@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/auth/authBaseUrl.js

@@ -1,59 +1,2 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertSafeAuthBaseUrl = void 0;
-exports.pickTrustedAuthBaseUrl = pickTrustedAuthBaseUrl;
-exports.resolveAuthBrokerBaseUrl = resolveAuthBrokerBaseUrl;
-/**
- * Where `agentide.auth.baseUrl` is allowed to come from.
- *
- * The setting is declared `"scope": "application"` in package.json, which is what actually stops a
- * repo's `.vscode/settings.json` from setting it. This module is the defence in depth behind that
- * declaration: it re-derives the value from `inspect()` and takes ONLY the user/application/default
- * layers, so even if the contribution scope is ever loosened by accident (or the value arrives
- * through a remote/folder layer this extension does not expect), a workspace-supplied endpoint is
- * dropped rather than trusted.
- *
- * Why this matters concretely: the resolved URL receives the PKCE authorization code, then
- * `Authorization: Bearer <AgentHippo access token>` on `/api/ide/bootstrap`, and the response
- * configures team store settings plus `agentide.AgentHippoModelGateway.url` (application-scoped).
- * The access token is also synced to the `agenthippo` model provider. A workspace that could
- * steer the auth endpoint would capture the token AND every subsequent prompt.
- */
-const brokerClient_js_1 = require("./brokerClient.js");
-Object.defineProperty(exports, "assertSafeAuthBaseUrl", { enumerable: true, get: function () { return brokerClient_js_1.assertSafeAuthBaseUrl; } });
-/**
- * Pick the auth base URL from the trusted layers only.
- *
- * Precedence matches VS Code's own (most specific trusted layer wins): remote user → local user →
- * user → default. `workspaceValue` / `workspaceFolderValue` are never consulted for the result;
- * they are only reported so the caller can warn.
- */
-function pickTrustedAuthBaseUrl(inspect) {
-    if (!inspect) {
-        return {};
-    }
-    const ignored = inspect.workspaceFolderValue?.trim() || inspect.workspaceValue?.trim() || undefined;
-    const trusted = inspect.globalRemoteValue?.trim() ||
-        inspect.globalLocalValue?.trim() ||
-        inspect.globalValue?.trim() ||
-        inspect.defaultValue?.trim() ||
-        undefined;
-    // A workspace value that merely repeats the trusted value is not an override worth warning about.
-    const ignoredWorkspaceValue = ignored && ignored !== trusted ? ignored : undefined;
-    return { value: trusted, ...(ignoredWorkspaceValue ? { ignoredWorkspaceValue } : {}) };
-}
-/**
- * Resolve the auth broker base URL from configuration, dropping workspace-scoped values and
- * enforcing the https/loopback requirement. Throws (with an actionable message) on a bad URL.
- */
-function resolveAuthBrokerBaseUrl(config, warn) {
-    const picked = pickTrustedAuthBaseUrl(config?.inspect('auth.baseUrl'));
-    if (picked.ignoredWorkspaceValue) {
-        warn?.(`[AgentIDE] Ignoring workspace-provided "agentide.auth.baseUrl" (${picked.ignoredWorkspaceValue}). ` +
-            `This endpoint receives your AgentHippo access token, so it is only honoured from user/application settings.`);
-    }
-    return (0, brokerClient_js_1.getAuthBrokerBaseUrl)(picked.value);
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.assertSafeAuthBaseUrl=void 0,exports.pickTrustedAuthBaseUrl=pickTrustedAuthBaseUrl,exports.resolveAuthBrokerBaseUrl=resolveAuthBrokerBaseUrl;const brokerClient_js_1=require("./brokerClient.js");Object.defineProperty(exports,"assertSafeAuthBaseUrl",{enumerable:!0,get:function(){return brokerClient_js_1.assertSafeAuthBaseUrl}});function pickTrustedAuthBaseUrl(e){if(!e)return{};const t=e.workspaceFolderValue?.trim()||e.workspaceValue?.trim()||void 0,r=e.globalRemoteValue?.trim()||e.globalLocalValue?.trim()||e.globalValue?.trim()||e.defaultValue?.trim()||void 0,o=t&&t!==r?t:void 0;return{value:r,...o?{ignoredWorkspaceValue:o}:{}}}function resolveAuthBrokerBaseUrl(e,t){const r=pickTrustedAuthBaseUrl(e?.inspect("auth.baseUrl"));return r.ignoredWorkspaceValue&&t?.(`[AgentIDE] Ignoring workspace-provided "agentide.auth.baseUrl" (${r.ignoredWorkspaceValue}). This endpoint receives your AgentHippo access token, so it is only honoured from user/application settings.`),(0,brokerClient_js_1.getAuthBrokerBaseUrl)(r.value)}

package/out/auth/bootstrapApply.js

@@ -1,71 +1,2 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEAM_BOOTSTRAP_CACHE_KEY = exports.TEAM_LAST_BOOTSTRAP_KEY = exports.TEAM_ID_KEY = exports.TEAM_MANAGED_ROUTING_KEY = exports.TEAM_MANAGED_STORE_KEY = void 0;
-exports.applyIdeBootstrap = applyIdeBootstrap;
-exports.revertTeamManagedBootstrap = revertTeamManagedBootstrap;
-exports.TEAM_MANAGED_STORE_KEY = 'agentide.teamManaged.store';
-exports.TEAM_MANAGED_ROUTING_KEY = 'agentide.teamManaged.routing';
-exports.TEAM_ID_KEY = 'agentide.team.id';
-exports.TEAM_LAST_BOOTSTRAP_KEY = 'agentide.team.lastBootstrapAt';
-exports.TEAM_BOOTSTRAP_CACHE_KEY = 'agentide.team.bootstrapCache';
-function shouldApplySetting(managedFlag, teamManagedList, key) {
-    return !managedFlag || teamManagedList.includes(key);
-}
-async function applyIdeBootstrap(bootstrap, target) {
-    const applied = [];
-    const skipped = [];
-    const teamManaged = bootstrap.policy.teamManagedSettings ?? [];
-    const storeConfig = target.getConfiguration('agentide');
-    if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_STORE_KEY), teamManaged, 'store')) {
-        await storeConfig.update('storeRepo', bootstrap.store.repo, target.ConfigurationTarget.Global);
-        await storeConfig.update('store.indexUrl', bootstrap.store.indexUrl, target.ConfigurationTarget.Global);
-        await target.globalStateUpdate(exports.TEAM_MANAGED_STORE_KEY, teamManaged.includes('store'));
-        applied.push('store');
-    }
-    else {
-        skipped.push('store');
-    }
-    // Routing configures the `agenthippo` provider slot ONLY. The `litellm` slot stays user-owned
-    // (a developer's local Spotlight proxy) — sign-in must never overwrite it. No credential is
-    // written here: the account JWT is synced to the provider by the auth provider's timer, and
-    // the bootstrap carries no routing key at all.
-    if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY), teamManaged, 'routing')) {
-        await storeConfig.update('AgentHippoModelGateway.url', bootstrap.routing.inferenceGatewayUrl, target.ConfigurationTarget.Global);
-        await target.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY, teamManaged.includes('routing'));
-        applied.push('routing');
-    }
-    else {
-        skipped.push('routing');
-    }
-    await target.globalStateUpdate(exports.TEAM_ID_KEY, bootstrap.team?.id);
-    await target.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY, new Date().toISOString());
-    await target.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY, bootstrap);
-    return { applied, skipped };
-}
-async function revertTeamManagedBootstrap(target) {
-    const storeManaged = target.globalStateGet(exports.TEAM_MANAGED_STORE_KEY);
-    const routingManaged = target.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY);
-    const storeConfig = target.getConfiguration('agentide');
-    const litellmConfig = target.getConfiguration('agentide.providers.litellm');
-    if (storeManaged) {
-        await storeConfig.update('storeRepo', 'agenthippoai/agenthippo-store', target.ConfigurationTarget.Global);
-        await storeConfig.update('store.indexUrl', 'https://agenthippoai.github.io/agenthippo-store', target.ConfigurationTarget.Global);
-    }
-    if (routingManaged) {
-        await storeConfig.update('AgentHippoModelGateway.url', undefined, target.ConfigurationTarget.Global);
-        // Clean up state written by pre-separation installs, where team routing overwrote the
-        // user-owned litellm slot with the team base URL and a shared key.
-        await litellmConfig.update('baseUrl', '', target.ConfigurationTarget.Global);
-        if (target.setParticipantApiKey) {
-            await target.setParticipantApiKey({ provider: 'litellm', apiKey: '', baseUrl: '' });
-        }
-    }
-    await target.globalStateUpdate(exports.TEAM_MANAGED_STORE_KEY, false);
-    await target.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY, false);
-    await target.globalStateUpdate(exports.TEAM_ID_KEY, undefined);
-    await target.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY, undefined);
-    await target.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY, undefined);
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.TEAM_BOOTSTRAP_CACHE_KEY=exports.TEAM_LAST_BOOTSTRAP_KEY=exports.TEAM_ID_KEY=exports.TEAM_MANAGED_ROUTING_KEY=exports.TEAM_MANAGED_STORE_KEY=void 0,exports.applyIdeBootstrap=applyIdeBootstrap,exports.revertTeamManagedBootstrap=revertTeamManagedBootstrap,exports.TEAM_MANAGED_STORE_KEY="agentide.teamManaged.store",exports.TEAM_MANAGED_ROUTING_KEY="agentide.teamManaged.routing",exports.TEAM_ID_KEY="agentide.team.id",exports.TEAM_LAST_BOOTSTRAP_KEY="agentide.team.lastBootstrapAt",exports.TEAM_BOOTSTRAP_CACHE_KEY="agentide.team.bootstrapCache";function shouldApplySetting(e,t,a){return!e||t.includes(a)}async function applyIdeBootstrap(e,t){const a=[],o=[],i=e.policy.teamManagedSettings??[],n=t.getConfiguration("agentide");return shouldApplySetting(t.globalStateGet(exports.TEAM_MANAGED_STORE_KEY),i,"store")?(await n.update("storeRepo",e.store.repo,t.ConfigurationTarget.Global),await n.update("store.indexUrl",e.store.indexUrl,t.ConfigurationTarget.Global),await t.globalStateUpdate(exports.TEAM_MANAGED_STORE_KEY,i.includes("store")),a.push("store")):o.push("store"),shouldApplySetting(t.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY),i,"routing")?(await n.update("AgentHippoModelGateway.url",e.routing.inferenceGatewayUrl,t.ConfigurationTarget.Global),await t.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY,i.includes("routing")),a.push("routing")):o.push("routing"),await t.globalStateUpdate(exports.TEAM_ID_KEY,e.team?.id),await t.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY,new Date().toISOString()),await t.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY,e),{applied:a,skipped:o}}async function revertTeamManagedBootstrap(e){const t=e.globalStateGet(exports.TEAM_MANAGED_STORE_KEY),a=e.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY),o=e.getConfiguration("agentide"),i=e.getConfiguration("agentide.providers.litellm");t&&(await o.update("storeRepo","agenthippoai/agenthippo-store",e.ConfigurationTarget.Global),await o.update("store.indexUrl","https://agenthippoai.github.io/agenthippo-store",e.ConfigurationTarget.Global)),a&&(await o.update("AgentHippoModelGateway.url",void 0,e.ConfigurationTarget.Global),await i.update("baseUrl","",e.ConfigurationTarget.Global),e.setParticipantApiKey&&await e.setParticipantApiKey({provider:"litellm",apiKey:"",baseUrl:""})),await e.globalStateUpdate(exports.TEAM_MANAGED_STORE_KEY,!1),await e.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY,!1),await e.globalStateUpdate(exports.TEAM_ID_KEY,void 0),await e.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY,void 0),await e.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY,void 0)}

package/out/auth/brokerClient.js

@@ -1,160 +1,2 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_AUTH_BROKER_BASE_URL = void 0;
-exports.isLoopbackAuthHost = isLoopbackAuthHost;
-exports.assertSafeAuthBaseUrl = assertSafeAuthBaseUrl;
-exports.getAuthBrokerBaseUrl = getAuthBrokerBaseUrl;
-exports.devLoginForTests = devLoginForTests;
-exports.exchangeAuthorizationCode = exchangeAuthorizationCode;
-exports.refreshAccessToken = refreshAccessToken;
-exports.fetchBootstrap = fetchBootstrap;
-exports.fetchMe = fetchMe;
-exports.buildAuthorizeUrl = buildAuthorizeUrl;
-exports.completeDevPkceLogin = completeDevPkceLogin;
-const types_js_1 = require("./types.js");
-const pkce_js_1 = require("./pkce.js");
-exports.DEFAULT_AUTH_BROKER_BASE_URL = 'https://auth.agenthippo.ai';
-/** Hostnames for which plain `http://` is accepted — an operator running a broker locally. */
-const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
-function isLoopbackAuthHost(hostname) {
-    return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
-}
-/**
- * Refuse an auth base URL that cannot safely carry a bearer token.
- *
- * Every request built from this value carries either the PKCE authorization code or the user's
- * AgentHippo access token (`/oauth/token`, `/api/ide/bootstrap`, `/api/ide/me`), and the bootstrap
- * response is written straight into the user's model-routing settings. A cleartext or non-http(s)
- * endpoint therefore leaks the credential on the wire; anything but https is refused unless the
- * host is loopback, which is the local-development case and never crosses a network.
- *
- * Returns the normalized (trailing-slash-stripped) URL, or throws with an actionable message.
- */
-function assertSafeAuthBaseUrl(value) {
-    const trimmed = value.trim();
-    let url;
-    try {
-        url = new URL(trimmed);
-    }
-    catch {
-        throw new Error(`AgentHippo auth base URL "${trimmed}" is not a valid URL. ` +
-            `Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`);
-    }
-    if (url.protocol === 'https:') {
-        return trimmed.replace(/\/+$/, '');
-    }
-    if (url.protocol === 'http:' && isLoopbackAuthHost(url.hostname)) {
-        return trimmed.replace(/\/+$/, '');
-    }
-    throw new Error(`Refusing to use AgentHippo auth base URL "${trimmed}": it must be https:// ` +
-        `(plain http:// is accepted only for loopback hosts such as http://127.0.0.1:9780). ` +
-        `Your AgentHippo access token is sent to this host, so it is never sent over cleartext. ` +
-        `Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`);
-}
-/**
- * Resolve the auth broker base URL. `configured` must already have been filtered for scope by the
- * caller (see `auth/authBaseUrl.ts` — a workspace-scoped value is dropped before it gets here);
- * this function is the second gate and enforces the transport requirement.
- */
-function getAuthBrokerBaseUrl(configured) {
-    const fromEnv = process.env.AGENTHIPPO_AUTH_BASE_URL?.trim();
-    const value = configured?.trim() || fromEnv || exports.DEFAULT_AUTH_BROKER_BASE_URL;
-    return assertSafeAuthBaseUrl(value);
-}
-async function devLoginForTests(baseUrl, email, redirectUri, codeChallenge) {
-    const res = await fetch(`${baseUrl}/oauth/dev/login`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            email,
-            client_id: types_js_1.AUTH_CLIENT_ID,
-            redirect_uri: redirectUri,
-            code_challenge: codeChallenge,
-        }),
-    });
-    if (!res.ok) {
-        throw new Error(`dev login failed: ${res.status}`);
-    }
-    const json = await res.json();
-    return json.code;
-}
-async function exchangeAuthorizationCode(baseUrl, code, redirectUri, codeVerifier) {
-    const body = new URLSearchParams({
-        grant_type: 'authorization_code',
-        client_id: types_js_1.AUTH_CLIENT_ID,
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: codeVerifier,
-    });
-    const res = await fetch(`${baseUrl}/oauth/token`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body,
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`token exchange failed: ${res.status} ${text}`);
-    }
-    return res.json();
-}
-async function refreshAccessToken(baseUrl, refreshToken) {
-    const body = new URLSearchParams({
-        grant_type: 'refresh_token',
-        client_id: types_js_1.AUTH_CLIENT_ID,
-        refresh_token: refreshToken,
-        scope: types_js_1.AUTH_SCOPES.join(' '),
-    });
-    const res = await fetch(`${baseUrl}/oauth/token`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body,
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`refresh failed: ${res.status} ${text}`.trim());
-    }
-    return res.json();
-}
-async function fetchBootstrap(baseUrl, accessToken) {
-    const res = await fetch(`${baseUrl}/api/ide/bootstrap`, {
-        headers: { Authorization: `Bearer ${accessToken}` },
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`bootstrap failed: ${res.status} ${text}`.trim());
-    }
-    return res.json();
-}
-async function fetchMe(baseUrl, accessToken) {
-    const res = await fetch(`${baseUrl}/api/ide/me`, {
-        headers: { Authorization: `Bearer ${accessToken}` },
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`me failed: ${res.status} ${text}`.trim());
-    }
-    return res.json();
-}
-function buildAuthorizeUrl(baseUrl, redirectUri, codeChallenge, state, loginHint) {
-    const url = new URL(`${baseUrl}/oauth/authorize`);
-    url.searchParams.set('response_type', 'code');
-    url.searchParams.set('client_id', types_js_1.AUTH_CLIENT_ID);
-    url.searchParams.set('redirect_uri', redirectUri);
-    url.searchParams.set('code_challenge', codeChallenge);
-    url.searchParams.set('code_challenge_method', 'S256');
-    url.searchParams.set('scope', types_js_1.AUTH_SCOPES.join(' '));
-    url.searchParams.set('state', state);
-    if (loginHint) {
-        url.searchParams.set('login_hint', loginHint);
-    }
-    return url.toString();
-}
-async function completeDevPkceLogin(baseUrl, email, redirectUri = 'http://127.0.0.1:1/callback') {
-    const verifier = (0, pkce_js_1.generateCodeVerifier)();
-    const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-    const code = await devLoginForTests(baseUrl, email, redirectUri, challenge);
-    return exchangeAuthorizationCode(baseUrl, code, redirectUri, verifier);
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.DEFAULT_AUTH_BROKER_BASE_URL=void 0,exports.isLoopbackAuthHost=isLoopbackAuthHost,exports.assertSafeAuthBaseUrl=assertSafeAuthBaseUrl,exports.getAuthBrokerBaseUrl=getAuthBrokerBaseUrl,exports.devLoginForTests=devLoginForTests,exports.exchangeAuthorizationCode=exchangeAuthorizationCode,exports.refreshAccessToken=refreshAccessToken,exports.fetchBootstrap=fetchBootstrap,exports.fetchMe=fetchMe,exports.buildAuthorizeUrl=buildAuthorizeUrl,exports.completeDevPkceLogin=completeDevPkceLogin;const types_js_1=require("./types.js"),pkce_js_1=require("./pkce.js");exports.DEFAULT_AUTH_BROKER_BASE_URL="https://auth.agenthippo.ai";const LOOPBACK_HOSTNAMES=new Set(["localhost","127.0.0.1","::1","[::1]"]);function isLoopbackAuthHost(o){return LOOPBACK_HOSTNAMES.has(o.toLowerCase())}function assertSafeAuthBaseUrl(o){const t=o.trim();let e;try{e=new URL(t)}catch{throw new Error(`AgentHippo auth base URL "${t}" is not a valid URL. Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`)}if(e.protocol==="https:")return t.replace(/\/+$/,"");if(e.protocol==="http:"&&isLoopbackAuthHost(e.hostname))return t.replace(/\/+$/,"");throw new Error(`Refusing to use AgentHippo auth base URL "${t}": it must be https:// (plain http:// is accepted only for loopback hosts such as http://127.0.0.1:9780). Your AgentHippo access token is sent to this host, so it is never sent over cleartext. Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`)}function getAuthBrokerBaseUrl(o){const t=process.env.AGENTHIPPO_AUTH_BASE_URL?.trim(),e=o?.trim()||t||exports.DEFAULT_AUTH_BROKER_BASE_URL;return assertSafeAuthBaseUrl(e)}async function devLoginForTests(o,t,e,r){const a=await fetch(`${o}/oauth/dev/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:t,client_id:types_js_1.AUTH_CLIENT_ID,redirect_uri:e,code_challenge:r})});if(!a.ok)throw new Error(`dev login failed: ${a.status}`);return(await a.json()).code}async function exchangeAuthorizationCode(o,t,e,r){const a=new URLSearchParams({grant_type:"authorization_code",client_id:types_js_1.AUTH_CLIENT_ID,code:t,redirect_uri:e,code_verifier:r}),s=await fetch(`${o}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:a});if(!s.ok){const n=await s.text();throw new Error(`token exchange failed: ${s.status} ${n}`)}return s.json()}async function refreshAccessToken(o,t){const e=new URLSearchParams({grant_type:"refresh_token",client_id:types_js_1.AUTH_CLIENT_ID,refresh_token:t,scope:types_js_1.AUTH_SCOPES.join(" ")}),r=await fetch(`${o}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:e});if(!r.ok){const a=await r.text();throw new Error(`refresh failed: ${r.status} ${a}`.trim())}return r.json()}async function fetchBootstrap(o,t){const e=await fetch(`${o}/api/ide/bootstrap`,{headers:{Authorization:`Bearer ${t}`}});if(!e.ok){const r=await e.text();throw new Error(`bootstrap failed: ${e.status} ${r}`.trim())}return e.json()}async function fetchMe(o,t){const e=await fetch(`${o}/api/ide/me`,{headers:{Authorization:`Bearer ${t}`}});if(!e.ok){const r=await e.text();throw new Error(`me failed: ${e.status} ${r}`.trim())}return e.json()}function buildAuthorizeUrl(o,t,e,r,a){const s=new URL(`${o}/oauth/authorize`);return s.searchParams.set("response_type","code"),s.searchParams.set("client_id",types_js_1.AUTH_CLIENT_ID),s.searchParams.set("redirect_uri",t),s.searchParams.set("code_challenge",e),s.searchParams.set("code_challenge_method","S256"),s.searchParams.set("scope",types_js_1.AUTH_SCOPES.join(" ")),s.searchParams.set("state",r),a&&s.searchParams.set("login_hint",a),s.toString()}async function completeDevPkceLogin(o,t,e="http://127.0.0.1:1/callback"){const r=(0,pkce_js_1.generateCodeVerifier)(),a=(0,pkce_js_1.codeChallengeFromVerifier)(r),s=await devLoginForTests(o,t,e,a);return exchangeAuthorizationCode(o,s,e,r)}

package/out/auth/callbackUri.js

@@ -1,59 +1,2 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildAuthCallbackUri = buildAuthCallbackUri;
-exports.resolveAuthRedirectUri = resolveAuthRedirectUri;
-exports.isAuthCallbackUri = isAuthCallbackUri;
-const vscode = __importStar(require("vscode"));
-const types_js_1 = require("./types.js");
-const callbackUriParse_js_1 = require("./callbackUriParse.js");
-/** VS Code / Cursor URI handler requires authority === extension id (e.g. agenthippo.agenthippo). */
-function buildAuthCallbackUri() {
-    return vscode.Uri.from({
-        scheme: vscode.env.uriScheme,
-        authority: types_js_1.AUTH_EXTENSION_AUTHORITY,
-        path: types_js_1.AUTH_CALLBACK_PATH,
-    });
-}
-async function resolveAuthRedirectUri() {
-    const external = await vscode.env.asExternalUri(buildAuthCallbackUri());
-    return external.toString(true);
-}
-function isAuthCallbackUri(uri) {
-    return (0, callbackUriParse_js_1.isAuthCallbackParts)(uri.authority, uri.path);
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";var __createBinding=this&&this.__createBinding||(Object.create?(function(t,e,i,r){r===void 0&&(r=i);var n=Object.getOwnPropertyDescriptor(e,i);(!n||("get"in n?!e.__esModule:n.writable||n.configurable))&&(n={enumerable:!0,get:function(){return e[i]}}),Object.defineProperty(t,r,n)}):(function(t,e,i,r){r===void 0&&(r=i),t[r]=e[i]})),__setModuleDefault=this&&this.__setModuleDefault||(Object.create?(function(t,e){Object.defineProperty(t,"default",{enumerable:!0,value:e})}):function(t,e){t.default=e}),__importStar=this&&this.__importStar||(function(){var t=function(e){return t=Object.getOwnPropertyNames||function(i){var r=[];for(var n in i)Object.prototype.hasOwnProperty.call(i,n)&&(r[r.length]=n);return r},t(e)};return function(e){if(e&&e.__esModule)return e;var i={};if(e!=null)for(var r=t(e),n=0;n<r.length;n++)r[n]!=="default"&&__createBinding(i,e,r[n]);return __setModuleDefault(i,e),i}})();Object.defineProperty(exports,"__esModule",{value:!0}),exports.buildAuthCallbackUri=buildAuthCallbackUri,exports.resolveAuthRedirectUri=resolveAuthRedirectUri,exports.isAuthCallbackUri=isAuthCallbackUri;const vscode=__importStar(require("vscode")),types_js_1=require("./types.js"),callbackUriParse_js_1=require("./callbackUriParse.js");function buildAuthCallbackUri(){return vscode.Uri.from({scheme:vscode.env.uriScheme,authority:types_js_1.AUTH_EXTENSION_AUTHORITY,path:types_js_1.AUTH_CALLBACK_PATH})}async function resolveAuthRedirectUri(){return(await vscode.env.asExternalUri(buildAuthCallbackUri())).toString(!0)}function isAuthCallbackUri(t){return(0,callbackUriParse_js_1.isAuthCallbackParts)(t.authority,t.path)}

package/out/auth/githubStoreGate.js

@@ -1,70 +1,2 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCachedBootstrap = getCachedBootstrap;
-exports.ensureGitHubStoreAccess = ensureGitHubStoreAccess;
-const vscode = __importStar(require("vscode"));
-const bootstrapApply_js_1 = require("./bootstrapApply.js");
-const github_js_1 = require("../agentpack/github.js");
-function getCachedBootstrap(globalState) {
-    return globalState.get(bootstrapApply_js_1.TEAM_BOOTSTRAP_CACHE_KEY);
-}
-/**
- * When team bootstrap sets store.githubOrg, require a GitHub session before store mutations.
- */
-async function ensureGitHubStoreAccess(context) {
-    const bootstrap = getCachedBootstrap(context.globalState);
-    const githubOrg = bootstrap?.store.githubOrg?.trim();
-    if (!githubOrg) {
-        return;
-    }
-    if (await (0, github_js_1.isGitHubAuthenticated)()) {
-        try {
-            await (0, github_js_1.getGitHubToken)(false, ['read:user', 'repo']);
-            return;
-        }
-        catch {
-            // fall through to prompt
-        }
-    }
-    const action = await vscode.window.showWarningMessage(`Team store is tied to GitHub org "${githubOrg}". Connect GitHub to install or publish.`, 'Connect GitHub', 'Cancel');
-    if (action !== 'Connect GitHub') {
-        throw new Error('GitHub connection required for team store access.');
-    }
-    await (0, github_js_1.getGitHubToken)(true, ['read:user', 'repo']);
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";var __createBinding=this&&this.__createBinding||(Object.create?(function(n,t,e,r){r===void 0&&(r=e);var i=Object.getOwnPropertyDescriptor(t,e);(!i||("get"in i?!t.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return t[e]}}),Object.defineProperty(n,r,i)}):(function(n,t,e,r){r===void 0&&(r=e),n[r]=t[e]})),__setModuleDefault=this&&this.__setModuleDefault||(Object.create?(function(n,t){Object.defineProperty(n,"default",{enumerable:!0,value:t})}):function(n,t){n.default=t}),__importStar=this&&this.__importStar||(function(){var n=function(t){return n=Object.getOwnPropertyNames||function(e){var r=[];for(var i in e)Object.prototype.hasOwnProperty.call(e,i)&&(r[r.length]=i);return r},n(t)};return function(t){if(t&&t.__esModule)return t;var e={};if(t!=null)for(var r=n(t),i=0;i<r.length;i++)r[i]!=="default"&&__createBinding(e,t,r[i]);return __setModuleDefault(e,t),e}})();Object.defineProperty(exports,"__esModule",{value:!0}),exports.getCachedBootstrap=getCachedBootstrap,exports.ensureGitHubStoreAccess=ensureGitHubStoreAccess;const vscode=__importStar(require("vscode")),bootstrapApply_js_1=require("./bootstrapApply.js"),github_js_1=require("../agentpack/github.js");function getCachedBootstrap(n){return n.get(bootstrapApply_js_1.TEAM_BOOTSTRAP_CACHE_KEY)}async function ensureGitHubStoreAccess(n){const e=getCachedBootstrap(n.globalState)?.store.githubOrg?.trim();if(!e)return;if(await(0,github_js_1.isGitHubAuthenticated)())try{await(0,github_js_1.getGitHubToken)(!1,["read:user","repo"]);return}catch{}if(await vscode.window.showWarningMessage(`Team store is tied to GitHub org "${e}". Connect GitHub to install or publish.`,"Connect GitHub","Cancel")!=="Connect GitHub")throw new Error("GitHub connection required for team store access.");await(0,github_js_1.getGitHubToken)(!0,["read:user","repo"])}

package/out/auth/loopbackAuthServer.js

@@ -1,165 +1,10 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentHippoLoopbackAuthServer = void 0;
-const http = __importStar(require("http"));
-const SUCCESS_HTML = `<!DOCTYPE html>
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";var __createBinding=this&&this.__createBinding||(Object.create?(function(o,e,r,n){n===void 0&&(n=r);var t=Object.getOwnPropertyDescriptor(e,r);(!t||("get"in t?!e.__esModule:t.writable||t.configurable))&&(t={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(o,n,t)}):(function(o,e,r,n){n===void 0&&(n=r),o[n]=e[r]})),__setModuleDefault=this&&this.__setModuleDefault||(Object.create?(function(o,e){Object.defineProperty(o,"default",{enumerable:!0,value:e})}):function(o,e){o.default=e}),__importStar=this&&this.__importStar||(function(){var o=function(e){return o=Object.getOwnPropertyNames||function(r){var n=[];for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(n[n.length]=t);return n},o(e)};return function(e){if(e&&e.__esModule)return e;var r={};if(e!=null)for(var n=o(e),t=0;t<n.length;t++)n[t]!=="default"&&__createBinding(r,e,n[t]);return __setModuleDefault(r,e),r}})();Object.defineProperty(exports,"__esModule",{value:!0}),exports.AgentHippoLoopbackAuthServer=void 0;const http=__importStar(require("http")),SUCCESS_HTML=`<!DOCTYPE html>
 <html lang="en"><head><meta charset="utf-8"/><title>AgentHippo</title></head>
 <body style="font-family:system-ui,sans-serif;padding:2rem">
 <p>Signed in to AgentHippo. You can close this tab.</p>
-</body></html>`;
-const STATE_MISMATCH_HTML = `<!DOCTYPE html>
+</body></html>`,STATE_MISMATCH_HTML=`<!DOCTYPE html>
 <html lang="en"><head><meta charset="utf-8"/><title>AgentHippo</title></head>
 <body style="font-family:system-ui,sans-serif;padding:2rem">
 <p>Sign-in could not be verified (state mismatch). Close this tab and try again from the IDE.</p>
-</body></html>`;
-/**
- * Localhost OAuth callback (same pattern as GitHub/Codex loopback flows).
- * Browser redirects to http://127.0.0.1:&lt;port&gt;/callback — no IDE URI scheme required.
- */
-class AgentHippoLoopbackAuthServer {
-    server;
-    port;
-    pending;
-    async start() {
-        if (this.server) {
-            return this.port;
-        }
-        return new Promise((resolve, reject) => {
-            const server = http.createServer((req, res) => {
-                try {
-                    const host = `127.0.0.1:${this.port}`;
-                    const url = new URL(req.url || '/', `http://${host}`);
-                    if (url.pathname !== '/callback') {
-                        res.writeHead(404);
-                        res.end();
-                        return;
-                    }
-                    const code = url.searchParams.get('code');
-                    const state = url.searchParams.get('state');
-                    if (!code || !state) {
-                        res.writeHead(400, { 'Content-Type': 'text/plain' });
-                        res.end('Missing authorization code');
-                        return;
-                    }
-                    // Validate state before showing success: a forged or cross-flow callback
-                    // must not render "signed in" or be silently dropped to a timeout.
-                    if (!this.pending || state !== this.pending.expectedState) {
-                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-                        res.end(STATE_MISMATCH_HTML);
-                        this.pending?.reject(new Error('OAuth state mismatch'));
-                        this.pending = undefined;
-                        return;
-                    }
-                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                    res.end(SUCCESS_HTML);
-                    this.pending.resolve(code);
-                    this.pending = undefined;
-                }
-                catch {
-                    res.writeHead(500);
-                    res.end();
-                }
-            });
-            server.once('error', reject);
-            server.listen(0, '127.0.0.1', () => {
-                const address = server.address();
-                if (!address || typeof address === 'string') {
-                    reject(new Error('Failed to bind loopback OAuth server'));
-                    return;
-                }
-                this.server = server;
-                this.port = address.port;
-                resolve(address.port);
-            });
-        });
-    }
-    getRedirectUri() {
-        if (!this.port) {
-            throw new Error('Loopback OAuth server not started');
-        }
-        return `http://127.0.0.1:${this.port}/callback`;
-    }
-    waitForAuthorizationCode(expectedState, timeoutMs, cancel) {
-        return new Promise((resolve, reject) => {
-            let pollCancel;
-            const cleanup = () => {
-                clearInterval(pollCancel);
-            };
-            const timeout = setTimeout(() => {
-                cleanup();
-                this.pending = undefined;
-                reject(new Error('Sign-in timed out waiting for browser callback.'));
-            }, timeoutMs);
-            this.pending = {
-                expectedState,
-                resolve: (code) => {
-                    cleanup();
-                    clearTimeout(timeout);
-                    resolve(code);
-                },
-                reject: (err) => {
-                    cleanup();
-                    clearTimeout(timeout);
-                    reject(err);
-                },
-            };
-            pollCancel = setInterval(() => {
-                if (cancel?.()) {
-                    cleanup();
-                    clearTimeout(timeout);
-                    this.pending = undefined;
-                    reject(new Error('Sign-in cancelled'));
-                }
-            }, 250);
-        });
-    }
-    async stop() {
-        this.pending?.reject(new Error('Sign-in cancelled'));
-        this.pending = undefined;
-        if (!this.server) {
-            return;
-        }
-        await new Promise((resolve) => {
-            this.server.close(() => resolve());
-        });
-        this.server = undefined;
-        this.port = undefined;
-    }
-}
-exports.AgentHippoLoopbackAuthServer = AgentHippoLoopbackAuthServer;
+</body></html>`;class AgentHippoLoopbackAuthServer{server;port;pending;async start(){return this.server?this.port:new Promise((e,r)=>{const n=http.createServer((t,i)=>{try{const d=`127.0.0.1:${this.port}`,a=new URL(t.url||"/",`http://${d}`);if(a.pathname!=="/callback"){i.writeHead(404),i.end();return}const s=a.searchParams.get("code"),c=a.searchParams.get("state");if(!s||!c){i.writeHead(400,{"Content-Type":"text/plain"}),i.end("Missing authorization code");return}if(!this.pending||c!==this.pending.expectedState){i.writeHead(400,{"Content-Type":"text/html; charset=utf-8"}),i.end(STATE_MISMATCH_HTML),this.pending?.reject(new Error("OAuth state mismatch")),this.pending=void 0;return}i.writeHead(200,{"Content-Type":"text/html; charset=utf-8"}),i.end(SUCCESS_HTML),this.pending.resolve(s),this.pending=void 0}catch{i.writeHead(500),i.end()}});n.once("error",r),n.listen(0,"127.0.0.1",()=>{const t=n.address();if(!t||typeof t=="string"){r(new Error("Failed to bind loopback OAuth server"));return}this.server=n,this.port=t.port,e(t.port)})})}getRedirectUri(){if(!this.port)throw new Error("Loopback OAuth server not started");return`http://127.0.0.1:${this.port}/callback`}waitForAuthorizationCode(e,r,n){return new Promise((t,i)=>{let d;const a=()=>{clearInterval(d)},s=setTimeout(()=>{a(),this.pending=void 0,i(new Error("Sign-in timed out waiting for browser callback."))},r);this.pending={expectedState:e,resolve:c=>{a(),clearTimeout(s),t(c)},reject:c=>{a(),clearTimeout(s),i(c)}},d=setInterval(()=>{n?.()&&(a(),clearTimeout(s),this.pending=void 0,i(new Error("Sign-in cancelled")))},250)})}async stop(){this.pending?.reject(new Error("Sign-in cancelled")),this.pending=void 0,this.server&&(await new Promise(e=>{this.server.close(()=>e())}),this.server=void 0,this.port=void 0)}}exports.AgentHippoLoopbackAuthServer=AgentHippoLoopbackAuthServer;