@aryee337/aery-ai 0.2.27 → 0.2.29

package/src/utils/oauth/github-copilot.ts

@@ -0,0 +1,362 @@
+/**
+ * GitHub Copilot OAuth flow (opencode OAuth app)
+ */
+import { scheduler } from "node:timers/promises";
+import { getBundledModels } from "../../models";
+import type { OAuthCredentials } from "./types";
+
+const CLIENT_ID = "Ov23li8tweQw6odWQebz";
+
+export const COPILOT_USER_AGENT = "opencode/1.3.15" as const;
+
+export const OPENCODE_HEADERS = {
+	"User-Agent": COPILOT_USER_AGENT,
+} as const;
+
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+type DeviceCodeResponse = {
+	device_code: string;
+	user_code: string;
+	verification_uri: string;
+	interval: number;
+	expires_in: number;
+};
+
+type DeviceTokenSuccessResponse = {
+	access_token: string;
+	token_type?: string;
+	scope?: string;
+};
+
+type DeviceTokenErrorResponse = {
+	error: string;
+	error_description?: string;
+	interval?: number;
+};
+
+type GitHubCopilotApiKeyPayload = {
+	token?: unknown;
+	enterpriseUrl?: unknown;
+};
+
+export type ParsedGitHubCopilotApiKey = {
+	accessToken: string;
+	enterpriseUrl?: string;
+};
+
+const PUBLIC_GITHUB_HOSTS = new Set(["api.github.com", "github.com", "www.github.com"]);
+
+function isPublicGitHubHost(host: string): boolean {
+	return PUBLIC_GITHUB_HOSTS.has(host.trim().toLowerCase());
+}
+
+export function normalizeGitHubCopilotEnterpriseDomain(input: string | undefined): string | undefined {
+	const trimmed = input?.trim();
+	if (!trimmed) return undefined;
+	const normalized = normalizeDomain(trimmed) ?? trimmed.toLowerCase();
+	if (!normalized || isPublicGitHubHost(normalized)) return undefined;
+	return normalized;
+}
+
+export function parseGitHubCopilotApiKey(apiKeyRaw: string): ParsedGitHubCopilotApiKey {
+	try {
+		const parsed = JSON.parse(apiKeyRaw) as GitHubCopilotApiKeyPayload;
+		if (typeof parsed.token === "string") {
+			return {
+				accessToken: parsed.token,
+				enterpriseUrl:
+					typeof parsed.enterpriseUrl === "string"
+						? normalizeGitHubCopilotEnterpriseDomain(parsed.enterpriseUrl)
+						: undefined,
+			};
+		}
+	} catch {}
+
+	return { accessToken: apiKeyRaw };
+}
+
+export function normalizeDomain(input: string): string | null {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		const url = trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+		return url.hostname;
+	} catch {
+		return null;
+	}
+}
+
+function getUrls(domain: string): {
+	deviceCodeUrl: string;
+	accessTokenUrl: string;
+} {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`,
+	};
+}
+
+export function getGitHubCopilotBaseUrl(enterpriseDomain?: string): string {
+	const normalizedEnterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(enterpriseDomain);
+	if (!normalizedEnterpriseDomain) return "https://api.githubcopilot.com";
+	const host = normalizedEnterpriseDomain.startsWith("copilot-api.")
+		? normalizedEnterpriseDomain
+		: `copilot-api.${normalizedEnterpriseDomain}`;
+	return `https://${host}`;
+}
+
+async function fetchJson(url: string, init: RequestInit): Promise<unknown> {
+	const response = await fetch(url, init);
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`${response.status} ${response.statusText}: ${text}`);
+	}
+	return response.json();
+}
+
+async function startDeviceFlow(domain: string): Promise<DeviceCodeResponse> {
+	const urls = getUrls(domain);
+	const data = await fetchJson(urls.deviceCodeUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+			...OPENCODE_HEADERS,
+		},
+		body: JSON.stringify({
+			client_id: CLIENT_ID,
+			scope: "read:user",
+		}),
+	});
+
+	if (!data || typeof data !== "object") {
+		throw new Error("Invalid device code response");
+	}
+
+	const deviceCode = (data as Record<string, unknown>).device_code;
+	const userCode = (data as Record<string, unknown>).user_code;
+	const verificationUri = (data as Record<string, unknown>).verification_uri;
+	const interval = (data as Record<string, unknown>).interval;
+	const expiresIn = (data as Record<string, unknown>).expires_in;
+
+	if (
+		typeof deviceCode !== "string" ||
+		typeof userCode !== "string" ||
+		typeof verificationUri !== "string" ||
+		typeof interval !== "number" ||
+		typeof expiresIn !== "number"
+	) {
+		throw new Error("Invalid device code response fields");
+	}
+
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn,
+	};
+}
+
+async function pollForGitHubAccessToken(
+	domain: string,
+	deviceCode: string,
+	intervalSeconds: number,
+	expiresIn: number,
+	signal?: AbortSignal,
+	pollIntervalFloorMs = 1000,
+	pollIntervalScaleMs = 1000,
+) {
+	const urls = getUrls(domain);
+	const deadline = Date.now() + expiresIn * 1000;
+	let intervalMs = Math.max(pollIntervalFloorMs, Math.floor(intervalSeconds * pollIntervalScaleMs));
+	let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;
+	let slowDownResponses = 0;
+
+	while (Date.now() < deadline) {
+		if (signal?.aborted) {
+			throw new Error("Login cancelled");
+		}
+
+		const remainingMs = deadline - Date.now();
+		const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);
+		try {
+			await scheduler.wait(waitMs, { signal });
+		} catch {
+			throw new Error("Login cancelled");
+		}
+
+		const raw = await fetchJson(urls.accessTokenUrl, {
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				...OPENCODE_HEADERS,
+			},
+			body: JSON.stringify({
+				client_id: CLIENT_ID,
+				device_code: deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			}),
+		});
+
+		if (raw && typeof raw === "object" && typeof (raw as DeviceTokenSuccessResponse).access_token === "string") {
+			return (raw as DeviceTokenSuccessResponse).access_token;
+		}
+
+		if (raw && typeof raw === "object" && typeof (raw as DeviceTokenErrorResponse).error === "string") {
+			const { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;
+			if (error === "authorization_pending") {
+				continue;
+			}
+
+			if (error === "slow_down") {
+				slowDownResponses += 1;
+				intervalMs =
+					typeof interval === "number" && interval > 0
+						? Math.max(pollIntervalFloorMs, interval * pollIntervalScaleMs)
+						: Math.max(pollIntervalFloorMs, intervalMs + 5 * pollIntervalScaleMs);
+				intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;
+				continue;
+			}
+
+			const descriptionSuffix = description ? `: ${description}` : "";
+			throw new Error(`Device flow failed: ${error}${descriptionSuffix}`);
+		}
+	}
+
+	if (slowDownResponses > 0) {
+		throw new Error(
+			"Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.",
+		);
+	}
+
+	throw new Error("Device flow timed out");
+}
+
+/** Far-future expiry (10 years). GitHub OAuth tokens are long-lived; no JWT exchange needed. */
+const FAR_FUTURE_MS = Date.now() + 10 * 365.25 * 24 * 60 * 60 * 1000;
+
+/**
+ * Refresh GitHub Copilot token.
+ * With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+ */
+export function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string): OAuthCredentials {
+	return {
+		refresh: refreshToken,
+		access: refreshToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain,
+	};
+}
+
+/**
+ * Enable a model for the user's GitHub Copilot account.
+ * This is required for some models (like Claude, Grok) before they can be used.
+ */
+async function enableGitHubCopilotModel(token: string, modelId: string, enterpriseDomain?: string): Promise<boolean> {
+	const baseUrl = getGitHubCopilotBaseUrl(enterpriseDomain);
+	const url = `${baseUrl}/models/${modelId}/policy`;
+
+	try {
+		const response = await fetch(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`,
+				...OPENCODE_HEADERS,
+				"openai-intent": "chat-policy",
+				"x-interaction-type": "chat-policy",
+			},
+			body: JSON.stringify({ state: "enabled" }),
+		});
+		return response.ok;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Enable all known GitHub Copilot models that may require policy acceptance.
+ * Called after successful login to ensure all models are available.
+ */
+async function enableAllGitHubCopilotModels(
+	token: string,
+	enterpriseDomain?: string,
+	onProgress?: (model: string, success: boolean) => void,
+): Promise<void> {
+	const models = getBundledModels("github-copilot");
+	const BATCH_SIZE = 5;
+	for (let i = 0; i < models.length; i += BATCH_SIZE) {
+		const batch = models.slice(i, i + BATCH_SIZE);
+		await Promise.all(
+			batch.map(async model => {
+				const success = await enableGitHubCopilotModel(token, model.id, enterpriseDomain);
+				onProgress?.(model.id, success);
+			}),
+		);
+	}
+}
+
+/**
+ * Login with GitHub Copilot OAuth (device code flow)
+ *
+ * @param options.onAuth - Callback with URL and optional instructions (user code)
+ * @param options.onPrompt - Callback to prompt user for input
+ * @param options.onProgress - Optional progress callback
+ * @param options.signal - Optional AbortSignal for cancellation
+ */
+export async function loginGitHubCopilot(options: {
+	onAuth: (url: string, instructions?: string) => void;
+	onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;
+	onProgress?: (message: string) => void;
+	signal?: AbortSignal;
+	pollIntervalFloorMs?: number;
+	pollIntervalScaleMs?: number;
+}): Promise<OAuthCredentials> {
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true,
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = input.trim();
+	const normalizedDomain = normalizeDomain(input);
+	if (trimmed && !normalizedDomain) {
+		throw new Error("Invalid GitHub Enterprise URL/domain");
+	}
+	const enterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(normalizedDomain ?? undefined);
+	const domain =
+		normalizedDomain && isPublicGitHubHost(normalizedDomain) ? "github.com" : (normalizedDomain ?? "github.com");
+
+	const device = await startDeviceFlow(domain);
+	options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);
+
+	const githubAccessToken = await pollForGitHubAccessToken(
+		domain,
+		device.device_code,
+		device.interval,
+		device.expires_in,
+		options.signal,
+		options.pollIntervalFloorMs,
+		options.pollIntervalScaleMs,
+	);
+
+	// With opencode OAuth, the GitHub token is used directly for all API requests
+	const credentials: OAuthCredentials = {
+		refresh: githubAccessToken,
+		access: githubAccessToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain ?? undefined,
+	};
+
+	// Enable all models after successful login
+	options.onProgress?.("Enabling models...");
+	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? undefined);
+	return credentials;
+}

package/src/utils/oauth/gitlab-duo.ts

@@ -0,0 +1,123 @@
+import { clearGitLabDuoDirectAccessCache } from "../../providers/gitlab-duo";
+import { OAuthCallbackFlow } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+
+const GITLAB_COM_URL = "https://gitlab.com";
+const BUNDLED_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b";
+const OAUTH_SCOPES = ["api"];
+const CALLBACK_PORT = 8080;
+const CALLBACK_PATH = "/callback";
+
+interface PKCEPair {
+	verifier: string;
+	challenge: string;
+}
+
+function mapTokenResponse(payload: {
+	access_token?: string;
+	refresh_token?: string;
+	expires_in?: number;
+	created_at?: number;
+}): OAuthCredentials {
+	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") {
+		throw new Error("GitLab OAuth token response missing required fields");
+	}
+
+	const createdAtMs =
+		typeof payload.created_at === "number" && Number.isFinite(payload.created_at)
+			? payload.created_at * 1000
+			: Date.now();
+
+	return {
+		access: payload.access_token,
+		refresh: payload.refresh_token,
+		expires: createdAtMs + payload.expires_in * 1000 - 5 * 60 * 1000,
+	};
+}
+
+class GitLabDuoOAuthFlow extends OAuthCallbackFlow {
+	#pkce: PKCEPair;
+
+	constructor(ctrl: OAuthLoginCallbacks, pkce: PKCEPair) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+		this.#pkce = pkce;
+	}
+
+	override async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const authParams = new URLSearchParams({
+			client_id: BUNDLED_CLIENT_ID,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: OAUTH_SCOPES.join(" "),
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+			state,
+		});
+
+		return {
+			url: `${GITLAB_COM_URL}/oauth/authorize?${authParams.toString()}`,
+			instructions: "Complete GitLab login in browser. Authentication will finish automatically.",
+		};
+	}
+
+	override async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		const response = await fetch(`${GITLAB_COM_URL}/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: BUNDLED_CLIENT_ID,
+				grant_type: "authorization_code",
+				code,
+				code_verifier: this.#pkce.verifier,
+				redirect_uri: redirectUri,
+			}).toString(),
+		});
+
+		if (!response.ok) {
+			throw new Error(`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`);
+		}
+
+		clearGitLabDuoDirectAccessCache();
+		return mapTokenResponse(
+			(await response.json()) as {
+				access_token?: string;
+				refresh_token?: string;
+				expires_in?: number;
+				created_at?: number;
+			},
+		);
+	}
+}
+
+export async function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+	const pkce = await generatePKCE();
+	const flow = new GitLabDuoOAuthFlow(callbacks, pkce);
+	return flow.login();
+}
+
+export async function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
+	const response = await fetch(`${GITLAB_COM_URL}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: BUNDLED_CLIENT_ID,
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh,
+		}).toString(),
+	});
+
+	if (!response.ok) {
+		throw new Error(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`);
+	}
+
+	clearGitLabDuoDirectAccessCache();
+	return mapTokenResponse(
+		(await response.json()) as {
+			access_token?: string;
+			refresh_token?: string;
+			expires_in?: number;
+			created_at?: number;
+		},
+	);
+}

package/src/utils/oauth/google-antigravity.ts

@@ -0,0 +1,200 @@
+/**
+ * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
+ * Uses different OAuth credentials than google-gemini-cli for access to additional models.
+ */
+import { getAntigravityUserAgent } from "../../providers/google-gemini-headers";
+import { runGoogleOAuthLogin } from "./google-oauth-shared";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const decode = (s: string) => atob(s);
+const CLIENT_ID = decode(
+	"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==",
+);
+const CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+const CALLBACK_PORT = 51121;
+const CALLBACK_PATH = "/oauth-callback";
+
+const SCOPES = [
+	"https://www.googleapis.com/auth/cloud-platform",
+	"https://www.googleapis.com/auth/userinfo.email",
+	"https://www.googleapis.com/auth/userinfo.profile",
+	"https://www.googleapis.com/auth/cclog",
+	"https://www.googleapis.com/auth/experimentsandconfigs",
+];
+
+const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const CLOUD_CODE_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+const TIER_LEGACY = "legacy-tier";
+const PROJECT_ONBOARD_MAX_ATTEMPTS = 5;
+const PROJECT_ONBOARD_INTERVAL_MS = 2000;
+
+interface LoadCodeAssistPayload {
+	cloudaicompanionProject?: string | { id?: string };
+	currentTier?: { id?: string };
+	allowedTiers?: Array<{ id?: string; isDefault?: boolean }>;
+}
+
+interface LongRunningOperationResponse {
+	done?: boolean;
+	response?: {
+		cloudaicompanionProject?: string | { id?: string };
+	};
+}
+
+export const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
+	ideType: "ANTIGRAVITY",
+	platform: "PLATFORM_UNSPECIFIED",
+	pluginType: "GEMINI",
+});
+
+function readProjectId(value: string | { id?: string } | undefined): string | undefined {
+	if (typeof value === "string" && value.length > 0) {
+		return value;
+	}
+	if (value && typeof value === "object" && typeof value.id === "string" && value.id.length > 0) {
+		return value.id;
+	}
+	return undefined;
+}
+
+function getDefaultTierId(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): string {
+	if (!allowedTiers || allowedTiers.length === 0) {
+		return TIER_LEGACY;
+	}
+	const defaultTier = allowedTiers.find(tier => tier.isDefault && typeof tier.id === "string" && tier.id.length > 0);
+	if (defaultTier?.id) {
+		return defaultTier.id;
+	}
+	return TIER_LEGACY;
+}
+
+async function onboardProjectWithRetries(
+	endpoint: string,
+	headers: Record<string, string>,
+	onboardBody: { tierId: string; metadata: typeof ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA },
+	onProgress?: (message: string) => void,
+): Promise<string> {
+	for (let attempt = 1; attempt <= PROJECT_ONBOARD_MAX_ATTEMPTS; attempt += 1) {
+		if (attempt > 1) {
+			onProgress?.(`Waiting for project provisioning (attempt ${attempt}/${PROJECT_ONBOARD_MAX_ATTEMPTS})...`);
+			await Bun.sleep(PROJECT_ONBOARD_INTERVAL_MS);
+		}
+
+		const onboardResponse = await fetch(`${endpoint}/v1internal:onboardUser`, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(onboardBody),
+		});
+
+		if (!onboardResponse.ok) {
+			const errorText = await onboardResponse.text();
+			throw new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);
+		}
+
+		const operation = (await onboardResponse.json()) as LongRunningOperationResponse;
+		if (!operation.done) {
+			continue;
+		}
+
+		const projectId = readProjectId(operation.response?.cloudaicompanionProject);
+		if (projectId) {
+			return projectId;
+		}
+	}
+
+	throw new Error(
+		`onboardUser did not return a provisioned project id after ${PROJECT_ONBOARD_MAX_ATTEMPTS} attempts`,
+	);
+}
+
+async function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {
+	const headers = {
+		Authorization: `Bearer ${accessToken}`,
+		"Content-Type": "application/json",
+		"User-Agent": getAntigravityUserAgent(),
+	};
+
+	onProgress?.("Checking for existing project...");
+	const endpoint = CLOUD_CODE_ENDPOINT;
+	try {
+		const loadResponse = await fetch(`${endpoint}/v1internal:loadCodeAssist`, {
+			method: "POST",
+			headers,
+			body: JSON.stringify({
+				metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+			}),
+		});
+
+		if (!loadResponse.ok) {
+			const errorText = await loadResponse.text();
+			throw new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);
+		}
+
+		const loadPayload = (await loadResponse.json()) as LoadCodeAssistPayload;
+		const existingProject = readProjectId(loadPayload.cloudaicompanionProject);
+		if (existingProject) {
+			return existingProject;
+		}
+
+		const tierId = getDefaultTierId(loadPayload.allowedTiers);
+		onProgress?.("Provisioning project...");
+		const onboardBody = {
+			tierId,
+			metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+		};
+		const provisionedProject = await onboardProjectWithRetries(endpoint, headers, onboardBody, onProgress);
+		return provisionedProject;
+	} catch (error) {
+		throw new Error(
+			`Could not discover or provision an Antigravity project. ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+}
+
+export async function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials> {
+	return runGoogleOAuthLogin(ctrl, {
+		clientId: CLIENT_ID,
+		clientSecret: CLIENT_SECRET,
+		authUrl: AUTH_URL,
+		tokenUrl: TOKEN_URL,
+		scopes: SCOPES,
+		callbackPort: CALLBACK_PORT,
+		callbackPath: CALLBACK_PATH,
+		discoverProject,
+	});
+}
+
+/**
+ * Refresh Antigravity token
+ */
+export async function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			client_secret: CLIENT_SECRET,
+			refresh_token: refreshToken,
+			grant_type: "refresh_token",
+		}),
+	});
+
+	if (!response.ok) {
+		const error = await response.text();
+		throw new Error(`Antigravity token refresh failed: ${error}`);
+	}
+
+	const data = (await response.json()) as {
+		access_token: string;
+		expires_in: number;
+		refresh_token?: string;
+	};
+
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+		projectId,
+	};
+}