@georgedong32/ccs 7.66.0

package/dist/cliproxy/auth/environment-detector.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Environment Detector for CLIProxyAPI
+ *
+ * Detects headless environments and manages OAuth callback ports.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = void 0;
+const child_process_1 = require("child_process");
+/**
+ * Detect if running in a headless environment (no browser available)
+ *
+ * IMPROVED: Avoids false positives on Windows desktop environments
+ * where isTTY may be undefined due to terminal wrapper behavior.
+ *
+ * Case study: Vietnamese Windows users reported "command hangs" because
+ * their terminal (PowerShell via npm) didn't set isTTY correctly.
+ */
+function isHeadlessEnvironment() {
+    // SSH session - always headless
+    if (process.env.SSH_TTY || process.env.SSH_CLIENT || process.env.SSH_CONNECTION) {
+        return true;
+    }
+    // No display on Linux (X11/Wayland) - headless
+    if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+        return true;
+    }
+    // Windows desktop - NEVER headless unless SSH (already checked above)
+    // This fixes false positive where Windows npm wrappers don't set isTTY correctly
+    // Windows desktop environments always have browser capability
+    if (process.platform === 'win32') {
+        return false;
+    }
+    // macOS - check for proper terminal
+    if (process.platform === 'darwin') {
+        // Non-interactive stdin on macOS means likely piped/scripted
+        if (!process.stdin.isTTY) {
+            return true;
+        }
+        return false;
+    }
+    // Linux with display - check TTY
+    if (process.platform === 'linux') {
+        if (!process.stdin.isTTY) {
+            return true;
+        }
+        return false;
+    }
+    // Default fallback for unknown platforms
+    return !process.stdin.isTTY;
+}
+exports.isHeadlessEnvironment = isHeadlessEnvironment;
+/**
+ * Kill any process using a specific port
+ * Used to free OAuth callback port before authentication
+ */
+function killProcessOnPort(port, verbose) {
+    try {
+        if (process.platform === 'win32') {
+            // Windows: use netstat + taskkill
+            const result = (0, child_process_1.execSync)(`netstat -ano | findstr :${port}`, {
+                encoding: 'utf-8',
+                stdio: 'pipe',
+            });
+            const lines = result.trim().split('\n');
+            for (const line of lines) {
+                const parts = line.trim().split(/\s+/);
+                const pid = parts[parts.length - 1];
+                if (pid && /^\d+$/.test(pid)) {
+                    (0, child_process_1.execSync)(`taskkill /F /PID ${pid}`, { stdio: 'pipe' });
+                    if (verbose)
+                        console.error(`[auth] Killed process ${pid} on port ${port}`);
+                }
+            }
+            return true;
+        }
+        else {
+            // Unix: use lsof + kill
+            const result = (0, child_process_1.execSync)(`lsof -ti:${port}`, { encoding: 'utf-8', stdio: 'pipe' });
+            const pids = result
+                .trim()
+                .split('\n')
+                .filter((p) => p);
+            for (const pid of pids) {
+                (0, child_process_1.execSync)(`kill -9 ${pid}`, { stdio: 'pipe' });
+                if (verbose)
+                    console.error(`[auth] Killed process ${pid} on port ${port}`);
+            }
+            return pids.length > 0;
+        }
+    }
+    catch {
+        // No process on port or command failed - that's fine
+        return false;
+    }
+}
+exports.killProcessOnPort = killProcessOnPort;
+/**
+ * Get platform-specific troubleshooting for OAuth timeout
+ */
+function getTimeoutTroubleshooting(provider, port) {
+    const lines = [];
+    lines.push('');
+    lines.push('TROUBLESHOOTING:');
+    lines.push('  1. Check browser completed auth (should show success page)');
+    lines.push('  2. Complete OAuth in the same browser session that opened');
+    if (port) {
+        lines.push(`  3. Check for port conflicts: lsof -ti:${port} or ss -tlnp | grep ${port}`);
+        lines.push(`  4. Try: ccs ${provider} --auth --verbose`);
+    }
+    else {
+        lines.push(`  3. Try: ccs ${provider} --auth --verbose`);
+    }
+    lines.push('');
+    lines.push('If you copied the URL to another browser:');
+    lines.push('  - OAuth sessions expire after ~10 minutes');
+    lines.push('  - Callback must reach localhost (same machine only)');
+    return lines;
+}
+exports.getTimeoutTroubleshooting = getTimeoutTroubleshooting;
+/**
+ * Display a single step status line
+ */
+function showStep(step, total, status, message) {
+    const statusIcon = status === 'ok' ? '[OK]' : status === 'fail' ? '[X]' : '[..]';
+    console.log(`${statusIcon} [${step}/${total}] ${message}`);
+}
+exports.showStep = showStep;
+//# sourceMappingURL=environment-detector.js.map

package/dist/cliproxy/auth/environment-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-detector.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/environment-detector.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,iDAAyC;AAGzC;;;;;;;;GAQG;AACH,SAAgB,qBAAqB;IACnC,gCAAgC;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,iFAAiF;IACjF,8DAA8D;IAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,6DAA6D;QAC7D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yCAAyC;IACzC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AAC9B,CAAC;AArCD,sDAqCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,OAAgB;IAC9D,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,kCAAkC;YAClC,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,2BAA2B,IAAI,EAAE,EAAE;gBACzD,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACpC,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,IAAA,wBAAQ,EAAC,oBAAoB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBACvD,IAAI,OAAO;wBAAE,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,YAAY,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM;iBAChB,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAA,wBAAQ,EAAC,WAAW,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9C,IAAI,OAAO;oBAAE,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAnCD,8CAmCC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CACvC,QAA0B,EAC1B,IAAmB;IAEnB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAE1E,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,2CAA2C,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,mBAAmB,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAEpE,OAAO,KAAK,CAAC;AACf,CAAC;AAvBD,8DAuBC;AAED;;GAEG;AACH,SAAgB,QAAQ,CACtB,IAAY,EACZ,KAAa,EACb,MAAkC,EAClC,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AARD,4BAQC"}

package/dist/cliproxy/auth/gemini-token-refresh.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Gemini Token Refresh
+ *
+ * Handles proactive token validation and refresh for Gemini OAuth tokens.
+ * Prevents UND_ERR_SOCKET errors by ensuring tokens are valid before use.
+ *
+ * Token sources (priority order):
+ * 1. CLIProxy auth dir (~/.ccs/cliproxy/auth/) - CCS-managed tokens
+ * 2. Standard Gemini CLI (~/.gemini/oauth_creds.json) - backward compatibility
+ */
+/**
+ * Get path to Gemini OAuth credentials file
+ */
+export declare function getGeminiOAuthPath(): string;
+/**
+ * Check if Gemini token is expired or expiring soon
+ */
+export declare function isGeminiTokenExpiringSoon(accountId?: string): boolean;
+/**
+ * Refresh Gemini access token using refresh_token
+ * @param accountId Optional account ID for account-scoped refresh
+ * @returns Result with success status, optional error, and expiry time
+ */
+export declare function refreshGeminiToken(accountId?: string): Promise<{
+    success: boolean;
+    error?: string;
+    expiresAt?: number;
+}>;
+/**
+ * Ensure Gemini token is valid, refreshing if needed
+ * @param verbose Log progress if true
+ * @param accountId Optional account ID for account-scoped refresh
+ * @returns true if token is valid (or was refreshed), false if refresh failed
+ */
+export declare function ensureGeminiTokenValid(verbose?: boolean, accountId?: string): Promise<{
+    valid: boolean;
+    refreshed: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=gemini-token-refresh.d.ts.map

package/dist/cliproxy/auth/gemini-token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-token-refresh.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/gemini-token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsEH;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AA+ND;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAUrE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAkED;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAwBD"}

package/dist/cliproxy/auth/gemini-token-refresh.js

@@ -0,0 +1,371 @@
+"use strict";
+/**
+ * Gemini Token Refresh
+ *
+ * Handles proactive token validation and refresh for Gemini OAuth tokens.
+ * Prevents UND_ERR_SOCKET errors by ensuring tokens are valid before use.
+ *
+ * Token sources (priority order):
+ * 1. CLIProxy auth dir (~/.ccs/cliproxy/auth/) - CCS-managed tokens
+ * 2. Standard Gemini CLI (~/.gemini/oauth_creds.json) - backward compatibility
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureGeminiTokenValid = exports.refreshGeminiToken = exports.isGeminiTokenExpiringSoon = exports.getGeminiOAuthPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const config_generator_1 = require("../config-generator");
+const account_manager_1 = require("../account-manager");
+const token_manager_1 = require("./token-manager");
+/** Google OAuth token endpoint */
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+/** Refresh tokens 5 minutes before expiry */
+const REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;
+const GEMINI_CLIENT_ID_ENV_KEYS = ['CCS_GEMINI_OAUTH_CLIENT_ID', 'OPENCLAW_GEMINI_OAUTH_CLIENT_ID'];
+const GEMINI_CLIENT_SECRET_ENV_KEYS = [
+    'CCS_GEMINI_OAUTH_CLIENT_SECRET',
+    'OPENCLAW_GEMINI_OAUTH_CLIENT_SECRET',
+];
+/**
+ * Get path to Gemini OAuth credentials file
+ */
+function getGeminiOAuthPath() {
+    return path.join(os.homedir(), '.gemini', 'oauth_creds.json');
+}
+exports.getGeminiOAuthPath = getGeminiOAuthPath;
+/**
+ * Map CLIProxyAPI token format to internal GeminiOAuthCreds format
+ */
+function mapCliproxyToGeminiCreds(cliproxy) {
+    return {
+        access_token: cliproxy.token.access_token,
+        refresh_token: cliproxy.token.refresh_token,
+        expiry_date: cliproxy.token.expiry,
+        token_type: 'Bearer',
+        client_id: cliproxy.token.client_id,
+        client_secret: cliproxy.token.client_secret,
+        token_uri: cliproxy.token.token_uri,
+    };
+}
+/**
+ * Validate CLIProxyAPI token structure has required fields
+ */
+function isValidCliproxyToken(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const obj = data;
+    if (obj.type !== 'gemini')
+        return false;
+    if (typeof obj.token !== 'object' || obj.token === null)
+        return false;
+    const token = obj.token;
+    return typeof token.access_token === 'string';
+}
+function getFirstEnvValue(keys) {
+    for (const key of keys) {
+        const value = process.env[key]?.trim();
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function resolveGeminiRefreshCredentials(creds) {
+    const clientId = creds.client_id?.trim() || getFirstEnvValue(GEMINI_CLIENT_ID_ENV_KEYS);
+    const clientSecret = creds.client_secret?.trim() || getFirstEnvValue(GEMINI_CLIENT_SECRET_ENV_KEYS);
+    if (!clientId || !clientSecret) {
+        return {
+            error: 'Gemini token refresh unavailable: missing OAuth client credentials in the token file. ' +
+                'Re-authenticate with CLIProxy or set CCS_GEMINI_OAUTH_CLIENT_ID and CCS_GEMINI_OAUTH_CLIENT_SECRET.',
+        };
+    }
+    return {
+        credentials: {
+            clientId,
+            clientSecret,
+            tokenUrl: creds.token_uri?.trim() || GOOGLE_TOKEN_URL,
+        },
+    };
+}
+/**
+ * Read Gemini token from CLIProxy auth directory
+ * Returns credentials with source path, or null if no valid token found
+ */
+function readCliproxyGeminiCreds(accountId) {
+    const authDir = (0, config_generator_1.getProviderAuthDir)('gemini');
+    if (!fs.existsSync(authDir))
+        return null;
+    let tokenPath = null;
+    const normalizedAccountId = accountId?.trim();
+    const accounts = (0, account_manager_1.getProviderAccounts)('gemini');
+    // Account-specific refresh path (used by background worker)
+    if (normalizedAccountId) {
+        const targetAccount = accounts.find((account) => account.id === normalizedAccountId);
+        if (!targetAccount) {
+            return null;
+        }
+        tokenPath = path.join(authDir, targetAccount.tokenFile);
+    }
+    if (!normalizedAccountId) {
+        // Try to find default account's token file
+        const defaultAccount = (0, account_manager_1.getDefaultAccount)('gemini');
+        if (defaultAccount) {
+            tokenPath = path.join(authDir, defaultAccount.tokenFile);
+            if (!fs.existsSync(tokenPath))
+                tokenPath = null;
+        }
+        // Fallback: find any gemini account token file
+        if (!tokenPath && accounts.length > 0) {
+            tokenPath = path.join(authDir, accounts[0].tokenFile);
+            if (!fs.existsSync(tokenPath))
+                tokenPath = null;
+        }
+        // Last fallback: scan directory for gemini token files
+        if (!tokenPath) {
+            try {
+                const files = fs.readdirSync(authDir).filter((f) => f.endsWith('.json'));
+                for (const file of files) {
+                    const filePath = path.join(authDir, file);
+                    if (file.startsWith('gemini-') || (0, token_manager_1.isTokenFileForProvider)(filePath, 'gemini')) {
+                        tokenPath = filePath;
+                        break;
+                    }
+                }
+            }
+            catch {
+                // Directory read failed - continue to return null
+                return null;
+            }
+        }
+    }
+    if (!tokenPath)
+        return null;
+    try {
+        const content = fs.readFileSync(tokenPath, 'utf8');
+        const data = JSON.parse(content);
+        // Validate CLIProxyAPI format with proper type checking
+        if (isValidCliproxyToken(data)) {
+            return {
+                creds: mapCliproxyToGeminiCreds(data),
+                sourcePath: tokenPath,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read Gemini OAuth credentials
+ * Priority: CLIProxy auth dir first, then ~/.gemini/oauth_creds.json
+ * Returns credentials with source path for correct write-back
+ */
+function readGeminiCreds(accountId) {
+    // 1. Try CLIProxy auth directory first (CCS-managed tokens)
+    const cliproxyResult = readCliproxyGeminiCreds(accountId);
+    if (cliproxyResult) {
+        return cliproxyResult;
+    }
+    // Account-scoped refresh is only supported for CLIProxy account files.
+    // Do not fall back to ~/.gemini for a specific accountId.
+    if (accountId?.trim()) {
+        return null;
+    }
+    // 2. Fall back to standard Gemini CLI location
+    const oauthPath = getGeminiOAuthPath();
+    if (!fs.existsSync(oauthPath)) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(oauthPath, 'utf8');
+        return {
+            creds: JSON.parse(content),
+            sourcePath: oauthPath,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write updated credentials to CLIProxy token file
+ * Preserves existing fields (email, project_id), only updates token subfields
+ */
+function writeCliproxyGeminiCreds(tokenPath, creds) {
+    try {
+        const existing = JSON.parse(fs.readFileSync(tokenPath, 'utf8'));
+        const updated = {
+            ...existing,
+            token: {
+                ...existing.token,
+                access_token: creds.access_token,
+                refresh_token: creds.refresh_token,
+                expiry: creds.expiry_date,
+            },
+        };
+        fs.writeFileSync(tokenPath, JSON.stringify(updated, null, 2), { mode: 0o600 });
+        return undefined;
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : 'Failed to write credentials';
+    }
+}
+/**
+ * Write Gemini OAuth credentials
+ * Writes back to the specified source location (CLIProxy or ~/.gemini)
+ * @param creds - The credentials to write
+ * @param sourcePath - The path where credentials were originally read from
+ * @returns error message if write failed, undefined on success
+ */
+function writeGeminiCreds(creds, sourcePath) {
+    const geminiOAuthPath = getGeminiOAuthPath();
+    // If source is not the standard Gemini path, write to CLIProxy format
+    if (sourcePath !== geminiOAuthPath) {
+        return writeCliproxyGeminiCreds(sourcePath, creds);
+    }
+    // Otherwise write to standard Gemini CLI location
+    const dir = path.dirname(geminiOAuthPath);
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(geminiOAuthPath, JSON.stringify(creds, null, 2), { mode: 0o600 });
+        return undefined;
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : 'Failed to write credentials';
+    }
+}
+/**
+ * Check if Gemini token is expired or expiring soon
+ */
+function isGeminiTokenExpiringSoon(accountId) {
+    const result = readGeminiCreds(accountId);
+    if (!result || !result.creds.access_token) {
+        return true; // No token = needs auth
+    }
+    if (!result.creds.expiry_date) {
+        return false; // No expiry info = assume valid
+    }
+    const expiresIn = result.creds.expiry_date - Date.now();
+    return expiresIn < REFRESH_LEAD_TIME_MS;
+}
+exports.isGeminiTokenExpiringSoon = isGeminiTokenExpiringSoon;
+/**
+ * Refresh Gemini access token using refresh_token
+ * @param accountId Optional account ID for account-scoped refresh
+ * @returns Result with success status, optional error, and expiry time
+ */
+async function refreshGeminiToken(accountId) {
+    const result = readGeminiCreds(accountId);
+    if (!result || !result.creds.refresh_token) {
+        return { success: false, error: 'No refresh token available' };
+    }
+    const { creds, sourcePath } = result;
+    const resolvedCredentials = resolveGeminiRefreshCredentials(creds);
+    if (!resolvedCredentials.credentials) {
+        return { success: false, error: resolvedCredentials.error };
+    }
+    const { clientId, clientSecret, tokenUrl } = resolvedCredentials.credentials;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 10000);
+    try {
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            signal: controller.signal,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: creds.refresh_token, // Already validated above
+                client_id: clientId,
+                client_secret: clientSecret,
+            }).toString(),
+        });
+        clearTimeout(timeoutId);
+        const data = (await response.json());
+        if (!response.ok || data.error) {
+            return {
+                success: false,
+                error: data.error_description || data.error || `OAuth error: ${response.status}`,
+            };
+        }
+        if (!data.access_token) {
+            return { success: false, error: 'No access_token in response' };
+        }
+        // Update credentials file with new token
+        const expiresAt = Date.now() + (data.expires_in ?? 3600) * 1000;
+        const updatedCreds = {
+            ...creds,
+            access_token: data.access_token,
+            expiry_date: expiresAt,
+        };
+        const writeError = writeGeminiCreds(updatedCreds, sourcePath);
+        if (writeError) {
+            return { success: false, error: `Token refreshed but failed to save: ${writeError}` };
+        }
+        return { success: true, expiresAt };
+    }
+    catch (err) {
+        clearTimeout(timeoutId);
+        if (err instanceof Error && err.name === 'AbortError') {
+            return { success: false, error: 'Token refresh timeout' };
+        }
+        return { success: false, error: err instanceof Error ? err.message : 'Unknown error' };
+    }
+}
+exports.refreshGeminiToken = refreshGeminiToken;
+/**
+ * Ensure Gemini token is valid, refreshing if needed
+ * @param verbose Log progress if true
+ * @param accountId Optional account ID for account-scoped refresh
+ * @returns true if token is valid (or was refreshed), false if refresh failed
+ */
+async function ensureGeminiTokenValid(verbose = false, accountId) {
+    const result = readGeminiCreds(accountId);
+    if (!result || !result.creds.access_token) {
+        return { valid: false, refreshed: false, error: 'No Gemini credentials found' };
+    }
+    if (!isGeminiTokenExpiringSoon(accountId)) {
+        return { valid: true, refreshed: false };
+    }
+    // Token is expired or expiring soon - try to refresh
+    if (verbose) {
+        console.log('[i] Gemini token expired or expiring soon, refreshing...');
+    }
+    const refreshResult = await refreshGeminiToken(accountId);
+    if (refreshResult.success) {
+        if (verbose) {
+            console.log('[OK] Gemini token refreshed successfully');
+        }
+        return { valid: true, refreshed: true };
+    }
+    return { valid: false, refreshed: false, error: refreshResult.error };
+}
+exports.ensureGeminiTokenValid = ensureGeminiTokenValid;
+//# sourceMappingURL=gemini-token-refresh.js.map

package/dist/cliproxy/auth/gemini-token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-token-refresh.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/gemini-token-refresh.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,0DAAyD;AACzD,wDAA4E;AAC5E,mDAAyD;AAEzD,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,MAAM,yBAAyB,GAAG,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAC;AACpG,MAAM,6BAA6B,GAAG;IACpC,gCAAgC;IAChC,qCAAqC;CACtC,CAAC;AAmDF;;GAEG;AACH,SAAgB,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAFD,gDAEC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAA6B;IAC7D,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY;QACzC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;QAC3C,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QAClC,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;QACnC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;QAC3C,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;KACpC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;IACnD,OAAO,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,+BAA+B,CAAC,KAAuB;IAI9D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IACxF,MAAM,YAAY,GAChB,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;IAEjF,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EACH,wFAAwF;gBACxF,qGAAqG;SACxG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE;YACX,QAAQ;YACR,YAAY;YACZ,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,gBAAgB;SACtD;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,SAAkB;IACjD,MAAM,OAAO,GAAG,IAAA,qCAAkB,EAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,MAAM,mBAAmB,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC;IAE/C,4DAA4D;IAC5D,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,mBAAmB,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,2CAA2C;QAC3C,MAAM,cAAc,GAAG,IAAA,mCAAiB,EAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;QAClD,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;QAClD,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAA,sCAAsB,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAC7E,SAAS,GAAG,QAAQ,CAAC;wBACrB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE1C,wDAAwD;QACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,wBAAwB,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,SAAS;aACtB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAAkB;IACzC,4DAA4D;IAC5D,MAAM,cAAc,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,uEAAuE;IACvE,0DAA0D;IAC1D,IAAI,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB;YAC9C,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,SAAiB,EAAE,KAAuB;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ;YACX,KAAK,EAAE;gBACL,GAAG,QAAQ,CAAC,KAAK;gBACjB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,MAAM,EAAE,KAAK,CAAC,WAAW;aAC1B;SACF,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAuB,EAAE,UAAkB;IACnE,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAE7C,sEAAsE;IACtE,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,kDAAkD;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CAAC,SAAkB;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,gCAAgC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,OAAO,SAAS,GAAG,oBAAoB,CAAC;AAC1C,CAAC;AAVD,8DAUC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,SAAkB;IAKzD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAuB,EAAE,0BAA0B;gBACxE,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAE7D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,gBAAgB,QAAQ,CAAC,MAAM,EAAE;aACjF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClE,CAAC;QAED,yCAAyC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAChE,MAAM,YAAY,GAAqB;YACrC,GAAG,KAAK;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,UAAU,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAtED,gDAsEC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sBAAsB,CAC1C,OAAO,GAAG,KAAK,EACf,SAAkB;IAMlB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,qDAAqD;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AA/BD,wDA+BC"}

package/dist/cliproxy/auth/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Auth Module - Barrel Export
+ *
+ * Re-exports all auth-related functionality from submodules.
+ */
+export type { AuthStatus, ProviderOAuthConfig, OAuthOptions } from './auth-types';
+export { OAUTH_CALLBACK_PORTS, OAUTH_CONFIGS, PROVIDER_AUTH_PREFIXES, PROVIDER_TYPE_VALUES, getOAuthConfig, } from './auth-types';
+export { getProviderTokenDir, isTokenFileForProvider, isAuthenticated, getAuthStatus, getAllAuthStatus, clearAuth, registerAccountFromToken, displayAuthStatus, } from './token-manager';
+export { isHeadlessEnvironment, killProcessOnPort, getTimeoutTroubleshooting, showStep, } from './environment-detector';
+export { triggerOAuth, ensureAuth } from './oauth-handler';
+//# sourceMappingURL=index.d.ts.map

package/dist/cliproxy/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,QAAQ,GACT,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cliproxy/auth/index.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Auth Module - Barrel Export
+ *
+ * Re-exports all auth-related functionality from submodules.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAuth = exports.triggerOAuth = exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = exports.displayAuthStatus = exports.registerAccountFromToken = exports.clearAuth = exports.getAllAuthStatus = exports.getAuthStatus = exports.isAuthenticated = exports.isTokenFileForProvider = exports.getProviderTokenDir = exports.getOAuthConfig = exports.PROVIDER_TYPE_VALUES = exports.PROVIDER_AUTH_PREFIXES = exports.OAUTH_CONFIGS = exports.OAUTH_CALLBACK_PORTS = void 0;
+var auth_types_1 = require("./auth-types");
+Object.defineProperty(exports, "OAUTH_CALLBACK_PORTS", { enumerable: true, get: function () { return auth_types_1.OAUTH_CALLBACK_PORTS; } });
+Object.defineProperty(exports, "OAUTH_CONFIGS", { enumerable: true, get: function () { return auth_types_1.OAUTH_CONFIGS; } });
+Object.defineProperty(exports, "PROVIDER_AUTH_PREFIXES", { enumerable: true, get: function () { return auth_types_1.PROVIDER_AUTH_PREFIXES; } });
+Object.defineProperty(exports, "PROVIDER_TYPE_VALUES", { enumerable: true, get: function () { return auth_types_1.PROVIDER_TYPE_VALUES; } });
+Object.defineProperty(exports, "getOAuthConfig", { enumerable: true, get: function () { return auth_types_1.getOAuthConfig; } });
+// Token management
+var token_manager_1 = require("./token-manager");
+Object.defineProperty(exports, "getProviderTokenDir", { enumerable: true, get: function () { return token_manager_1.getProviderTokenDir; } });
+Object.defineProperty(exports, "isTokenFileForProvider", { enumerable: true, get: function () { return token_manager_1.isTokenFileForProvider; } });
+Object.defineProperty(exports, "isAuthenticated", { enumerable: true, get: function () { return token_manager_1.isAuthenticated; } });
+Object.defineProperty(exports, "getAuthStatus", { enumerable: true, get: function () { return token_manager_1.getAuthStatus; } });
+Object.defineProperty(exports, "getAllAuthStatus", { enumerable: true, get: function () { return token_manager_1.getAllAuthStatus; } });
+Object.defineProperty(exports, "clearAuth", { enumerable: true, get: function () { return token_manager_1.clearAuth; } });
+Object.defineProperty(exports, "registerAccountFromToken", { enumerable: true, get: function () { return token_manager_1.registerAccountFromToken; } });
+Object.defineProperty(exports, "displayAuthStatus", { enumerable: true, get: function () { return token_manager_1.displayAuthStatus; } });
+// Environment detection
+var environment_detector_1 = require("./environment-detector");
+Object.defineProperty(exports, "isHeadlessEnvironment", { enumerable: true, get: function () { return environment_detector_1.isHeadlessEnvironment; } });
+Object.defineProperty(exports, "killProcessOnPort", { enumerable: true, get: function () { return environment_detector_1.killProcessOnPort; } });
+Object.defineProperty(exports, "getTimeoutTroubleshooting", { enumerable: true, get: function () { return environment_detector_1.getTimeoutTroubleshooting; } });
+Object.defineProperty(exports, "showStep", { enumerable: true, get: function () { return environment_detector_1.showStep; } });
+// OAuth handling
+var oauth_handler_1 = require("./oauth-handler");
+Object.defineProperty(exports, "triggerOAuth", { enumerable: true, get: function () { return oauth_handler_1.triggerOAuth; } });
+Object.defineProperty(exports, "ensureAuth", { enumerable: true, get: function () { return oauth_handler_1.ensureAuth; } });
+//# sourceMappingURL=index.js.map

package/dist/cliproxy/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAIH,2CAMsB;AALpB,kHAAA,oBAAoB,OAAA;AACpB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,kHAAA,oBAAoB,OAAA;AACpB,4GAAA,cAAc,OAAA;AAGhB,mBAAmB;AACnB,iDASyB;AARvB,oHAAA,mBAAmB,OAAA;AACnB,uHAAA,sBAAsB,OAAA;AACtB,gHAAA,eAAe,OAAA;AACf,8GAAA,aAAa,OAAA;AACb,iHAAA,gBAAgB,OAAA;AAChB,0GAAA,SAAS,OAAA;AACT,yHAAA,wBAAwB,OAAA;AACxB,kHAAA,iBAAiB,OAAA;AAGnB,wBAAwB;AACxB,+DAKgC;AAJ9B,6HAAA,qBAAqB,OAAA;AACrB,yHAAA,iBAAiB,OAAA;AACjB,iIAAA,yBAAyB,OAAA;AACzB,gHAAA,QAAQ,OAAA;AAGV,iBAAiB;AACjB,iDAA2D;AAAlD,6GAAA,YAAY,OAAA;AAAE,2GAAA,UAAU,OAAA"}

package/dist/cliproxy/auth/kiro-import.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Kiro Import Helper
+ *
+ * Imports Kiro token from Kiro IDE when OAuth callback redirects to IDE instead of CLI.
+ * Spawns cli-proxy-api-plus --kiro-import to import token from Kiro IDE's storage.
+ */
+export interface KiroImportResult {
+    success: boolean;
+    provider?: string;
+    email?: string;
+    error?: string;
+}
+/**
+ * Try to import Kiro token from Kiro IDE
+ * Uses cli-proxy-api-plus --kiro-import flag
+ */
+export declare function tryKiroImport(tokenDir: string, verbose?: boolean): Promise<KiroImportResult>;
+/**
+ * Import Kiro token with user-facing output
+ * Shows progress and result to user
+ */
+export declare function importKiroToken(verbose?: boolean): Promise<boolean>;
+//# sourceMappingURL=kiro-import.d.ts.map

package/dist/cliproxy/auth/kiro-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-import.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/kiro-import.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0GhG;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBvE"}