@link-assistant/agent 0.5.3 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/agent",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "A minimal, public domain AI CLI agent compatible with OpenCode's JSON interface. Bun-only runtime.",
   "main": "src/index.js",
   "type": "module",
@@ -68,6 +68,8 @@
     "@opentui/solid": "^0.1.46",
     "@parcel/watcher": "^2.5.1",
     "@solid-primitives/event-bus": "^1.1.2",
+    "@standard-community/standard-json": "^0.3.5",
+    "@standard-community/standard-openapi": "^0.2.9",
     "@zip.js/zip.js": "^2.8.10",
     "ai": "6.0.0-beta.99",
     "chokidar": "^4.0.3",
@@ -83,9 +85,8 @@
     "ignore": "^7.0.5",
     "jsonc-parser": "^3.3.1",
     "lino-objects-codec": "^0.1.1",
+    "log-lazy": "^1.0.4",
     "minimatch": "^10.1.1",
-    "open": "^11.0.0",
-    "partial-json": "^0.1.7",
     "remeda": "^2.32.0",
     "solid-js": "^1.9.10",
     "strip-ansi": "^7.1.2",

package/src/auth/claude-oauth.ts

@@ -147,9 +147,10 @@ export namespace ClaudeOAuth {
    */
   export async function saveState(state: OAuthState): Promise<void> {
     await Bun.write(statePath, JSON.stringify(state, null, 2));
-    log.info('saved oauth state', {
+    log.info(() => ({
+      message: 'saved oauth state',
       expiresAt: new Date(state.expiresAt).toISOString(),
-    });
+    }));
   }
 
   /**
@@ -165,14 +166,14 @@ export namespace ClaudeOAuth {
       const parsed = OAuthState.parse(content);
 
       if (parsed.expiresAt < Date.now()) {
-        log.warn('oauth state expired');
+        log.warn(() => ({ message: 'oauth state expired' }));
         await clearState();
         return undefined;
       }
 
       return parsed;
     } catch (error) {
-      log.error('failed to load oauth state', { error });
+      log.error(() => ({ message: 'failed to load oauth state', error }));
       return undefined;
     }
   }
@@ -190,7 +191,7 @@ export namespace ClaudeOAuth {
         await fs.unlink(statePath).catch(() => {});
       }
     } catch (error) {
-      log.error('failed to clear oauth state', { error });
+      log.error(() => ({ message: 'failed to clear oauth state', error }));
     }
   }
 
@@ -213,7 +214,9 @@ export namespace ClaudeOAuth {
       code_verifier: codeVerifier,
     });
 
-    log.info('exchanging authorization code for tokens');
+    log.info(() => ({
+      message: 'exchanging authorization code for tokens',
+    }));
 
     const response = await fetch(Config.tokenUrl, {
       method: 'POST',
@@ -225,7 +228,11 @@ export namespace ClaudeOAuth {
 
     if (!response.ok) {
       const error = await response.text();
-      log.error('token exchange failed', { status: response.status, error });
+      log.error(() => ({
+        message: 'token exchange failed',
+        status: response.status,
+        error,
+      }));
       throw new Error(`Token exchange failed: ${response.status} ${error}`);
     }
 
@@ -267,9 +274,10 @@ export namespace ClaudeOAuth {
     };
 
     await Bun.write(credentialsPath, JSON.stringify(credentials, null, 2));
-    log.info('saved credentials', {
+    log.info(() => ({
+      message: 'saved credentials',
       expiresAt: new Date(credentials.claudeAiOauth!.expiresAt).toISOString(),
-    });
+    }));
   }
 
   /**
@@ -283,7 +291,10 @@ export namespace ClaudeOAuth {
     try {
       const file = Bun.file(credentialsPath);
       if (!(await file.exists())) {
-        log.info('credentials file not found', { path: credentialsPath });
+        log.info(() => ({
+          message: 'credentials file not found',
+          path: credentialsPath,
+        }));
         return undefined;
       }
 
@@ -291,27 +302,31 @@ export namespace ClaudeOAuth {
       const parsed = Credentials.parse(content);
 
       if (!parsed.claudeAiOauth) {
-        log.info('no claudeAiOauth credentials found');
+        log.info(() => ({
+          message: 'no claudeAiOauth credentials found',
+        }));
         return undefined;
       }
 
       // Check if token is expired
       if (parsed.claudeAiOauth.expiresAt < Date.now()) {
-        log.warn('token expired', {
+        log.warn(() => ({
+          message: 'token expired',
           expiresAt: new Date(parsed.claudeAiOauth.expiresAt).toISOString(),
-        });
+        }));
         // TODO: Implement token refresh using refreshToken
         // For now, user needs to re-authenticate
       }
 
-      log.info('loaded oauth credentials', {
+      log.info(() => ({
+        message: 'loaded oauth credentials',
         subscriptionType: parsed.claudeAiOauth.subscriptionType,
         scopes: parsed.claudeAiOauth.scopes,
-      });
+      }));
 
       return parsed.claudeAiOauth;
     } catch (error) {
-      log.error('failed to read credentials', { error });
+      log.error(() => ({ message: 'failed to read credentials', error }));
       return undefined;
     }
   }
@@ -344,7 +359,9 @@ export namespace ClaudeOAuth {
   export async function completeAuth(code: string): Promise<boolean> {
     const state = await loadState();
     if (!state) {
-      log.error('no oauth state found - please start login flow first');
+      log.error(() => ({
+        message: 'no oauth state found - please start login flow first',
+      }));
       return false;
     }
 
@@ -352,10 +369,15 @@ export namespace ClaudeOAuth {
       const tokens = await exchangeCode(code, state.codeVerifier);
       await saveCredentials(tokens);
       await clearState();
-      log.info('authentication completed successfully');
+      log.info(() => ({
+        message: 'authentication completed successfully',
+      }));
       return true;
     } catch (error) {
-      log.error('failed to complete authentication', { error });
+      log.error(() => ({
+        message: 'failed to complete authentication',
+        error,
+      }));
       await clearState();
       return false;
     }
@@ -367,7 +389,7 @@ export namespace ClaudeOAuth {
   export async function refreshToken(): Promise<boolean> {
     const creds = await getCredentials();
     if (!creds?.refreshToken) {
-      log.error('no refresh token available');
+      log.error(() => ({ message: 'no refresh token available' }));
       return false;
     }
 
@@ -377,7 +399,7 @@ export namespace ClaudeOAuth {
       refresh_token: creds.refreshToken,
     });
 
-    log.info('refreshing access token');
+    log.info(() => ({ message: 'refreshing access token' }));
 
     try {
       const response = await fetch(Config.tokenUrl, {
@@ -390,16 +412,20 @@ export namespace ClaudeOAuth {
 
       if (!response.ok) {
         const error = await response.text();
-        log.error('token refresh failed', { status: response.status, error });
+        log.error(() => ({
+          message: 'token refresh failed',
+          status: response.status,
+          error,
+        }));
         return false;
       }
 
       const tokens = TokenResponse.parse(await response.json());
       await saveCredentials(tokens);
-      log.info('token refreshed successfully');
+      log.info(() => ({ message: 'token refreshed successfully' }));
       return true;
     } catch (error) {
-      log.error('failed to refresh token', { error });
+      log.error(() => ({ message: 'failed to refresh token', error }));
       return false;
     }
   }

package/src/auth/plugins.ts

@@ -162,9 +162,10 @@ const AnthropicPlugin: AuthPlugin = {
             );
 
             if (!result.ok) {
-              log.error('anthropic oauth token exchange failed', {
+              log.error(() => ({
+                message: 'anthropic oauth token exchange failed',
                 status: result.status,
-              });
+              }));
               return { type: 'failed' };
             }
 
@@ -229,9 +230,10 @@ const AnthropicPlugin: AuthPlugin = {
             );
 
             if (!tokenResult.ok) {
-              log.error('anthropic oauth token exchange failed', {
+              log.error(() => ({
+                message: 'anthropic oauth token exchange failed',
                 status: tokenResult.status,
-              });
+              }));
               return { type: 'failed' };
             }
 
@@ -286,7 +288,9 @@ const AnthropicPlugin: AuthPlugin = {
 
         // Refresh token if expired
         if (!currentAuth.access || currentAuth.expires < Date.now()) {
-          log.info('refreshing anthropic oauth token');
+          log.info(() => ({
+            message: 'refreshing anthropic oauth token',
+          }));
           const response = await fetch(
             'https://console.anthropic.com/v1/oauth/token',
             {
@@ -566,7 +570,7 @@ const GitHubCopilotPlugin: AuthPlugin = {
             : 'github.com';
           const urls = getCopilotUrls(domain);
 
-          log.info('refreshing github copilot token');
+          log.info(() => ({ message: 'refreshing github copilot token' }));
           const response = await fetch(urls.COPILOT_API_KEY_URL, {
             headers: {
               Accept: 'application/json',
@@ -720,7 +724,9 @@ const OpenAIPlugin: AuthPlugin = {
             }
 
             if (!code) {
-              log.error('openai oauth no code provided');
+              log.error(() => ({
+                message: 'openai oauth no code provided',
+              }));
               return { type: 'failed' };
             }
 
@@ -740,9 +746,10 @@ const OpenAIPlugin: AuthPlugin = {
             });
 
             if (!tokenResult.ok) {
-              log.error('openai oauth token exchange failed', {
+              log.error(() => ({
+                message: 'openai oauth token exchange failed',
                 status: tokenResult.status,
-              });
+              }));
               return { type: 'failed' };
             }
 
@@ -752,7 +759,9 @@ const OpenAIPlugin: AuthPlugin = {
               !json.refresh_token ||
               typeof json.expires_in !== 'number'
             ) {
-              log.error('openai oauth token response missing fields');
+              log.error(() => ({
+                message: 'openai oauth token response missing fields',
+              }));
               return { type: 'failed' };
             }
 
@@ -787,7 +796,7 @@ const OpenAIPlugin: AuthPlugin = {
 
         // Refresh token if expired
         if (!currentAuth.access || currentAuth.expires < Date.now()) {
-          log.info('refreshing openai oauth token');
+          log.info(() => ({ message: 'refreshing openai oauth token' }));
           const response = await fetch(OPENAI_TOKEN_URL, {
             method: 'POST',
             headers: {
@@ -858,30 +867,125 @@ const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
 const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 const GOOGLE_USERINFO_URL = 'https://www.googleapis.com/oauth2/v2/userinfo';
 
+/**
+ * Get an available port for the OAuth callback server.
+ * Supports configurable port via OAUTH_CALLBACK_PORT or GOOGLE_OAUTH_CALLBACK_PORT
+ * environment variable. Falls back to automatic port discovery (port 0) if not configured.
+ *
+ * Based on Gemini CLI implementation:
+ * https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/oauth2.ts
+ */
+async function getGoogleOAuthPort(): Promise<number> {
+  // Check for environment variable override (useful for containers/firewalls)
+  // Support both OAUTH_CALLBACK_PORT (Gemini CLI style) and GOOGLE_OAUTH_CALLBACK_PORT
+  const portStr =
+    process.env['OAUTH_CALLBACK_PORT'] ||
+    process.env['GOOGLE_OAUTH_CALLBACK_PORT'];
+  if (portStr) {
+    const port = parseInt(portStr, 10);
+    if (!isNaN(port) && port > 0 && port <= 65535) {
+      log.info(() => ({
+        message: 'using configured oauth callback port',
+        port,
+      }));
+      return port;
+    }
+    log.warn(() => ({
+      message: 'invalid OAUTH_CALLBACK_PORT, using auto discovery',
+      value: portStr,
+    }));
+  }
+
+  // Discover an available port by binding to port 0
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.listen(0, () => {
+      const address = server.address() as net.AddressInfo;
+      const port = address.port;
+      server.close(() => resolve(port));
+    });
+    server.on('error', reject);
+  });
+}
+
+/**
+ * Check if browser launch should be suppressed.
+ * When NO_BROWSER=true, use manual code entry flow instead of localhost redirect.
+ *
+ * Based on Gemini CLI's config.isBrowserLaunchSuppressed() functionality.
+ */
+function isBrowserSuppressed(): boolean {
+  const noBrowser = process.env['NO_BROWSER'];
+  return noBrowser === 'true' || noBrowser === '1';
+}
+
+/**
+ * Get the OAuth callback host for server binding.
+ * Defaults to 'localhost' but can be configured via OAUTH_CALLBACK_HOST.
+ * Use '0.0.0.0' in Docker containers to allow external connections.
+ */
+function getOAuthCallbackHost(): string {
+  return process.env['OAUTH_CALLBACK_HOST'] || 'localhost';
+}
+
+/**
+ * Google Code Assist redirect URI for manual code entry flow
+ * This is used when NO_BROWSER=true or in headless environments
+ * Based on Gemini CLI implementation
+ */
+const GOOGLE_CODEASSIST_REDIRECT_URI = 'https://codeassist.google.com/authcode';
+
 /**
  * Google OAuth Plugin
  * Supports:
- * - Google AI Pro/Ultra OAuth login
+ * - Google AI Pro/Ultra OAuth login (browser mode with localhost redirect)
+ * - Google AI Pro/Ultra OAuth login (manual code entry for NO_BROWSER mode)
  * - Manual API key entry
  *
  * Note: This plugin uses OAuth 2.0 with PKCE for Google AI subscription authentication.
  * After authenticating, you can use Gemini models with subscription benefits.
+ *
+ * The OAuth flow supports two modes:
+ * 1. Browser mode (default): Opens browser, uses localhost redirect server
+ * 2. Manual code entry (NO_BROWSER=true): Shows URL, user pastes authorization code
+ *
+ * Based on Gemini CLI implementation:
+ * https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/oauth2.ts
  */
 const GooglePlugin: AuthPlugin = {
   provider: 'google',
   methods: [
     {
-      label: 'Google AI Pro/Ultra (OAuth)',
+      label: 'Google AI Pro/Ultra (OAuth - Browser)',
       type: 'oauth',
       async authorize() {
+        // Check if browser is suppressed - if so, recommend manual method
+        if (isBrowserSuppressed()) {
+          log.info(() => ({
+            message: 'NO_BROWSER is set, use manual code entry method instead',
+          }));
+        }
+
         const pkce = await generatePKCE();
         const state = generateRandomString(16);
 
-        // Start local server to handle OAuth redirect
+        // Get an available port BEFORE starting the server
+        // This fixes the race condition where port was 0 when building redirect URI
+        const serverPort = await getGoogleOAuthPort();
+        const host = getOAuthCallbackHost();
+        // The redirect URI sent to Google must use localhost (loopback IP)
+        // even if we bind to a different host (like 0.0.0.0 in Docker)
+        const redirectUri = `http://localhost:${serverPort}/oauth/callback`;
+
+        log.info(() => ({
+          message: 'starting google oauth server',
+          port: serverPort,
+          host,
+          redirectUri,
+        }));
+
+        // Create server to handle OAuth redirect
         const server = http.createServer();
-        let serverPort = 0;
-        let authCode: string | null = null;
-        let authState: string | null = null;
 
         const authPromise = new Promise<{ code: string; state: string }>(
           (resolve, reject) => {
@@ -935,12 +1039,22 @@ const GooglePlugin: AuthPlugin = {
               res.end('Missing code or state parameter');
             });
 
-            server.listen(0, () => {
-              const address = server.address() as net.AddressInfo;
-              serverPort = address.port;
+            // Listen on the configured host and pre-determined port
+            server.listen(serverPort, host, () => {
+              log.info(() => ({
+                message: 'google oauth server listening',
+                port: serverPort,
+                host,
+              }));
             });
 
-            server.on('error', reject);
+            server.on('error', (err) => {
+              log.error(() => ({
+                message: 'google oauth server error',
+                error: err,
+              }));
+              reject(err);
+            });
 
             // Timeout after 5 minutes
             setTimeout(
@@ -953,8 +1067,7 @@ const GooglePlugin: AuthPlugin = {
           }
         );
 
-        // Build authorization URL with local redirect URI
-        const redirectUri = `http://localhost:${serverPort}/oauth/callback`;
+        // Build authorization URL with the redirect URI
         const url = new URL(GOOGLE_AUTH_URL);
         url.searchParams.set('client_id', GOOGLE_OAUTH_CLIENT_ID);
         url.searchParams.set('redirect_uri', redirectUri);
@@ -992,9 +1105,108 @@ const GooglePlugin: AuthPlugin = {
               });
 
               if (!tokenResult.ok) {
-                log.error('google oauth token exchange failed', {
+                log.error(() => ({
+                  message: 'google oauth token exchange failed',
+                  status: tokenResult.status,
+                }));
+                return { type: 'failed' };
+              }
+
+              const json = await tokenResult.json();
+              if (
+                !json.access_token ||
+                !json.refresh_token ||
+                typeof json.expires_in !== 'number'
+              ) {
+                log.error(() => ({
+                  message: 'google oauth token response missing fields',
+                }));
+                return { type: 'failed' };
+              }
+
+              return {
+                type: 'success',
+                refresh: json.refresh_token,
+                access: json.access_token,
+                expires: Date.now() + json.expires_in * 1000,
+              };
+            } catch (error) {
+              log.error(() => ({ message: 'google oauth failed', error }));
+              return { type: 'failed' };
+            }
+          },
+        };
+      },
+    },
+    {
+      label: 'Google AI Pro/Ultra (OAuth - Manual Code Entry)',
+      type: 'oauth',
+      async authorize() {
+        /**
+         * Manual code entry flow for headless environments or when NO_BROWSER=true
+         * Uses Google's Code Assist redirect URI which displays the auth code to the user
+         *
+         * Based on Gemini CLI's authWithUserCode function:
+         * https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/oauth2.ts
+         */
+        const pkce = await generatePKCE();
+        const state = generateRandomString(16);
+        const redirectUri = GOOGLE_CODEASSIST_REDIRECT_URI;
+
+        log.info(() => ({
+          message: 'using manual code entry oauth flow',
+          redirectUri,
+        }));
+
+        // Build authorization URL with the Code Assist redirect URI
+        const url = new URL(GOOGLE_AUTH_URL);
+        url.searchParams.set('client_id', GOOGLE_OAUTH_CLIENT_ID);
+        url.searchParams.set('redirect_uri', redirectUri);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('scope', GOOGLE_OAUTH_SCOPES.join(' '));
+        url.searchParams.set('access_type', 'offline');
+        url.searchParams.set('code_challenge', pkce.challenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+        url.searchParams.set('state', state);
+        url.searchParams.set('prompt', 'consent');
+
+        return {
+          url: url.toString(),
+          instructions:
+            'Visit the URL above, complete authorization, then paste the authorization code here: ',
+          method: 'code' as const,
+          async callback(code?: string): Promise<AuthResult> {
+            if (!code) {
+              log.error(() => ({
+                message: 'google oauth no code provided',
+              }));
+              return { type: 'failed' };
+            }
+
+            try {
+              // Exchange authorization code for tokens
+              const tokenResult = await fetch(GOOGLE_TOKEN_URL, {
+                method: 'POST',
+                headers: {
+                  'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                  code: code.trim(),
+                  client_id: GOOGLE_OAUTH_CLIENT_ID,
+                  client_secret: GOOGLE_OAUTH_CLIENT_SECRET,
+                  redirect_uri: redirectUri,
+                  grant_type: 'authorization_code',
+                  code_verifier: pkce.verifier,
+                }),
+              });
+
+              if (!tokenResult.ok) {
+                const errorText = await tokenResult.text();
+                log.error(() => ({
+                  message: 'google oauth token exchange failed',
                   status: tokenResult.status,
-                });
+                  error: errorText,
+                }));
                 return { type: 'failed' };
               }
 
@@ -1004,7 +1216,9 @@ const GooglePlugin: AuthPlugin = {
                 !json.refresh_token ||
                 typeof json.expires_in !== 'number'
               ) {
-                log.error('google oauth token response missing fields');
+                log.error(() => ({
+                  message: 'google oauth token response missing fields',
+                }));
                 return { type: 'failed' };
               }
 
@@ -1015,7 +1229,10 @@ const GooglePlugin: AuthPlugin = {
                 expires: Date.now() + json.expires_in * 1000,
               };
             } catch (error) {
-              log.error('google oauth failed', { error });
+              log.error(() => ({
+                message: 'google oauth manual code entry failed',
+                error,
+              }));
               return { type: 'failed' };
             }
           },
@@ -1058,7 +1275,7 @@ const GooglePlugin: AuthPlugin = {
           !currentAuth.access ||
           currentAuth.expires < Date.now() + FIVE_MIN_MS
         ) {
-          log.info('refreshing google oauth token');
+          log.info(() => ({ message: 'refreshing google oauth token' }));
           const response = await fetch(GOOGLE_TOKEN_URL, {
             method: 'POST',
             headers: {