@pentoshi/clai 4.11.24 → 4.11.25

package/dist/ui-core/commands/key-commands.js

@@ -5,10 +5,11 @@ import { appendSearchProviderKey, getProviderKeys, getSearchProviderKeys, listPr
 import { searchProviderIds } from "../../tools/web/types.js";
 import { formatKeyStatus } from "../rendering/format-keys.js";
 import { notice, openEndpointsEditor, openSearchKeysEditor, resolveEditorRowsDetailed } from "./keys/editors.js";
-import { pollClineDeviceAuth, startClineDeviceAuth, } from "../../llm/cline-auth.js";
+import { maybeRefreshClineToken, pollClineDeviceAuth, startClineDeviceAuth, } from "../../llm/cline-auth.js";
 import { codexKeyFromAccessToken, encodeCodexKey, pollCodexDeviceAuth, startCodexBrowserAuth, startCodexDeviceAuth, } from "../../llm/codex-auth.js";
 import { openSystemBrowser } from "../../mcp/auth/loopback.js";
 import { pollCopilotDeviceAuth, startCopilotDeviceAuth, } from "../../llm/copilot-auth.js";
+import { encodeKiroKey, decodeKiroKey, isKiroOAuthToken, maybeRefreshKiroCredential, pollKiroDeviceAuth, startKiroDeviceAuth, startKiroSocialAuth, exchangeKiroSocialCode, importExistingKiroAuth, refreshKiroToken, listenForKiroSocialCallback, createKiroCliAuthorizationFlow, exchangeKiroPortalCode, listenForKiroCliCallback, parseKiroCliCallback, isHeadlessEnvironment, KIRO_KEY_PREFIX, } from "../../llm/kiro-auth.js";
 import { appendProviderKey, replaceProviderKey } from "../../store/keys.js";
 import { MAX_PROVIDER_KEYS } from "../../llm/key-rotation.js";
 const SEARCH_IDS = new Set(["brave", "tavily", "duckduckgo", "exa"]);
@@ -331,6 +332,7 @@ export async function runClineAuthForUI(services) {
         notice(services, "warn", `could not start Cline sign-in: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
+    void openSystemBrowser(start.verificationUrl).catch(() => { });
     services.overlay.openPager("Cline sign-in", [
         "Authenticate Cline on any device:",
         "",
@@ -341,20 +343,33 @@ export async function runClineAuthForUI(services) {
         "Approve in your browser — clai will continue automatically.",
         "(close this and press Ctrl-C to cancel)",
     ].join("\n"), undefined, undefined, "plain");
+    const abortController = new AbortController();
+    const unsubscribe = services.overlay.subscribe(() => {
+        if (!services.overlay.isOpen())
+            abortController.abort();
+    });
     const waiting = services.toast.info("waiting for Cline approval…", {
         sticky: true,
     });
     try {
-        const tokens = await pollClineDeviceAuth(start);
-        services.toast.dismiss(waiting);
+        const tokens = await pollClineDeviceAuth(start, {
+            signal: abortController.signal,
+        });
         notice(services, "info", "Cline authenticated");
         return tokens;
     }
     catch (error) {
-        services.toast.dismiss(waiting);
+        if (abortController.signal.aborted) {
+            notice(services, "info", "cancelled");
+            return undefined;
+        }
         notice(services, "warn", `Cline sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
+    finally {
+        unsubscribe();
+        services.toast.dismiss(waiting);
+    }
 }
 async function clineAddAccount(services) {
     const tokens = await runClineAuthForUI(services);
@@ -436,21 +451,40 @@ export async function runCodexAuthForUI(services) {
         "clai will continue automatically once authorization completes.",
         "(close this and press Ctrl-C to cancel)",
     ].join("\n"), undefined, undefined, "plain");
+    const abortController = new AbortController();
+    const unsubscribe = services.overlay.subscribe(() => {
+        if (!services.overlay.isOpen())
+            abortController.abort();
+    });
     const waiting = services.toast.info("waiting for ChatGPT approval…", {
         sticky: true,
     });
     try {
         await openSystemBrowser(handle.url).catch(() => { });
-        const credential = await handle.waitForCredential();
-        services.toast.dismiss(waiting);
+        const credential = await Promise.race([
+            handle.waitForCredential(),
+            new Promise((_, reject) => {
+                if (abortController.signal.aborted)
+                    reject(new Error("ChatGPT authentication cancelled"));
+                abortController.signal.addEventListener("abort", () => reject(new Error("ChatGPT authentication cancelled")));
+            }),
+        ]);
         notice(services, "info", "ChatGPT Subscription authenticated");
         return credential;
     }
     catch (error) {
-        services.toast.dismiss(waiting);
+        if (abortController.signal.aborted) {
+            notice(services, "info", "cancelled");
+            return undefined;
+        }
         notice(services, "warn", `ChatGPT Subscription sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
+    finally {
+        unsubscribe();
+        services.toast.dismiss(waiting);
+        handle.close();
+    }
 }
 export async function runCodexDeviceAuthForUI(services) {
     let start;
@@ -461,6 +495,7 @@ export async function runCodexDeviceAuthForUI(services) {
         notice(services, "warn", `could not start ChatGPT Subscription sign-in: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
+    void openSystemBrowser(start.verificationUrl).catch(() => { });
     services.overlay.openPager("ChatGPT Subscription sign-in", [
         "Authenticate ChatGPT Subscription on any device:",
         "",
@@ -471,20 +506,33 @@ export async function runCodexDeviceAuthForUI(services) {
         "Approve in your browser — clai will continue automatically.",
         "(close this and press Ctrl-C to cancel)",
     ].join("\n"), undefined, undefined, "plain");
+    const abortController = new AbortController();
+    const unsubscribe = services.overlay.subscribe(() => {
+        if (!services.overlay.isOpen())
+            abortController.abort();
+    });
     const waiting = services.toast.info("waiting for ChatGPT approval…", {
         sticky: true,
     });
     try {
-        const credential = await pollCodexDeviceAuth(start);
-        services.toast.dismiss(waiting);
+        const credential = await pollCodexDeviceAuth(start, {
+            signal: abortController.signal,
+        });
         notice(services, "info", "ChatGPT Subscription authenticated");
         return credential;
     }
     catch (error) {
-        services.toast.dismiss(waiting);
+        if (abortController.signal.aborted) {
+            notice(services, "info", "cancelled");
+            return undefined;
+        }
         notice(services, "warn", `ChatGPT Subscription sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
+    finally {
+        unsubscribe();
+        services.toast.dismiss(waiting);
+    }
 }
 export async function runCopilotAuthForUI(services) {
     let start;
@@ -505,20 +553,33 @@ export async function runCopilotAuthForUI(services) {
         "Approve in your browser — clai will continue automatically.",
         "(close this and press Ctrl-C to cancel)",
     ].join("\n"), undefined, undefined, "plain");
+    const abortController = new AbortController();
+    const unsubscribe = services.overlay.subscribe(() => {
+        if (!services.overlay.isOpen())
+            abortController.abort();
+    });
     const waiting = services.toast.info("waiting for Github Copilot approval…", {
         sticky: true,
     });
     try {
-        const token = await pollCopilotDeviceAuth(start);
-        services.toast.dismiss(waiting);
+        const token = await pollCopilotDeviceAuth(start, {
+            signal: abortController.signal,
+        });
         notice(services, "info", "Github Copilot authenticated");
         return token;
     }
     catch (error) {
-        services.toast.dismiss(waiting);
+        if (abortController.signal.aborted) {
+            notice(services, "info", "cancelled");
+            return undefined;
+        }
         notice(services, "warn", `Github Copilot sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
+    finally {
+        unsubscribe();
+        services.toast.dismiss(waiting);
+    }
 }
 async function loadClineKeys() {
     const multi = await getProviderKeys("cline");
@@ -539,13 +600,27 @@ async function storeClineAccount(services, tokens) {
     }
     notice(services, "info", `added Cline account ${maskSecret(tokens.accessToken)}`);
 }
-async function refreshClineAccount(services, oldValue) {
+async function refreshClineAccount(services, slot) {
+    if (slot.refreshToken) {
+        notice(services, "info", "refreshing Cline account…");
+        const fresh = await maybeRefreshClineToken(slot.value, slot.refreshToken);
+        if (fresh?.accessToken) {
+            const replaced = await replaceProviderKey("cline", slot.value, fresh.accessToken, {
+                ...(fresh.refreshToken ? { refreshToken: fresh.refreshToken } : {}),
+                ...(fresh.expiresAt !== undefined ? { expiresAt: fresh.expiresAt } : {}),
+            });
+            if (replaced) {
+                notice(services, "info", `refreshed Cline account ${maskSecret(fresh.accessToken)}`);
+                return;
+            }
+        }
+    }
     const tokens = await runClineAuthForUI(services);
     if (!tokens) {
         notice(services, "info", "cancelled");
         return;
     }
-    const replaced = await replaceProviderKey("cline", oldValue, tokens.accessToken, {
+    const replaced = await replaceProviderKey("cline", slot.value, tokens.accessToken, {
         ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
         ...(tokens.expiresAt !== undefined ? { expiresAt: tokens.expiresAt } : {}),
     });
@@ -607,6 +682,7 @@ async function openClineKeysFlow(services) {
             return;
         }
         if (answer.action === "pick") {
+            await savePickerDraft("cline", answer, keys, activeIndex);
             const tokens = await clineAddAccount(services);
             if (tokens)
                 await storeClineAccount(services, tokens);
@@ -616,7 +692,7 @@ async function openClineKeysFlow(services) {
         if (answer.action === "refresh") {
             const selected = keys.find((key) => key.id === answer.slotId);
             if (selected) {
-                await refreshClineAccount(services, selected.value);
+                await refreshClineAccount(services, selected);
             }
             else {
                 notice(services, "warn", "Cline account was not found");
@@ -635,6 +711,18 @@ async function loadOAuthKeys(provider) {
         activeIndex: multi.source === "env" ? 0 : multi.activeIndex,
     };
 }
+async function savePickerDraft(provider, answer, keys, activeIndex) {
+    const byId = new Map(keys.map((key) => [key.id, key.value]));
+    const detailed = answer.rows.flatMap((row) => {
+        if (row.slotId) {
+            const value = byId.get(row.slotId);
+            return value ? [{ value, disabled: row.disabled === true }] : [];
+        }
+        const value = row.value.trim();
+        return value ? [{ value, disabled: row.disabled === true }] : [];
+    });
+    await setProviderKeys(provider, detailed.map((row) => row.value), answer.activeIndex ?? activeIndex, detailed.filter((row) => row.disabled).map((row) => row.value));
+}
 async function saveOAuthKeys(services, provider, answer, keys, activeIndex) {
     const label = getProvider(provider).displayName;
     const byId = new Map(keys.map((key) => [key.id, key.value]));
@@ -688,6 +776,7 @@ async function openCodexKeysFlow(services) {
             return;
         }
         if (answer.action === "pick") {
+            await savePickerDraft("codex", answer, keys, activeIndex);
             const credential = await runCodexAuthForUI(services);
             const manualKey = credential?.manualKey;
             if (credential) {
@@ -757,6 +846,7 @@ async function openCopilotKeysFlow(services) {
             return;
         }
         if (answer.action === "pick") {
+            await savePickerDraft("copilot", answer, keys, activeIndex);
             const token = await runCopilotAuthForUI(services);
             if (token) {
                 await appendProviderKey("copilot", token);
@@ -795,6 +885,334 @@ async function openCopilotKeysFlow(services) {
         return;
     }
 }
+function pickKiroAuthMethod(services) {
+    return new Promise((resolve) => {
+        const opened = services.overlay.openPicker({
+            title: "Kiro AI sign-in method",
+            options: [
+                {
+                    value: "kiro-cli",
+                    label: "Sign in with Kiro (recommended)",
+                    description: "Google, GitHub, or Builder ID — browser sign-in",
+                },
+                {
+                    value: "builder-id",
+                    label: "Sign in with AWS Builder ID",
+                    description: "device code — works on any device or terminal",
+                },
+                {
+                    value: "idc",
+                    label: "Sign in with AWS IAM Identity Center (IDC)",
+                    description: "enterprise SSO start URL",
+                },
+                {
+                    value: "import",
+                    label: "Import existing Kiro CLI / Desktop sign-in",
+                    description: "reads local Kiro or AWS SSO credentials",
+                },
+                {
+                    value: "apikey",
+                    label: "Manually enter API key / token",
+                    description: "paste an API key or token",
+                },
+            ],
+        }, (value) => {
+            services.overlay.close();
+            resolve(value);
+        });
+        if (!opened)
+            resolve(undefined);
+    });
+}
+export async function runKiroDeviceAuthForUI(services, options = {}) {
+    let start;
+    try {
+        start = await startKiroDeviceAuth(options);
+    }
+    catch (error) {
+        notice(services, "warn", `could not start Kiro sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    const completeUrl = start.verificationUriComplete || start.verificationUri;
+    void openSystemBrowser(completeUrl).catch(() => { });
+    services.overlay.openPager("Kiro AI sign-in", [
+        "Authenticate Kiro AI on any device:",
+        "",
+        `  ${completeUrl}`,
+        "",
+        `  Code: ${start.userCode}`,
+        "",
+        "Approve in your browser — clai will continue automatically.",
+        "(close this and press Ctrl-C to cancel)",
+    ].join("\n"), undefined, undefined, "plain");
+    const abortController = new AbortController();
+    const unsubscribe = services.overlay.subscribe(() => {
+        if (!services.overlay.isOpen())
+            abortController.abort();
+    });
+    const waiting = services.toast.info("waiting for Kiro approval…", {
+        sticky: true,
+    });
+    try {
+        const credential = await pollKiroDeviceAuth(start, {
+            signal: abortController.signal,
+        });
+        notice(services, "info", "Kiro AI authenticated");
+        return credential;
+    }
+    catch (error) {
+        if (abortController.signal.aborted) {
+            notice(services, "info", "cancelled");
+            return undefined;
+        }
+        notice(services, "warn", `Kiro AI sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    finally {
+        unsubscribe();
+        services.toast.dismiss(waiting);
+    }
+}
+export async function runKiroPortalAuthForUI(services) {
+    if (isHeadlessEnvironment()) {
+        return runKiroDeviceAuthForUI(services, { authMethod: "builder-id" });
+    }
+    const { authorizeUrl, codeVerifier, state } = createKiroCliAuthorizationFlow();
+    let server;
+    try {
+        server = listenForKiroCliCallback({ expectedState: state });
+    }
+    catch {
+        server = undefined;
+    }
+    if (server) {
+        server.promise
+            .then((cb) => services.overlay.answerSecret(`${cb.path}?code=${cb.code}&login_option=${cb.loginOption}${cb.state ? `&state=${cb.state}` : ""}`))
+            .catch(() => { });
+    }
+    await openSystemBrowser(authorizeUrl).catch(() => { });
+    const waiting = services.toast.info("waiting for Kiro sign-in…", {
+        sticky: true,
+    });
+    const prompt = "Sign in with Google, GitHub, or Builder ID in your browser.\nclai will continue automatically — or paste the redirect URL / code below:";
+    try {
+        const pasted = await services.overlay.openSecret({
+            title: "Kiro AI sign-in",
+            prompt,
+            reveal: true,
+        });
+        if (!pasted?.trim())
+            return undefined;
+        const cb = parseKiroCliCallback(pasted.trim());
+        const cred = await exchangeKiroPortalCode(cb, codeVerifier);
+        notice(services, "info", "Kiro AI authenticated");
+        return cred;
+    }
+    catch (err) {
+        notice(services, "warn", `Kiro sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+    finally {
+        services.toast.dismiss(waiting);
+        server?.close();
+    }
+}
+export async function runKiroSocialAuthForUI(services, provider) {
+    const { url, codeVerifier } = await startKiroSocialAuth(provider);
+    const label = provider === "google" ? "Google" : "GitHub";
+    let callbackHandle;
+    try {
+        callbackHandle = await listenForKiroSocialCallback({
+            onCode: (urlOrCode) => {
+                services.overlay.answerSecret(urlOrCode);
+            },
+        });
+    }
+    catch { }
+    await openSystemBrowser(url).catch(() => { });
+    const waiting = services.toast.info(`waiting for Kiro (${label}) sign-in…`, {
+        sticky: true,
+    });
+    try {
+        const pasted = await services.overlay.openSecret({
+            title: `Kiro AI (${label}) sign-in`,
+            prompt: `Sign in with ${label} in your browser.\nWhen prompted "Open Kiro", click Open (or paste the redirect URL / code below):`,
+            reveal: true,
+        });
+        if (!pasted?.trim())
+            return undefined;
+        const cred = await exchangeKiroSocialCode(pasted.trim(), codeVerifier, provider);
+        notice(services, "info", `Kiro AI (${label}) authenticated`);
+        return cred;
+    }
+    catch (err) {
+        notice(services, "warn", `Kiro sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+    finally {
+        services.toast.dismiss(waiting);
+        callbackHandle?.close();
+    }
+}
+export async function runKiroAuthForUI(services) {
+    const method = await pickKiroAuthMethod(services);
+    if (!method)
+        return undefined;
+    if (method === "kiro-cli") {
+        return runKiroPortalAuthForUI(services);
+    }
+    if (method === "builder-id") {
+        return runKiroDeviceAuthForUI(services, { authMethod: "builder-id" });
+    }
+    if (method === "idc") {
+        const startUrl = await services.overlay.openSecret({
+            title: "AWS IAM Identity Center Start URL",
+            prompt: "Enter AWS IDC Start URL (e.g. https://my-org.awsapps.com/start):",
+            reveal: true,
+        });
+        if (!startUrl?.trim())
+            return undefined;
+        const region = await services.overlay.openSecret({
+            title: "AWS Region",
+            prompt: "Enter AWS Region (default: us-east-1):",
+            reveal: true,
+        });
+        return runKiroDeviceAuthForUI(services, {
+            authMethod: "idc",
+            startUrl: startUrl.trim(),
+            region: region?.trim() || "us-east-1",
+        });
+    }
+    if (method === "import") {
+        const imported = await importExistingKiroAuth();
+        if (!imported) {
+            notice(services, "warn", "no existing Kiro credential found to import");
+            return undefined;
+        }
+        notice(services, "info", "imported existing Kiro credentials");
+        return imported;
+    }
+    if (method === "apikey") {
+        const answer = await services.overlay.openSecret({
+            title: "Kiro API Key or Token",
+            prompt: "Paste Kiro API key, access token, or refresh token:",
+        });
+        const raw = answer?.trim();
+        if (!raw)
+            return undefined;
+        if (raw.startsWith(KIRO_KEY_PREFIX)) {
+            const decoded = decodeKiroKey(raw);
+            if (decoded)
+                return decoded;
+        }
+        if (raw.startsWith("aorAAAAAG")) {
+            try {
+                return await refreshKiroToken(raw);
+            }
+            catch (err) {
+                notice(services, "warn", `failed to validate refresh token: ${err instanceof Error ? err.message : String(err)}`);
+                return undefined;
+            }
+        }
+        return {
+            accessToken: raw,
+            apiKey: raw,
+            authMethod: "api_key",
+            region: "us-east-1",
+        };
+    }
+    return undefined;
+}
+async function openKiroKeysFlow(services) {
+    let { keys, activeIndex } = await loadOAuthKeys("kiro");
+    for (;;) {
+        services.overlay.close();
+        const answer = await services.overlay.openKeysEditor({
+            provider: "kiro",
+            heading: "KIRO AI ACCOUNTS",
+            itemLabel: "account",
+            addViaPicker: true,
+            refreshable: true,
+            initialKeys: keys.map((key) => ({
+                id: key.id,
+                masked: maskSecret(key.value),
+                disabled: key.disabled === true,
+            })),
+            activeIndex,
+        });
+        if (!answer) {
+            notice(services, "info", "cancelled");
+            return;
+        }
+        if (answer.action === "reset") {
+            await unsetProviderSecret("kiro");
+            notice(services, "info", "unset all keys for Kiro AI");
+            return;
+        }
+        if (answer.action === "pick") {
+            await savePickerDraft("kiro", answer, keys, activeIndex);
+            const credential = await runKiroAuthForUI(services);
+            if (credential) {
+                const key = encodeKiroKey(credential);
+                await appendProviderKey("kiro", key, {
+                    ...(credential.refreshToken ? { refreshToken: credential.refreshToken } : {}),
+                    ...(credential.expiresAt !== undefined ? { expiresAt: credential.expiresAt } : {}),
+                });
+                notice(services, "info", `added Kiro account ${maskSecret(key)}`);
+            }
+            else {
+                notice(services, "info", "cancelled");
+            }
+            ({ keys, activeIndex } = await loadOAuthKeys("kiro"));
+            continue;
+        }
+        if (answer.action === "refresh") {
+            const selected = keys.find((key) => key.id === answer.slotId);
+            if (selected) {
+                if (selected.refreshToken || isKiroOAuthToken(selected.value)) {
+                    notice(services, "info", "refreshing Kiro account…");
+                    const refreshedKey = await maybeRefreshKiroCredential(selected.value, selected.refreshToken);
+                    if (refreshedKey) {
+                        const decoded = decodeKiroKey(refreshedKey);
+                        const replaced = await replaceProviderKey("kiro", selected.value, refreshedKey, {
+                            ...(decoded?.refreshToken ? { refreshToken: decoded.refreshToken } : {}),
+                            ...(decoded?.expiresAt !== undefined ? { expiresAt: decoded.expiresAt } : {}),
+                        });
+                        if (replaced) {
+                            notice(services, "info", `refreshed Kiro account ${maskSecret(refreshedKey)}`);
+                            ({ keys, activeIndex } = await loadOAuthKeys("kiro"));
+                            continue;
+                        }
+                    }
+                }
+                const credential = await runKiroAuthForUI(services);
+                if (credential) {
+                    const key = encodeKiroKey(credential);
+                    const replaced = await replaceProviderKey("kiro", selected.value, key, {
+                        ...(credential.refreshToken ? { refreshToken: credential.refreshToken } : {}),
+                        ...(credential.expiresAt !== undefined ? { expiresAt: credential.expiresAt } : {}),
+                    });
+                    if (!replaced) {
+                        notice(services, "warn", "Kiro account was not found");
+                    }
+                    else {
+                        notice(services, "info", `refreshed Kiro account ${maskSecret(key)}`);
+                    }
+                }
+                else {
+                    notice(services, "info", "cancelled");
+                }
+            }
+            else {
+                notice(services, "warn", "Kiro account was not found");
+            }
+            ({ keys, activeIndex } = await loadOAuthKeys("kiro"));
+            continue;
+        }
+        await saveOAuthKeys(services, "kiro", answer, keys, activeIndex);
+        return;
+    }
+}
 export async function openLlmKeysEditor(services, id) {
     if (id === "ollama") {
         const host = await services.overlay.openSecret({
@@ -822,6 +1240,10 @@ export async function openLlmKeysEditor(services, id) {
         await openCopilotKeysFlow(services);
         return;
     }
+    if (id === "kiro") {
+        await openKiroKeysFlow(services);
+        return;
+    }
     if (providerUsesEndpoints(id)) {
         await openEndpointsEditor(services, id);
     }