access_token !== "string" || creds.access_token.trim().length === 0) return false;
     const hasRefresh = typeof creds.refresh_token === "string" && creds.refresh_token.trim().length > 0;
     if (creds.expiry_date !== void 0) {
@@ -24392,7 +24628,7 @@ function liveOauthCredential() {
   }
 }
 function geminiIsAuthenticated(env) {
-  return nonBlank(env.GEMINI_API_KEY) || nonBlank(env.GOOGLE_API_KEY) || existsSync8(join17(homedir10(), ".gemini", "oauth_creds.json")) && liveOauthCredential();
+  return nonBlank(env.GEMINI_API_KEY) || nonBlank(env.GOOGLE_API_KEY) || existsSync8(join18(homedir11(), ".gemini", "oauth_creds.json")) && liveOauthCredential();
 }
 var AUTH_PREFERENCE, nonBlank, support3, GeminiAgentDriver;
 var init_gemini = __esm({
@@ -24435,16 +24671,16 @@ ${turn.text}` : turn.text
 
 // server/drivers/acp/kimi.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { join as join18 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { join as join19 } from "node:path";
 function isLocalInjectAlias(slug) {
   return LOCAL_PROVIDER_PREFIXES.some((prefix) => slug.startsWith(prefix));
 }
 function kimiDataRoot(env) {
-  return env.KIMI_CODE_HOME || join18(env.HOME || env.USERPROFILE || homedir11(), ".kimi-code");
+  return env.KIMI_CODE_HOME || join19(env.HOME || env.USERPROFILE || homedir12(), ".kimi-code");
 }
 function credentialsPath(env) {
-  return join18(kimiDataRoot(env), "credentials", "kimi-code.json");
+  return join19(kimiDataRoot(env), "credentials", "kimi-code.json");
 }
 function quoteToml2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
@@ -24732,7 +24968,7 @@ function ensureKimiInjectAlias(modelId, env = process.env) {
   const alias = `${inject.host}/${inject.model.replace(/\//g, "-")}`;
   const dataRoot = kimiDataRoot(env);
   mkdirSync5(dataRoot, { recursive: true });
-  const path3 = join18(dataRoot, "config.toml");
+  const path3 = join19(dataRoot, "config.toml");
   let text2 = "";
   try {
     text2 = readFileSync11(path3, "utf8");
@@ -24797,7 +25033,7 @@ function readKimiModelCatalog(env) {
   const dataRoot = kimiDataRoot(env);
   let text2 = "";
   try {
-    text2 = readFileSync11(join18(dataRoot, "config.toml"), "utf8");
+    text2 = readFileSync11(join19(dataRoot, "config.toml"), "utf8");
   } catch {
     return STATIC_KIMI_MODELS;
   }
@@ -24917,18 +25153,18 @@ ${turn.text}` : turn.text
 
 // server/drivers/acp/droid.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { join as join19 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { join as join20 } from "node:path";
 function authFilePaths(env) {
-  const home = env.FACTORY_HOME_OVERRIDE || env.HOME || homedir12();
-  return AUTH_FILES.map((name) => join19(home, ".factory", name));
+  const home = env.FACTORY_HOME_OVERRIDE || env.HOME || homedir13();
+  return AUTH_FILES.map((name) => join20(home, ".factory", name));
 }
 function droidInjectId(host, model) {
   const safe = `${host}-${model}`.replace(/[^a-zA-Z0-9._+-]+/g, "-").replace(/-+/g, "-");
   return `${INJECT_ID_PREFIX}${safe}`;
 }
 function factoryHome(env) {
-  return env.FACTORY_HOME_OVERRIDE || env.HOME || env.USERPROFILE || homedir12();
+  return env.FACTORY_HOME_OVERRIDE || env.HOME || env.USERPROFILE || homedir13();
 }
 function ensureDroidInjectModel(modelId, env = process.env) {
   const inject = decodeInjectId(modelId);
@@ -24936,9 +25172,9 @@ function ensureDroidInjectModel(modelId, env = process.env) {
   const host = localHost(inject.host);
   if (!host) return modelId;
   const id = droidInjectId(inject.host, inject.model);
-  const dir = join19(factoryHome(env), ".factory");
+  const dir = join20(factoryHome(env), ".factory");
   mkdirSync6(dir, { recursive: true });
-  const path3 = join19(dir, "settings.json");
+  const path3 = join20(dir, "settings.json");
   let settings2 = {};
   try {
     settings2 = JSON.parse(readFileSync12(path3, "utf8"));
@@ -24978,7 +25214,7 @@ function applyDroidLocalAuthEnv(env, modelId) {
   env.FACTORY_API_KEY = "openmausbot-local";
 }
 function readSettings(env) {
-  return JSON.parse(readFileSync12(join19(factoryHome(env), ".factory", "settings.json"), "utf8"));
+  return JSON.parse(readFileSync12(join20(factoryHome(env), ".factory", "settings.json"), "utf8"));
 }
 async function resolveModels(env) {
   let catalog = MODELS3;
@@ -25247,10 +25483,10 @@ function decodeCursorAuthText(text2) {
   return null;
 }
 function execText(run3, cli, args, env) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     run3(cli, args, { timeout: EXEC_TIMEOUT_MS, env }, (err, stdout2) => {
-      if (err) return resolve9(null);
-      resolve9(String(stdout2 ?? ""));
+      if (err) return resolve10(null);
+      resolve10(String(stdout2 ?? ""));
     });
   });
 }
@@ -25369,8 +25605,8 @@ ${turn.text}` : turn.text
 
 // server/drivers/acp/opencode-go.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join20 } from "node:path";
+import { homedir as homedir14 } from "node:os";
+import { join as join21 } from "node:path";
 function labelForModel(id) {
   return id.split(/[-_.]+/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
@@ -25444,7 +25680,7 @@ function parseOpenCodeModelsOutput(stdout2) {
   return { default: (preferred ?? options[0]).id, options };
 }
 function runOpenCodeModels(cli, environment, verbose) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     execCli(
       cli,
       ["models", ...verbose ? ["--verbose"] : []],
@@ -25454,7 +25690,7 @@ function runOpenCodeModels(cli, environment, verbose) {
           reject(new Error(stderr?.trim() || error51.message, { cause: error51 }));
           return;
         }
-        resolve9(stdout2);
+        resolve10(stdout2);
       }
     );
   });
@@ -25470,8 +25706,8 @@ async function discoverOpenCodeModels(environment, cli = "opencode") {
   }
 }
 function opencodeConfigDir(env) {
-  const home = env.HOME || env.USERPROFILE || homedir13();
-  return join20(env.XDG_CONFIG_HOME || join20(home, ".config"), "opencode");
+  const home = env.HOME || env.USERPROFILE || homedir14();
+  return join21(env.XDG_CONFIG_HOME || join21(home, ".config"), "opencode");
 }
 function ensureOpenCodeInjectModel(modelId, env = process.env) {
   const inject = decodeInjectId(modelId);
@@ -25481,7 +25717,7 @@ function ensureOpenCodeInjectModel(modelId, env = process.env) {
   const native = `${inject.host}/${inject.model}`;
   const dir = opencodeConfigDir(env);
   mkdirSync7(dir, { recursive: true });
-  const path3 = join20(dir, "opencode.json");
+  const path3 = join21(dir, "opencode.json");
   let config2 = { $schema: "https://opencode.ai/config.json" };
   if (existsSync11(path3)) {
     try {
@@ -25517,12 +25753,12 @@ function ensureOpenCodeInjectModel(modelId, env = process.env) {
   return native;
 }
 function storedAuthPaths(env) {
-  const home = env.HOME || env.USERPROFILE || homedir13();
+  const home = env.HOME || env.USERPROFILE || homedir14();
   const roots = [
-    env.XDG_DATA_HOME || join20(home, ".local", "share"),
-    process.platform === "darwin" ? join20(home, "Library", "Application Support") : process.platform === "win32" ? env.LOCALAPPDATA || join20(home, "AppData", "Local") : ""
+    env.XDG_DATA_HOME || join21(home, ".local", "share"),
+    process.platform === "darwin" ? join21(home, "Library", "Application Support") : process.platform === "win32" ? env.LOCALAPPDATA || join21(home, "AppData", "Local") : ""
   ].filter(Boolean);
-  return [...new Set(roots)].map((root) => join20(root, "opencode", "auth.json"));
+  return [...new Set(roots)].map((root) => join21(root, "opencode", "auth.json"));
 }
 function usableAuthEntry(parsed) {
   return Object.values(parsed).some((auth) => {
@@ -25653,10 +25889,10 @@ ${turn.text}` : turn.text
 
 // server/drivers/acp/qwen.ts
 import { chmodSync as chmodSync3, existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
-import { join as join21 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { join as join22 } from "node:path";
 function qwenHome(env) {
-  return join21(env.HOME || env.USERPROFILE || homedir14(), ".qwen");
+  return join22(env.HOME || env.USERPROFILE || homedir15(), ".qwen");
 }
 function envKeyFor(hostId) {
   return `OPENMAUSBOT_QWEN_${hostId.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`;
@@ -25668,7 +25904,7 @@ function ensureQwenInjectModel(modelId, env = process.env) {
   if (!host) return modelId;
   const dir = qwenHome(env);
   mkdirSync8(dir, { recursive: true });
-  const path3 = join21(dir, "settings.json");
+  const path3 = join22(dir, "settings.json");
   let settings2 = {};
   if (existsSync12(path3)) {
     try {
@@ -32634,8 +32870,8 @@ var init_browser = __esm({
 // server/drivers/acp/hermes.ts
 import { spawn as spawn4 } from "node:child_process";
 import { mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
-import { join as join22 } from "node:path";
+import { homedir as homedir16 } from "node:os";
+import { join as join23 } from "node:path";
 function bindHermesScreenshotCompat(env, modelId) {
   delete env[HERMES_OPENMAUS_SCREENSHOT_COMPAT];
   delete env[HERMES_OPENMAUS_SCREENSHOT_COMPAT_MODEL];
@@ -32645,7 +32881,7 @@ function bindHermesScreenshotCompat(env, modelId) {
   env[HERMES_OPENMAUS_SCREENSHOT_COMPAT_MODEL] = inject.model;
 }
 function hermesHome(env) {
-  return env.HERMES_HOME || join22(env.HOME || env.USERPROFILE || homedir15(), ".hermes");
+  return env.HERMES_HOME || join23(env.HOME || env.USERPROFILE || homedir16(), ".hermes");
 }
 function quoteYaml(value) {
   if (/^[\w./:+-]+$/.test(value)) return value;
@@ -32687,7 +32923,7 @@ function ensureHermesInjectProvider(modelId, env = process.env) {
   if (!host) return modelId;
   const dir = hermesHome(env);
   mkdirSync9(dir, { recursive: true });
-  const path3 = join22(dir, "config.yaml");
+  const path3 = join23(dir, "config.yaml");
   let text2 = "";
   try {
     text2 = readFileSync15(path3, "utf8");
@@ -32758,13 +32994,13 @@ function hermesConfiguredModel(env = process.env) {
   const dir = hermesHome(env);
   let secrets = "";
   try {
-    secrets = readFileSync15(join22(dir, ".env"), "utf8");
+    secrets = readFileSync15(join23(dir, ".env"), "utf8");
   } catch {
   }
   const hasHostedProviderKey = HERMES_HOSTED_PROVIDER_KEYS.some((name) => nonEmptyDotenvValue(secrets, name));
   let configuredDefault = null;
   try {
-    configuredDefault = hermesConfigDefault(readFileSync15(join22(dir, "config.yaml"), "utf8"));
+    configuredDefault = hermesConfigDefault(readFileSync15(join23(dir, "config.yaml"), "utf8"));
   } catch {
   }
   const configuredProvider = configuredDefault?.provider.toLowerCase() ?? "";
@@ -32780,12 +33016,12 @@ function hermesConfiguredModel(env = process.env) {
   };
 }
 async function fetchHermesAcpModels(cli, env) {
-  return await new Promise((resolve9) => {
+  return await new Promise((resolve10) => {
     let child;
     try {
       child = spawn4(cli, ["acp"], { stdio: ["pipe", "pipe", "ignore"], env });
     } catch {
-      return resolve9([]);
+      return resolve10([]);
     }
     let settled = false;
     let timer;
@@ -32806,7 +33042,7 @@ async function fetchHermesAcpModels(cli, env) {
         }
       } catch {
       }
-      resolve9(out);
+      resolve10(out);
     };
     timer = setTimeout(() => done([]), 5e3);
     child.once("error", () => done([]));
@@ -32849,7 +33085,7 @@ async function fetchHermesAcpModels(cli, env) {
         }
         if (msg?.id === initId) {
           if (!msg.result) return done([]);
-          sessionId = send("session/new", { cwd: env.HOME || env.USERPROFILE || homedir15(), mcpServers: [] });
+          sessionId = send("session/new", { cwd: env.HOME || env.USERPROFILE || homedir16(), mcpServers: [] });
         } else if (sessionId && msg?.id === sessionId) {
           const list = Array.isArray(msg.result?.models?.availableModels) ? msg.result.models.availableModels : [];
           done(
@@ -33085,8 +33321,8 @@ var init_openai_compat = __esm({
 
 // server/drivers/pi.ts
 import { chmodSync as chmodSync4, existsSync as existsSync13, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, rmSync as rmSync2, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir16, tmpdir as tmpdir3 } from "node:os";
-import { join as join23 } from "node:path";
+import { homedir as homedir17, tmpdir as tmpdir3 } from "node:os";
+import { join as join24 } from "node:path";
 function readPiPromptImages(turn) {
   return (turn.images ?? []).map((image) => ({
     type: "image",
@@ -33193,7 +33429,7 @@ async function applyPiLocalCatalog(catalog, env = process.env, fetchImpl = fetch
   return preferPiInjectRows(await mergeLocalInject(catalog, env, fetchImpl));
 }
 function piAgentDir(env) {
-  return join23(env.HOME || env.USERPROFILE || homedir16(), ".pi", "agent");
+  return join24(env.HOME || env.USERPROFILE || homedir17(), ".pi", "agent");
 }
 function ensurePiInjectModel(modelId, env = process.env) {
   const split = splitPiModel(modelId);
@@ -33204,7 +33440,7 @@ function ensurePiInjectModel(modelId, env = process.env) {
   if (!host) return split;
   const dir = piAgentDir(env);
   mkdirSync10(dir, { recursive: true });
-  const path3 = join23(dir, "models.json");
+  const path3 = join24(dir, "models.json");
   let root = { providers: {} };
   if (existsSync13(path3)) {
     try {
@@ -33258,7 +33494,7 @@ function ensurePiInjectModel(modelId, env = process.env) {
   return split;
 }
 function readPiDefaultModel(env) {
-  const home = env.HOME || env.USERPROFILE || homedir16();
+  const home = env.HOME || env.USERPROFILE || homedir17();
   try {
     const s = JSON.parse(readFileSync16(`${home}/.pi/agent/settings.json`, "utf8"));
     return s.defaultProvider && s.defaultModel ? `${s.defaultProvider}/${s.defaultModel}` : "";
@@ -33268,7 +33504,7 @@ function readPiDefaultModel(env) {
 }
 async function fetchPiModels(cli, env) {
   const child = spawnCli(cli, PI_ARGS, { stdio: ["pipe", "pipe", "pipe"], env });
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let buf = "";
     let done = false;
     const fallbackDefault = readPiDefaultModel(env);
@@ -33279,7 +33515,7 @@ async function fetchPiModels(cli, env) {
         killCliTree(child);
       } catch {
       }
-      resolve9(catalog);
+      resolve10(catalog);
     };
     const timer = setTimeout(() => finish({ default: "", options: [] }), 15e3);
     timer.unref?.();
@@ -33406,9 +33642,9 @@ var init_pi = __esm({
           const mcpServers = buildMcpServers(turn);
           let mcpTempDir = null;
           if (mcpServers) {
-            mcpTempDir = mkdtempSync2(join23(tmpdir3(), "omb-pi-mcp-"));
+            mcpTempDir = mkdtempSync2(join24(tmpdir3(), "omb-pi-mcp-"));
             try {
-              writeFileSync10(join23(mcpTempDir, "mcp.json"), JSON.stringify({ mcpServers }), { mode: 384 });
+              writeFileSync10(join24(mcpTempDir, "mcp.json"), JSON.stringify({ mcpServers }), { mode: 384 });
             } catch (err) {
               try {
                 rmSync2(mcpTempDir, { recursive: true, force: true });
@@ -33426,7 +33662,7 @@ var init_pi = __esm({
                 env: piEnvironment({
                   ...process.env,
                   ...input.environment,
-                  ...mcpServers && mcpTempDir ? { OMB_MCP_CONFIG: join23(mcpTempDir, "mcp.json") } : {}
+                  ...mcpServers && mcpTempDir ? { OMB_MCP_CONFIG: join24(mcpTempDir, "mcp.json") } : {}
                 })
               });
             } catch (err) {
@@ -33449,13 +33685,13 @@ var init_pi = __esm({
             }
             responseWaiters.clear();
           };
-          const awaitResponse = (command, timeoutMs = 2e4) => new Promise((resolve9, reject) => {
+          const awaitResponse = (command, timeoutMs = 2e4) => new Promise((resolve10, reject) => {
             const timer = setTimeout(() => {
               responseWaiters.delete(command);
               reject(new Error(`pi ${command} timed out`));
             }, timeoutMs);
             timer.unref?.();
-            responseWaiters.set(command, { resolve: resolve9, reject, timer });
+            responseWaiters.set(command, { resolve: resolve10, reject, timer });
           });
           child.stdin.on("error", () => rejectWaiters(new Error("pi stdin closed")));
           const send = (obj) => {
@@ -33663,7 +33899,7 @@ ${turn.text}` : turn.text;
           return { turnId };
         };
         const snapshot = async () => {
-          const version2 = await new Promise((resolve9) => {
+          const version2 = await new Promise((resolve10) => {
             const child = spawnCli(config2.cli, ["--version"], {
               stdio: ["ignore", "pipe", "pipe"],
               env: piEnvironment({ ...process.env, ...input.environment })
@@ -33676,16 +33912,16 @@ ${turn.text}` : turn.text;
                 killCliTree(child);
               } catch {
               }
-              resolve9(null);
+              resolve10(null);
             }, 8e3);
             timer.unref?.();
             child.on("error", () => {
               clearTimeout(timer);
-              resolve9(null);
+              resolve10(null);
             });
             child.on("close", () => {
               clearTimeout(timer);
-              resolve9(out.trim() || null);
+              resolve10(out.trim() || null);
             });
           });
           if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
@@ -33764,15 +34000,15 @@ ${turn.text}` : turn.text;
 
 // server/drivers/minimax.ts
 import { readFileSync as readFileSync17 } from "node:fs";
-import { homedir as homedir17 } from "node:os";
-import { join as join24 } from "node:path";
+import { homedir as homedir18 } from "node:os";
+import { join as join25 } from "node:path";
 function normalizedApiUrl(value) {
   const root = value.trim().replace(/\/+$/, "");
   return root.endsWith("/v1") ? root : `${root}/v1`;
 }
-function loadLocalMiniMaxConfig(home = homedir17()) {
+function loadLocalMiniMaxConfig(home = homedir18()) {
   try {
-    const raw = localConfigSchema.parse(JSON.parse(readFileSync17(join24(home, ".mmx", "config.json"), "utf8")));
+    const raw = localConfigSchema.parse(JSON.parse(readFileSync17(join25(home, ".mmx", "config.json"), "utf8")));
     const configuredUrl = raw.base_url?.trim() ? raw.base_url : raw.region === "cn" ? CN_URL : DEFAULT_URL2;
     return {
       apiKey: raw.api_key?.trim() ?? "",
@@ -34040,8 +34276,8 @@ __export(cli_setup_exports, {
 });
 import { spawn as spawn5 } from "node:child_process";
 import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join25, resolve as resolve6 } from "node:path";
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { join as join26, resolve as resolve7 } from "node:path";
+import { randomUUID as randomUUID9 } from "node:crypto";
 async function inspect(id, entry) {
   const registry2 = new ProviderRegistry(BUILT_IN_DRIVERS);
   try {
@@ -34073,11 +34309,11 @@ async function runSetupCli(cli, args, environment = {}) {
   resetPathCache();
 }
 function assertDataDir(dataDir) {
-  if (resolve6(dataDir) !== resolve6(DATA_DIR)) throw new Error("Setup data directory mismatch. Restart the CLI with --data-dir.");
+  if (resolve7(dataDir) !== resolve7(DATA_DIR)) throw new Error("Setup data directory mismatch. Restart the CLI with --data-dir.");
 }
 function checkStoredConfig(dataDir) {
   try {
-    parseStoredConfig(JSON.parse(readFileSync18(join25(dataDir, "config.json"), "utf8")));
+    parseStoredConfig(JSON.parse(readFileSync18(join26(dataDir, "config.json"), "utf8")));
   } catch (error51) {
     if (error51.code === "ENOENT") return;
     throw new Error("Existing config.json could not be read or validated. Setup has not changed it; repair it before continuing.");
@@ -34188,7 +34424,7 @@ async function runSetup(options, io = defaultSetupIo(), deps = dependencies) {
       try {
         if (native) {
           id = prior?.[0] ?? native.id;
-          if (!prior && runtime[id] && runtime[id].driver !== native.driver) id = `${native.id}-${randomUUID8().slice(0, 8)}`;
+          if (!prior && runtime[id] && runtime[id].driver !== native.driver) id = `${native.id}-${randomUUID9().slice(0, 8)}`;
           entry = { ...cfg.instances?.[id] ?? { driver: native.driver }, enabled: true };
           const models = await connectNative(native, id, entry, io, deps);
           const saved = cfg.defaultModelSelection;
@@ -34243,7 +34479,7 @@ async function runSetup(options, io = defaultSetupIo(), deps = dependencies) {
           if (routingProvider) await deps.verify(url2, key, model, routingProvider);
           else await deps.verify(url2, key, model);
           io.log("Test reply received.");
-          id = reuse && prior ? prior[0] : `api-${randomUUID8().slice(0, 8)}`;
+          id = reuse && prior ? prior[0] : `api-${randomUUID9().slice(0, 8)}`;
           entry = reuse && prior ? { ...cfg.instances[id], config: { ...rawObject(cfg.instances[id].config), model } } : { driver: "openai-compat", displayName: label, config: { url: url2, key, model, provider: routingProvider ?? "" } };
           if (!reuse) io.log("The key will be stored in your private config.json (plaintext, owner-only permissions on Unix). Never share this file.");
         }
@@ -34353,7 +34589,7 @@ var init_browser_engine_release = __esm({
 });
 
 // server/browser-bundle-release.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function browserBundleSpec(target) {
   if (!Object.hasOwn(CHROME_ASSETS, target)) throw new Error(`Unsupported desktop browser target: ${target}`);
   const pinned = CHROME_ASSETS[target];
@@ -34389,10 +34625,10 @@ function browserBundlePaths(bundleDirectory, target) {
   const spec = browserBundleSpec(target);
   return {
     directory: bundleDirectory,
-    manifest: join26(bundleDirectory, "manifest.json"),
-    engine: join26(bundleDirectory, spec.engine.executable),
-    chrome: join26(bundleDirectory, spec.chrome.executable),
-    licenses: join26(bundleDirectory, "licenses")
+    manifest: join27(bundleDirectory, "manifest.json"),
+    engine: join27(bundleDirectory, spec.engine.executable),
+    chrome: join27(bundleDirectory, spec.chrome.executable),
+    licenses: join27(bundleDirectory, "licenses")
   };
 }
 var CHROME_VERSION, CHROME_ASSETS;
@@ -34429,10 +34665,10 @@ __export(browser_engine_exports, {
   resolveAgentBrowserBinary: () => resolveAgentBrowserBinary
 });
 import { spawn as spawn6 } from "node:child_process";
-import { createHash as createHash6, randomBytes as randomBytes2, randomUUID as randomUUID9 } from "node:crypto";
+import { createHash as createHash6, randomBytes as randomBytes2, randomUUID as randomUUID10 } from "node:crypto";
 import { chmodSync as chmodSync5, existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync19, renameSync as renameSync4, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { delimiter as delimiter5, join as join27, resolve as resolve7 } from "node:path";
+import { delimiter as delimiter5, join as join28, resolve as resolve8 } from "node:path";
 function executableName(platform = process.platform) {
   return platform === "win32" ? "agent-browser.exe" : "agent-browser";
 }
@@ -34441,14 +34677,14 @@ function isMusl(platform = process.platform, exists = existsSync14) {
 }
 function pinnedBinaryPath(dataDir = DATA_DIR, platform = process.platform, arch = process.arch) {
   const version2 = agentBrowserReleaseVersion(resolveAgentBrowserReleaseAsset(platform, arch));
-  return join27(dataDir, ENGINE_DIR, version2, executableName(platform));
+  return join28(dataDir, ENGINE_DIR, version2, executableName(platform));
 }
 function onPath(env, platform, exists) {
   const pathValue = platform === "win32" ? Object.entries(env).findLast(([key]) => key.toUpperCase() === "PATH")?.[1] : env.PATH;
   for (const part of (pathValue ?? "").split(delimiter5)) {
     const dir = part.trim().replace(/^"|"$/gu, "");
     if (!dir) continue;
-    const candidate = resolve7(dir, executableName(platform));
+    const candidate = resolve8(dir, executableName(platform));
     if (exists(candidate)) return candidate;
   }
   return null;
@@ -34457,7 +34693,7 @@ function packagedBrowser(options) {
   const resources = (options.env ?? process.env).OMB_RESOURCES_PATH;
   if (!resources) return null;
   try {
-    return browserBundlePaths(join27(resolve7(resources), "browser-engine"), `${options.platform ?? process.platform}-${options.arch ?? process.arch}`);
+    return browserBundlePaths(join28(resolve8(resources), "browser-engine"), `${options.platform ?? process.platform}-${options.arch ?? process.arch}`);
   } catch {
     return null;
   }
@@ -34470,7 +34706,7 @@ function resolveAgentBrowserBinary(options = {}) {
   const platform = options.platform ?? process.platform;
   const exists = options.exists ?? existsSync14;
   const override = env.OMB_AGENT_BROWSER_PATH?.trim();
-  if (override) return resolve7(override) && exists(resolve7(override)) ? resolve7(override) : null;
+  if (override) return resolve8(override) && exists(resolve8(override)) ? resolve8(override) : null;
   const bundle = packagedBrowser(options);
   if (bundle && exists(bundle.directory)) return completePackage(bundle, exists) ? bundle.engine : null;
   const pinned = pinnedBinaryPath(options.dataDir, platform, options.arch);
@@ -34482,7 +34718,7 @@ async function installAgentBrowserBinary(options = {}) {
   const asset = options.asset ?? resolveAgentBrowserReleaseAsset(platform, options.arch ?? process.arch, options.musl ?? isMusl(platform));
   if (!asset) throw new Error(`agent-browser publishes no build for ${platform}-${options.arch ?? process.arch}.`);
   const destination = pinnedBinaryPath(options.dataDir, platform, options.arch);
-  const directory = join27(destination, "..");
+  const directory = join28(destination, "..");
   mkdirSync11(directory, { recursive: true, mode: 448 });
   const url2 = agentBrowserReleaseUrl(asset);
   options.log?.(`downloading agent-browser ${agentBrowserReleaseVersion(asset)} (${Math.round(asset.bytes / 1024 / 1024)} MB, digest pinned)`);
@@ -34508,7 +34744,7 @@ async function installAgentBrowserBinary(options = {}) {
 }
 function ensureChrome(binaryPath, options = {}) {
   const bundle = packagedBrowser(options);
-  if (!options.withDeps && bundle && resolve7(binaryPath) === bundle.engine && completePackage(bundle, existsSync14)) {
+  if (!options.withDeps && bundle && resolve8(binaryPath) === bundle.engine && completePackage(bundle, existsSync14)) {
     options.log?.("agent-browser: the bundled browser is ready; no download needed");
     return Promise.resolve();
   }
@@ -34534,7 +34770,7 @@ function ensureChrome(binaryPath, options = {}) {
   });
 }
 function browserEngineEncryptionKey(dataDir = DATA_DIR) {
-  const file2 = join27(dataDir, KEY_FILE);
+  const file2 = join28(dataDir, KEY_FILE);
   try {
     const existing = readFileSync19(file2, "utf8").trim();
     if (/^[0-9a-f]{64}$/u.test(existing)) return existing;
@@ -34582,13 +34818,13 @@ function agentBrowserIntegration(input) {
     if (sourceEnv[name]) env[name] = sourceEnv[name];
   }
   const bundle = packagedBrowser({ env: sourceEnv });
-  if (!env.AGENT_BROWSER_EXECUTABLE_PATH && bundle && resolve7(input.binaryPath) === bundle.engine && completePackage(bundle, existsSync14)) {
+  if (!env.AGENT_BROWSER_EXECUTABLE_PATH && bundle && resolve8(input.binaryPath) === bundle.engine && completePackage(bundle, existsSync14)) {
     env.AGENT_BROWSER_EXECUTABLE_PATH = bundle.chrome;
   }
   return { command: input.binaryPath, args: ["mcp", "--tools", "core", "--no-webmcp"], env };
 }
 function agentBrowserFrame(input) {
-  const file2 = join27(tmpdir4(), `openmausbot-browser-${randomUUID9()}.png`);
+  const file2 = join28(tmpdir4(), `openmausbot-browser-${randomUUID10()}.png`);
   return new Promise((settle, fail) => {
     const child = spawn6(input.binaryPath, ["screenshot", file2], {
       env: { ...process.env, ...input.env },
@@ -34624,7 +34860,7 @@ function agentBrowserFrame(input) {
   });
 }
 function browserSessionId(botId, partitionId) {
-  if (partitionId === "guest") return `guest-${randomUUID9()}`;
+  if (partitionId === "guest") return `guest-${randomUUID10()}`;
   const raw = partitionId || `bot-${botId}`;
   return raw.replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 96);
 }
@@ -34692,8 +34928,8 @@ var init_browser_engine = __esm({
 var import_qrcode_terminal = __toESM(require_main(), 1);
 import { spawn as spawn7 } from "node:child_process";
 import { closeSync as closeSync3, existsSync as existsSync15, mkdirSync as mkdirSync12, openSync as openSync3, readFileSync as readFileSync20 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
-import { dirname as dirname7, join as join28, resolve as resolve8 } from "node:path";
+import { homedir as homedir19 } from "node:os";
+import { dirname as dirname8, join as join29, resolve as resolve9 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
@@ -34747,14 +34983,14 @@ function explainTailscaleFailure(reason) {
   }
 }
 function run(cli, args, timeoutMs) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     execFile(
       cli,
       args,
       { timeout: timeoutMs, killSignal: "SIGKILL", maxBuffer: 16 * 1024 * 1024, env: { ...process.env, PATH: searchPath() } },
       (error51, stdout2, stderr) => {
         const code = error51 && "code" in error51 && typeof error51.code === "number" ? error51.code : error51 ? null : 0;
-        resolve9({ ok: !error51, stdout: String(stdout2 ?? ""), stderr: String(stderr ?? ""), code });
+        resolve10({ ok: !error51, stdout: String(stdout2 ?? ""), stderr: String(stderr ?? ""), code });
       }
     );
   });
@@ -35518,13 +35754,13 @@ function writePrivateToken(runtimeRoot2, token, { fileSystem, processId, identif
 }
 async function waitForExit(child, milliseconds) {
   if (child.exitCode !== null || child.signalCode !== null) return;
-  await new Promise((resolve9) => {
+  await new Promise((resolve10) => {
     let settled = false;
     const finish = () => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve9();
+      resolve10();
     };
     child.once("exit", finish);
     const timer = setTimeout(finish, milliseconds);
@@ -35688,8 +35924,8 @@ function createManagedCompanionTunnel({
       child = spawned;
       const cancellationController = new AbortController();
       let resolveCancellation;
-      const cancellation = new Promise((resolve9) => {
-        resolveCancellation = resolve9;
+      const cancellation = new Promise((resolve10) => {
+        resolveCancellation = resolve10;
       });
       let cancelled = false;
       attemptHandle = {
@@ -35705,8 +35941,8 @@ function createManagedCompanionTunnel({
       let terminated = false;
       let expectedStop = false;
       let resolveExit;
-      const exit = new Promise((resolve9) => {
-        resolveExit = resolve9;
+      const exit = new Promise((resolve10) => {
+        resolveExit = resolve10;
       });
       const onTerminated = () => {
         if (terminated) return;
@@ -35740,8 +35976,8 @@ function createManagedCompanionTunnel({
         }
         if (Date.now() >= deadline) break;
         await Promise.race([
-          new Promise((resolve9) => {
-            const timer = setTimeout(resolve9, verifyIntervalMs);
+          new Promise((resolve10) => {
+            const timer = setTimeout(resolve10, verifyIntervalMs);
             timer.unref?.();
           }),
           exit,
@@ -36559,7 +36795,7 @@ function describeTunnelState(state, address) {
 }
 
 // server/cli.ts
-var HERE2 = dirname7(fileURLToPath3(import.meta.url));
+var HERE2 = dirname8(fileURLToPath3(import.meta.url));
 var COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "browser", "help", "--help", "-h"];
 function parseArgs(argv, env = process.env) {
   const implicitStart = !argv.length || argv[0].startsWith("--") && argv[0] !== "--help";
@@ -36570,7 +36806,7 @@ function parseArgs(argv, env = process.env) {
   const options = {
     command: command === "--help" || command === "-h" ? "help" : command,
     port: Number(env.OMB_PORT || 8799),
-    dataDir: env.OMB_DATA_DIR || join28(homedir18(), ".openmausbot"),
+    dataDir: env.OMB_DATA_DIR || join29(homedir19(), ".openmausbot"),
     tailscale: false,
     tunnel: false,
     client: false,
@@ -36588,7 +36824,7 @@ function parseArgs(argv, env = process.env) {
     };
     try {
       if (arg === "--port") options.port = Number(value());
-      else if (arg === "--data-dir") options.dataDir = resolve8(value());
+      else if (arg === "--data-dir") options.dataDir = resolve9(value());
       else if (arg === "--label") options.label = value();
       else if (arg === "--public-url") options.publicUrl = value().replace(/\/+$/, "");
       else if (arg === "--tailscale") options.tailscale = true;
@@ -36674,7 +36910,7 @@ function defaultIo() {
 }
 function serverVersion(here = HERE2) {
   try {
-    const parsed = JSON.parse(readFileSync20(resolve8(here, "..", "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync20(resolve9(here, "..", "package.json"), "utf8"));
     const version2 = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "version") : void 0;
     return typeof version2 === "string" && version2 ? version2 : "0.0.0";
   } catch {
@@ -36699,7 +36935,7 @@ async function isWorkspaceRunning(options) {
   try {
     const { status, body } = await api(options.port, "/api/health");
     if (status !== 200 || body?.app !== "openmausbot") return false;
-    const expected = readFileSync20(join28(options.dataDir, "environment-id"), "utf8").trim();
+    const expected = readFileSync20(join29(options.dataDir, "environment-id"), "utf8").trim();
     const descriptor = await api(options.port, "/.well-known/openmausbot/environment");
     return /^[0-9a-f-]{36}$/i.test(expected) && descriptor.status === 200 && descriptor.body?.environmentId === expected;
   } catch {
@@ -36996,16 +37232,16 @@ async function runBrowser(options, io = defaultIo()) {
   return 0;
 }
 function serverEntry(here = HERE2) {
-  const bundled = join28(here, "index.js");
-  const root = resolve8(here, "..");
+  const bundled = join29(here, "index.js");
+  const root = resolve9(here, "..");
   if (existsSync15(bundled)) {
-    const staticDir2 = [join28(root, "dist"), join28(here, "..", "ui")].find((d) => existsSync15(join28(d, "index.html"))) ?? null;
-    const skillsDir = existsSync15(join28(root, "skills")) ? join28(root, "skills") : null;
+    const staticDir2 = [join29(root, "dist"), join29(here, "..", "ui")].find((d) => existsSync15(join29(d, "index.html"))) ?? null;
+    const skillsDir = existsSync15(join29(root, "skills")) ? join29(root, "skills") : null;
     return { command: process.execPath, args: [bundled], staticDir: staticDir2, skillsDir };
   }
-  const source = join28(here, "index.ts");
-  const staticDir = existsSync15(join28(root, "dist", "index.html")) ? join28(root, "dist") : null;
-  return { command: process.execPath, args: ["--experimental-strip-types", source], staticDir, skillsDir: existsSync15(join28(root, "skills")) ? join28(root, "skills") : null };
+  const source = join29(here, "index.ts");
+  const staticDir = existsSync15(join29(root, "dist", "index.html")) ? join29(root, "dist") : null;
+  return { command: process.execPath, args: ["--experimental-strip-types", source], staticDir, skillsDir: existsSync15(join29(root, "skills")) ? join29(root, "skills") : null };
 }
 async function planTunnel(options, log) {
   const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
@@ -37084,9 +37320,9 @@ async function runServe(options, log = console.log) {
   let child;
   try {
     if (options.guided) {
-      const logsDir = join28(options.dataDir, "logs");
+      const logsDir = join29(options.dataDir, "logs");
       mkdirSync12(logsDir, { recursive: true, mode: 448 });
-      logPath = join28(logsDir, `server-${Date.now()}-${process.pid}.log`);
+      logPath = join29(logsDir, `server-${Date.now()}-${process.pid}.log`);
       logFd = openSync3(logPath, "wx", 384);
       log("\nStarting your workspace\u2026");
     }
@@ -37263,7 +37499,7 @@ async function runOnboardingCommand(options, io = defaultIo(), startServer = run
     }
     if (options.command === "setup") {
       io.log("\nAll set. Start with: openmausbot (or npx openmausbot without a global install).");
-      if (options.dataDir !== join28(homedir18(), ".openmausbot") || options.port !== 8799) {
+      if (options.dataDir !== join29(homedir19(), ".openmausbot") || options.port !== 8799) {
         io.log(`Use the same --data-dir (${options.dataDir}) and --port (${options.port}) options when starting.`);
       }
       return 0;