@michael-joseph-miller/ant-bot 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to ant-bot are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
 [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] — 2026-08-24
+
+### Fixed
+
+- **Sign-in accepts a client secret.** Google's "Web application" OAuth clients authenticate at
+  the token endpoint, so a client ID alone got as far as the consent screen and then failed with
+  the provider's own `client_secret is missing`. Both the CLI (`--client-secret`) and the
+  Connectors screen now take one, and ant-bot explains what is needed rather than passing that
+  message through unhelpfully.
+- **Client credentials are remembered.** They are registered once with a provider and outlive any
+  token, so they are stored in the keychain under their own key — a second sign-in, after an
+  expiry or a failed exchange, needs no flags.
+
 ## [0.3.0] — 2026-08-24
 
 ### Added

package/README.md

@@ -280,10 +280,10 @@ Current totals, as run against this checkout:
 | Package | Test files | Tests |
 |---|---|---|
 | `@antbot/contract` | 1 | 34 |
-| `@antbot/daemon` | 25 | 573 |
-| `@antbot/ui` | 9 | 90 |
+| `@antbot/daemon` | 25 | 575 |
+| `@antbot/ui` | 9 | 92 |
 | `@antbot/cli` | 8 | 140 |
-| **Total** | **43** | **837** |
+| **Total** | **43** | **841** |
 
 ## Status / not built
 

package/dist/server.js

@@ -2306,6 +2306,7 @@ async function refreshTokens(tokens, now2 = Date.now()) {
 // daemon/src/connectors/auth.ts
 var log7 = logger("connector-auth");
 var tokenSecretName = (connectorName) => `antbot:oauth:${connectorName}`;
+var clientSecretName = (connectorName) => `antbot:oauth-client:${connectorName}`;
 var redirectUri = (port) => `http://127.0.0.1:${port}/api/connectors/oauth/callback`;
 var LOGIN_TTL_MS = 10 * 60 * 1e3;
 var ConnectorAuthService = class {
@@ -2337,6 +2338,20 @@ var ConnectorAuthService = class {
   async signOut(connectorName) {
     await this.secrets.remove(tokenSecretName(connectorName));
   }
+  /** Forget the tokens *and* the registered client. Used when the credentials themselves are wrong. */
+  async forgetClient(connectorName) {
+    await this.secrets.remove(clientSecretName(connectorName));
+  }
+  async readClient(connectorName) {
+    const key = clientSecretName(connectorName);
+    const found = (await this.secrets.resolve([key])).get(key);
+    if (!found) return null;
+    try {
+      return JSON.parse(found);
+    } catch {
+      return null;
+    }
+  }
   /**
    * Begin a sign-in. Returns the URL the human must open.
    *
@@ -2350,8 +2365,9 @@ var ConnectorAuthService = class {
     }
     const discovery = await discoverAuth(connector.config.url);
     const redirect = redirectUri(this.port);
-    let clientId = opts.clientId;
-    let clientSecret = opts.clientSecret;
+    const remembered = await this.readClient(connector.name);
+    let clientId = opts.clientId ?? remembered?.clientId;
+    let clientSecret = opts.clientSecret ?? (opts.clientId ? void 0 : remembered?.clientSecret);
     if (!clientId && discovery.authServer.registrationEndpoint) {
       const registered = await registerClient(discovery.authServer.registrationEndpoint, redirect);
       clientId = registered?.clientId;
@@ -2362,6 +2378,9 @@ var ConnectorAuthService = class {
         `${new URL(discovery.authServer.authorizationEndpoint).host} does not support automatic app registration, so it needs a client ID you create yourself. Register one with that provider, add "${redirect}" as an authorised redirect URI, and pass the client ID with --client-id.`
       );
     }
+    if (opts.clientId || opts.clientSecret || !remembered) {
+      await this.secrets.set(clientSecretName(connector.name), JSON.stringify({ clientId, clientSecret }));
+    }
     const pkce = createPkce();
     const state = crypto2.randomBytes(16).toString("base64url");
     this.pending.set(state, {
@@ -2394,15 +2413,26 @@ var ConnectorAuthService = class {
     const p = this.pending.get(state);
     if (!p) throw new OAuthError("This sign-in link is no longer valid. Start the sign-in again.");
     this.pending.delete(state);
-    const tokens = await exchangeCode({
-      tokenEndpoint: p.tokenEndpoint,
-      code,
-      verifier: p.verifier,
-      clientId: p.clientId,
-      clientSecret: p.clientSecret,
-      redirectUri: p.redirectUri,
-      resource: p.resource
-    });
+    let tokens;
+    try {
+      tokens = await exchangeCode({
+        tokenEndpoint: p.tokenEndpoint,
+        code,
+        verifier: p.verifier,
+        clientId: p.clientId,
+        clientSecret: p.clientSecret,
+        redirectUri: p.redirectUri,
+        resource: p.resource
+      });
+    } catch (err) {
+      const message = err.message;
+      if (/client_secret/i.test(message)) {
+        throw new OAuthError(
+          `This provider requires a client secret as well as a client ID. Add the secret from the same OAuth client (in Google's console: the client's "Client secret") and sign in again.`
+        );
+      }
+      throw err;
+    }
     await this.write(p.connectorName, tokens);
     log7.info(`connector "${p.connectorName}" signed in`);
     return { connectorId: p.connectorId, connectorName: p.connectorName };