@andoai/opencode 0.1.0 → 0.2.1

package/README.md

@@ -5,15 +5,17 @@ Official Ando Wallet integration for [OpenCode](https://opencode.ai/).
 ## Install
 
 ```sh
-opencode plugin --global @andoai/opencode
+opencode plugin --global --force @andoai/opencode@0.2.1
 ```
 
 Then run `/connect` in OpenCode, choose **Ando**, and select **Connect Ando Wallet**. Your browser opens
 `wallet.andoai.xyz`, where you choose an existing open, funded OpenCode session or open a new one.
 
-The selected MPP session credential is returned directly to the OpenCode process over a one-time IPv4
-loopback callback. It is sent in a form POST body, never in the callback URL. OpenCode stores the credential
-in its local authentication store; this plugin does not add it to `opencode.json`.
+The browser returns only a short-lived, single-use authorization code over the IPv4 loopback callback.
+The plugin redeems that code over HTTPS using an S256 PKCE verifier that never leaves the OpenCode process.
+The MPP session credential is therefore never placed in the callback URL or submitted from HTTPS to an HTTP
+form. OpenCode stores the redeemed credential in its local authentication store; this plugin does not add it
+to `opencode.json`.
 
 ## Provider
 

package/dist/callback.d.ts

@@ -1,9 +1,11 @@
-export type CredentialCallback = {
+export type AuthorizationCallback = {
     callbackUrl: string;
     close: () => Promise<void>;
+    codeChallenge: string;
+    codeVerifier: string;
     state: string;
-    waitForCredential: () => Promise<string>;
+    waitForCode: () => Promise<string>;
 };
-export declare function startCredentialCallback(options?: Readonly<{
+export declare function startAuthorizationCallback(options?: Readonly<{
     timeoutMs?: number;
-}>): Promise<CredentialCallback>;
+}>): Promise<AuthorizationCallback>;

package/dist/callback.js

@@ -1,26 +1,28 @@
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-export async function startCredentialCallback(options = {}) {
+export async function startAuthorizationCallback(options = {}) {
     const timeoutMs = options.timeoutMs ?? 5 * 60 * 1_000;
     if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
         throw new Error("OpenCode callback timeout must be a positive integer");
     }
     const state = randomBytes(32).toString("base64url");
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
     let settled = false;
-    let resolveCredential = () => undefined;
-    let rejectCredential = () => undefined;
-    const credential = new Promise((resolve, reject) => {
-        resolveCredential = resolve;
-        rejectCredential = reject;
+    let resolveCode = () => undefined;
+    let rejectCode = () => undefined;
+    const authorizationCode = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
     });
-    void credential.catch(() => undefined);
+    void authorizationCode.catch(() => undefined);
     const server = createServer((request, response) => {
-        void handleRequest(request, response, state, (token) => {
+        handleRequest(request, response, state, (code) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timeout);
-            resolveCredential(token);
+            resolveCode(code);
             setImmediate(() => server.close());
         });
     });
@@ -44,80 +46,60 @@ export async function startCredentialCallback(options = {}) {
         if (settled)
             return;
         settled = true;
-        rejectCredential(new Error("Ando Wallet approval timed out"));
+        rejectCode(new Error("Ando Wallet approval timed out"));
         server.close();
     }, timeoutMs);
     timeout.unref();
     return {
         callbackUrl,
-        state,
-        waitForCredential: () => credential,
         close: async () => {
             clearTimeout(timeout);
             if (!settled) {
                 settled = true;
-                rejectCredential(new Error("Ando Wallet approval was cancelled"));
+                rejectCode(new Error("Ando Wallet approval was cancelled"));
             }
             await closeServer(server);
-        }
+        },
+        codeChallenge,
+        codeVerifier,
+        state,
+        waitForCode: () => authorizationCode
     };
 }
 const CALLBACK_PATH = "/ando/opencode/callback";
-const MAX_BODY_BYTES = 8_192;
-const MAX_TOKEN_LENGTH = 6_144;
-async function handleRequest(request, response, expectedState, accept) {
-    if (request.method !== "POST") {
-        send(response, 405, "This callback accepts POST requests only.", { allow: "POST" });
+const AUTHORIZATION_CODE = /^[A-Za-z0-9_-]{43}$/u;
+function handleRequest(request, response, expectedState, accept) {
+    if (request.method !== "GET") {
+        send(response, 405, "This callback accepts GET requests only.", { allow: "GET" });
         request.resume();
         return;
     }
-    if (request.url !== CALLBACK_PATH) {
+    const url = new URL(request.url ?? "", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
         send(response, 404, "Callback not found.");
-        request.resume();
-        return;
-    }
-    const contentType = request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
-    if (contentType !== "application/x-www-form-urlencoded") {
-        send(response, 415, "Unsupported callback content type.");
-        request.resume();
         return;
     }
-    const body = await readBody(request);
-    if (body === undefined) {
-        send(response, 413, "Callback request is too large.");
+    const fields = [...url.searchParams.keys()];
+    if (fields.length !== 2 ||
+        !fields.includes("code") ||
+        !fields.includes("state") ||
+        url.searchParams.getAll("code").length !== 1 ||
+        url.searchParams.getAll("state").length !== 1) {
+        send(response, 400, "The wallet authorization response is invalid.");
         return;
     }
-    const form = new URLSearchParams(body);
-    const state = form.get("state") ?? "";
+    const state = url.searchParams.get("state") ?? "";
     if (!safeEqual(state, expectedState)) {
         send(response, 403, "The wallet approval state did not match.");
         return;
     }
-    const credential = form.get("credential") ?? "";
-    if (!credential.startsWith("mpp_session_v1_") ||
-        credential.length <= "mpp_session_v1_".length ||
-        credential.length > MAX_TOKEN_LENGTH ||
-        !/^mpp_session_v1_[A-Za-z0-9_-]+$/u.test(credential)) {
-        send(response, 400, "The selected Ando session credential is invalid.");
+    const code = url.searchParams.get("code") ?? "";
+    if (!AUTHORIZATION_CODE.test(code)) {
+        send(response, 400, "The wallet authorization code is invalid.");
         return;
     }
     send(response, 200, "Ando Wallet connected. You can close this window and return to OpenCode.", {}, true);
-    accept(credential);
-}
-async function readBody(request) {
-    const chunks = [];
-    let length = 0;
-    let tooLarge = false;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        length += buffer.length;
-        if (length > MAX_BODY_BYTES) {
-            tooLarge = true;
-            continue;
-        }
-        chunks.push(buffer);
-    }
-    return tooLarge ? undefined : Buffer.concat(chunks).toString("utf8");
+    accept(code);
 }
 function safeEqual(actual, expected) {
     const actualBytes = Buffer.from(actual);

package/dist/index.d.ts

@@ -1,9 +1,14 @@
 import type { Plugin } from "@opencode-ai/plugin";
-import { type CredentialCallback } from "./callback.js";
+import { type AuthorizationCallback } from "./callback.js";
 type StartCallback = (options?: Readonly<{
     timeoutMs?: number;
-}>) => Promise<CredentialCallback>;
+}>) => Promise<AuthorizationCallback>;
+type ExchangeCode = (input: Readonly<{
+    code: string;
+    codeVerifier: string;
+}>) => Promise<string>;
 export declare function createAndoOpenCodePlugin(runtime?: Readonly<{
+    exchangeCode?: ExchangeCode;
     startCallback?: StartCallback;
 }>): Plugin;
 declare const AndoOpenCodePlugin: Plugin;

package/dist/index.js

@@ -1,4 +1,5 @@
-import { startCredentialCallback } from "./callback.js";
+import { startAuthorizationCallback } from "./callback.js";
+import { exchangeAuthorizationCode } from "./token-exchange.js";
 const WALLET_ORIGIN = "https://wallet.andoai.xyz";
 const INFERENCE_BASE_URL = "https://inference.andoai.xyz/v1/mpp";
 const MODELS = {
@@ -7,7 +8,8 @@ const MODELS = {
     "ando/nemotron-3-ultra-550b-a55b": { name: "Nemotron 3 Ultra 550B" }
 };
 export function createAndoOpenCodePlugin(runtime = {}) {
-    const startCallback = runtime.startCallback ?? startCredentialCallback;
+    const startCallback = runtime.startCallback ?? startAuthorizationCallback;
+    const exchangeCode = runtime.exchangeCode ?? exchangeAuthorizationCode;
     return async () => {
         const pending = new Set();
         return {
@@ -24,6 +26,7 @@ export function createAndoOpenCodePlugin(runtime = {}) {
                             const authorizationUrl = new URL("/integrations/opencode/authorize", WALLET_ORIGIN);
                             authorizationUrl.searchParams.set("redirect_uri", callback.callbackUrl);
                             authorizationUrl.searchParams.set("state", callback.state);
+                            authorizationUrl.searchParams.set("code_challenge", callback.codeChallenge);
                             return {
                                 method: "auto",
                                 url: authorizationUrl.toString(),
@@ -33,7 +36,10 @@ export function createAndoOpenCodePlugin(runtime = {}) {
                                         return {
                                             type: "success",
                                             provider: "ando",
-                                            key: await callback.waitForCredential()
+                                            key: await exchangeCode({
+                                                code: await callback.waitForCode(),
+                                                codeVerifier: callback.codeVerifier
+                                            })
                                         };
                                     }
                                     catch {

package/dist/token-exchange.d.ts

@@ -0,0 +1,10 @@
+type FetchLike = typeof fetch;
+export declare function exchangeAuthorizationCode(input: Readonly<{
+    code: string;
+    codeVerifier: string;
+}>, options?: Readonly<{
+    fetchImpl?: FetchLike;
+    timeoutMs?: number;
+}>): Promise<string>;
+export declare const OPEN_CODE_TOKEN_ENDPOINT = "https://ando-wallet-api-devnet.onrender.com/v1/integrations/opencode/token";
+export {};

package/dist/token-exchange.js

@@ -0,0 +1,45 @@
+const WALLET_API_ORIGIN = "https://ando-wallet-api-devnet.onrender.com";
+const TOKEN_ENDPOINT = `${WALLET_API_ORIGIN}/v1/integrations/opencode/token`;
+const REQUEST_TIMEOUT_MS = 15_000;
+export async function exchangeAuthorizationCode(input, options = {}) {
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(input.code)) {
+        throw new Error("Ando Wallet returned an invalid authorization code");
+    }
+    if (!/^[A-Za-z0-9._~-]{43,128}$/u.test(input.codeVerifier)) {
+        throw new Error("OpenCode PKCE verifier is invalid");
+    }
+    const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("OpenCode token exchange timeout must be a positive integer");
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    timeout.unref();
+    try {
+        const response = await (options.fetchImpl ?? fetch)(TOKEN_ENDPOINT, {
+            body: JSON.stringify(input),
+            cache: "no-store",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json"
+            },
+            method: "POST",
+            redirect: "error",
+            signal: controller.signal
+        });
+        if (!response.ok)
+            throw new Error("Ando Wallet authorization could not be completed");
+        const body = await response.json();
+        const credential = body.credential;
+        if (typeof credential !== "string" ||
+            !/^mpp_session_v1_[A-Za-z0-9_-]+$/u.test(credential) ||
+            credential.length > 6_144) {
+            throw new Error("Ando Wallet returned an invalid session credential");
+        }
+        return credential;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export const OPEN_CODE_TOKEN_ENDPOINT = TOKEN_ENDPOINT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andoai/opencode",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Official Ando Wallet integration for OpenCode",
   "license": "Apache-2.0",
   "type": "module",