@georgedong32/ccs 7.67.1 → 8.0.0

package/dist/cliproxy/ai-providers/tool-name-sanitizer.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * Tool Name Sanitizer
+ *
+ * Sanitizes MCP tool names to comply with Gemini API constraints:
+ * - Max 64 characters
+ * - Must start with letter or underscore
+ * - Only a-z A-Z 0-9 _ . : - / allowed
+ *
+ * Strategies:
+ * 1. Remove duplicate segments (e.g., gitmcp__foo__foo → gitmcp__foo)
+ * 2. Smart truncate with hash suffix if still >64 chars
+ *
+ * Note: Hash collision risk is ~1 in 16M with 6-char MD5 prefix.
+ * Acceptable for typical MCP tool counts (<1000 tools).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeToolName = exports.smartTruncate = exports.removeDuplicateSegments = exports.isValidToolName = exports.GEMINI_MAX_TOOL_NAME_LENGTH = void 0;
+const crypto_1 = require("crypto");
+/** Maximum tool name length allowed by Gemini API */
+exports.GEMINI_MAX_TOOL_NAME_LENGTH = 64;
+/** Valid characters pattern for Gemini tool names */
+const VALID_CHARS_REGEX = /^[a-zA-Z_][a-zA-Z0-9_.:/-]*$/;
+/**
+ * Check if a tool name is valid for Gemini API.
+ *
+ * Requirements:
+ * - Length <= 64 characters
+ * - Starts with letter or underscore
+ * - Contains only valid characters: a-z A-Z 0-9 _ . : -
+ */
+function isValidToolName(name) {
+    if (!name || name.length === 0) {
+        return false;
+    }
+    if (name.length > exports.GEMINI_MAX_TOOL_NAME_LENGTH) {
+        return false;
+    }
+    return VALID_CHARS_REGEX.test(name);
+}
+exports.isValidToolName = isValidToolName;
+/**
+ * Remove consecutive duplicate segments separated by '__'.
+ *
+ * Examples:
+ * - 'gitmcp__foo__foo' → 'gitmcp__foo'
+ * - 'a__b__c__b__c' → 'a__b__c'
+ * - 'no_dupes' → 'no_dupes'
+ */
+function removeDuplicateSegments(name) {
+    const segments = name.split('__');
+    const deduped = [];
+    for (const segment of segments) {
+        // Only add if different from previous segment
+        if (deduped.length === 0 || deduped[deduped.length - 1] !== segment) {
+            deduped.push(segment);
+        }
+    }
+    return deduped.join('__');
+}
+exports.removeDuplicateSegments = removeDuplicateSegments;
+/**
+ * Generate a short hash from a string for truncation suffix.
+ * Uses first 6 characters of MD5 hash (16M combinations).
+ */
+function generateShortHash(input) {
+    return (0, crypto_1.createHash)('md5').update(input).digest('hex').slice(0, 6);
+}
+/**
+ * Smart truncate a name to fit within maxLen.
+ * Preserves start of name and appends hash suffix for uniqueness.
+ *
+ * Format: <prefix>_<6-char-hash>
+ *
+ * @param name The name to truncate
+ * @param maxLen Maximum allowed length (default: 64)
+ */
+function smartTruncate(name, maxLen = exports.GEMINI_MAX_TOOL_NAME_LENGTH) {
+    if (name.length <= maxLen) {
+        return name;
+    }
+    // Format: prefix + '_' + 6-char hash = 7 chars for suffix
+    const hash = generateShortHash(name);
+    const prefixLen = maxLen - 7; // 7 = '_' (1) + hash (6)
+    const prefix = name.slice(0, prefixLen);
+    return `${prefix}_${hash}`;
+}
+exports.smartTruncate = smartTruncate;
+/**
+ * Force a string to comply with Gemini tool name character rules.
+ * Replaces invalid characters with underscores and ensures the name
+ * starts with a letter or underscore (not a digit, dot, colon, etc.).
+ */
+function forceValidChars(name) {
+    // Replace any character not in [a-zA-Z0-9_.:/-] with underscore
+    let fixed = name.replace(/[^a-zA-Z0-9_.:/-]/g, '_');
+    // Collapse multiple consecutive underscores from replacement
+    fixed = fixed.replace(/_+/g, '_');
+    // Ensure starts with letter or underscore (not digit, dot, colon, hyphen, slash)
+    if (fixed.length > 0 && !/^[a-zA-Z_]/.test(fixed)) {
+        fixed = '_' + fixed;
+    }
+    return fixed || '_';
+}
+/**
+ * Sanitize a tool name to comply with Gemini API constraints.
+ *
+ * Process:
+ * 1. Remove duplicate segments (always, as duplicates are likely unintentional)
+ * 2. Truncate with hash if >64 chars
+ * 3. Force valid characters if still invalid
+ * 4. Truncate again if forced-valid name exceeds limit
+ *
+ * @param name The original tool name
+ * @returns Sanitization result with sanitized name and changed flag
+ */
+function sanitizeToolName(name) {
+    // Step 1: Always try to remove duplicate segments
+    // Duplicates like gitmcp__foo__foo are likely unintentional from MCP naming
+    let sanitized = removeDuplicateSegments(name);
+    // Step 2: Truncate if still too long
+    if (sanitized.length > exports.GEMINI_MAX_TOOL_NAME_LENGTH) {
+        sanitized = smartTruncate(sanitized);
+    }
+    // Step 3: If still invalid, fix characters and truncate if needed
+    if (!isValidToolName(sanitized)) {
+        sanitized = forceValidChars(sanitized);
+        if (sanitized.length > exports.GEMINI_MAX_TOOL_NAME_LENGTH) {
+            sanitized = smartTruncate(sanitized);
+        }
+    }
+    return {
+        sanitized,
+        changed: sanitized !== name,
+    };
+}
+exports.sanitizeToolName = sanitizeToolName;
+//# sourceMappingURL=tool-name-sanitizer.js.map

package/dist/cliproxy/ai-providers/tool-name-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-name-sanitizer.js","sourceRoot":"","sources":["../../../src/cliproxy/ai-providers/tool-name-sanitizer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,mCAAoC;AAEpC,qDAAqD;AACxC,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAE9C,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAUzD;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,mCAA2B,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AARD,0CAQC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAZD,0DAYC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,IAAA,mBAAU,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAAC,IAAY,EAAE,SAAiB,mCAA2B;IACtF,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,yBAAyB;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAExC,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;AAC7B,CAAC;AAXD,sCAWC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,gEAAgE;IAChE,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAEpD,6DAA6D;IAC7D,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAElC,iFAAiF;IACjF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,IAAI,GAAG,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,kDAAkD;IAClD,4EAA4E;IAC5E,IAAI,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAE9C,qCAAqC;IACrC,IAAI,SAAS,CAAC,MAAM,GAAG,mCAA2B,EAAE,CAAC;QACnD,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,MAAM,GAAG,mCAA2B,EAAE,CAAC;YACnD,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,SAAS,KAAK,IAAI;KAC5B,CAAC;AACJ,CAAC;AAtBD,4CAsBC"}

package/dist/cliproxy/auth/antigravity-responsibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-responsibility.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/antigravity-responsibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,eAAO,MAAM,0BAA0B,iDAAiD,CAAC;AACzF,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AACzE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAC/C,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AACtD,eAAO,MAAM,6BAA6B,UAAqD,CAAC;AAEhG,KAAK,cAAc,GAAG,OAAO,GAAG,KAAK,CAAC;AAEtC,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,yBAAyB,EAAE,OAAO,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,gBAAgB;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,cAAc,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD,wBAAgB,wCAAwC,IAAI,OAAO,CAWlE;AAsED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAExE;AAED,wBAAgB,sCAAsC,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAmCzF;AAED,wBAAsB,kCAAkC,CACtD,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAkDlB"}

package/dist/cliproxy/auth/antigravity-responsibility.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * Antigravity OAuth Responsibility Gate
+ *
+ * Enforces explicit user acknowledgement for Antigravity OAuth usage.
+ * This is used by:
+ * - CLI OAuth flow (`ccs agy --auth`)
+ * - CLI runtime flow (`ccs agy`)
+ * - Dashboard auth endpoints (server-side payload validation)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureCliAntigravityResponsibility = exports.validateAntigravityRiskAcknowledgement = exports.hasAntigravityRiskAcceptanceFlag = exports.isAntigravityResponsibilityBypassEnabled = exports.ANTIGRAVITY_ACCEPT_RISK_FLAGS = exports.ANTIGRAVITY_ACK_PHRASE = exports.RISK_ACK_PHRASE = exports.ANTIGRAVITY_ACK_VERSION = exports.ANTIGRAVITY_RISK_ISSUE_URL = void 0;
+const readline_1 = require("readline");
+const ui_1 = require("../../utils/ui");
+const config_loader_facade_1 = require("../../config/config-loader-facade");
+exports.ANTIGRAVITY_RISK_ISSUE_URL = 'https://github.com/kaitranntt/ccs/issues/509';
+exports.ANTIGRAVITY_ACK_VERSION = '2026-02-24-antigravity-oauth-v2';
+exports.RISK_ACK_PHRASE = 'I ACCEPT RISK';
+exports.ANTIGRAVITY_ACK_PHRASE = exports.RISK_ACK_PHRASE;
+exports.ANTIGRAVITY_ACCEPT_RISK_FLAGS = ['--accept-agr-risk', '--accept-antigravity-risk'];
+function normalizePhrase(value) {
+    return value.trim().replace(/\s+/g, ' ').toUpperCase();
+}
+function isTruthyEnv(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes';
+}
+function isAntigravityResponsibilityBypassEnabled() {
+    if (isTruthyEnv(process.env.CCS_ACCEPT_AGY_RISK)) {
+        return true;
+    }
+    try {
+        const safety = (0, config_loader_facade_1.getCliproxySafetyConfig)();
+        return safety.antigravity_ack_bypass === true;
+    }
+    catch {
+        return false;
+    }
+}
+exports.isAntigravityResponsibilityBypassEnabled = isAntigravityResponsibilityBypassEnabled;
+function askQuestion(rl, prompt) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const onClose = () => {
+            if (!settled) {
+                settled = true;
+                resolve(null);
+            }
+        };
+        rl.once('close', onClose);
+        rl.question(prompt, (answer) => {
+            if (settled)
+                return;
+            settled = true;
+            rl.removeListener('close', onClose);
+            resolve(answer.trim());
+        });
+    });
+}
+async function askYesNoStep(rl, step, message) {
+    while (true) {
+        const answer = await askQuestion(rl, `[?] ${step}\n    ${message}\n    Type YES to continue (NO to cancel): `);
+        if (answer === null)
+            return false;
+        const normalized = answer.toUpperCase();
+        if (normalized === 'YES')
+            return true;
+        if (normalized === 'NO' || normalized === 'N' || normalized === '')
+            return false;
+        console.error((0, ui_1.warn)('Please type YES or NO.'));
+    }
+}
+async function askResponsibilityPhrase(rl) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const answer = await askQuestion(rl, `[?] Step 4/4\n    Type exactly "${exports.ANTIGRAVITY_ACK_PHRASE}": `);
+        if (answer === null || answer === '')
+            return false;
+        if (normalizePhrase(answer) === exports.ANTIGRAVITY_ACK_PHRASE) {
+            return true;
+        }
+        console.error((0, ui_1.warn)('Phrase mismatch. Try again.'));
+    }
+    return false;
+}
+function printResponsibilityHeader(context) {
+    const contextLine = context === 'oauth'
+        ? 'You are starting Antigravity OAuth account authorization.'
+        : 'You are starting a live Antigravity CLI session (ccs agy).';
+    console.error('');
+    console.error('╔══════════════════════════════════════════════════════════════════════╗');
+    console.error('║ Antigravity Responsibility Confirmation (Mandatory)                  ║');
+    console.error('╚══════════════════════════════════════════════════════════════════════╝');
+    console.error(`    ${contextLine}`);
+    console.error('    Antigravity has active ban/suspension patterns for risky OAuth usage.');
+    console.error(`    Policy issue: ${exports.ANTIGRAVITY_RISK_ISSUE_URL}`);
+    console.error('');
+}
+function hasAntigravityRiskAcceptanceFlag(args) {
+    return args.some((arg) => exports.ANTIGRAVITY_ACCEPT_RISK_FLAGS.includes(arg));
+}
+exports.hasAntigravityRiskAcceptanceFlag = hasAntigravityRiskAcceptanceFlag;
+function validateAntigravityRiskAcknowledgement(payload) {
+    if (!payload || typeof payload !== 'object') {
+        return {
+            valid: false,
+            error: 'Antigravity OAuth requires a full responsibility acknowledgement payload.',
+        };
+    }
+    const data = payload;
+    if (data.version !== exports.ANTIGRAVITY_ACK_VERSION) {
+        return {
+            valid: false,
+            error: 'Antigravity acknowledgement version mismatch. Re-open add account and try again.',
+        };
+    }
+    if (!data.reviewedIssue509 || !data.understandsBanRisk || !data.acceptsFullResponsibility) {
+        return {
+            valid: false,
+            error: 'Complete all Antigravity responsibility checklist steps before authenticating.',
+        };
+    }
+    if (typeof data.typedPhrase !== 'string' ||
+        normalizePhrase(data.typedPhrase) !== exports.ANTIGRAVITY_ACK_PHRASE) {
+        return {
+            valid: false,
+            error: `Type exact acknowledgement phrase: "${exports.ANTIGRAVITY_ACK_PHRASE}".`,
+        };
+    }
+    return { valid: true };
+}
+exports.validateAntigravityRiskAcknowledgement = validateAntigravityRiskAcknowledgement;
+async function ensureCliAntigravityResponsibility(options) {
+    if (options.acceptedByFlag || isAntigravityResponsibilityBypassEnabled()) {
+        return true;
+    }
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        console.error((0, ui_1.fail)('Antigravity responsibility acknowledgement required.'));
+        console.error('    Re-run interactively and complete the 4-step confirmation.');
+        console.error('    Non-interactive override: --accept-agr-risk');
+        return false;
+    }
+    printResponsibilityHeader(options.context);
+    const rl = (0, readline_1.createInterface)({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        const step1 = await askYesNoStep(rl, 'Step 1/4', 'I reviewed issue #509 and understand AGY OAuth can trigger bans/suspensions.');
+        if (!step1)
+            return false;
+        const step2 = await askYesNoStep(rl, 'Step 2/4', 'I understand this OAuth operation is my own decision and I choose to continue.');
+        if (!step2)
+            return false;
+        const step3 = await askYesNoStep(rl, 'Step 3/4', 'I accept that CCS provides no responsibility coverage for account loss, bans, or suspension.');
+        if (!step3)
+            return false;
+        const step4 = await askResponsibilityPhrase(rl);
+        if (!step4)
+            return false;
+        console.error((0, ui_1.ok)('Antigravity responsibility acknowledgement accepted for this command.'));
+        console.error((0, ui_1.info)('Proceeding with Antigravity flow...'));
+        return true;
+    }
+    finally {
+        rl.close();
+    }
+}
+exports.ensureCliAntigravityResponsibility = ensureCliAntigravityResponsibility;
+//# sourceMappingURL=antigravity-responsibility.js.map

package/dist/cliproxy/auth/antigravity-responsibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity-responsibility.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/antigravity-responsibility.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,uCAAsD;AACtD,uCAAsD;AACtD,4EAA4E;AAE/D,QAAA,0BAA0B,GAAG,8CAA8C,CAAC;AAC5E,QAAA,uBAAuB,GAAG,iCAAiC,CAAC;AAC5D,QAAA,eAAe,GAAG,eAAe,CAAC;AAClC,QAAA,sBAAsB,GAAG,uBAAe,CAAC;AACzC,QAAA,6BAA6B,GAAG,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;AAsBhG,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,CAAC;AAC7E,CAAC;AAED,SAAgB,wCAAwC;IACtD,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,8CAAuB,GAAE,CAAC;QACzC,OAAO,MAAM,CAAC,sBAAsB,KAAK,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAXD,4FAWC;AAED,SAAS,WAAW,CAAC,EAAa,EAAE,MAAc;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QAEF,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe;IACtE,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,EAAE,EACF,OAAO,IAAI,SAAS,OAAO,6CAA6C,CACzE,CAAC;QAEF,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACjF,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,wBAAwB,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAa;IAClD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,EAAE,EACF,mCAAmC,8BAAsB,KAAK,CAC/D,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAEnD,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,8BAAsB,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,6BAA6B,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAuB;IACxD,MAAM,WAAW,GACf,OAAO,KAAK,OAAO;QACjB,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,4DAA4D,CAAC;IAEnE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,OAAO,CAAC,KAAK,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,CAAC,qBAAqB,kCAA0B,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,gCAAgC,CAAC,IAAc;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qCAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAFD,4EAEC;AAED,SAAgB,sCAAsC,CAAC,OAAgB;IACrE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,2EAA2E;SACnF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAkD,CAAC;IAEhE,IAAI,IAAI,CAAC,OAAO,KAAK,+BAAuB,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,kFAAkF;SAC1F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1F,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,gFAAgF;SACxF,CAAC;IACJ,CAAC;IAED,IACE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,8BAAsB,EAC5D,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,uCAAuC,8BAAsB,IAAI;SACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAnCD,wFAmCC;AAEM,KAAK,UAAU,kCAAkC,CACtD,OAA6B;IAE7B,IAAI,OAAO,CAAC,cAAc,IAAI,wCAAwC,EAAE,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,sDAAsD,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,EAAE,EACF,UAAU,EACV,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,EAAE,EACF,UAAU,EACV,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,EAAE,EACF,UAAU,EACV,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,OAAO,CAAC,KAAK,CAAC,IAAA,OAAE,EAAC,uEAAuE,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,qCAAqC,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AApDD,gFAoDC"}

package/dist/cliproxy/auth/auth-handler.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Auth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication for CLIProxy providers (Gemini, Codex, Antigravity).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ *
+ * Token storage: ~/.ccs/cliproxy/auth/<provider>/
+ * Each provider has its own directory to avoid conflicts.
+ *
+ * This file is a facade that re-exports from the auth/ submodule.
+ * The actual implementation is split across:
+ * - auth/auth-types.ts     - Types and OAuth configurations
+ * - auth/token-manager.ts  - Token storage/retrieval/validation
+ * - auth/oauth-handler.ts  - OAuth flow handling
+ * - auth/environment-detector.ts - Headless detection and port management
+ */
+export type { AuthStatus, ProviderOAuthConfig, OAuthOptions } from '.';
+export { OAUTH_CALLBACK_PORTS, OAUTH_CONFIGS, PROVIDER_AUTH_PREFIXES, PROVIDER_TYPE_VALUES, getOAuthConfig, } from '.';
+export { getProviderTokenDir, isTokenFileForProvider, isAuthenticated, getAuthStatus, getAllAuthStatus, clearAuth, displayAuthStatus, } from '.';
+export { isHeadlessEnvironment, killProcessOnPort, getTimeoutTroubleshooting, showStep } from '.';
+export { triggerOAuth, ensureAuth } from '.';
+/**
+ * Initialize accounts registry from existing tokens
+ * Should be called on startup to populate accounts from existing token files
+ */
+export declare function initializeAccounts(): void;
+//# sourceMappingURL=auth-handler.d.ts.map

package/dist/cliproxy/auth/auth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,GAAG,CAAC;AAGvE,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,GAAG,CAAC;AAGX,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,iBAAiB,GAClB,MAAM,GAAG,CAAC;AAGX,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC;AAGlG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC;AAK7C;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/cliproxy/auth/auth-handler.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Auth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication for CLIProxy providers (Gemini, Codex, Antigravity).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ *
+ * Token storage: ~/.ccs/cliproxy/auth/<provider>/
+ * Each provider has its own directory to avoid conflicts.
+ *
+ * This file is a facade that re-exports from the auth/ submodule.
+ * The actual implementation is split across:
+ * - auth/auth-types.ts     - Types and OAuth configurations
+ * - auth/token-manager.ts  - Token storage/retrieval/validation
+ * - auth/oauth-handler.ts  - OAuth flow handling
+ * - auth/environment-detector.ts - Headless detection and port management
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initializeAccounts = exports.ensureAuth = exports.triggerOAuth = exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = exports.displayAuthStatus = exports.clearAuth = exports.getAllAuthStatus = exports.getAuthStatus = exports.isAuthenticated = exports.isTokenFileForProvider = exports.getProviderTokenDir = exports.getOAuthConfig = exports.PROVIDER_TYPE_VALUES = exports.PROVIDER_AUTH_PREFIXES = exports.OAUTH_CONFIGS = exports.OAUTH_CALLBACK_PORTS = void 0;
+// Re-export configurations
+var _1 = require(".");
+Object.defineProperty(exports, "OAUTH_CALLBACK_PORTS", { enumerable: true, get: function () { return _1.OAUTH_CALLBACK_PORTS; } });
+Object.defineProperty(exports, "OAUTH_CONFIGS", { enumerable: true, get: function () { return _1.OAUTH_CONFIGS; } });
+Object.defineProperty(exports, "PROVIDER_AUTH_PREFIXES", { enumerable: true, get: function () { return _1.PROVIDER_AUTH_PREFIXES; } });
+Object.defineProperty(exports, "PROVIDER_TYPE_VALUES", { enumerable: true, get: function () { return _1.PROVIDER_TYPE_VALUES; } });
+Object.defineProperty(exports, "getOAuthConfig", { enumerable: true, get: function () { return _1.getOAuthConfig; } });
+// Re-export token management functions
+var _2 = require(".");
+Object.defineProperty(exports, "getProviderTokenDir", { enumerable: true, get: function () { return _2.getProviderTokenDir; } });
+Object.defineProperty(exports, "isTokenFileForProvider", { enumerable: true, get: function () { return _2.isTokenFileForProvider; } });
+Object.defineProperty(exports, "isAuthenticated", { enumerable: true, get: function () { return _2.isAuthenticated; } });
+Object.defineProperty(exports, "getAuthStatus", { enumerable: true, get: function () { return _2.getAuthStatus; } });
+Object.defineProperty(exports, "getAllAuthStatus", { enumerable: true, get: function () { return _2.getAllAuthStatus; } });
+Object.defineProperty(exports, "clearAuth", { enumerable: true, get: function () { return _2.clearAuth; } });
+Object.defineProperty(exports, "displayAuthStatus", { enumerable: true, get: function () { return _2.displayAuthStatus; } });
+// Re-export environment detection functions
+var _3 = require(".");
+Object.defineProperty(exports, "isHeadlessEnvironment", { enumerable: true, get: function () { return _3.isHeadlessEnvironment; } });
+Object.defineProperty(exports, "killProcessOnPort", { enumerable: true, get: function () { return _3.killProcessOnPort; } });
+Object.defineProperty(exports, "getTimeoutTroubleshooting", { enumerable: true, get: function () { return _3.getTimeoutTroubleshooting; } });
+Object.defineProperty(exports, "showStep", { enumerable: true, get: function () { return _3.showStep; } });
+// Re-export OAuth handling functions
+var _4 = require(".");
+Object.defineProperty(exports, "triggerOAuth", { enumerable: true, get: function () { return _4.triggerOAuth; } });
+Object.defineProperty(exports, "ensureAuth", { enumerable: true, get: function () { return _4.ensureAuth; } });
+// Re-export account management initialization
+const account_manager_1 = require("../accounts/account-manager");
+/**
+ * Initialize accounts registry from existing tokens
+ * Should be called on startup to populate accounts from existing token files
+ */
+function initializeAccounts() {
+    (0, account_manager_1.discoverExistingAccounts)();
+}
+exports.initializeAccounts = initializeAccounts;
+//# sourceMappingURL=auth-handler.js.map

package/dist/cliproxy/auth/auth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handler.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAKH,2BAA2B;AAC3B,sBAMW;AALT,wGAAA,oBAAoB,OAAA;AACpB,iGAAA,aAAa,OAAA;AACb,0GAAA,sBAAsB,OAAA;AACtB,wGAAA,oBAAoB,OAAA;AACpB,kGAAA,cAAc,OAAA;AAGhB,uCAAuC;AACvC,sBAQW;AAPT,uGAAA,mBAAmB,OAAA;AACnB,0GAAA,sBAAsB,OAAA;AACtB,mGAAA,eAAe,OAAA;AACf,iGAAA,aAAa,OAAA;AACb,oGAAA,gBAAgB,OAAA;AAChB,6FAAA,SAAS,OAAA;AACT,qGAAA,iBAAiB,OAAA;AAGnB,4CAA4C;AAC5C,sBAAkG;AAAzF,yGAAA,qBAAqB,OAAA;AAAE,qGAAA,iBAAiB,OAAA;AAAE,6GAAA,yBAAyB,OAAA;AAAE,4FAAA,QAAQ,OAAA;AAEtF,qCAAqC;AACrC,sBAA6C;AAApC,gGAAA,YAAY,OAAA;AAAE,8FAAA,UAAU,OAAA;AAEjC,8CAA8C;AAC9C,iEAAuE;AAEvE;;;GAGG;AACH,SAAgB,kBAAkB;IAChC,IAAA,0CAAwB,GAAE,CAAC;AAC7B,CAAC;AAFD,gDAEC"}

package/dist/cliproxy/auth/auth-session-manager.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Auth Session Manager
+ *
+ * Tracks active OAuth sessions and provides cancellation capability.
+ * Used to properly terminate in-progress OAuth flows from UI.
+ */
+/// <reference types="node" />
+/// <reference types="node" />
+import { EventEmitter } from 'events';
+import { ChildProcess } from 'child_process';
+export interface ActiveAuthSession {
+    sessionId: string;
+    provider: string;
+    startedAt: number;
+    process?: ChildProcess;
+}
+export declare const authSessionEvents: EventEmitter<[never]>;
+/**
+ * Register an active OAuth session
+ */
+export declare function registerAuthSession(sessionId: string, provider: string, process?: ChildProcess): void;
+/**
+ * Update session with process reference (if registered before spawn)
+ */
+export declare function attachProcessToSession(sessionId: string, process: ChildProcess): void;
+/**
+ * Unregister an auth session (on completion or cancellation)
+ */
+export declare function unregisterAuthSession(sessionId: string): void;
+/**
+ * Cancel an active OAuth session
+ * Returns true if session was found and killed
+ */
+export declare function cancelAuthSession(sessionId: string): boolean;
+/**
+ * Get active session by session ID
+ */
+export declare function getActiveSession(sessionId: string): ActiveAuthSession | null;
+/**
+ * Get active session for a provider (most recent by startedAt)
+ */
+export declare function getActiveSessionForProvider(provider: string): ActiveAuthSession | null;
+/**
+ * Check if there's an active session for provider
+ */
+export declare function hasActiveSession(provider: string): boolean;
+/**
+ * Cancel all sessions for a provider
+ */
+export declare function cancelAllSessionsForProvider(provider: string): number;
+//# sourceMappingURL=auth-session-manager.d.ts.map

package/dist/cliproxy/auth/auth-session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-manager.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAK7C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,eAAO,MAAM,iBAAiB,uBAAqB,CAAC;AAiCpD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CAUN;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAKrF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAI7D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAe5D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAE5E;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQtF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAcrE"}

package/dist/cliproxy/auth/auth-session-manager.js

@@ -0,0 +1,141 @@
+"use strict";
+/**
+ * Auth Session Manager
+ *
+ * Tracks active OAuth sessions and provides cancellation capability.
+ * Used to properly terminate in-progress OAuth flows from UI.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cancelAllSessionsForProvider = exports.hasActiveSession = exports.getActiveSessionForProvider = exports.getActiveSession = exports.cancelAuthSession = exports.unregisterAuthSession = exports.attachProcessToSession = exports.registerAuthSession = exports.authSessionEvents = void 0;
+const events_1 = require("events");
+// H8: TTL for stale session cleanup (10 minutes - generous for OAuth flows)
+const SESSION_TTL_MS = 10 * 60 * 1000;
+exports.authSessionEvents = new events_1.EventEmitter();
+const activeSessions = new Map();
+// H8: Periodic cleanup of stale sessions (prevents memory leak from orphaned sessions)
+let cleanupInterval = null;
+function startCleanupInterval() {
+    if (cleanupInterval)
+        return;
+    cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [sessionId, session] of activeSessions.entries()) {
+            if (now - session.startedAt > SESSION_TTL_MS) {
+                // Stale session - kill process if still running, then remove
+                if (session.process && !session.process.killed) {
+                    session.process.kill('SIGTERM');
+                }
+                activeSessions.delete(sessionId);
+                exports.authSessionEvents.emit('session:expired', sessionId);
+            }
+        }
+        stopCleanupIfEmpty();
+    }, 60000); // Check every minute
+}
+/** Clear the cleanup interval when no sessions remain. */
+function stopCleanupIfEmpty() {
+    if (activeSessions.size === 0 && cleanupInterval) {
+        clearInterval(cleanupInterval);
+        cleanupInterval = null;
+    }
+}
+/**
+ * Register an active OAuth session
+ */
+function registerAuthSession(sessionId, provider, process) {
+    activeSessions.set(sessionId, {
+        sessionId,
+        provider,
+        startedAt: Date.now(),
+        process,
+    });
+    // H8: Start TTL cleanup when first session registered
+    startCleanupInterval();
+    exports.authSessionEvents.emit('session:started', sessionId, provider);
+}
+exports.registerAuthSession = registerAuthSession;
+/**
+ * Update session with process reference (if registered before spawn)
+ */
+function attachProcessToSession(sessionId, process) {
+    const session = activeSessions.get(sessionId);
+    if (session) {
+        session.process = process;
+    }
+}
+exports.attachProcessToSession = attachProcessToSession;
+/**
+ * Unregister an auth session (on completion or cancellation)
+ */
+function unregisterAuthSession(sessionId) {
+    activeSessions.delete(sessionId);
+    exports.authSessionEvents.emit('session:ended', sessionId);
+    stopCleanupIfEmpty();
+}
+exports.unregisterAuthSession = unregisterAuthSession;
+/**
+ * Cancel an active OAuth session
+ * Returns true if session was found and killed
+ */
+function cancelAuthSession(sessionId) {
+    const session = activeSessions.get(sessionId);
+    if (!session) {
+        return false;
+    }
+    // Kill the process if attached
+    if (session.process && !session.process.killed) {
+        session.process.kill('SIGTERM');
+    }
+    activeSessions.delete(sessionId);
+    exports.authSessionEvents.emit('session:cancelled', sessionId);
+    stopCleanupIfEmpty();
+    return true;
+}
+exports.cancelAuthSession = cancelAuthSession;
+/**
+ * Get active session by session ID
+ */
+function getActiveSession(sessionId) {
+    return activeSessions.get(sessionId) || null;
+}
+exports.getActiveSession = getActiveSession;
+/**
+ * Get active session for a provider (most recent by startedAt)
+ */
+function getActiveSessionForProvider(provider) {
+    let latest = null;
+    for (const session of activeSessions.values()) {
+        if (session.provider === provider && (!latest || session.startedAt > latest.startedAt)) {
+            latest = session;
+        }
+    }
+    return latest;
+}
+exports.getActiveSessionForProvider = getActiveSessionForProvider;
+/**
+ * Check if there's an active session for provider
+ */
+function hasActiveSession(provider) {
+    return getActiveSessionForProvider(provider) !== null;
+}
+exports.hasActiveSession = hasActiveSession;
+/**
+ * Cancel all sessions for a provider
+ */
+function cancelAllSessionsForProvider(provider) {
+    let count = 0;
+    for (const [sessionId, session] of activeSessions.entries()) {
+        if (session.provider === provider) {
+            if (session.process && !session.process.killed) {
+                session.process.kill('SIGTERM');
+            }
+            activeSessions.delete(sessionId);
+            exports.authSessionEvents.emit('session:cancelled', sessionId);
+            count++;
+        }
+    }
+    stopCleanupIfEmpty();
+    return count;
+}
+exports.cancelAllSessionsForProvider = cancelAllSessionsForProvider;
+//# sourceMappingURL=auth-session-manager.js.map

package/dist/cliproxy/auth/auth-session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-manager.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-session-manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,mCAAsC;AAGtC,4EAA4E;AAC5E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AASzB,QAAA,iBAAiB,GAAG,IAAI,qBAAY,EAAE,CAAC;AAEpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE5D,uFAAuF;AACvF,IAAI,eAAe,GAA0C,IAAI,CAAC;AAElE,SAAS,oBAAoB;IAC3B,IAAI,eAAe;QAAE,OAAO;IAC5B,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;gBAC7C,6DAA6D;gBAC7D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClC,CAAC;gBACD,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,yBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,kBAAkB,EAAE,CAAC;IACvB,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB;AAClC,CAAC;AAED,0DAA0D;AAC1D,SAAS,kBAAkB;IACzB,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QACjD,aAAa,CAAC,eAAe,CAAC,CAAC;QAC/B,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,SAAiB,EACjB,QAAgB,EAChB,OAAsB;IAEtB,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE;QAC5B,SAAS;QACT,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,OAAO;KACR,CAAC,CAAC;IACH,sDAAsD;IACtD,oBAAoB,EAAE,CAAC;IACvB,yBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAdD,kDAcC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,OAAqB;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IAC5B,CAAC;AACH,CAAC;AALD,wDAKC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,yBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACnD,kBAAkB,EAAE,CAAC;AACvB,CAAC;AAJD,sDAIC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,SAAiB;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,yBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACvD,kBAAkB,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAfD,8CAeC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAFD,4CAEC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CAAC,QAAgB;IAC1D,IAAI,MAAM,GAA6B,IAAI,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvF,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AARD,kEAQC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,2BAA2B,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AACxD,CAAC;AAFD,4CAEC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;YACD,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,yBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACvD,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,kBAAkB,EAAE,CAAC;IACrB,OAAO,KAAK,CAAC;AACf,CAAC;AAdD,oEAcC"}

package/dist/cliproxy/auth/auth-token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-manager.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-token-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAK,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAkB/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,CAUrD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAYhE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAY1E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAqBtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAW1C;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI;IAChC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,gBAAgB,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAgBA"}