@goodandready/dsh-subscriptions 0.6.50 → 0.6.51

package/lib/blob.js

@@ -2,6 +2,33 @@ function asString(value) {
   return value == null ? "" : String(value)
 }
 
+export function normalizeExpiresAt(raw) {
+  if (raw == null || raw === "") return 0
+  if (typeof raw === "number") {
+    if (!Number.isFinite(raw) || raw <= 0) return 0
+    return raw < 1e11 ? Math.floor(raw * 1000) : Math.floor(raw)
+  }
+  if (typeof raw === "string") {
+    const trimmed = raw.trim()
+    if (!trimmed) return 0
+    if (/^\d+(\.\d+)?$/.test(trimmed)) {
+      const num = Number(trimmed)
+      if (!Number.isFinite(num) || num <= 0) return 0
+      return num < 1e11 ? Math.floor(num * 1000) : Math.floor(num)
+    }
+    const parsed = Date.parse(trimmed)
+    if (Number.isFinite(parsed) && parsed > 0) {
+      return parsed
+    }
+    return 0
+  }
+  if (raw instanceof Date) {
+    const t = raw.getTime()
+    return Number.isFinite(t) && t > 0 ? t : 0
+  }
+  return 0
+}
+
 export function serializeBlob(obj) {
   if (!obj || typeof obj !== "object") throw new Error("invalid oauth blob")
   const accessToken = asString(obj.accessToken)
@@ -13,11 +40,14 @@ export function serializeBlob(obj) {
     ...obj,
     accessToken,
     refreshToken,
-    expiresAt: Number(obj.expiresAt) || 0,
+    expiresAt: normalizeExpiresAt(obj.expiresAt),
     label: asString(obj.label),
     email: asString(obj.email),
     accountId: asString(obj.accountId),
     projectId: asString(obj.projectId),
+    ...(obj.clientId ? { clientId: asString(obj.clientId) } : {}),
+    ...(obj.clientSecret ? { clientSecret: asString(obj.clientSecret) } : {}),
+    ...(obj.idToken ? { idToken: asString(obj.idToken) } : {}),
     ...(Array.isArray(obj.usage) ? { usage: obj.usage } : {}),
     ...(obj.usageAt ? { usageAt: Number(obj.usageAt) } : {}),
   })
@@ -30,11 +60,14 @@ export function parseBlob(text) {
     ...obj,
     accessToken: asString(obj.accessToken),
     refreshToken: asString(obj.refreshToken),
-    expiresAt: Number(obj.expiresAt) || 0,
+    expiresAt: normalizeExpiresAt(obj.expiresAt),
     label: asString(obj.label),
     email: asString(obj.email),
     accountId: asString(obj.accountId),
     projectId: asString(obj.projectId),
+    ...(obj.clientId ? { clientId: asString(obj.clientId) } : {}),
+    ...(obj.clientSecret ? { clientSecret: asString(obj.clientSecret) } : {}),
+    ...(obj.idToken ? { idToken: asString(obj.idToken) } : {}),
     ...(Array.isArray(obj.usage) ? { usage: obj.usage } : {}),
     ...(obj.usageAt ? { usageAt: Number(obj.usageAt) } : {}),
   }

package/lib/import-auth.js

@@ -2,6 +2,8 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
+import { normalizeExpiresAt } from './blob.js'
+import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -67,17 +69,20 @@ async function discoverLocalCliSessionsInner() {
   // 3. Antigravity / Gemini CLI
   const agyPaths = [
     homeFile('.gemini', 'antigravity-cli', 'antigravity-oauth-token'),
+    homeFile('.gemini', 'oauth_creds.json'),
     homeFile('.cli-proxy-api', 'antigravity.json'),
   ]
   for (const p of agyPaths) {
     const agy = await readJson(p)
     const tok = agy && agy.token ? agy.token : agy
     if (tok && (tok.access_token || tok.accessToken)) {
+      const idToken = agy?.id_token || agy?.idToken || tok?.id_token || tok?.idToken || ''
+      const email = agy?.email || tok?.account || (idToken ? emailFromToken(idToken) : '') || ''
       detected.antigravity = {
         provider: 'antigravity',
         source: 'file',
         path: p,
-        email: agy.email || tok.account || '',
+        email: email || 'Antigravity User',
         hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
       }
       break
@@ -331,12 +336,35 @@ export async function loadLocalCliBlob(provider, options = {}) {
 
   if (canonical === 'antigravity') {
     const tok = raw.token || raw
+    const idToken = raw.id_token || raw.idToken || tok.id_token || tok.idToken || ''
+
+    const directClientId = raw.client_id || raw.clientId || tok.client_id || tok.clientId ||
+      raw.installed?.client_id || raw.web?.client_id || ''
+    let clientId = ''
+    if (typeof directClientId === 'string' && isGoogleClientId(directClientId)) {
+      clientId = directClientId.trim()
+    } else if (idToken) {
+      clientId = extractGoogleClientIdFromJwt(idToken)
+    }
+
+    const directSecret = raw.client_secret || raw.clientSecret || tok.client_secret || tok.clientSecret ||
+      raw.installed?.client_secret || raw.web?.client_secret || ''
+    const clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
+
+    const rawExpiry = tok.expiry ?? tok.expires_at ?? tok.expiresAt ?? tok.expiry_date ?? raw.expiry_date ?? raw.expiry ?? (tok.expires_in ? Date.now() + Number(tok.expires_in) * 1000 : 0)
+    const expiresAt = normalizeExpiresAt(rawExpiry)
+
+    const email = raw.email || tok.account || (idToken ? emailFromToken(idToken) : '') || ''
+
     return {
       accessToken: tok.access_token || tok.accessToken || '',
       refreshToken: tok.refresh_token || tok.refreshToken || '',
-      expiresAt: tok.expiry || tok.expires_at || tok.expiresAt || (Date.now() + 3600 * 1000),
-      email: raw.email || tok.account || '',
+      expiresAt,
+      email,
       projectId: raw.project_id || raw.projectId || tok.project_id || '',
+      ...(clientId ? { clientId } : {}),
+      ...(clientSecret ? { clientSecret } : {}),
+      ...(idToken ? { idToken } : {}),
     }
   }
 

package/lib/jwt.js

@@ -26,3 +26,36 @@ export function emailFromToken(token) {
   if (!payload) return ''
   return String(payload.email || payload.preferred_username || '')
 }
+
+export function isGoogleClientId(str) {
+  if (typeof str !== 'string') return false
+  const trimmed = str.trim()
+  return /^[0-9]+-[a-zA-Z0-9_-]+\.apps\.googleusercontent\.com$/.test(trimmed)
+}
+
+export function extractGoogleClientIdFromJwt(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== 'object') return ''
+
+  const azp = typeof payload.azp === 'string' ? payload.azp.trim() : ''
+  const rawAud = payload.aud
+
+  const audiences = Array.isArray(rawAud)
+    ? rawAud.filter(a => typeof a === 'string').map(a => a.trim())
+    : (typeof rawAud === 'string' && rawAud.trim() ? [rawAud.trim()] : [])
+
+  if (azp) {
+    if (!isGoogleClientId(azp)) return ''
+    if (audiences.length > 0 && !audiences.includes(azp)) {
+      return ''
+    }
+    return azp
+  }
+
+  const validAuds = audiences.filter(isGoogleClientId)
+  if (validAuds.length === 1 && (audiences.length === 1 || audiences.every(a => a === validAuds[0]))) {
+    return validAuds[0]
+  }
+
+  return ''
+}

package/lib/vendors/antigravity.js

@@ -109,15 +109,25 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
     redirect_uri: cfg.redirectUri,
     code_verifier: pkce.verifier,
   }, fetchImpl)
-  const blob = tokenBlobFromOAuth(json)
+  const blob = tokenBlobFromOAuth(json, {
+    clientId: cfg.clientId,
+    ...(cfg.clientSecret ? { clientSecret: cfg.clientSecret } : {}),
+  })
   const labeled = { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Antigravity' }
   return withProject(labeled, fetchImpl)
 }
 
 export async function refresh(cfg, blob, fetchImpl) {
+  const clientId = (cfg?.clientId && String(cfg.clientId).trim()) || (blob?.clientId && String(blob.clientId).trim()) || ''
+  const clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
+
+  if (!clientId) {
+    throw new Error('Google OAuth refresh requires a Client ID. Configure antigravityClientId in plugin settings or re-import credentials with valid OAuth client metadata.')
+  }
+
   const json = await formTokenRequest(TOKEN, {
-    client_id: cfg.clientId,
-    client_secret: cfg.clientSecret || '',
+    client_id: clientId,
+    ...(clientSecret ? { client_secret: clientSecret } : {}),
     grant_type: 'refresh_token',
     refresh_token: blob.refreshToken,
   }, fetchImpl)
@@ -128,6 +138,8 @@ export async function refresh(cfg, blob, fetchImpl) {
     paidTierId: blob.paidTierId,
     paidTierName: blob.paidTierName,
     sessionId: blob.sessionId,
+    clientId,
+    ...(clientSecret ? { clientSecret } : {}),
   })
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.50",
+  "version": "0.6.51",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",