@linxiraos/pi-ai 1.0.0

package/src/registry/oauth/gitlab-duo-workflow.ts

@@ -0,0 +1,146 @@
+import * as AIError from "../../error";
+import type { FetchImpl } from "../../types";
+import { OAuthCallbackFlow } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+
+const GITLAB_COM_URL = "https://gitlab.com";
+export const GITLAB_DUO_WORKFLOW_OAUTH_CLIENT_ID = "36f2a70cddeb5a0889d4fd8295c241b7e9848e89cf9e599d0eed2d8e5350fbf5";
+export const GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI = "vscode://gitlab.gitlab-workflow/authentication";
+const OAUTH_SCOPES = ["api"];
+
+interface PKCEPair {
+	verifier: string;
+	challenge: string;
+}
+
+function mapTokenResponse(payload: {
+	access_token?: string;
+	refresh_token?: string;
+	expires_in?: number;
+	created_at?: number;
+}): OAuthCredentials {
+	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") {
+		throw new AIError.OAuthError("GitLab Duo Workflow OAuth token response missing required fields", {
+			kind: "validation",
+			provider: "gitlab-duo-workflow",
+		});
+	}
+
+	const createdAtMs =
+		typeof payload.created_at === "number" && Number.isFinite(payload.created_at)
+			? payload.created_at * 1000
+			: Date.now();
+
+	return {
+		access: payload.access_token,
+		refresh: payload.refresh_token,
+		expires: createdAtMs + payload.expires_in * 1000 - 5 * 60 * 1000,
+	};
+}
+
+class GitLabDuoWorkflowOAuthFlow extends OAuthCallbackFlow {
+	#pkce: PKCEPair;
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthLoginCallbacks, pkce: PKCEPair) {
+		super(ctrl, {
+			preferredPort: 0,
+			redirectUri: GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI,
+		});
+		this.#pkce = pkce;
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+
+	override async generateAuthUrl(state: string): Promise<{ url: string; instructions?: string }> {
+		const authParams = new URLSearchParams({
+			client_id: GITLAB_DUO_WORKFLOW_OAUTH_CLIENT_ID,
+			redirect_uri: GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI,
+			response_type: "code",
+			scope: OAUTH_SCOPES.join(" "),
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+			state,
+		});
+
+		return {
+			url: `${GITLAB_COM_URL}/oauth/authorize?${authParams.toString()}`,
+			instructions:
+				"Complete GitLab login in your browser. This uses GitLab's official VS Code OAuth application. " +
+				"If the redirect opens VS Code instead of returning to OMP, copy the full " +
+				"vscode://gitlab.gitlab-workflow/authentication?... callback URL from VS Code/browser and paste it back into OMP.",
+		};
+	}
+
+	override async exchangeToken(code: string): Promise<OAuthCredentials> {
+		const response = await this.#fetch(`${GITLAB_COM_URL}/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: GITLAB_DUO_WORKFLOW_OAUTH_CLIENT_ID,
+				redirect_uri: GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI,
+				grant_type: "authorization_code",
+				code,
+				code_verifier: this.#pkce.verifier,
+			}).toString(),
+		});
+
+		if (!response.ok) {
+			throw new AIError.OAuthError(
+				`GitLab Duo Workflow OAuth token exchange failed: ${response.status} ${await response.text()}`,
+				{ kind: "token-exchange", provider: "gitlab-duo-workflow", status: response.status },
+			);
+		}
+
+		return mapTokenResponse(
+			(await response.json()) as {
+				access_token?: string;
+				refresh_token?: string;
+				expires_in?: number;
+				created_at?: number;
+			},
+		);
+	}
+}
+
+export async function loginGitLabDuoWorkflow(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+	const pkce = await generatePKCE();
+	const flow = new GitLabDuoWorkflowOAuthFlow(callbacks, pkce);
+	return flow.login();
+}
+
+export async function refreshGitLabDuoWorkflowToken(
+	credentials: OAuthCredentials,
+	fetchImpl: FetchImpl = fetch,
+): Promise<OAuthCredentials> {
+	const response = await fetchImpl(`${GITLAB_COM_URL}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: GITLAB_DUO_WORKFLOW_OAUTH_CLIENT_ID,
+			redirect_uri: GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI,
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh,
+		}).toString(),
+	});
+
+	if (!response.ok) {
+		throw new AIError.OAuthError(
+			`GitLab Duo Workflow OAuth refresh failed: ${response.status} ${await response.text()}`,
+			{
+				kind: "token-refresh",
+				provider: "gitlab-duo-workflow",
+				status: response.status,
+			},
+		);
+	}
+
+	return mapTokenResponse(
+		(await response.json()) as {
+			access_token?: string;
+			refresh_token?: string;
+			expires_in?: number;
+			created_at?: number;
+		},
+	);
+}

package/src/registry/oauth/gitlab-duo.ts

@@ -0,0 +1,222 @@
+import * as AIError from "../../error";
+import { clearGitLabDuoDirectAccessCache } from "../../providers/gitlab-duo";
+import type { FetchImpl } from "../../types";
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+
+const GITLAB_COM_URL = "https://gitlab.com";
+/**
+ * Default OAuth client id baked into the bundled GitLab Duo login flow. GitLab
+ * authorize requests are rejected outright (`The redirect URI included is not
+ * valid`) whenever this client id's registered redirect URI list drifts from
+ * `http://localhost:8080/callback`. Users hitting that case can either:
+ *
+ * - register their own GitLab OAuth application and override the bundled
+ *   credentials with `GITLAB_CLIENT_ID` + `GITLAB_REDIRECT_URI`, or
+ * - skip OAuth entirely and supply a Personal Access Token via `GITLAB_TOKEN`.
+ *
+ * @see https://github.com/can1357/oh-my-pi/issues/2424
+ */
+const DEFAULT_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b";
+const OAUTH_SCOPES = ["api"];
+const DEFAULT_CALLBACK_PORT = 8080;
+const DEFAULT_CALLBACK_PATH = "/callback";
+const DEFAULT_CALLBACK_HOSTNAME = "localhost";
+
+interface PKCEPair {
+	verifier: string;
+	challenge: string;
+}
+
+/**
+ * Resolve the OAuth client id, preferring `GITLAB_CLIENT_ID` when set so users
+ * with their own GitLab OAuth application can bypass the bundled credentials.
+ */
+function resolveClientId(): string {
+	const env = process.env.GITLAB_CLIENT_ID?.trim();
+	return env && env.length > 0 ? env : DEFAULT_CLIENT_ID;
+}
+
+/**
+ * Resolve callback-server options from `GITLAB_REDIRECT_URI`. When set, the
+ * exact string is advertised to GitLab (strict matching), random-port fallback
+ * is disabled, and HTTP loopback URIs bind the listener to the URI's host/port
+ * so the browser callback lands on us. HTTPS loopback URIs are rejected because
+ * the local callback server is plaintext HTTP. Non-loopback URIs bind a random
+ * local port — only the paste-code path can complete in that case.
+ */
+function resolveCallbackOptions(): OAuthCallbackFlowOptions {
+	const raw = process.env.GITLAB_REDIRECT_URI?.trim();
+	if (!raw) {
+		return {
+			preferredPort: DEFAULT_CALLBACK_PORT,
+			callbackPath: DEFAULT_CALLBACK_PATH,
+			callbackHostname: DEFAULT_CALLBACK_HOSTNAME,
+		};
+	}
+
+	let parsed: URL;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new AIError.OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
+	}
+
+	const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+	if (isLoopback && parsed.protocol !== "http:") {
+		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
+	}
+
+	const port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
+
+	return {
+		preferredPort: isLoopback ? port : 0,
+		callbackPath: parsed.pathname || DEFAULT_CALLBACK_PATH,
+		callbackHostname: isLoopback ? parsed.hostname : DEFAULT_CALLBACK_HOSTNAME,
+		redirectUri: raw,
+	};
+}
+
+function mapTokenResponse(payload: {
+	access_token?: string;
+	refresh_token?: string;
+	expires_in?: number;
+	created_at?: number;
+}): OAuthCredentials {
+	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") {
+		throw new AIError.OAuthError("GitLab OAuth token response missing required fields", {
+			kind: "validation",
+			provider: "gitlab-duo",
+		});
+	}
+
+	const createdAtMs =
+		typeof payload.created_at === "number" && Number.isFinite(payload.created_at)
+			? payload.created_at * 1000
+			: Date.now();
+
+	return {
+		access: payload.access_token,
+		refresh: payload.refresh_token,
+		expires: createdAtMs + payload.expires_in * 1000 - 5 * 60 * 1000,
+	};
+}
+
+class GitLabDuoOAuthFlow extends OAuthCallbackFlow {
+	#pkce: PKCEPair;
+	#clientId: string;
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthLoginCallbacks, pkce: PKCEPair, clientId: string, options: OAuthCallbackFlowOptions) {
+		super(ctrl, options);
+		this.#pkce = pkce;
+		this.#clientId = clientId;
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+
+	override async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const authParams = new URLSearchParams({
+			client_id: this.#clientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: OAUTH_SCOPES.join(" "),
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+			state,
+		});
+
+		return {
+			url: `${GITLAB_COM_URL}/oauth/authorize?${authParams.toString()}`,
+			instructions:
+				'Complete GitLab login in browser. If GitLab responds with "The redirect URI included is not valid", ' +
+				"register your own GitLab OAuth application and set GITLAB_CLIENT_ID + GITLAB_REDIRECT_URI, or use a " +
+				"Personal Access Token via GITLAB_TOKEN.",
+		};
+	}
+
+	override async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		const response = await this.#fetch(`${GITLAB_COM_URL}/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.#clientId,
+				grant_type: "authorization_code",
+				code,
+				code_verifier: this.#pkce.verifier,
+				redirect_uri: redirectUri,
+			}).toString(),
+		});
+
+		if (!response.ok) {
+			throw new AIError.OAuthError(
+				`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`,
+				{
+					kind: "token-exchange",
+					provider: "gitlab-duo",
+					status: response.status,
+				},
+			);
+		}
+
+		clearGitLabDuoDirectAccessCache();
+		return mapTokenResponse(
+			(await response.json()) as {
+				access_token?: string;
+				refresh_token?: string;
+				expires_in?: number;
+				created_at?: number;
+			},
+		);
+	}
+}
+
+export async function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+	const pkce = await generatePKCE();
+	const clientId = resolveClientId();
+	const options = resolveCallbackOptions();
+	const flow = new GitLabDuoOAuthFlow(callbacks, pkce, clientId, options);
+	return flow.login();
+}
+
+export async function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
+	const response = await fetch(`${GITLAB_COM_URL}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: resolveClientId(),
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh,
+		}).toString(),
+	});
+
+	if (!response.ok) {
+		throw new AIError.OAuthError(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`, {
+			kind: "token-refresh",
+			provider: "gitlab-duo",
+			status: response.status,
+		});
+	}
+
+	clearGitLabDuoDirectAccessCache();
+	return mapTokenResponse(
+		(await response.json()) as {
+			access_token?: string;
+			refresh_token?: string;
+			expires_in?: number;
+			created_at?: number;
+		},
+	);
+}

package/src/registry/oauth/google-antigravity.ts

@@ -0,0 +1,225 @@
+/**
+ * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
+ * Uses different OAuth credentials than google-gemini-cli for access to additional models.
+ */
+import { getAntigravityUserAgent } from "@linxiraos/pi-catalog/wire/gemini-headers";
+import * as AIError from "../../error";
+import { oauthFetch, runGoogleOAuthLogin, throwIfLoginCancelled } from "./google-oauth-shared";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const decode = (s: string) => atob(s);
+const CLIENT_ID = decode(
+	"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==",
+);
+const CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+const CALLBACK_PORT = 51121;
+const CALLBACK_PATH = "/oauth-callback";
+
+const SCOPES = [
+	"https://www.googleapis.com/auth/cloud-platform",
+	"https://www.googleapis.com/auth/userinfo.email",
+	"https://www.googleapis.com/auth/userinfo.profile",
+	"https://www.googleapis.com/auth/cclog",
+	"https://www.googleapis.com/auth/experimentsandconfigs",
+];
+
+const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const CLOUD_CODE_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+const TIER_LEGACY = "legacy-tier";
+const PROJECT_ONBOARD_MAX_ATTEMPTS = 5;
+const PROJECT_ONBOARD_INTERVAL_MS = 2000;
+
+interface LoadCodeAssistPayload {
+	cloudaicompanionProject?: string | { id?: string };
+	currentTier?: { id?: string };
+	allowedTiers?: Array<{ id?: string; isDefault?: boolean }>;
+}
+
+interface LongRunningOperationResponse {
+	done?: boolean;
+	response?: {
+		cloudaicompanionProject?: string | { id?: string };
+	};
+}
+
+export const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
+	ideType: "ANTIGRAVITY",
+	platform: "PLATFORM_UNSPECIFIED",
+	pluginType: "GEMINI",
+});
+
+function readProjectId(value: string | { id?: string } | undefined): string | undefined {
+	if (typeof value === "string" && value.length > 0) {
+		return value;
+	}
+	if (value && typeof value === "object" && typeof value.id === "string" && value.id.length > 0) {
+		return value.id;
+	}
+	return undefined;
+}
+
+function getDefaultTierId(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): string {
+	if (!allowedTiers || allowedTiers.length === 0) {
+		return TIER_LEGACY;
+	}
+	const defaultTier = allowedTiers.find(tier => tier.isDefault && typeof tier.id === "string" && tier.id.length > 0);
+	if (defaultTier?.id) {
+		return defaultTier.id;
+	}
+	return TIER_LEGACY;
+}
+
+async function onboardProjectWithRetries(
+	endpoint: string,
+	headers: Record<string, string>,
+	onboardBody: { tierId: string; metadata: typeof ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA },
+	signal: AbortSignal | undefined,
+	onProgress?: (message: string) => void,
+): Promise<string> {
+	for (let attempt = 1; attempt <= PROJECT_ONBOARD_MAX_ATTEMPTS; attempt += 1) {
+		if (attempt > 1) {
+			onProgress?.(`Waiting for project provisioning (attempt ${attempt}/${PROJECT_ONBOARD_MAX_ATTEMPTS})...`);
+			throwIfLoginCancelled(signal);
+			await Bun.sleep(PROJECT_ONBOARD_INTERVAL_MS);
+		}
+
+		throwIfLoginCancelled(signal);
+		const onboardResponse = await oauthFetch(
+			`${endpoint}/v1internal:onboardUser`,
+			{ method: "POST", headers, body: JSON.stringify(onboardBody) },
+			{ provider: "google-antigravity", signal },
+		);
+
+		if (!onboardResponse.ok) {
+			const errorText = await onboardResponse.text();
+			throw new AIError.OAuthError(
+				`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`,
+				{ kind: "provisioning", provider: "google-antigravity", status: onboardResponse.status },
+			);
+		}
+
+		const operation = (await onboardResponse.json()) as LongRunningOperationResponse;
+		if (!operation.done) {
+			continue;
+		}
+
+		const projectId = readProjectId(operation.response?.cloudaicompanionProject);
+		if (projectId) {
+			return projectId;
+		}
+	}
+
+	throw new AIError.OAuthError(
+		`onboardUser did not return a provisioned project id after ${PROJECT_ONBOARD_MAX_ATTEMPTS} attempts`,
+		{ kind: "provisioning", provider: "google-antigravity" },
+	);
+}
+
+async function discoverProject(
+	accessToken: string,
+	onProgress?: (message: string) => void,
+	signal?: AbortSignal,
+): Promise<string> {
+	const headers = {
+		Authorization: `Bearer ${accessToken}`,
+		"Content-Type": "application/json",
+		"User-Agent": getAntigravityUserAgent(),
+	};
+
+	onProgress?.("Checking for existing project...");
+	const endpoint = CLOUD_CODE_ENDPOINT;
+	try {
+		throwIfLoginCancelled(signal);
+		const loadResponse = await oauthFetch(
+			`${endpoint}/v1internal:loadCodeAssist`,
+			{
+				method: "POST",
+				headers,
+				body: JSON.stringify({
+					metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+				}),
+			},
+			{ provider: "google-antigravity", signal },
+		);
+
+		if (!loadResponse.ok) {
+			const errorText = await loadResponse.text();
+			throw new AIError.OAuthError(
+				`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`,
+				{ kind: "discovery", status: loadResponse.status },
+			);
+		}
+
+		const loadPayload = (await loadResponse.json()) as LoadCodeAssistPayload;
+		const existingProject = readProjectId(loadPayload.cloudaicompanionProject);
+		if (existingProject) {
+			return existingProject;
+		}
+
+		const tierId = getDefaultTierId(loadPayload.allowedTiers);
+		onProgress?.("Provisioning project...");
+		const onboardBody = {
+			tierId,
+			metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+		};
+		const provisionedProject = await onboardProjectWithRetries(endpoint, headers, onboardBody, signal, onProgress);
+		return provisionedProject;
+	} catch (error) {
+		if (error instanceof AIError.LoginCancelledError || error instanceof AIError.OAuthError) {
+			throw error;
+		}
+		throw new AIError.OAuthError(
+			`Could not discover or provision an Antigravity project. ${error instanceof Error ? error.message : String(error)}`,
+			{ kind: "discovery", provider: "google-antigravity", cause: error },
+		);
+	}
+}
+
+export async function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials> {
+	return runGoogleOAuthLogin(ctrl, {
+		provider: "google-antigravity",
+		clientId: CLIENT_ID,
+		clientSecret: CLIENT_SECRET,
+		authUrl: AUTH_URL,
+		tokenUrl: TOKEN_URL,
+		scopes: SCOPES,
+		callbackPort: CALLBACK_PORT,
+		callbackPath: CALLBACK_PATH,
+		discoverProject,
+	});
+}
+
+/**
+ * Refresh Antigravity token
+ */
+export async function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			client_secret: CLIENT_SECRET,
+			refresh_token: refreshToken,
+			grant_type: "refresh_token",
+		}),
+	});
+
+	if (!response.ok) {
+		const error = await response.text();
+		throw new AIError.OAuthError(`Antigravity token refresh failed: ${error}`, { kind: "token-refresh" });
+	}
+
+	const data = (await response.json()) as {
+		access_token: string;
+		expires_in: number;
+		refresh_token?: string;
+	};
+
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+		projectId,
+	};
+}