@hanzo/browser-extension 1.7.5 → 1.7.6

package/dist/browser-extension/background-firefox.js

@@ -27,7 +27,8 @@
   function generateState() {
     return generateRandomString(32);
   }
-  var IAM_BASE = "https://hanzo.id";
+  var IAM_LOGIN = "https://hanzo.id";
+  var IAM_API = "https://iam.hanzo.ai";
   var CLIENT_ID = "app-hanzo";
   var SCOPES = "openid profile email";
   function getRedirectUri() {
@@ -69,7 +70,7 @@
     const { codeVerifier, codeChallenge } = await generatePkceChallenge();
     const state = generateState();
     const redirectUri = getRedirectUri();
-    const authorizeUrl = new URL(`${IAM_BASE}/login/oauth/authorize`);
+    const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
     authorizeUrl.searchParams.set("client_id", CLIENT_ID);
     authorizeUrl.searchParams.set("response_type", "code");
     authorizeUrl.searchParams.set("redirect_uri", redirectUri);
@@ -82,28 +83,39 @@
     const returnedState = url.searchParams.get("state");
     if (returnedState !== state) throw new Error("State mismatch \u2014 possible CSRF");
     const code = url.searchParams.get("code");
-    if (!code) {
-      const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code";
+    const directToken = url.searchParams.get("access_token");
+    if (directToken) {
+      const tokens = {
+        access_token: directToken,
+        refresh_token: url.searchParams.get("refresh_token") || void 0,
+        token_type: "Bearer"
+      };
+      await storeTokens(tokens);
+    } else if (code) {
+      const tokenResponse = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          grant_type: "authorization_code",
+          client_id: CLIENT_ID,
+          code,
+          redirect_uri: redirectUri,
+          code_verifier: codeVerifier
+        })
+      });
+      if (!tokenResponse.ok) {
+        const errText = await tokenResponse.text();
+        throw new Error(`Token exchange failed: ${errText}`);
+      }
+      const tokens = await tokenResponse.json();
+      await storeTokens(tokens);
+    } else {
+      const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code or token";
       throw new Error(error);
     }
-    const tokenResponse = await fetch(`${IAM_BASE}/oauth/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: codeVerifier
-      })
-    });
-    if (!tokenResponse.ok) {
-      const errText = await tokenResponse.text();
-      throw new Error(`Token exchange failed: ${errText}`);
-    }
-    const tokens = await tokenResponse.json();
-    await storeTokens(tokens);
-    const user = await fetchUserInfo(tokens.access_token);
+    const { accessToken } = await getStoredTokens();
+    if (!accessToken) throw new Error("Login succeeded but no token was stored");
+    const user = await fetchUserInfo(accessToken);
     await chrome.storage.local.set({ [STORAGE_KEYS.user]: user });
     return user;
   }
@@ -167,10 +179,10 @@
     return accessToken;
   }
   async function refreshAccessToken(refreshToken) {
-    const response = await fetch(`${IAM_BASE}/oauth/token`, {
+    const response = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
       method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
         grant_type: "refresh_token",
         client_id: CLIENT_ID,
         refresh_token: refreshToken
@@ -182,7 +194,7 @@
     return tokens.access_token;
   }
   async function fetchUserInfo(accessToken) {
-    const response = await fetch(`${IAM_BASE}/oauth/userinfo`, {
+    const response = await fetch(`${IAM_API}/api/userinfo`, {
       headers: { Authorization: `Bearer ${accessToken}` }
     });
     if (!response.ok) throw new Error("Failed to fetch user info");

package/dist/browser-extension/background.js

@@ -1608,7 +1608,8 @@ async function generatePkceChallenge() {
 function generateState() {
   return generateRandomString(32);
 }
-var IAM_BASE = "https://hanzo.id";
+var IAM_LOGIN = "https://hanzo.id";
+var IAM_API = "https://iam.hanzo.ai";
 var CLIENT_ID = "app-hanzo";
 var SCOPES = "openid profile email";
 function getRedirectUri() {
@@ -1650,7 +1651,7 @@ async function login() {
   const { codeVerifier, codeChallenge } = await generatePkceChallenge();
   const state = generateState();
   const redirectUri = getRedirectUri();
-  const authorizeUrl = new URL(`${IAM_BASE}/login/oauth/authorize`);
+  const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
   authorizeUrl.searchParams.set("client_id", CLIENT_ID);
   authorizeUrl.searchParams.set("response_type", "code");
   authorizeUrl.searchParams.set("redirect_uri", redirectUri);
@@ -1663,28 +1664,39 @@ async function login() {
   const returnedState = url.searchParams.get("state");
   if (returnedState !== state) throw new Error("State mismatch \u2014 possible CSRF");
   const code = url.searchParams.get("code");
-  if (!code) {
-    const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code";
+  const directToken = url.searchParams.get("access_token");
+  if (directToken) {
+    const tokens = {
+      access_token: directToken,
+      refresh_token: url.searchParams.get("refresh_token") || void 0,
+      token_type: "Bearer"
+    };
+    await storeTokens(tokens);
+  } else if (code) {
+    const tokenResponse = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier
+      })
+    });
+    if (!tokenResponse.ok) {
+      const errText = await tokenResponse.text();
+      throw new Error(`Token exchange failed: ${errText}`);
+    }
+    const tokens = await tokenResponse.json();
+    await storeTokens(tokens);
+  } else {
+    const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code or token";
     throw new Error(error);
   }
-  const tokenResponse = await fetch(`${IAM_BASE}/oauth/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      redirect_uri: redirectUri,
-      code_verifier: codeVerifier
-    })
-  });
-  if (!tokenResponse.ok) {
-    const errText = await tokenResponse.text();
-    throw new Error(`Token exchange failed: ${errText}`);
-  }
-  const tokens = await tokenResponse.json();
-  await storeTokens(tokens);
-  const user = await fetchUserInfo(tokens.access_token);
+  const { accessToken } = await getStoredTokens();
+  if (!accessToken) throw new Error("Login succeeded but no token was stored");
+  const user = await fetchUserInfo(accessToken);
   await chrome.storage.local.set({ [STORAGE_KEYS.user]: user });
   return user;
 }
@@ -1749,10 +1761,10 @@ async function getValidAccessToken() {
   return accessToken;
 }
 async function refreshAccessToken(refreshToken) {
-  const response = await fetch(`${IAM_BASE}/oauth/token`, {
+  const response = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
       grant_type: "refresh_token",
       client_id: CLIENT_ID,
       refresh_token: refreshToken
@@ -1764,7 +1776,7 @@ async function refreshAccessToken(refreshToken) {
   return tokens.access_token;
 }
 async function fetchUserInfo(accessToken) {
-  const response = await fetch(`${IAM_BASE}/oauth/userinfo`, {
+  const response = await fetch(`${IAM_API}/api/userinfo`, {
     headers: { Authorization: `Bearer ${accessToken}` }
   });
   if (!response.ok) throw new Error("Failed to fetch user info");

package/dist/browser-extension/chrome/background.js

@@ -1608,7 +1608,8 @@ async function generatePkceChallenge() {
 function generateState() {
   return generateRandomString(32);
 }
-var IAM_BASE = "https://hanzo.id";
+var IAM_LOGIN = "https://hanzo.id";
+var IAM_API = "https://iam.hanzo.ai";
 var CLIENT_ID = "app-hanzo";
 var SCOPES = "openid profile email";
 function getRedirectUri() {
@@ -1650,7 +1651,7 @@ async function login() {
   const { codeVerifier, codeChallenge } = await generatePkceChallenge();
   const state = generateState();
   const redirectUri = getRedirectUri();
-  const authorizeUrl = new URL(`${IAM_BASE}/login/oauth/authorize`);
+  const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
   authorizeUrl.searchParams.set("client_id", CLIENT_ID);
   authorizeUrl.searchParams.set("response_type", "code");
   authorizeUrl.searchParams.set("redirect_uri", redirectUri);
@@ -1663,28 +1664,39 @@ async function login() {
   const returnedState = url.searchParams.get("state");
   if (returnedState !== state) throw new Error("State mismatch \u2014 possible CSRF");
   const code = url.searchParams.get("code");
-  if (!code) {
-    const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code";
+  const directToken = url.searchParams.get("access_token");
+  if (directToken) {
+    const tokens = {
+      access_token: directToken,
+      refresh_token: url.searchParams.get("refresh_token") || void 0,
+      token_type: "Bearer"
+    };
+    await storeTokens(tokens);
+  } else if (code) {
+    const tokenResponse = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier
+      })
+    });
+    if (!tokenResponse.ok) {
+      const errText = await tokenResponse.text();
+      throw new Error(`Token exchange failed: ${errText}`);
+    }
+    const tokens = await tokenResponse.json();
+    await storeTokens(tokens);
+  } else {
+    const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code or token";
     throw new Error(error);
   }
-  const tokenResponse = await fetch(`${IAM_BASE}/oauth/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      redirect_uri: redirectUri,
-      code_verifier: codeVerifier
-    })
-  });
-  if (!tokenResponse.ok) {
-    const errText = await tokenResponse.text();
-    throw new Error(`Token exchange failed: ${errText}`);
-  }
-  const tokens = await tokenResponse.json();
-  await storeTokens(tokens);
-  const user = await fetchUserInfo(tokens.access_token);
+  const { accessToken } = await getStoredTokens();
+  if (!accessToken) throw new Error("Login succeeded but no token was stored");
+  const user = await fetchUserInfo(accessToken);
   await chrome.storage.local.set({ [STORAGE_KEYS.user]: user });
   return user;
 }
@@ -1749,10 +1761,10 @@ async function getValidAccessToken() {
   return accessToken;
 }
 async function refreshAccessToken(refreshToken) {
-  const response = await fetch(`${IAM_BASE}/oauth/token`, {
+  const response = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
       grant_type: "refresh_token",
       client_id: CLIENT_ID,
       refresh_token: refreshToken
@@ -1764,7 +1776,7 @@ async function refreshAccessToken(refreshToken) {
   return tokens.access_token;
 }
 async function fetchUserInfo(accessToken) {
-  const response = await fetch(`${IAM_BASE}/oauth/userinfo`, {
+  const response = await fetch(`${IAM_API}/api/userinfo`, {
     headers: { Authorization: `Bearer ${accessToken}` }
   });
   if (!response.ok) throw new Error("Failed to fetch user info");

package/dist/browser-extension/chrome/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Hanzo AI",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "AI-powered dev assistant — click-to-code navigation, source maps, WebGPU AI, and MCP integration for Claude Code.",
   "permissions": [
     "activeTab",

package/dist/browser-extension/firefox/background.js

@@ -27,7 +27,8 @@
   function generateState() {
     return generateRandomString(32);
   }
-  var IAM_BASE = "https://hanzo.id";
+  var IAM_LOGIN = "https://hanzo.id";
+  var IAM_API = "https://iam.hanzo.ai";
   var CLIENT_ID = "app-hanzo";
   var SCOPES = "openid profile email";
   function getRedirectUri() {
@@ -69,7 +70,7 @@
     const { codeVerifier, codeChallenge } = await generatePkceChallenge();
     const state = generateState();
     const redirectUri = getRedirectUri();
-    const authorizeUrl = new URL(`${IAM_BASE}/login/oauth/authorize`);
+    const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
     authorizeUrl.searchParams.set("client_id", CLIENT_ID);
     authorizeUrl.searchParams.set("response_type", "code");
     authorizeUrl.searchParams.set("redirect_uri", redirectUri);
@@ -82,28 +83,39 @@
     const returnedState = url.searchParams.get("state");
     if (returnedState !== state) throw new Error("State mismatch \u2014 possible CSRF");
     const code = url.searchParams.get("code");
-    if (!code) {
-      const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code";
+    const directToken = url.searchParams.get("access_token");
+    if (directToken) {
+      const tokens = {
+        access_token: directToken,
+        refresh_token: url.searchParams.get("refresh_token") || void 0,
+        token_type: "Bearer"
+      };
+      await storeTokens(tokens);
+    } else if (code) {
+      const tokenResponse = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          grant_type: "authorization_code",
+          client_id: CLIENT_ID,
+          code,
+          redirect_uri: redirectUri,
+          code_verifier: codeVerifier
+        })
+      });
+      if (!tokenResponse.ok) {
+        const errText = await tokenResponse.text();
+        throw new Error(`Token exchange failed: ${errText}`);
+      }
+      const tokens = await tokenResponse.json();
+      await storeTokens(tokens);
+    } else {
+      const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code or token";
       throw new Error(error);
     }
-    const tokenResponse = await fetch(`${IAM_BASE}/oauth/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: codeVerifier
-      })
-    });
-    if (!tokenResponse.ok) {
-      const errText = await tokenResponse.text();
-      throw new Error(`Token exchange failed: ${errText}`);
-    }
-    const tokens = await tokenResponse.json();
-    await storeTokens(tokens);
-    const user = await fetchUserInfo(tokens.access_token);
+    const { accessToken } = await getStoredTokens();
+    if (!accessToken) throw new Error("Login succeeded but no token was stored");
+    const user = await fetchUserInfo(accessToken);
     await chrome.storage.local.set({ [STORAGE_KEYS.user]: user });
     return user;
   }
@@ -167,10 +179,10 @@
     return accessToken;
   }
   async function refreshAccessToken(refreshToken) {
-    const response = await fetch(`${IAM_BASE}/oauth/token`, {
+    const response = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
       method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
         grant_type: "refresh_token",
         client_id: CLIENT_ID,
         refresh_token: refreshToken
@@ -182,7 +194,7 @@
     return tokens.access_token;
   }
   async function fetchUserInfo(accessToken) {
-    const response = await fetch(`${IAM_BASE}/oauth/userinfo`, {
+    const response = await fetch(`${IAM_API}/api/userinfo`, {
       headers: { Authorization: `Bearer ${accessToken}` }
     });
     if (!response.ok) throw new Error("Failed to fetch user info");

package/dist/browser-extension/firefox/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Hanzo AI",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "AI-powered dev assistant — click-to-code navigation, source maps, WebGPU AI, and MCP integration for Claude Code.",
   "permissions": [
     "activeTab",

package/dist/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Hanzo AI",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "AI-powered dev assistant — click-to-code navigation, source maps, WebGPU AI, and MCP integration for Claude Code.",
   "permissions": [
     "activeTab",

package/dist/browser-extension/safari/background.js

@@ -1608,7 +1608,8 @@ async function generatePkceChallenge() {
 function generateState() {
   return generateRandomString(32);
 }
-var IAM_BASE = "https://hanzo.id";
+var IAM_LOGIN = "https://hanzo.id";
+var IAM_API = "https://iam.hanzo.ai";
 var CLIENT_ID = "app-hanzo";
 var SCOPES = "openid profile email";
 function getRedirectUri() {
@@ -1650,7 +1651,7 @@ async function login() {
   const { codeVerifier, codeChallenge } = await generatePkceChallenge();
   const state = generateState();
   const redirectUri = getRedirectUri();
-  const authorizeUrl = new URL(`${IAM_BASE}/login/oauth/authorize`);
+  const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
   authorizeUrl.searchParams.set("client_id", CLIENT_ID);
   authorizeUrl.searchParams.set("response_type", "code");
   authorizeUrl.searchParams.set("redirect_uri", redirectUri);
@@ -1663,28 +1664,39 @@ async function login() {
   const returnedState = url.searchParams.get("state");
   if (returnedState !== state) throw new Error("State mismatch \u2014 possible CSRF");
   const code = url.searchParams.get("code");
-  if (!code) {
-    const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code";
+  const directToken = url.searchParams.get("access_token");
+  if (directToken) {
+    const tokens = {
+      access_token: directToken,
+      refresh_token: url.searchParams.get("refresh_token") || void 0,
+      token_type: "Bearer"
+    };
+    await storeTokens(tokens);
+  } else if (code) {
+    const tokenResponse = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier
+      })
+    });
+    if (!tokenResponse.ok) {
+      const errText = await tokenResponse.text();
+      throw new Error(`Token exchange failed: ${errText}`);
+    }
+    const tokens = await tokenResponse.json();
+    await storeTokens(tokens);
+  } else {
+    const error = url.searchParams.get("error_description") || url.searchParams.get("error") || "No authorization code or token";
     throw new Error(error);
   }
-  const tokenResponse = await fetch(`${IAM_BASE}/oauth/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID,
-      code,
-      redirect_uri: redirectUri,
-      code_verifier: codeVerifier
-    })
-  });
-  if (!tokenResponse.ok) {
-    const errText = await tokenResponse.text();
-    throw new Error(`Token exchange failed: ${errText}`);
-  }
-  const tokens = await tokenResponse.json();
-  await storeTokens(tokens);
-  const user = await fetchUserInfo(tokens.access_token);
+  const { accessToken } = await getStoredTokens();
+  if (!accessToken) throw new Error("Login succeeded but no token was stored");
+  const user = await fetchUserInfo(accessToken);
   await chrome.storage.local.set({ [STORAGE_KEYS.user]: user });
   return user;
 }
@@ -1749,10 +1761,10 @@ async function getValidAccessToken() {
   return accessToken;
 }
 async function refreshAccessToken(refreshToken) {
-  const response = await fetch(`${IAM_BASE}/oauth/token`, {
+  const response = await fetch(`${IAM_API}/api/login/oauth/access_token`, {
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
       grant_type: "refresh_token",
       client_id: CLIENT_ID,
       refresh_token: refreshToken
@@ -1764,7 +1776,7 @@ async function refreshAccessToken(refreshToken) {
   return tokens.access_token;
 }
 async function fetchUserInfo(accessToken) {
-  const response = await fetch(`${IAM_BASE}/oauth/userinfo`, {
+  const response = await fetch(`${IAM_API}/api/userinfo`, {
     headers: { Authorization: `Bearer ${accessToken}` }
   });
   if (!response.ok) throw new Error("Failed to fetch user info");