@jonnyhoo/ccs 1.0.0

package/dist/cliproxy/auth/token-refresh-worker.js

@@ -0,0 +1,214 @@
+"use strict";
+/**
+ * Token Refresh Worker
+ *
+ * Background worker that periodically checks and refreshes OAuth tokens
+ * before they expire. Runs as interval loop with retry logic.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenRefreshWorker = void 0;
+const token_expiry_checker_1 = require("./token-expiry-checker");
+const provider_refreshers_1 = require("./provider-refreshers");
+/** Default worker configuration */
+const DEFAULT_CONFIG = {
+    refreshInterval: 30,
+    preemptiveTime: 45,
+    maxRetries: 3,
+    retryBaseDelay: 1000,
+    refreshTimeout: 10000,
+    verbose: false,
+};
+/** Minimum config values to prevent infinite loops */
+const MIN_REFRESH_INTERVAL = 1; // 1 minute minimum
+const MIN_RETRY_BASE_DELAY = 100; // 100ms minimum
+/** Unrecoverable error patterns - don't retry these */
+const UNRECOVERABLE_ERRORS = [
+    'No refresh token',
+    'Invalid client',
+    'Invalid grant',
+    'Token has been revoked',
+    'Token not found',
+];
+/** Validate and sanitize config values */
+function sanitizeConfig(config) {
+    return {
+        refreshInterval: Math.max(MIN_REFRESH_INTERVAL, config.refreshInterval || DEFAULT_CONFIG.refreshInterval),
+        preemptiveTime: Math.max(0, config.preemptiveTime || DEFAULT_CONFIG.preemptiveTime),
+        maxRetries: Math.max(1, config.maxRetries || DEFAULT_CONFIG.maxRetries),
+        retryBaseDelay: Math.max(MIN_RETRY_BASE_DELAY, config.retryBaseDelay || DEFAULT_CONFIG.retryBaseDelay),
+        refreshTimeout: Math.max(1000, config.refreshTimeout || DEFAULT_CONFIG.refreshTimeout),
+        verbose: config.verbose ?? DEFAULT_CONFIG.verbose,
+    };
+}
+/** Promise with timeout */
+function withTimeout(promise, timeoutMs, errorMsg) {
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => setTimeout(() => reject(new Error(errorMsg)), timeoutMs)),
+    ]);
+}
+/**
+ * Background token refresh worker
+ * Manages periodic token refresh checks with retry logic
+ */
+class TokenRefreshWorker {
+    constructor(config = {}) {
+        this.intervalId = null;
+        this.running = false;
+        this.lastResults = [];
+        this.exitHandler = null;
+        this.config = sanitizeConfig({ ...DEFAULT_CONFIG, ...config });
+    }
+    /**
+     * Start the worker
+     * Runs refresh loop immediately, then on interval
+     */
+    start() {
+        if (this.running) {
+            return;
+        }
+        this.running = true;
+        this.log('[i] Token refresh worker started');
+        // Register process exit handlers for cleanup
+        this.exitHandler = () => this.stop();
+        process.on('SIGINT', this.exitHandler);
+        process.on('SIGTERM', this.exitHandler);
+        process.on('beforeExit', this.exitHandler);
+        // Run immediately on start
+        void this.refreshLoop();
+        // Then run on interval
+        const intervalMs = this.config.refreshInterval * 60 * 1000;
+        this.intervalId = setInterval(() => {
+            void this.refreshLoop();
+        }, intervalMs);
+    }
+    /**
+     * Stop the worker
+     */
+    stop() {
+        if (!this.running) {
+            return;
+        }
+        this.running = false;
+        if (this.intervalId) {
+            clearInterval(this.intervalId);
+            this.intervalId = null;
+        }
+        // Remove process exit handlers
+        if (this.exitHandler) {
+            process.off('SIGINT', this.exitHandler);
+            process.off('SIGTERM', this.exitHandler);
+            process.off('beforeExit', this.exitHandler);
+            this.exitHandler = null;
+        }
+        this.log('[i] Token refresh worker stopped');
+    }
+    /**
+     * Check if worker is active
+     */
+    isActive() {
+        return this.running;
+    }
+    /**
+     * Manually trigger refresh check now
+     */
+    async refreshNow() {
+        return await this.refreshLoop();
+    }
+    /**
+     * Get results from last refresh cycle
+     */
+    getLastRefreshResults() {
+        return [...this.lastResults];
+    }
+    /**
+     * Main refresh loop
+     * Checks all tokens and refreshes those needing refresh
+     */
+    async refreshLoop() {
+        const results = [];
+        try {
+            const tokens = (0, token_expiry_checker_1.getAllTokenExpiryInfo)();
+            const tokensNeedingRefresh = tokens.filter((t) => t.needsRefresh);
+            if (tokensNeedingRefresh.length === 0) {
+                this.log('[OK] All tokens valid, no refresh needed');
+                this.lastResults = [];
+                return results;
+            }
+            this.log(`[i] Refreshing ${tokensNeedingRefresh.length} token(s)...`);
+            for (const token of tokensNeedingRefresh) {
+                const result = await this.refreshWithRetry(token);
+                results.push(result);
+                if (result.success) {
+                    this.log(`[OK] ${token.provider}/${token.accountId} refreshed`);
+                }
+                else {
+                    this.log(`[X] ${token.provider}/${token.accountId} failed: ${result.error}`);
+                }
+            }
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : 'Unknown error';
+            this.log(`[X] Refresh loop error: ${msg}`);
+        }
+        this.lastResults = results;
+        return results;
+    }
+    /**
+     * Refresh a single token with retry logic
+     * Uses exponential backoff on failures
+     */
+    async refreshWithRetry(token) {
+        let lastError = 'Unknown error';
+        for (let attempt = 0; attempt < this.config.maxRetries; attempt++) {
+            try {
+                // Apply timeout to refresh operation
+                const result = await withTimeout((0, provider_refreshers_1.refreshToken)(token.provider, token.accountId), this.config.refreshTimeout, `Refresh timeout after ${this.config.refreshTimeout}ms`);
+                if (result.success) {
+                    return {
+                        provider: token.provider,
+                        accountId: token.accountId,
+                        success: true,
+                        refreshedAt: new Date(),
+                        nextExpiry: result.expiresAt,
+                    };
+                }
+                lastError = result.error || 'Refresh failed';
+                // Don't retry if error indicates unrecoverable issue
+                if (this.isUnrecoverableError(lastError)) {
+                    break;
+                }
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error.message : 'Unknown error';
+            }
+            // Exponential backoff before retry
+            if (attempt < this.config.maxRetries - 1) {
+                const delay = this.config.retryBaseDelay * Math.pow(2, attempt);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+        return {
+            provider: token.provider,
+            accountId: token.accountId,
+            success: false,
+            error: lastError,
+        };
+    }
+    /**
+     * Check if error is unrecoverable (should not retry)
+     */
+    isUnrecoverableError(error) {
+        return UNRECOVERABLE_ERRORS.some((pattern) => error.includes(pattern));
+    }
+    /**
+     * Log message if verbose enabled
+     */
+    log(msg) {
+        if (this.config.verbose) {
+            console.error(`[token-refresh] ${msg}`);
+        }
+    }
+}
+exports.TokenRefreshWorker = TokenRefreshWorker;
+//# sourceMappingURL=token-refresh-worker.js.map

package/dist/cliproxy/auth/token-refresh-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh-worker.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-refresh-worker.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,iEAAgF;AAChF,+DAAqD;AA4BrD,mCAAmC;AACnC,MAAM,cAAc,GAAuB;IACzC,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,UAAU,EAAE,CAAC;IACb,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,KAAK;CACf,CAAC;AAEF,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAC,mBAAmB;AACnD,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,gBAAgB;AAElD,uDAAuD;AACvD,MAAM,oBAAoB,GAAG;IAC3B,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,wBAAwB;IACxB,iBAAiB;CAClB,CAAC;AAEF,0CAA0C;AAC1C,SAAS,cAAc,CAAC,MAA0B;IAChD,OAAO;QACL,eAAe,EAAE,IAAI,CAAC,GAAG,CACvB,oBAAoB,EACpB,MAAM,CAAC,eAAe,IAAI,cAAc,CAAC,eAAe,CACzD;QACD,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,CAAC;QACnF,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC;QACvE,cAAc,EAAE,IAAI,CAAC,GAAG,CACtB,oBAAoB,EACpB,MAAM,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,CACvD;QACD,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,CAAC;QACtF,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO;KAClD,CAAC;AACJ,CAAC;AAED,2BAA2B;AAC3B,SAAS,WAAW,CAAI,OAAmB,EAAE,SAAiB,EAAE,QAAgB;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO;QACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KAC5F,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAa,kBAAkB;IAO7B,YAAY,SAAsC,EAAE;QAL5C,eAAU,GAA0B,IAAI,CAAC;QACzC,YAAO,GAAG,KAAK,CAAC;QAChB,gBAAW,GAAoB,EAAE,CAAC;QAClC,gBAAW,GAAwB,IAAI,CAAC;QAG9C,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAE7C,6CAA6C;QAC7C,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE3C,2BAA2B;QAC3B,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAExB,uBAAuB;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,+BAA+B;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW;QACvB,MAAM,OAAO,GAAoB,EAAE,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,4CAAqB,GAAE,CAAC;YACvC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAElE,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBACrD,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;gBACtB,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,kBAAkB,oBAAoB,CAAC,MAAM,cAAc,CAAC,CAAC;YAEtE,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAErB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,YAAY,CAAC,CAAC;gBAClE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAsB;QACnD,IAAI,SAAS,GAAG,eAAe,CAAC;QAEhC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,qCAAqC;gBACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,IAAA,kCAAY,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,EAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,EAC1B,yBAAyB,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CACxD,CAAC;gBAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO;wBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,UAAU,EAAE,MAAM,CAAC,SAAS;qBAC7B,CAAC;gBACJ,CAAC;gBAED,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,gBAAgB,CAAC;gBAE7C,qDAAqD;gBACrD,IAAI,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzC,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACvE,CAAC;YAED,mCAAmC;YACnC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,KAAa;QACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACK,GAAG,CAAC,GAAW;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AA7LD,gDA6LC"}

package/dist/cliproxy/auth-handler.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Auth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication for CLIProxy providers (Gemini, Codex, Antigravity).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ *
+ * Token storage: ~/.ccs/cliproxy/auth/<provider>/
+ * Each provider has its own directory to avoid conflicts.
+ *
+ * This file is a facade that re-exports from the auth/ submodule.
+ * The actual implementation is split across:
+ * - auth/auth-types.ts     - Types and OAuth configurations
+ * - auth/token-manager.ts  - Token storage/retrieval/validation
+ * - auth/oauth-handler.ts  - OAuth flow handling
+ * - auth/environment-detector.ts - Headless detection and port management
+ */
+export type { AuthStatus, ProviderOAuthConfig, OAuthOptions } from './auth';
+export { OAUTH_CALLBACK_PORTS, OAUTH_CONFIGS, PROVIDER_AUTH_PREFIXES, PROVIDER_TYPE_VALUES, getOAuthConfig, } from './auth';
+export { getProviderTokenDir, isTokenFileForProvider, isAuthenticated, getAuthStatus, getAllAuthStatus, clearAuth, displayAuthStatus, } from './auth';
+export { isHeadlessEnvironment, killProcessOnPort, getTimeoutTroubleshooting, showStep, } from './auth';
+export { triggerOAuth, ensureAuth } from './auth';
+/**
+ * Initialize accounts registry from existing tokens
+ * Should be called on startup to populate accounts from existing token files
+ */
+export declare function initializeAccounts(): void;
+//# sourceMappingURL=auth-handler.d.ts.map

package/dist/cliproxy/auth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../src/cliproxy/auth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG5E,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,QAAQ,GACT,MAAM,QAAQ,CAAC;AAGhB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAKlD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/cliproxy/auth-handler.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Auth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication for CLIProxy providers (Gemini, Codex, Antigravity).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ *
+ * Token storage: ~/.ccs/cliproxy/auth/<provider>/
+ * Each provider has its own directory to avoid conflicts.
+ *
+ * This file is a facade that re-exports from the auth/ submodule.
+ * The actual implementation is split across:
+ * - auth/auth-types.ts     - Types and OAuth configurations
+ * - auth/token-manager.ts  - Token storage/retrieval/validation
+ * - auth/oauth-handler.ts  - OAuth flow handling
+ * - auth/environment-detector.ts - Headless detection and port management
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initializeAccounts = exports.ensureAuth = exports.triggerOAuth = exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = exports.displayAuthStatus = exports.clearAuth = exports.getAllAuthStatus = exports.getAuthStatus = exports.isAuthenticated = exports.isTokenFileForProvider = exports.getProviderTokenDir = exports.getOAuthConfig = exports.PROVIDER_TYPE_VALUES = exports.PROVIDER_AUTH_PREFIXES = exports.OAUTH_CONFIGS = exports.OAUTH_CALLBACK_PORTS = void 0;
+// Re-export configurations
+var auth_1 = require("./auth");
+Object.defineProperty(exports, "OAUTH_CALLBACK_PORTS", { enumerable: true, get: function () { return auth_1.OAUTH_CALLBACK_PORTS; } });
+Object.defineProperty(exports, "OAUTH_CONFIGS", { enumerable: true, get: function () { return auth_1.OAUTH_CONFIGS; } });
+Object.defineProperty(exports, "PROVIDER_AUTH_PREFIXES", { enumerable: true, get: function () { return auth_1.PROVIDER_AUTH_PREFIXES; } });
+Object.defineProperty(exports, "PROVIDER_TYPE_VALUES", { enumerable: true, get: function () { return auth_1.PROVIDER_TYPE_VALUES; } });
+Object.defineProperty(exports, "getOAuthConfig", { enumerable: true, get: function () { return auth_1.getOAuthConfig; } });
+// Re-export token management functions
+var auth_2 = require("./auth");
+Object.defineProperty(exports, "getProviderTokenDir", { enumerable: true, get: function () { return auth_2.getProviderTokenDir; } });
+Object.defineProperty(exports, "isTokenFileForProvider", { enumerable: true, get: function () { return auth_2.isTokenFileForProvider; } });
+Object.defineProperty(exports, "isAuthenticated", { enumerable: true, get: function () { return auth_2.isAuthenticated; } });
+Object.defineProperty(exports, "getAuthStatus", { enumerable: true, get: function () { return auth_2.getAuthStatus; } });
+Object.defineProperty(exports, "getAllAuthStatus", { enumerable: true, get: function () { return auth_2.getAllAuthStatus; } });
+Object.defineProperty(exports, "clearAuth", { enumerable: true, get: function () { return auth_2.clearAuth; } });
+Object.defineProperty(exports, "displayAuthStatus", { enumerable: true, get: function () { return auth_2.displayAuthStatus; } });
+// Re-export environment detection functions
+var auth_3 = require("./auth");
+Object.defineProperty(exports, "isHeadlessEnvironment", { enumerable: true, get: function () { return auth_3.isHeadlessEnvironment; } });
+Object.defineProperty(exports, "killProcessOnPort", { enumerable: true, get: function () { return auth_3.killProcessOnPort; } });
+Object.defineProperty(exports, "getTimeoutTroubleshooting", { enumerable: true, get: function () { return auth_3.getTimeoutTroubleshooting; } });
+Object.defineProperty(exports, "showStep", { enumerable: true, get: function () { return auth_3.showStep; } });
+// Re-export OAuth handling functions
+var auth_4 = require("./auth");
+Object.defineProperty(exports, "triggerOAuth", { enumerable: true, get: function () { return auth_4.triggerOAuth; } });
+Object.defineProperty(exports, "ensureAuth", { enumerable: true, get: function () { return auth_4.ensureAuth; } });
+// Re-export account management initialization
+const account_manager_1 = require("./account-manager");
+/**
+ * Initialize accounts registry from existing tokens
+ * Should be called on startup to populate accounts from existing token files
+ */
+function initializeAccounts() {
+    (0, account_manager_1.discoverExistingAccounts)();
+}
+exports.initializeAccounts = initializeAccounts;
+//# sourceMappingURL=auth-handler.js.map

package/dist/cliproxy/auth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handler.js","sourceRoot":"","sources":["../../src/cliproxy/auth-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAKH,2BAA2B;AAC3B,+BAMgB;AALd,4GAAA,oBAAoB,OAAA;AACpB,qGAAA,aAAa,OAAA;AACb,8GAAA,sBAAsB,OAAA;AACtB,4GAAA,oBAAoB,OAAA;AACpB,sGAAA,cAAc,OAAA;AAGhB,uCAAuC;AACvC,+BAQgB;AAPd,2GAAA,mBAAmB,OAAA;AACnB,8GAAA,sBAAsB,OAAA;AACtB,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,wGAAA,gBAAgB,OAAA;AAChB,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AAGnB,4CAA4C;AAC5C,+BAKgB;AAJd,6GAAA,qBAAqB,OAAA;AACrB,yGAAA,iBAAiB,OAAA;AACjB,iHAAA,yBAAyB,OAAA;AACzB,gGAAA,QAAQ,OAAA;AAGV,qCAAqC;AACrC,+BAAkD;AAAzC,oGAAA,YAAY,OAAA;AAAE,kGAAA,UAAU,OAAA;AAEjC,8CAA8C;AAC9C,uDAA6D;AAE7D;;;GAGG;AACH,SAAgB,kBAAkB;IAChC,IAAA,0CAAwB,GAAE,CAAC;AAC7B,CAAC;AAFD,gDAEC"}

package/dist/cliproxy/auth-session-manager.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Auth Session Manager
+ *
+ * Tracks active OAuth sessions and provides cancellation capability.
+ * Used to properly terminate in-progress OAuth flows from UI.
+ */
+/// <reference types="node" />
+/// <reference types="node" />
+import { EventEmitter } from 'events';
+import { ChildProcess } from 'child_process';
+export interface ActiveAuthSession {
+    sessionId: string;
+    provider: string;
+    startedAt: number;
+    process?: ChildProcess;
+}
+export declare const authSessionEvents: EventEmitter<[never]>;
+/**
+ * Register an active OAuth session
+ */
+export declare function registerAuthSession(sessionId: string, provider: string, process?: ChildProcess): void;
+/**
+ * Update session with process reference (if registered before spawn)
+ */
+export declare function attachProcessToSession(sessionId: string, process: ChildProcess): void;
+/**
+ * Unregister an auth session (on completion or cancellation)
+ */
+export declare function unregisterAuthSession(sessionId: string): void;
+/**
+ * Cancel an active OAuth session
+ * Returns true if session was found and killed
+ */
+export declare function cancelAuthSession(sessionId: string): boolean;
+/**
+ * Get active session by session ID
+ */
+export declare function getActiveSession(sessionId: string): ActiveAuthSession | null;
+/**
+ * Get active session for a provider (most recent)
+ */
+export declare function getActiveSessionForProvider(provider: string): ActiveAuthSession | null;
+/**
+ * Check if there's an active session for provider
+ */
+export declare function hasActiveSession(provider: string): boolean;
+/**
+ * Cancel all sessions for a provider
+ */
+export declare function cancelAllSessionsForProvider(provider: string): number;
+//# sourceMappingURL=auth-session-manager.d.ts.map

package/dist/cliproxy/auth-session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-manager.d.ts","sourceRoot":"","sources":["../../src/cliproxy/auth-session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAK7C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,eAAO,MAAM,iBAAiB,uBAAqB,CAAC;AA6BpD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CAUN;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAKrF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAG7D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAc5D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAE5E;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAOtF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAarE"}

package/dist/cliproxy/auth-session-manager.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Auth Session Manager
+ *
+ * Tracks active OAuth sessions and provides cancellation capability.
+ * Used to properly terminate in-progress OAuth flows from UI.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cancelAllSessionsForProvider = exports.hasActiveSession = exports.getActiveSessionForProvider = exports.getActiveSession = exports.cancelAuthSession = exports.unregisterAuthSession = exports.attachProcessToSession = exports.registerAuthSession = exports.authSessionEvents = void 0;
+const events_1 = require("events");
+// H8: TTL for stale session cleanup (10 minutes - generous for OAuth flows)
+const SESSION_TTL_MS = 10 * 60 * 1000;
+exports.authSessionEvents = new events_1.EventEmitter();
+const activeSessions = new Map();
+// H8: Periodic cleanup of stale sessions (prevents memory leak from orphaned sessions)
+let cleanupInterval = null;
+function startCleanupInterval() {
+    if (cleanupInterval)
+        return;
+    cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [sessionId, session] of activeSessions.entries()) {
+            if (now - session.startedAt > SESSION_TTL_MS) {
+                // Stale session - kill process if still running, then remove
+                if (session.process && !session.process.killed) {
+                    session.process.kill('SIGTERM');
+                }
+                activeSessions.delete(sessionId);
+                exports.authSessionEvents.emit('session:expired', sessionId);
+            }
+        }
+        // Stop interval if no active sessions
+        if (activeSessions.size === 0 && cleanupInterval) {
+            clearInterval(cleanupInterval);
+            cleanupInterval = null;
+        }
+    }, 60000); // Check every minute
+}
+/**
+ * Register an active OAuth session
+ */
+function registerAuthSession(sessionId, provider, process) {
+    activeSessions.set(sessionId, {
+        sessionId,
+        provider,
+        startedAt: Date.now(),
+        process,
+    });
+    // H8: Start TTL cleanup when first session registered
+    startCleanupInterval();
+    exports.authSessionEvents.emit('session:started', sessionId, provider);
+}
+exports.registerAuthSession = registerAuthSession;
+/**
+ * Update session with process reference (if registered before spawn)
+ */
+function attachProcessToSession(sessionId, process) {
+    const session = activeSessions.get(sessionId);
+    if (session) {
+        session.process = process;
+    }
+}
+exports.attachProcessToSession = attachProcessToSession;
+/**
+ * Unregister an auth session (on completion or cancellation)
+ */
+function unregisterAuthSession(sessionId) {
+    activeSessions.delete(sessionId);
+    exports.authSessionEvents.emit('session:ended', sessionId);
+}
+exports.unregisterAuthSession = unregisterAuthSession;
+/**
+ * Cancel an active OAuth session
+ * Returns true if session was found and killed
+ */
+function cancelAuthSession(sessionId) {
+    const session = activeSessions.get(sessionId);
+    if (!session) {
+        return false;
+    }
+    // Kill the process if attached
+    if (session.process && !session.process.killed) {
+        session.process.kill('SIGTERM');
+    }
+    activeSessions.delete(sessionId);
+    exports.authSessionEvents.emit('session:cancelled', sessionId);
+    return true;
+}
+exports.cancelAuthSession = cancelAuthSession;
+/**
+ * Get active session by session ID
+ */
+function getActiveSession(sessionId) {
+    return activeSessions.get(sessionId) || null;
+}
+exports.getActiveSession = getActiveSession;
+/**
+ * Get active session for a provider (most recent)
+ */
+function getActiveSessionForProvider(provider) {
+    for (const session of activeSessions.values()) {
+        if (session.provider === provider) {
+            return session;
+        }
+    }
+    return null;
+}
+exports.getActiveSessionForProvider = getActiveSessionForProvider;
+/**
+ * Check if there's an active session for provider
+ */
+function hasActiveSession(provider) {
+    return getActiveSessionForProvider(provider) !== null;
+}
+exports.hasActiveSession = hasActiveSession;
+/**
+ * Cancel all sessions for a provider
+ */
+function cancelAllSessionsForProvider(provider) {
+    let count = 0;
+    for (const [sessionId, session] of activeSessions.entries()) {
+        if (session.provider === provider) {
+            if (session.process && !session.process.killed) {
+                session.process.kill('SIGTERM');
+            }
+            activeSessions.delete(sessionId);
+            exports.authSessionEvents.emit('session:cancelled', sessionId);
+            count++;
+        }
+    }
+    return count;
+}
+exports.cancelAllSessionsForProvider = cancelAllSessionsForProvider;
+//# sourceMappingURL=auth-session-manager.js.map

package/dist/cliproxy/auth-session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-manager.js","sourceRoot":"","sources":["../../src/cliproxy/auth-session-manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,mCAAsC;AAGtC,4EAA4E;AAC5E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AASzB,QAAA,iBAAiB,GAAG,IAAI,qBAAY,EAAE,CAAC;AAEpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE5D,uFAAuF;AACvF,IAAI,eAAe,GAA0C,IAAI,CAAC;AAElE,SAAS,oBAAoB;IAC3B,IAAI,eAAe;QAAE,OAAO;IAC5B,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;gBAC7C,6DAA6D;gBAC7D,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClC,CAAC;gBACD,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,yBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,sCAAsC;QACtC,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;YACjD,aAAa,CAAC,eAAe,CAAC,CAAC;YAC/B,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB;AAClC,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,SAAiB,EACjB,QAAgB,EAChB,OAAsB;IAEtB,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE;QAC5B,SAAS;QACT,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,OAAO;KACR,CAAC,CAAC;IACH,sDAAsD;IACtD,oBAAoB,EAAE,CAAC;IACvB,yBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAdD,kDAcC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,OAAqB;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IAC5B,CAAC;AACH,CAAC;AALD,wDAKC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,yBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAHD,sDAGC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,SAAiB;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,yBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAdD,8CAcC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAFD,4CAEC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CAAC,QAAgB;IAC1D,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAPD,kEAOC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,2BAA2B,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AACxD,CAAC;AAFD,4CAEC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;YACD,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,yBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACvD,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAbD,oEAaC"}

package/dist/cliproxy/auth-token-manager.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Auth Token Manager for CLIProxyAPI
+ *
+ * Manages API key and management secret resolution with inheritance:
+ * - Per-variant override → Global config → Default constants
+ *
+ * Provides secure token generation for user customization.
+ */
+/**
+ * Generate a cryptographically secure token.
+ * Uses CSPRNG (crypto.randomBytes) for proper entropy.
+ *
+ * @param length - Number of random bytes (default: 32 = 256-bit entropy)
+ * @returns Base64URL-encoded token (43 chars for 32 bytes)
+ */
+export declare function generateSecureToken(length?: number): string;
+/**
+ * Mask a token for display.
+ * Shows first 4 and last 4 chars: "ccs_...4f2a"
+ * Used by CLI commands and API routes.
+ */
+export declare function maskToken(token: string): string;
+/**
+ * Get effective API key with inheritance chain.
+ * Priority: variant auth → global cliproxy.auth → default constant
+ *
+ * @param variantName - Optional variant name for per-variant override
+ * @returns Resolved API key
+ */
+export declare function getEffectiveApiKey(variantName?: string): string;
+/**
+ * Get effective management secret.
+ * Priority: global cliproxy.auth → default constant
+ *
+ * Note: Management secret is global-only (no per-variant override)
+ * as it controls the Control Panel access for the entire CLIProxy instance.
+ *
+ * @returns Resolved management secret
+ */
+export declare function getEffectiveManagementSecret(): string;
+/**
+ * Set global API key.
+ * Updates cliproxy.auth.api_key in config.yaml.
+ *
+ * @param apiKey - New API key (or undefined to reset to default)
+ */
+export declare function setGlobalApiKey(apiKey: string | undefined): void;
+/**
+ * Set global management secret.
+ * Updates cliproxy.auth.management_secret in config.yaml.
+ *
+ * @param secret - New management secret (or undefined to reset to default)
+ */
+export declare function setGlobalManagementSecret(secret: string | undefined): void;
+/**
+ * Set per-variant API key override.
+ * Updates variants[variantName].auth.api_key in config.yaml.
+ *
+ * @param variantName - Variant name
+ * @param apiKey - New API key (or undefined to remove override)
+ */
+export declare function setVariantApiKey(variantName: string, apiKey: string | undefined): void;
+/**
+ * Reset all auth settings to defaults.
+ * Removes cliproxy.auth and all variant auth overrides.
+ */
+export declare function resetAuthToDefaults(): void;
+/**
+ * Get auth configuration summary for display.
+ * Returns current effective values and whether they're customized.
+ */
+export declare function getAuthSummary(): {
+    apiKey: {
+        value: string;
+        isCustom: boolean;
+    };
+    managementSecret: {
+        value: string;
+        isCustom: boolean;
+    };
+};
+//# sourceMappingURL=auth-token-manager.d.ts.map

package/dist/cliproxy/auth-token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-manager.d.ts","sourceRoot":"","sources":["../../src/cliproxy/auth-token-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAK,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAkB/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,CAUrD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAchE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAc1E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAuBtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAe1C;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI;IAChC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,gBAAgB,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAgBA"}