@agenthippo-ai/agenthippo 0.1.0

package/out/auth/loopbackAuthServer.js

@@ -0,0 +1,165 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentHippoLoopbackAuthServer = void 0;
+const http = __importStar(require("http"));
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"/><title>AgentHippo</title></head>
+<body style="font-family:system-ui,sans-serif;padding:2rem">
+<p>Signed in to AgentHippo. You can close this tab.</p>
+</body></html>`;
+const STATE_MISMATCH_HTML = `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"/><title>AgentHippo</title></head>
+<body style="font-family:system-ui,sans-serif;padding:2rem">
+<p>Sign-in could not be verified (state mismatch). Close this tab and try again from the IDE.</p>
+</body></html>`;
+/**
+ * Localhost OAuth callback (same pattern as GitHub/Codex loopback flows).
+ * Browser redirects to http://127.0.0.1:&lt;port&gt;/callback — no IDE URI scheme required.
+ */
+class AgentHippoLoopbackAuthServer {
+    server;
+    port;
+    pending;
+    async start() {
+        if (this.server) {
+            return this.port;
+        }
+        return new Promise((resolve, reject) => {
+            const server = http.createServer((req, res) => {
+                try {
+                    const host = `127.0.0.1:${this.port}`;
+                    const url = new URL(req.url || '/', `http://${host}`);
+                    if (url.pathname !== '/callback') {
+                        res.writeHead(404);
+                        res.end();
+                        return;
+                    }
+                    const code = url.searchParams.get('code');
+                    const state = url.searchParams.get('state');
+                    if (!code || !state) {
+                        res.writeHead(400, { 'Content-Type': 'text/plain' });
+                        res.end('Missing authorization code');
+                        return;
+                    }
+                    // Validate state before showing success: a forged or cross-flow callback
+                    // must not render "signed in" or be silently dropped to a timeout.
+                    if (!this.pending || state !== this.pending.expectedState) {
+                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(STATE_MISMATCH_HTML);
+                        this.pending?.reject(new Error('OAuth state mismatch'));
+                        this.pending = undefined;
+                        return;
+                    }
+                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(SUCCESS_HTML);
+                    this.pending.resolve(code);
+                    this.pending = undefined;
+                }
+                catch {
+                    res.writeHead(500);
+                    res.end();
+                }
+            });
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', () => {
+                const address = server.address();
+                if (!address || typeof address === 'string') {
+                    reject(new Error('Failed to bind loopback OAuth server'));
+                    return;
+                }
+                this.server = server;
+                this.port = address.port;
+                resolve(address.port);
+            });
+        });
+    }
+    getRedirectUri() {
+        if (!this.port) {
+            throw new Error('Loopback OAuth server not started');
+        }
+        return `http://127.0.0.1:${this.port}/callback`;
+    }
+    waitForAuthorizationCode(expectedState, timeoutMs, cancel) {
+        return new Promise((resolve, reject) => {
+            let pollCancel;
+            const cleanup = () => {
+                clearInterval(pollCancel);
+            };
+            const timeout = setTimeout(() => {
+                cleanup();
+                this.pending = undefined;
+                reject(new Error('Sign-in timed out waiting for browser callback.'));
+            }, timeoutMs);
+            this.pending = {
+                expectedState,
+                resolve: (code) => {
+                    cleanup();
+                    clearTimeout(timeout);
+                    resolve(code);
+                },
+                reject: (err) => {
+                    cleanup();
+                    clearTimeout(timeout);
+                    reject(err);
+                },
+            };
+            pollCancel = setInterval(() => {
+                if (cancel?.()) {
+                    cleanup();
+                    clearTimeout(timeout);
+                    this.pending = undefined;
+                    reject(new Error('Sign-in cancelled'));
+                }
+            }, 250);
+        });
+    }
+    async stop() {
+        this.pending?.reject(new Error('Sign-in cancelled'));
+        this.pending = undefined;
+        if (!this.server) {
+            return;
+        }
+        await new Promise((resolve) => {
+            this.server.close(() => resolve());
+        });
+        this.server = undefined;
+        this.port = undefined;
+    }
+}
+exports.AgentHippoLoopbackAuthServer = AgentHippoLoopbackAuthServer;

package/out/auth/pkce.js

@@ -0,0 +1,9 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codeChallengeFromVerifier = exports.generateCodeVerifier = void 0;
+var pkce_js_1 = require("../auth-broker/pkce.js");
+Object.defineProperty(exports, "generateCodeVerifier", { enumerable: true, get: function () { return pkce_js_1.generateCodeVerifier; } });
+Object.defineProperty(exports, "codeChallengeFromVerifier", { enumerable: true, get: function () { return pkce_js_1.codeChallengeFromVerifier; } });

package/out/auth/provider.js

@@ -0,0 +1,239 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentHippoAuthProvider = exports.getAgentHippoAccessToken = void 0;
+exports.registerAgentHippoAuth = registerAgentHippoAuth;
+exports.refreshBootstrapIfSignedIn = refreshBootstrapIfSignedIn;
+exports.startAgentHippoTokenRefreshTimer = startAgentHippoTokenRefreshTimer;
+const vscode = __importStar(require("vscode"));
+const brokerClient_js_1 = require("./brokerClient.js");
+const bootstrapApply_js_1 = require("./bootstrapApply.js");
+const types_js_1 = require("./types.js");
+const signInFlow_js_1 = require("./signInFlow.js");
+const sessionStore_js_1 = require("./sessionStore.js");
+var sessionStore_js_2 = require("./sessionStore.js");
+Object.defineProperty(exports, "getAgentHippoAccessToken", { enumerable: true, get: function () { return sessionStore_js_2.getAgentHippoAccessToken; } });
+const DEFAULT_AGENTHIPPO_MODEL_GATEWAY_URL = 'https://api.agenthippo.ai/v1';
+function getAgentHippoModelGatewayUrl() {
+    return vscode.workspace.getConfiguration('agentide').get('AgentHippoModelGateway.url')?.trim() || DEFAULT_AGENTHIPPO_MODEL_GATEWAY_URL;
+}
+/** Returns true if the key was successfully pushed to the model gateway. */
+async function syncAgentHippoModelGatewayToken(accessToken) {
+    try {
+        await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', {
+            provider: 'agenthippo',
+            apiKey: accessToken,
+            baseUrl: getAgentHippoModelGatewayUrl(),
+        });
+        return true;
+    }
+    catch {
+        // workbench may not be ready yet; model registry will pick it up on next refresh
+        return false;
+    }
+}
+async function clearAgentHippoModelGatewayToken() {
+    try {
+        await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', {
+            provider: 'agenthippo',
+            apiKey: '',
+        });
+    }
+    catch {
+        // best effort
+    }
+}
+class AgentHippoAuthProvider {
+    context;
+    _onDidChangeSessions = new vscode.EventEmitter();
+    onDidChangeSessions = this._onDidChangeSessions.event;
+    constructor(context) {
+        this.context = context;
+    }
+    dispose() {
+        // no-op
+    }
+    async getSessions(scopes) {
+        const stored = await (0, sessionStore_js_1.getStoredAuthSession)(this.context.secrets);
+        if (!stored) {
+            return [];
+        }
+        if (scopes?.length && !scopes.every((s) => stored.scopes.includes(s))) {
+            return [];
+        }
+        return [(0, sessionStore_js_1.storedSessionToVsCode)(stored)];
+    }
+    async createSession(scopes) {
+        const session = await (0, signInFlow_js_1.runAgentHippoSignInFlow)(this.context, { scopes });
+        if (!session) {
+            throw new Error('Sign-in cancelled');
+        }
+        this._onDidChangeSessions.fire({ added: [session], removed: [], changed: [] });
+        void syncAgentHippoModelGatewayToken(session.accessToken);
+        return session;
+    }
+    async removeSession(_sessionId) {
+        const stored = await (0, sessionStore_js_1.getStoredAuthSession)(this.context.secrets);
+        const removedSession = stored ? (0, sessionStore_js_1.storedSessionToVsCode)(stored) : undefined;
+        if (stored) {
+            const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+            try {
+                await fetch(`${baseUrl}/api/ide/signout`, {
+                    method: 'POST',
+                    headers: { Authorization: `Bearer ${stored.accessToken}` },
+                });
+            }
+            catch {
+                // best effort
+            }
+        }
+        await (0, sessionStore_js_1.clearAuthSession)(this.context.secrets);
+        void clearAgentHippoModelGatewayToken();
+        await (0, bootstrapApply_js_1.revertTeamManagedBootstrap)({
+            getConfiguration: (section) => vscode.workspace.getConfiguration(section),
+            ConfigurationTarget: vscode.ConfigurationTarget,
+            setParticipantApiKey: async (args) => {
+                await vscode.commands.executeCommand('agentide.setParticipantApiKey', args);
+                await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', args);
+            },
+            globalStateUpdate: async (key, value) => {
+                await this.context.globalState.update(key, value);
+            },
+            globalStateGet: (key) => this.context.globalState.get(key),
+        });
+        const removed = removedSession ? [removedSession] : [];
+        this._onDidChangeSessions.fire({ added: [], removed, changed: [] });
+    }
+}
+exports.AgentHippoAuthProvider = AgentHippoAuthProvider;
+function registerAgentHippoAuth(context) {
+    const provider = new AgentHippoAuthProvider(context);
+    context.subscriptions.push(vscode.authentication.registerAuthenticationProvider(types_js_1.AUTH_PROVIDER_ID, 'AgentHippo', provider, { supportsMultipleAccounts: false }), vscode.commands.registerCommand('agenthippo.signIn', async () => {
+        try {
+            await vscode.authentication.getSession(types_js_1.AUTH_PROVIDER_ID, [...types_js_1.AUTH_SCOPES], { forceNewSession: true });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (!message.toLowerCase().includes('cancel')) {
+                void vscode.window.showErrorMessage(`AgentHippo sign-in failed: ${message}`);
+            }
+        }
+    }), vscode.commands.registerCommand('agenthippo.signOut', async () => {
+        const session = await (0, sessionStore_js_1.getStoredAuthSession)(context.secrets);
+        if (session) {
+            await provider.removeSession(session.accountId);
+        }
+    }), 
+    // Called by the workbench provider dispatcher on an AgentHippo model-gateway 401 to refresh
+    // the (possibly stale) JWT and re-push it to IAPIKeyService before a single retry. Returns
+    // true when a fresh key is now available in SecretStorage for the dispatcher to re-read.
+    vscode.commands.registerCommand('agentide.auth.refreshToken', async () => {
+        const token = await (0, sessionStore_js_1.getAgentHippoAccessToken)(context);
+        if (!token) {
+            return false;
+        }
+        return syncAgentHippoModelGatewayToken(token.accessToken);
+    }));
+}
+async function refreshBootstrapIfSignedIn(context) {
+    const token = await (0, sessionStore_js_1.getAgentHippoAccessToken)(context);
+    if (!token) {
+        return;
+    }
+    try {
+        await (0, sessionStore_js_1.applyIdeBootstrapForContext)(context, token.accessToken);
+    }
+    catch {
+        // ignore startup refresh errors
+    }
+    void syncAgentHippoModelGatewayToken(token.accessToken);
+}
+/**
+ * Refresh cadence for the model-gateway JWT and LiteLLM routing key. The access token TTL is
+ * ~1h; getAgentHippoAccessToken refreshes it inside a 5-min pre-expiry window, so a 60s tick
+ * always lands inside that window with buffer and re-syncs the agenthippo provider key before
+ * the old JWT expires (fixes stale-key 401s on long sessions). Routing credentials are refreshed
+ * less often (every ~5 min) so a server-side rotation of the team LiteLLM key is picked up
+ * without re-sign-in. Both syncs are diff-gated so we don't churn SecretStorage / settings /
+ * onDidChangeKeys every tick when nothing changed.
+ */
+const TOKEN_REFRESH_INTERVAL_MS = 60_000;
+const ROUTING_REFRESH_EVERY_N_TICKS = 5;
+function startAgentHippoTokenRefreshTimer(context) {
+    let lastSyncedAccessToken = '';
+    let running = false;
+    let tick = 0;
+    const handle = setInterval(() => {
+        // Guard against overlapping ticks: a stalled fetch shouldn't let the next tick stack up.
+        if (running) {
+            return;
+        }
+        void (async () => {
+            running = true;
+            try {
+                const token = await (0, sessionStore_js_1.getAgentHippoAccessToken)(context);
+                if (!token) {
+                    return;
+                }
+                // Only push to the model gateway when the JWT actually changed (once per ~hour,
+                // on rotation) — setAPIKey fires onDidChangeKeys on every call, so re-syncing an
+                // unchanged token every 60s would churn listeners.
+                if (token.accessToken !== lastSyncedAccessToken) {
+                    const ok = await syncAgentHippoModelGatewayToken(token.accessToken);
+                    if (ok) {
+                        lastSyncedAccessToken = token.accessToken;
+                    }
+                }
+                // Routing key rotation is rare; refresh infrequently and let the helper skip the
+                // settings write when the key hasn't changed.
+                if (++tick % ROUTING_REFRESH_EVERY_N_TICKS === 0) {
+                    try {
+                        await (0, sessionStore_js_1.refreshRoutingCredentialsForContext)(context, token.accessToken);
+                    }
+                    catch {
+                        // best-effort routing refresh; next cycle retries
+                    }
+                }
+            }
+            finally {
+                running = false;
+            }
+        })();
+    }, TOKEN_REFRESH_INTERVAL_MS);
+    return { dispose: () => clearInterval(handle) };
+}

package/out/auth/sessionStore.js

@@ -0,0 +1,193 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getStoredAuthSession = getStoredAuthSession;
+exports.persistAuthSession = persistAuthSession;
+exports.applyIdeBootstrapForContext = applyIdeBootstrapForContext;
+exports.refreshRoutingCredentialsForContext = refreshRoutingCredentialsForContext;
+exports.getAgentHippoAccessToken = getAgentHippoAccessToken;
+exports.clearAuthSession = clearAuthSession;
+exports.storedSessionToVsCode = storedSessionToVsCode;
+const vscode = __importStar(require("vscode"));
+const brokerClient_js_1 = require("./brokerClient.js");
+const bootstrapApply_js_1 = require("./bootstrapApply.js");
+const SESSION_SECRET_KEY = 'agenthippo.auth.session';
+/**
+ * Refresh this far before expiry so the model-gateway key (synced by a periodic timer in
+ * provider.ts) is rotated with a buffer before the old short-lived JWT actually expires.
+ */
+const REFRESH_WINDOW_MS = 5 * 60_000;
+/**
+ * De-dups concurrent refresh attempts. Refresh tokens are single-use (the broker revokes the
+ * rotated token on first exchange), so two simultaneous refreshes would burn one token and
+ * force a re-sign-in. Only the first caller performs the refresh; others await its result.
+ */
+let inFlightRefresh;
+async function getStoredAuthSession(secrets) {
+    const raw = await secrets.get(SESSION_SECRET_KEY);
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function storeAuthSession(secrets, session) {
+    await secrets.store(SESSION_SECRET_KEY, JSON.stringify(session));
+}
+function toVsCodeSession(stored) {
+    return {
+        id: stored.accountId,
+        accessToken: stored.accessToken,
+        account: { id: stored.accountId, label: stored.accountLabel },
+        scopes: stored.scopes,
+    };
+}
+async function persistAuthSession(secrets, tokens, bootstrap, scopes) {
+    const session = {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        accountId: bootstrap.user.id,
+        accountLabel: bootstrap.user.email,
+        scopes: [...scopes],
+        expiresAt: Date.now() + tokens.expires_in * 1000,
+    };
+    await storeAuthSession(secrets, session);
+    return toVsCodeSession(session);
+}
+async function applyIdeBootstrapForContext(context, accessToken) {
+    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+    const bootstrap = await (0, brokerClient_js_1.fetchBootstrap)(baseUrl, accessToken);
+    await (0, bootstrapApply_js_1.applyIdeBootstrap)(bootstrap, {
+        getConfiguration: (section) => vscode.workspace.getConfiguration(section),
+        ConfigurationTarget: vscode.ConfigurationTarget,
+        setParticipantApiKey: async (args) => {
+            await vscode.commands.executeCommand('agentide.setParticipantApiKey', args);
+            await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', args);
+        },
+        globalStateUpdate: async (key, value) => {
+            await context.globalState.update(key, value);
+        },
+        globalStateGet: (key) => context.globalState.get(key),
+    });
+    return bootstrap;
+}
+/**
+ * Refresh only the LiteLLM routing credentials (lighter than re-fetching the full bootstrap)
+ * and re-apply them, merging into the last cached bootstrap. Handles server-side rotation of
+ * the team routing key without requiring a re-sign-in. No-op if no bootstrap has been applied.
+ */
+async function refreshRoutingCredentialsForContext(context, accessToken) {
+    const cached = context.globalState.get(bootstrapApply_js_1.TEAM_BOOTSTRAP_CACHE_KEY);
+    if (!cached) {
+        return;
+    }
+    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+    const refreshed = await (0, brokerClient_js_1.fetchBootstrapRefresh)(baseUrl, accessToken);
+    // Skip the settings write when nothing rotated: applyIdeBootstrap re-writes store + routing
+    // and setAPIKey fires onDidChangeKeys on every call, so re-applying an unchanged key every
+    // few minutes would churn listeners and SecretStorage.
+    const keyChanged = refreshed.routing.litellmApiKey !== cached.routing.litellmApiKey;
+    const baseUrlChanged = refreshed.routing.litellmBaseUrl !== cached.routing.litellmBaseUrl;
+    if (!keyChanged && !baseUrlChanged) {
+        return;
+    }
+    const merged = {
+        ...cached,
+        routing: { ...cached.routing, ...refreshed.routing },
+    };
+    await (0, bootstrapApply_js_1.applyIdeBootstrap)(merged, {
+        getConfiguration: (section) => vscode.workspace.getConfiguration(section),
+        ConfigurationTarget: vscode.ConfigurationTarget,
+        setParticipantApiKey: async (args) => {
+            await vscode.commands.executeCommand('agentide.setParticipantApiKey', args);
+            await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', args);
+        },
+        globalStateUpdate: async (key, value) => {
+            await context.globalState.update(key, value);
+        },
+        globalStateGet: (key) => context.globalState.get(key),
+    });
+}
+async function getAgentHippoAccessToken(context) {
+    const stored = await getStoredAuthSession(context.secrets);
+    if (!stored) {
+        return undefined;
+    }
+    if (stored.expiresAt > Date.now() + REFRESH_WINDOW_MS) {
+        return { accessToken: stored.accessToken, email: stored.accountLabel };
+    }
+    // Near expiry — refresh exactly once across concurrent callers.
+    if (!inFlightRefresh) {
+        const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+        const refreshing = stored;
+        inFlightRefresh = (async () => {
+            try {
+                const refreshed = await (0, brokerClient_js_1.refreshAccessToken)(baseUrl, refreshing.refreshToken);
+                const next = {
+                    ...refreshing,
+                    accessToken: refreshed.access_token,
+                    refreshToken: refreshed.refresh_token,
+                    expiresAt: Date.now() + refreshed.expires_in * 1000,
+                };
+                await storeAuthSession(context.secrets, next);
+                return next;
+            }
+            catch {
+                return undefined;
+            }
+            finally {
+                inFlightRefresh = undefined;
+            }
+        })();
+    }
+    const result = await inFlightRefresh;
+    if (!result) {
+        return undefined;
+    }
+    return { accessToken: result.accessToken, email: result.accountLabel };
+}
+async function clearAuthSession(secrets) {
+    await secrets.delete(SESSION_SECRET_KEY);
+}
+function storedSessionToVsCode(stored) {
+    return toVsCodeSession(stored);
+}