zelari-code 0.1.0

package/dist/cli/grokOAuth.js

@@ -0,0 +1,375 @@
+/**
+ * grokOAuth — complete OAuth flow for xAI Grok / SuperGrok provider.
+ *
+ * Implements PKCE OAuth2 (RFC 7636) flow with OpenID Connect discovery,
+ * matching the pattern used by the reference `supergrok-oauth` client
+ * (https://github.com/toptoppy/supergrok-oauth).
+ *
+ * 1. Fetch OpenID Connect discovery document from `{issuer}/.well-known/openid-configuration`
+ * 2. Generate PKCE verifier + S256 challenge
+ * 3. Build authorization URL with state, scope, code_challenge
+ * 4. Start local OAuth callback server (port 56121, path /callback)
+ * 5. Open the user's browser to the authorization URL
+ * 6. Wait for the redirect callback to deliver the authorization code
+ * 7. Verify state to prevent CSRF
+ * 8. Exchange code for access token (with code_verifier) at the token endpoint
+ * 9. Return { accessToken, expiresAt, refreshToken }
+ *
+ * The browser launcher is INJECTED so tests can verify URL construction
+ * without spawning a real browser. The fetch implementation is also injected
+ * so tests can mock the token exchange.
+ *
+ * Default config (override via env GROK_OAUTH_CLIENT_ID):
+ *   - Issuer: https://auth.x.ai
+ *   - Client ID: b1a00492-073a-47ea-816f-4c329264a828 (xAI public OAuth client)
+ *   - Scope: openid profile email offline_access grok-cli:access api:access
+ *   - Redirect: http://127.0.0.1:56121/callback
+ *
+ * @see docs/plans/2026-06-29-anathema-coder-v2.md (Task 16.2)
+ */
+import { startOAuthCallbackServer } from './oauthCallbackServer.js';
+import nodeCrypto from 'node:crypto';
+const { getRandomValues, createHash } = nodeCrypto;
+export class GrokOAuthError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'GrokOAuthError';
+    }
+}
+/**
+ * Default xAI OAuth client ID — public client registered for SuperGrok OAuth
+ * (same as used by the reference supergrok-oauth Python client).
+ */
+export const DEFAULT_GROK_OAUTH_CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
+/** Default OAuth issuer for xAI authentication server. */
+export const DEFAULT_GROK_OAUTH_ISSUER = 'https://auth.x.ai';
+/** Default OAuth scopes for full SuperGrok access (matches supergrok-oauth config). */
+export const DEFAULT_GROK_OAUTH_SCOPES = [
+    'openid',
+    'profile',
+    'email',
+    'offline_access',
+    'grok-cli:access',
+    'api:access',
+];
+/** Default redirect port (matches supergrok-oauth config). */
+export const DEFAULT_GROK_OAUTH_REDIRECT_PORT = 56121;
+/** Default redirect path (matches supergrok-oauth config). */
+export const DEFAULT_GROK_OAUTH_REDIRECT_PATH = '/callback';
+/** Fetch the OpenID Connect discovery document. */
+export async function fetchGrokDiscovery(options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const discoveryUrl = options.discoveryUrl ?? `${options.issuer ?? DEFAULT_GROK_OAUTH_ISSUER}/.well-known/openid-configuration`;
+    let response;
+    try {
+        response = await fetchImpl(discoveryUrl, { method: 'GET', headers: { Accept: 'application/json' } });
+    }
+    catch (err) {
+        throw new GrokOAuthError(`OAuth discovery network error: ${err instanceof Error ? err.message : String(err)}`, 'discovery_network_error');
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        throw new GrokOAuthError(`OAuth discovery HTTP ${response.status}: ${text.slice(0, 200)}`, `discovery_http_${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (err) {
+        throw new GrokOAuthError(`OAuth discovery returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!body || typeof body !== 'object') {
+        throw new GrokOAuthError('OAuth discovery returned non-object body');
+    }
+    const obj = body;
+    if (typeof obj.authorization_endpoint !== 'string' || typeof obj.token_endpoint !== 'string') {
+        throw new GrokOAuthError('OAuth discovery missing authorization_endpoint or token_endpoint');
+    }
+    return {
+        authorizationEndpoint: obj.authorization_endpoint,
+        tokenEndpoint: obj.token_endpoint,
+    };
+}
+/**
+ * Generate PKCE verifier (RFC 7636) and S256 challenge.
+ * Returns base64url-encoded strings (no padding).
+ */
+export function generatePkce() {
+    // 64 random bytes → base64url → strip padding → take first 128 chars
+    const random = getRandomValues(new Uint8Array(64));
+    const verifier = Buffer.from(random).toString('base64url').slice(0, 128);
+    // SHA-256(verifier) → base64url (no padding)
+    const hash = createHash('sha256').update(verifier).digest();
+    const challenge = hash.toString('base64url').replace(/=+$/, '');
+    return { verifier, challenge };
+}
+/** Build the xAI authorization URL with PKCE. */
+export function buildGrokAuthorizeUrl(options) {
+    const scopes = options.scopes ?? DEFAULT_GROK_OAUTH_SCOPES;
+    const params = new URLSearchParams({
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        response_type: 'code',
+        scope: scopes.join(' '),
+        state: options.state ?? crypto.randomUUID(),
+        code_challenge: options.codeChallenge,
+        code_challenge_method: 'S256',
+    });
+    return `${options.authorizeEndpoint}?${params.toString()}`;
+}
+/** Exchange the authorization code for an access token. */
+export async function exchangeGrokCode(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(options.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+            },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                client_id: options.clientId,
+                code: options.code,
+                redirect_uri: options.redirectUri,
+                code_verifier: options.codeVerifier,
+            }).toString(),
+        });
+    }
+    catch (err) {
+        throw new GrokOAuthError(`Token exchange network error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!response.ok) {
+        const errText = await response.text().catch(() => '');
+        throw new GrokOAuthError(`Token exchange HTTP ${response.status}: ${errText.slice(0, 200)}`, `http_${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (err) {
+        throw new GrokOAuthError(`Token exchange returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!body || typeof body !== 'object') {
+        throw new GrokOAuthError('Token exchange returned non-object body');
+    }
+    const obj = body;
+    const accessToken = obj.access_token;
+    if (typeof accessToken !== 'string' || accessToken.length === 0) {
+        throw new GrokOAuthError('Token exchange response missing access_token', 'no_access_token');
+    }
+    return parseTokenResponseBody(obj, accessToken, 'Token exchange');
+}
+/**
+ * Parse the standard OAuth token response body into a GrokOAuthResult.
+ * Shared between `exchangeGrokCode` and `refreshGrokToken`.
+ *
+ * @param label Human-readable label for the operation (used in error messages).
+ * @param accessToken Pre-validated access token from the body.
+ */
+function parseTokenResponseBody(obj, accessToken, label) {
+    const result = { accessToken };
+    if (typeof obj.expires_in === 'number' && Number.isFinite(obj.expires_in)) {
+        result.expiresAt = Date.now() + obj.expires_in * 1000;
+    }
+    if (typeof obj.refresh_token === 'string' && obj.refresh_token.length > 0) {
+        result.refreshToken = obj.refresh_token;
+    }
+    // xAI SuperGrok OAuth also returns refresh_token_expires_in (refresh token TTL).
+    // Capture it so callers can warn before the refresh token expires.
+    if (typeof obj.refresh_token_expires_in === 'number' && Number.isFinite(obj.refresh_token_expires_in)) {
+        result.refreshExpiresAt = Date.now() + obj.refresh_token_expires_in * 1000;
+    }
+    // Some providers also return `scope` — we ignore it for now.
+    void obj;
+    void label;
+    return result;
+}
+/**
+ * Exchange a refresh token for a new access token (Task D.2.1, v3-D).
+ *
+ * Per RFC 6749 §6, the request body is:
+ *   grant_type=refresh_token&refresh_token=<token>&client_id=<id>
+ *
+ * Some providers also require `client_secret` — xAI does not (public OAuth).
+ *
+ * The provider MAY rotate the refresh_token: callers should treat the
+ * returned `refreshToken` (if any) as the new authoritative value and
+ * persist it. If the provider does NOT return a new refresh_token, the
+ * caller should keep using the previous one.
+ */
+export async function refreshGrokToken(options) {
+    if (!options.clientId || options.clientId.trim().length === 0) {
+        throw new GrokOAuthError('Missing clientId', 'no_client_id');
+    }
+    if (!options.refreshToken || options.refreshToken.trim().length === 0) {
+        throw new GrokOAuthError('Missing refreshToken', 'no_refresh_token');
+    }
+    const endpoint = options.tokenEndpoint ?? 'https://oauth.x.ai/token';
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                client_id: options.clientId,
+                refresh_token: options.refreshToken,
+            }).toString(),
+        });
+    }
+    catch (err) {
+        throw new GrokOAuthError(`Token refresh network error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!response.ok) {
+        const errText = await response.text().catch(() => '');
+        // 400/401 with "invalid_grant" → refresh token expired or revoked.
+        const code = response.status === 400 || response.status === 401 ? 'invalid_grant' : `http_${response.status}`;
+        throw new GrokOAuthError(`Token refresh HTTP ${response.status}: ${errText.slice(0, 200)}`, code);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (err) {
+        throw new GrokOAuthError(`Token refresh returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!body || typeof body !== 'object') {
+        throw new GrokOAuthError('Token refresh returned non-object body');
+    }
+    const obj = body;
+    const accessToken = obj.access_token;
+    if (typeof accessToken !== 'string' || accessToken.length === 0) {
+        throw new GrokOAuthError('Token refresh response missing access_token', 'no_access_token');
+    }
+    return parseTokenResponseBody(obj, accessToken, 'Token refresh');
+}
+/**
+ * Run the complete OAuth flow.
+ *
+ * Steps:
+ *  1. Fetch OpenID Connect discovery document
+ *  2. Generate PKCE verifier + S256 challenge
+ *  3. Build authorization URL
+ *  4. Start local callback server
+ *  5. Open browser
+ *  6. Wait for callback
+ *  7. Verify state to prevent CSRF
+ *  8. Exchange code for token (with code_verifier)
+ *
+ * @throws GrokOAuthError on any failure (network, missing params, provider error).
+ */
+export async function runGrokOAuthFlow(options) {
+    const clientId = options.clientId || process.env.GROK_OAUTH_CLIENT_ID || DEFAULT_GROK_OAUTH_CLIENT_ID;
+    if (!clientId || clientId.trim().length === 0) {
+        throw new GrokOAuthError('Missing clientId', 'no_client_id');
+    }
+    const callbackPort = options.callbackPort ?? DEFAULT_GROK_OAUTH_REDIRECT_PORT;
+    const callbackPath = options.callbackPath ?? DEFAULT_GROK_OAUTH_REDIRECT_PATH;
+    const redirectUri = `http://127.0.0.1:${callbackPort}${callbackPath}`;
+    // Step 1: fetch OpenID Connect discovery document.
+    const discovery = await fetchGrokDiscovery({
+        issuer: options.issuer,
+        discoveryUrl: options.discoveryUrl,
+        fetchImpl: options.fetchImpl,
+    });
+    // Step 2: generate PKCE verifier + S256 challenge.
+    const { verifier: codeVerifier, challenge: codeChallenge } = generatePkce();
+    const state = crypto.randomUUID();
+    // Step 3: build authorize URL with PKCE.
+    const authorizeUrl = buildGrokAuthorizeUrl({
+        clientId,
+        redirectUri,
+        scopes: options.scopes,
+        state,
+        codeChallenge,
+        authorizeEndpoint: discovery.authorizationEndpoint,
+    });
+    // Step 4: start callback server.
+    let handle;
+    try {
+        handle = await startOAuthCallbackServer({
+            port: callbackPort,
+            timeoutMs: options.callbackTimeoutMs ?? 120_000,
+            expectedPath: callbackPath,
+        });
+    }
+    catch (err) {
+        throw new GrokOAuthError(`Failed to start OAuth callback server on port ${callbackPort}: ${err instanceof Error ? err.message : String(err)}`, 'callback_bind_failed');
+    }
+    try {
+        // Step 5: open browser (or call injected opener for tests).
+        if (options.onBrowserOpen) {
+            await options.onBrowserOpen(authorizeUrl);
+        }
+        else {
+            // Production path: open in default browser.
+            await openBrowser(authorizeUrl);
+        }
+        // Step 6: wait for callback.
+        const callbackResult = await handle.waitForCode();
+        // Step 7: verify state (CSRF protection).
+        if (callbackResult.state !== state) {
+            throw new GrokOAuthError(`OAuth state mismatch — possible CSRF. expected=${state} got=${callbackResult.state ?? '(none)'}`, 'state_mismatch');
+        }
+        if (callbackResult.error) {
+            throw new GrokOAuthError(`OAuth provider returned error: ${callbackResult.error}${callbackResult.errorDescription ? ` — ${callbackResult.errorDescription}` : ''}`, callbackResult.error);
+        }
+        if (!callbackResult.code) {
+            throw new GrokOAuthError('OAuth callback did not include authorization code', 'no_code');
+        }
+        // Step 8: exchange code for token (with code_verifier).
+        return await exchangeGrokCode({
+            clientId,
+            code: callbackResult.code,
+            codeVerifier,
+            redirectUri,
+            tokenEndpoint: discovery.tokenEndpoint,
+            fetchImpl: options.fetchImpl,
+        });
+    }
+    finally {
+        handle.close();
+    }
+}
+/**
+ * Open the given URL in the user's default browser. Cross-platform via
+ * child_process. Safe to call from Node 20+ — no shell injection (uses
+ * spawn with args array).
+ */
+export async function openBrowser(url) {
+    const { spawn } = await import('node:child_process');
+    // Detect platform via process.env.PLATFORM? Use process.platform.
+    // 'darwin' → open, 'win32' → start (cmd /c start ""), else → xdg-open
+    const cmd = (() => {
+        switch (process.platform) {
+            case 'darwin': return { bin: 'open', args: [url] };
+            case 'win32': return { bin: 'cmd', args: ['/c', 'start', '""', url] };
+            default: return { bin: 'xdg-open', args: [url] };
+        }
+    })();
+    return new Promise((resolve, reject) => {
+        try {
+            const child = spawn(cmd.bin, cmd.args, { stdio: 'ignore', detached: true });
+            child.on('error', (err) => reject(err));
+            child.on('spawn', () => {
+                // Detach so the browser process can outlive the Node CLI.
+                child.unref();
+                resolve();
+            });
+            // Fallback in case 'spawn' doesn't fire on all platforms.
+            setTimeout(() => resolve(), 100);
+        }
+        catch (err) {
+            reject(err);
+        }
+    });
+}
+//# sourceMappingURL=grokOAuth.js.map

package/dist/cli/grokOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokOAuth.js","sourceRoot":"","sources":["../../src/cli/grokOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,wBAAwB,EAAkC,MAAM,0BAA0B,CAAC;AACpG,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;AAkCnD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACM;IAA7C,YAAY,OAAe,EAAkB,IAAa;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,SAAI,GAAJ,IAAI,CAAS;QAExD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AAEnF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,uFAAuF;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ;IACR,SAAS;IACT,OAAO;IACP,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;CACJ,CAAC;AAEX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CAAC;AAE5D,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAIrC,EAAE;IACJ,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,yBAAyB,mCAAmC,CAAC;IAC/H,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,cAAc,CACtB,wBAAwB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAChE,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,cAAc,CAAC,0CAA0C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,cAAc,CAAC,kEAAkE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO;QACL,qBAAqB,EAAE,GAAG,CAAC,sBAAsB;QACjD,aAAa,EAAE,GAAG,CAAC,cAAc;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,qEAAqE;IACrE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEzE,6CAA6C;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEhE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CAAC,OAOrC;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,yBAAyB,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE;QAC3C,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAOtC;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,cAAc,CACtB,uBAAuB,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAClE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAC1B,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,cAAc,CAAC,yCAAyC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,cAAc,CAAC,8CAA8C,EAAE,iBAAiB,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,sBAAsB,CAAC,GAAG,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,GAA4B,EAC5B,WAAmB,EACnB,KAAa;IAEb,MAAM,MAAM,GAAoB,EAAE,WAAW,EAAE,CAAC;IAChD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1C,CAAC;IACD,iFAAiF;IACjF,mEAAmE;IACnE,IAAI,OAAO,GAAG,CAAC,wBAAwB,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACtG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAC7E,CAAC;IACD,6DAA6D;IAC7D,KAAK,GAAG,CAAC;IACT,KAAK,KAAK,CAAC;IACX,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAKtC;IACC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,cAAc,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,0BAA0B,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE7C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACtD,mEAAmE;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC9G,MAAM,IAAI,cAAc,CACtB,sBAAsB,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACjE,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,cAAc,CAAC,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,cAAc,CAAC,6CAA6C,EAAE,iBAAiB,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,sBAAsB,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAyB;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,4BAA4B,CAAC;IACtG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gCAAgC,CAAC;IAC9E,MAAM,WAAW,GAAG,oBAAoB,YAAY,GAAG,YAAY,EAAE,CAAC;IAEtE,mDAAmD;IACnD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,mDAAmD;IACnD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAElC,yCAAyC;IACzC,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,QAAQ;QACR,WAAW;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK;QACL,aAAa;QACb,iBAAiB,EAAE,SAAS,CAAC,qBAAqB;KACnD,CAAC,CAAC;IAEH,iCAAiC;IACjC,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,wBAAwB,CAAC;YACtC,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,OAAO;YAC/C,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CACtB,iDAAiD,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpH,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,4DAA4D;QAC5D,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,4CAA4C;YAC5C,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAED,6BAA6B;QAC7B,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAElD,0CAA0C;QAC1C,IAAI,cAAc,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,cAAc,CACtB,kDAAkD,KAAK,QAAQ,cAAc,CAAC,KAAK,IAAI,QAAQ,EAAE,EACjG,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CACtB,kCAAkC,cAAc,CAAC,KAAK,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EACzI,cAAc,CAAC,KAAK,CACrB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CAAC,mDAAmD,EAAE,SAAS,CAAC,CAAC;QAC3F,CAAC;QAED,wDAAwD;QACxD,OAAO,MAAM,gBAAgB,CAAC;YAC5B,QAAQ;YACR,IAAI,EAAE,cAAc,CAAC,IAAI;YACzB,YAAY;YACZ,WAAW;YACX,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE;QAChB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,OAAO,CAAC,CAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,CAAO,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,0DAA0D;gBAC1D,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,0DAA0D;YAC1D,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/keyStore.js

@@ -0,0 +1,263 @@
+/**
+ * keyStore — secure-ish key storage for CLI provider credentials.
+ *
+ * Persists API keys for MiniMax, GLM, Grok (and any other provider) to a
+ * JSON file in the user's home directory. NOT a real keychain — just a
+ * plain JSON file with restrictive file permissions. Document this in
+ * /help so users know to use OS-level secret storage for production keys.
+ *
+ * Used by Task 14.9 to support `/login <provider> <key>` from the CLI.
+ * Resolution order at provider boot:
+ *   1. process.env[ENV_VAR_NAME] (e.g. OPENAI_API_KEY)
+ *   2. Stored key in keys.json
+ *
+ * @see docs/plans/2026-06-28-zelari-code.md (Task 14.9)
+ */
+import { promises as fs, existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { getRefreshImpl, registerDefaultRefreshImpls, } from './refreshRegistry.js';
+// Idempotent — safe to call on every module load. The registry starts empty
+// and this seeds it with the built-in defaults (Grok).
+registerDefaultRefreshImpls();
+export const PROVIDERS = [
+    { id: 'openai-compatible', displayName: 'OpenAI-compatible', envVar: 'OPENAI_API_KEY' },
+    { id: 'minimax', displayName: 'MiniMax', envVar: 'MINIMAX_API_KEY', baseUrl: 'https://api.MiniMax.chat/v1' },
+    { id: 'glm', displayName: 'GLM / Z.AI', envVar: 'GLM_API_KEY', baseUrl: 'https://api.z.ai/v1' },
+    { id: 'grok', displayName: 'xAI Grok', envVar: 'GROK_API_KEY', baseUrl: 'https://api.x.ai/v1' },
+];
+export function getKeyStorePath() {
+    return process.env.ANATHEMA_KEYSTORE_FILE
+        ?? path.join(os.homedir(), '.tmp', 'zelari-code', 'keys.json');
+}
+export function getProviderSpec(id) {
+    return PROVIDERS.find((p) => p.id === id);
+}
+/**
+ * Upgrade a raw provider entry from on-disk JSON to a `StoredKey`.
+ * Accepts both the legacy bare-string shape and the new object shape.
+ * Returns null for anything we can't interpret.
+ */
+function normalizeProviderEntry(raw) {
+    if (typeof raw === 'string') {
+        return { apiKey: raw };
+    }
+    if (raw && typeof raw === 'object') {
+        const r = raw;
+        if (typeof r.apiKey === 'string' && r.apiKey.length > 0) {
+            const out = { apiKey: r.apiKey };
+            if (typeof r.expiresAt === 'number' && Number.isFinite(r.expiresAt)) {
+                out.expiresAt = r.expiresAt;
+            }
+            if (typeof r.refreshToken === 'string' && r.refreshToken.length > 0) {
+                out.refreshToken = r.refreshToken;
+            }
+            return out;
+        }
+    }
+    return null;
+}
+function readStore() {
+    const file = getKeyStorePath();
+    if (!existsSync(file))
+        return { providers: {} };
+    try {
+        const raw = readFileSync(file, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && parsed.providers && typeof parsed.providers === 'object') {
+            // Normalize + deep clone to avoid the SHALLOW-SPREAD-DEFAULTS gotcha:
+            // returning `parsed.providers` directly would let callers mutate the
+            // shared object across reads.
+            const normalizedProviders = {};
+            for (const [id, rawEntry] of Object.entries(parsed.providers)) {
+                const norm = normalizeProviderEntry(rawEntry);
+                if (norm)
+                    normalizedProviders[id] = norm;
+            }
+            return { providers: normalizedProviders };
+        }
+    }
+    catch {
+        // Corrupt file — start fresh.
+    }
+    return { providers: {} };
+}
+function writeStore(store) {
+    const file = getKeyStorePath();
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(store, null, 2), { encoding: 'utf-8', mode: 0o600 });
+}
+/** Store an API key for a provider. Overwrites any existing key. */
+export function setApiKey(providerId, key) {
+    const store = readStore();
+    store.providers[providerId] = { apiKey: key };
+    writeStore(store);
+}
+/** Remove the stored key for a provider. */
+export function clearApiKey(providerId) {
+    const store = readStore();
+    delete store.providers[providerId];
+    writeStore(store);
+}
+/** Get the stored key for a provider (null if unset). */
+export function getStoredApiKey(providerId) {
+    const store = readStore();
+    return store.providers[providerId]?.apiKey ?? null;
+}
+/**
+ * Store an OAuth token (apiKey + optional expiresAt + optional refreshToken)
+ * for a provider. Overwrites any existing entry.
+ */
+export function setOAuthToken(providerId, token) {
+    const store = readStore();
+    const entry = { apiKey: token.apiKey };
+    if (typeof token.expiresAt === 'number' && Number.isFinite(token.expiresAt)) {
+        entry.expiresAt = token.expiresAt;
+    }
+    if (typeof token.refreshToken === 'string' && token.refreshToken.length > 0) {
+        entry.refreshToken = token.refreshToken;
+    }
+    store.providers[providerId] = entry;
+    writeStore(store);
+}
+/** Read the full OAuth token record for a provider (null if unset). */
+export function getOAuthToken(providerId) {
+    const store = readStore();
+    return store.providers[providerId] ?? null;
+}
+/**
+ * Resolve a key for a provider, checking env first, then store.
+ * Returns just the apiKey string — use `resolveApiKeyWithMeta` if you also
+ * need `expiresAt` / `refreshToken`.
+ */
+export function resolveApiKey(providerId) {
+    const spec = getProviderSpec(providerId);
+    if (spec) {
+        const envKey = process.env[spec.envVar];
+        if (envKey && envKey.trim().length > 0)
+            return envKey;
+    }
+    return getStoredApiKey(providerId);
+}
+/**
+ * Resolve the full StoredKey for a provider (apiKey + expiresAt + refreshToken).
+ * Env var path returns only the apiKey (no expiry metadata).
+ *
+ * Auto-refresh (Task D.3.1): if the stored token has an `expiresAt` within
+ * the `refreshBufferMs` window AND a `refreshToken`, this function calls
+ * the injected `refreshImpl` to obtain a fresh token, persists it via
+ * `setOAuthToken`, and returns the new `StoredKey`. This is best-effort:
+ * if the refresh fails, the stale token is still returned (and the caller
+ * sees an API error from the upstream provider — surfacing the real issue).
+ *
+ * Defaults to refreshing only the Grok provider (via `refreshGrokToken`).
+ */
+export async function resolveApiKeyWithMeta(providerId, options = {}) {
+    const refreshBufferMs = options.refreshBufferMs ?? 5 * 60_000;
+    const refreshImpl = options.refreshImpl ?? defaultRefreshImpl;
+    const now = options.now ?? Date.now();
+    // 1. Env var wins (no expiry metadata — assume user manages it).
+    const spec = getProviderSpec(providerId);
+    if (spec) {
+        const envKey = process.env[spec.envVar];
+        if (envKey && envKey.trim().length > 0) {
+            return { apiKey: envKey };
+        }
+    }
+    // 2. Stored token (may include expiry + refresh).
+    const stored = getOAuthToken(providerId);
+    if (!stored)
+        return null;
+    // 3. Auto-refresh if expiry is near and we have a refresh token.
+    if (stored.expiresAt !== undefined &&
+        stored.refreshToken !== undefined &&
+        stored.expiresAt - now < refreshBufferMs) {
+        try {
+            const refreshed = await refreshImpl(providerId, stored.refreshToken);
+            // Persist new token (preserving the apiKey, expiresAt, and any new
+            // refresh_token the provider returned).
+            const next = { apiKey: refreshed.accessToken };
+            if (refreshed.expiresAt !== undefined)
+                next.expiresAt = refreshed.expiresAt;
+            if (refreshed.refreshToken !== undefined && refreshed.refreshToken.length > 0) {
+                next.refreshToken = refreshed.refreshToken;
+            }
+            else {
+                // Provider did NOT rotate the refresh_token — keep the old one.
+                next.refreshToken = stored.refreshToken;
+            }
+            // Update store in-place. We call readStore/writeStore indirectly via
+            // setOAuthToken's shape: but we need to avoid clobbering other fields.
+            // setOAuthToken accepts the same shape, so use it.
+            // Note: setOAuthToken calls readStore() which re-reads the file; that's
+            // fine — the file hasn't changed between the read above and the write
+            // below in single-threaded Node.
+            // eslint-disable-next-line @typescript-eslint/no-use-before-define
+            writeStoreDirect({ providers: { ...readStoreDirect().providers, [providerId]: next } });
+            return next;
+        }
+        catch {
+            // Refresh failed — return the stale token. Upstream will surface
+            // the auth error; user can re-login via /login grok.
+            return stored;
+        }
+    }
+    return stored;
+}
+/**
+ * Default refresh impl: looks up the provider in the refresh registry.
+ *
+ * v3-F behavior change: for providers with no registered impl (currently
+ * MiniMax, GLM, OpenAI-compatible, custom), this returns `null` instead of
+ * throwing. The caller in `resolveApiKeyWithMeta` handles `null` by returning
+ * the stale token unchanged — graceful degradation, no behavior break.
+ *
+ * To plug a custom provider in: call `registerRefreshImpl(id, impl)` once at
+ * startup (or in a test).
+ */
+const defaultRefreshImpl = async (providerId, refreshToken) => {
+    const impl = getRefreshImpl(providerId);
+    if (!impl) {
+        // No refresh impl for this provider — signal graceful no-op to the caller.
+        throw new Error(`No refresh impl registered for provider "${providerId}"`);
+    }
+    return impl(providerId, refreshToken);
+};
+/**
+ * Direct file r/w helpers exposed for `resolveApiKeyWithMeta`'s auto-refresh
+ * path. These bypass the public API to avoid an extra read/write cycle
+ * inside the resolve hot path. Behavior matches `readStore` / `writeStore`.
+ */
+function readStoreDirect() {
+    return readStore();
+}
+function writeStoreDirect(store) {
+    writeStore(store);
+}
+/** Mask a key for display: show first 4 + last 4 chars only. */
+export function maskKey(key) {
+    if (key.length <= 12)
+        return '****';
+    return `${key.slice(0, 4)}…${key.slice(-4)} (len=${key.length})`;
+}
+/** Async variant for callers that prefer async I/O (used by tests). */
+export async function loadStoredKeys() {
+    const file = getKeyStorePath();
+    try {
+        const raw = await fs.readFile(file, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const out = {};
+        if (parsed.providers && typeof parsed.providers === 'object') {
+            for (const [id, entry] of Object.entries(parsed.providers)) {
+                const norm = normalizeProviderEntry(entry);
+                if (norm)
+                    out[id] = norm.apiKey;
+            }
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=keyStore.js.map

package/dist/cli/keyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyStore.js","sourceRoot":"","sources":["../../src/cli/keyStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,cAAc,EACd,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAE9B,4EAA4E;AAC5E,uDAAuD;AACvD,2BAA2B,EAAE,CAAC;AAe9B,MAAM,CAAC,MAAM,SAAS,GAA4B;IAChD,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACvF,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC5G,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC/F,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE;CACvF,CAAC;AAEX,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB;WACpC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAwBD;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAc,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;YACpC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACrG,sEAAsE;YACtE,qEAAqE;YACrE,8BAA8B;YAC9B,MAAM,mBAAmB,GAA8B,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,IAAI;oBAAE,mBAAmB,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;YAC3C,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9C,UAAU,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnC,UAAU,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,KAAoE;IAEpE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAClD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IACpC,UAAU,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,UAA0B,EAAE;IAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,MAAM,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtC,iEAAiE;IACjE,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,iEAAiE;IACjE,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,MAAM,CAAC,YAAY,KAAK,SAAS;QACjC,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,eAAe,EACxC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACrE,mEAAmE;YACnE,wCAAwC;YACxC,MAAM,IAAI,GAAc,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1D,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YAC5E,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YAC1C,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,mDAAmD;YACnD,wEAAwE;YACxE,sEAAsE;YACtE,iCAAiC;YACjC,mEAAmE;YACnE,gBAAgB,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,qDAAqD;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAwBD;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAgB,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE;IACzE,MAAM,IAAI,GAAG,cAAc,CAAC,UAA0B,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,4CAA4C,UAAU,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,eAAe;IACtB,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,UAAU,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC;AACnE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC7D,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,IAAI;oBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}