@iislee/opencodex 2.11.0 → 2.35.0

package/src/oauth/account-import/index.ts

@@ -0,0 +1,15 @@
+export { importAccounts } from "./service";
+export {
+  ACCOUNT_IMPORT_DEADLINE_MS,
+  ACCOUNT_IMPORT_FORMAT,
+  ACCOUNT_IMPORT_MAX_BYTES,
+  ACCOUNT_IMPORT_MAX_REQUEST_BYTES,
+  ACCOUNT_IMPORT_PROVIDER,
+} from "./types";
+export type {
+  AccountImportCode,
+  AccountImportRecordResult,
+  AccountImportRequest,
+  AccountImportResult,
+  AccountImportStatus,
+} from "./types";

package/src/oauth/account-import/parser.ts

@@ -0,0 +1,83 @@
+import {
+  ACCOUNT_IMPORT_MAX_BYTES,
+  ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
+  ACCOUNT_IMPORT_MAX_RECORDS,
+  ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES,
+  type ParsedCockpitRecord,
+} from "./types";
+
+const encoder = new TextEncoder();
+const ALLOWED_RECORD_KEYS = new Set(["email", "refresh_token", "tags", "notes"]);
+
+export type CockpitDocumentParseResult =
+  | { ok: true; records: ParsedCockpitRecord[] }
+  | { ok: false; code: "invalid_document" };
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function serializedDocumentSize(document: unknown): number | null {
+  try {
+    const serialized = JSON.stringify(document);
+    return serialized === undefined ? null : encoder.encode(serialized).byteLength;
+  } catch {
+    return null;
+  }
+}
+
+function validEmail(value: unknown): value is string {
+  if (typeof value !== "string" || value.length === 0 || value.length > ACCOUNT_IMPORT_MAX_EMAIL_LENGTH) return false;
+  if (value !== value.trim() || /[\x00-\x20\x7f]/.test(value)) return false;
+  const at = value.indexOf("@");
+  return at > 0 && at === value.lastIndexOf("@") && at < value.length - 1;
+}
+
+function validRefreshToken(value: unknown): value is string {
+  return typeof value === "string"
+    && value.length > 0
+    && encoder.encode(value).byteLength <= ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES
+    && !/[\s\x7f]/.test(value);
+}
+
+function validMetadata(record: Record<string, unknown>): boolean {
+  if (record.tags !== undefined && (
+    !Array.isArray(record.tags)
+    || record.tags.some(tag => typeof tag !== "string")
+  )) return false;
+  return record.notes === undefined || typeof record.notes === "string";
+}
+
+function parseRecord(value: unknown, index: number): ParsedCockpitRecord {
+  if (!isPlainRecord(value)) return { index, code: "invalid_record" };
+  if (Object.keys(value).some(key => !ALLOWED_RECORD_KEYS.has(key))) return { index, code: "invalid_record" };
+  if (!validEmail(value.email) || !validRefreshToken(value.refresh_token) || !validMetadata(value)) {
+    return { index, code: "invalid_record" };
+  }
+  return {
+    index,
+    record: {
+      email: value.email.toLowerCase(),
+      refreshToken: value.refresh_token,
+    },
+  };
+}
+
+export function parseCockpitAccountDocument(document: unknown): CockpitDocumentParseResult {
+  const size = serializedDocumentSize(document);
+  if (size === null || size > ACCOUNT_IMPORT_MAX_BYTES) return { ok: false, code: "invalid_document" };
+  if (!Array.isArray(document) || document.length === 0 || document.length > ACCOUNT_IMPORT_MAX_RECORDS) {
+    return { ok: false, code: "invalid_document" };
+  }
+  const seen = new Set<string>();
+  const records = document.map((value, index): ParsedCockpitRecord => {
+    const parsed = parseRecord(value, index);
+    if ("code" in parsed) return parsed;
+    if (seen.has(parsed.record.email)) return { index, code: "invalid_record" };
+    seen.add(parsed.record.email);
+    return parsed;
+  });
+  return { ok: true, records };
+}

package/src/oauth/account-import/registry.ts

@@ -0,0 +1,18 @@
+import { createAntigravityAccountImportAdapter } from "./google-antigravity-adapter";
+import {
+  ACCOUNT_IMPORT_FORMAT,
+  ACCOUNT_IMPORT_PROVIDER,
+  type AccountImportAdapter,
+} from "./types";
+
+export type AccountImportRegistryResult =
+  | { ok: true; adapter: AccountImportAdapter }
+  | { ok: false; code: "unsupported_provider" | "unsupported_format" };
+
+const antigravityAdapter = createAntigravityAccountImportAdapter();
+
+export function resolveAccountImportAdapter(provider: string, format: string): AccountImportRegistryResult {
+  if (provider !== ACCOUNT_IMPORT_PROVIDER) return { ok: false, code: "unsupported_provider" };
+  if (format !== ACCOUNT_IMPORT_FORMAT) return { ok: false, code: "unsupported_format" };
+  return { ok: true, adapter: antigravityAdapter };
+}

package/src/oauth/account-import/service.ts

@@ -0,0 +1,75 @@
+import { parseCockpitAccountDocument } from "./parser";
+import { resolveAccountImportAdapter, type AccountImportRegistryResult } from "./registry";
+import {
+  AccountImportAbortError,
+  throwIfAccountImportAborted,
+} from "./types";
+import type {
+  AccountImportRequest,
+  AccountImportResult,
+  AccountImportRecordResult,
+} from "./types";
+
+export type AccountImportServiceResult =
+  | { ok: true; result: AccountImportResult }
+  | {
+    ok: false;
+    status: 400 | 408;
+    code: "unsupported_provider" | "unsupported_format" | "invalid_document" | "import_cancelled";
+    /** True when at least one credential was committed before the terminal failure. */
+    changed?: boolean;
+  };
+
+export interface AccountImportServiceDeps {
+  resolveAdapter(provider: string, format: string): AccountImportRegistryResult;
+}
+
+export async function importAccounts(
+  request: AccountImportRequest,
+  deps: AccountImportServiceDeps = { resolveAdapter: resolveAccountImportAdapter },
+): Promise<AccountImportServiceResult> {
+  // Provider/format admission intentionally precedes any traversal or serialization of the
+  // credential-bearing document.
+  const resolved = deps.resolveAdapter(request.provider, request.format);
+  if (!resolved.ok) return { ok: false, status: 400, code: resolved.code };
+
+  const parsed = parseCockpitAccountDocument(request.document);
+  if (!parsed.ok) return { ok: false, status: 400, code: parsed.code };
+
+  const results: AccountImportRecordResult[] = [];
+  try {
+    for (const item of parsed.records) {
+      throwIfAccountImportAborted(request.signal);
+      if ("code" in item) {
+        results.push({ index: item.index, status: "failed", code: item.code });
+        continue;
+      }
+      const outcome = await resolved.adapter.importRecord(item.record, request.signal);
+      results.push({ index: item.index, ...outcome });
+      // Record the committed outcome before observing cancellation. The route uses this
+      // internal signal to reconcile live stores and caches even when the public response
+      // is the terminal 408 DTO.
+      throwIfAccountImportAborted(request.signal);
+    }
+  } catch (error) {
+    if (error instanceof AccountImportAbortError) {
+      const changed = results.some(result => result.status === "imported" || result.status === "updated");
+      return { ok: false, status: 408, code: "import_cancelled", ...(changed ? { changed: true } : {}) };
+    }
+    throw error;
+  }
+
+  const count = (status: AccountImportRecordResult["status"]) =>
+    results.filter(result => result.status === status).length;
+  return {
+    ok: true,
+    result: {
+      totalCount: results.length,
+      importedCount: count("imported"),
+      updatedCount: count("updated"),
+      failedCount: count("failed"),
+      unsupportedCount: count("unsupported"),
+      results,
+    },
+  };
+}

package/src/oauth/account-import/types.ts

@@ -0,0 +1,91 @@
+import type { OAuthCredentials } from "../types";
+
+export const ACCOUNT_IMPORT_PROVIDER = "google-antigravity" as const;
+export const ACCOUNT_IMPORT_FORMAT = "cockpit-tools" as const;
+export const ACCOUNT_IMPORT_MAX_BYTES = 256 * 1024;
+// The HTTP request also carries the fixed provider/format envelope. Keep that envelope bounded
+// without making a valid document at the 256 KiB contract boundary fail at the API layer.
+export const ACCOUNT_IMPORT_MAX_REQUEST_BYTES = ACCOUNT_IMPORT_MAX_BYTES + 1024;
+// Shared CLI POST timeout and management-route deadline. Individual provider requests keep
+// shorter timeouts; this bounds the full admitted batch (up to ACCOUNT_IMPORT_MAX_RECORDS).
+export const ACCOUNT_IMPORT_DEADLINE_MS = 600_000;
+export const ACCOUNT_IMPORT_MAX_RECORDS = 25;
+export const ACCOUNT_IMPORT_MAX_EMAIL_LENGTH = 254;
+export const ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES = 16 * 1024;
+
+export type AccountImportStatus = "imported" | "updated" | "failed" | "unsupported";
+
+export type AccountImportCode =
+  | "imported"
+  | "updated"
+  | "import_cancelled"
+  | "unsupported_provider"
+  | "unsupported_format"
+  | "invalid_document"
+  | "invalid_record"
+  | "credential_rejected"
+  | "identity_mismatch"
+  | "missing_project"
+  | "persist_failed";
+
+export interface AccountImportRecordResult {
+  index: number;
+  status: AccountImportStatus;
+  code: AccountImportCode;
+}
+
+export interface AccountImportResult {
+  totalCount: number;
+  importedCount: number;
+  updatedCount: number;
+  failedCount: number;
+  unsupportedCount: number;
+  results: AccountImportRecordResult[];
+}
+
+export interface AccountImportRequest {
+  provider: string;
+  format: string;
+  document: unknown;
+  signal?: AbortSignal;
+}
+
+/** A secret-free terminal signal for a cancelled import request. */
+export class AccountImportAbortError extends Error {
+  constructor() {
+    super("Account import cancelled");
+    this.name = "AccountImportAbortError";
+  }
+}
+
+export function throwIfAccountImportAborted(signal?: AbortSignal): void {
+  if (signal?.aborted) throw new AccountImportAbortError();
+}
+
+export interface CockpitAccountRecord {
+  email: string;
+  refreshToken: string;
+}
+
+export type ParsedCockpitRecord =
+  | { index: number; record: CockpitAccountRecord }
+  | { index: number; code: "invalid_record" };
+
+export type AccountImportRecordOutcome =
+  | { status: "imported"; code: "imported" }
+  | { status: "updated"; code: "updated" }
+  | {
+    status: "failed";
+    code: "credential_rejected" | "identity_mismatch" | "missing_project" | "persist_failed";
+  };
+
+export interface AccountImportAdapter {
+  readonly provider: typeof ACCOUNT_IMPORT_PROVIDER;
+  readonly format: typeof ACCOUNT_IMPORT_FORMAT;
+  importRecord(record: CockpitAccountRecord, signal?: AbortSignal): Promise<AccountImportRecordOutcome>;
+}
+
+export interface ValidatedAntigravityCredential extends OAuthCredentials {
+  email?: string;
+  projectId?: string;
+}

package/src/oauth/anthropic.ts

@@ -81,10 +81,21 @@ function parseTokenResponse(responseBody: string): AnthropicTokenResponse {
 function credsFrom(data: AnthropicTokenResponse, refreshFallback?: string): OAuthCredentials {
   const accountUuid = data.account?.uuid;
   const email = data.account?.email_address;
+  // Guard against a missing/non-finite/negative expires_in (malformed upstream
+  // response): a NaN expiry would never compare as expired, and a negative
+  // duration would stamp an already-past expiry — both block refresh semantics.
+  const expiresIn =
+    typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in >= 0
+      ? data.expires_in
+      : 3600;
+  // The computed timestamp itself must stay finite: Number.MAX_VALUE passes
+  // Number.isFinite but overflows to Infinity once multiplied by 1000.
+  const computedExpires = Date.now() + expiresIn * 1000 - 5 * 60 * 1000;
+  const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000 - 5 * 60 * 1000;
   return {
     refresh: data.refresh_token || refreshFallback || "",
     access: data.access_token,
-    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+    expires,
     accountId: typeof accountUuid === "string" && accountUuid.length > 0 ? accountUuid : undefined,
     email: typeof email === "string" && email.length > 0 ? email : undefined,
   };

package/src/oauth/callback-server.ts

@@ -5,7 +5,7 @@
  * Change vs source: the success/error page is an inline HTML constant. opencodex's GUI polls
  * GET /api/oauth/status, so it does not need OAuth state injected into the callback page.
  *
- * Handles: port allocation (preferred → random fallback), callback server, CSRF state,
+ * Handles: port allocation (preferred → random/manual-only fallback), callback server, CSRF state,
  * manual-input race, 300s timeout. Providers implement generateAuthUrl() + exchangeToken().
  */
 import { isAddrInUse } from "../server/ports";
@@ -131,8 +131,14 @@ export abstract class OAuthCallbackFlow {
       }
       const redirectUri = `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
       return { servers, redirectUri };
-    } catch {
+    } catch (error) {
       if (this.redirectUri) {
+        // Fixed OAuth redirect URIs cannot move to a random port. Remote dashboards can
+        // still complete the same state/PKCE flow by pasting the final redirect URL or
+        // authorization code, so do not make a local listener a prerequisite for that path.
+        if (this.ctrl.onManualCodeInput && isAddrInUse(error)) {
+          return { servers: [], redirectUri: this.redirectUri };
+        }
         throw new Error(
           `OAuth callback port ${this.preferredPort} unavailable; cannot fall back to a random port when redirectUri is set`,
         );
@@ -270,10 +276,30 @@ export function parseCallbackInput(input: string): { kind: "url" | "query" | "ra
 
   try {
     const url = new URL(value);
+    // Also read the fragment. No provider configured here returns one — every
+    // OAuthCallbackFlow asks for response_type=code without response_mode, so
+    // the parameters land in the query — but a full URL whose parameters sit in
+    // the hash parses as a valid URL with no code, and reading only the query
+    // rejects it as "no authorization code found in input". This is the one
+    // place a fragment-returning provider would land, and the raw branch below
+    // already understands `code#state`.
+    //
+    // The query wins as a WHOLE when it carries the response, and the two
+    // fields are never mixed across collections. Reading `code` and `state`
+    // independently would accept `?state=<expected>#code=<other>` — one
+    // response assembled from two sources — which is exactly the confusion a
+    // state check exists to prevent. An authorization response arrives in one
+    // place; treat it that way.
+    //
+    // Only `code` and `state` are read — never a token. This repo does not
+    // implement the implicit grant and a paste field must not become the place
+    // it appears.
+    const fragment = new URLSearchParams(url.hash.replace(/^#/, ""));
+    const source = url.searchParams.has("code") ? url.searchParams : fragment;
     return {
       kind: "url",
-      code: url.searchParams.get("code") ?? undefined,
-      state: url.searchParams.get("state") ?? undefined,
+      code: source.get("code") ?? undefined,
+      state: source.get("state") ?? undefined,
     };
   } catch {
     // Not a URL - check for query string format

package/src/oauth/chatgpt.ts

@@ -49,10 +49,21 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
 function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
   const accessToken = data.access_token as string;
+  // ?? only guards null/undefined; NaN or a string expires_in would otherwise
+  // produce a NaN expiry that never compares as expired, and a negative duration
+  // would stamp an already-past expiry — both block refresh semantics.
+  const expiresIn =
+    typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in >= 0
+      ? data.expires_in
+      : 3600;
+  // The computed timestamp itself must stay finite: Number.MAX_VALUE passes
+  // Number.isFinite but overflows to Infinity once multiplied by 1000.
+  const computedExpires = Date.now() + expiresIn * 1000;
+  const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000;
   return {
     access: accessToken,
     refresh: (data.refresh_token as string) ?? "",
-    expires: Date.now() + ((data.expires_in as number) ?? 3600) * 1000,
+    expires,
     accountId: extractAccountId(idToken, accessToken),
     email: extractEmail(idToken, accessToken),
   };

package/src/oauth/cline.ts

@@ -0,0 +1,203 @@
+/**
+ * Cline OAuth — automatic session import from local Cline CLI / VS Code extension
+ * and background WorkOS token refresh.
+ *
+ * Security: tokens are read securely from local config files and refreshed directly
+ * against WorkOS API (api.workos.com). Tokens and credentials are never logged.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { clineConfigPath } from "../clients/config-export";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+export const WORKOS_CLIENT_ID = "client_01K3A541FN8TA3EPPHTD2325AR";
+export const WORKOS_AUTH_URL = "https://api.workos.com/user_management/authenticate";
+const WORKOS_TOKEN_PREFIX = "workos:";
+
+export interface ClineLoginOptions {
+  importLocal?: "fallback" | "off";
+  forceLogin?: boolean;
+}
+
+interface ClineProvidersJson {
+  providers?: {
+    cline?: {
+      settings?: {
+        provider?: string;
+        auth?: {
+          accessToken?: unknown;
+          refreshToken?: unknown;
+          expiresAt?: unknown;
+          accountId?: unknown;
+          metadata?: {
+            userInfo?: {
+              email?: unknown;
+              name?: unknown;
+              subject?: unknown;
+              clineUserId?: unknown;
+            };
+          };
+        };
+      };
+    };
+  };
+}
+
+interface WorkOSAuthResponse {
+  access_token?: unknown;
+  refresh_token?: unknown;
+  user?: {
+    id?: unknown;
+    external_id?: unknown;
+    email?: unknown;
+    first_name?: unknown;
+    last_name?: unknown;
+  };
+  error?: unknown;
+  error_description?: unknown;
+}
+
+function decodeJwtExpiry(token: string): number {
+  try {
+    const rawJwt = token.startsWith(WORKOS_TOKEN_PREFIX) ? token.slice(WORKOS_TOKEN_PREFIX.length) : token;
+    const parts = rawJwt.split(".");
+    if (parts.length === 3 && parts[1]) {
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8")) as { exp?: unknown };
+      if (typeof payload.exp === "number" && Number.isFinite(payload.exp)) {
+        return payload.exp * 1000;
+      }
+    }
+  } catch {
+    // fallback below
+  }
+  return Date.now() + 3600_000;
+}
+
+export function formatClineAccessToken(token: string): string {
+  return token.startsWith(WORKOS_TOKEN_PREFIX) ? token : `${WORKOS_TOKEN_PREFIX}${token}`;
+}
+
+export function detectLocalClineToken(): OAuthCredentials | null {
+  const configPath = clineConfigPath();
+  if (!existsSync(configPath)) return null;
+
+  try {
+    const raw = JSON.parse(readFileSync(configPath, "utf8")) as ClineProvidersJson;
+    const auth = raw.providers?.cline?.settings?.auth;
+    if (!auth || typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string") {
+      return null;
+    }
+
+    const accessToken = auth.accessToken.trim();
+    const refreshToken = auth.refreshToken.trim();
+    if (!accessToken || !refreshToken) return null;
+
+    const expiresAt = typeof auth.expiresAt === "number" && Number.isFinite(auth.expiresAt)
+      ? auth.expiresAt
+      : decodeJwtExpiry(accessToken);
+
+    const userInfo = auth.metadata?.userInfo;
+    const accountId = typeof auth.accountId === "string" && auth.accountId.length > 0
+      ? auth.accountId
+      : typeof userInfo?.clineUserId === "string" && userInfo.clineUserId.length > 0
+        ? userInfo.clineUserId
+        : typeof userInfo?.subject === "string" && userInfo.subject.length > 0
+          ? userInfo.subject
+          : undefined;
+
+    const email = typeof userInfo?.email === "string" && userInfo.email.length > 0
+      ? userInfo.email
+      : undefined;
+
+    return {
+      access: formatClineAccessToken(accessToken),
+      refresh: refreshToken,
+      expires: expiresAt,
+      ...(accountId ? { accountId } : {}),
+      ...(email ? { email } : {}),
+      source: "local-cli",
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function refreshClineToken(
+  refreshToken: string,
+  signal?: AbortSignal,
+  credential?: OAuthCredentials,
+): Promise<OAuthCredentials> {
+  if (signal?.aborted) {
+    throw signal.reason ?? new DOMException("Cline token refresh aborted", "AbortError");
+  }
+
+  const response = await fetch(WORKOS_AUTH_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+    },
+    body: JSON.stringify({
+      client_id: WORKOS_CLIENT_ID,
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+    }),
+    signal,
+  });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`Cline WorkOS token refresh failed (HTTP ${response.status}): ${body || response.statusText}`);
+  }
+
+  const data = (await response.json()) as WorkOSAuthResponse;
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new Error(`Cline token refresh returned no access_token: ${JSON.stringify(data)}`);
+  }
+
+  const nextRefreshToken = typeof data.refresh_token === "string" && data.refresh_token
+    ? data.refresh_token
+    : refreshToken;
+
+  const access = formatClineAccessToken(data.access_token);
+  const expires = decodeJwtExpiry(data.access_token);
+
+  const accountId = typeof data.user?.external_id === "string" && data.user.external_id
+    ? data.user.external_id
+    : typeof data.user?.id === "string" && data.user.id
+      ? data.user.id
+      : credential?.accountId;
+
+  const email = typeof data.user?.email === "string" && data.user.email
+    ? data.user.email
+    : credential?.email;
+
+  return {
+    access,
+    refresh: nextRefreshToken,
+    expires,
+    ...(accountId ? { accountId } : {}),
+    ...(email ? { email } : {}),
+  };
+}
+
+export async function loginCline(
+  ctrl?: OAuthController,
+  options: ClineLoginOptions = {},
+): Promise<OAuthCredentials> {
+  if (options.importLocal !== "off") {
+    ctrl?.onProgress?.("Checking local Cline CLI and VS Code installation for active session...");
+    const local = detectLocalClineToken();
+    if (local) {
+      if (local.expires <= Date.now() + 60_000) {
+        ctrl?.onProgress?.("Local Cline session token expired; refreshing via WorkOS...");
+        return await refreshClineToken(local.refresh, ctrl?.signal, local);
+      }
+      ctrl?.onProgress?.("Imported active Cline session successfully.");
+      return local;
+    }
+  }
+
+  throw new Error(
+    "No local Cline session found. Please log in to Cline via the VS Code extension or Cline CLI (`cline`), then re-run `ocx login cline` to import your account.",
+  );
+}