sliccy 5.64.1 → 5.65.0

package/dist/ui/assets/{xai-grok-DYD1UJ2S.js → xai-grok-EQeZdJC8.js}

@@ -1 +1 @@
-import{O as e,i as t}from"./account-store-CbBigdPI.js";import{p as n}from"./transform-messages-CVIV-EgO.js";import{p as r}from"./bedrock-camp-CvxD6hHk.js";import{c as i,i as a}from"./legacy-api-aliases-DWJHPSiz.js";import"./provider-settings-BclOQB4V.js";import{XaiErrorCode as o,XaiOAuthError as s}from"./xai-grok-errors-ByEMMSoz.js";import{resolveModels as c,toModelMetadata as l}from"./xai-grok-models-B0Tf--xf.js";import{sanitizePayload as u}from"./xai-grok-sanitize-CV6qvaEF.js";const d=`xai-grok`,f=`https://auth.x.ai`,p=`${f}/oauth2/authorize`,m=`${f}/oauth2/token`,h=`b1a00492-073a-47ea-816f-4c329264a828`,g=`http://127.0.0.1:56121/callback`,_=`https://api.x.ai/v1`,v=`openai-responses`,y=`${d}-openai`;function b(){return typeof process>`u`?null:{}.PI_XAI_OAUTH_MODELS??null}const x=c(b());function S(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/,``)}function C(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}function w(){return S(C(32))}async function T(e){let t=new TextEncoder().encode(e);return S(new Uint8Array(await crypto.subtle.digest(`SHA-256`,t)))}function E(){return S(C(16))}async function D(e,t){let n=new URLSearchParams({grant_type:`authorization_code`,code:e,redirect_uri:g,client_id:h,code_verifier:t}),r=await fetch(m,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:n});if(!r.ok)throw new s(`xAI token exchange failed: ${r.status} ${await r.text()}`,o.TOKEN_EXCHANGE_FAILED);let i=await r.json();if(!i.access_token)throw new s(`xAI token exchange did not return access_token.`,o.TOKEN_EXCHANGE_INVALID);return i}async function O(e){try{let t=new URLSearchParams({grant_type:`refresh_token`,refresh_token:e,client_id:h}),n=await fetch(m,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t});return n.ok?await n.json():(console.error(`[xai-grok] refresh failed:`,n.status,await n.text()),null)}catch(e){return console.error(`[xai-grok] refresh error:`,e instanceof Error?e.message:String(e)),null}}function k(){return t().find(e=>e.providerId===d)}async function A(){let t=k();if(!t?.accessToken)throw new s("Not signed in to xAI Grok — run /login or `oauth-token xai-grok`",o.AUTH_MISSING,!0);let n=t.tokenExpiresAt??0;if(n&&Date.now()+6e4<n)return t.accessToken;if(t.refreshToken){let n=await O(t.refreshToken);if(n?.access_token)return await e({providerId:d,accessToken:n.access_token,refreshToken:n.refresh_token??t.refreshToken,tokenExpiresAt:Date.now()+(n.expires_in??21600)*1e3}),n.access_token}return t.accessToken}function j(e,t){return{type:`error`,reason:`error`,error:{role:`assistant`,content:[],api:y,provider:d,model:e.id,usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:`error`,errorMessage:t instanceof Error?t.message:String(t),timestamp:Date.now()}}}function M(e,t){return n=>!n||typeof n!=`object`?n:u(n,e,t)}function N(e,t){return t?{...e??{},"x-grok-conv-id":t}:e}const P=(e,t,r={})=>{let i=n();return(async()=>{try{let n=await A(),o=r.sessionId,s=a({...e,baseUrl:_,api:v},t,{...r,apiKey:n,headers:N(r.headers,o),onPayload:M(e.id,o)});for await(let e of s)i.push(e);i.end()}catch(t){console.error(`[xai-grok] Stream error:`,t instanceof Error?t.message:String(t)),i.push(j(e,t)),i.end()}})(),i},F=(e,t,r)=>{let a=n();return(async()=>{try{let n=await A(),o=r?.sessionId,s=i({...e,baseUrl:_,api:v},t,{...r,apiKey:n,headers:N(r?.headers,o),onPayload:M(e.id,o)});for await(let e of s)a.push(e);a.end()}catch(t){console.error(`[xai-grok] Stream error:`,t instanceof Error?t.message:String(t)),a.push(j(e,t)),a.end()}})(),a},I={id:d,name:`xAI Grok (SuperGrok OAuth)`,description:`Grok via xAI OAuth — uses your SuperGrok subscription, no API key needed. Default model is Grok Heavy.`,requiresApiKey:!1,requiresBaseUrl:!1,isOAuth:!0,defaultModelId:`grok-4.20-multi-agent-0309`,oauthTokenDomains:[`api.x.ai`,`*.x.ai`,`auth.x.ai`,`accounts.x.ai`],getModelIds:()=>x.map(e=>{let t=l(e);return e.thinkingLevelMap?{...t,thinkingLevelMap:e.thinkingLevelMap}:t}),onOAuthLoginIntercepted:async(t,n,r)=>{let i=w(),a=await T(i),c=E(),l=E(),u=new URL(p);u.searchParams.set(`response_type`,`code`),u.searchParams.set(`client_id`,h),u.searchParams.set(`redirect_uri`,g),u.searchParams.set(`scope`,r?.scopes??`openid profile email offline_access grok-cli:access api:access`),u.searchParams.set(`code_challenge`,a),u.searchParams.set(`code_challenge_method`,`S256`),u.searchParams.set(`state`,c),u.searchParams.set(`nonce`,l),u.searchParams.set(`plan`,`generic`),u.searchParams.set(`referrer`,`slicc`);let f=await t({authorizeUrl:u.toString(),redirectUriPattern:`http://127.0.0.1:56121/*`,onCapture:`close`});if(!f)throw new s(`xAI OAuth login was cancelled or timed out`,o.CALLBACK_TIMEOUT);let m=new URL(f),v=m.searchParams.get(`code`),y=m.searchParams.get(`state`);if(!v)throw new s(`xAI OAuth redirect did not include a code`,o.CODE_MISSING);if(y!==c)throw new s(`xAI OAuth state mismatch — possible CSRF, aborting`,o.STATE_MISMATCH);let b=await D(v,i);await e({providerId:d,accessToken:b.access_token,refreshToken:b.refresh_token,tokenExpiresAt:Date.now()+(b.expires_in??21600)*1e3,baseUrl:_}),n()},onOAuthLogout:async()=>{await e({providerId:d,accessToken:``})},onSilentRenew:async()=>{let t=k();if(!t?.refreshToken)return null;let n=await O(t.refreshToken);return n?.access_token?(await e({providerId:d,accessToken:n.access_token,refreshToken:n.refresh_token??t.refreshToken,tokenExpiresAt:Date.now()+(n.expires_in??21600)*1e3}),n.access_token):null}};function L(){r({api:y,stream:P,streamSimple:F})}export{o as XaiErrorCode,s as XaiOAuthError,I as config,L as register};
+import{O as e,i as t}from"./account-store-DBH6AYjF.js";import{p as n}from"./transform-messages-CVIV-EgO.js";import{p as r}from"./bedrock-camp-CvxD6hHk.js";import{c as i,i as a}from"./legacy-api-aliases-DWJHPSiz.js";import"./provider-settings-AHSP9_xw.js";import{XaiErrorCode as o,XaiOAuthError as s}from"./xai-grok-errors-ByEMMSoz.js";import{resolveModels as c,toModelMetadata as l}from"./xai-grok-models-B0Tf--xf.js";import{sanitizePayload as u}from"./xai-grok-sanitize-CV6qvaEF.js";const d=`xai-grok`,f=`https://auth.x.ai`,p=`${f}/oauth2/authorize`,m=`${f}/oauth2/token`,h=`b1a00492-073a-47ea-816f-4c329264a828`,g=`http://127.0.0.1:56121/callback`,_=`https://api.x.ai/v1`,v=`openai-responses`,y=`${d}-openai`;function b(){return typeof process>`u`?null:{}.PI_XAI_OAUTH_MODELS??null}const x=c(b());function S(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/,``)}function C(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}function w(){return S(C(32))}async function T(e){let t=new TextEncoder().encode(e);return S(new Uint8Array(await crypto.subtle.digest(`SHA-256`,t)))}function E(){return S(C(16))}async function D(e,t){let n=new URLSearchParams({grant_type:`authorization_code`,code:e,redirect_uri:g,client_id:h,code_verifier:t}),r=await fetch(m,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:n});if(!r.ok)throw new s(`xAI token exchange failed: ${r.status} ${await r.text()}`,o.TOKEN_EXCHANGE_FAILED);let i=await r.json();if(!i.access_token)throw new s(`xAI token exchange did not return access_token.`,o.TOKEN_EXCHANGE_INVALID);return i}async function O(e){try{let t=new URLSearchParams({grant_type:`refresh_token`,refresh_token:e,client_id:h}),n=await fetch(m,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t});return n.ok?await n.json():(console.error(`[xai-grok] refresh failed:`,n.status,await n.text()),null)}catch(e){return console.error(`[xai-grok] refresh error:`,e instanceof Error?e.message:String(e)),null}}function k(){return t().find(e=>e.providerId===d)}async function A(){let t=k();if(!t?.accessToken)throw new s("Not signed in to xAI Grok — run /login or `oauth-token xai-grok`",o.AUTH_MISSING,!0);let n=t.tokenExpiresAt??0;if(n&&Date.now()+6e4<n)return t.accessToken;if(t.refreshToken){let n=await O(t.refreshToken);if(n?.access_token)return await e({providerId:d,accessToken:n.access_token,refreshToken:n.refresh_token??t.refreshToken,tokenExpiresAt:Date.now()+(n.expires_in??21600)*1e3}),n.access_token}return t.accessToken}function j(e,t){return{type:`error`,reason:`error`,error:{role:`assistant`,content:[],api:y,provider:d,model:e.id,usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:`error`,errorMessage:t instanceof Error?t.message:String(t),timestamp:Date.now()}}}function M(e,t){return n=>!n||typeof n!=`object`?n:u(n,e,t)}function N(e,t){return t?{...e??{},"x-grok-conv-id":t}:e}const P=(e,t,r={})=>{let i=n();return(async()=>{try{let n=await A(),o=r.sessionId,s=a({...e,baseUrl:_,api:v},t,{...r,apiKey:n,headers:N(r.headers,o),onPayload:M(e.id,o)});for await(let e of s)i.push(e);i.end()}catch(t){console.error(`[xai-grok] Stream error:`,t instanceof Error?t.message:String(t)),i.push(j(e,t)),i.end()}})(),i},F=(e,t,r)=>{let a=n();return(async()=>{try{let n=await A(),o=r?.sessionId,s=i({...e,baseUrl:_,api:v},t,{...r,apiKey:n,headers:N(r?.headers,o),onPayload:M(e.id,o)});for await(let e of s)a.push(e);a.end()}catch(t){console.error(`[xai-grok] Stream error:`,t instanceof Error?t.message:String(t)),a.push(j(e,t)),a.end()}})(),a},I={id:d,name:`xAI Grok (SuperGrok OAuth)`,description:`Grok via xAI OAuth — uses your SuperGrok subscription, no API key needed. Default model is Grok Heavy.`,requiresApiKey:!1,requiresBaseUrl:!1,isOAuth:!0,defaultModelId:`grok-4.20-multi-agent-0309`,oauthTokenDomains:[`api.x.ai`,`*.x.ai`,`auth.x.ai`,`accounts.x.ai`],getModelIds:()=>x.map(e=>{let t=l(e);return e.thinkingLevelMap?{...t,thinkingLevelMap:e.thinkingLevelMap}:t}),onOAuthLoginIntercepted:async(t,n,r)=>{let i=w(),a=await T(i),c=E(),l=E(),u=new URL(p);u.searchParams.set(`response_type`,`code`),u.searchParams.set(`client_id`,h),u.searchParams.set(`redirect_uri`,g),u.searchParams.set(`scope`,r?.scopes??`openid profile email offline_access grok-cli:access api:access`),u.searchParams.set(`code_challenge`,a),u.searchParams.set(`code_challenge_method`,`S256`),u.searchParams.set(`state`,c),u.searchParams.set(`nonce`,l),u.searchParams.set(`plan`,`generic`),u.searchParams.set(`referrer`,`slicc`);let f=await t({authorizeUrl:u.toString(),redirectUriPattern:`http://127.0.0.1:56121/*`,onCapture:`close`});if(!f)throw new s(`xAI OAuth login was cancelled or timed out`,o.CALLBACK_TIMEOUT);let m=new URL(f),v=m.searchParams.get(`code`),y=m.searchParams.get(`state`);if(!v)throw new s(`xAI OAuth redirect did not include a code`,o.CODE_MISSING);if(y!==c)throw new s(`xAI OAuth state mismatch — possible CSRF, aborting`,o.STATE_MISMATCH);let b=await D(v,i);await e({providerId:d,accessToken:b.access_token,refreshToken:b.refresh_token,tokenExpiresAt:Date.now()+(b.expires_in??21600)*1e3,baseUrl:_}),n()},onOAuthLogout:async()=>{await e({providerId:d,accessToken:``})},onSilentRenew:async()=>{let t=k();if(!t?.refreshToken)return null;let n=await O(t.refreshToken);return n?.access_token?(await e({providerId:d,accessToken:n.access_token,refreshToken:n.refresh_token??t.refreshToken,tokenExpiresAt:Date.now()+(n.expires_in??21600)*1e3}),n.access_token):null}};function L(){r({api:y,stream:P,streamSimple:F})}export{o as XaiErrorCode,s as XaiOAuthError,I as config,L as register};

package/dist/ui/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>slicc</title>
     <link rel="icon" type="image/png" href="/logos/sliccy-color-1scoops-32x32.png" />
-    <script type="module" crossorigin src="/assets/main-BC7cdhzM.js"></script>
+    <script type="module" crossorigin src="/assets/main-CmZaYL6M.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/modulepreload-polyfill-Dezn_h7o.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-Czpn1I53.js">
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
@@ -24,21 +24,21 @@
     <link rel="modulepreload" crossorigin href="/assets/port-bridge-client-CdvMlimf.js">
     <link rel="modulepreload" crossorigin href="/assets/secrets-bridge-client-CONYX8PU.js">
     <link rel="modulepreload" crossorigin href="/assets/tool-ui-DfXu6quJ.js">
-    <link rel="modulepreload" crossorigin href="/assets/providers-CLGEV4xE.js">
+    <link rel="modulepreload" crossorigin href="/assets/providers-lerk0za2.js">
     <link rel="modulepreload" crossorigin href="/assets/panel-rpc-DmJSNs0I.js">
     <link rel="modulepreload" crossorigin href="/assets/transform-messages-fFaW-DLG.js">
     <link rel="modulepreload" crossorigin href="/assets/bedrock-camp-BEi8MYUS.js">
-    <link rel="modulepreload" crossorigin href="/assets/account-store-O2BUvC3j.js">
+    <link rel="modulepreload" crossorigin href="/assets/account-store-CK-N94Ou.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-overlay-route-CjT6k9Df.js">
     <link rel="modulepreload" crossorigin href="/assets/bridge-launch-params-jegYRGJ6.js">
     <link rel="modulepreload" crossorigin href="/assets/messages-BD4p8GuF.js">
     <link rel="modulepreload" crossorigin href="/assets/tray-runtime-config-DJIIJaBR.js">
-    <link rel="modulepreload" crossorigin href="/assets/setup-sudo-Cv0iEi2g.js">
+    <link rel="modulepreload" crossorigin href="/assets/setup-sudo-h7qRDT2t.js">
     <link rel="modulepreload" crossorigin href="/assets/telemetry-C8rZr13D.js">
     <link rel="modulepreload" crossorigin href="/assets/tray-follower-status-CyJIKXH4.js">
     <link rel="modulepreload" crossorigin href="/assets/clipboard-DuHpK59o.js">
     <link rel="modulepreload" crossorigin href="/assets/tray-join-url-BIvzbiFR.js">
-    <link rel="modulepreload" crossorigin href="/assets/provider-settings-Be9DZHqf.js">
+    <link rel="modulepreload" crossorigin href="/assets/provider-settings-BAQroSjB.js">
   </head>
   <body>
     <div id="app"></div>

package/dist/ui/packages/webapp/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>slicc</title>
     <link rel="icon" type="image/png" href="/logos/sliccy-color-1scoops-32x32.png" />
-    <script type="module" crossorigin src="/assets/main-BC7cdhzM.js"></script>
+    <script type="module" crossorigin src="/assets/main-CmZaYL6M.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/modulepreload-polyfill-Dezn_h7o.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-Czpn1I53.js">
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
@@ -24,21 +24,21 @@
     <link rel="modulepreload" crossorigin href="/assets/port-bridge-client-CdvMlimf.js">
     <link rel="modulepreload" crossorigin href="/assets/secrets-bridge-client-CONYX8PU.js">
     <link rel="modulepreload" crossorigin href="/assets/tool-ui-DfXu6quJ.js">
-    <link rel="modulepreload" crossorigin href="/assets/providers-CLGEV4xE.js">
+    <link rel="modulepreload" crossorigin href="/assets/providers-lerk0za2.js">
     <link rel="modulepreload" crossorigin href="/assets/panel-rpc-DmJSNs0I.js">
     <link rel="modulepreload" crossorigin href="/assets/transform-messages-fFaW-DLG.js">
     <link rel="modulepreload" crossorigin href="/assets/bedrock-camp-BEi8MYUS.js">
-    <link rel="modulepreload" crossorigin href="/assets/account-store-O2BUvC3j.js">
+    <link rel="modulepreload" crossorigin href="/assets/account-store-CK-N94Ou.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-overlay-route-CjT6k9Df.js">
     <link rel="modulepreload" crossorigin href="/assets/bridge-launch-params-jegYRGJ6.js">
     <link rel="modulepreload" crossorigin href="/assets/messages-BD4p8GuF.js">
     <link rel="modulepreload" crossorigin href="/assets/tray-runtime-config-DJIIJaBR.js">
-    <link rel="modulepreload" crossorigin href="/assets/setup-sudo-Cv0iEi2g.js">
+    <link rel="modulepreload" crossorigin href="/assets/setup-sudo-h7qRDT2t.js">
     <link rel="modulepreload" crossorigin href="/assets/telemetry-C8rZr13D.js">
     <link rel="modulepreload" crossorigin href="/assets/tray-follower-status-CyJIKXH4.js">
     <link rel="modulepreload" crossorigin href="/assets/clipboard-DuHpK59o.js">
     <link rel="modulepreload" crossorigin href="/assets/tray-join-url-BIvzbiFR.js">
-    <link rel="modulepreload" crossorigin href="/assets/provider-settings-Be9DZHqf.js">
+    <link rel="modulepreload" crossorigin href="/assets/provider-settings-BAQroSjB.js">
   </head>
   <body>
     <div id="app"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sliccy",
-  "version": "5.64.1",
+  "version": "5.65.0",
   "description": "Browser-based coding agent with thin CLI server",
   "license": "Apache-2.0",
   "type": "module",
@@ -90,7 +90,7 @@
     "lint:hosted-origin": "node packages/dev-tools/tools/check-hosted-origin-literal.mjs"
   },
   "dependencies": {
-    "e2b": ">=2.23.0 <2.33.0",
+    "e2b": "^2.35.0",
     "express": "^5.0.0",
     "pyodide": "314.0.2",
     "ws": "^8.18.0"

package/dist/node-server/_cloud_core/tests/e2b-workerd-pin.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=e2b-workerd-pin.test.d.ts.map

package/dist/node-server/_cloud_core/tests/e2b-workerd-pin.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"e2b-workerd-pin.test.d.ts","sourceRoot":"","sources":["../../tests/e2b-workerd-pin.test.ts"],"names":[],"mappings":""}

package/dist/node-server/_cloud_core/tests/e2b-workerd-pin.test.js

@@ -1,44 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { describe, expect, it } from 'vitest';
-// Regression guard for the e2b 2.33.0 / Cloudflare workerd incompatibility.
-//
-// e2b >=2.33.0 emits a top-level `createRequire(import.meta.url)` ESM-interop
-// shim in dist/index.mjs (from its bundler, Rolldown). That runs at module-eval
-// time and throws under workerd (`import.meta.url` is undefined there), crashing
-// the tray-hub worker at startup — the worker bundles e2b via @slicc/cloud-core.
-// e2b is therefore capped `>=2.23.0 <2.33.0` in the root, cloud-core, and
-// node-server package.json, plus an allowedVersions rule in renovate.json.
-//
-// If this test fails, either a cap was removed/raised or e2b resolved to
-// >=2.33.0. Do NOT lift the cap until e2b makes the shim lazy (init on first
-// use) or ships an edge/browser export — see docs/pitfalls.md
-// ("e2b SDK in the Worker: createRequire Breaks workerd").
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
-// Every e2b install in the tree: the hoisted copy plus any nested
-// packages/*/node_modules/e2b a future uncapped consumer could force in.
-function resolvedE2bVersions() {
-    const raw = readFileSync(resolve(repoRoot, 'package-lock.json'), 'utf8');
-    const lock = JSON.parse(raw);
-    const versions = Object.entries(lock.packages)
-        .filter(([key]) => key === 'node_modules/e2b' || key.endsWith('/node_modules/e2b'))
-        .map(([, entry]) => entry.version)
-        .filter((v) => typeof v === 'string');
-    if (versions.length === 0) {
-        throw new Error('no e2b entry found in package-lock.json');
-    }
-    return versions;
-}
-function isBelow2_33(version) {
-    const [major, minor] = version.split('.').map((n) => Number.parseInt(n, 10));
-    return major < 2 || (major === 2 && minor < 33);
-}
-describe('e2b workerd pin', () => {
-    it('resolves every e2b install below 2.33.0 (workerd createRequire incompatibility)', () => {
-        for (const version of resolvedE2bVersions()) {
-            expect(isBelow2_33(version), `e2b resolved to ${version}; every install must stay <2.33.0 until the ` +
-                `workerd createRequire shim is fixed (see docs/pitfalls.md).`).toBe(true);
-        }
-    });
-});

package/dist/ui/assets/provider-store-access-DyDHzY1t.js

@@ -1 +0,0 @@
-import{t as e}from"./store-FJJcjvMM.js";export{e as readMcpAuthEntries};