@georgedong32/ccs 7.67.0 → 8.0.0

package/dist/cliproxy/auth/oauth-handler.js

@@ -34,29 +34,144 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureAuth = exports.triggerOAuth = exports.resolvePasteCallbackAuthUrl = exports.getCliAuthNicknameError = exports.requestPasteCallbackStart = void 0;
+exports.ensureAuth = exports.triggerOAuth = exports.usesKiroLocalCallbackReplay = exports.resolvePasteCallbackAuthUrl = exports.findNewTokenSnapshotForManualAuth = exports.promptGitLabPersonalAccessToken = exports.normalizeGitLabBaseUrl = exports.getCliAuthNicknameError = exports.requestPasteCallbackStart = exports.getGeminiAuthUrlCredentialError = exports.getGeminiPlusOAuthCredentialError = exports.getPlusAuthUrlCredentialError = exports.getPlusOAuthCredentialError = exports.PLUS_OAUTH_ENV_BY_PROVIDER = void 0;
 const fs = __importStar(require("fs"));
 const ui_1 = require("../../utils/ui");
+const logging_1 = require("../../services/logging");
 const binary_manager_1 = require("../binary-manager");
-const config_generator_1 = require("../config-generator");
-const account_manager_1 = require("../account-manager");
+const config_generator_1 = require("../config/config-generator");
+const account_manager_1 = require("../accounts/account-manager");
 const oauth_port_diagnostics_1 = require("../../management/oauth-port-diagnostics");
 const auth_types_1 = require("./auth-types");
 const environment_detector_1 = require("./environment-detector");
 const token_manager_1 = require("./token-manager");
 const oauth_process_1 = require("./oauth-process");
 const kiro_import_1 = require("./kiro-import");
-const proxy_target_resolver_1 = require("../proxy-target-resolver");
-const account_safety_1 = require("../account-safety");
-const antigravity_responsibility_1 = require("../antigravity-responsibility");
+const gitlab_pat_response_1 = require("./gitlab-pat-response");
+const oauth_start_failure_guidance_1 = require("./oauth-start-failure-guidance");
+const proxy_target_resolver_1 = require("../proxy/proxy-target-resolver");
+const account_safety_1 = require("../accounts/account-safety");
+const antigravity_responsibility_1 = require("../auth/antigravity-responsibility");
+const prompt_1 = require("../../utils/prompt");
 const PASTE_CALLBACK_AUTH_URL_POLL_INTERVAL_MS = 3000;
-async function requestPasteCallbackStart(provider, target) {
-    const startPath = (0, auth_types_1.getPasteCallbackStartPath)(provider);
+const POLLED_AUTH_LOCAL_TOKEN_GRACE_MS = 15 * 1000;
+const GEMINI_PLUS_CLIENT_ID_ENV = 'CLIPROXY_GEMINI_OAUTH_CLIENT_ID';
+const GEMINI_PLUS_CLIENT_SECRET_ENV = 'CLIPROXY_GEMINI_OAUTH_CLIENT_SECRET';
+const logger = (0, logging_1.createLogger)('cliproxy:auth:oauth');
+/**
+ * Table of providers that require Google OAuth client credentials when running
+ * against CLIProxy Plus. Keyed by CLIProxyProvider value.
+ *
+ * Used by the generalized helpers so the dashboard handler can guard any
+ * table-listed provider without duplicating env-var names.
+ */
+exports.PLUS_OAUTH_ENV_BY_PROVIDER = {
+    gemini: {
+        idEnv: GEMINI_PLUS_CLIENT_ID_ENV,
+        secretEnv: GEMINI_PLUS_CLIENT_SECRET_ENV,
+        displayName: 'Gemini',
+    },
+    agy: {
+        idEnv: 'CLIPROXY_ANTIGRAVITY_OAUTH_CLIENT_ID',
+        secretEnv: 'CLIPROXY_ANTIGRAVITY_OAUTH_CLIENT_SECRET',
+        displayName: 'Antigravity',
+    },
+};
+/**
+ * Build a human-readable error message for a provider whose Plus OAuth client
+ * credentials are missing.
+ *
+ * @param displayName - Human-readable provider name (e.g. "Gemini", "Antigravity")
+ * @param idEnv       - Name of the client-ID env var
+ * @param secretEnv   - Name of the client-secret env var
+ * @param missing     - Which of the two vars are absent (omit to suppress the "Missing:" prefix)
+ */
+function buildPlusOAuthCredentialMessage(displayName, idEnv, secretEnv, missing) {
+    const missingText = missing?.length ? ` Missing: ${missing.join(', ')}.` : '';
+    return (`${displayName} OAuth from CLIProxy Plus is missing Google OAuth client credentials.` +
+        missingText +
+        ` Set ${idEnv} and ${secretEnv} before starting CLIProxy Plus,` +
+        ` or switch \`cliproxy.backend\` to \`original\` for ${displayName}.`);
+}
+/**
+ * Generalized credential-missing guard for any provider in PLUS_OAUTH_ENV_BY_PROVIDER.
+ *
+ * Returns null when:
+ *   - provider is not in the table (not a Plus-credentialed provider)
+ *   - backend is not 'plus'
+ *   - both credential env vars are set and non-empty
+ *
+ * Returns an error string when Plus is active and one or both vars are missing.
+ */
+function getPlusOAuthCredentialError(provider, backend, env = process.env) {
+    const entry = exports.PLUS_OAUTH_ENV_BY_PROVIDER[provider];
+    if (!entry || backend !== 'plus') {
+        return null;
+    }
+    const missing = [entry.idEnv, entry.secretEnv].filter((name) => !env[name]?.trim());
+    return missing.length > 0
+        ? buildPlusOAuthCredentialMessage(entry.displayName, entry.idEnv, entry.secretEnv, missing)
+        : null;
+}
+exports.getPlusOAuthCredentialError = getPlusOAuthCredentialError;
+/**
+ * Generalized auth-URL guard for any provider in PLUS_OAUTH_ENV_BY_PROVIDER.
+ *
+ * Returns null when:
+ *   - provider is not in the table
+ *   - authUrl cannot be parsed as a URL (ignore malformed upstream responses)
+ *   - client_id query param is present and non-empty
+ *
+ * Returns an error string when client_id is absent or empty.
+ */
+function getPlusAuthUrlCredentialError(provider, authUrl) {
+    const entry = exports.PLUS_OAUTH_ENV_BY_PROVIDER[provider];
+    if (!entry) {
+        return null;
+    }
+    try {
+        const parsed = new URL(authUrl);
+        const clientId = parsed.searchParams.get('client_id')?.trim();
+        return clientId
+            ? null
+            : buildPlusOAuthCredentialMessage(entry.displayName, entry.idEnv, entry.secretEnv);
+    }
+    catch {
+        return null;
+    }
+}
+exports.getPlusAuthUrlCredentialError = getPlusAuthUrlCredentialError;
+// ---------------------------------------------------------------------------
+// Gemini-specific aliases — kept for backward-compat with PR #1131's callers.
+// These lock the provider to 'gemini' and delegate to the generalized helpers.
+// ---------------------------------------------------------------------------
+function getGeminiPlusOAuthCredentialError(provider, backend, env = process.env) {
+    if (provider !== 'gemini') {
+        return null;
+    }
+    return getPlusOAuthCredentialError(provider, backend, env);
+}
+exports.getGeminiPlusOAuthCredentialError = getGeminiPlusOAuthCredentialError;
+function getGeminiAuthUrlCredentialError(provider, authUrl) {
+    if (provider !== 'gemini') {
+        return null;
+    }
+    return getPlusAuthUrlCredentialError(provider, authUrl);
+}
+exports.getGeminiAuthUrlCredentialError = getGeminiAuthUrlCredentialError;
+async function requestPasteCallbackStart(provider, target, options) {
+    let startPath = (0, auth_types_1.getPasteCallbackStartPath)(provider, {
+        kiroMethod: options?.kiroMethod,
+    });
+    if (!startPath) {
+        throw new Error(`Paste-callback start is not available for ${provider} with the selected method`);
+    }
+    const normalizedGitLabBaseUrl = provider === 'gitlab' ? normalizeGitLabBaseUrl(options?.gitlabBaseUrl) : undefined;
+    if (normalizedGitLabBaseUrl) {
+        startPath += `&base_url=${encodeURIComponent(normalizedGitLabBaseUrl)}`;
+    }
     const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, startPath), {
-        ...(provider === 'kiro' ? { method: 'POST' } : {}),
-        headers: provider === 'kiro'
-            ? (0, proxy_target_resolver_1.buildManagementHeaders)(target, { 'Content-Type': 'application/json' })
-            : (0, proxy_target_resolver_1.buildManagementHeaders)(target),
+        headers: (0, proxy_target_resolver_1.buildManagementHeaders)(target),
     });
     if (!response.ok) {
         throw new Error(`OAuth start failed with status ${response.status}`);
@@ -81,6 +196,92 @@ exports.getCliAuthNicknameError = getCliAuthNicknameError;
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function parseAuthUrlState(url) {
+    if (!url) {
+        return null;
+    }
+    try {
+        return new URL(url).searchParams.get('state');
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeGitLabBaseUrl(baseUrl) {
+    const normalized = baseUrl?.trim();
+    if (!normalized) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = new URL(normalized);
+    }
+    catch {
+        throw new Error('GitLab URL must be a valid http:// or https:// URL');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error('GitLab URL must use http:// or https://');
+    }
+    parsed.hash = '';
+    parsed.search = '';
+    parsed.username = '';
+    parsed.password = '';
+    const normalizedPath = parsed.pathname.replace(/\/+$/, '');
+    return normalizedPath ? `${parsed.origin}${normalizedPath}` : parsed.origin;
+}
+exports.normalizeGitLabBaseUrl = normalizeGitLabBaseUrl;
+async function promptGitLabPersonalAccessToken() {
+    try {
+        const token = (await prompt_1.InteractivePrompt.password('GitLab Personal Access Token')).trim();
+        return token.length > 0 ? token : null;
+    }
+    catch (error) {
+        if (error.message.includes('TTY')) {
+            console.log((0, ui_1.fail)('GitLab Personal Access Token prompt requires an interactive TTY. Set the token explicitly or use Browser OAuth.'));
+            return null;
+        }
+        throw error;
+    }
+}
+exports.promptGitLabPersonalAccessToken = promptGitLabPersonalAccessToken;
+function findNewTokenSnapshotForManualAuth(provider, tokenDir, knownTokenFiles, expectedAccountId) {
+    return (0, token_manager_1.findNewTokenSnapshotForAuthAttempt)(provider, tokenDir, knownTokenFiles, expectedAccountId);
+}
+exports.findNewTokenSnapshotForManualAuth = findNewTokenSnapshotForManualAuth;
+async function waitForManualCallbackToken(provider, target, tokenDir, oauthState, knownTokenFiles, expectedAccountId, timeoutMs, pollIntervalMs = PASTE_CALLBACK_AUTH_URL_POLL_INTERVAL_MS) {
+    const deadline = Date.now() + timeoutMs;
+    let upstreamCompletedAt = null;
+    while (Date.now() < deadline) {
+        const tokenSnapshot = findNewTokenSnapshotForManualAuth(provider, tokenDir, knownTokenFiles, expectedAccountId);
+        if (tokenSnapshot) {
+            return { tokenSnapshot };
+        }
+        if (oauthState) {
+            const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, `/v0/management/get-auth-status?state=${encodeURIComponent(oauthState)}`), { headers: (0, proxy_target_resolver_1.buildManagementHeaders)(target) });
+            if (response.ok) {
+                const data = (await response.json());
+                if (data.status === 'error') {
+                    return {
+                        tokenSnapshot: null,
+                        error: data.error || 'Authentication failed while waiting for local token persistence',
+                    };
+                }
+                if (data.status === 'ok' && upstreamCompletedAt === null) {
+                    upstreamCompletedAt = Date.now();
+                }
+            }
+        }
+        if (upstreamCompletedAt !== null &&
+            Date.now() - upstreamCompletedAt >= POLLED_AUTH_LOCAL_TOKEN_GRACE_MS) {
+            break;
+        }
+        if (Date.now() + pollIntervalMs >= deadline) {
+            break;
+        }
+        await sleep(pollIntervalMs);
+    }
+    return { tokenSnapshot: null };
+}
 async function resolvePasteCallbackAuthUrl(target, startData, timeoutMs, pollIntervalMs = PASTE_CALLBACK_AUTH_URL_POLL_INTERVAL_MS) {
     const authUrl = startData.url || startData.auth_url;
     if (authUrl) {
@@ -205,7 +406,7 @@ async function runPreflightChecks(provider, oauthConfig) {
 async function prepareBinary(provider, verbose) {
     (0, environment_detector_1.showStep)(1, 4, 'progress', 'Preparing CLIProxy binary...');
     try {
-        const binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose);
+        const binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose, { skipAutoUpdate: true });
         process.stdout.write('\x1b[1A\x1b[2K');
         (0, environment_detector_1.showStep)(1, 4, 'ok', 'CLIProxy binary ready');
         const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
@@ -223,11 +424,43 @@ async function prepareBinary(provider, verbose) {
         throw error;
     }
 }
+function buildOAuthArgs(provider, configPath, headless, noIncognito, options = {}) {
+    const args = ['--config', configPath];
+    if (provider === 'kiro') {
+        const method = (0, auth_types_1.normalizeKiroAuthMethod)(options.kiroMethod);
+        if (!(0, auth_types_1.isKiroCLIAuthMethod)(method)) {
+            throw new Error(`Kiro auth method '${method}' is not supported by CLI flow.`);
+        }
+        args.push(...(0, auth_types_1.getKiroCLIAuthArgs)(method, {
+            idcStartUrl: options.kiroIDCStartUrl,
+            idcRegion: options.kiroIDCRegion,
+            idcFlow: options.kiroIDCFlow,
+        }));
+    }
+    else {
+        args.push((0, auth_types_1.getOAuthConfig)(provider).authFlag);
+    }
+    if (headless) {
+        args.push('--no-browser');
+    }
+    if (provider === 'kiro' && noIncognito) {
+        args.push('--no-incognito');
+    }
+    return args;
+}
+function usesKiroLocalCallbackReplay(method, idcFlow) {
+    const normalizedMethod = (0, auth_types_1.normalizeKiroAuthMethod)(method);
+    if (normalizedMethod === 'aws-authcode') {
+        return true;
+    }
+    return normalizedMethod === 'idc' && (0, auth_types_1.normalizeKiroIDCFlow)(idcFlow) === 'authcode';
+}
+exports.usesKiroLocalCallbackReplay = usesKiroLocalCallbackReplay;
 /**
  * Handle paste-callback mode: show auth URL, prompt for callback paste
  * Uses proxy target resolver to connect to correct CLIProxyAPI instance (local or remote)
  */
-async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir, nickname, expectedAccountId) {
+async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir, nickname, expectedAccountId, options) {
     // Resolve CLIProxyAPI target (local or remote based on config)
     const target = (0, proxy_target_resolver_1.getProxyTarget)();
     // OAuth state timeout (10 minutes, matches CLIProxyAPI state TTL)
@@ -235,16 +468,36 @@ async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir,
     console.log('');
     console.log((0, ui_1.info)(`Starting ${oauthConfig.displayName} OAuth (paste-callback mode)...`));
     try {
-        // Request auth URL from CLIProxyAPI.
-        // Kiro keeps its legacy start route because CLI auth methods do not share the generic
-        // management auth-url contract used by providers like Claude.
+        // Request auth URL from CLIProxyAPI management endpoints when the selected
+        // provider/method supports the manual start-url contract.
         let startData;
+        let startPath = (0, auth_types_1.getPasteCallbackStartPath)(provider, {
+            kiroMethod: options?.kiroMethod,
+        });
+        const normalizedGitLabBaseUrl = provider === 'gitlab' ? normalizeGitLabBaseUrl(options?.gitlabBaseUrl) : undefined;
+        if (startPath && normalizedGitLabBaseUrl) {
+            startPath += `&base_url=${encodeURIComponent(normalizedGitLabBaseUrl)}`;
+        }
         try {
-            startData = await requestPasteCallbackStart(provider, target);
+            startData = await requestPasteCallbackStart(provider, target, {
+                kiroMethod: options?.kiroMethod,
+                gitlabBaseUrl: options?.gitlabBaseUrl,
+            });
         }
         catch (error) {
             const startError = error.message;
             console.log((0, ui_1.fail)('Failed to start OAuth flow'));
+            if (startPath) {
+                const guidance = (0, oauth_start_failure_guidance_1.buildOAuthStartFailureGuidance)(provider, {
+                    target,
+                    startPath,
+                    cause: error,
+                    addAccount: options?.add,
+                });
+                for (const line of (0, oauth_start_failure_guidance_1.formatOAuthStartFailureForCli)(guidance)) {
+                    console.log(`    ${line}`);
+                }
+            }
             (0, account_safety_1.warnPossible403Ban)(provider, startError);
             return null;
         }
@@ -253,6 +506,13 @@ async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir,
             console.log((0, ui_1.fail)('No authorization URL received'));
             return null;
         }
+        const authUrlCredentialError = getGeminiAuthUrlCredentialError(provider, authUrl);
+        if (authUrlCredentialError) {
+            console.log((0, ui_1.fail)(authUrlCredentialError));
+            return null;
+        }
+        const oauthState = startData.state || parseAuthUrlState(authUrl);
+        const knownTokenFiles = (0, token_manager_1.listProviderTokenSnapshots)(provider, tokenDir);
         // Display auth URL in box
         console.log('');
         console.log('  ╔══════════════════════════════════════════════════════════════╗');
@@ -328,8 +588,23 @@ async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir,
             (0, account_safety_1.warnPossible403Ban)(provider, callbackError);
             return null;
         }
+        console.log((0, ui_1.info)('Callback submitted. Waiting for token exchange...'));
+        const { tokenSnapshot, error: tokenWaitError } = await waitForManualCallbackToken(provider, target, tokenDir, oauthState, knownTokenFiles, expectedAccountId, OAUTH_STATE_TIMEOUT_MS);
+        if (tokenWaitError) {
+            console.log((0, ui_1.fail)(tokenWaitError));
+            (0, account_safety_1.warnPossible403Ban)(provider, tokenWaitError);
+            return null;
+        }
+        if (!tokenSnapshot) {
+            console.log((0, ui_1.fail)('Authentication completed upstream, but no new local token was saved for this account. Update CCS/CLIProxy and retry.'));
+            return null;
+        }
+        const account = (0, token_manager_1.registerAccountFromToken)(provider, tokenDir, nickname, verbose, tokenSnapshot.file);
+        if (!account) {
+            console.log((0, ui_1.fail)('Authenticated token could not be matched to the requested account. Retry the flow.'));
+            return null;
+        }
         console.log((0, ui_1.ok)('Authentication successful!'));
-        const account = (0, token_manager_1.registerAccountFromToken)(provider, tokenDir, nickname, verbose, expectedAccountId);
         // Account safety: check for cross-provider conflicts
         if (account?.email) {
             const conflicts = (0, account_safety_1.checkNewAccountConflict)(provider, account.email);
@@ -349,6 +624,53 @@ async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir,
         return null;
     }
 }
+async function handleGitLabPatLogin(provider, oauthConfig, verbose, tokenDir, nickname, expectedAccountId, options) {
+    const target = (0, proxy_target_resolver_1.getProxyTarget)();
+    const baseUrl = normalizeGitLabBaseUrl(options?.gitlabBaseUrl);
+    const knownTokenFiles = (0, token_manager_1.listProviderTokenSnapshots)(provider, tokenDir);
+    const suppliedToken = options?.gitlabPersonalAccessToken?.trim();
+    const personalAccessToken = suppliedToken || process.env['GITLAB_PERSONAL_ACCESS_TOKEN']?.trim() || undefined;
+    let token = personalAccessToken;
+    if (!token) {
+        console.log('');
+        console.log((0, ui_1.info)(`Starting ${oauthConfig.displayName} PAT login...`));
+        console.log('Paste a Personal Access Token with api and read_user scopes.');
+        token = (await promptGitLabPersonalAccessToken()) || undefined;
+    }
+    if (!token) {
+        console.log((0, ui_1.info)('Cancelled'));
+        return null;
+    }
+    const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, '/v0/management/gitlab-auth-url'), {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(0, proxy_target_resolver_1.buildManagementHeaders)(target),
+        },
+        body: JSON.stringify({
+            ...(baseUrl ? { base_url: baseUrl } : {}),
+            personal_access_token: token,
+        }),
+    });
+    const responseBody = await response.text();
+    const parsedResponse = (0, gitlab_pat_response_1.parseGitLabPatAuthResponse)(response.ok, response.status, responseBody, token);
+    if (!parsedResponse.ok) {
+        console.log((0, ui_1.fail)(parsedResponse.errorMessage));
+        return null;
+    }
+    const tokenSnapshot = (0, token_manager_1.findNewTokenSnapshotForAuthAttempt)(provider, tokenDir, knownTokenFiles, expectedAccountId);
+    if (!tokenSnapshot) {
+        console.log((0, ui_1.fail)('GitLab PAT login completed, but CCS could not find the saved token file.'));
+        return null;
+    }
+    const account = (0, token_manager_1.registerAccountFromToken)(provider, tokenDir, nickname, verbose, expectedAccountId || tokenSnapshot.file);
+    if (!account) {
+        console.log((0, ui_1.fail)('Authenticated GitLab token could not be registered as a CCS account.'));
+        return null;
+    }
+    console.log((0, ui_1.ok)('Authentication successful!'));
+    return account;
+}
 /**
  * Trigger OAuth flow for provider
  * Auto-detects headless environment and uses --no-browser flag accordingly
@@ -358,10 +680,28 @@ async function handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir,
 async function triggerOAuth(provider, options = {}) {
     const oauthConfig = (0, auth_types_1.getOAuthConfig)(provider);
     (0, account_safety_1.warnOAuthBanRisk)(provider);
+    const oauthStartedAt = Date.now();
+    logger.stage('auth', 'cliproxy.oauth.start', 'Triggering OAuth flow', {
+        provider,
+        add: options.add === true,
+        fromUI: options.fromUI === true,
+    });
     const { verbose = false, add = false, fromUI = false, noIncognito = true } = options;
     const acceptAgyRisk = options.acceptAgyRisk === true;
     const { nickname } = options;
     const resolvedKiroMethod = provider === 'kiro' ? (0, auth_types_1.normalizeKiroAuthMethod)(options.kiroMethod) : auth_types_1.DEFAULT_KIRO_AUTH_METHOD;
+    const resolvedKiroIDCFlow = provider === 'kiro' ? (0, auth_types_1.normalizeKiroIDCFlow)(options.kiroIDCFlow) : auth_types_1.DEFAULT_KIRO_IDC_FLOW;
+    const resolvedGitLabAuthMode = provider === 'gitlab' && options.gitlabAuthMode === 'pat' ? 'pat' : 'oauth';
+    let resolvedGitLabBaseUrl;
+    if (provider === 'gitlab') {
+        try {
+            resolvedGitLabBaseUrl = normalizeGitLabBaseUrl(options.gitlabBaseUrl);
+        }
+        catch (error) {
+            console.log((0, ui_1.fail)(error.message));
+            return null;
+        }
+    }
     if (provider === 'agy') {
         if (fromUI && !acceptAgyRisk) {
             console.log((0, ui_1.fail)('Antigravity OAuth blocked: responsibility acknowledgement is missing.'));
@@ -388,11 +728,6 @@ async function triggerOAuth(provider, options = {}) {
         console.log((0, ui_1.fail)(nicknameError));
         return null;
     }
-    // Handle paste-callback mode
-    if (options.pasteCallback) {
-        const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
-        return handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir, nickname, existingNameMatch?.id);
-    }
     // Handle --import flag: skip OAuth and import from Kiro IDE directly
     if (options.import && provider === 'kiro') {
         const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
@@ -407,33 +742,49 @@ async function triggerOAuth(provider, options = {}) {
         console.log('    Use: ccs config -> Accounts -> Add Kiro account -> Method: GitHub OAuth');
         return null;
     }
-    const callbackPort = provider === 'kiro' ? (0, auth_types_1.getKiroCallbackPort)(resolvedKiroMethod) : oauth_port_diagnostics_1.OAUTH_CALLBACK_PORTS[provider];
+    const callbackPort = provider === 'kiro'
+        ? (0, auth_types_1.getKiroCallbackPort)(resolvedKiroMethod, { idcFlow: resolvedKiroIDCFlow })
+        : oauth_port_diagnostics_1.OAUTH_CALLBACK_PORTS[provider];
     const isCLI = !fromUI;
     const headless = options.headless ?? (0, environment_detector_1.isHeadlessEnvironment)();
-    const isDeviceCodeFlow = provider === 'kiro' ? (0, auth_types_1.isKiroDeviceCodeMethod)(resolvedKiroMethod) : callbackPort === null;
-    let authFlag = oauthConfig.authFlag;
-    if (provider === 'kiro') {
-        if (!(0, auth_types_1.isKiroCLIAuthMethod)(resolvedKiroMethod)) {
-            console.log((0, ui_1.fail)(`Kiro auth method '${resolvedKiroMethod}' is not supported by CLI flow.`));
-            console.log('    Use Dashboard management OAuth for this method.');
-            return null;
-        }
-        authFlag = (0, auth_types_1.getKiroCLIAuthFlag)(resolvedKiroMethod);
+    const isDeviceCodeFlow = provider === 'kiro'
+        ? (0, auth_types_1.isKiroDeviceCodeMethod)(resolvedKiroMethod, { idcFlow: resolvedKiroIDCFlow })
+        : callbackPort === null;
+    let selectedPasteCallback = options.pasteCallback === true;
+    if (provider === 'kiro' && !(0, auth_types_1.isKiroCLIAuthMethod)(resolvedKiroMethod)) {
+        console.log((0, ui_1.fail)(`Kiro auth method '${resolvedKiroMethod}' is not supported by CLI flow.`));
+        console.log('    Use Dashboard management OAuth for this method.');
+        return null;
     }
     // Interactive mode selection for headless environments
     // Skip if explicit mode flag provided or device code flow (no callback needed)
-    if (headless && !options.pasteCallback && !options.portForward && !isDeviceCodeFlow) {
+    if (headless && !selectedPasteCallback && !options.portForward && !isDeviceCodeFlow) {
         // Non-interactive environment (piped input) - default to paste mode
         if (!process.stdin.isTTY) {
-            const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
-            return handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir, nickname, existingNameMatch?.id);
+            selectedPasteCallback = true;
         }
-        const mode = await promptOAuthModeChoice(callbackPort);
-        if (mode === 'paste') {
-            const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
-            return handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir, nickname, existingNameMatch?.id);
+        else {
+            const mode = await promptOAuthModeChoice(callbackPort);
+            if (mode === 'paste') {
+                selectedPasteCallback = true;
+            }
+        }
+    }
+    if (provider === 'gitlab' && resolvedGitLabBaseUrl && !selectedPasteCallback) {
+        selectedPasteCallback = true;
+        console.log('');
+        console.log((0, ui_1.info)('GitLab custom base URL selected. Switching to paste-callback mode for OAuth.'));
+    }
+    const useSelectedKiroLocalPasteCallback = selectedPasteCallback &&
+        provider === 'kiro' &&
+        usesKiroLocalCallbackReplay(resolvedKiroMethod, resolvedKiroIDCFlow);
+    const useSelectedKiroDirectCliFlow = provider === 'kiro' && (isDeviceCodeFlow || useSelectedKiroLocalPasteCallback);
+    if (!(selectedPasteCallback && !useSelectedKiroDirectCliFlow)) {
+        const credentialError = getGeminiPlusOAuthCredentialError(provider, (0, binary_manager_1.getStoredConfiguredBackend)());
+        if (credentialError) {
+            console.log((0, ui_1.fail)(credentialError));
+            return null;
         }
-        // mode === 'forward' continues to existing port-forwarding flow below
     }
     if (existingAccounts.length > 0 && !add) {
         console.log('');
@@ -443,6 +794,21 @@ async function triggerOAuth(provider, options = {}) {
             return null;
         }
     }
+    if (provider === 'gitlab' && resolvedGitLabAuthMode === 'pat') {
+        const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
+        return handleGitLabPatLogin(provider, oauthConfig, verbose, tokenDir, nickname, existingNameMatch?.id, {
+            gitlabBaseUrl: resolvedGitLabBaseUrl,
+            gitlabPersonalAccessToken: options.gitlabPersonalAccessToken,
+        });
+    }
+    if (selectedPasteCallback && !useSelectedKiroDirectCliFlow) {
+        const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
+        return handlePasteCallbackMode(provider, oauthConfig, verbose, tokenDir, nickname, existingNameMatch?.id, {
+            kiroMethod: provider === 'kiro' ? resolvedKiroMethod : undefined,
+            gitlabBaseUrl: provider === 'gitlab' ? resolvedGitLabBaseUrl : undefined,
+            add,
+        });
+    }
     // Pre-flight checks (skip for device code flows which don't need callback ports)
     if (!isDeviceCodeFlow && !(await runPreflightChecks(provider, oauthConfig))) {
         return null;
@@ -461,14 +827,19 @@ async function triggerOAuth(provider, options = {}) {
             console.error(`[auth] Freed port ${localCallbackPort} for OAuth callback`);
         }
     }
-    // Build args
-    const args = ['--config', configPath, authFlag];
-    if (headless) {
-        args.push('--no-browser');
+    const processHeadless = selectedPasteCallback && provider === 'kiro' ? true : headless;
+    let args;
+    try {
+        args = buildOAuthArgs(provider, configPath, processHeadless, noIncognito, {
+            kiroMethod: provider === 'kiro' ? resolvedKiroMethod : undefined,
+            kiroIDCStartUrl: options.kiroIDCStartUrl,
+            kiroIDCRegion: options.kiroIDCRegion,
+            kiroIDCFlow: provider === 'kiro' ? resolvedKiroIDCFlow : undefined,
+        });
     }
-    // Kiro-specific: --no-incognito to use normal browser (saves login credentials)
-    if (provider === 'kiro' && noIncognito) {
-        args.push('--no-incognito');
+    catch (error) {
+        console.log((0, ui_1.fail)(error.message));
+        return null;
     }
     // Show step based on flow type
     if (isDeviceCodeFlow) {
@@ -479,7 +850,13 @@ async function triggerOAuth(provider, options = {}) {
     else {
         (0, environment_detector_1.showStep)(2, 4, 'progress', `Starting callback server on port ${callbackPort}...`);
         // Show headless instructions (only for authorization code flows)
-        if (headless) {
+        if (useSelectedKiroLocalPasteCallback) {
+            console.log('');
+            console.log((0, ui_1.info)('Paste-callback mode enabled for Kiro CLI auth.'));
+            console.log('    CCS will print the authorization URL and wait for you to paste the final callback URL.');
+            console.log('');
+        }
+        else if (headless) {
             console.log('');
             console.log((0, ui_1.warn)('PORT FORWARDING REQUIRED'));
             console.log(`    OAuth callback uses localhost:${callbackPort} which must be reachable.`);
@@ -496,11 +873,14 @@ async function triggerOAuth(provider, options = {}) {
         tokenDir,
         oauthConfig,
         callbackPort,
-        headless,
+        headless: processHeadless,
         verbose,
         isCLI,
         nickname,
         expectedAccountId: existingNameMatch?.id,
+        authFlowType: isDeviceCodeFlow ? 'device_code' : 'authorization_code',
+        kiroMethod: provider === 'kiro' ? resolvedKiroMethod : undefined,
+        manualCallback: useSelectedKiroLocalPasteCallback,
     });
     // Show hint for Kiro users about --no-incognito option (first-time auth only)
     if (account && provider === 'kiro' && !noIncognito) {
@@ -516,6 +896,12 @@ async function triggerOAuth(provider, options = {}) {
             (0, account_safety_1.warnNewAccountConflict)(account.email, conflicts);
         }
     }
+    if (account) {
+        logger.stage('auth', 'cliproxy.oauth.success', 'OAuth flow completed successfully', { provider, accountId: account.id }, { latencyMs: Date.now() - oauthStartedAt });
+    }
+    else {
+        logger.stage('cleanup', 'cliproxy.oauth.failed', 'OAuth flow failed or was cancelled', { provider }, { level: 'warn', latencyMs: Date.now() - oauthStartedAt });
+    }
     return account;
 }
 exports.triggerOAuth = triggerOAuth;
@@ -525,6 +911,9 @@ exports.triggerOAuth = triggerOAuth;
  */
 async function ensureAuth(provider, options = {}) {
     if ((0, token_manager_1.isAuthenticated)(provider)) {
+        logger.stage('auth', 'cliproxy.auth.cached', 'Provider already authenticated', {
+            provider,
+        });
         if (options.verbose) {
             console.error(`[auth] ${provider} already authenticated`);
         }
@@ -534,6 +923,9 @@ async function ensureAuth(provider, options = {}) {
         }
         return true;
     }
+    logger.stage('auth', 'cliproxy.auth.required', 'Provider needs authentication', {
+        provider,
+    });
     const oauthConfig = (0, auth_types_1.getOAuthConfig)(provider);
     console.log((0, ui_1.info)(`${oauthConfig.displayName} authentication required`));
     const account = await triggerOAuth(provider, options);