@jonnyhoo/ccs 1.0.0

package/dist/cliproxy/auth/gemini-token-refresh.js

@@ -0,0 +1,327 @@
+"use strict";
+/**
+ * Gemini Token Refresh
+ *
+ * Handles proactive token validation and refresh for Gemini OAuth tokens.
+ * Prevents UND_ERR_SOCKET errors by ensuring tokens are valid before use.
+ *
+ * Token sources (priority order):
+ * 1. CLIProxy auth dir (~/.ccs/cliproxy/auth/) - CCS-managed tokens
+ * 2. Standard Gemini CLI (~/.gemini/oauth_creds.json) - backward compatibility
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureGeminiTokenValid = exports.refreshGeminiToken = exports.isGeminiTokenExpiringSoon = exports.getGeminiOAuthPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const config_generator_1 = require("../config-generator");
+const account_manager_1 = require("../account-manager");
+const token_manager_1 = require("./token-manager");
+/**
+ * Gemini OAuth credentials - PUBLIC from official Gemini CLI source code
+ * These are not secrets - they're public OAuth client credentials that Google
+ * distributes with their official applications. See:
+ * https://github.com/google/generative-ai-python (Gemini CLI source)
+ *
+ * GitHub secret scanning may flag these, but they are intentionally hardcoded
+ * as they're required for OAuth token refresh and are publicly documented.
+ */
+const GEMINI_CLIENT_ID = '681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com';
+const GEMINI_CLIENT_SECRET = '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';
+/** Google OAuth token endpoint */
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+/** Refresh tokens 5 minutes before expiry */
+const REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;
+/**
+ * Get path to Gemini OAuth credentials file
+ */
+function getGeminiOAuthPath() {
+    return path.join(os.homedir(), '.gemini', 'oauth_creds.json');
+}
+exports.getGeminiOAuthPath = getGeminiOAuthPath;
+/**
+ * Map CLIProxyAPI token format to internal GeminiOAuthCreds format
+ */
+function mapCliproxyToGeminiCreds(cliproxy) {
+    return {
+        access_token: cliproxy.token.access_token,
+        refresh_token: cliproxy.token.refresh_token,
+        expiry_date: cliproxy.token.expiry,
+        token_type: 'Bearer',
+    };
+}
+/**
+ * Validate CLIProxyAPI token structure has required fields
+ */
+function isValidCliproxyToken(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const obj = data;
+    if (obj.type !== 'gemini')
+        return false;
+    if (typeof obj.token !== 'object' || obj.token === null)
+        return false;
+    const token = obj.token;
+    return typeof token.access_token === 'string';
+}
+/**
+ * Read Gemini token from CLIProxy auth directory
+ * Returns credentials with source path, or null if no valid token found
+ */
+function readCliproxyGeminiCreds() {
+    const authDir = (0, config_generator_1.getProviderAuthDir)('gemini');
+    if (!fs.existsSync(authDir))
+        return null;
+    // Try to find default account's token file
+    const defaultAccount = (0, account_manager_1.getDefaultAccount)('gemini');
+    let tokenPath = null;
+    if (defaultAccount) {
+        tokenPath = path.join(authDir, defaultAccount.tokenFile);
+        if (!fs.existsSync(tokenPath))
+            tokenPath = null;
+    }
+    // Fallback: find any gemini token file by prefix or type
+    if (!tokenPath) {
+        const accounts = (0, account_manager_1.getProviderAccounts)('gemini');
+        if (accounts.length > 0) {
+            tokenPath = path.join(authDir, accounts[0].tokenFile);
+            if (!fs.existsSync(tokenPath))
+                tokenPath = null;
+        }
+    }
+    // Last fallback: scan directory for gemini token files
+    if (!tokenPath) {
+        try {
+            const files = fs.readdirSync(authDir).filter((f) => f.endsWith('.json'));
+            for (const file of files) {
+                const filePath = path.join(authDir, file);
+                if (file.startsWith('gemini-') || (0, token_manager_1.isTokenFileForProvider)(filePath, 'gemini')) {
+                    tokenPath = filePath;
+                    break;
+                }
+            }
+        }
+        catch {
+            // Directory read failed - continue to return null
+            return null;
+        }
+    }
+    if (!tokenPath)
+        return null;
+    try {
+        const content = fs.readFileSync(tokenPath, 'utf8');
+        const data = JSON.parse(content);
+        // Validate CLIProxyAPI format with proper type checking
+        if (isValidCliproxyToken(data)) {
+            return {
+                creds: mapCliproxyToGeminiCreds(data),
+                sourcePath: tokenPath,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read Gemini OAuth credentials
+ * Priority: CLIProxy auth dir first, then ~/.gemini/oauth_creds.json
+ * Returns credentials with source path for correct write-back
+ */
+function readGeminiCreds() {
+    // 1. Try CLIProxy auth directory first (CCS-managed tokens)
+    const cliproxyResult = readCliproxyGeminiCreds();
+    if (cliproxyResult) {
+        return cliproxyResult;
+    }
+    // 2. Fall back to standard Gemini CLI location
+    const oauthPath = getGeminiOAuthPath();
+    if (!fs.existsSync(oauthPath)) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(oauthPath, 'utf8');
+        return {
+            creds: JSON.parse(content),
+            sourcePath: oauthPath,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write updated credentials to CLIProxy token file
+ * Preserves existing fields (email, project_id), only updates token subfields
+ */
+function writeCliproxyGeminiCreds(tokenPath, creds) {
+    try {
+        const existing = JSON.parse(fs.readFileSync(tokenPath, 'utf8'));
+        const updated = {
+            ...existing,
+            token: {
+                ...existing.token,
+                access_token: creds.access_token,
+                refresh_token: creds.refresh_token,
+                expiry: creds.expiry_date,
+            },
+        };
+        fs.writeFileSync(tokenPath, JSON.stringify(updated, null, 2), { mode: 0o600 });
+        return undefined;
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : 'Failed to write credentials';
+    }
+}
+/**
+ * Write Gemini OAuth credentials
+ * Writes back to the specified source location (CLIProxy or ~/.gemini)
+ * @param creds - The credentials to write
+ * @param sourcePath - The path where credentials were originally read from
+ * @returns error message if write failed, undefined on success
+ */
+function writeGeminiCreds(creds, sourcePath) {
+    const geminiOAuthPath = getGeminiOAuthPath();
+    // If source is not the standard Gemini path, write to CLIProxy format
+    if (sourcePath !== geminiOAuthPath) {
+        return writeCliproxyGeminiCreds(sourcePath, creds);
+    }
+    // Otherwise write to standard Gemini CLI location
+    const dir = path.dirname(geminiOAuthPath);
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(geminiOAuthPath, JSON.stringify(creds, null, 2), { mode: 0o600 });
+        return undefined;
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : 'Failed to write credentials';
+    }
+}
+/**
+ * Check if Gemini token is expired or expiring soon
+ */
+function isGeminiTokenExpiringSoon() {
+    const result = readGeminiCreds();
+    if (!result || !result.creds.access_token) {
+        return true; // No token = needs auth
+    }
+    if (!result.creds.expiry_date) {
+        return false; // No expiry info = assume valid
+    }
+    const expiresIn = result.creds.expiry_date - Date.now();
+    return expiresIn < REFRESH_LEAD_TIME_MS;
+}
+exports.isGeminiTokenExpiringSoon = isGeminiTokenExpiringSoon;
+/**
+ * Refresh Gemini access token using refresh_token
+ * @returns Result with success status, optional error, and expiry time
+ */
+async function refreshGeminiToken() {
+    const result = readGeminiCreds();
+    if (!result || !result.creds.refresh_token) {
+        return { success: false, error: 'No refresh token available' };
+    }
+    const { creds, sourcePath } = result;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 10000);
+    try {
+        const response = await fetch(GOOGLE_TOKEN_URL, {
+            method: 'POST',
+            signal: controller.signal,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: creds.refresh_token, // Already validated above
+                client_id: GEMINI_CLIENT_ID,
+                client_secret: GEMINI_CLIENT_SECRET,
+            }).toString(),
+        });
+        clearTimeout(timeoutId);
+        const data = (await response.json());
+        if (!response.ok || data.error) {
+            return {
+                success: false,
+                error: data.error_description || data.error || `OAuth error: ${response.status}`,
+            };
+        }
+        if (!data.access_token) {
+            return { success: false, error: 'No access_token in response' };
+        }
+        // Update credentials file with new token
+        const expiresAt = Date.now() + (data.expires_in ?? 3600) * 1000;
+        const updatedCreds = {
+            ...creds,
+            access_token: data.access_token,
+            expiry_date: expiresAt,
+        };
+        const writeError = writeGeminiCreds(updatedCreds, sourcePath);
+        if (writeError) {
+            return { success: false, error: `Token refreshed but failed to save: ${writeError}` };
+        }
+        return { success: true, expiresAt };
+    }
+    catch (err) {
+        clearTimeout(timeoutId);
+        if (err instanceof Error && err.name === 'AbortError') {
+            return { success: false, error: 'Token refresh timeout' };
+        }
+        return { success: false, error: err instanceof Error ? err.message : 'Unknown error' };
+    }
+}
+exports.refreshGeminiToken = refreshGeminiToken;
+/**
+ * Ensure Gemini token is valid, refreshing if needed
+ * @param verbose Log progress if true
+ * @returns true if token is valid (or was refreshed), false if refresh failed
+ */
+async function ensureGeminiTokenValid(verbose = false) {
+    const result = readGeminiCreds();
+    if (!result || !result.creds.access_token) {
+        return { valid: false, refreshed: false, error: 'No Gemini credentials found' };
+    }
+    if (!isGeminiTokenExpiringSoon()) {
+        return { valid: true, refreshed: false };
+    }
+    // Token is expired or expiring soon - try to refresh
+    if (verbose) {
+        console.log('[i] Gemini token expired or expiring soon, refreshing...');
+    }
+    const refreshResult = await refreshGeminiToken();
+    if (refreshResult.success) {
+        if (verbose) {
+            console.log('[OK] Gemini token refreshed successfully');
+        }
+        return { valid: true, refreshed: true };
+    }
+    return { valid: false, refreshed: false, error: refreshResult.error };
+}
+exports.ensureGeminiTokenValid = ensureGeminiTokenValid;
+//# sourceMappingURL=gemini-token-refresh.js.map

package/dist/cliproxy/auth/gemini-token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-token-refresh.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/gemini-token-refresh.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,0DAAyD;AACzD,wDAA4E;AAC5E,mDAAyD;AAEzD;;;;;;;;GAQG;AAEH,MAAM,gBAAgB,GAAG,0EAA0E,CAAC;AAEpG,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAEnE,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAuC3C;;GAEG;AACH,SAAgB,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAFD,gDAEC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,QAA6B;IAC7D,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY;QACzC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;QAC3C,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QAClC,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;IACnD,OAAO,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB;IAC9B,MAAM,OAAO,GAAG,IAAA,qCAAkB,EAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,2CAA2C;IAC3C,MAAM,cAAc,GAAG,IAAA,mCAAiB,EAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,IAAI,cAAc,EAAE,CAAC;QACnB,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;IAClD,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;QAClD,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAA,sCAAsB,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAC7E,SAAS,GAAG,QAAQ,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE1C,wDAAwD;QACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,wBAAwB,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,SAAS;aACtB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe;IACtB,4DAA4D;IAC5D,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB;YAC9C,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,SAAiB,EAAE,KAAuB;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ;YACX,KAAK,EAAE;gBACL,GAAG,QAAQ,CAAC,KAAK;gBACjB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,MAAM,EAAE,KAAK,CAAC,WAAW;aAC1B;SACF,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAuB,EAAE,UAAkB;IACnE,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAE7C,sEAAsE;IACtE,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,kDAAkD;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB;IACvC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,gCAAgC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,OAAO,SAAS,GAAG,oBAAoB,CAAC;AAC1C,CAAC;AAVD,8DAUC;AAED;;;GAGG;AACI,KAAK,UAAU,kBAAkB;IAKtC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAuB,EAAE,0BAA0B;gBACxE,SAAS,EAAE,gBAAgB;gBAC3B,aAAa,EAAE,oBAAoB;aACpC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAE7D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,gBAAgB,QAAQ,CAAC,MAAM,EAAE;aACjF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClE,CAAC;QAED,yCAAyC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAChE,MAAM,YAAY,GAAqB;YACrC,GAAG,KAAK;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,UAAU,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAhED,gDAgEC;AAED;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAAC,OAAO,GAAG,KAAK;IAK1D,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,qDAAqD;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACjD,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AA5BD,wDA4BC"}

package/dist/cliproxy/auth/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Auth Module - Barrel Export
+ *
+ * Re-exports all auth-related functionality from submodules.
+ */
+export type { AuthStatus, ProviderOAuthConfig, OAuthOptions } from './auth-types';
+export { OAUTH_CALLBACK_PORTS, OAUTH_CONFIGS, PROVIDER_AUTH_PREFIXES, PROVIDER_TYPE_VALUES, getOAuthConfig, } from './auth-types';
+export { getProviderTokenDir, isTokenFileForProvider, isAuthenticated, getAuthStatus, getAllAuthStatus, clearAuth, registerAccountFromToken, displayAuthStatus, } from './token-manager';
+export { isHeadlessEnvironment, killProcessOnPort, getTimeoutTroubleshooting, showStep, } from './environment-detector';
+export { triggerOAuth, ensureAuth } from './oauth-handler';
+//# sourceMappingURL=index.d.ts.map

package/dist/cliproxy/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,QAAQ,GACT,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cliproxy/auth/index.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Auth Module - Barrel Export
+ *
+ * Re-exports all auth-related functionality from submodules.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAuth = exports.triggerOAuth = exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = exports.displayAuthStatus = exports.registerAccountFromToken = exports.clearAuth = exports.getAllAuthStatus = exports.getAuthStatus = exports.isAuthenticated = exports.isTokenFileForProvider = exports.getProviderTokenDir = exports.getOAuthConfig = exports.PROVIDER_TYPE_VALUES = exports.PROVIDER_AUTH_PREFIXES = exports.OAUTH_CONFIGS = exports.OAUTH_CALLBACK_PORTS = void 0;
+var auth_types_1 = require("./auth-types");
+Object.defineProperty(exports, "OAUTH_CALLBACK_PORTS", { enumerable: true, get: function () { return auth_types_1.OAUTH_CALLBACK_PORTS; } });
+Object.defineProperty(exports, "OAUTH_CONFIGS", { enumerable: true, get: function () { return auth_types_1.OAUTH_CONFIGS; } });
+Object.defineProperty(exports, "PROVIDER_AUTH_PREFIXES", { enumerable: true, get: function () { return auth_types_1.PROVIDER_AUTH_PREFIXES; } });
+Object.defineProperty(exports, "PROVIDER_TYPE_VALUES", { enumerable: true, get: function () { return auth_types_1.PROVIDER_TYPE_VALUES; } });
+Object.defineProperty(exports, "getOAuthConfig", { enumerable: true, get: function () { return auth_types_1.getOAuthConfig; } });
+// Token management
+var token_manager_1 = require("./token-manager");
+Object.defineProperty(exports, "getProviderTokenDir", { enumerable: true, get: function () { return token_manager_1.getProviderTokenDir; } });
+Object.defineProperty(exports, "isTokenFileForProvider", { enumerable: true, get: function () { return token_manager_1.isTokenFileForProvider; } });
+Object.defineProperty(exports, "isAuthenticated", { enumerable: true, get: function () { return token_manager_1.isAuthenticated; } });
+Object.defineProperty(exports, "getAuthStatus", { enumerable: true, get: function () { return token_manager_1.getAuthStatus; } });
+Object.defineProperty(exports, "getAllAuthStatus", { enumerable: true, get: function () { return token_manager_1.getAllAuthStatus; } });
+Object.defineProperty(exports, "clearAuth", { enumerable: true, get: function () { return token_manager_1.clearAuth; } });
+Object.defineProperty(exports, "registerAccountFromToken", { enumerable: true, get: function () { return token_manager_1.registerAccountFromToken; } });
+Object.defineProperty(exports, "displayAuthStatus", { enumerable: true, get: function () { return token_manager_1.displayAuthStatus; } });
+// Environment detection
+var environment_detector_1 = require("./environment-detector");
+Object.defineProperty(exports, "isHeadlessEnvironment", { enumerable: true, get: function () { return environment_detector_1.isHeadlessEnvironment; } });
+Object.defineProperty(exports, "killProcessOnPort", { enumerable: true, get: function () { return environment_detector_1.killProcessOnPort; } });
+Object.defineProperty(exports, "getTimeoutTroubleshooting", { enumerable: true, get: function () { return environment_detector_1.getTimeoutTroubleshooting; } });
+Object.defineProperty(exports, "showStep", { enumerable: true, get: function () { return environment_detector_1.showStep; } });
+// OAuth handling
+var oauth_handler_1 = require("./oauth-handler");
+Object.defineProperty(exports, "triggerOAuth", { enumerable: true, get: function () { return oauth_handler_1.triggerOAuth; } });
+Object.defineProperty(exports, "ensureAuth", { enumerable: true, get: function () { return oauth_handler_1.ensureAuth; } });
+//# sourceMappingURL=index.js.map

package/dist/cliproxy/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAIH,2CAMsB;AALpB,kHAAA,oBAAoB,OAAA;AACpB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,kHAAA,oBAAoB,OAAA;AACpB,4GAAA,cAAc,OAAA;AAGhB,mBAAmB;AACnB,iDASyB;AARvB,oHAAA,mBAAmB,OAAA;AACnB,uHAAA,sBAAsB,OAAA;AACtB,gHAAA,eAAe,OAAA;AACf,8GAAA,aAAa,OAAA;AACb,iHAAA,gBAAgB,OAAA;AAChB,0GAAA,SAAS,OAAA;AACT,yHAAA,wBAAwB,OAAA;AACxB,kHAAA,iBAAiB,OAAA;AAGnB,wBAAwB;AACxB,+DAKgC;AAJ9B,6HAAA,qBAAqB,OAAA;AACrB,yHAAA,iBAAiB,OAAA;AACjB,iIAAA,yBAAyB,OAAA;AACzB,gHAAA,QAAQ,OAAA;AAGV,iBAAiB;AACjB,iDAA2D;AAAlD,6GAAA,YAAY,OAAA;AAAE,2GAAA,UAAU,OAAA"}

package/dist/cliproxy/auth/kiro-import.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Kiro Import Helper
+ *
+ * Imports Kiro token from Kiro IDE when OAuth callback redirects to IDE instead of CLI.
+ * Spawns cli-proxy-api-plus --kiro-import to import token from Kiro IDE's storage.
+ */
+export interface KiroImportResult {
+    success: boolean;
+    provider?: string;
+    email?: string;
+    error?: string;
+}
+/**
+ * Try to import Kiro token from Kiro IDE
+ * Uses cli-proxy-api-plus --kiro-import flag
+ */
+export declare function tryKiroImport(tokenDir: string, verbose?: boolean): Promise<KiroImportResult>;
+/**
+ * Import Kiro token with user-facing output
+ * Shows progress and result to user
+ */
+export declare function importKiroToken(verbose?: boolean): Promise<boolean>;
+//# sourceMappingURL=kiro-import.d.ts.map

package/dist/cliproxy/auth/kiro-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-import.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/kiro-import.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0GhG;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBvE"}

package/dist/cliproxy/auth/kiro-import.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * Kiro Import Helper
+ *
+ * Imports Kiro token from Kiro IDE when OAuth callback redirects to IDE instead of CLI.
+ * Spawns cli-proxy-api-plus --kiro-import to import token from Kiro IDE's storage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importKiroToken = exports.tryKiroImport = void 0;
+const child_process_1 = require("child_process");
+const ui_1 = require("../../utils/ui");
+const binary_manager_1 = require("../binary-manager");
+const config_generator_1 = require("../config-generator");
+const token_manager_1 = require("./token-manager");
+/**
+ * Try to import Kiro token from Kiro IDE
+ * Uses cli-proxy-api-plus --kiro-import flag
+ */
+async function tryKiroImport(tokenDir, verbose = false) {
+    const log = (msg) => {
+        if (verbose)
+            console.error(`[kiro-import] ${msg}`);
+    };
+    try {
+        log('Ensuring CLIProxy binary is available...');
+        const binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose);
+        const configPath = (0, config_generator_1.generateConfig)('kiro');
+        log(`Binary: ${binaryPath}`);
+        log(`Config: ${configPath}`);
+        log(`Token dir: ${tokenDir}`);
+        return new Promise((resolve) => {
+            const args = ['--config', configPath, '--kiro-import'];
+            log(`Running: ${binaryPath} ${args.join(' ')}`);
+            const proc = (0, child_process_1.spawn)(binaryPath, args, {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: { ...process.env, CLI_PROXY_AUTH_DIR: tokenDir },
+            });
+            let stdout = '';
+            let stderr = '';
+            let resolved = false;
+            const safeResolve = (result) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeoutId);
+                resolve(result);
+            };
+            proc.stdout?.on('data', (data) => {
+                const output = data.toString();
+                stdout += output;
+                log(`stdout: ${output.trim()}`);
+            });
+            proc.stderr?.on('data', (data) => {
+                const output = data.toString();
+                stderr += output;
+                log(`stderr: ${output.trim()}`);
+            });
+            proc.on('exit', (code) => {
+                log(`Exit code: ${code}`);
+                if (code === 0) {
+                    // Parse output for provider info
+                    const providerMatch = stdout.match(/Provider:\s*(\w+)/i);
+                    const emailMatch = stdout.match(/email[:\s]+([^\s,)]+)/i);
+                    const successMatch = stdout.includes('Kiro token import successful') ||
+                        stdout.includes('Imported Kiro token') ||
+                        stdout.includes('Authentication saved');
+                    if (successMatch) {
+                        safeResolve({
+                            success: true,
+                            provider: providerMatch?.[1],
+                            email: emailMatch?.[1],
+                        });
+                    }
+                    else {
+                        safeResolve({
+                            success: false,
+                            error: 'Import completed but token not confirmed',
+                        });
+                    }
+                }
+                else {
+                    const errorLine = stderr.trim().split('\n')[0] || stdout.trim().split('\n')[0];
+                    safeResolve({
+                        success: false,
+                        error: errorLine || `Exit code ${code}`,
+                    });
+                }
+            });
+            proc.on('error', (error) => {
+                log(`Process error: ${error.message}`);
+                safeResolve({
+                    success: false,
+                    error: error.message,
+                });
+            });
+            // Timeout after 30 seconds
+            const timeoutId = setTimeout(() => {
+                if (!resolved && !proc.killed) {
+                    proc.kill();
+                    safeResolve({
+                        success: false,
+                        error: 'Import timed out after 30 seconds',
+                    });
+                }
+            }, 30000);
+        });
+    }
+    catch (error) {
+        log(`Error: ${error.message}`);
+        return {
+            success: false,
+            error: error.message,
+        };
+    }
+}
+exports.tryKiroImport = tryKiroImport;
+/**
+ * Import Kiro token with user-facing output
+ * Shows progress and result to user
+ */
+async function importKiroToken(verbose = false) {
+    const tokenDir = (0, token_manager_1.getProviderTokenDir)('kiro');
+    console.log('');
+    console.log((0, ui_1.info)('Importing token from Kiro IDE...'));
+    const result = await tryKiroImport(tokenDir, verbose);
+    if (result.success) {
+        const providerInfo = result.provider ? ` (Provider: ${result.provider})` : '';
+        console.log((0, ui_1.ok)(`Imported Kiro token from IDE${providerInfo}`));
+        return true;
+    }
+    console.log((0, ui_1.fail)(`Import failed: ${result.error}`));
+    console.log('');
+    console.log('Make sure you are logged into Kiro IDE first:');
+    console.log('  1. Open Kiro IDE');
+    console.log('  2. Sign in with your AWS/Google account');
+    console.log('  3. Run: ccs kiro --import');
+    return false;
+}
+exports.importKiroToken = importKiroToken;
+//# sourceMappingURL=kiro-import.js.map

package/dist/cliproxy/auth/kiro-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-import.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/kiro-import.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,iDAAsC;AACtC,uCAAgD;AAChD,sDAAyD;AACzD,0DAAqD;AACrD,mDAAsD;AAStD;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAO,GAAG,KAAK;IACnE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,IAAA,qCAAoB,EAAC,OAAO,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAA,iCAAc,EAAC,MAAM,CAAC,CAAC;QAE1C,GAAG,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;QAE9B,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YAEvD,GAAG,CAAC,YAAY,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhD,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,UAAU,EAAE,IAAI,EAAE;gBACnC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE;aACtD,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,WAAW,GAAG,CAAC,MAAwB,EAAE,EAAE;gBAC/C,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,MAAM,CAAC;gBACjB,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,MAAM,CAAC;gBACjB,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACvB,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;gBAE1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,iCAAiC;oBACjC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACzD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBAC1D,MAAM,YAAY,GAChB,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC;wBAC/C,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;wBACtC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;oBAE1C,IAAI,YAAY,EAAE,CAAC;wBACjB,WAAW,CAAC;4BACV,OAAO,EAAE,IAAI;4BACb,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;4BAC5B,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;yBACvB,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,WAAW,CAAC;4BACV,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,0CAA0C;yBAClD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/E,WAAW,CAAC;wBACV,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,SAAS,IAAI,aAAa,IAAI,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACzB,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvC,WAAW,CAAC;oBACV,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,2BAA2B;YAC3B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;oBACZ,WAAW,CAAC;wBACV,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,mCAAmC;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,UAAW,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAG,KAAe,CAAC,OAAO;SAChC,CAAC;IACJ,CAAC;AACH,CAAC;AA1GD,sCA0GC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CAAC,OAAO,GAAG,KAAK;IACnD,MAAM,QAAQ,GAAG,IAAA,mCAAmB,EAAC,MAAM,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,kCAAkC,CAAC,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,IAAA,OAAE,EAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,kBAAkB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3C,OAAO,KAAK,CAAC;AACf,CAAC;AAtBD,0CAsBC"}

package/dist/cliproxy/auth/oauth-handler.d.ts

@@ -0,0 +1,31 @@
+/**
+ * OAuth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication flow for CLIProxy providers (Gemini, Codex, Antigravity, Kiro, Copilot).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ * 5. Handle Device Code flows for Copilot/Qwen (no callback server)
+ */
+import { CLIProxyProvider } from '../types';
+import { AccountInfo } from '../account-manager';
+import { OAuthOptions } from './auth-types';
+/**
+ * Trigger OAuth flow for provider
+ * Auto-detects headless environment and uses --no-browser flag accordingly
+ * Shows real-time step-by-step progress for better user feedback
+ * Handles both Authorization Code (callback server) and Device Code (polling) flows
+ */
+export declare function triggerOAuth(provider: CLIProxyProvider, options?: OAuthOptions): Promise<AccountInfo | null>;
+/**
+ * Ensure provider is authenticated
+ * Triggers OAuth flow if not authenticated
+ */
+export declare function ensureAuth(provider: CLIProxyProvider, options?: {
+    verbose?: boolean;
+    headless?: boolean;
+    account?: string;
+}): Promise<boolean>;
+//# sourceMappingURL=oauth-handler.d.ts.map

package/dist/cliproxy/auth/oauth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-handler.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EACL,WAAW,EAMZ,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,YAAY,EAKb,MAAM,cAAc,CAAC;AAoTtB;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAiI7B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACxE,OAAO,CAAC,OAAO,CAAC,CAiBlB"}