vibemancer 1.0.1 → 1.0.3

package/dist/{chunk-4DUS7IHW.js → chunk-CMTEJ5MU.js}

@@ -72,13 +72,16 @@ function getCoreCompileOptions() {
     }
   };
 }
+var EXTRA_RESOLVABLE_BOTS = {
+  Hero: "Hero.ts"
+};
 function getBuiltinBotNames() {
   return Object.keys(BUILTIN_BOTS);
 }
 function resolveOpponent(name) {
-  const relativePath = BUILTIN_BOTS[name];
+  const relativePath = BUILTIN_BOTS[name] ?? EXTRA_RESOLVABLE_BOTS[name];
   if (!relativePath) {
-    const available = Object.keys(BUILTIN_BOTS).join(", ");
+    const available = [...Object.keys(BUILTIN_BOTS), ...Object.keys(EXTRA_RESOLVABLE_BOTS)].join(", ");
     throw new Error(
       `Unknown opponent "${name}".
 Available built-in bots: ${available}`
@@ -98,4 +101,4 @@ export {
   getBuiltinBotNames,
   resolveOpponent
 };
-//# sourceMappingURL=chunk-4DUS7IHW.js.map
+//# sourceMappingURL=chunk-CMTEJ5MU.js.map

package/dist/{chunk-4DUS7IHW.js.map → chunk-CMTEJ5MU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/opponent-resolver.ts"],"sourcesContent":["/**\r\n * Opponent Resolver\r\n *\r\n * Resolves an opponent name (e.g., \"Battlemage\", \"Turtle\") to a BotBundle\r\n * pointing at the built-in bot's TypeScript source file.\r\n */\r\n\r\nimport path from 'node:path';\r\nimport fs from 'node:fs';\r\nimport {fileURLToPath} from 'node:url';\r\nimport {BotBundle} from '@vibemancer/core';\r\nimport type {CompileOptions} from '@vibemancer/core';\r\n\r\n/**\r\n * Find the @vibemancer/core package's source directory.\r\n * The core package ships with both dist/ and src/ (TypeScript source).\r\n * esbuild needs the TypeScript source for compilation.\r\n */\r\nexport function findCoreSourceDir(): string\r\n{\r\n\t// When running from the monorepo (development), core is a sibling package\r\n\tconst monorepoCore = path.resolve(import.meta.dirname, '..', '..', 'core', 'src');\r\n\tif (fs.existsSync(path.join(monorepoCore, 'engine', 'simulation.ts')))\r\n\t{\r\n\t\treturn monorepoCore;\r\n\t}\r\n\r\n\t// When installed as a dependency, core is in node_modules\r\n\t// Use import.meta.resolve to find the package\r\n\ttry\r\n\t{\r\n\t\tconst coreIndex = import.meta.resolve('@vibemancer/core');\r\n\t\t// coreIndex = file:///path/to/node_modules/@vibemancer/core/dist/index.js\r\n\t\tconst coreIndexPath = fileURLToPath(coreIndex);\r\n\t\tconst coreRoot = path.resolve(path.dirname(coreIndexPath), '..');\r\n\t\tconst srcDir = path.join(coreRoot, 'src');\r\n\t\tif (fs.existsSync(path.join(srcDir, 'engine', 'simulation.ts')))\r\n\t\t{\r\n\t\t\treturn srcDir;\r\n\t\t}\r\n\t}\r\n\tcatch\r\n\t{\r\n\t\t// import.meta.resolve failed\r\n\t}\r\n\r\n\tthrow new Error(\r\n\t\t'Could not find @vibemancer/core source directory.\\n'\r\n\t\t+ 'Ensure @vibemancer/core is installed and includes its src/ directory.',\r\n\t);\r\n}\r\n\r\n/**\r\n * Built-in bot source file mapping.\r\n * Maps bot name → relative path from core's src/bots/ directory.\r\n *\r\n * Derived from the naming convention:\r\n * - Standalone: standalone/{Name}.ts\r\n * - Tiered: {group}/{nn}_{Name}.ts\r\n */\r\nconst BUILTIN_BOTS: Record<string, string> = {\r\n\t// Standalone\r\n\tTargetDummy: 'standalone/TargetDummy.ts',\r\n\tCritter: 'standalone/Critter.ts',\r\n\tRookie: 'standalone/Rookie.ts',\r\n\tHogger: 'standalone/Hogger.ts',\r\n\tDoombringer: 'standalone/Doombringer.ts',\r\n\t// Defensive\r\n\tTurtle: 'defensive/01_Turtle.ts',\r\n\tSentinel: 'defensive/02_Sentinel.ts',\r\n\tGolem: 'defensive/03_Golem.ts',\r\n\t// Melee\r\n\tShadowblade: 'melee/01_Shadowblade.ts',\r\n\tNightblade: 'melee/02_Nightblade.ts',\r\n\tVoidblade: 'melee/03_Voidblade.ts',\r\n\t// Homing\r\n\tBonemancer: 'homing/01_Bonemancer.ts',\r\n\tLich: 'homing/02_Lich.ts',\r\n\tArchlich: 'homing/03_Archlich.ts',\r\n\t// Caster\r\n\tFlamecaller: 'caster/01_Flamecaller.ts',\r\n\tPyromancer: 'caster/02_Pyromancer.ts',\r\n\tInfernalist: 'caster/03_Infernalist.ts',\r\n\t// Sniper\r\n\tSpellshot: 'sniper/01_Spellshot.ts',\r\n\tSpelltracer: 'sniper/02_Spelltracer.ts',\r\n\tSpellseeker: 'sniper/03_Spellseeker.ts',\r\n\t// Duelist\r\n\tBattlemage: 'duelist/01_Battlemage.ts',\r\n\tWarmage: 'duelist/02_Warmage.ts',\r\n\tArchmage: 'duelist/03_Archmage.ts',\r\n\t// Berserker\r\n\tStormchaser: 'berserker/01_Stormchaser.ts',\r\n\tStormcaller: 'berserker/02_Stormcaller.ts',\r\n\tStormforger: 'berserker/03_Stormforger.ts',\r\n\t// Kiter\r\n\tSpellspinner: 'kiter/01_Spellspinner.ts',\r\n\tSpellweaver: 'kiter/02_Spellweaver.ts',\r\n\tSpellbinder: 'kiter/03_Spellbinder.ts',\r\n};\r\n\r\n/**\r\n * Get CompileOptions that alias @vibemancer/core to the TypeScript source.\r\n * Required for compiling user bots that import from @vibemancer/core.\r\n */\r\nexport function getCoreCompileOptions(): CompileOptions\r\n{\r\n\tconst coreSourceDir = findCoreSourceDir();\r\n\treturn {\r\n\t\talias: {\r\n\t\t\t'@vibemancer/core': coreSourceDir + '/index-browser.ts',\r\n\t\t},\r\n\t};\r\n}\r\n\r\n/**\r\n * Get the list of all built-in bot names.\r\n */\r\nexport function getBuiltinBotNames(): string[]\r\n{\r\n\treturn Object.keys(BUILTIN_BOTS);\r\n}\r\n\r\n/**\r\n * Resolve an opponent name to a BotBundle.\r\n *\r\n * @param name - Built-in bot name (e.g., \"Battlemage\")\r\n * @returns BotBundle pointing at the bot's TypeScript source\r\n */\r\nexport function resolveOpponent(name: string): BotBundle\r\n{\r\n\tconst relativePath = BUILTIN_BOTS[name];\r\n\tif (!relativePath)\r\n\t{\r\n\t\tconst available = Object.keys(BUILTIN_BOTS).join(', ');\r\n\t\tthrow new Error(\r\n\t\t\t`Unknown opponent \"${name}\".\\n`\r\n\t\t\t+ `Available built-in bots: ${available}`,\r\n\t\t);\r\n\t}\r\n\r\n\tconst coreSourceDir = findCoreSourceDir();\r\n\tconst sourcePath = path.join(coreSourceDir, 'bots', relativePath);\r\n\r\n\tif (!fs.existsSync(sourcePath))\r\n\t{\r\n\t\tthrow new Error(`Built-in bot source not found: ${sourcePath}`);\r\n\t}\r\n\r\n\treturn new BotBundle(sourcePath, name);\r\n}\r\n"],"mappings":";;;AAOA,OAAO,UAAU;AACjB,OAAO,QAAQ;AACf,SAAQ,qBAAoB;AAC5B,SAAQ,iBAAgB;AAQjB,SAAS,oBAChB;AAEC,QAAM,eAAe,KAAK,QAAQ,YAAY,SAAS,MAAM,MAAM,QAAQ,KAAK;AAChF,MAAI,GAAG,WAAW,KAAK,KAAK,cAAc,UAAU,eAAe,CAAC,GACpE;AACC,WAAO;AAAA,EACR;AAIA,MACA;AACC,UAAM,YAAY,YAAY,QAAQ,kBAAkB;AAExD,UAAM,gBAAgB,cAAc,SAAS;AAC7C,UAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ,aAAa,GAAG,IAAI;AAC/D,UAAM,SAAS,KAAK,KAAK,UAAU,KAAK;AACxC,QAAI,GAAG,WAAW,KAAK,KAAK,QAAQ,UAAU,eAAe,CAAC,GAC9D;AACC,aAAO;AAAA,IACR;AAAA,EACD,QAEA;AAAA,EAEA;AAEA,QAAM,IAAI;AAAA,IACT;AAAA,EAED;AACD;AAUA,IAAM,eAAuC;AAAA;AAAA,EAE5C,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,aAAa;AAAA;AAAA,EAEb,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,OAAO;AAAA;AAAA,EAEP,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA;AAAA,EAEX,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,UAAU;AAAA;AAAA,EAEV,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,aAAa;AAAA;AAAA,EAEb,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA;AAAA,EAEb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA;AAAA,EAEV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA;AAAA,EAEb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,aAAa;AACd;AAMO,SAAS,wBAChB;AACC,QAAM,gBAAgB,kBAAkB;AACxC,SAAO;AAAA,IACN,OAAO;AAAA,MACN,oBAAoB,gBAAgB;AAAA,IACrC;AAAA,EACD;AACD;AAKO,SAAS,qBAChB;AACC,SAAO,OAAO,KAAK,YAAY;AAChC;AAQO,SAAS,gBAAgB,MAChC;AACC,QAAM,eAAe,aAAa,IAAI;AACtC,MAAI,CAAC,cACL;AACC,UAAM,YAAY,OAAO,KAAK,YAAY,EAAE,KAAK,IAAI;AACrD,UAAM,IAAI;AAAA,MACT,qBAAqB,IAAI;AAAA,2BACK,SAAS;AAAA,IACxC;AAAA,EACD;AAEA,QAAM,gBAAgB,kBAAkB;AACxC,QAAM,aAAa,KAAK,KAAK,eAAe,QAAQ,YAAY;AAEhE,MAAI,CAAC,GAAG,WAAW,UAAU,GAC7B;AACC,UAAM,IAAI,MAAM,kCAAkC,UAAU,EAAE;AAAA,EAC/D;AAEA,SAAO,IAAI,UAAU,YAAY,IAAI;AACtC;","names":[]}
+{"version":3,"sources":["../src/opponent-resolver.ts"],"sourcesContent":["/**\r\n * Opponent Resolver\r\n *\r\n * Resolves an opponent name (e.g., \"Battlemage\", \"Turtle\") to a BotBundle\r\n * pointing at the built-in bot's TypeScript source file.\r\n */\r\n\r\nimport path from 'node:path';\r\nimport fs from 'node:fs';\r\nimport {fileURLToPath} from 'node:url';\r\nimport {BotBundle} from '@vibemancer/core';\r\nimport type {CompileOptions} from '@vibemancer/core';\r\n\r\n/**\r\n * Find the @vibemancer/core package's source directory.\r\n * The core package ships with both dist/ and src/ (TypeScript source).\r\n * esbuild needs the TypeScript source for compilation.\r\n */\r\nexport function findCoreSourceDir(): string\r\n{\r\n\t// When running from the monorepo (development), core is a sibling package\r\n\tconst monorepoCore = path.resolve(import.meta.dirname, '..', '..', 'core', 'src');\r\n\tif (fs.existsSync(path.join(monorepoCore, 'engine', 'simulation.ts')))\r\n\t{\r\n\t\treturn monorepoCore;\r\n\t}\r\n\r\n\t// When installed as a dependency, core is in node_modules\r\n\t// Use import.meta.resolve to find the package\r\n\ttry\r\n\t{\r\n\t\tconst coreIndex = import.meta.resolve('@vibemancer/core');\r\n\t\t// coreIndex = file:///path/to/node_modules/@vibemancer/core/dist/index.js\r\n\t\tconst coreIndexPath = fileURLToPath(coreIndex);\r\n\t\tconst coreRoot = path.resolve(path.dirname(coreIndexPath), '..');\r\n\t\tconst srcDir = path.join(coreRoot, 'src');\r\n\t\tif (fs.existsSync(path.join(srcDir, 'engine', 'simulation.ts')))\r\n\t\t{\r\n\t\t\treturn srcDir;\r\n\t\t}\r\n\t}\r\n\tcatch\r\n\t{\r\n\t\t// import.meta.resolve failed\r\n\t}\r\n\r\n\tthrow new Error(\r\n\t\t'Could not find @vibemancer/core source directory.\\n'\r\n\t\t+ 'Ensure @vibemancer/core is installed and includes its src/ directory.',\r\n\t);\r\n}\r\n\r\n/**\r\n * Built-in bot source file mapping.\r\n * Maps bot name → relative path from core's src/bots/ directory.\r\n *\r\n * Derived from the naming convention:\r\n * - Standalone: standalone/{Name}.ts\r\n * - Tiered: {group}/{nn}_{Name}.ts\r\n */\r\nconst BUILTIN_BOTS: Record<string, string> = {\r\n\t// Standalone\r\n\tTargetDummy: 'standalone/TargetDummy.ts',\r\n\tCritter: 'standalone/Critter.ts',\r\n\tRookie: 'standalone/Rookie.ts',\r\n\tHogger: 'standalone/Hogger.ts',\r\n\tDoombringer: 'standalone/Doombringer.ts',\r\n\t// Defensive\r\n\tTurtle: 'defensive/01_Turtle.ts',\r\n\tSentinel: 'defensive/02_Sentinel.ts',\r\n\tGolem: 'defensive/03_Golem.ts',\r\n\t// Melee\r\n\tShadowblade: 'melee/01_Shadowblade.ts',\r\n\tNightblade: 'melee/02_Nightblade.ts',\r\n\tVoidblade: 'melee/03_Voidblade.ts',\r\n\t// Homing\r\n\tBonemancer: 'homing/01_Bonemancer.ts',\r\n\tLich: 'homing/02_Lich.ts',\r\n\tArchlich: 'homing/03_Archlich.ts',\r\n\t// Caster\r\n\tFlamecaller: 'caster/01_Flamecaller.ts',\r\n\tPyromancer: 'caster/02_Pyromancer.ts',\r\n\tInfernalist: 'caster/03_Infernalist.ts',\r\n\t// Sniper\r\n\tSpellshot: 'sniper/01_Spellshot.ts',\r\n\tSpelltracer: 'sniper/02_Spelltracer.ts',\r\n\tSpellseeker: 'sniper/03_Spellseeker.ts',\r\n\t// Duelist\r\n\tBattlemage: 'duelist/01_Battlemage.ts',\r\n\tWarmage: 'duelist/02_Warmage.ts',\r\n\tArchmage: 'duelist/03_Archmage.ts',\r\n\t// Berserker\r\n\tStormchaser: 'berserker/01_Stormchaser.ts',\r\n\tStormcaller: 'berserker/02_Stormcaller.ts',\r\n\tStormforger: 'berserker/03_Stormforger.ts',\r\n\t// Kiter\r\n\tSpellspinner: 'kiter/01_Spellspinner.ts',\r\n\tSpellweaver: 'kiter/02_Spellweaver.ts',\r\n\tSpellbinder: 'kiter/03_Spellbinder.ts',\r\n};\r\n\r\n/**\r\n * Get CompileOptions that alias @vibemancer/core to the TypeScript source.\r\n * Required for compiling user bots that import from @vibemancer/core.\r\n */\r\nexport function getCoreCompileOptions(): CompileOptions\r\n{\r\n\tconst coreSourceDir = findCoreSourceDir();\r\n\treturn {\r\n\t\talias: {\r\n\t\t\t'@vibemancer/core': coreSourceDir + '/index-browser.ts',\r\n\t\t},\r\n\t};\r\n}\r\n\r\n/**\r\n * Hero is resolvable but NOT part of the 29-bot roster.\r\n *\r\n * It is the adaptive SHOWCASE players build their own bot to beat, and `fight` advertises\r\n * \"all 29 built-in bots\" everywhere — scaffolder banner, README, scoring denominator — so\r\n * adding it to BUILTIN_BOTS would silently change what `fight` and `optimize` mean.\r\n *\r\n * But `vibemancer bots Hero` prints \"To fight: vibemancer fight --opponent Hero\", and that\r\n * command failed, because nothing could resolve the name. A tool printing a command it\r\n * cannot run is worse than omitting it: the user assumes they mistyped. So Hero resolves\r\n * for a DELIBERATE single fight, and stays out of the roster everything else counts.\r\n */\r\nconst EXTRA_RESOLVABLE_BOTS: Record<string, string> = {\r\n\tHero: 'Hero.ts',\r\n};\r\n\r\n/**\r\n * Get the list of all built-in bot names.\r\n */\r\nexport function getBuiltinBotNames(): string[]\r\n{\r\n\treturn Object.keys(BUILTIN_BOTS);\r\n}\r\n\r\n/**\r\n * Resolve an opponent name to a BotBundle.\r\n *\r\n * @param name - Built-in bot name (e.g., \"Battlemage\")\r\n * @returns BotBundle pointing at the bot's TypeScript source\r\n */\r\nexport function resolveOpponent(name: string): BotBundle\r\n{\r\n\tconst relativePath = BUILTIN_BOTS[name] ?? EXTRA_RESOLVABLE_BOTS[name];\r\n\tif (!relativePath)\r\n\t{\r\n\t\tconst available = [...Object.keys(BUILTIN_BOTS), ...Object.keys(EXTRA_RESOLVABLE_BOTS)].join(', ');\r\n\t\tthrow new Error(\r\n\t\t\t`Unknown opponent \"${name}\".\\n`\r\n\t\t\t+ `Available built-in bots: ${available}`,\r\n\t\t);\r\n\t}\r\n\r\n\tconst coreSourceDir = findCoreSourceDir();\r\n\tconst sourcePath = path.join(coreSourceDir, 'bots', relativePath);\r\n\r\n\tif (!fs.existsSync(sourcePath))\r\n\t{\r\n\t\tthrow new Error(`Built-in bot source not found: ${sourcePath}`);\r\n\t}\r\n\r\n\treturn new BotBundle(sourcePath, name);\r\n}\r\n"],"mappings":";;;AAOA,OAAO,UAAU;AACjB,OAAO,QAAQ;AACf,SAAQ,qBAAoB;AAC5B,SAAQ,iBAAgB;AAQjB,SAAS,oBAChB;AAEC,QAAM,eAAe,KAAK,QAAQ,YAAY,SAAS,MAAM,MAAM,QAAQ,KAAK;AAChF,MAAI,GAAG,WAAW,KAAK,KAAK,cAAc,UAAU,eAAe,CAAC,GACpE;AACC,WAAO;AAAA,EACR;AAIA,MACA;AACC,UAAM,YAAY,YAAY,QAAQ,kBAAkB;AAExD,UAAM,gBAAgB,cAAc,SAAS;AAC7C,UAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ,aAAa,GAAG,IAAI;AAC/D,UAAM,SAAS,KAAK,KAAK,UAAU,KAAK;AACxC,QAAI,GAAG,WAAW,KAAK,KAAK,QAAQ,UAAU,eAAe,CAAC,GAC9D;AACC,aAAO;AAAA,IACR;AAAA,EACD,QAEA;AAAA,EAEA;AAEA,QAAM,IAAI;AAAA,IACT;AAAA,EAED;AACD;AAUA,IAAM,eAAuC;AAAA;AAAA,EAE5C,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,aAAa;AAAA;AAAA,EAEb,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,OAAO;AAAA;AAAA,EAEP,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA;AAAA,EAEX,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,UAAU;AAAA;AAAA,EAEV,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,aAAa;AAAA;AAAA,EAEb,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA;AAAA,EAEb,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA;AAAA,EAEV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA;AAAA,EAEb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,aAAa;AACd;AAMO,SAAS,wBAChB;AACC,QAAM,gBAAgB,kBAAkB;AACxC,SAAO;AAAA,IACN,OAAO;AAAA,MACN,oBAAoB,gBAAgB;AAAA,IACrC;AAAA,EACD;AACD;AAcA,IAAM,wBAAgD;AAAA,EACrD,MAAM;AACP;AAKO,SAAS,qBAChB;AACC,SAAO,OAAO,KAAK,YAAY;AAChC;AAQO,SAAS,gBAAgB,MAChC;AACC,QAAM,eAAe,aAAa,IAAI,KAAK,sBAAsB,IAAI;AACrE,MAAI,CAAC,cACL;AACC,UAAM,YAAY,CAAC,GAAG,OAAO,KAAK,YAAY,GAAG,GAAG,OAAO,KAAK,qBAAqB,CAAC,EAAE,KAAK,IAAI;AACjG,UAAM,IAAI;AAAA,MACT,qBAAqB,IAAI;AAAA,2BACK,SAAS;AAAA,IACxC;AAAA,EACD;AAEA,QAAM,gBAAgB,kBAAkB;AACxC,QAAM,aAAa,KAAK,KAAK,eAAe,QAAQ,YAAY;AAEhE,MAAI,CAAC,GAAG,WAAW,UAAU,GAC7B;AACC,UAAM,IAAI,MAAM,kCAAkC,UAAU,EAAE;AAAA,EAC/D;AAEA,SAAO,IAAI,UAAU,YAAY,IAAI;AACtC;","names":[]}

package/dist/chunk-MCU2B4PZ.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+
+// src/auth/oauth-client.ts
+import { createHash, randomBytes } from "crypto";
+
+// src/auth/credentials-store.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function configDir() {
+  return process.env.VIBEMANCER_CONFIG_DIR ?? join(homedir(), ".vibemancer");
+}
+function credentialsPath() {
+  return join(configDir(), "credentials.json");
+}
+function loadCredentials() {
+  const path = credentialsPath();
+  if (!existsSync(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    if (typeof parsed === "object" && parsed !== null && "refreshToken" in parsed && typeof parsed.refreshToken === "string" && "accessToken" in parsed && typeof parsed.accessToken === "string" && "expiresAt" in parsed && typeof parsed.expiresAt === "number") {
+      return { refreshToken: parsed.refreshToken, accessToken: parsed.accessToken, expiresAt: parsed.expiresAt };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(credentials) {
+  mkdirSync(configDir(), { recursive: true });
+  const path = credentialsPath();
+  writeFileSync(path, JSON.stringify(credentials, null, 2), { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function clearCredentials() {
+  try {
+    rmSync(credentialsPath(), { force: true });
+  } catch {
+  }
+}
+
+// src/auth/oauth-client.ts
+var MCP_BASE_URL = process.env.VIBEMANCER_MCP_URL ?? "https://mcp.vibemancer.com";
+var NotLoggedInError = class extends Error {
+  constructor() {
+    super("Not logged in. Run: vibemancer login");
+    this.name = "NotLoggedInError";
+  }
+};
+function generatePkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+async function registerClient(redirectUri) {
+  const res = await fetch(`${MCP_BASE_URL}/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ redirect_uris: [redirectUri], client_name: "vibemancer-cli" })
+  });
+  if (!res.ok) throw new Error(`Client registration failed (${res.status}).`);
+  const json = await res.json();
+  const clientId = typeof json === "object" && json !== null && "client_id" in json && typeof json.client_id === "string" ? json.client_id : "";
+  if (!clientId) throw new Error("Client registration returned no client_id.");
+  return clientId;
+}
+function parseTokenResponse(json, fallbackRefresh) {
+  if (typeof json !== "object" || json === null) throw new Error("Invalid token response.");
+  const accessToken = "access_token" in json && typeof json.access_token === "string" ? json.access_token : "";
+  if (!accessToken) throw new Error("Token response missing access_token.");
+  const refreshToken = "refresh_token" in json && typeof json.refresh_token === "string" ? json.refresh_token : fallbackRefresh;
+  const expiresIn = "expires_in" in json && typeof json.expires_in === "number" ? json.expires_in : 3600;
+  return { accessToken, refreshToken, expiresAt: Date.now() + expiresIn * 1e3 };
+}
+async function exchangeCode(code, codeVerifier) {
+  const res = await fetch(`${MCP_BASE_URL}/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ grant_type: "authorization_code", code, code_verifier: codeVerifier })
+  });
+  if (!res.ok) throw new Error(`Token exchange failed (${res.status}): ${await res.text()}`);
+  const creds = parseTokenResponse(await res.json(), "");
+  saveCredentials(creds);
+  return creds;
+}
+async function refreshCredentials(refreshToken) {
+  const res = await fetch(`${MCP_BASE_URL}/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ grant_type: "refresh_token", refresh_token: refreshToken })
+  });
+  if (!res.ok) throw new NotLoggedInError();
+  const creds = parseTokenResponse(await res.json(), refreshToken);
+  saveCredentials(creds);
+  return creds;
+}
+var REFRESH_SKEW_MS = 6e4;
+async function getAccessToken() {
+  const creds = loadCredentials();
+  if (!creds) throw new NotLoggedInError();
+  if (creds.expiresAt - Date.now() > REFRESH_SKEW_MS) return creds.accessToken;
+  const refreshed = await refreshCredentials(creds.refreshToken);
+  return refreshed.accessToken;
+}
+
+export {
+  loadCredentials,
+  clearCredentials,
+  MCP_BASE_URL,
+  NotLoggedInError,
+  generatePkce,
+  registerClient,
+  exchangeCode,
+  getAccessToken
+};
+//# sourceMappingURL=chunk-MCU2B4PZ.js.map

package/dist/chunk-MCU2B4PZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/oauth-client.ts","../src/auth/credentials-store.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/naming-convention -- OAuth 2.0 wire-format field names (grant_type, access_token, …) are snake_case by spec */\n\n/**\n * CLI OAuth client for the Vibemancer MCP gateway.\n *\n * The CLI is a PKCE OAuth client of mcp.vibemancer.com (the same gateway the MCP\n * AI clients use). `vibemancer login` runs the authorization-code flow; the\n * resulting session token carries the canonical Firebase uid. This module owns\n * PKCE, the token exchange/refresh, and handing callers a fresh access token.\n */\n\nimport {createHash, randomBytes} from 'node:crypto';\nimport {loadCredentials, saveCredentials, type Credentials} from './credentials-store.js';\n\n/** Gateway base URL; overridable for emulator/E2E via VIBEMANCER_MCP_URL. */\nexport const MCP_BASE_URL = process.env.VIBEMANCER_MCP_URL ?? 'https://mcp.vibemancer.com';\n\nexport class NotLoggedInError extends Error\n{\n\tconstructor()\n\t{\n\t\tsuper('Not logged in. Run: vibemancer login');\n\t\tthis.name = 'NotLoggedInError';\n\t}\n}\n\nexport interface Pkce\n{\n\tverifier: string;\n\tchallenge: string;\n}\n\nexport function generatePkce(): Pkce\n{\n\tconst verifier = randomBytes(32).toString('base64url');\n\tconst challenge = createHash('sha256').update(verifier).digest('base64url');\n\treturn {verifier, challenge};\n}\n\n/** Dynamic client registration → client_id (localhost/https redirect allowed). */\nexport async function registerClient(redirectUri: string): Promise<string>\n{\n\tconst res = await fetch(`${MCP_BASE_URL}/register`, {\n\t\tmethod: 'POST',\n\t\theaders: {'Content-Type': 'application/json'},\n\t\tbody: JSON.stringify({redirect_uris: [redirectUri], client_name: 'vibemancer-cli'}),\n\t});\n\tif (!res.ok) throw new Error(`Client registration failed (${res.status}).`);\n\tconst json: unknown = await res.json();\n\tconst clientId = typeof json === 'object' && json !== null && 'client_id' in json && typeof json.client_id === 'string'\n\t\t? json.client_id\n\t\t: '';\n\tif (!clientId) throw new Error('Client registration returned no client_id.');\n\treturn clientId;\n}\n\nfunction parseTokenResponse(json: unknown, fallbackRefresh: string): Credentials\n{\n\tif (typeof json !== 'object' || json === null) throw new Error('Invalid token response.');\n\tconst accessToken = 'access_token' in json && typeof json.access_token === 'string' ? json.access_token : '';\n\tif (!accessToken) throw new Error('Token response missing access_token.');\n\tconst refreshToken = 'refresh_token' in json && typeof json.refresh_token === 'string' ? json.refresh_token : fallbackRefresh;\n\tconst expiresIn = 'expires_in' in json && typeof json.expires_in === 'number' ? json.expires_in : 3600;\n\treturn {accessToken, refreshToken, expiresAt: Date.now() + expiresIn * 1000};\n}\n\n/** Exchange an authorization code (PKCE) for tokens, and persist them. */\nexport async function exchangeCode(code: string, codeVerifier: string): Promise<Credentials>\n{\n\tconst res = await fetch(`${MCP_BASE_URL}/token`, {\n\t\tmethod: 'POST',\n\t\theaders: {'Content-Type': 'application/json'},\n\t\tbody: JSON.stringify({grant_type: 'authorization_code', code, code_verifier: codeVerifier}),\n\t});\n\tif (!res.ok) throw new Error(`Token exchange failed (${res.status}): ${await res.text()}`);\n\tconst creds = parseTokenResponse(await res.json(), '');\n\tsaveCredentials(creds);\n\treturn creds;\n}\n\nasync function refreshCredentials(refreshToken: string): Promise<Credentials>\n{\n\tconst res = await fetch(`${MCP_BASE_URL}/token`, {\n\t\tmethod: 'POST',\n\t\theaders: {'Content-Type': 'application/json'},\n\t\tbody: JSON.stringify({grant_type: 'refresh_token', refresh_token: refreshToken}),\n\t});\n\tif (!res.ok) throw new NotLoggedInError();\n\tconst creds = parseTokenResponse(await res.json(), refreshToken);\n\tsaveCredentials(creds);\n\treturn creds;\n}\n\nconst REFRESH_SKEW_MS = 60_000;\n\n/** A valid access token, refreshing silently when within 60s of expiry. */\nexport async function getAccessToken(): Promise<string>\n{\n\tconst creds = loadCredentials();\n\tif (!creds) throw new NotLoggedInError();\n\tif (creds.expiresAt - Date.now() > REFRESH_SKEW_MS) return creds.accessToken;\n\tconst refreshed = await refreshCredentials(creds.refreshToken);\n\treturn refreshed.accessToken;\n}\n","/**\n * Local credential store for the CLI's OAuth session.\n *\n * Persists the refresh + access tokens at ~/.vibemancer/credentials.json so the\n * user stays logged in between commands. The directory is overridable via\n * VIBEMANCER_CONFIG_DIR (tests, or users who relocate their config).\n */\n\nimport {chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync} from 'node:fs';\nimport {homedir} from 'node:os';\nimport {join} from 'node:path';\n\nexport interface Credentials\n{\n\trefreshToken: string;\n\taccessToken: string;\n\t/** Epoch milliseconds at which the access token expires. */\n\texpiresAt: number;\n}\n\nfunction configDir(): string\n{\n\treturn process.env.VIBEMANCER_CONFIG_DIR ?? join(homedir(), '.vibemancer');\n}\n\nfunction credentialsPath(): string\n{\n\treturn join(configDir(), 'credentials.json');\n}\n\nexport function loadCredentials(): Credentials | null\n{\n\tconst path = credentialsPath();\n\tif (!existsSync(path)) return null;\n\ttry\n\t{\n\t\tconst parsed: unknown = JSON.parse(readFileSync(path, 'utf-8'));\n\t\tif (\n\t\t\ttypeof parsed === 'object' && parsed !== null\n\t\t\t&& 'refreshToken' in parsed && typeof parsed.refreshToken === 'string'\n\t\t\t&& 'accessToken' in parsed && typeof parsed.accessToken === 'string'\n\t\t\t&& 'expiresAt' in parsed && typeof parsed.expiresAt === 'number'\n\t\t)\n\t\t{\n\t\t\treturn {refreshToken: parsed.refreshToken, accessToken: parsed.accessToken, expiresAt: parsed.expiresAt};\n\t\t}\n\t\treturn null;\n\t}\n\tcatch\n\t{\n\t\treturn null;\n\t}\n}\n\nexport function saveCredentials(credentials: Credentials): void\n{\n\tmkdirSync(configDir(), {recursive: true});\n\tconst path = credentialsPath();\n\twriteFileSync(path, JSON.stringify(credentials, null, 2), {mode: 0o600});\n\t// Best-effort tighten perms (no-op semantics on Windows).\n\ttry\n\t{\n\t\tchmodSync(path, 0o600);\n\t}\n\tcatch\n\t{\n\t\t// ignore — Windows / restricted FS\n\t}\n}\n\nexport function clearCredentials(): void\n{\n\ttry\n\t{\n\t\trmSync(credentialsPath(), {force: true});\n\t}\n\tcatch\n\t{\n\t\t// ignore\n\t}\n}\n"],"mappings":";;;AAWA,SAAQ,YAAY,mBAAkB;;;ACHtC,SAAQ,WAAW,YAAY,WAAW,cAAc,QAAQ,qBAAoB;AACpF,SAAQ,eAAc;AACtB,SAAQ,YAAW;AAUnB,SAAS,YACT;AACC,SAAO,QAAQ,IAAI,yBAAyB,KAAK,QAAQ,GAAG,aAAa;AAC1E;AAEA,SAAS,kBACT;AACC,SAAO,KAAK,UAAU,GAAG,kBAAkB;AAC5C;AAEO,SAAS,kBAChB;AACC,QAAM,OAAO,gBAAgB;AAC7B,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MACA;AACC,UAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAC9D,QACC,OAAO,WAAW,YAAY,WAAW,QACtC,kBAAkB,UAAU,OAAO,OAAO,iBAAiB,YAC3D,iBAAiB,UAAU,OAAO,OAAO,gBAAgB,YACzD,eAAe,UAAU,OAAO,OAAO,cAAc,UAEzD;AACC,aAAO,EAAC,cAAc,OAAO,cAAc,aAAa,OAAO,aAAa,WAAW,OAAO,UAAS;AAAA,IACxG;AACA,WAAO;AAAA,EACR,QAEA;AACC,WAAO;AAAA,EACR;AACD;AAEO,SAAS,gBAAgB,aAChC;AACC,YAAU,UAAU,GAAG,EAAC,WAAW,KAAI,CAAC;AACxC,QAAM,OAAO,gBAAgB;AAC7B,gBAAc,MAAM,KAAK,UAAU,aAAa,MAAM,CAAC,GAAG,EAAC,MAAM,IAAK,CAAC;AAEvE,MACA;AACC,cAAU,MAAM,GAAK;AAAA,EACtB,QAEA;AAAA,EAEA;AACD;AAEO,SAAS,mBAChB;AACC,MACA;AACC,WAAO,gBAAgB,GAAG,EAAC,OAAO,KAAI,CAAC;AAAA,EACxC,QAEA;AAAA,EAEA;AACD;;;ADjEO,IAAM,eAAe,QAAQ,IAAI,sBAAsB;AAEvD,IAAM,mBAAN,cAA+B,MACtC;AAAA,EACC,cACA;AACC,UAAM,sCAAsC;AAC5C,SAAK,OAAO;AAAA,EACb;AACD;AAQO,SAAS,eAChB;AACC,QAAM,WAAW,YAAY,EAAE,EAAE,SAAS,WAAW;AACrD,QAAM,YAAY,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,WAAW;AAC1E,SAAO,EAAC,UAAU,UAAS;AAC5B;AAGA,eAAsB,eAAe,aACrC;AACC,QAAM,MAAM,MAAM,MAAM,GAAG,YAAY,aAAa;AAAA,IACnD,QAAQ;AAAA,IACR,SAAS,EAAC,gBAAgB,mBAAkB;AAAA,IAC5C,MAAM,KAAK,UAAU,EAAC,eAAe,CAAC,WAAW,GAAG,aAAa,iBAAgB,CAAC;AAAA,EACnF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,IAAI;AAC1E,QAAM,OAAgB,MAAM,IAAI,KAAK;AACrC,QAAM,WAAW,OAAO,SAAS,YAAY,SAAS,QAAQ,eAAe,QAAQ,OAAO,KAAK,cAAc,WAC5G,KAAK,YACL;AACH,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4CAA4C;AAC3E,SAAO;AACR;AAEA,SAAS,mBAAmB,MAAe,iBAC3C;AACC,MAAI,OAAO,SAAS,YAAY,SAAS,KAAM,OAAM,IAAI,MAAM,yBAAyB;AACxF,QAAM,cAAc,kBAAkB,QAAQ,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAC1G,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,sCAAsC;AACxE,QAAM,eAAe,mBAAmB,QAAQ,OAAO,KAAK,kBAAkB,WAAW,KAAK,gBAAgB;AAC9G,QAAM,YAAY,gBAAgB,QAAQ,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAClG,SAAO,EAAC,aAAa,cAAc,WAAW,KAAK,IAAI,IAAI,YAAY,IAAI;AAC5E;AAGA,eAAsB,aAAa,MAAc,cACjD;AACC,QAAM,MAAM,MAAM,MAAM,GAAG,YAAY,UAAU;AAAA,IAChD,QAAQ;AAAA,IACR,SAAS,EAAC,gBAAgB,mBAAkB;AAAA,IAC5C,MAAM,KAAK,UAAU,EAAC,YAAY,sBAAsB,MAAM,eAAe,aAAY,CAAC;AAAA,EAC3F,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0BAA0B,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,CAAC,EAAE;AACzF,QAAM,QAAQ,mBAAmB,MAAM,IAAI,KAAK,GAAG,EAAE;AACrD,kBAAgB,KAAK;AACrB,SAAO;AACR;AAEA,eAAe,mBAAmB,cAClC;AACC,QAAM,MAAM,MAAM,MAAM,GAAG,YAAY,UAAU;AAAA,IAChD,QAAQ;AAAA,IACR,SAAS,EAAC,gBAAgB,mBAAkB;AAAA,IAC5C,MAAM,KAAK,UAAU,EAAC,YAAY,iBAAiB,eAAe,aAAY,CAAC;AAAA,EAChF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,iBAAiB;AACxC,QAAM,QAAQ,mBAAmB,MAAM,IAAI,KAAK,GAAG,YAAY;AAC/D,kBAAgB,KAAK;AACrB,SAAO;AACR;AAEA,IAAM,kBAAkB;AAGxB,eAAsB,iBACtB;AACC,QAAM,QAAQ,gBAAgB;AAC9B,MAAI,CAAC,MAAO,OAAM,IAAI,iBAAiB;AACvC,MAAI,MAAM,YAAY,KAAK,IAAI,IAAI,gBAAiB,QAAO,MAAM;AACjE,QAAM,YAAY,MAAM,mBAAmB,MAAM,YAAY;AAC7D,SAAO,UAAU;AAClB;","names":[]}

package/dist/cli.js

@@ -4,10 +4,17 @@ import {
   getBuiltinBotNames,
   getCoreCompileOptions,
   resolveOpponent
-} from "./chunk-4DUS7IHW.js";
+} from "./chunk-CMTEJ5MU.js";
 import {
-  FIREBASE_CONFIG
-} from "./chunk-AA2UJPPN.js";
+  MCP_BASE_URL,
+  NotLoggedInError,
+  clearCredentials,
+  exchangeCode,
+  generatePkce,
+  getAccessToken,
+  loadCredentials,
+  registerClient
+} from "./chunk-MCU2B4PZ.js";
 
 // src/commands/dev.ts
 import { execFile } from "child_process";
@@ -217,6 +224,8 @@ function startServer(options) {
     res.setHeader("Access-Control-Allow-Origin", "*");
     res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
     res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    res.setHeader("Access-Control-Allow-Private-Network", "true");
+    res.setHeader("Access-Control-Allow-Local-Network-Access", "true");
     if (req.method === "OPTIONS") {
       res.writeHead(204);
       res.end();
@@ -329,10 +338,10 @@ import { spawn } from "child_process";
 async function runTest(_options) {
   console.log("\n  Running tests...\n");
   const code = await new Promise((resolve) => {
-    const child = spawn("npx", ["vitest", "run"], {
+    const child = spawn("npx vitest run", {
       stdio: "inherit",
       cwd: process.cwd(),
-      shell: process.platform === "win32"
+      shell: true
     });
     child.on("error", () => resolve(1));
     child.on("close", (status) => resolve(status ?? 1));
@@ -352,6 +361,16 @@ import { initializeApp, getApps } from "firebase/app";
 import { getFirestore, collection, query, where, limit, getDocs, connectFirestoreEmulator } from "firebase/firestore";
 import { getStorage, ref, getBytes, connectStorageEmulator } from "firebase/storage";
 import { isBannedBotName } from "@vibemancer/core";
+
+// src/firebase-config.ts
+var FIREBASE_CONFIG = {
+  apiKey: "AIzaSyDSUJ2jlk5_vlpGOypMtvqKjHhDmbgomIY",
+  authDomain: "le-vibemancer.firebaseapp.com",
+  projectId: "le-vibemancer",
+  storageBucket: "le-vibemancer.firebasestorage.app"
+};
+
+// src/remote-opponent.ts
 function isHandleSelector(opponent) {
   const trimmed = opponent.trim();
   const slash = trimmed.indexOf("/");
@@ -913,7 +932,8 @@ function runBots(options) {
   listAllBots();
 }
 function listAllBots() {
-  console.log("\n  Built-in Bots (29 total, ranked weakest \u2192 strongest)\n");
+  console.log("\n  Built-in Bots (29 total, by round-robin points \u2014 weakest first)");
+  console.log("  Matchups are non-transitive: a low-ranked bot may still counter yours.\n");
   for (const group of BOT_GROUPS) {
     console.log(`  ${group.label}:`);
     for (const bot of group.bots) {
@@ -994,121 +1014,15 @@ function getStyleDescription(bot) {
 // src/commands/upload.ts
 import fs4 from "fs";
 
-// src/auth/oauth-client.ts
-import { createHash, randomBytes } from "crypto";
-
-// src/auth/credentials-store.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-function configDir() {
-  return process.env.VIBEMANCER_CONFIG_DIR ?? join(homedir(), ".vibemancer");
-}
-function credentialsPath() {
-  return join(configDir(), "credentials.json");
-}
-function loadCredentials() {
-  const path7 = credentialsPath();
-  if (!existsSync(path7)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path7, "utf-8"));
-    if (typeof parsed === "object" && parsed !== null && "refreshToken" in parsed && typeof parsed.refreshToken === "string" && "accessToken" in parsed && typeof parsed.accessToken === "string" && "expiresAt" in parsed && typeof parsed.expiresAt === "number") {
-      return { refreshToken: parsed.refreshToken, accessToken: parsed.accessToken, expiresAt: parsed.expiresAt };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function saveCredentials(credentials) {
-  mkdirSync(configDir(), { recursive: true });
-  const path7 = credentialsPath();
-  writeFileSync2(path7, JSON.stringify(credentials, null, 2), { mode: 384 });
-  try {
-    chmodSync(path7, 384);
-  } catch {
-  }
-}
-function clearCredentials() {
-  try {
-    rmSync(credentialsPath(), { force: true });
-  } catch {
-  }
-}
-
-// src/auth/oauth-client.ts
-var MCP_BASE_URL = process.env.VIBEMANCER_MCP_URL ?? "https://mcp.vibemancer.com";
-var NotLoggedInError = class extends Error {
-  constructor() {
-    super("Not logged in. Run: vibemancer login");
-    this.name = "NotLoggedInError";
-  }
-};
-function generatePkce() {
-  const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-async function registerClient(redirectUri) {
-  const res = await fetch(`${MCP_BASE_URL}/register`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ redirect_uris: [redirectUri], client_name: "vibemancer-cli" })
-  });
-  if (!res.ok) throw new Error(`Client registration failed (${res.status}).`);
-  const json = await res.json();
-  const clientId = typeof json === "object" && json !== null && "client_id" in json && typeof json.client_id === "string" ? json.client_id : "";
-  if (!clientId) throw new Error("Client registration returned no client_id.");
-  return clientId;
-}
-function parseTokenResponse(json, fallbackRefresh) {
-  if (typeof json !== "object" || json === null) throw new Error("Invalid token response.");
-  const accessToken = "access_token" in json && typeof json.access_token === "string" ? json.access_token : "";
-  if (!accessToken) throw new Error("Token response missing access_token.");
-  const refreshToken = "refresh_token" in json && typeof json.refresh_token === "string" ? json.refresh_token : fallbackRefresh;
-  const expiresIn = "expires_in" in json && typeof json.expires_in === "number" ? json.expires_in : 3600;
-  return { accessToken, refreshToken, expiresAt: Date.now() + expiresIn * 1e3 };
-}
-async function exchangeCode(code, codeVerifier) {
-  const res = await fetch(`${MCP_BASE_URL}/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ grant_type: "authorization_code", code, code_verifier: codeVerifier })
-  });
-  if (!res.ok) throw new Error(`Token exchange failed (${res.status}): ${await res.text()}`);
-  const creds = parseTokenResponse(await res.json(), "");
-  saveCredentials(creds);
-  return creds;
-}
-async function refreshCredentials(refreshToken) {
-  const res = await fetch(`${MCP_BASE_URL}/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ grant_type: "refresh_token", refresh_token: refreshToken })
-  });
-  if (!res.ok) throw new NotLoggedInError();
-  const creds = parseTokenResponse(await res.json(), refreshToken);
-  saveCredentials(creds);
-  return creds;
-}
-var REFRESH_SKEW_MS = 6e4;
-async function getAccessToken() {
-  const creds = loadCredentials();
-  if (!creds) throw new NotLoggedInError();
-  if (creds.expiresAt - Date.now() > REFRESH_SKEW_MS) return creds.accessToken;
-  const refreshed = await refreshCredentials(creds.refreshToken);
-  return refreshed.accessToken;
-}
-
 // src/auth/env-headers.ts
 import os from "os";
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import path4 from "path";
 import { fileURLToPath } from "url";
 function findCliVersionFrom(here) {
   for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
     try {
-      const parsed = JSON.parse(readFileSync3(path4.resolve(here, rel), "utf8"));
+      const parsed = JSON.parse(readFileSync2(path4.resolve(here, rel), "utf8"));
       if (typeof parsed !== "object" || parsed === null) continue;
       if (!("name" in parsed) || !("version" in parsed)) continue;
       const { name, version } = parsed;
@@ -1251,7 +1165,7 @@ async function runPull(options) {
 
 // src/commands/login.ts
 import { createServer } from "http";
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline/promises";
 function buildAuthorizeUrl(baseUrl, params) {
@@ -1343,7 +1257,7 @@ async function runPasteLogin(challenge, verifier, state) {
 }
 async function runLogin(options) {
   const { verifier, challenge } = generatePkce();
-  const state = randomBytes2(16).toString("hex");
+  const state = randomBytes(16).toString("hex");
   if (options.noBrowser) {
     await runPasteLogin(challenge, verifier, state);
   } else {
@@ -1380,22 +1294,49 @@ async function runLogout() {
 }
 
 // src/commands/feedback.ts
-async function runFeedback(options) {
+async function defaultTokenLookup() {
+  const { getAccessToken: getAccessToken2 } = await import("./oauth-client-AX3HNK6P.js");
+  return await getAccessToken2();
+}
+async function runFeedback(options, tokenLookup = defaultTokenLookup) {
   const message = options.message.trim();
   if (!message) {
     console.error("  Error: feedback message cannot be empty.");
     process.exit(1);
+    return;
   }
   console.log("\n  Submitting feedback...");
+  let token;
   try {
-    const { initializeApp: initializeApp2 } = await import("firebase/app");
-    const { getFunctions, httpsCallable } = await import("firebase/functions");
-    const { FIREBASE_CONFIG: FIREBASE_CONFIG2 } = await import("./firebase-config-F6COE3NY.js");
-    const app = initializeApp2(FIREBASE_CONFIG2);
-    const functions = getFunctions(app, "us-central1");
-    const submitFn = httpsCallable(functions, "submitFeedback");
-    await submitFn({ message });
-    console.log("  Sent! Thanks for the feedback.\n");
+    token = await tokenLookup();
+  } catch {
+    token = null;
+  }
+  const headers = { "Content-Type": "application/json", ...envHeaders() };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  try {
+    const res = await fetch(`${MCP_BASE_URL}/feedback`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ message }),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) {
+      const body = await res.text();
+      let detail = body;
+      try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed === "object" && parsed !== null && "error" in parsed) {
+          detail = String(parsed.error);
+        }
+      } catch {
+      }
+      console.error(`  Failed to submit: ${detail}
+`);
+      process.exit(1);
+      return;
+    }
+    console.log(token ? "  Sent! Thanks for the feedback.\n" : "  Sent! Thanks for the feedback. (Not signed in, so we have no way to reply.)\n");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`  Failed to submit: ${msg}
@@ -1594,7 +1535,7 @@ async function main() {
     case "trace": {
       const opponent = parseFlag("--opponent");
       if (!opponent) {
-        const { getBuiltinBotNames: getBuiltinBotNames2 } = await import("./opponent-resolver-U2UK2QEJ.js");
+        const { getBuiltinBotNames: getBuiltinBotNames2 } = await import("./opponent-resolver-DJLF4CPO.js");
         const names = getBuiltinBotNames2();
         const list = names.map((n) => `  --opponent ${n}`).join("\n");
         console.error("Error: --opponent is required for trace.\n");