git-fit 0.10.6 → 0.10.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 529a74a588a51b0b04ba1a0e15e629425dec93dd79986c6e6f45a0eda35d5914
-  data.tar.gz: 37a81d2e9285b8917c13b36eb343d3b97de27709cf1d71a094216c7a645b3168
+  metadata.gz: 32616b46febca2fefadfe46d783de032676821f74e82c0a65e85f3a0def488f1
+  data.tar.gz: 4b409c0d20c049c50e804123d82639915e35b6df957c1543756e75e4a2d8d643
 SHA512:
-  metadata.gz: 8ecb103ba98d635affa43058a695811d061d8be767754e3012efb23aa3a7eb4a85b5ab6041c371da1371fab1afc31100f94f8cf77e11a21ec900b38be29a3dcf
-  data.tar.gz: 27610f67729cf037ac1a05772103abcc0899de47a484b929d4d62a4f34184c23921245c84f62ea308861ffa62c4e520e0d39223ecb8908e0c36966e0f6825d6c
+  metadata.gz: 39a504dad06283e1a891552b775d0df401f2a038343323e1084379882739a9fe669841b7195c8fa28d0bea136ac62b8e61cccc5c1eac9fb3ce4aca800d156a69
+  data.tar.gz: dfbb3028468e96f6b943d332856e27520b034d216504bbd6072e26e656700d9340b38991e83fc6b5d869cbdc9a745c2a1fa5e684c903425b18dc45e608eacfa9

data/lib/git-fit.rb

@@ -93,4 +93,5 @@ require_relative 'git_fit/strava_web/file_check'
 require_relative 'git_fit/cli/strava'
 require_relative 'git_fit/auth/garmin_token'
 require_relative 'git_fit/auth/strava'
+require_relative 'git_fit/auth/garmin'
 require_relative 'git_fit/cli'

data/lib/git_fit/auth/garmin/di_exchange.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require_relative '../../sync/garmin_base'
+require 'net/http'
+require 'uri'
+require 'json'
+require 'base64'
+
+module GitFit
+  module Auth
+    module Garmin
+      module DIExchange
+        DI_CLIENT_IDS = %w[
+          GARMIN_CONNECT_MOBILE_ANDROID_DI_2025Q2
+          GARMIN_CONNECT_MOBILE_ANDROID_DI_2024Q4
+          GARMIN_CONNECT_MOBILE_ANDROID_DI
+        ].freeze
+
+        DI_TOKEN_URL = 'https://diauth.garmin.com/di-oauth2-service/oauth/token'
+        DI_GRANT_TYPE = 'https://connectapi.garmin.com/di-oauth2-service/oauth/grant/service_ticket'
+        DI_USER_AGENT = 'GCM-Android-5.23'
+
+        DEFAULT_EXPIRES_IN = 64800
+
+        module_function
+
+        def call(domain, ticket, service_url)
+          DI_CLIENT_IDS.each do |cid|
+            token = attempt(cid, domain, ticket, service_url)
+            return token if token
+          end
+
+          raise GitFit::Sync::AuthError, 'All DI client IDs failed for ticket exchange'
+        end
+
+        def build_url(domain)
+          DI_TOKEN_URL.sub('garmin.com', domain)
+        end
+
+        def attempt(cid, domain, ticket, service_url)
+          resp = post(cid, domain, ticket, service_url)
+          unless resp.code.to_i == 200
+            warn "DI exchange #{cid}: HTTP #{resp.code}"
+            return nil
+          end
+
+          token = JSON.parse(resp.body)
+          token['di_client_id'] = cid
+          token['expires_at'] = Time.now.to_i + (token['expires_in'] || DEFAULT_EXPIRES_IN).to_i
+          if token['refresh_token_expires_in']
+            token['refresh_token_expires_at'] = Time.now.to_i + token['refresh_token_expires_in'].to_i
+          end
+          token
+        rescue StandardError => e
+          warn "DI exchange #{cid}: #{e.message}"
+          nil
+        end
+
+        def post(cid, domain, ticket, service_url)
+          uri = URI(build_url(domain))
+          req = Net::HTTP::Post.new(uri)
+          req['Authorization'] = "Basic #{Base64.strict_encode64("#{cid}:")}"
+          req['Accept'] = 'application/json,text/html;q=0.9,*/*;q=0.8'
+          req['Content-Type'] = 'application/x-www-form-urlencoded'
+          req['Cache-Control'] = 'no-cache'
+          req['User-Agent'] = DI_USER_AGENT
+          req.body = URI.encode_www_form(
+            client_id: cid,
+            service_ticket: ticket,
+            grant_type: DI_GRANT_TYPE,
+            service_url: service_url,
+          )
+          send_http(uri, req)
+        end
+
+        def send_http(uri, request)
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = uri.scheme == 'https'
+          http.open_timeout = 30
+          http.read_timeout = 60
+          http.start { |h| h.request(request) }
+        end
+      end
+    end
+  end
+end

data/lib/git_fit/auth/garmin/strategy_a.rb

@@ -0,0 +1,332 @@
+# frozen_string_literal: true
+
+require_relative 'di_exchange'
+require_relative '../../sync/garmin_base'
+require 'open3'
+require 'tmpdir'
+require 'uri'
+require 'json'
+
+module GitFit
+  module Auth
+    module Garmin
+      # Strategy A: curl-impersonate shellout (faithful Ruby port of
+      # workouts/scripts/garmin_auth.py).
+      #
+      #   mobile+cffi (primary): single Safari TLS session, /mobile/api/login
+      #   portal+cffi (fallback): 5 TLS fingerprints, /portal/api/login
+      #
+      # A 30-45s random delay before each GET sign-in is critical for the
+      # Cloudflare WAF bypass — keep it.
+      # rubocop:disable Metrics/ModuleLength
+      module StrategyA
+        PORTAL_CLIENT_ID = 'GarminConnect'
+        PORTAL_SERVICE = 'https://connect.garmin.com/app'
+        MOBILE_CLIENT_ID = 'GCM_ANDROID_DARK'
+        MOBILE_SERVICE = 'https://mobile.integration.garmin.com/gcm/android'
+        MOBILE_UA = 'Mozilla/5.0 (Linux; Android 13; sdk_gphone64_arm64 Build/TE1A.220922.025; wv) ' \
+                    'AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/132.0.0.0 ' \
+                    'Mobile Safari/537.36'
+        DESKTOP_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ' \
+                     'AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36'
+        HTML_ACCEPT = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
+        JSON_ACCEPT = 'application/json, text/plain, */*'
+        LOGIN_DELAY_MIN = 30.0
+        LOGIN_DELAY_MAX = 45.0
+        TLS_FINGERPRINTS = %w[safari safari_ios chrome120 edge101 chrome].freeze
+        CURL_BINARY = 'curl-impersonate'
+
+        module_function
+
+        def call(email:, password:, domain: 'garmin.com', mfa_code: nil)
+          check_curl_available!
+
+          errors = []
+          begin
+            return finish(mobile_login(domain, email, password, mfa_code), domain)
+          rescue GitFit::Sync::AuthError => e
+            errors << "mobile+cffi: #{e.message}"
+            warn "[garmin_auth] #{errors.last}"
+          rescue StandardError => e
+            errors << "mobile+cffi: unexpected error: #{e.message}"
+            warn "[garmin_auth] #{errors.last}"
+          end
+
+          begin
+            return finish(portal_login(domain, email, password, mfa_code), domain)
+          rescue GitFit::Sync::AuthError => e
+            errors << "portal+cffi: #{e.message}"
+            warn "[garmin_auth] #{errors.last}"
+          rescue StandardError => e
+            errors << "portal+cffi: unexpected error: #{e.message}"
+            warn "[garmin_auth] #{errors.last}"
+          end
+
+          raise GitFit::Sync::AuthError, "All strategies exhausted: #{errors.join('; ')}"
+        end
+
+        def random_delay(label)
+          delay = rand(LOGIN_DELAY_MIN..LOGIN_DELAY_MAX)
+          warn "[garmin_auth] #{label}: waiting #{delay.to_i}s for Cloudflare..."
+          sleep(delay)
+        end
+
+        def mobile_login(domain, email, password, mfa_code)
+          sso = "https://sso.#{domain}"
+          with_session_files do |jar, body|
+            mobile_login_session(sso, email, password, mfa_code, jar, body)
+          end
+        end
+
+        def mobile_login_session(sso, email, password, mfa_code, jar, body)
+          random_delay('mobile+cffi')
+          signin_url = "#{sso}/mobile/sso/en_US/sign-in"
+          get_params = { clientId: MOBILE_CLIENT_ID, service: MOBILE_SERVICE }
+          get_headers = {
+            'User-Agent' => MOBILE_UA,
+            'accept' => HTML_ACCEPT,
+            'accept-language' => 'en-US,en;q=0.9',
+          }
+
+          status, = curl_request(
+            impersonate: 'safari',
+            jar: jar,
+            output: body,
+            url: with_query(signin_url, get_params),
+            headers: get_headers,
+          )
+          raise GitFit::Sync::AuthError, 'mobile+cffi GET 429' if status == 429
+          raise GitFit::Sync::AuthError, "mobile+cffi GET #{status}" unless status.between?(200, 299)
+
+          post_headers = get_headers.merge(
+            'accept' => JSON_ACCEPT,
+            'content-type' => 'application/json',
+            'origin' => sso,
+            'referer' => "#{signin_url}?clientId=#{MOBILE_CLIENT_ID}&service=#{MOBILE_SERVICE}",
+          )
+          login_params = { clientId: MOBILE_CLIENT_ID, locale: 'en-US', service: MOBILE_SERVICE }
+          login_body = JSON.generate(
+            username: email,
+            password: password,
+            rememberMe: true,
+            captchaToken: '',
+          )
+
+          status, resp_body = curl_request(
+            impersonate: 'safari',
+            jar: jar,
+            output: body,
+            url: with_query("#{sso}/mobile/api/login", login_params),
+            headers: post_headers,
+            data: login_body,
+          )
+          raise GitFit::Sync::AuthError, 'mobile+cffi POST 429' if status == 429
+          raise GitFit::Sync::AuthError, "mobile+cffi POST #{status}" unless status.between?(200, 299)
+
+          res = JSON.parse(resp_body)
+          resp_type = res.dig('responseStatus', 'type')
+          if resp_type == 'MFA_REQUIRED'
+            method = res.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
+            res = handle_mfa(sso, method, login_params, post_headers, mfa_code,
+                             impersonate: 'safari', jar: jar, output: body)
+            resp_type = res.dig('responseStatus', 'type')
+          end
+
+          if resp_type == 'SUCCESSFUL'
+            [res['serviceTicketId'], MOBILE_SERVICE]
+          elsif resp_type == 'INVALID_USERNAME_PASSWORD'
+            raise GitFit::Sync::AuthError, 'Invalid username or password'
+          else
+            raise GitFit::Sync::AuthError, "mobile+cffi: unexpected response type: #{resp_type}"
+          end
+        end
+
+        def portal_login(domain, email, password, mfa_code)
+          sso = "https://sso.#{domain}"
+          TLS_FINGERPRINTS.each do |imp|
+            result = attempt_portal_fingerprint(sso, imp, email, password, mfa_code)
+            return result if result
+          end
+          raise GitFit::Sync::AuthError, 'portal+cffi: all TLS fingerprints exhausted'
+        end
+
+        def attempt_portal_fingerprint(sso, imp, email, password, mfa_code)
+          with_session_files do |jar, body|
+            attempt_portal_in_session(sso, imp, email, password, mfa_code, jar, body)
+          end
+        end
+
+        def attempt_portal_in_session(sso, imp, email, password, mfa_code, jar, body)
+          random_delay("portal+cffi/#{imp}")
+          signin_url = "#{sso}/portal/sso/en-US/sign-in"
+          get_params = { clientId: PORTAL_CLIENT_ID, service: PORTAL_SERVICE }
+          get_headers = browser_headers.merge('Accept' => HTML_ACCEPT)
+
+          status, = curl_request(
+            impersonate: imp,
+            jar: jar,
+            output: body,
+            url: with_query(signin_url, get_params),
+            headers: get_headers,
+          )
+          if status == 429
+            warn "[garmin_auth] portal+cffi/#{imp} GET 429"
+            return nil
+          end
+          unless status.between?(200, 299)
+            warn "[garmin_auth] portal+cffi/#{imp} GET #{status}"
+            return nil
+          end
+
+          post_headers = browser_headers.merge(
+            'Accept' => JSON_ACCEPT,
+            'Content-Type' => 'application/json',
+            'Origin' => sso,
+            'Referer' => "#{signin_url}?clientId=#{PORTAL_CLIENT_ID}&service=#{PORTAL_SERVICE}",
+          )
+          login_params = { clientId: PORTAL_CLIENT_ID, locale: 'en-US', service: PORTAL_SERVICE }
+          login_body = JSON.generate(
+            username: email,
+            password: password,
+            rememberMe: true,
+            captchaToken: '',
+          )
+
+          status, resp_body = curl_request(
+            impersonate: imp,
+            jar: jar,
+            output: body,
+            url: with_query("#{sso}/portal/api/login", login_params),
+            headers: post_headers,
+            data: login_body,
+          )
+          if status == 429
+            warn "[garmin_auth] portal+cffi/#{imp} POST 429"
+            return nil
+          end
+          unless status.between?(200, 299)
+            warn "[garmin_auth] portal+cffi/#{imp} POST #{status}"
+            return nil
+          end
+
+          res = JSON.parse(resp_body)
+          resp_type = res.dig('responseStatus', 'type')
+          if resp_type == 'MFA_REQUIRED'
+            method = res.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
+            res = handle_mfa(sso, method, login_params, post_headers, mfa_code,
+                             impersonate: imp, jar: jar, output: body)
+            resp_type = res.dig('responseStatus', 'type')
+          end
+
+          return [res['serviceTicketId'], PORTAL_SERVICE] if resp_type == 'SUCCESSFUL'
+          raise GitFit::Sync::AuthError, 'Invalid username or password' if resp_type == 'INVALID_USERNAME_PASSWORD'
+
+          nil
+        rescue GitFit::Sync::AuthError
+          raise
+        rescue StandardError => e
+          warn "[garmin_auth] portal+cffi/#{imp} error: #{e.message}"
+          nil
+        end
+
+        def handle_mfa(sso, method, login_params, post_headers, mfa_code, impersonate:, jar:, output:)
+          code = resolve_mfa_code(mfa_code)
+          mfa_data = {
+            'mfaMethod' => method,
+            'mfaVerificationCode' => code,
+            'rememberMyBrowser' => true,
+            'reconsentList' => [],
+            'mfaSetup' => false,
+          }
+
+          endpoints = [
+            ["#{sso}/portal/api/mfa/verifyCode", login_params],
+            ["#{sso}/mobile/api/mfa/verifyCode",
+             { clientId: MOBILE_CLIENT_ID, locale: 'en-US', service: MOBILE_SERVICE }],
+          ]
+
+          endpoints.each do |ep_url, ep_params|
+            status, resp_body = curl_request(
+              impersonate: impersonate,
+              jar: jar,
+              output: output,
+              url: with_query(ep_url, ep_params),
+              headers: post_headers,
+              data: JSON.generate(mfa_data),
+            )
+            next if status == 429
+            next unless status.between?(200, 299)
+
+            res = JSON.parse(resp_body)
+            return res if res.dig('responseStatus', 'type') == 'SUCCESSFUL'
+          rescue StandardError
+            next
+          end
+          raise GitFit::Sync::AuthError, 'MFA verification failed on all endpoints'
+        end
+
+        def resolve_mfa_code(mfa_code)
+          code = mfa_code
+          code = ENV['SYNC__GARMIN__MFA_CODE'] if code.nil? || code.to_s.empty?
+          if (code.nil? || code.to_s.empty?) && $stdin.tty?
+            $stderr.write('Enter MFA code: ')
+            $stderr.flush
+            code = $stdin.gets
+          end
+          if code.nil? || code.to_s.empty?
+            raise GitFit::Sync::AuthError,
+                  'MFA required but SYNC__GARMIN__MFA_CODE env var not set and stdin unavailable'
+          end
+          code = code.strip
+          raise GitFit::Sync::AuthError, 'SYNC__GARMIN__MFA_CODE is empty' if code.empty?
+
+          code
+        end
+
+        def check_curl_available!
+          _out, _err, status = Open3.capture3(CURL_BINARY, '--version')
+          return if status.success?
+
+          raise GitFit::Sync::AuthError, "#{CURL_BINARY} not found. Install it or use -B strategy"
+        rescue Errno::ENOENT
+          raise GitFit::Sync::AuthError, "#{CURL_BINARY} not found. Install it or use -B strategy"
+        end
+
+        def curl_request(impersonate:, jar:, output:, url:, headers:, data: nil)
+          args = [CURL_BINARY, '--impersonate', impersonate, '-s', '-S', '-L']
+          args += ['-c', jar, '-b', jar]
+          headers.each { |key, value| args += ['-H', "#{key}: #{value}"] }
+          args += ['--data-raw', data] if data
+          args += ['-w', "\n%{http_code}", '-o', output, url] # rubocop:disable Style/FormatStringToken
+          out, = Open3.capture3(*args)
+          code = out.strip.split.last.to_i
+          [code, File.read(output)]
+        end
+
+        def browser_headers
+          {
+            'User-Agent' => DESKTOP_UA,
+            'Accept-Language' => 'en-US,en;q=0.9',
+          }
+        end
+
+        def with_query(url, params)
+          return url if params.nil? || params.empty?
+
+          "#{url}?#{URI.encode_www_form(params)}"
+        end
+
+        def with_session_files
+          Dir.mktmpdir('garmin-strategy-a-') do |dir|
+            yield File.join(dir, 'cookies.txt'), File.join(dir, 'body.txt')
+          end
+        end
+
+        def finish((ticket, service_url), domain)
+          DIExchange.call(domain, ticket, service_url)
+        end
+      end
+      # rubocop:enable Metrics/ModuleLength
+    end
+  end
+end

data/lib/git_fit/auth/garmin/strategy_b.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require_relative 'di_exchange'
+require_relative '../../sync/garmin_base'
+require 'json'
+require 'fileutils'
+
+module GitFit
+  module Auth
+    module Garmin
+      # rubocop:disable Metrics/ModuleLength
+      module StrategyB
+        MOBILE_UA = 'Mozilla/5.0 (Linux; Android 13; sdk_gphone64_arm64 Build/TE1A.220922.025; wv) ' \
+                    'AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/132.0.0.0 ' \
+                    'Mobile Safari/537.36'
+        MOBILE_CLIENT_ID = 'GCM_ANDROID_DARK'
+        MOBILE_SERVICE = 'https://mobile.integration.garmin.com/gcm/android'
+        LOGIN_DELAY_MIN = 30.0
+        LOGIN_DELAY_MAX = 45.0
+        SESSION_CACHE_DIR = 'data/cache'
+        REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
+
+        module_function
+
+        def call(email:, password:, domain: 'garmin.com', mfa_code: nil)
+          mfa_code = mfa_code.to_s.strip
+          mfa_code = ENV['SYNC__GARMIN__MFA_CODE'].to_s.strip if mfa_code.empty?
+          sso = "https://sso.#{domain}"
+          session_path = _session_file_path(domain)
+          chrome_path = _find_chrome
+
+          _launch_playwright(chrome_path) do |browser|
+            session = _load_session(session_path)
+            warn "loaded session cookies (#{session[:age_days].round} days old)" if session
+
+            opts = { user_agent: MOBILE_UA, viewport: { width: 375, height: 812 } }
+            opts[:storage_state] = session[:path] if session
+            context = browser.new_context(**opts)
+
+            begin
+              ticket, service_url = _mobile_api_login(context.request, domain, email, password, mfa_code, sso)
+              token = DIExchange.call(domain, ticket, service_url)
+              _save_session(context, session_path)
+              token
+            ensure
+              context.close
+            end
+          end
+        end
+
+        def _mobile_api_login(context, _domain, email, password, mfa_code, sso)
+          headers = {
+            'User-Agent' => MOBILE_UA,
+            'Accept' => 'application/json, text/plain, */*',
+            'Content-Type' => 'application/json',
+            'Origin' => sso,
+            'Accept-Language' => 'en-US,en;q=0.9',
+          }
+          params = { 'clientId' => MOBILE_CLIENT_ID, 'locale' => 'en-US', 'service' => MOBILE_SERVICE }
+          referer = "#{sso}/mobile/sso/en_US/sign-in?clientId=#{MOBILE_CLIENT_ID}&service=#{MOBILE_SERVICE}"
+
+          signin_resp = context.get(
+            "#{sso}/mobile/sso/en_US/sign-in",
+            params: { 'clientId' => MOBILE_CLIENT_ID, 'service' => MOBILE_SERVICE },
+            headers: { 'User-Agent' => MOBILE_UA, 'Accept' => 'text/html,...', 'Accept-Language' => 'en-US,en;q=0.9' },
+            max_redirects: 0,
+          )
+
+          if REDIRECT_STATUSES.include?(signin_resp.status)
+            location = signin_resp.headers['location'].to_s
+            ticket = _extract_ticket_from_url(location)
+            if ticket
+              warn "session valid — ticket from redirect: #{ticket[0, 20]}..."
+              return [ticket, MOBILE_SERVICE]
+            end
+            warn "302 redirect but no ticket in: #{location[0, 80]}..."
+          end
+
+          _random_delay('mobile')
+          warn 'posting login credentials...'
+          resp = context.post(
+            "#{sso}/mobile/api/login",
+            params: params,
+            headers: headers.merge('Referer' => referer),
+            data: JSON.generate(
+              'username' => email,
+              'password' => password,
+              'rememberMe' => true,
+              'captchaToken' => '',
+            ),
+          )
+
+          raise GitFit::Sync::AuthError, 'mobile API login 429 (rate limited by Cloudflare)' if resp.status == 429
+
+          data = resp.json
+          resp_type = data.dig('responseStatus', 'type')
+
+          raise GitFit::Sync::AuthError, 'Invalid username or password' if resp_type == 'INVALID_USERNAME_PASSWORD'
+
+          return [data['serviceTicketId'], MOBILE_SERVICE] if resp_type == 'SUCCESSFUL'
+
+          raise GitFit::Sync::AuthError, "Unexpected login response: #{resp_type}" unless resp_type == 'MFA_REQUIRED'
+
+          mfa_method = data.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
+          warn "MFA required (method: #{mfa_method})"
+
+          code = mfa_code.to_s.strip
+          if code.empty? && $stdin.tty?
+            warn 'Enter MFA code: '
+            code = $stdin.gets.to_s.strip
+          end
+          if code.empty?
+            raise GitFit::Sync::AuthError, 'MFA required but no code provided (set SYNC__GARMIN__MFA_CODE or use stdin)'
+          end
+
+          warn 'verifying MFA code...'
+          mfa_data = {
+            'mfaMethod' => mfa_method,
+            'mfaVerificationCode' => code,
+            'rememberMyBrowser' => true,
+            'reconsentList' => [],
+            'mfaSetup' => false,
+          }
+
+          resp = context.post(
+            "#{sso}/mobile/api/mfa/verifyCode",
+            params: params,
+            headers: headers.merge('Referer' => referer),
+            data: JSON.generate(mfa_data),
+          )
+
+          data = resp.json
+          resp_type = data.dig('responseStatus', 'type')
+
+          return [data['serviceTicketId'], MOBILE_SERVICE] if resp_type == 'SUCCESSFUL'
+
+          if resp_type == 'MFA_CODE_INVALID'
+            raise GitFit::Sync::AuthError, "MFA code invalid — #{data.dig('responseStatus', 'message') || 'unknown'}"
+          end
+
+          raise GitFit::Sync::AuthError, "Unexpected MFA response: #{resp_type}"
+        end
+
+        def _extract_ticket_from_url(url)
+          url[/[?&]ticket=(ST-[^&\s]+)/, 1]
+        end
+
+        def _random_delay(label)
+          delay = rand(LOGIN_DELAY_MIN..LOGIN_DELAY_MAX)
+          warn "[garmin_auth_pw] #{label}: waiting #{delay.round}s for Cloudflare..."
+          sleep(delay)
+        end
+
+        def _session_file_path(domain)
+          File.join(SESSION_CACHE_DIR, "garmin_playwright_session_#{domain.tr('.', '_')}.json")
+        end
+
+        def _load_session(session_path)
+          return nil unless File.exist?(session_path)
+
+          data = JSON.parse(File.read(session_path))
+          age_days = (Time.now.to_f - (data['saved_at'] || 0).to_f) / 86_400.0
+          { path: session_path, age_days: age_days }
+        rescue StandardError => e
+          warn "failed to load session cookies: #{e.message}"
+          File.delete(session_path) if File.exist?(session_path)
+          nil
+        end
+
+        def _save_session(context, session_path)
+          FileUtils.mkdir_p(File.dirname(session_path))
+          state = context.storage_state
+          state['saved_at'] = Time.now.to_f
+          File.write(session_path, JSON.generate(state))
+        rescue StandardError => e
+          warn "failed to save session cookies: #{e.message}"
+        end
+
+        def _find_chrome
+          candidates = []
+          env_path = ENV['GIT_FIT_GARMIN_CHROMIUM_PATH'].to_s.strip
+          candidates << env_path unless env_path.empty?
+          candidates.concat(%w[/usr/bin/google-chrome-beta /usr/bin/google-chrome /usr/bin/chromium])
+
+          found = candidates.find { |path| File.exist?(path) }
+          return found if found
+
+          raise GitFit::Sync::AuthError, 'Chrome not found. Set GIT_FIT_GARMIN_CHROMIUM_PATH or use -A strategy'
+        end
+
+        def _launch_playwright(chrome_path)
+          begin
+            require 'playwright'
+          rescue LoadError
+            raise GitFit::Sync::AuthError, 'playwright-ruby-client gem missing. bundle install, or use -A strategy'
+          end
+
+          Playwright.create do |playwright|
+            browser = playwright.chromium.launch(headless: true, executable_path: chrome_path)
+            begin
+              yield browser
+            ensure
+              browser.close
+            end
+          end
+        rescue GitFit::Sync::AuthError
+          raise
+        rescue StandardError => e
+          raise GitFit::Sync::AuthError, "Playwright launch failed: #{e.message}"
+        end
+      end
+      # rubocop:enable Metrics/ModuleLength
+    end
+  end
+end

data/lib/git_fit/auth/garmin.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require_relative 'garmin/strategy_a'
+require_relative 'garmin/strategy_b'
+require_relative 'garmin/di_exchange'
+require_relative '../config'
+require_relative '../cli/gh_cli'
+require 'json'
+require 'yaml'
+require 'base64'
+require 'fileutils'
+require 'open3'
+
+module GitFit
+  module Auth
+    module Garmin
+      # Orchestrator for `git fit auth garmin` — faithful Ruby port of
+      # workouts/scripts/garmin_auth_local.sh with the finalized
+      # -A/-B/--auto/--sync CLI interface. The module namespace is shared with
+      # the strategies (StrategyA/StrategyB/DIExchange), so the orchestrator
+      # lives in a nested class and `GitFit::Auth::Garmin.new` delegates to it
+      # (same call site as GitFit::Auth::Strava).
+      SEED_SECRET_NAME = 'SYNC_GARMIN_AUTH_SEED'
+      FLAGS = %i[A B auto sync].freeze
+      STRATEGIES = { A: StrategyA, B: StrategyB }.freeze
+
+      class Orchestrator
+        include GitFit::GhHelpers
+
+        def initialize(options, config)
+          @options = options || {}
+          @config = config
+        end
+
+        attr_reader :generated_secret
+
+        def call
+          mode = selected_mode
+          token = mode == :sync ? sync_token : sso_token(mode)
+          persist(token)
+          nil
+        end
+
+        private
+
+        def selected_mode
+          chosen = FLAGS.select { |flag| flag_enabled?(flag) }
+          if chosen.size > 1
+            raise GitFit::Sync::AuthError,
+                  'git fit auth garmin: -A/-B/--auto/--sync are mutually exclusive — ' \
+                  'use exactly one (default: -B)'
+          end
+
+          chosen.first || :B
+        end
+
+        def flag_enabled?(flag)
+          @options[flag] || @options[flag.to_s]
+        end
+
+        def sso_token(mode)
+          email, password = sso_credentials
+          creds = { email: email, password: password, domain: domain }
+          case mode
+          when :A then single_strategy(:A, creds)
+          when :B then single_strategy(:B, creds)
+          when :auto then auto_strategy(creds)
+          end
+        end
+
+        def sso_credentials
+          cfg = @config.sync_config('garmin')
+          email = cfg['email'].to_s
+          password = cfg['password'].to_s
+          if email.empty? || password.empty?
+            exit_with_error('sync.garmin.email / sync.garmin.password not set in config.yml — ' \
+                            'run: git fit init')
+          end
+
+          [email, password]
+        end
+
+        def single_strategy(label, creds)
+          token, error = run_strategy(label, creds)
+          exit_with_error("Garmin auth failed: #{error}") unless token
+
+          token
+        end
+
+        def auto_strategy(creds)
+          token, b_error = run_strategy(:B, creds)
+          return token if token
+
+          warn '[auto] B failed, falling back to A'
+          token, a_error = run_strategy(:A, creds)
+          return token if token
+
+          exit_with_error("Garmin auth failed: B: #{b_error}; A: #{a_error}")
+        end
+
+        def run_strategy(label, creds)
+          token = STRATEGIES.fetch(label).call(**creds)
+          return [token, nil] if json_round_trips?(token)
+
+          [nil, "Strategy #{label} returned a token that fails JSON round-trip"]
+        rescue GitFit::Sync::AuthError => e
+          [nil, e.message]
+        rescue StandardError => e
+          [nil, "unexpected error: #{e.message}"]
+        end
+
+        def json_round_trips?(token)
+          JSON.parse(JSON.generate(token))
+          true
+        rescue StandardError
+          false
+        end
+
+        def sync_token
+          path = token_path
+          unless File.exist?(path)
+            exit_with_error("Cache file not found: #{path}\n" \
+                            'Run without --sync first to perform SSO auth (git fit auth garmin).')
+          end
+
+          JSON.parse(File.read(path))
+        rescue JSON::ParserError => e
+          exit_with_error("Cache file is not valid JSON: #{path} (#{e.message})")
+        end
+
+        def persist(token)
+          @generated_secret = Base64.strict_encode64(JSON.generate(token))
+          write_token_cache(token)
+          write_config_auth_seed(@generated_secret)
+          gh_ladder(@generated_secret)
+          puts 'Done. Token cached in config.yml. CI will auto-refresh via di_refresh (30d sliding).'
+        end
+
+        def write_token_cache(token)
+          path = token_path
+          FileUtils.mkdir_p(File.dirname(path))
+          File.write(path, JSON.pretty_generate(token))
+        rescue StandardError => e
+          warn "Failed to write token cache: #{e.message}"
+        end
+
+        def write_config_auth_seed(seed)
+          cfg = File.exist?(config_path) ? (YAML.safe_load_file(config_path) || {}) : {}
+          cfg['sync'] ||= {}
+          cfg['sync']['garmin'] ||= {}
+          cfg['sync']['garmin']['auth_seed'] = seed
+          File.write(config_path, YAML.dump(cfg))
+          puts 'sync.garmin.auth_seed updated in config.yml'
+        rescue StandardError => e
+          warn "Failed to update config.yml: #{e.message}"
+        end
+
+        def config_path
+          File.expand_path(@options[:config] || 'config/config.yml')
+        end
+
+        def garmin_cfg
+          @config.sync_config('garmin')
+        end
+
+        def domain
+          garmin_cfg['domain'] || 'garmin.com'
+        end
+
+        def token_path
+          garmin_cfg['token_path'] ||
+            File.join('data', 'auth', "garmin_#{domain.tr('.', '_')}_tokens.json")
+        end
+
+        def gh_ladder(seed)
+          unless gh_installed?
+            warn 'gh CLI not found — install gh or set the secret manually'
+            print_secret_help(seed)
+            return
+          end
+          unless gh_auth_status?
+            warn 'gh CLI not authenticated — run: gh auth login'
+            print_secret_help(seed)
+            return
+          end
+
+          repo = detect_repo
+          unless gh_repo_view?(repo)
+            warn "No access to repo #{repo} — token only written to config.yml"
+            print_secret_help(seed)
+            return
+          end
+          unless gh_secret_list?(repo)
+            warn "No permission to write GitHub Secrets on #{repo}"
+            print_secret_help(seed)
+            return
+          end
+
+          if gh_secret_set(seed, repo)
+            puts "GitHub Secret set: #{SEED_SECRET_NAME}"
+          else
+            warn 'Failed to set GitHub Secret (unexpected error)'
+            print_secret_help(seed)
+          end
+        end
+
+        def gh_installed?
+          gh_success?('gh', '--version')
+        end
+
+        def gh_auth_status?
+          gh_success?('gh', 'auth', 'status')
+        end
+
+        def gh_repo_view?(repo)
+          gh_success?('gh', 'repo', 'view', repo)
+        end
+
+        def gh_secret_list?(repo)
+          gh_success?('gh', 'secret', 'list', '-R', repo)
+        end
+
+        def gh_secret_set(seed, repo)
+          _out, _err, status = Open3.capture3('gh', 'secret', 'set', SEED_SECRET_NAME, '-R', repo, stdin_data: seed)
+          status.success?
+        rescue Errno::ENOENT
+          false
+        end
+
+        def gh_success?(*args)
+          _out, _err, status = Open3.capture3(*args)
+          status.success?
+        rescue Errno::ENOENT
+          false
+        end
+
+        def print_secret_help(seed)
+          warn ''
+          warn '==========================================='
+          warn '  GitHub Actions Secret (one-time setup)'
+          warn "  Name:   #{SEED_SECRET_NAME}"
+          warn '==========================================='
+          warn ''
+          warn "Name:  #{SEED_SECRET_NAME}"
+          warn "Value: #{seed}"
+          warn ''
+        end
+
+        def exit_with_error(message)
+          warn message
+          exit 1
+        end
+      end
+
+      def self.new(options, config)
+        Orchestrator.new(options, config)
+      end
+    end
+  end
+end

data/lib/git_fit/cli/sync.rb

@@ -38,11 +38,6 @@ module GitFit
           return
         end
 
-        if source == 'garmin'
-          say_status :warn, 'garmin (intl) DI auth migration pending (Phase 3)', :yellow
-          return
-        end
-
         config = git_fit_config.sync_config(source)
         if config.empty?
           say_status :warn, "No config for #{source}. Set env vars or config.yml", :yellow
@@ -82,7 +77,9 @@ module GitFit
         klass = GitFit::Sync::Base.adapters.find { |a| a.config_key == source }
         return nil unless klass
 
-        klass.new(config: git_fit_config.sync_config(source), db: nil)
+        cfg = git_fit_config.sync_config(source).dup
+        cfg['config_path'] = options[:config] if options[:config]
+        klass.new(config: cfg, db: nil)
       end
     end
   end

data/lib/git_fit/cli.rb

@@ -73,7 +73,15 @@ module GitFit
     end
 
     desc 'auth SOURCE', 'Authenticate with a sync source (strava, garmin, garmin_cn)'
+    option :A, type: :boolean, desc: 'Garmin Strategy A: curl-impersonate shellout'
+    option :B, type: :boolean, desc: 'Garmin Strategy B: Playwright (default)'
+    option :auto, type: :boolean, desc: 'Garmin auto: B first, fallback to A'
+    option :sync, type: :boolean, desc: 'Garmin: promote cached token to auth_seed'
     def auth(source)
+      if source == 'garmin'
+        GitFit::Auth::Garmin.new(options, git_fit_config).call
+        return
+      end
       if source == 'strava'
         GitFit::Auth::Strava.new(options, git_fit_config).call
       else

data/lib/git_fit/config_template.rb

@@ -23,7 +23,7 @@ module GitFit
           # garmin:                                    # env: GIT_FIT_GARMIN_EMAIL
           #   email: ""                                # env: GIT_FIT_GARMIN_PASSWORD
           #   password: ""
-          #   auth_seed: ""                            # git fit auth garmin (DI OAuth2, Phase 3)
+          #   auth_seed: ""                            # auto-written by git fit auth garmin
           #   secret: ""                               # CN SSO secret (auto-written by git fit auth garmin_cn)
 
           # garmin_cn:                                 # env: GIT_FIT_GARMIN_CN_EMAIL

data/lib/git_fit/import/apple_health.rb

@@ -519,7 +519,7 @@ module GitFit
         return nil unless m
         num = m[1].to_f
         unit = m[2].downcase
-        if unit.start_with?('degf') || unit.start_with?('°f')
+        if unit.start_with?('degf', '°f')
           ((num - 32) * 5.0 / 9.0).round(1)
         else
           num.round(1)
@@ -543,17 +543,17 @@ module GitFit
 
       def map_sport_type(workout_type)
         return 'other' unless workout_type
-        key = workout_type.sub(/\AHKWorkoutActivityType/, '')
+        key = workout_type.delete_prefix('HKWorkoutActivityType')
         return 'workout' if key.downcase.include?('strength')
         GitFit::SportMapper.canonicalize(key)
       end
 
       def display_name(workout_type, _start_date)
-        workout_type.sub(/\AHKWorkoutActivityType/, '')
+        workout_type.delete_prefix('HKWorkoutActivityType')
       end
 
       def build_title(workout_type, start_date)
-        label = workout_type.sub(/\AHKWorkoutActivityType/, '')
+        label = workout_type.delete_prefix('HKWorkoutActivityType')
         date = start_date ? start_date[0..9] : nil
         date ? "#{date} · #{label}" : label
       end

data/lib/git_fit/sync/garmin_base.rb

@@ -186,7 +186,7 @@ module GitFit
       end
 
       def save_secret_to_config
-        path = 'config/config.yml'
+        path = @config['config_path'] || 'config/config.yml'
         return unless File.exist?(path)
 
         cfg = YAML.safe_load(File.read(path)) || {}

data/lib/git_fit/sync/garmin_base_di.rb

@@ -46,15 +46,15 @@ module GitFit
         end
 
         puts 'Garmin: no valid DI token found'
-        puts '  First time: ./scripts/garmin_auth_local.sh'
-        puts '  Refresh:    ./scripts/garmin_auth_local.sh --sync'
+        puts '  First time: git fit auth garmin'
+        puts '  Refresh:    git fit auth garmin --sync'
         false
       end
 
       def before_call
         if @config['auth_seed'].to_s.empty? && !File.exist?(token_path)
           puts 'Garmin: auth_seed not configured and no cached token'
-          puts '  Run: ./scripts/garmin_auth_local.sh'
+          puts '  Run: git fit auth garmin'
           return false
         end
         @start_time = Time.now
@@ -62,7 +62,7 @@ module GitFit
       end
 
       def reauth_hint
-        'Re-auth: ./scripts/garmin_auth_local.sh --sync'
+        'Re-auth: git fit auth garmin --sync'
       end
 
       private
@@ -110,7 +110,7 @@ module GitFit
         true
       rescue JSON::ParserError
         puts 'Garmin: auth_seed decode failed — invalid Base64 or JSON'
-        puts '  Fix: ./scripts/garmin_auth_local.sh --sync'
+        puts '  Fix: git fit auth garmin --sync'
         false
       rescue StandardError => e
         puts "Garmin: auth_seed error: #{e.message}"
@@ -140,10 +140,10 @@ module GitFit
           msg = "DI refresh error: #{resp.code}"
           if resp.code.to_i == 400
             msg += ' — refresh_token expired across rotation'
-            msg += ', re-run: scripts/garmin_auth_local.sh'
+            msg += ', re-run: git fit auth garmin'
           elsif resp.code.to_i == 401
             msg += ' — DI client_id rotated by Garmin'
-            msg += ', re-run: scripts/garmin_auth_local.sh'
+            msg += ', re-run: git fit auth garmin'
           end
           raise AuthError, msg
         end
@@ -161,10 +161,10 @@ module GitFit
       # @deprecated Kept for local script reference only.
       # email+password SSO strategies are not called by `authenticate`
       # because garmin.com DI auth requires MFA, handled by
-      # scripts/garmin_auth_local.sh outside Ruby.
+      # git fit auth garmin outside Ruby.
       #
       # Note: method naming (strategy_a = curl_cffi, strategy_b = Playwright) is
-      # historical. In scripts/garmin_auth_local.sh, Playwright runs first (cookies
+      # historical. In git fit auth garmin, Playwright runs first (cookies
       # persist 365d → no repeat MFA), curl_cffi is the fallback.
       def strategy_a_login
         script = File.expand_path('../../../scripts/garmin_auth.py', __dir__)

data/lib/git_fit/sync/runner.rb

@@ -41,7 +41,7 @@ module GitFit
         start_watchdog if @total_timeout
         init_pending
         unless @source_queue.empty?
-          worker_threads = @num_workers.times.map { Thread.new { worker_loop } }
+          worker_threads = Array.new(@num_workers) { Thread.new { worker_loop } }
           worker_threads.each(&:join)
         end
         output_queue << POISON
@@ -321,9 +321,9 @@ module GitFit
           case msg[:type]
           when :banner
             text = msg[:text]
-            if text =~ /auth failed/
+            if /auth failed/.match?(text)
               ps[:auth_failed] = true
-            elsif text =~ /no new activities/
+            elsif /no new activities/.match?(text)
               ps[:up_to_date] = true
             elsif text =~ /(\d+) pending/
               ps[:total] = $1.to_i

data/lib/git_fit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GitFit
-  VERSION = '0.10.6'
+  VERSION = '0.10.7'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: git-fit
 version: !ruby/object:Gem::Version
-  version: 0.10.6
+  version: 0.10.7
 platform: ruby
 authors:
 - Lax
@@ -191,6 +191,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.9'
+- !ruby/object:Gem::Dependency
+  name: playwright-ruby-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: ostruct
   requirement: !ruby/object:Gem::Requirement
@@ -232,6 +246,10 @@ files:
 - db/migrations/002_iso8601_time_format.rb
 - exe/git-fit
 - lib/git-fit.rb
+- lib/git_fit/auth/garmin.rb
+- lib/git_fit/auth/garmin/di_exchange.rb
+- lib/git_fit/auth/garmin/strategy_a.rb
+- lib/git_fit/auth/garmin/strategy_b.rb
 - lib/git_fit/auth/garmin_token.rb
 - lib/git_fit/auth/strava.rb
 - lib/git_fit/cli.rb