@linxiraos/pi-ai 1.0.0

package/src/registry/oauth/openai-codex.ts

@@ -0,0 +1,384 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow — browser and device-code flows.
+ */
+
+import { OPENAI_HEADER_VALUES } from "@linxiraos/pi-catalog/wire/codex";
+import * as AIError from "../../error";
+import type { FetchImpl } from "../../types";
+import { isRecord } from "../../utils";
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
+const TOKEN_REQUEST_TIMEOUT_MS = 15_000;
+const DEVICE_USERCODE_URL = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN_URL = "https://auth.openai.com/api/accounts/deviceauth/token";
+const DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+const DEVICE_AUTH_URL = "https://auth.openai.com/codex/device";
+const DEVICE_POLL_INTERVAL_MS = 5_000;
+const DEVICE_POLL_SAFETY_MARGIN_MS = 3_000;
+/** Upper bound on device-code polling to avoid infinite loops on server errors. */
+const DEVICE_MAX_POLLS = 120;
+
+type JwtPayload = {
+	[JWT_CLAIM_PATH]?: {
+		chatgpt_account_id?: string;
+		chatgpt_plan_type?: string;
+	};
+	[JWT_PROFILE_CLAIM]?: {
+		email?: string;
+	};
+	[key: string]: unknown;
+};
+
+export function decodeJwt<T = Record<string, unknown>>(token: string): T | null {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1] ?? "";
+		const decoded = Buffer.from(payload, "base64").toString("utf-8");
+		return JSON.parse(decoded) as T;
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Identity slice decoded from the token claims. The ChatGPT workspace
+ * (`chatgpt_account_id`) is the subscription pool the token draws limits
+ * from — one account email can hold several (e.g. a personal Pro plan plus a
+ * Team seat). `chatgpt_plan_type` may only be present on the `id_token`.
+ */
+function getTokenProfile(
+	accessToken: string,
+	idToken?: string,
+): { accountId?: string; email?: string; planType?: string } {
+	const payload = decodeJwt<JwtPayload>(accessToken);
+	const idPayload = idToken ? decodeJwt<JwtPayload>(idToken) : null;
+	const auth = payload?.[JWT_CLAIM_PATH];
+	const idAuth = idPayload?.[JWT_CLAIM_PATH];
+	const accountId = auth?.chatgpt_account_id;
+	const email = payload?.[JWT_PROFILE_CLAIM]?.email?.trim().toLowerCase();
+	const planType = (auth?.chatgpt_plan_type ?? idAuth?.chatgpt_plan_type)?.trim().toLowerCase();
+	return {
+		accountId: typeof accountId === "string" && accountId.length > 0 ? accountId : undefined,
+		email: typeof email === "string" && email.length > 0 ? email : undefined,
+		planType: typeof planType === "string" && planType.length > 0 ? planType : undefined,
+	};
+}
+
+interface PKCE {
+	verifier: string;
+	challenge: string;
+}
+function describeTokenEndpointValue(value: unknown): string | undefined {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : undefined;
+	}
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (!isRecord(value)) return undefined;
+
+	const code = describeTokenEndpointValue(value.code ?? value.error);
+	const message = describeTokenEndpointValue(value.message ?? value.error_description ?? value.description);
+	if (code && message && code !== message) return `${code}: ${message}`;
+	return code ?? message ?? JSON.stringify(value);
+}
+
+/** Formats OpenAI Codex OAuth token endpoint errors for login and refresh failures. */
+export function formatOpenAICodexTokenEndpointError(status: number, bodyText: string): string {
+	const trimmed = bodyText.trim();
+	if (trimmed.length === 0) return `${status}`;
+
+	try {
+		const body: unknown = JSON.parse(trimmed);
+		if (!isRecord(body)) return `${status} ${trimmed}`;
+
+		const error = describeTokenEndpointValue(body.error);
+		const description = describeTokenEndpointValue(body.error_description);
+		if (error && description && error !== description) return `${status} ${error}: ${description}`;
+		return `${status} ${error ?? description ?? describeTokenEndpointValue(body.message) ?? trimmed}`;
+	} catch {
+		return `${status} ${trimmed}`;
+	}
+}
+/** Builds the Codex browser OAuth URL used by browser login; exported for auth regression tests. */
+export function createOpenAICodexAuthorizationUrl(args: {
+	state: string;
+	redirectUri: string;
+	challenge: string;
+	originator?: string;
+}): string {
+	const originator = args.originator?.trim() || OPENAI_HEADER_VALUES.ORIGINATOR_CODEX;
+	const searchParams = new URLSearchParams({
+		response_type: "code",
+		client_id: CLIENT_ID,
+		redirect_uri: args.redirectUri,
+		scope: SCOPE,
+		code_challenge: args.challenge,
+		code_challenge_method: "S256",
+		state: args.state,
+		id_token_add_organizations: "true",
+		codex_cli_simplified_flow: "true",
+		originator,
+	});
+
+	return `${AUTHORIZE_URL}?${searchParams.toString()}`;
+}
+
+class OpenAICodexOAuthFlow extends OAuthCallbackFlow {
+	#pkce: PKCE;
+	#originator: string;
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthController, pkce: PKCE, originator: string, fetchImpl: FetchImpl) {
+		super(ctrl, {
+			preferredPort: CALLBACK_PORT,
+			callbackPath: CALLBACK_PATH,
+			// Enforce the fixed port: OpenAI only allows http://localhost:1455/auth/callback.
+			// Without this, a busy port 1455 falls back to a random port, and the token
+			// exchange would fail with 403 because the redirect_uri no longer matches the
+			// registered allowlist entry.
+			redirectUri: `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`,
+		} satisfies OAuthCallbackFlowOptions);
+		this.#pkce = pkce;
+		this.#originator = originator;
+		this.#fetch = fetchImpl;
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const url = createOpenAICodexAuthorizationUrl({
+			state,
+			redirectUri,
+			challenge: this.#pkce.challenge,
+			originator: this.#originator,
+		});
+		return { url, instructions: "A browser window should open. Complete login to finish." };
+	}
+
+	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		return exchangeCodeForToken(code, this.#pkce.verifier, redirectUri, this.#fetch);
+	}
+}
+
+async function exchangeCodeForToken(
+	code: string,
+	verifier: string,
+	redirectUri: string,
+	fetchImpl: FetchImpl = fetch,
+): Promise<OAuthCredentials> {
+	const tokenResponse = await fetchImpl(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri,
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+	});
+
+	if (!tokenResponse.ok) {
+		const bodyText = await tokenResponse.text();
+		throw new AIError.OAuthError(
+			`Token exchange failed: ${formatOpenAICodexTokenEndpointError(tokenResponse.status, bodyText)}`,
+			{ kind: "token-exchange", status: tokenResponse.status },
+		);
+	}
+
+	const tokenData = (await tokenResponse.json()) as {
+		access_token?: string;
+		refresh_token?: string;
+		id_token?: string;
+		expires_in?: number;
+	};
+
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") {
+		throw new AIError.OAuthError("Token response missing required fields", { kind: "validation" });
+	}
+
+	const { accountId, email, planType } = getTokenProfile(tokenData.access_token, tokenData.id_token);
+	if (!accountId) {
+		throw new AIError.OAuthError("Failed to extract accountId from token", { kind: "validation" });
+	}
+
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token,
+		expires: Date.now() + tokenData.expires_in * 1000,
+		accountId,
+		email,
+		orgId: accountId,
+		orgName: planType,
+	};
+}
+
+/**
+ * Login with OpenAI Codex OAuth
+ */
+export type OpenAICodexLoginOptions = OAuthController & {
+	/** Optional originator value for OpenAI Codex OAuth. Default matches OMP Codex request headers. */
+	originator?: string;
+};
+
+export async function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials> {
+	const pkce = await generatePKCE();
+	const originator = options.originator?.trim() || OPENAI_HEADER_VALUES.ORIGINATOR_CODEX;
+	const flow = new OpenAICodexOAuthFlow(options, pkce, originator, options.fetch ?? fetch);
+
+	return flow.login();
+}
+
+/**
+ * Login with OpenAI Codex using the device-code (headless) flow.
+ *
+ * Avoids a local callback server entirely — useful when port 1455 is unavailable
+ * or when the browser callback flow fails with 403 (e.g. network/proxy issues).
+ */
+export async function loginOpenAICodexDevice(ctrl: OAuthController): Promise<OAuthCredentials> {
+	ctrl.onProgress?.("Initiating device authorization…");
+
+	const initResponse = await fetch(DEVICE_USERCODE_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+	});
+
+	if (!initResponse.ok) {
+		throw new AIError.OAuthError(`Device authorization initiation failed: ${initResponse.status}`, {
+			kind: "device-auth",
+			status: initResponse.status,
+		});
+	}
+
+	const initData = (await initResponse.json()) as {
+		device_auth_id?: string;
+		user_code?: string;
+		interval?: string | number;
+	};
+
+	if (!initData.device_auth_id || !initData.user_code) {
+		throw new AIError.OAuthError("Device authorization response missing required fields", { kind: "validation" });
+	}
+
+	const userCode = initData.user_code;
+	const pollIntervalMs =
+		(typeof initData.interval === "number"
+			? initData.interval
+			: parseInt(String(initData.interval ?? "5"), 10) || 5) *
+			1000 +
+		DEVICE_POLL_SAFETY_MARGIN_MS;
+
+	ctrl.onAuth?.({
+		url: DEVICE_AUTH_URL,
+		instructions: `Enter code: ${userCode}`,
+	});
+
+	ctrl.onProgress?.(`Waiting for browser authorization (code: ${userCode})…`);
+
+	for (let poll = 0; poll < DEVICE_MAX_POLLS; poll++) {
+		await Bun.sleep(poll === 0 ? Math.min(pollIntervalMs, DEVICE_POLL_INTERVAL_MS) : pollIntervalMs);
+
+		if (ctrl.signal?.aborted) {
+			throw new AIError.LoginCancelledError("Device authorization cancelled");
+		}
+
+		const pollResponse = await fetch(DEVICE_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				device_auth_id: initData.device_auth_id,
+				user_code: userCode,
+			}),
+			signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+		});
+
+		// 403/404 = authorization pending, keep polling
+		if (pollResponse.status === 403 || pollResponse.status === 404) {
+			continue;
+		}
+
+		if (!pollResponse.ok) {
+			throw new AIError.OAuthError(`Device token polling failed: ${pollResponse.status}`, {
+				kind: "polling",
+				status: pollResponse.status,
+			});
+		}
+
+		const pollData = (await pollResponse.json()) as {
+			authorization_code?: string;
+			code_verifier?: string;
+		};
+
+		if (!pollData.authorization_code || !pollData.code_verifier) {
+			throw new AIError.OAuthError("Device token response missing authorization_code or code_verifier", {
+				kind: "validation",
+			});
+		}
+
+		ctrl.onProgress?.("Exchanging authorization code for tokens…");
+		return exchangeCodeForToken(pollData.authorization_code, pollData.code_verifier, DEVICE_REDIRECT_URI);
+	}
+
+	throw new AIError.OAuthError("Device authorization timed out — user did not complete login in time", {
+		kind: "timeout",
+	});
+}
+
+/**
+ * Refresh OpenAI Codex OAuth token
+ */
+export async function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: CLIENT_ID,
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+	});
+
+	if (!response.ok) {
+		const bodyText = await response.text();
+		throw new AIError.OAuthError(
+			`OpenAI Codex token refresh failed: ${formatOpenAICodexTokenEndpointError(response.status, bodyText)}`,
+			{ kind: "token-refresh", status: response.status },
+		);
+	}
+
+	const tokenData = (await response.json()) as {
+		access_token?: string;
+		refresh_token?: string;
+		expires_in?: number;
+	};
+
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") {
+		throw new AIError.OAuthError("Token response missing required fields", { kind: "validation" });
+	}
+
+	const { accountId, email } = getTokenProfile(tokenData.access_token);
+
+	// Deliberately no org fields on the result: the workspace a credential is
+	// scoped to is fixed at login. Callers merge refresh results over the
+	// stored credential, so omitting org here preserves it verbatim.
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token || refreshToken,
+		expires: Date.now() + tokenData.expires_in * 1000,
+		accountId: accountId ?? undefined,
+		email,
+	};
+}

package/src/registry/oauth/opencode.ts

@@ -0,0 +1,50 @@
+/**
+ * OpenCode Zen login flow.
+ *
+ * OpenCode Zen is a subscription service that provides access to various AI models
+ * (GPT-5.x, Claude 4.x, Gemini 3, etc.) through a unified API at opencode.ai/zen.
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to https://opencode.ai/auth
+ * 2. User logs in and copies their API key
+ * 3. User pastes the API key back into the CLI
+ */
+
+import * as AIError from "../../error";
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://opencode.ai/auth";
+
+/**
+ * Login to OpenCode Zen.
+ *
+ * Opens browser to auth page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginOpenCode(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("OpenCode Zen");
+	}
+
+	// Open browser to auth page
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Log in and copy your API key",
+	});
+
+	// Prompt user to paste their API key
+	const apiKey = await options.onPrompt({
+		message: "Paste your OpenCode Zen API key",
+		placeholder: "sk-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	return trimmed;
+}

package/src/registry/oauth/perplexity.ts

@@ -0,0 +1,228 @@
+/**
+ * Perplexity login and token refresh.
+ *
+ * Login paths (in priority order):
+ * 1. macOS native app: reads JWT from NSUserDefaults (`defaults read ai.perplexity.mac authToken`)
+ * 2. HTTP email OTP: `GET /api/auth/csrf` → `POST /api/auth/signin-email` → `POST /api/auth/signin-otp`
+ *
+ * No browser or manual cookie paste required.
+ * Refresh: Socket.IO `refreshJWT` RPC over authenticated WebSocket connection.
+ *
+ * Protocol: Engine.IO v4 + Socket.IO v4 over WebSocket (bypasses Cloudflare managed challenge).
+ * Architecture reverse-engineered from Perplexity macOS app (ai.perplexity.mac).
+ */
+import * as os from "node:os";
+import { $env } from "@linxiraos/pi-utils";
+import { $ } from "bun";
+import * as AIError from "../../error";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const API_VERSION = "2.18";
+const NATIVE_APP_BUNDLE = "ai.perplexity.mac";
+const APP_USER_AGENT = "Perplexity/641 CFNetwork/1568 Darwin/25.2.0";
+
+// ---------------------------------------------------------------------------
+// JWT helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Extract expiry from a JWT. Perplexity tokens generally lack an `exp` claim
+ * (their sessions are server-side and effectively non-expiring from the client's
+ * point of view), so we return a far-future sentinel when no `exp` is present.
+ * When `exp` IS present, subtract a 5-minute safety margin.
+ */
+const NEVER_EXPIRES = 8.64e15; // max safe Date value
+function getJwtExpiry(token: string): number {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return NEVER_EXPIRES;
+		const payload = parts[1] ?? "";
+		const decoded = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+		if (typeof decoded?.exp === "number" && Number.isFinite(decoded.exp)) {
+			return decoded.exp * 1000 - 5 * 60_000;
+		}
+	} catch {
+		// Ignore decode errors
+	}
+	return NEVER_EXPIRES;
+}
+
+/** Build OAuthCredentials from a Perplexity JWT string. */
+function jwtToCredentials(jwt: string, email?: string): OAuthCredentials {
+	return {
+		access: jwt,
+		refresh: jwt,
+		expires: getJwtExpiry(jwt),
+		email,
+	};
+}
+
+// ---------------------------------------------------------------------------
+// Desktop app extraction
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the Perplexity JWT from the native macOS Catalyst app's UserDefaults.
+ * Tokens are stored in NSUserDefaults (not Keychain), readable by any same-UID process.
+ */
+async function extractFromNativeApp(): Promise<string | null> {
+	if (os.platform() !== "darwin") return null;
+
+	try {
+		const result = await $`defaults read ${NATIVE_APP_BUNDLE} authToken`.quiet().nothrow();
+		if (result.exitCode !== 0) return null;
+		const token = result.text().trim();
+		if (!token || token === "(null)") return null;
+		return token;
+	} catch {
+		return null;
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Socket.IO email OTP login
+// ---------------------------------------------------------------------------
+
+/**
+ * Send email OTP and exchange it for a Perplexity JWT via HTTP endpoints.
+ */
+async function httpEmailLogin(ctrl: OAuthController): Promise<OAuthCredentials> {
+	if (!ctrl.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Perplexity");
+	}
+	const email = await ctrl.onPrompt({
+		message: "Enter your Perplexity email address",
+		placeholder: "user@example.com",
+	});
+	const trimmedEmail = email.trim();
+	if (!trimmedEmail)
+		throw new AIError.OAuthError("Email is required for Perplexity login", {
+			kind: "validation",
+			provider: "perplexity",
+		});
+	if (ctrl.signal?.aborted) throw new AIError.LoginCancelledError();
+
+	ctrl.onProgress?.("Fetching Perplexity CSRF token...");
+	const csrfResponse = await fetch("https://www.perplexity.ai/api/auth/csrf", {
+		headers: {
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION,
+		},
+		signal: ctrl.signal,
+	});
+
+	if (!csrfResponse.ok) {
+		throw new AIError.ProviderHttpError(
+			`Perplexity CSRF request failed: ${csrfResponse.status}`,
+			csrfResponse.status,
+		);
+	}
+
+	const csrfData = (await csrfResponse.json()) as { csrfToken?: string };
+	if (!csrfData.csrfToken) {
+		throw new AIError.OAuthError("Perplexity CSRF response missing csrfToken", {
+			kind: "validation",
+			provider: "perplexity",
+		});
+	}
+	ctrl.onProgress?.("Sending login code to your email...");
+	const sendResponse = await fetch("https://www.perplexity.ai/api/auth/signin-email", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION,
+		},
+		body: JSON.stringify({
+			email: trimmedEmail,
+			csrfToken: csrfData.csrfToken,
+		}),
+		signal: ctrl.signal,
+	});
+
+	if (!sendResponse.ok) {
+		const body = await sendResponse.text();
+		throw new AIError.ProviderHttpError(
+			`Perplexity send login code failed (${sendResponse.status}): ${body}`,
+			sendResponse.status,
+		);
+	}
+	const otp = await ctrl.onPrompt({
+		message: "Enter the code sent to your email",
+		placeholder: "123456",
+	});
+	const trimmedOtp = otp.trim();
+	if (!trimmedOtp)
+		throw new AIError.OAuthError("OTP code is required", { kind: "validation", provider: "perplexity" });
+	if (ctrl.signal?.aborted) throw new AIError.LoginCancelledError();
+	ctrl.onProgress?.("Verifying login code...");
+	const verifyResponse = await fetch("https://www.perplexity.ai/api/auth/signin-otp", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION,
+		},
+		body: JSON.stringify({
+			email: trimmedEmail,
+			otp: trimmedOtp,
+			csrfToken: csrfData.csrfToken,
+		}),
+		signal: ctrl.signal,
+	});
+
+	const verifyData = (await verifyResponse.json()) as {
+		token?: string;
+		status?: string;
+		error_code?: string;
+		text?: string;
+	};
+
+	if (!verifyResponse.ok) {
+		const reason = verifyData.text ?? verifyData.error_code ?? verifyData.status ?? "OTP verification failed";
+		throw new AIError.OAuthError(`Perplexity OTP verification failed: ${reason}`, {
+			kind: "validation",
+			provider: "perplexity",
+			status: verifyResponse.status,
+		});
+	}
+
+	if (!verifyData.token) {
+		throw new AIError.OAuthError("Perplexity OTP verification response missing token", {
+			kind: "validation",
+			provider: "perplexity",
+		});
+	}
+
+	return jwtToCredentials(verifyData.token, trimmedEmail);
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Login to Perplexity.
+ *
+ * Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
+ *
+ * No browser/manual token paste fallback is used.
+ */
+export async function loginPerplexity(ctrl: OAuthController): Promise<OAuthCredentials> {
+	if (!ctrl.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Perplexity");
+	}
+
+	// Path 1: Native macOS app JWT (skip if PI_AUTH_NO_BORROW=1)
+	if (!$env.PI_AUTH_NO_BORROW) {
+		ctrl.onProgress?.("Checking for Perplexity desktop app...");
+		const nativeJwt = await extractFromNativeApp();
+		if (nativeJwt) {
+			ctrl.onProgress?.("Found Perplexity JWT from native app");
+			return jwtToCredentials(nativeJwt);
+		}
+	}
+
+	// Path 2: HTTP email OTP
+	return httpEmailLogin(ctrl);
+}

package/src/registry/oauth/pkce.ts

@@ -0,0 +1,18 @@
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {
+	// Generate random verifier
+	const verifierBytes = new Uint8Array(96);
+	crypto.getRandomValues(verifierBytes);
+	const verifier = Buffer.from(verifierBytes).toString("base64url");
+
+	// Compute SHA-256 challenge
+	const encoder = new TextEncoder();
+	const data = encoder.encode(verifier);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+	const challenge = Buffer.from(hashBuffer).toString("base64url");
+
+	return { verifier, challenge };
+}