zelari-code 0.1.2 → 0.1.3

package/dist/cli/main.bundled.js

@@ -10,276 +10,71 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/cli/oauthCallbackServer.ts
-import { createServer } from "node:http";
-function startOAuthCallbackServer(options = {}) {
-  const host = options.host ?? "127.0.0.1";
-  const preferredPort = options.port ?? 14523;
-  const timeoutMs = options.timeoutMs ?? 6e4;
-  const expectedPath = options.expectedPath ?? "/oauth/callback";
-  const successHtml = options.successHtml ?? DEFAULT_SUCCESS_HTML;
-  return new Promise((resolveStart, rejectStart) => {
-    let resolved = false;
-    let resolveCode = null;
-    let rejectCode = null;
-    let timeoutHandle = null;
-    const server = createServer((req, res) => {
-      try {
-        if (!req.url) {
-          res.writeHead(400, { "Content-Type": "text/plain" });
-          res.end("Bad request");
-          return;
-        }
-        const url2 = new URL(req.url, `http://${host}:${preferredPort}`);
-        if (url2.pathname !== expectedPath) {
-          res.writeHead(404, { "Content-Type": "text/plain" });
-          res.end("Not found");
-          return;
-        }
-        const code = url2.searchParams.get("code");
-        const state = url2.searchParams.get("state");
-        const errorParam = url2.searchParams.get("error");
-        const errorDescription = url2.searchParams.get("error_description");
-        const extras = {};
-        for (const [key, value] of url2.searchParams.entries()) {
-          if (key !== "code" && key !== "state" && key !== "error" && key !== "error_description") {
-            extras[key] = value;
-          }
-        }
-        const params = {
-          ...code ? { code } : {},
-          ...state ? { state } : {},
-          ...errorParam ? { error: errorParam } : {},
-          ...errorDescription ? { errorDescription } : {},
-          extras
-        };
-        if (errorParam) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(`<h1>OAuth error: ${errorParam}</h1>`);
-          if (rejectCode && !resolved) {
-            resolved = true;
-            if (timeoutHandle) clearTimeout(timeoutHandle);
-            rejectCode(new OAuthCallbackError(`OAuth provider returned error: ${errorParam}`));
-          }
-          return;
-        }
-        if (!code) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end("<h1>Missing <code>code</code> query parameter</h1>");
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(successHtml);
-        if (resolveCode && !resolved) {
-          resolved = true;
-          if (timeoutHandle) clearTimeout(timeoutHandle);
-          resolveCode(params);
-        }
-        setTimeout(() => {
-          try {
-            server.close();
-          } catch {
-          }
-        }, 100);
-      } catch (err) {
-        try {
-          res.writeHead(500, { "Content-Type": "text/plain" });
-          res.end("Internal error");
-        } catch {
-        }
-        if (!resolved && rejectCode) {
-          resolved = true;
-          if (timeoutHandle) clearTimeout(timeoutHandle);
-          rejectCode(err instanceof Error ? err : new Error(String(err)));
-        }
-      }
-    });
-    const onError = (err) => {
-      if (!resolved) {
-        resolved = true;
-        if (timeoutHandle) clearTimeout(timeoutHandle);
-        rejectStart(err);
-      }
-    };
-    server.once("error", onError);
-    server.listen(preferredPort, host, () => {
-      const addr = server.address();
-      const actualPort = addr ? addr.port : preferredPort;
-      const waitForCode = () => {
-        return new Promise((res, rej) => {
-          if (resolved) {
-            rej(new OAuthCallbackClosedError());
-            return;
-          }
-          resolveCode = res;
-          rejectCode = rej;
-          timeoutHandle = setTimeout(() => {
-            if (!resolved) {
-              resolved = true;
-              try {
-                server.close();
-              } catch {
-              }
-              rej(new OAuthCallbackTimeoutError(timeoutMs));
-            }
-          }, timeoutMs);
-          if (typeof timeoutHandle?.unref === "function") timeoutHandle.unref();
-        });
-      };
-      const close = () => {
-        if (timeoutHandle) clearTimeout(timeoutHandle);
-        try {
-          server.close();
-        } catch {
-        }
-        if (!resolved && rejectCode) {
-          resolved = true;
-          rejectCode(new OAuthCallbackClosedError());
-        }
-      };
-      resolveStart({ port: actualPort, waitForCode, close });
-    });
-  });
-}
-var DEFAULT_SUCCESS_HTML, OAuthCallbackTimeoutError, OAuthCallbackClosedError, OAuthCallbackError;
-var init_oauthCallbackServer = __esm({
-  "src/cli/oauthCallbackServer.ts"() {
-    "use strict";
-    DEFAULT_SUCCESS_HTML = `
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <title>zelari-code OAuth</title>
-</head>
-<body style="font-family: -apple-system, BlinkMacSystemFont, sans-serif; padding: 40px; text-align: center; color: #1a1a1a;">
-  <h1 style="color: #00aa33;">\u2713 Authentication complete</h1>
-  <p>You can close this tab and return to zelari-code.</p>
-</body>
-</html>
-`.trim();
-    OAuthCallbackTimeoutError = class extends Error {
-      constructor(timeoutMs) {
-        super(`OAuth callback not received within ${timeoutMs}ms`);
-        this.name = "OAuthCallbackTimeoutError";
-      }
-    };
-    OAuthCallbackClosedError = class extends Error {
-      constructor() {
-        super("OAuth callback server closed before receiving a callback");
-        this.name = "OAuthCallbackClosedError";
-      }
-    };
-    OAuthCallbackError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "OAuthCallbackError";
-      }
-    };
-  }
-});
-
 // src/cli/grokOAuth.ts
-import nodeCrypto from "node:crypto";
-async function fetchGrokDiscovery(options = {}) {
+async function requestDeviceCode(options) {
   const fetchImpl = options.fetchImpl ?? fetch;
-  const discoveryUrl = options.discoveryUrl ?? `${options.issuer ?? DEFAULT_GROK_OAUTH_ISSUER}/.well-known/openid-configuration`;
-  let response;
-  try {
-    response = await fetchImpl(discoveryUrl, { method: "GET", headers: { Accept: "application/json" } });
-  } catch (err) {
-    throw new GrokOAuthError(`OAuth discovery network error: ${err instanceof Error ? err.message : String(err)}`, "discovery_network_error");
-  }
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    throw new GrokOAuthError(
-      `OAuth discovery HTTP ${response.status}: ${text.slice(0, 200)}`,
-      `discovery_http_${response.status}`
-    );
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch (err) {
-    throw new GrokOAuthError(`OAuth discovery returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (!body || typeof body !== "object") {
-    throw new GrokOAuthError("OAuth discovery returned non-object body");
-  }
-  const obj = body;
-  if (typeof obj.authorization_endpoint !== "string" || typeof obj.token_endpoint !== "string") {
-    throw new GrokOAuthError("OAuth discovery missing authorization_endpoint or token_endpoint");
-  }
-  return {
-    authorizationEndpoint: obj.authorization_endpoint,
-    tokenEndpoint: obj.token_endpoint
-  };
-}
-function generatePkce() {
-  const random = getRandomValues(new Uint8Array(64));
-  const verifier = Buffer.from(random).toString("base64url").slice(0, 128);
-  const hash2 = createHash("sha256").update(verifier).digest();
-  const challenge = hash2.toString("base64url").replace(/=+$/, "");
-  return { verifier, challenge };
-}
-function buildGrokAuthorizeUrl(options) {
+  const endpoint = options.deviceCodeEndpoint ?? DEFAULT_DEVICE_CODE_ENDPOINT;
   const scopes = options.scopes ?? DEFAULT_GROK_OAUTH_SCOPES;
-  const params = new URLSearchParams({
-    client_id: options.clientId,
-    redirect_uri: options.redirectUri,
-    response_type: "code",
-    scope: scopes.join(" "),
-    state: options.state ?? crypto.randomUUID(),
-    code_challenge: options.codeChallenge,
-    code_challenge_method: "S256"
-  });
-  return `${options.authorizeEndpoint}?${params.toString()}`;
-}
-async function exchangeGrokCode(options) {
-  const fetchImpl = options.fetchImpl ?? fetch;
   let response;
   try {
-    response = await fetchImpl(options.tokenEndpoint, {
+    response = await fetchImpl(endpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
         Accept: "application/json"
       },
       body: new URLSearchParams({
-        grant_type: "authorization_code",
         client_id: options.clientId,
-        code: options.code,
-        redirect_uri: options.redirectUri,
-        code_verifier: options.codeVerifier
+        scope: scopes.join(" ")
       }).toString()
     });
   } catch (err) {
-    throw new GrokOAuthError(`Token exchange network error: ${err instanceof Error ? err.message : String(err)}`);
+    throw new GrokOAuthError(
+      `Device code request network error: ${err instanceof Error ? err.message : String(err)}`,
+      "device_code_network_error"
+    );
   }
   if (!response.ok) {
     const errText = await response.text().catch(() => "");
     throw new GrokOAuthError(
-      `Token exchange HTTP ${response.status}: ${errText.slice(0, 200)}`,
-      `http_${response.status}`
+      `Device code request HTTP ${response.status}: ${errText.slice(0, 200)}`,
+      `device_code_http_${response.status}`
     );
   }
   let body;
   try {
     body = await response.json();
   } catch (err) {
-    throw new GrokOAuthError(`Token exchange returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    throw new GrokOAuthError(
+      `Device code response invalid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
   if (!body || typeof body !== "object") {
-    throw new GrokOAuthError("Token exchange returned non-object body");
+    throw new GrokOAuthError("Device code response is not an object");
   }
   const obj = body;
-  const accessToken = obj.access_token;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new GrokOAuthError("Token exchange response missing access_token", "no_access_token");
+  const deviceCode = obj.device_code;
+  const userCode = obj.user_code;
+  const verificationUri = obj.verification_uri;
+  if (typeof deviceCode !== "string" || deviceCode.length === 0) {
+    throw new GrokOAuthError("Device code response missing device_code", "no_device_code");
+  }
+  if (typeof userCode !== "string" || userCode.length === 0) {
+    throw new GrokOAuthError("Device code response missing user_code", "no_user_code");
+  }
+  if (typeof verificationUri !== "string" || verificationUri.length === 0) {
+    throw new GrokOAuthError("Device code response missing verification_uri", "no_verification_uri");
   }
-  return parseTokenResponseBody(obj, accessToken, "Token exchange");
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...typeof obj.verification_uri_complete === "string" && obj.verification_uri_complete.length > 0 ? { verificationUriComplete: obj.verification_uri_complete } : {},
+    expiresIn: typeof obj.expires_in === "number" && Number.isFinite(obj.expires_in) ? obj.expires_in : 1800,
+    interval: typeof obj.interval === "number" && Number.isFinite(obj.interval) ? obj.interval : 5
+  };
 }
-function parseTokenResponseBody(obj, accessToken, label) {
+function parseTokenResponseBody(obj, accessToken) {
   const result = { accessToken };
   if (typeof obj.expires_in === "number" && Number.isFinite(obj.expires_in)) {
     result.expiresAt = Date.now() + obj.expires_in * 1e3;
@@ -292,6 +87,116 @@ function parseTokenResponseBody(obj, accessToken, label) {
   }
   return result;
 }
+async function pollForDeviceToken(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const sleep = options.sleepImpl ?? defaultSleep;
+  const endpoint = options.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+  const deadline = Date.now() + options.timeoutMs;
+  let interval = Math.max(options.interval, 1);
+  while (true) {
+    if (Date.now() >= deadline) {
+      throw new GrokOAuthError("Device authorization timed out waiting for user approval", "timeout");
+    }
+    let response;
+    try {
+      response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: DEVICE_GRANT_TYPE,
+          client_id: options.clientId,
+          device_code: options.deviceCode
+        }).toString()
+      });
+    } catch (err) {
+      throw new GrokOAuthError(
+        `Token poll network error: ${err instanceof Error ? err.message : String(err)}`,
+        "poll_network_error"
+      );
+    }
+    if (response.ok) {
+      let body;
+      try {
+        body = await response.json();
+      } catch (err) {
+        throw new GrokOAuthError(
+          `Token response invalid JSON: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      if (!body || typeof body !== "object") {
+        throw new GrokOAuthError("Token response is not an object");
+      }
+      const obj = body;
+      const accessToken = obj.access_token;
+      if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new GrokOAuthError("Token response missing access_token", "no_access_token");
+      }
+      return parseTokenResponseBody(obj, accessToken);
+    }
+    let errBody = {};
+    try {
+      const parsed = await response.json();
+      if (parsed && typeof parsed === "object") errBody = parsed;
+    } catch {
+    }
+    const errorCode = typeof errBody.error === "string" ? errBody.error : `http_${response.status}`;
+    switch (errorCode) {
+      case "authorization_pending":
+        await sleep(interval * 1e3);
+        continue;
+      case "slow_down":
+        interval += 5;
+        await sleep(interval * 1e3);
+        continue;
+      case "expired_token":
+      case "expired":
+        throw new GrokOAuthError("Device code expired before user authorized", "expired");
+      case "access_denied":
+      case "denied":
+        throw new GrokOAuthError("User denied the authorization request", "denied");
+      case "invalid_grant":
+        throw new GrokOAuthError("Device code rejected (invalid_grant)", "invalid_grant");
+      default:
+        throw new GrokOAuthError(
+          `Token poll error: ${errorCode}${typeof errBody.error_description === "string" ? ` \u2014 ${errBody.error_description}` : ""}`,
+          errorCode
+        );
+    }
+  }
+}
+async function runGrokOAuthFlow(options = {}) {
+  const clientId = options.clientId || process.env.GROK_OAUTH_CLIENT_ID || DEFAULT_GROK_OAUTH_CLIENT_ID;
+  if (!clientId || clientId.trim().length === 0) {
+    throw new GrokOAuthError("Missing clientId", "no_client_id");
+  }
+  const deviceAuth = await requestDeviceCode({
+    clientId,
+    scopes: options.scopes,
+    deviceCodeEndpoint: options.deviceCodeEndpoint,
+    fetchImpl: options.fetchImpl
+  });
+  if (options.onUserCode) {
+    await options.onUserCode(deviceAuth);
+  }
+  try {
+    await openBrowser(deviceAuth.verificationUriComplete ?? deviceAuth.verificationUri);
+  } catch {
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_OAUTH_TIMEOUT_MS;
+  const effectiveTimeout = Math.min(timeoutMs, deviceAuth.expiresIn * 1e3);
+  return pollForDeviceToken({
+    clientId,
+    deviceCode: deviceAuth.deviceCode,
+    interval: deviceAuth.interval,
+    timeoutMs: effectiveTimeout,
+    tokenEndpoint: options.tokenEndpoint,
+    fetchImpl: options.fetchImpl,
+    sleepImpl: options.sleepImpl
+  });
+}
 async function refreshGrokToken(options) {
   if (!options.clientId || options.clientId.trim().length === 0) {
     throw new GrokOAuthError("Missing clientId", "no_client_id");
@@ -299,7 +204,7 @@ async function refreshGrokToken(options) {
   if (!options.refreshToken || options.refreshToken.trim().length === 0) {
     throw new GrokOAuthError("Missing refreshToken", "no_refresh_token");
   }
-  const endpoint = options.tokenEndpoint ?? "https://oauth.x.ai/token";
+  const endpoint = options.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
   const fetchImpl = options.fetchImpl ?? fetch;
   let response;
   try {
@@ -340,77 +245,7 @@ async function refreshGrokToken(options) {
   if (typeof accessToken !== "string" || accessToken.length === 0) {
     throw new GrokOAuthError("Token refresh response missing access_token", "no_access_token");
   }
-  return parseTokenResponseBody(obj, accessToken, "Token refresh");
-}
-async function runGrokOAuthFlow(options) {
-  const clientId = options.clientId || process.env.GROK_OAUTH_CLIENT_ID || DEFAULT_GROK_OAUTH_CLIENT_ID;
-  if (!clientId || clientId.trim().length === 0) {
-    throw new GrokOAuthError("Missing clientId", "no_client_id");
-  }
-  const callbackPort = options.callbackPort ?? DEFAULT_GROK_OAUTH_REDIRECT_PORT;
-  const callbackPath = options.callbackPath ?? DEFAULT_GROK_OAUTH_REDIRECT_PATH;
-  const redirectUri = `http://127.0.0.1:${callbackPort}${callbackPath}`;
-  const discovery = await fetchGrokDiscovery({
-    issuer: options.issuer,
-    discoveryUrl: options.discoveryUrl,
-    fetchImpl: options.fetchImpl
-  });
-  const { verifier: codeVerifier, challenge: codeChallenge } = generatePkce();
-  const state = crypto.randomUUID();
-  const authorizeUrl = buildGrokAuthorizeUrl({
-    clientId,
-    redirectUri,
-    scopes: options.scopes,
-    state,
-    codeChallenge,
-    authorizeEndpoint: discovery.authorizationEndpoint
-  });
-  let handle;
-  try {
-    handle = await startOAuthCallbackServer({
-      port: callbackPort,
-      timeoutMs: options.callbackTimeoutMs ?? 12e4,
-      expectedPath: callbackPath
-    });
-  } catch (err) {
-    throw new GrokOAuthError(
-      `Failed to start OAuth callback server on port ${callbackPort}: ${err instanceof Error ? err.message : String(err)}`,
-      "callback_bind_failed"
-    );
-  }
-  try {
-    if (options.onBrowserOpen) {
-      await options.onBrowserOpen(authorizeUrl);
-    } else {
-      await openBrowser(authorizeUrl);
-    }
-    const callbackResult = await handle.waitForCode();
-    if (callbackResult.state !== state) {
-      throw new GrokOAuthError(
-        `OAuth state mismatch \u2014 possible CSRF. expected=${state} got=${callbackResult.state ?? "(none)"}`,
-        "state_mismatch"
-      );
-    }
-    if (callbackResult.error) {
-      throw new GrokOAuthError(
-        `OAuth provider returned error: ${callbackResult.error}${callbackResult.errorDescription ? ` \u2014 ${callbackResult.errorDescription}` : ""}`,
-        callbackResult.error
-      );
-    }
-    if (!callbackResult.code) {
-      throw new GrokOAuthError("OAuth callback did not include authorization code", "no_code");
-    }
-    return await exchangeGrokCode({
-      clientId,
-      code: callbackResult.code,
-      codeVerifier,
-      redirectUri,
-      tokenEndpoint: discovery.tokenEndpoint,
-      fetchImpl: options.fetchImpl
-    });
-  } finally {
-    handle.close();
-  }
+  return parseTokenResponseBody(obj, accessToken);
 }
 async function openBrowser(url2) {
   const { spawn: spawn3 } = await import("node:child_process");
@@ -438,12 +273,10 @@ async function openBrowser(url2) {
     }
   });
 }
-var getRandomValues, createHash, GrokOAuthError, DEFAULT_GROK_OAUTH_CLIENT_ID, DEFAULT_GROK_OAUTH_ISSUER, DEFAULT_GROK_OAUTH_SCOPES, DEFAULT_GROK_OAUTH_REDIRECT_PORT, DEFAULT_GROK_OAUTH_REDIRECT_PATH;
+var GrokOAuthError, DEFAULT_GROK_OAUTH_CLIENT_ID, DEFAULT_GROK_OAUTH_SCOPES, DEFAULT_DEVICE_CODE_ENDPOINT, DEFAULT_TOKEN_ENDPOINT, DEVICE_GRANT_TYPE, DEFAULT_OAUTH_TIMEOUT_MS, defaultSleep;
 var init_grokOAuth = __esm({
   "src/cli/grokOAuth.ts"() {
     "use strict";
-    init_oauthCallbackServer();
-    ({ getRandomValues, createHash } = nodeCrypto);
     GrokOAuthError = class extends Error {
       constructor(message, code) {
         super(message);
@@ -452,7 +285,6 @@ var init_grokOAuth = __esm({
       }
     };
     DEFAULT_GROK_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
-    DEFAULT_GROK_OAUTH_ISSUER = "https://auth.x.ai";
     DEFAULT_GROK_OAUTH_SCOPES = [
       "openid",
       "profile",
@@ -461,8 +293,11 @@ var init_grokOAuth = __esm({
       "grok-cli:access",
       "api:access"
     ];
-    DEFAULT_GROK_OAUTH_REDIRECT_PORT = 56121;
-    DEFAULT_GROK_OAUTH_REDIRECT_PATH = "/callback";
+    DEFAULT_DEVICE_CODE_ENDPOINT = "https://auth.x.ai/oauth2/device/code";
+    DEFAULT_TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
+    DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+    DEFAULT_OAUTH_TIMEOUT_MS = 3e5;
+    defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
   }
 });
 
@@ -21219,14 +21054,27 @@ ${lines.join("\n")}`,
         {
           id: crypto.randomUUID(),
           role: "system",
-          content: "[login oauth] opening browser for SuperGrok authentication (PKCE)...",
+          content: "[login oauth] requesting device code from xAI...",
           ts: Date.now()
         }
       ]);
       setBusy(true);
       try {
         const resultOAuth = await runGrokOAuthFlow({
-          callbackTimeoutMs: 12e4
+          // Show the user_code + verification_uri as soon as xAI returns them.
+          onUserCode: (info) => {
+            setMessages((prev) => [
+              ...prev,
+              {
+                id: crypto.randomUUID(),
+                role: "system",
+                content: `[login oauth] Open ${info.verificationUri} in your browser and enter the code:
+  ${info.userCode}
+(Opening your browser automatically...)`,
+                ts: Date.now()
+              }
+            ]);
+          }
         });
         setOAuthToken("grok", {
           apiKey: resultOAuth.accessToken,