@anthonyhaussman/opencode-agy-auth 1.2.3-alpha.4 → 1.2.3-alpha.5

package/dist/index.js

@@ -104,8 +104,6 @@ function updateStaticModelsWithPricing(staticModels) {
 
 // src/constants.ts
 var AGY_PROVIDER_ID = "google-agy";
-var AGY_AUTH_URL = "https://accounts.google.com/o/oauth2/auth";
-var AGY_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var AGY_CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
 var AGY_CLIENT_SECRET = "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";
 var AGY_SCOPES = [
@@ -1583,7 +1581,11 @@ function createOAuthAuthorizeMethod(options) {
     const isHeadless = !!(process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY || process.env.OPENCODE_HEADLESS);
     const authorization = await authorizeAgy();
     if (!isHeadless) {
-      openBrowserUrl(authorization.url);
+      if (options?.openBrowser) {
+        options.openBrowser(authorization.url);
+      } else {
+        openBrowserUrl(authorization.url);
+      }
     }
     return {
       url: authorization.url,
@@ -1637,16 +1639,23 @@ function parseOAuthCallbackInput(input) {
   }
   return { code: trimmed };
 }
+function defaultOpenBrowserLauncher(command, args) {
+  const child = spawn(command, args, {
+    stdio: "ignore",
+    detached: true
+  });
+  child.unref?.();
+}
+var openBrowserLauncher = defaultOpenBrowserLauncher;
 function openBrowserUrl(url2) {
+  if ((process.env.NODE_ENV === "test" || process.env.VITEST) && openBrowserLauncher === defaultOpenBrowserLauncher) {
+    return;
+  }
   try {
     const platform2 = process.platform;
     const command = platform2 === "darwin" ? "open" : platform2 === "win32" ? "rundll32" : "xdg-open";
     const args = platform2 === "win32" ? ["url.dll,FileProtocolHandler", url2] : [url2];
-    const child = spawn(command, args, {
-      stdio: "ignore",
-      detached: true
-    });
-    child.unref?.();
+    openBrowserLauncher(command, args);
   } catch {
   }
 }
@@ -20669,6 +20678,7 @@ function defineOpenCodeV2Plugin(def) {
 import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import "http";
 var AGY_V2_QUOTA_COMMAND = "agy-quota";
 var AGY_V2_QUOTA_SUMMARY_COMMAND = "agy-quota-summary";
 var AGY_V2_QUOTA_COMMAND_TEMPLATE = `Retrieve Agy Code Assist quota usage for the current authenticated account.
@@ -20768,7 +20778,11 @@ function resolveModelTier2(baseModelId, init) {
   }
   return mapping["medium"] ?? mapping["high"];
 }
+var storedAuthOverrideForTesting = void 0;
 function loadStoredAuthFromJson() {
+  if (storedAuthOverrideForTesting !== void 0) {
+    return storedAuthOverrideForTesting;
+  }
   const authPath = join6(homedir4(), ".local", "share", "opencode", "auth.json");
   try {
     if (existsSync6(authPath)) {
@@ -21055,16 +21069,10 @@ async function setupOpenCodeV2(ctx) {
         label: "Antigravity CLI (OAuth)"
       },
       authorize: async () => {
-        const authUrl = new URL(AGY_AUTH_URL);
-        authUrl.searchParams.set("client_id", AGY_CLIENT_ID);
-        authUrl.searchParams.set("response_type", "code");
-        authUrl.searchParams.set("redirect_uri", "http://localhost");
-        authUrl.searchParams.set("scope", AGY_SCOPES.join(" "));
-        authUrl.searchParams.set("access_type", "offline");
-        authUrl.searchParams.set("prompt", "consent");
+        const authorization = await authorizeAgy();
         return {
           mode: "code",
-          url: authUrl.toString(),
+          url: authorization.url,
           instructions: "Please complete Google account authorization in your browser. After authorization, copy the full redirect URL or code and paste it below:",
           callback: async (code) => {
             const trimmed = code.trim();
@@ -21073,35 +21081,21 @@ async function setupOpenCodeV2(ctx) {
             if (!authCode) {
               return { type: "failed", error: "Missing authorization code in callback input" };
             }
-            const tokenResponse = await agyFetch(AGY_TOKEN_URL, {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/x-www-form-urlencoded"
-              },
-              body: new URLSearchParams({
-                client_id: AGY_CLIENT_ID,
-                client_secret: AGY_CLIENT_SECRET,
-                code: authCode,
-                grant_type: "authorization_code",
-                redirect_uri: "http://localhost"
-              })
-            });
-            if (!tokenResponse.ok) {
-              const errorText = await tokenResponse.text();
-              return { type: "failed", error: errorText };
+            if (parsed.state && parsed.state !== authorization.state) {
+              return { type: "failed", error: "State mismatch in callback input (possible CSRF attempt)" };
             }
-            const tokenPayload = await tokenResponse.json();
-            if (!tokenPayload.refresh_token) {
-              return { type: "failed", error: "Missing refresh token in response" };
+            const exchangeResult = await exchangeAgyWithVerifier(authCode, authorization.verifier);
+            if (exchangeResult.type !== "success") {
+              return exchangeResult;
             }
             const initialRefresh = formatRefreshParts({
-              refreshToken: tokenPayload.refresh_token
+              refreshToken: exchangeResult.refresh
             });
             let authRecord = {
               type: "oauth",
               refresh: initialRefresh,
-              access: tokenPayload.access_token,
-              expires: Date.now() + tokenPayload.expires_in * 1e3
+              access: exchangeResult.access,
+              expires: exchangeResult.expires
             };
             try {
               const projectContext = await ensureProjectContext(
@@ -21160,6 +21154,19 @@ async function setupOpenCodeV2(ctx) {
             }
           }
         }
+        if (event.request?.headers) {
+          if (typeof event.request.headers.delete === "function") {
+            event.request.headers.delete("x-goog-api-key");
+            event.request.headers.delete("api-key");
+          } else {
+            for (const key of Object.keys(event.request.headers)) {
+              const lower = key.toLowerCase();
+              if (lower === "x-goog-api-key" || lower === "api-key") {
+                delete event.request.headers[key];
+              }
+            }
+          }
+        }
         try {
           const parsedUrl = new URL(rawUrl);
           let urlChanged = false;
@@ -21182,18 +21189,29 @@ async function setupOpenCodeV2(ctx) {
           }
         } catch {
         }
-        const hasAuth = typeof event.headers.get === "function" ? !!event.headers.get("Authorization") : Object.keys(event.headers).some((k) => k.toLowerCase() === "authorization");
+        const hasAuth = typeof event.headers?.get === "function" ? !!event.headers.get("Authorization") : event.headers && Object.keys(event.headers).some((k) => k.toLowerCase() === "authorization");
         if (!hasAuth) {
           let token;
           if (typeof event.auth?.access === "string" && event.auth.access) {
             token = event.auth.access;
           } else if (typeof event.auth?.token === "string" && event.auth.token) {
             token = event.auth.token;
-          }
-          if (typeof event.headers.set === "function") {
-            event.headers.set("Authorization", `Bearer ${token || "dummy"}`);
           } else {
-            event.headers["Authorization"] = `Bearer ${token || "dummy"}`;
+            const storedAuth = loadStoredAuthFromJson();
+            if (storedAuth && isOAuthAuth(storedAuth)) {
+              const resolved = resolveCachedAuth(storedAuth);
+              token = resolved.access;
+            }
+          }
+          if (token) {
+            if (typeof event.headers?.set === "function") {
+              event.headers.set("Authorization", `Bearer ${token}`);
+            } else if (event.headers) {
+              event.headers["Authorization"] = `Bearer ${token}`;
+            }
+            if (event.request?.headers && typeof event.request.headers.set === "function") {
+              event.request.headers.set("Authorization", `Bearer ${token}`);
+            }
           }
         }
       }