@amir83nasr/10router 0.1.0

package/src/lib/network/initOutboundProxy.js

@@ -0,0 +1,25 @@
+import { getSettings } from "@/lib/localDb";
+import { applyResolvedOutboundProxy } from "@/lib/network/resolveOutboundProxy";
+
+let initialized = false;
+
+export async function ensureOutboundProxyInitialized() {
+  if (initialized) return true;
+
+  try {
+    const settings = await getSettings();
+    await applyResolvedOutboundProxy(settings);
+    initialized = true;
+  } catch (error) {
+    console.error("[ServerInit] Error initializing outbound proxy:", error);
+  }
+
+  return initialized;
+}
+
+// Defer init so HTTP server accepts connections first
+setImmediate(() => {
+  ensureOutboundProxyInitialized().catch(console.log);
+});
+
+export default ensureOutboundProxyInitialized;

package/src/lib/network/outboundProxy.js

@@ -0,0 +1,87 @@
+function normalizeString(value) {
+  if (value === undefined || value === null) return "";
+  return String(value).trim();
+}
+
+const ALLOWED_PROXY_SCHEMES = ["http:", "https:", "socks5:", "socks4:", "socks5h:", "socks4a:"];
+
+function validateProxyUrl(url) {
+  if (!url) return null;
+  if (/[\n\r`$]/.test(url)) return null;
+  try {
+    const parsed = new URL(url);
+    if (!ALLOWED_PROXY_SCHEMES.includes(parsed.protocol)) return null;
+    return parsed.href;
+  } catch {
+    return null;
+  }
+}
+
+export function applyOutboundProxyEnv({
+  outboundProxyEnabled,
+  outboundProxyUrl,
+  outboundNoProxy,
+} = {}) {
+  if (typeof process === "undefined" || !process.env) return;
+  const enabled = Boolean(outboundProxyEnabled);
+  const proxyUrl = normalizeString(outboundProxyUrl);
+  const noProxy = normalizeString(outboundNoProxy);
+
+  // If disabled, only clear env vars we previously managed.
+  if (!enabled) {
+    if (process.env.NINE_ROUTER_PROXY_MANAGED === "1") {
+      delete process.env.HTTP_PROXY;
+      delete process.env.HTTPS_PROXY;
+      delete process.env.ALL_PROXY;
+      delete process.env.NO_PROXY;
+      delete process.env.NINE_ROUTER_PROXY_MANAGED;
+      delete process.env.NINE_ROUTER_PROXY_URL;
+      delete process.env.NINE_ROUTER_NO_PROXY;
+    }
+    return;
+  }
+
+  // When enabled:
+  // - If values are provided, write them and mark as managed
+  // - If values are empty, do not touch externally-provided env,
+  //   but do clear values we previously managed.
+  const wasManaged = process.env.NINE_ROUTER_PROXY_MANAGED === "1";
+  let managed = false;
+
+  if (wasManaged) {
+    if (!proxyUrl) {
+      delete process.env.HTTP_PROXY;
+      delete process.env.HTTPS_PROXY;
+      delete process.env.ALL_PROXY;
+      delete process.env.NINE_ROUTER_PROXY_URL;
+    }
+    if (!noProxy) {
+      delete process.env.NO_PROXY;
+      delete process.env.NINE_ROUTER_NO_PROXY;
+    }
+  }
+
+  if (proxyUrl) {
+    const validated = validateProxyUrl(proxyUrl);
+    if (validated) {
+      process.env.HTTP_PROXY = validated;
+      process.env.HTTPS_PROXY = validated;
+      process.env.ALL_PROXY = validated;
+      process.env.NINE_ROUTER_PROXY_URL = validated;
+      managed = true;
+    }
+  }
+
+  if (noProxy) {
+    process.env.NO_PROXY = noProxy;
+    process.env.NINE_ROUTER_NO_PROXY = noProxy;
+    managed = true;
+  }
+
+  if (managed) {
+    process.env.NINE_ROUTER_PROXY_MANAGED = "1";
+  } else if (wasManaged) {
+    // If we previously managed env but now cleared everything, drop the marker.
+    delete process.env.NINE_ROUTER_PROXY_MANAGED;
+  }
+}

package/src/lib/network/proxyTest.js

@@ -0,0 +1,88 @@
+import { ProxyAgent, fetch as undiciFetch } from "undici";
+
+const DEFAULT_TEST_URL = "https://google.com/";
+const DEFAULT_TIMEOUT_MS = 8000;
+
+function getErrorMessage(err) {
+  if (!err) return "Unknown error";
+  const base = err?.message || String(err);
+  const causeCode = err?.cause?.code || err?.code;
+  const causeMessage = err?.cause?.message;
+
+  if (causeMessage && causeMessage !== base) {
+    return causeCode ? `${base}: ${causeMessage} (${causeCode})` : `${base}: ${causeMessage}`;
+  }
+
+  if (causeCode && !base.includes(causeCode)) {
+    return `${base} (${causeCode})`;
+  }
+
+  return base;
+}
+
+function normalizeString(value) {
+  if (value === undefined || value === null) return "";
+  return String(value).trim();
+}
+
+export async function testProxyUrl({ proxyUrl, testUrl, timeoutMs } = {}) {
+  const normalizedProxyUrl = normalizeString(proxyUrl);
+  if (!normalizedProxyUrl) {
+    return { ok: false, status: 400, error: "proxyUrl is required" };
+  }
+
+  const normalizedTestUrl = normalizeString(testUrl) || DEFAULT_TEST_URL;
+  const timeoutMsRaw = Number(timeoutMs);
+  const normalizedTimeoutMs =
+    Number.isFinite(timeoutMsRaw) && timeoutMsRaw > 0
+      ? Math.min(timeoutMsRaw, 30000)
+      : DEFAULT_TIMEOUT_MS;
+
+  let dispatcher;
+
+  try {
+    try {
+      dispatcher = new ProxyAgent({ uri: normalizedProxyUrl });
+    } catch (err) {
+      return {
+        ok: false,
+        status: 400,
+        error: `Invalid proxy URL: ${err?.message || String(err)}`,
+      };
+    }
+
+    const controller = new AbortController();
+    const startedAt = Date.now();
+    const timer = setTimeout(() => controller.abort(), normalizedTimeoutMs);
+
+    try {
+      const res = await undiciFetch(normalizedTestUrl, {
+        method: "GET",
+        dispatcher,
+        signal: controller.signal,
+        headers: {
+          "User-Agent": "10Router",
+        },
+      });
+
+      return {
+        ok: res.ok,
+        status: res.status,
+        statusText: res.statusText,
+        url: normalizedTestUrl,
+        elapsedMs: Date.now() - startedAt,
+      };
+    } catch (err) {
+      const message = err?.name === "AbortError" ? "Proxy test timed out" : getErrorMessage(err);
+      return { ok: false, status: 500, error: message };
+    } finally {
+      clearTimeout(timer);
+    }
+  } finally {
+    try {
+      await dispatcher?.close?.();
+    } catch {
+      // ignore
+    }
+  }
+}

package/src/lib/network/resolveOutboundProxy.js

@@ -0,0 +1,45 @@
+// Resolve the effective global outbound proxy target.
+//
+// A selected proxy pool (http type only) wins over the manual URL fields.
+// Relay pools (vercel/cloudflare/deno) rewrite relay headers per request and
+// can never work as an env HTTP_PROXY — skipped here, filtered in UI,
+// rejected in the settings API.
+import { getProxyPoolById } from "@/models";
+import { applyOutboundProxyEnv } from "./outboundProxy.js";
+
+function normalizeString(value) {
+  if (value === undefined || value === null) return "";
+  return String(value).trim();
+}
+
+export async function resolveOutboundProxyTarget(settings = {}) {
+  const enabled = settings?.outboundProxyEnabled === true;
+  const poolId = normalizeString(settings?.outboundProxyPoolId);
+
+  if (poolId) {
+    try {
+      const pool = await getProxyPoolById(poolId);
+      const type = pool?.type || "http";
+      if (pool && pool.isActive === true && type === "http" && normalizeString(pool.proxyUrl)) {
+        return {
+          outboundProxyEnabled: enabled,
+          outboundProxyUrl: pool.proxyUrl,
+          outboundNoProxy: pool.noProxy || "",
+        };
+      }
+    } catch {
+      // Fail open to manual values — same convention as the RTK hooks.
+    }
+  }
+
+  return {
+    outboundProxyEnabled: enabled,
+    outboundProxyUrl: settings?.outboundProxyUrl || "",
+    outboundNoProxy: settings?.outboundNoProxy || "",
+  };
+}
+
+// Resolve + apply in one step (settings PATCH, DB import, pool edit).
+export async function applyResolvedOutboundProxy(settings = {}) {
+  applyOutboundProxyEnv(await resolveOutboundProxyTarget(settings));
+}

package/src/lib/oauth/constants/oauth.js

@@ -0,0 +1,213 @@
+/**
+ * OAuth Configuration Constants — static data lives in registry, re-exported here for consumers.
+ */
+import { platform, arch } from "os";
+import { ANTIGRAVITY_OAUTH_CLIENT } from "open-sse/providers/shared.js";
+import { PROVIDER_OAUTH } from "open-sse/providers/index.js";
+
+/**
+ * Get the platform enum value based on the current OS.
+ * Matches Antigravity binary's ClientMetadata.Platform enum.
+ */
+function getOAuthPlatformEnum() {
+  const os = platform();
+  const architecture = arch();
+  if (os === "darwin") return architecture === "arm64" ? 2 : 1;
+  if (os === "linux") return architecture === "arm64" ? 4 : 3;
+  if (os === "win32") return 5;
+  return 0;
+}
+
+// Claude OAuth Configuration (Authorization Code Flow with PKCE)
+export const CLAUDE_CONFIG = { ...PROVIDER_OAUTH["claude"] };
+
+// Codex (OpenAI) OAuth Configuration (Authorization Code Flow with PKCE)
+export const CODEX_CONFIG = { ...PROVIDER_OAUTH["codex"] };
+
+// Qoder OAuth Configuration (Device Token Flow with PKCE).
+// Device tokens are long-lived (~30 days for access, ~360 for refresh).
+// The upstream refresh endpoint at center.qoder.sh returns 403 for our
+// flow — we accept that and surface it to the user as "re-login" instead
+// of attempting to silently rotate.
+export const QODER_CONFIG = { ...PROVIDER_OAUTH["qoder"] };
+
+// iFlow OAuth Configuration (Authorization Code)
+export const IFLOW_CONFIG = { ...PROVIDER_OAUTH["iflow"] };
+
+// Antigravity OAuth Configuration (Standard OAuth2 with Google)
+// clientId/clientSecret from ANTIGRAVITY_OAUTH_CLIENT (shared.js) — not stored in registry
+// loadCodeAssistClientMetadata is dynamic (runtime platform detection)
+export const ANTIGRAVITY_CONFIG = {
+  ...ANTIGRAVITY_OAUTH_CLIENT,
+  ...PROVIDER_OAUTH["antigravity"],
+  loadCodeAssistClientMetadata: JSON.stringify({
+    ideType: 9,
+    platform: getOAuthPlatformEnum(),
+    pluginType: 2,
+  }),
+};
+
+/**
+ * Get client metadata using numeric enum values for API calls.
+ * @returns {{ ideType: number, platform: number, pluginType: number }}
+ */
+export function getOAuthClientMetadata() {
+  return { ideType: 9, platform: getOAuthPlatformEnum(), pluginType: 2 };
+}
+
+// OpenAI OAuth Configuration (Authorization Code Flow with PKCE)
+export const OPENAI_CONFIG = { ...PROVIDER_OAUTH["openai"] };
+
+// GitHub Copilot OAuth Configuration (Device Code Flow)
+export const GITHUB_CONFIG = { ...PROVIDER_OAUTH["github"] };
+
+// AWS region allowlist pattern — prevents SSRF via region injection into upstream URLs (GHSA-6mwv-4mrm-5p3m)
+export const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;
+
+// Reject any region that is not a valid AWS region before interpolating it into a URL
+export function assertValidAwsRegion(region) {
+  if (typeof region !== "string" || !AWS_REGION_PATTERN.test(region)) {
+    throw new Error("Invalid region");
+  }
+  return region;
+}
+
+// Cursor OAuth Configuration (Import Token from Cursor IDE)
+// tokenStoragePaths: user-reference only, not stored in registry
+export const CURSOR_CONFIG = {
+  ...PROVIDER_OAUTH["cursor"],
+  tokenStoragePaths: {
+    linux: "~/.config/Cursor/User/globalStorage/state.vscdb",
+    macos: "/Users/<user>/Library/Application Support/Cursor/User/globalStorage/state.vscdb",
+    windows: "%APPDATA%\\Cursor\\User\\globalStorage\\state.vscdb",
+  },
+};
+
+// KiloCode OAuth Configuration (Custom Device Auth Flow)
+export const KILOCODE_CONFIG = { ...PROVIDER_OAUTH["kilocode"] };
+
+// GitLab Duo OAuth Configuration (Authorization Code Flow with PKCE)
+export const GITLAB_CONFIG = { ...PROVIDER_OAUTH["gitlab"] };
+
+// CodeBuddy (Tencent) OAuth Configuration (Browser OAuth Polling Flow)
+export const CODEBUDDY_CONFIG = { ...PROVIDER_OAUTH["codebuddy-cn"] };
+
+// CodeBuddy International — same shape as CN, .ai domain (mirror of codebuddy-cn).
+export const CODEBUDDY_INTL_CONFIG = { ...PROVIDER_OAUTH["codebuddy-intl"] };
+
+// Kimchi OAuth Configuration (Browser token callback flow)
+export const KIMCHI_CONFIG = { ...PROVIDER_OAUTH["kimchi"] };
+
+// Grok CLI / Grok Build OAuth Configuration (Device Code Flow)
+// Endpoint: cli-chat-proxy.grok.com — same client_id as xai, different flow + scopes
+export const GROK_CLI_CONFIG = { ...PROVIDER_OAUTH["grok-cli"] };
+
+// Trae (ByteDance marscode) OAuth — authorization_code flow with local callback.
+//   1) POST GetLoginGuidance {loginTraceID} → {Result.LoginHost}
+//   2) Browser opens ${loginHost}/authorization?client_id=...&login_trace_id=...&auth_callback_url=${cb}
+//   3) Redirect → ${cb}?refreshToken=...&loginHost=...&isRedirect=true
+//   4) POST ExchangeToken {ClientID, RefreshToken, ClientSecret:"-"} → {Result.AccessToken, ExpiresAt}
+//   5) POST GetUserInfo (x-cloudide-token) → email/name
+// Xiaomi MiMo Desktop OAuth — custom ECDH encrypted-callback flow (NOT standard OAuth2).
+//   1) Client generates X25519 keypair
+//   2) Browser opens ${platformUrl}/authorize?pk=<pubkey>&redirect_uri=http://localhost:<port>/&kn=mimocode&key_name=...
+//   3) Redirect → http://localhost:<port>/?u=<base64 encrypted payload>
+//   4) Decrypt: ECDH(shared) → SHA256 → AES-256-GCM
+//      Layout: [12-byte nonce][32-byte ephemeral pubkey][ciphertext][16-byte GCM tag]
+//   5) Result JSON: { uid, sk, url }
+export const XIAOMI_MIMO_CONFIG = {
+  platformUrl: process.env.MIMO_PLATFORM_URL || "https://platform.xiaomimimo.com",
+  defaultBaseUrl: "https://api.xiaomimimo.com/v1",
+  kn: "mimocode",
+  callbackPath: "/",
+  timeoutMs: 300000, // 5 minutes
+};
+
+export const TRAE_CONFIG = {
+  clientId: "ono9krqynydwx5",
+  clientSecret: "-",
+  loginGuidanceUrls: [
+    "https://api.marscode.com/cloudide/api/v3/trae/GetLoginGuidance",
+    "https://api.trae.ai/cloudide/api/v3/trae/GetLoginGuidance",
+    "https://www.trae.ai/cloudide/api/v3/trae/GetLoginGuidance",
+  ],
+  apiOrigins: [
+    "https://api.marscode.com",
+    "https://api.trae.ai",
+    "https://www.trae.ai",
+    "https://www.marscode.com",
+  ],
+  exchangeTokenPath: "/cloudide/api/v3/trae/oauth/ExchangeToken",
+  getUserInfoPath: "/cloudide/api/v3/trae/GetUserInfo",
+  authorizationPath: "/authorization",
+  callbackPath: "/callback",
+  minAppVersion: "3.5.54",
+  defaultAppVersion: "3.5.54",
+  defaultAppType: "stable",
+  defaultPluginVersion: "local",
+  // service machine id is derived at runtime; device_id "0" is the stable default
+  defaultDeviceId: "0",
+  userAgent: "Trae/1.0.0 antigravity-cockpit-tools",
+  webUrl: "https://www.trae.ai",
+  authScheme: "Cloud-IDE-JWT",
+  tokenLifetimeDays: 14,
+  oauthTimeoutMs: 600_000,
+};
+
+// Windsurf / Devin CLI OAuth — authorization_code (implicit) flow with local callback.
+//   1) Browser opens windsurf.com/windsurf/signin?response_type=token&client_id=...&redirect_uri=${cb}
+//   2) Redirect → ${cb}?access_token=${firebaseJWT}&state=...
+//   3) POST RegisterUser {firebase_id_token} → {apiKey, apiServerUrl, name}
+//   4) POST GetOneTimeAuthToken → GetCurrentUser (best-effort email/plan)
+export const WINDSURF_CONFIG = {
+  clientId: "3GUryQ7ldAeKEuD2obYnppsnmj58eP5u",
+  authBaseUrl: "https://www.windsurf.com",
+  signInPath: "/windsurf/signin",
+  registerApiBaseUrl: "https://register.windsurf.com",
+  registerPath: "/exa.seat_management_pb.SeatManagementService/RegisterUser",
+  oneTimeAuthPath: "/exa.seat_management_pb.SeatManagementService/GetOneTimeAuthToken",
+  currentUserPath: "/exa.seat_management_pb.SeatManagementService/GetCurrentUser",
+  planStatusPath: "/exa.seat_management_pb.SeatManagementService/GetPlanStatus",
+  userStatusPath: "/exa.seat_management_pb.SeatManagementService/GetUserStatus",
+  defaultApiServerUrl: "https://server.codeium.com",
+  firebaseApiKey: "AIzaSyDsOl-1XpT5err0Tcn0TFFod1H8gVGIycY",
+  callbackPath: "/windsurf-auth-callback",
+  userAgent: "antigravity-cockpit-tools",
+  oauthTimeoutMs: 600_000,
+};
+
+// Zed hosted LLM aggregator — RSA keypair native-app auth (NOT OAuth).
+// Client generates ephemeral RSA-2048 keypair; user signs in at zed.dev/native_app_signin;
+// Zed redirects to local callback with access_token RSA-encrypted against our public key.
+// See open-sse/shared/zedAuth.js for the keypair/decrypt helpers.
+export const ZED_HOSTED_CONFIG = {
+  webBaseUrl: "https://zed.dev",
+  cloudBaseUrl: "https://cloud.zed.dev",
+  llmBaseUrl: "https://cloud.zed.dev",
+  defaultNativeAppPort: 58443,
+  oauthTimeoutMs: 600_000,
+};
+
+// OAuth timeout (5 minutes)
+export const OAUTH_TIMEOUT = 300000;
+
+// Provider list
+export const PROVIDERS = {
+  CLAUDE: "claude",
+  CODEX: "codex",
+  QODER: "qoder",
+  IFLOW: "iflow",
+  ANTIGRAVITY: "antigravity",
+  OPENAI: "openai",
+  GITHUB: "github",
+  CURSOR: "cursor",
+  KILOCODE: "kilocode",
+  GITLAB: "gitlab",
+  CODEBUDDY: "codebuddy-cn",
+  CODEBUDDY_INTL: "codebuddy-intl",
+  KIMCHI: "kimchi",
+  GROK_CLI: "grok-cli",
+  TRAE: "trae",
+  WINDSURF: "windsurf",
+  ZED: "zed",
+};

package/src/lib/oauth/constants/xai.js

@@ -0,0 +1,62 @@
+/**
+ * xAI (Grok) OAuth Configuration
+ *
+ * Source of truth: router-for-me/CLIProxyAPI internal/auth/xai/types.go
+ * Mirrors the upstream Go constants 1:1.
+ */
+import { PROVIDERS } from "open-sse/providers/index.js";
+
+// xAI client_id for OAuth (PKCE public client) — single source: registry xai.transport
+export const XAI_CLIENT_ID = PROVIDERS["xai"]?.clientId;
+
+// OAuth issuer + endpoints
+export const XAI_ISSUER = "https://auth.x.ai";
+export const XAI_AUTH_ENDPOINT_PATH = "/oauth2/authorize";
+export const XAI_TOKEN_ENDPOINT_PATH = "/oauth2/token";
+export const XAI_DISCOVERY_PATH = "/.well-known/openid-configuration";
+
+// Scopes (space-separated, matches Go upstream)
+export const XAI_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+
+// xAI inference API base URL
+export const XAI_API_BASE = "https://api.x.ai/v1";
+
+// Loopback callback (PKCE)
+export const XAI_LOOPBACK_PORT = 56121;
+export const XAI_CALLBACK_PATH = "/callback";
+export const XAI_REDIRECT_URI = `http://127.0.0.1:${XAI_LOOPBACK_PORT}${XAI_CALLBACK_PATH}`;
+
+// PKCE verifier length (bytes pre-base64url)
+export const XAI_PKCE_VERIFIER_BYTES = 96;
+
+// Refresh tokens this many seconds before expiry
+export const XAI_REFRESH_LEAD_SECONDS = 5 * 60;
+
+// User-Agent — mirror Go grok-cli UA. Version is best-effort; xAI does not pin a specific version.
+export const XAI_USER_AGENT = "grok-cli/9router";
+
+/**
+ * Aggregated config object — mirrors the shape of CLAUDE_CONFIG/CODEX_CONFIG in oauth.js.
+ * Includes both the discovery-derived defaults and the static fallbacks used when
+ * discovery is unavailable. Discovery results override authorizeUrl/tokenUrl at runtime.
+ */
+export const XAI_CONFIG = {
+  clientId: XAI_CLIENT_ID,
+  issuer: XAI_ISSUER,
+  authEndpointPath: XAI_AUTH_ENDPOINT_PATH,
+  tokenEndpointPath: XAI_TOKEN_ENDPOINT_PATH,
+  discoveryPath: XAI_DISCOVERY_PATH,
+  // Static fallbacks (these are also the values returned by xAI discovery today)
+  authorizeUrl: `${XAI_ISSUER}${XAI_AUTH_ENDPOINT_PATH}`,
+  tokenUrl: `${XAI_ISSUER}${XAI_TOKEN_ENDPOINT_PATH}`,
+  discoveryUrl: `${XAI_ISSUER}${XAI_DISCOVERY_PATH}`,
+  scope: XAI_SCOPE,
+  apiBaseUrl: XAI_API_BASE,
+  redirectUri: XAI_REDIRECT_URI,
+  loopbackPort: XAI_LOOPBACK_PORT,
+  callbackPath: XAI_CALLBACK_PATH,
+  pkceVerifierBytes: XAI_PKCE_VERIFIER_BYTES,
+  refreshLeadSeconds: XAI_REFRESH_LEAD_SECONDS,
+  userAgent: XAI_USER_AGENT,
+  codeChallengeMethod: "S256",
+};

package/src/lib/oauth/providerHelpers.js

@@ -0,0 +1,74 @@
+const BASE64_BLOCK_SIZE = 4;
+
+function validateXaiOAuthEndpoint(rawUrl, field) {
+  const value = String(rawUrl || "").trim();
+  if (!value) throw new Error(`xai discovery ${field} is empty`);
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch (err) {
+    throw new Error(`xai discovery ${field} is invalid: ${err.message}`);
+  }
+  if (parsed.protocol !== "https:")
+    throw new Error(`xai discovery ${field} must use https: ${value}`);
+  const host = parsed.hostname.toLowerCase().trim();
+  if (host !== "x.ai" && !host.endsWith(".x.ai")) {
+    throw new Error(`xai discovery ${field} host ${host} is not on x.ai`);
+  }
+  return value;
+}
+
+function decodeXaiIdTokenEmail(idToken) {
+  if (!idToken || typeof idToken !== "string") return undefined;
+  const parts = idToken.split(".");
+  if (parts.length !== 3) return undefined;
+  try {
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padding = (BASE64_BLOCK_SIZE - (base64.length % BASE64_BLOCK_SIZE)) % BASE64_BLOCK_SIZE;
+    const json = Buffer.from(base64 + "=".repeat(padding), "base64").toString("utf8");
+    const payload = JSON.parse(json);
+    return payload.email || payload.preferred_username || payload.sub || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function decodeJwtPayload(jwt) {
+  try {
+    if (!jwt || typeof jwt !== "string") return null;
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const missingPadding =
+      (BASE64_BLOCK_SIZE - (base64.length % BASE64_BLOCK_SIZE)) % BASE64_BLOCK_SIZE;
+    const padded = base64 + "=".repeat(missingPadding);
+    return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function extractEmailFromAccessToken(accessToken) {
+  const payload = decodeJwtPayload(accessToken);
+  if (!payload) return undefined;
+  return payload.email || payload.preferred_username || payload.sub || undefined;
+}
+
+export function extractCodexAccountInfo(idToken) {
+  const payload = decodeJwtPayload(idToken);
+  if (!payload) return {};
+  const chatgpt = payload["https://api.openai.com/auth"] || {};
+  return {
+    email: payload.email,
+    chatgptAccountId: chatgpt.chatgpt_account_id || payload.account_id,
+    chatgptPlanType: chatgpt.chatgpt_plan_type || payload.plan_type,
+  };
+}
+
+export {
+  BASE64_BLOCK_SIZE,
+  validateXaiOAuthEndpoint,
+  decodeXaiIdTokenEmail,
+  decodeJwtPayload,
+  extractEmailFromAccessToken,
+};

package/src/lib/oauth/providers/_shared.js

@@ -0,0 +1,17 @@
+// Shared helpers used across provider entry files (currently trae + windsurf).
+
+export function extractJsonPath(root, paths) {
+  for (const path of paths) {
+    let cur = root;
+    for (const key of path) {
+      if (cur == null || typeof cur !== "object") {
+        cur = undefined;
+        break;
+      }
+      cur = cur[key];
+    }
+    if (typeof cur === "string" && cur.trim()) return cur.trim();
+    if (typeof cur === "number") return String(cur);
+  }
+  return null;
+}