@kaitranntt/ccs 6.7.0 → 6.7.1-dev.1

package/dist/cliproxy/auth/auth-types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Auth Types and Configurations
+ *
+ * Type definitions and OAuth configurations for CLIProxy authentication.
+ */
+import { CLIProxyProvider } from '../types';
+import { AccountInfo } from '../account-manager';
+/**
+ * OAuth callback ports used by CLIProxyAPI (hardcoded in binary)
+ * See: https://github.com/router-for-me/CLIProxyAPI/tree/main/internal/auth
+ *
+ * OAuth flow types per provider:
+ * - Gemini: Authorization Code Flow with local callback server on port 8085
+ * - Codex:  Authorization Code Flow with local callback server on port 1455
+ * - Agy:    Authorization Code Flow with local callback server on port 51121
+ * - Qwen:   Device Code Flow (polling-based, NO callback port needed)
+ */
+export declare const OAUTH_CALLBACK_PORTS: Partial<Record<CLIProxyProvider, number>>;
+/**
+ * Auth status for a provider
+ */
+export interface AuthStatus {
+    /** Provider name */
+    provider: CLIProxyProvider;
+    /** Whether authentication exists */
+    authenticated: boolean;
+    /** Path to token directory */
+    tokenDir: string;
+    /** Token file paths found */
+    tokenFiles: string[];
+    /** When last authenticated (if known) */
+    lastAuth?: Date;
+    /** Accounts registered for this provider (multi-account support) */
+    accounts: AccountInfo[];
+    /** Default account ID */
+    defaultAccount?: string;
+}
+/**
+ * OAuth config for each provider
+ */
+export interface ProviderOAuthConfig {
+    /** Provider identifier */
+    provider: CLIProxyProvider;
+    /** Display name */
+    displayName: string;
+    /** OAuth authorization URL (for manual flow) */
+    authUrl: string;
+    /** Scopes required */
+    scopes: string[];
+    /** CLI flag for auth */
+    authFlag: string;
+}
+/**
+ * OAuth configurations per provider
+ * Note: CLIProxyAPI handles actual OAuth - these are for display/manual flow
+ */
+export declare const OAUTH_CONFIGS: Record<CLIProxyProvider, ProviderOAuthConfig>;
+/**
+ * Provider-specific auth file prefixes (fallback detection)
+ * CLIProxyAPI names auth files with provider prefix (e.g., "antigravity-user@email.json")
+ * Note: Gemini tokens may NOT have prefix - CLIProxyAPI uses {email}-{projectID}.json format
+ */
+export declare const PROVIDER_AUTH_PREFIXES: Record<CLIProxyProvider, string[]>;
+/**
+ * Provider type values inside token JSON files
+ * CLIProxyAPI sets "type" field in token JSON (e.g., {"type": "gemini"})
+ */
+export declare const PROVIDER_TYPE_VALUES: Record<CLIProxyProvider, string[]>;
+/**
+ * Get OAuth config for provider
+ */
+export declare function getOAuthConfig(provider: CLIProxyProvider): ProviderOAuthConfig;
+/**
+ * OAuth options for triggerOAuth
+ */
+export interface OAuthOptions {
+    verbose?: boolean;
+    headless?: boolean;
+    account?: string;
+    add?: boolean;
+    nickname?: string;
+    /** If true, triggered from Web UI (enables project selection prompt) */
+    fromUI?: boolean;
+}
+//# sourceMappingURL=auth-types.d.ts.map

package/dist/cliproxy/auth/auth-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-types.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAK1E,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,oBAAoB;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oCAAoC;IACpC,aAAa,EAAE,OAAO,CAAC;IACvB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,6BAA6B;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,oEAAoE;IACpE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,yBAAyB;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0BAA0B;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAoCvE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAMrE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAMnE,CAAC;AAEF;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,mBAAmB,CAM9E;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB"}

package/dist/cliproxy/auth/auth-types.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Auth Types and Configurations
+ *
+ * Type definitions and OAuth configurations for CLIProxy authentication.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOAuthConfig = exports.PROVIDER_TYPE_VALUES = exports.PROVIDER_AUTH_PREFIXES = exports.OAUTH_CONFIGS = exports.OAUTH_CALLBACK_PORTS = void 0;
+/**
+ * OAuth callback ports used by CLIProxyAPI (hardcoded in binary)
+ * See: https://github.com/router-for-me/CLIProxyAPI/tree/main/internal/auth
+ *
+ * OAuth flow types per provider:
+ * - Gemini: Authorization Code Flow with local callback server on port 8085
+ * - Codex:  Authorization Code Flow with local callback server on port 1455
+ * - Agy:    Authorization Code Flow with local callback server on port 51121
+ * - Qwen:   Device Code Flow (polling-based, NO callback port needed)
+ */
+exports.OAUTH_CALLBACK_PORTS = {
+    gemini: 8085,
+    // codex uses 1455
+    // agy uses 51121
+    // qwen uses Device Code Flow - no callback port needed
+};
+/**
+ * OAuth configurations per provider
+ * Note: CLIProxyAPI handles actual OAuth - these are for display/manual flow
+ */
+exports.OAUTH_CONFIGS = {
+    gemini: {
+        provider: 'gemini',
+        displayName: 'Google Gemini',
+        authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+        scopes: ['https://www.googleapis.com/auth/generative-language'],
+        authFlag: '--login',
+    },
+    codex: {
+        provider: 'codex',
+        displayName: 'Codex',
+        authUrl: 'https://auth.openai.com/authorize',
+        scopes: ['openid', 'profile'],
+        authFlag: '--codex-login',
+    },
+    agy: {
+        provider: 'agy',
+        displayName: 'Antigravity',
+        authUrl: 'https://antigravity.ai/oauth/authorize',
+        scopes: ['api'],
+        authFlag: '--antigravity-login',
+    },
+    qwen: {
+        provider: 'qwen',
+        displayName: 'Qwen Code',
+        authUrl: 'https://chat.qwen.ai/api/v1/oauth2/device/code',
+        scopes: ['openid', 'profile', 'email', 'model.completion'],
+        authFlag: '--qwen-login',
+    },
+    iflow: {
+        provider: 'iflow',
+        displayName: 'iFlow',
+        authUrl: 'https://iflow.cn/oauth',
+        scopes: ['phone', 'profile', 'email'],
+        authFlag: '--iflow-login',
+    },
+};
+/**
+ * Provider-specific auth file prefixes (fallback detection)
+ * CLIProxyAPI names auth files with provider prefix (e.g., "antigravity-user@email.json")
+ * Note: Gemini tokens may NOT have prefix - CLIProxyAPI uses {email}-{projectID}.json format
+ */
+exports.PROVIDER_AUTH_PREFIXES = {
+    gemini: ['gemini-', 'google-'],
+    codex: ['codex-', 'openai-'],
+    agy: ['antigravity-', 'agy-'],
+    qwen: ['qwen-'],
+    iflow: ['iflow-'],
+};
+/**
+ * Provider type values inside token JSON files
+ * CLIProxyAPI sets "type" field in token JSON (e.g., {"type": "gemini"})
+ */
+exports.PROVIDER_TYPE_VALUES = {
+    gemini: ['gemini'],
+    codex: ['codex'],
+    agy: ['antigravity'],
+    qwen: ['qwen'],
+    iflow: ['iflow'],
+};
+/**
+ * Get OAuth config for provider
+ */
+function getOAuthConfig(provider) {
+    const config = exports.OAUTH_CONFIGS[provider];
+    if (!config) {
+        throw new Error(`Unknown provider: ${provider}`);
+    }
+    return config;
+}
+exports.getOAuthConfig = getOAuthConfig;
+//# sourceMappingURL=auth-types.js.map

package/dist/cliproxy/auth/auth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-types.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/auth-types.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAKH;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAA8C;IAC7E,MAAM,EAAE,IAAI;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,uDAAuD;CACxD,CAAC;AAsCF;;;GAGG;AACU,QAAA,aAAa,GAAkD;IAC1E,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,8CAA8C;QACvD,MAAM,EAAE,CAAC,qDAAqD,CAAC;QAC/D,QAAQ,EAAE,SAAS;KACpB;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,mCAAmC;QAC5C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC7B,QAAQ,EAAE,eAAe;KAC1B;IACD,GAAG,EAAE;QACH,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,wCAAwC;QACjD,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,QAAQ,EAAE,qBAAqB;KAChC;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC;QAC1D,QAAQ,EAAE,cAAc;KACzB;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,eAAe;KAC1B;CACF,CAAC;AAEF;;;;GAIG;AACU,QAAA,sBAAsB,GAAuC;IACxE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC5B,GAAG,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,KAAK,EAAE,CAAC,QAAQ,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACU,QAAA,oBAAoB,GAAuC;IACtE,MAAM,EAAE,CAAC,QAAQ,CAAC;IAClB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,GAAG,EAAE,CAAC,aAAa,CAAC;IACpB,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,CAAC,OAAO,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,SAAgB,cAAc,CAAC,QAA0B;IACvD,MAAM,MAAM,GAAG,qBAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAND,wCAMC"}

package/dist/cliproxy/auth/environment-detector.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Environment Detector for CLIProxyAPI
+ *
+ * Detects headless environments and manages OAuth callback ports.
+ */
+import { CLIProxyProvider } from '../types';
+/**
+ * Detect if running in a headless environment (no browser available)
+ *
+ * IMPROVED: Avoids false positives on Windows desktop environments
+ * where isTTY may be undefined due to terminal wrapper behavior.
+ *
+ * Case study: Vietnamese Windows users reported "command hangs" because
+ * their terminal (PowerShell via npm) didn't set isTTY correctly.
+ */
+export declare function isHeadlessEnvironment(): boolean;
+/**
+ * Kill any process using a specific port
+ * Used to free OAuth callback port before authentication
+ */
+export declare function killProcessOnPort(port: number, verbose: boolean): boolean;
+/**
+ * Get platform-specific troubleshooting for OAuth timeout
+ */
+export declare function getTimeoutTroubleshooting(provider: CLIProxyProvider, port: number | null): string[];
+/**
+ * Display a single step status line
+ */
+export declare function showStep(step: number, total: number, status: 'ok' | 'fail' | 'progress', message: string): void;
+//# sourceMappingURL=environment-detector.d.ts.map

package/dist/cliproxy/auth/environment-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-detector.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/environment-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAqC/C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAmCzE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,EAAE,CAcV;AAED;;GAEG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,UAAU,EAClC,OAAO,EAAE,MAAM,GACd,IAAI,CAGN"}

package/dist/cliproxy/auth/environment-detector.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Environment Detector for CLIProxyAPI
+ *
+ * Detects headless environments and manages OAuth callback ports.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = void 0;
+const child_process_1 = require("child_process");
+/**
+ * Detect if running in a headless environment (no browser available)
+ *
+ * IMPROVED: Avoids false positives on Windows desktop environments
+ * where isTTY may be undefined due to terminal wrapper behavior.
+ *
+ * Case study: Vietnamese Windows users reported "command hangs" because
+ * their terminal (PowerShell via npm) didn't set isTTY correctly.
+ */
+function isHeadlessEnvironment() {
+    // SSH session - always headless
+    if (process.env.SSH_TTY || process.env.SSH_CLIENT || process.env.SSH_CONNECTION) {
+        return true;
+    }
+    // No display on Linux (X11/Wayland) - headless
+    if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+        return true;
+    }
+    // Windows desktop - NEVER headless unless SSH (already checked above)
+    // This fixes false positive where Windows npm wrappers don't set isTTY correctly
+    // Windows desktop environments always have browser capability
+    if (process.platform === 'win32') {
+        return false;
+    }
+    // macOS - check for proper terminal
+    if (process.platform === 'darwin') {
+        // Non-interactive stdin on macOS means likely piped/scripted
+        if (!process.stdin.isTTY) {
+            return true;
+        }
+        return false;
+    }
+    // Linux with display - check TTY
+    if (process.platform === 'linux') {
+        if (!process.stdin.isTTY) {
+            return true;
+        }
+        return false;
+    }
+    // Default fallback for unknown platforms
+    return !process.stdin.isTTY;
+}
+exports.isHeadlessEnvironment = isHeadlessEnvironment;
+/**
+ * Kill any process using a specific port
+ * Used to free OAuth callback port before authentication
+ */
+function killProcessOnPort(port, verbose) {
+    try {
+        if (process.platform === 'win32') {
+            // Windows: use netstat + taskkill
+            const result = (0, child_process_1.execSync)(`netstat -ano | findstr :${port}`, {
+                encoding: 'utf-8',
+                stdio: 'pipe',
+            });
+            const lines = result.trim().split('\n');
+            for (const line of lines) {
+                const parts = line.trim().split(/\s+/);
+                const pid = parts[parts.length - 1];
+                if (pid && /^\d+$/.test(pid)) {
+                    (0, child_process_1.execSync)(`taskkill /F /PID ${pid}`, { stdio: 'pipe' });
+                    if (verbose)
+                        console.error(`[auth] Killed process ${pid} on port ${port}`);
+                }
+            }
+            return true;
+        }
+        else {
+            // Unix: use lsof + kill
+            const result = (0, child_process_1.execSync)(`lsof -ti:${port}`, { encoding: 'utf-8', stdio: 'pipe' });
+            const pids = result
+                .trim()
+                .split('\n')
+                .filter((p) => p);
+            for (const pid of pids) {
+                (0, child_process_1.execSync)(`kill -9 ${pid}`, { stdio: 'pipe' });
+                if (verbose)
+                    console.error(`[auth] Killed process ${pid} on port ${port}`);
+            }
+            return pids.length > 0;
+        }
+    }
+    catch {
+        // No process on port or command failed - that's fine
+        return false;
+    }
+}
+exports.killProcessOnPort = killProcessOnPort;
+/**
+ * Get platform-specific troubleshooting for OAuth timeout
+ */
+function getTimeoutTroubleshooting(provider, port) {
+    const lines = [];
+    lines.push('');
+    lines.push('TROUBLESHOOTING:');
+    lines.push('  1. Check browser completed auth (should show success page)');
+    if (port) {
+        lines.push(`  2. Check for port conflicts: lsof -ti:${port} or ss -tlnp | grep ${port}`);
+        lines.push(`  3. Try: ccs ${provider} --auth --verbose`);
+    }
+    else {
+        lines.push(`  2. Try: ccs ${provider} --auth --verbose`);
+    }
+    return lines;
+}
+exports.getTimeoutTroubleshooting = getTimeoutTroubleshooting;
+/**
+ * Display a single step status line
+ */
+function showStep(step, total, status, message) {
+    const statusIcon = status === 'ok' ? '[OK]' : status === 'fail' ? '[X]' : '[..]';
+    console.log(`${statusIcon} [${step}/${total}] ${message}`);
+}
+exports.showStep = showStep;
+//# sourceMappingURL=environment-detector.js.map

package/dist/cliproxy/auth/environment-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-detector.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/environment-detector.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,iDAAyC;AAGzC;;;;;;;;GAQG;AACH,SAAgB,qBAAqB;IACnC,gCAAgC;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,iFAAiF;IACjF,8DAA8D;IAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,6DAA6D;QAC7D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yCAAyC;IACzC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AAC9B,CAAC;AArCD,sDAqCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,OAAgB;IAC9D,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,kCAAkC;YAClC,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,2BAA2B,IAAI,EAAE,EAAE;gBACzD,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACpC,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,IAAA,wBAAQ,EAAC,oBAAoB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBACvD,IAAI,OAAO;wBAAE,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,YAAY,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM;iBAChB,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAA,wBAAQ,EAAC,WAAW,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9C,IAAI,OAAO;oBAAE,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAnCD,8CAmCC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CACvC,QAA0B,EAC1B,IAAmB;IAEnB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAE3E,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,2CAA2C,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,mBAAmB,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAjBD,8DAiBC;AAED;;GAEG;AACH,SAAgB,QAAQ,CACtB,IAAY,EACZ,KAAa,EACb,MAAkC,EAClC,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AARD,4BAQC"}

package/dist/cliproxy/auth/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Auth Module - Barrel Export
+ *
+ * Re-exports all auth-related functionality from submodules.
+ */
+export type { AuthStatus, ProviderOAuthConfig, OAuthOptions } from './auth-types';
+export { OAUTH_CALLBACK_PORTS, OAUTH_CONFIGS, PROVIDER_AUTH_PREFIXES, PROVIDER_TYPE_VALUES, getOAuthConfig, } from './auth-types';
+export { getProviderTokenDir, isTokenFileForProvider, isAuthenticated, getAuthStatus, getAllAuthStatus, clearAuth, registerAccountFromToken, displayAuthStatus, } from './token-manager';
+export { isHeadlessEnvironment, killProcessOnPort, getTimeoutTroubleshooting, showStep, } from './environment-detector';
+export { triggerOAuth, ensureAuth } from './oauth-handler';
+//# sourceMappingURL=index.d.ts.map

package/dist/cliproxy/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,QAAQ,GACT,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cliproxy/auth/index.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Auth Module - Barrel Export
+ *
+ * Re-exports all auth-related functionality from submodules.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAuth = exports.triggerOAuth = exports.showStep = exports.getTimeoutTroubleshooting = exports.killProcessOnPort = exports.isHeadlessEnvironment = exports.displayAuthStatus = exports.registerAccountFromToken = exports.clearAuth = exports.getAllAuthStatus = exports.getAuthStatus = exports.isAuthenticated = exports.isTokenFileForProvider = exports.getProviderTokenDir = exports.getOAuthConfig = exports.PROVIDER_TYPE_VALUES = exports.PROVIDER_AUTH_PREFIXES = exports.OAUTH_CONFIGS = exports.OAUTH_CALLBACK_PORTS = void 0;
+var auth_types_1 = require("./auth-types");
+Object.defineProperty(exports, "OAUTH_CALLBACK_PORTS", { enumerable: true, get: function () { return auth_types_1.OAUTH_CALLBACK_PORTS; } });
+Object.defineProperty(exports, "OAUTH_CONFIGS", { enumerable: true, get: function () { return auth_types_1.OAUTH_CONFIGS; } });
+Object.defineProperty(exports, "PROVIDER_AUTH_PREFIXES", { enumerable: true, get: function () { return auth_types_1.PROVIDER_AUTH_PREFIXES; } });
+Object.defineProperty(exports, "PROVIDER_TYPE_VALUES", { enumerable: true, get: function () { return auth_types_1.PROVIDER_TYPE_VALUES; } });
+Object.defineProperty(exports, "getOAuthConfig", { enumerable: true, get: function () { return auth_types_1.getOAuthConfig; } });
+// Token management
+var token_manager_1 = require("./token-manager");
+Object.defineProperty(exports, "getProviderTokenDir", { enumerable: true, get: function () { return token_manager_1.getProviderTokenDir; } });
+Object.defineProperty(exports, "isTokenFileForProvider", { enumerable: true, get: function () { return token_manager_1.isTokenFileForProvider; } });
+Object.defineProperty(exports, "isAuthenticated", { enumerable: true, get: function () { return token_manager_1.isAuthenticated; } });
+Object.defineProperty(exports, "getAuthStatus", { enumerable: true, get: function () { return token_manager_1.getAuthStatus; } });
+Object.defineProperty(exports, "getAllAuthStatus", { enumerable: true, get: function () { return token_manager_1.getAllAuthStatus; } });
+Object.defineProperty(exports, "clearAuth", { enumerable: true, get: function () { return token_manager_1.clearAuth; } });
+Object.defineProperty(exports, "registerAccountFromToken", { enumerable: true, get: function () { return token_manager_1.registerAccountFromToken; } });
+Object.defineProperty(exports, "displayAuthStatus", { enumerable: true, get: function () { return token_manager_1.displayAuthStatus; } });
+// Environment detection
+var environment_detector_1 = require("./environment-detector");
+Object.defineProperty(exports, "isHeadlessEnvironment", { enumerable: true, get: function () { return environment_detector_1.isHeadlessEnvironment; } });
+Object.defineProperty(exports, "killProcessOnPort", { enumerable: true, get: function () { return environment_detector_1.killProcessOnPort; } });
+Object.defineProperty(exports, "getTimeoutTroubleshooting", { enumerable: true, get: function () { return environment_detector_1.getTimeoutTroubleshooting; } });
+Object.defineProperty(exports, "showStep", { enumerable: true, get: function () { return environment_detector_1.showStep; } });
+// OAuth handling
+var oauth_handler_1 = require("./oauth-handler");
+Object.defineProperty(exports, "triggerOAuth", { enumerable: true, get: function () { return oauth_handler_1.triggerOAuth; } });
+Object.defineProperty(exports, "ensureAuth", { enumerable: true, get: function () { return oauth_handler_1.ensureAuth; } });
+//# sourceMappingURL=index.js.map

package/dist/cliproxy/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAIH,2CAMsB;AALpB,kHAAA,oBAAoB,OAAA;AACpB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,kHAAA,oBAAoB,OAAA;AACpB,4GAAA,cAAc,OAAA;AAGhB,mBAAmB;AACnB,iDASyB;AARvB,oHAAA,mBAAmB,OAAA;AACnB,uHAAA,sBAAsB,OAAA;AACtB,gHAAA,eAAe,OAAA;AACf,8GAAA,aAAa,OAAA;AACb,iHAAA,gBAAgB,OAAA;AAChB,0GAAA,SAAS,OAAA;AACT,yHAAA,wBAAwB,OAAA;AACxB,kHAAA,iBAAiB,OAAA;AAGnB,wBAAwB;AACxB,+DAKgC;AAJ9B,6HAAA,qBAAqB,OAAA;AACrB,yHAAA,iBAAiB,OAAA;AACjB,iIAAA,yBAAyB,OAAA;AACzB,gHAAA,QAAQ,OAAA;AAGV,iBAAiB;AACjB,iDAA2D;AAAlD,6GAAA,YAAY,OAAA;AAAE,2GAAA,UAAU,OAAA"}

package/dist/cliproxy/auth/oauth-handler.d.ts

@@ -0,0 +1,29 @@
+/**
+ * OAuth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication flow for CLIProxy providers (Gemini, Codex, Antigravity).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ */
+import { CLIProxyProvider } from '../types';
+import { AccountInfo } from '../account-manager';
+import { OAuthOptions } from './auth-types';
+/**
+ * Trigger OAuth flow for provider
+ * Auto-detects headless environment and uses --no-browser flag accordingly
+ * Shows real-time step-by-step progress for better user feedback
+ */
+export declare function triggerOAuth(provider: CLIProxyProvider, options?: OAuthOptions): Promise<AccountInfo | null>;
+/**
+ * Ensure provider is authenticated
+ * Triggers OAuth flow if not authenticated
+ */
+export declare function ensureAuth(provider: CLIProxyProvider, options?: {
+    verbose?: boolean;
+    headless?: boolean;
+    account?: string;
+}): Promise<boolean>;
+//# sourceMappingURL=oauth-handler.d.ts.map

package/dist/cliproxy/auth/oauth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-handler.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EACL,WAAW,EAIZ,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAAE,YAAY,EAAwC,MAAM,cAAc,CAAC;AA0FlF;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA+E7B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACxE,OAAO,CAAC,OAAO,CAAC,CAiBlB"}

package/dist/cliproxy/auth/oauth-handler.js

@@ -0,0 +1,205 @@
+"use strict";
+/**
+ * OAuth Handler for CLIProxyAPI
+ *
+ * Manages OAuth authentication flow for CLIProxy providers (Gemini, Codex, Antigravity).
+ * CLIProxyAPI handles OAuth internally - we just need to:
+ * 1. Check if auth exists (token files in CCS auth directory)
+ * 2. Trigger OAuth flow by spawning binary with auth flag
+ * 3. Auto-detect headless environments (SSH, no DISPLAY)
+ * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAuth = exports.triggerOAuth = void 0;
+const fs = __importStar(require("fs"));
+const ui_1 = require("../../utils/ui");
+const binary_manager_1 = require("../binary-manager");
+const config_generator_1 = require("../config-generator");
+const account_manager_1 = require("../account-manager");
+const oauth_port_diagnostics_1 = require("../../management/oauth-port-diagnostics");
+const auth_types_1 = require("./auth-types");
+const environment_detector_1 = require("./environment-detector");
+const token_manager_1 = require("./token-manager");
+const oauth_process_1 = require("./oauth-process");
+/**
+ * Prompt user to add another account
+ */
+async function promptAddAccount() {
+    const readline = await Promise.resolve().then(() => __importStar(require('readline')));
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question('[?] Add another account? (y/N): ', (answer) => {
+            rl.close();
+            resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+        });
+    });
+}
+/**
+ * Run pre-flight OAuth checks
+ */
+async function runPreflightChecks(provider, oauthConfig) {
+    console.log('');
+    console.log((0, ui_1.info)(`Pre-flight OAuth check for ${oauthConfig.displayName}...`));
+    const preflight = await (0, oauth_port_diagnostics_1.enhancedPreflightOAuthCheck)(provider);
+    for (const check of preflight.checks) {
+        const icon = check.status === 'ok' ? '[OK]' : check.status === 'warn' ? '[!]' : '[X]';
+        console.log(`  ${icon} ${check.name}: ${check.message}`);
+        if (check.fixCommand && check.status !== 'ok') {
+            console.log(`      Fix: ${check.fixCommand}`);
+        }
+    }
+    if (preflight.firewallWarning) {
+        console.log('');
+        console.log((0, ui_1.warn)('Windows Firewall may block OAuth callback'));
+        console.log('    If auth hangs, run as Administrator:');
+        console.log(`    ${(0, ui_1.color)(preflight.firewallFixCommand || '', 'command')}`);
+    }
+    if (!preflight.ready) {
+        console.log('');
+        console.log((0, ui_1.fail)('Pre-flight check failed. Resolve issues above and retry.'));
+        return false;
+    }
+    return true;
+}
+/**
+ * Prepare OAuth binary and config
+ */
+async function prepareBinary(provider, verbose) {
+    (0, environment_detector_1.showStep)(1, 4, 'progress', 'Preparing CLIProxy binary...');
+    try {
+        const binaryPath = await (0, binary_manager_1.ensureCLIProxyBinary)(verbose);
+        process.stdout.write('\x1b[1A\x1b[2K');
+        (0, environment_detector_1.showStep)(1, 4, 'ok', 'CLIProxy binary ready');
+        const tokenDir = (0, token_manager_1.getProviderTokenDir)(provider);
+        fs.mkdirSync(tokenDir, { recursive: true, mode: 0o700 });
+        const configPath = (0, config_generator_1.generateConfig)(provider);
+        if (verbose) {
+            console.error(`[auth] Config generated: ${configPath}`);
+        }
+        return { binaryPath, tokenDir, configPath };
+    }
+    catch (error) {
+        process.stdout.write('\x1b[1A\x1b[2K');
+        (0, environment_detector_1.showStep)(1, 4, 'fail', 'Failed to prepare CLIProxy binary');
+        console.error((0, ui_1.fail)(error.message));
+        throw error;
+    }
+}
+/**
+ * Trigger OAuth flow for provider
+ * Auto-detects headless environment and uses --no-browser flag accordingly
+ * Shows real-time step-by-step progress for better user feedback
+ */
+async function triggerOAuth(provider, options = {}) {
+    const oauthConfig = (0, auth_types_1.getOAuthConfig)(provider);
+    const { verbose = false, add = false, nickname, fromUI = false } = options;
+    const callbackPort = oauth_port_diagnostics_1.OAUTH_CALLBACK_PORTS[provider];
+    const isCLI = !fromUI;
+    const headless = options.headless ?? (0, environment_detector_1.isHeadlessEnvironment)();
+    // Check for existing accounts
+    const existingAccounts = (0, account_manager_1.getProviderAccounts)(provider);
+    if (existingAccounts.length > 0 && !add) {
+        console.log('');
+        console.log((0, ui_1.info)(`${existingAccounts.length} account(s) already authenticated for ${oauthConfig.displayName}`));
+        if (!(await promptAddAccount())) {
+            console.log((0, ui_1.info)('Cancelled'));
+            return null;
+        }
+    }
+    // Pre-flight checks
+    if (!(await runPreflightChecks(provider, oauthConfig))) {
+        return null;
+    }
+    console.log('');
+    // Prepare binary
+    const prepared = await prepareBinary(provider, verbose);
+    if (!prepared)
+        return null;
+    const { binaryPath, tokenDir, configPath } = prepared;
+    // Free callback port if needed
+    const localCallbackPort = auth_types_1.OAUTH_CALLBACK_PORTS[provider];
+    if (localCallbackPort) {
+        const killed = (0, environment_detector_1.killProcessOnPort)(localCallbackPort, verbose);
+        if (killed && verbose) {
+            console.error(`[auth] Freed port ${localCallbackPort} for OAuth callback`);
+        }
+    }
+    // Build args
+    const args = ['--config', configPath, oauthConfig.authFlag];
+    if (headless) {
+        args.push('--no-browser');
+    }
+    // Show callback server step
+    (0, environment_detector_1.showStep)(2, 4, 'progress', `Starting callback server on port ${callbackPort || 'N/A'}...`);
+    // Show headless instructions
+    if (headless) {
+        console.log('');
+        console.log((0, ui_1.warn)('PORT FORWARDING REQUIRED'));
+        console.log(`    OAuth callback uses localhost:${callbackPort} which must be reachable.`);
+        console.log('    Run this on your LOCAL machine:');
+        console.log(`    ${(0, ui_1.color)(`ssh -L ${callbackPort}:localhost:${callbackPort} <USER>@<HOST>`, 'command')}`);
+        console.log('');
+    }
+    // Execute OAuth process
+    return (0, oauth_process_1.executeOAuthProcess)({
+        provider,
+        binaryPath,
+        args,
+        tokenDir,
+        oauthConfig,
+        callbackPort,
+        headless,
+        verbose,
+        isCLI,
+        nickname,
+    });
+}
+exports.triggerOAuth = triggerOAuth;
+/**
+ * Ensure provider is authenticated
+ * Triggers OAuth flow if not authenticated
+ */
+async function ensureAuth(provider, options = {}) {
+    if ((0, token_manager_1.isAuthenticated)(provider)) {
+        if (options.verbose) {
+            console.error(`[auth] ${provider} already authenticated`);
+        }
+        const defaultAccount = (0, account_manager_1.getDefaultAccount)(provider);
+        if (defaultAccount) {
+            (0, account_manager_1.touchAccount)(provider, options.account || defaultAccount.id);
+        }
+        return true;
+    }
+    const oauthConfig = (0, auth_types_1.getOAuthConfig)(provider);
+    console.log((0, ui_1.info)(`${oauthConfig.displayName} authentication required`));
+    const account = await triggerOAuth(provider, options);
+    return account !== null;
+}
+exports.ensureAuth = ensureAuth;
+//# sourceMappingURL=oauth-handler.js.map