@linxiraos/pi-ai 1.0.0

package/src/registry/oauth/device-code.ts

@@ -0,0 +1,92 @@
+import * as AIError from "../../error";
+
+const DEVICE_FLOW_CANCEL_MESSAGE = "Login cancelled";
+const DEVICE_FLOW_TIMEOUT_MESSAGE = "Device flow timed out";
+const DEVICE_FLOW_SLOW_DOWN_TIMEOUT_MESSAGE =
+	"Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.";
+const MINIMUM_DEVICE_FLOW_INTERVAL_MS = 1000;
+const DEFAULT_DEVICE_FLOW_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_INTERVAL_INCREMENT_MS = 5000;
+
+/** Result returned by one OAuth device-code polling attempt. */
+export type OAuthDeviceCodePollResult<T> =
+	| { status: "complete"; value: T }
+	| { status: "pending" }
+	| { status: "slow_down" }
+	| { status: "failed"; message: string };
+
+/** Options for polling an RFC 8628-style OAuth device-code flow. */
+export interface OAuthDeviceCodeFlowOptions<T> {
+	/** Poll the provider once and classify the response. */
+	poll(): OAuthDeviceCodePollResult<T> | Promise<OAuthDeviceCodePollResult<T>>;
+	/** Provider-requested polling cadence; defaults to RFC 8628's five seconds. */
+	intervalSeconds?: number;
+	/** Provider-issued expiry window for the device code. */
+	expiresInSeconds?: number;
+	/** Cancels the flow with the legacy "Login cancelled" error. */
+	signal?: AbortSignal;
+}
+
+async function abortableDeviceFlowSleep(ms: number, signal: AbortSignal | undefined): Promise<void> {
+	if (!signal) {
+		await Bun.sleep(ms);
+		return;
+	}
+	if (signal.aborted) {
+		throw new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE);
+	}
+
+	const { promise, resolve, reject } = Promise.withResolvers<void>();
+	let timer: Timer | undefined;
+	const onAbort = () => {
+		clearTimeout(timer);
+		reject(new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE));
+	};
+	timer = setTimeout(() => {
+		signal.removeEventListener("abort", onAbort);
+		resolve();
+	}, ms);
+	signal.addEventListener("abort", onAbort, { once: true });
+	await promise;
+}
+
+/** Poll an OAuth device-code flow until completion, provider failure, timeout, or cancellation. */
+export async function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOptions<T>): Promise<T> {
+	const deadline =
+		typeof options.expiresInSeconds === "number"
+			? Date.now() + options.expiresInSeconds * 1000
+			: Number.POSITIVE_INFINITY;
+	let intervalMs = Math.max(
+		MINIMUM_DEVICE_FLOW_INTERVAL_MS,
+		Math.floor((options.intervalSeconds ?? DEFAULT_DEVICE_FLOW_INTERVAL_SECONDS) * 1000),
+	);
+	let slowDownResponses = 0;
+
+	while (Date.now() < deadline) {
+		if (options.signal?.aborted) {
+			throw new AIError.LoginCancelledError(DEVICE_FLOW_CANCEL_MESSAGE);
+		}
+		const result = await options.poll();
+		if (result.status === "complete") {
+			return result.value;
+		}
+		if (result.status === "failed") {
+			throw new AIError.OAuthError(result.message, { kind: "polling" });
+		}
+		if (result.status === "slow_down") {
+			slowDownResponses += 1;
+			intervalMs = Math.max(MINIMUM_DEVICE_FLOW_INTERVAL_MS, intervalMs + SLOW_DOWN_INTERVAL_INCREMENT_MS);
+		}
+
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) {
+			break;
+		}
+		await abortableDeviceFlowSleep(Math.min(intervalMs, remainingMs), options.signal);
+	}
+
+	throw new AIError.OAuthError(
+		slowDownResponses > 0 ? DEVICE_FLOW_SLOW_DOWN_TIMEOUT_MESSAGE : DEVICE_FLOW_TIMEOUT_MESSAGE,
+		{ kind: "timeout" },
+	);
+}

package/src/registry/oauth/devin.ts

@@ -0,0 +1,124 @@
+import * as AIError from "../../error";
+import { OAuthCallbackFlow } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+type FetchFunction = NonNullable<OAuthController["fetch"]>;
+
+const DEVIN_WEBAPP_URL = "https://app.devin.ai";
+const DEVIN_API_URL = "https://api.devin.ai";
+const CALLBACK_PORT = 59653;
+const CALLBACK_PATH = "/callback";
+const TOKEN_PATH = "/auth/cli/token";
+const FALLBACK_EXPIRES_MS = 365 * 24 * 60 * 60 * 1000;
+
+interface DevinPKCEParams {
+	verifier: string;
+	challenge: string;
+}
+
+export async function loginDevin(ctrl: OAuthController): Promise<OAuthCredentials> {
+	const flow = new DevinOAuthFlow(ctrl);
+	return flow.login();
+}
+
+class DevinOAuthFlow extends OAuthCallbackFlow {
+	#pkce?: DevinPKCEParams;
+
+	constructor(ctrl: OAuthController) {
+		super(ctrl, {
+			preferredPort: CALLBACK_PORT,
+			callbackPath: CALLBACK_PATH,
+			callbackHostname: "127.0.0.1",
+		});
+	}
+
+	override generateState(): string {
+		return crypto.randomUUID();
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		this.#pkce = await generatePKCE();
+		const params = new URLSearchParams({
+			redirect_uri: redirectUri,
+			state,
+			prompt: "select_account",
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+		});
+
+		return {
+			url: `${DEVIN_WEBAPP_URL}/auth/cli/continue?${params.toString()}`,
+			instructions: "Sign in to Devin in your browser.",
+		};
+	}
+
+	async exchangeToken(code: string): Promise<OAuthCredentials> {
+		if (!this.#pkce) {
+			throw new AIError.OAuthError("Devin PKCE verifier was not initialized", {
+				kind: "configuration",
+				provider: "devin",
+			});
+		}
+		const token = await exchangeDevinCliToken(code, this.#pkce.verifier, this.ctrl.fetch);
+
+		return {
+			access: token,
+			refresh: token,
+			expires: getTokenExpiry(token),
+			apiEndpoint: DEVIN_API_URL,
+			enterpriseUrl: DEVIN_WEBAPP_URL,
+		};
+	}
+}
+
+export async function exchangeDevinCliToken(
+	authorizationCode: string,
+	codeVerifier: string,
+	fetchImpl: FetchFunction = fetch,
+): Promise<string> {
+	const response = await fetchImpl(`${DEVIN_API_URL}${TOKEN_PATH}`, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/json",
+		},
+		body: JSON.stringify({
+			code: authorizationCode,
+			code_verifier: codeVerifier,
+		}),
+	});
+
+	if (!response.ok) {
+		const error = await response.text();
+		throw new AIError.OAuthError(`Devin CLI token exchange failed: ${response.status} ${error}`.trim(), {
+			kind: "token-exchange",
+			provider: "devin",
+			status: response.status,
+		});
+	}
+
+	const data = (await response.json()) as { token?: unknown };
+	if (typeof data.token !== "string" || data.token.length === 0) {
+		throw new AIError.OAuthError("Devin CLI token exchange returned an empty token", {
+			kind: "validation",
+			provider: "devin",
+		});
+	}
+	return data.token;
+}
+
+function getTokenExpiry(token: string): number {
+	try {
+		const [, payload] = token.split(".");
+		if (payload) {
+			const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as { exp?: unknown };
+			if (typeof decoded.exp === "number" && Number.isFinite(decoded.exp)) {
+				return decoded.exp * 1000 - 5 * 60 * 1000;
+			}
+		}
+	} catch {
+		// Ignore malformed non-JWT tokens and use a conservative long-lived fallback.
+	}
+	return Date.now() + FALLBACK_EXPIRES_MS;
+}

package/src/registry/oauth/github-copilot.ts

@@ -0,0 +1,369 @@
+/**
+ * GitHub Copilot OAuth flow (opencode OAuth app)
+ */
+import { scheduler } from "node:timers/promises";
+import { getBundledModels } from "@linxiraos/pi-catalog/models";
+import {
+	COPILOT_API_HEADERS,
+	getGitHubCopilotBaseUrl,
+	isPublicGitHubHost,
+	normalizeDomain,
+	normalizeGitHubCopilotApiEndpoint,
+	normalizeGitHubCopilotEnterpriseDomain,
+	OPENCODE_HEADERS,
+} from "@linxiraos/pi-catalog/wire/github-copilot";
+import * as AIError from "../../error";
+import type { FetchImpl } from "../../types";
+import type { OAuthCredentials } from "./types";
+
+const CLIENT_ID = "Ov23li8tweQw6odWQebz";
+
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+
+type GitHubCopilotLoginOptions = {
+	onAuth: (url: string, instructions?: string) => void;
+	onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;
+	onProgress?: (message: string) => void;
+	signal?: AbortSignal;
+	pollIntervalFloorMs?: number;
+	pollIntervalScaleMs?: number;
+	fetch?: FetchImpl;
+};
+type DeviceCodeResponse = {
+	device_code: string;
+	user_code: string;
+	verification_uri: string;
+	interval: number;
+	expires_in: number;
+};
+
+type DeviceTokenSuccessResponse = {
+	access_token: string;
+	token_type?: string;
+	scope?: string;
+};
+
+type DeviceTokenErrorResponse = {
+	error: string;
+	error_description?: string;
+	interval?: number;
+};
+
+function getUrls(domain: string): {
+	deviceCodeUrl: string;
+	accessTokenUrl: string;
+} {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`,
+	};
+}
+
+async function fetchJson(url: string, init: RequestInit, fetchImpl: FetchImpl): Promise<unknown> {
+	const response = await fetchImpl(url, init);
+	if (!response.ok) {
+		const text = await response.text();
+		throw new AIError.ProviderHttpError(`${response.status} ${response.statusText}: ${text}`, response.status);
+	}
+	return response.json();
+}
+
+async function startDeviceFlow(domain: string, fetchImpl: FetchImpl): Promise<DeviceCodeResponse> {
+	const urls = getUrls(domain);
+	const data = await fetchJson(
+		urls.deviceCodeUrl,
+		{
+			method: "POST",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				...OPENCODE_HEADERS,
+			},
+			body: JSON.stringify({
+				client_id: CLIENT_ID,
+				scope: "read:user",
+			}),
+		},
+		fetchImpl,
+	);
+
+	if (!data || typeof data !== "object") {
+		throw new AIError.OAuthError("Invalid device code response", { kind: "validation", provider: "github-copilot" });
+	}
+
+	const deviceCode = (data as Record<string, unknown>).device_code;
+	const userCode = (data as Record<string, unknown>).user_code;
+	const verificationUri = (data as Record<string, unknown>).verification_uri;
+	const interval = (data as Record<string, unknown>).interval;
+	const expiresIn = (data as Record<string, unknown>).expires_in;
+
+	if (
+		typeof deviceCode !== "string" ||
+		typeof userCode !== "string" ||
+		typeof verificationUri !== "string" ||
+		typeof interval !== "number" ||
+		typeof expiresIn !== "number"
+	) {
+		throw new AIError.OAuthError("Invalid device code response fields", {
+			kind: "validation",
+			provider: "github-copilot",
+		});
+	}
+
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn,
+	};
+}
+
+async function pollForGitHubAccessToken(
+	domain: string,
+	deviceCode: string,
+	intervalSeconds: number,
+	expiresIn: number,
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+	pollIntervalFloorMs = 1000,
+	pollIntervalScaleMs = 1000,
+) {
+	const urls = getUrls(domain);
+	const deadline = Date.now() + expiresIn * 1000;
+	let intervalMs = Math.max(pollIntervalFloorMs, Math.floor(intervalSeconds * pollIntervalScaleMs));
+	let intervalMultiplier = INITIAL_POLL_INTERVAL_MULTIPLIER;
+	let slowDownResponses = 0;
+
+	while (Date.now() < deadline) {
+		if (signal?.aborted) {
+			throw new AIError.LoginCancelledError();
+		}
+
+		const remainingMs = deadline - Date.now();
+		const waitMs = Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs);
+		try {
+			await scheduler.wait(waitMs, { signal });
+		} catch {
+			throw new AIError.LoginCancelledError();
+		}
+
+		const raw = await fetchJson(
+			urls.accessTokenUrl,
+			{
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					"Content-Type": "application/json",
+					...OPENCODE_HEADERS,
+				},
+				body: JSON.stringify({
+					client_id: CLIENT_ID,
+					device_code: deviceCode,
+					grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				}),
+			},
+			fetchImpl,
+		);
+
+		if (raw && typeof raw === "object" && typeof (raw as DeviceTokenSuccessResponse).access_token === "string") {
+			return (raw as DeviceTokenSuccessResponse).access_token;
+		}
+
+		if (raw && typeof raw === "object" && typeof (raw as DeviceTokenErrorResponse).error === "string") {
+			const { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;
+			if (error === "authorization_pending") {
+				continue;
+			}
+
+			if (error === "slow_down") {
+				slowDownResponses += 1;
+				intervalMs =
+					typeof interval === "number" && interval > 0
+						? Math.max(pollIntervalFloorMs, interval * pollIntervalScaleMs)
+						: Math.max(pollIntervalFloorMs, intervalMs + 5 * pollIntervalScaleMs);
+				intervalMultiplier = SLOW_DOWN_POLL_INTERVAL_MULTIPLIER;
+				continue;
+			}
+
+			const descriptionSuffix = description ? `: ${description}` : "";
+			throw new AIError.OAuthError(`Device flow failed: ${error}${descriptionSuffix}`, {
+				kind: "polling",
+				provider: "github-copilot",
+			});
+		}
+	}
+
+	if (slowDownResponses > 0) {
+		throw new AIError.OAuthError(
+			"Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.",
+			{ kind: "timeout", provider: "github-copilot" },
+		);
+	}
+
+	throw new AIError.OAuthError("Device flow timed out", { kind: "timeout", provider: "github-copilot" });
+}
+
+/** Far-future expiry (10 years). GitHub OAuth tokens are long-lived; no JWT exchange needed. */
+const FAR_FUTURE_MS = Date.now() + 10 * 365.25 * 24 * 60 * 60 * 1000;
+
+/**
+ * Refresh GitHub Copilot token.
+ * With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+ */
+export function refreshGitHubCopilotToken(
+	refreshToken: string,
+	enterpriseDomain?: string,
+	apiEndpoint?: string,
+): OAuthCredentials {
+	return {
+		refresh: refreshToken,
+		access: refreshToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain,
+		apiEndpoint,
+	};
+}
+
+async function discoverGitHubCopilotApiEndpoint(token: string, fetchImpl: FetchImpl): Promise<string | undefined> {
+	try {
+		const data = await fetchJson(
+			"https://api.github.com/copilot_internal/user",
+			{
+				headers: {
+					Accept: "application/json",
+					Authorization: `token ${token}`,
+					...OPENCODE_HEADERS,
+				},
+			},
+			fetchImpl,
+		);
+		if (!data || typeof data !== "object") return undefined;
+		const endpoints = (data as { endpoints?: { api?: unknown } }).endpoints;
+		return typeof endpoints?.api === "string" ? normalizeGitHubCopilotApiEndpoint(endpoints.api) : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Enable a model for the user's GitHub Copilot account.
+ * This is required for some models (like Claude, Grok) before they can be used.
+ */
+async function enableGitHubCopilotModel(
+	token: string,
+	modelId: string,
+	fetchImpl: FetchImpl,
+	enterpriseDomain: string | undefined,
+	apiEndpoint: string | undefined,
+): Promise<boolean> {
+	const baseUrl = apiEndpoint ?? getGitHubCopilotBaseUrl(enterpriseDomain);
+	const url = `${baseUrl}/models/${modelId}/policy`;
+
+	try {
+		const response = await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`,
+				...COPILOT_API_HEADERS,
+				"openai-intent": "chat-policy",
+				"x-interaction-type": "chat-policy",
+			},
+			body: JSON.stringify({ state: "enabled" }),
+		});
+		return response.ok;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Enable all known GitHub Copilot models that may require policy acceptance.
+ * Called after successful login to ensure all models are available.
+ */
+async function enableAllGitHubCopilotModels(
+	token: string,
+	enterpriseDomain: string | undefined,
+	apiEndpoint: string | undefined,
+	fetchImpl: FetchImpl,
+	onProgress?: (model: string, success: boolean) => void,
+): Promise<void> {
+	// Synthesized catalog variants (Copilot long-context `-1m` entries) share
+	// the upstream model id; enable each wire id exactly once.
+	const wireModelIds = [...new Set(getBundledModels("github-copilot").map(model => model.requestModelId ?? model.id))];
+	const BATCH_SIZE = 5;
+	for (let i = 0; i < wireModelIds.length; i += BATCH_SIZE) {
+		const batch = wireModelIds.slice(i, i + BATCH_SIZE);
+		await Promise.all(
+			batch.map(async modelId => {
+				const success = await enableGitHubCopilotModel(token, modelId, fetchImpl, enterpriseDomain, apiEndpoint);
+				onProgress?.(modelId, success);
+			}),
+		);
+	}
+}
+
+/**
+ * Login with GitHub Copilot OAuth (device code flow)
+ *
+ * @param options.onAuth - Callback with URL and optional instructions (user code)
+ * @param options.onPrompt - Callback to prompt user for input
+ * @param options.onProgress - Optional progress callback
+ * @param options.signal - Optional AbortSignal for cancellation
+ */
+export async function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Promise<OAuthCredentials> {
+	const fetchImpl = options.fetch ?? fetch;
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true,
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = input.trim();
+	const normalizedDomain = normalizeDomain(input);
+	if (trimmed && !normalizedDomain) {
+		throw new AIError.OAuthError("Invalid GitHub Enterprise URL/domain", {
+			kind: "validation",
+			provider: "github-copilot",
+		});
+	}
+	const enterpriseDomain = normalizeGitHubCopilotEnterpriseDomain(normalizedDomain ?? undefined);
+	const domain =
+		normalizedDomain && isPublicGitHubHost(normalizedDomain) ? "github.com" : (normalizedDomain ?? "github.com");
+
+	const device = await startDeviceFlow(domain, fetchImpl);
+	options.onAuth(device.verification_uri, `Enter code: ${device.user_code}`);
+
+	const githubAccessToken = await pollForGitHubAccessToken(
+		domain,
+		device.device_code,
+		device.interval,
+		device.expires_in,
+		options.signal,
+		fetchImpl,
+		options.pollIntervalFloorMs,
+		options.pollIntervalScaleMs,
+	);
+
+	const apiEndpoint = await discoverGitHubCopilotApiEndpoint(githubAccessToken, fetchImpl);
+
+	// With opencode OAuth, the GitHub token is used directly for all API requests
+	const credentials: OAuthCredentials = {
+		refresh: githubAccessToken,
+		access: githubAccessToken,
+		expires: FAR_FUTURE_MS,
+		enterpriseUrl: enterpriseDomain ?? undefined,
+		apiEndpoint,
+	};
+
+	// Enable all models after successful login
+	options.onProgress?.("Enabling models...");
+	await enableAllGitHubCopilotModels(githubAccessToken, enterpriseDomain ?? undefined, apiEndpoint, fetchImpl);
+	return credentials;
+}