@providerkit/core 0.24.0 → 0.25.1

package/src/auth/flows.ts

@@ -40,7 +40,14 @@ export interface AuthFlow {
 }
 
 export type AuthFlowId =
-  "chatgpt" | "kimi-plan" | "grok" | "github-copilot" | "meta" | "openrouter";
+  | "chatgpt"
+  | "kimi-plan"
+  | "grok"
+  | "github-copilot"
+  | "meta"
+  | "openrouter"
+  | "opencode-zen"
+  | "antigravity";
 
 export function createAuthFlow(id: AuthFlowId, host: AuthHost): AuthFlow {
   switch (id) {
@@ -66,6 +73,10 @@ export function createAuthFlow(id: AuthFlowId, host: AuthHost): AuthFlow {
       );
     case "openrouter":
       return openrouterFlow(host);
+    case "opencode-zen":
+      return deviceFlow(host, OPENCODE_ZEN_DEVICE, opencodeZenCredential, opencodeZenRefresh(host));
+    case "antigravity":
+      return antigravityFlow(host);
   }
 }
 
@@ -518,6 +529,282 @@ function openrouterFlow(host: AuthHost): AuthFlow {
   };
 }
 
+// ── OpenCode Console (Zen / Go): device code ──────────────────────────────
+// Matches `opencode auth login opencode` in OpenCode v2 (`packages/core/src/plugin/provider/opencode.ts`)
+// and `cc-proxy auth login opencode-zen --device`. The Console returns a relative
+// `verification_uri_complete` (`/console/device?user_code=…&client_id=opencode-cli`),
+// which `requestDeviceCode` resolves against `deviceUrl`.
+
+const OPENCODE_ZEN_DEVICE: DeviceEndpoint = {
+  clientId: "opencode-cli",
+  deviceUrl: "https://opencode.ai/console/auth/device/code",
+  tokenUrl: "https://opencode.ai/console/auth/device/token",
+  extra: { supports_org_scope: true },
+  encode: "json",
+};
+
+function opencodeZenCredential(
+  body: Record<string, unknown>,
+  fallbackRefresh?: string,
+): Credential {
+  const accessToken = str(body.access_token);
+  if (!accessToken) {
+    throw authError("token_incomplete", "OpenCode Console's reply has no access token.");
+  }
+  const refreshToken = str(body.refresh_token) ?? fallbackRefresh ?? "";
+  const expiresIn = num(body.expires_in);
+  const expiresAt =
+    refreshToken && expiresIn !== undefined
+      ? Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS
+      : NEVER;
+  const account = str(body.org_id) ?? accountFromToken(accessToken, "email", "sub");
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt,
+    ...(account ? { account } : {}),
+  };
+}
+
+function opencodeZenRefresh(host: AuthHost): AuthFlow["refresh"] {
+  return async (credential) => {
+    if (!credential.refreshToken) return credential;
+    const body = await postToken(
+      host,
+      OPENCODE_ZEN_DEVICE.tokenUrl,
+      {
+        client_id: OPENCODE_ZEN_DEVICE.clientId,
+        grant_type: "refresh_token",
+        refresh_token: credential.refreshToken,
+      },
+      { encode: "json" },
+    );
+    const fresh = opencodeZenCredential(body, credential.refreshToken);
+    return credential.account && !fresh.account ? { ...fresh, account: credential.account } : fresh;
+  };
+}
+
+// ── Google Antigravity (Cloud Code Assist): PKCE + project discovery ──────
+// Mirrors `cc-proxy/src/providers/antigravity.rs` and `opencodex/src/oauth/google-antigravity.ts`.
+// Signs in with Google OAuth PKCE using the public Antigravity desktop client,
+// then discovers the Cloud Code Assist `projectId` via `loadCodeAssist` (with
+// `onboardUser` fallback for accounts without a project yet).
+
+const ANTIGRAVITY = {
+  clientId: [
+    "1071006060591-",
+    "tmhssin2h21lcre235vtolojh4g403ep",
+    ".apps.google",
+    "usercontent.com",
+  ].join(""),
+  clientSecret: ["GOCS", "PX-", "K58FWR486LdL", "J1mLB8sXC4z6qDAf"].join(""),
+  authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  redirectUri: "http://127.0.0.1:51121/callback",
+  prodApi: "https://cloudcode-pa.googleapis.com",
+  dailyApi: "https://daily-cloudcode-pa.googleapis.com",
+  apiVersion: "v1internal",
+  ideUserAgent:
+    "antigravity/ide/2.5.5 (os_type=windows; arch=amd64; aidev_client; auth_method=oauth)",
+  scopes: [
+    "https://www.googleapis.com/auth/cloud-platform",
+    "https://www.googleapis.com/auth/userinfo.email",
+    "https://www.googleapis.com/auth/userinfo.profile",
+    "https://www.googleapis.com/auth/cclog",
+    "https://www.googleapis.com/auth/experimentsandconfigs",
+  ].join(" "),
+  onboardAttempts: 5,
+  onboardPollMs: 2_000,
+} as const;
+
+/** The authorize URL to open for Google Antigravity. Exported so tests can pin the exact params. */
+export function antigravityAuthorizeUrl(challenge: string, state: string): string {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: ANTIGRAVITY.clientId,
+    redirect_uri: ANTIGRAVITY.redirectUri,
+    scope: ANTIGRAVITY.scopes,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    access_type: "offline",
+    prompt: "consent",
+    state,
+  });
+  return `${ANTIGRAVITY.authorizeUrl}?${params.toString()}`;
+}
+
+function extractAntigravityProjectId(data: Record<string, unknown>): string | undefined {
+  for (const key of ["cloudaicompanionProject", "projectId", "project"]) {
+    const val = data[key];
+    const direct = str(val);
+    if (direct) return direct;
+    const nested = str(asRecord(val).id);
+    if (nested) return nested;
+  }
+  return undefined;
+}
+
+/** Discover the Cloud Code Assist project for an Antigravity access token. */
+export async function discoverAntigravityProject(
+  host: AuthHost,
+  accessToken: string,
+  signal?: AbortSignal,
+): Promise<string | undefined> {
+  const headers = {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: "application/json",
+    "Content-Type": "application/json",
+    "User-Agent": ANTIGRAVITY.ideUserAgent,
+  };
+  try {
+    const loadRes = await authFetch(
+      host,
+      `${ANTIGRAVITY.prodApi}/${ANTIGRAVITY.apiVersion}:loadCodeAssist`,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
+        ...(signal ? { signal } : {}),
+      },
+    );
+    if (loadRes.ok) {
+      const payload = asRecord(parseJson(await loadRes.text().catch(() => "")));
+      const found = extractAntigravityProjectId(payload);
+      if (found) return found;
+    }
+  } catch (err) {
+    if (signal?.aborted) throw err;
+  }
+
+  for (let attempt = 0; attempt < ANTIGRAVITY.onboardAttempts; attempt++) {
+    if (signal?.aborted) throw signal.reason ?? new Error("Aborted");
+    try {
+      const onboardRes = await authFetch(
+        host,
+        `${ANTIGRAVITY.dailyApi}/${ANTIGRAVITY.apiVersion}:onboardUser`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            tier_id: "free-tier",
+            metadata: {
+              ide_type: "ANTIGRAVITY",
+              ide_name: "antigravity",
+              ide_version: "2.5.5",
+            },
+          }),
+          ...(signal ? { signal } : {}),
+        },
+      );
+      if (onboardRes.ok) {
+        const payload = asRecord(parseJson(await onboardRes.text().catch(() => "")));
+        if (payload.done === true) {
+          const found = extractAntigravityProjectId(asRecord(payload.response));
+          if (found) return found;
+        }
+      } else if (onboardRes.status !== 429 && onboardRes.status < 500) {
+        return undefined;
+      }
+    } catch (err) {
+      if (signal?.aborted) throw err;
+    }
+    if (attempt + 1 < ANTIGRAVITY.onboardAttempts) {
+      await waitMs(ANTIGRAVITY.onboardPollMs, signal);
+    }
+  }
+  return undefined;
+}
+
+function waitMs(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason ?? new Error("Aborted"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason ?? new Error("Aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+function antigravityFlow(host: AuthHost): AuthFlow {
+  const tokenRequest = (params: Record<string, string>) =>
+    postToken(
+      host,
+      ANTIGRAVITY.tokenUrl,
+      {
+        client_id: ANTIGRAVITY.clientId,
+        client_secret: ANTIGRAVITY.clientSecret,
+        ...params,
+      },
+      { encode: "form" },
+    );
+
+  return {
+    async signIn(signal, onPrompt) {
+      const { verifier, challenge } = await generatePKCE();
+      const state = randomState();
+      const authorizeUrl = antigravityAuthorizeUrl(challenge, state);
+      onPrompt({ url: authorizeUrl });
+      const code = await host.captureRedirect({
+        authorizeUrl,
+        redirectUri: ANTIGRAVITY.redirectUri,
+        state,
+        signal,
+      });
+      const body = await tokenRequest({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: ANTIGRAVITY.redirectUri,
+        code_verifier: verifier,
+      });
+      const credential = antigravityCredential(body);
+      const projectId = await discoverAntigravityProject(host, credential.accessToken, signal);
+      if (!projectId) {
+        throw authError(
+          "setup_required",
+          "Antigravity login could not discover a Cloud Code Assist project for this Google account.",
+        );
+      }
+      return { ...credential, projectId };
+    },
+    async refresh(credential) {
+      const body = await tokenRequest({
+        grant_type: "refresh_token",
+        refresh_token: credential.refreshToken,
+      });
+      const fresh = antigravityCredential(body, credential.refreshToken, credential.account);
+      const projectId =
+        credential.projectId ??
+        (await discoverAntigravityProject(host, fresh.accessToken).catch(() => undefined));
+      return projectId ? { ...fresh, projectId } : fresh;
+    },
+  };
+}
+
+function antigravityCredential(
+  body: Record<string, unknown>,
+  fallbackRefresh?: string,
+  fallbackAccount?: string,
+): Credential {
+  const credential = toCredential(
+    { ...body, expires_in: num(body.expires_in) ?? GROK_DEFAULT_LIFETIME_SEC },
+    fallbackRefresh,
+  );
+  const idToken = str(body.id_token);
+  const account =
+    accountFromToken(idToken, "email") ??
+    accountFromToken(credential.accessToken, "email") ??
+    fallbackAccount;
+  return account ? { ...credential, account } : credential;
+}
+
 function parseJson(text: string): unknown {
   try {
     return JSON.parse(text);

package/src/auth/oauth.ts

@@ -42,6 +42,8 @@ export interface Credential {
   account?: string;
   /** ChatGPT only: send it as the `ChatGPT-Account-Id` header. */
   chatgptAccountId?: string;
+  /** Google Antigravity only: the Cloud Code Assist project id for the envelope. */
+  projectId?: string;
   /** Set when the vendor gives each account its own host (Copilot). */
   baseUrl?: string;
 }
@@ -137,17 +139,19 @@ function toBase64Url(bytes: Uint8Array): string {
 export async function postToken(
   host: AuthHost,
   url: string,
-  params: Record<string, string>,
+  params: Record<string, string | boolean>,
   opts: { encode: "json" | "form"; allowErrorBody?: boolean },
 ): Promise<Record<string, unknown>> {
   const json = opts.encode === "json";
+  const formEntries = () =>
+    Object.entries(params).map(([k, v]): [string, string] => [k, String(v)]);
   const res = await authFetch(host, url, {
     method: "POST",
     headers: {
       "Content-Type": json ? "application/json" : "application/x-www-form-urlencoded",
       Accept: "application/json",
     },
-    body: json ? JSON.stringify(params) : new URLSearchParams(params).toString(),
+    body: json ? JSON.stringify(params) : new URLSearchParams(formEntries()).toString(),
   });
   const text = await res.text().catch(() => "");
   const record = asRecord(safeJson(text));
@@ -237,10 +241,11 @@ export function accountFromToken(
 export function webUrl(
   value: string | undefined,
   protocols = ["https:", "http:"],
+  base?: string,
 ): string | undefined {
   if (!value) return undefined;
   try {
-    const url = new URL(value);
+    const url = base ? new URL(value, base) : new URL(value);
     return protocols.includes(url.protocol) ? url.href : undefined;
   } catch {
     return undefined;

package/src/auth/with-token.ts

@@ -71,12 +71,14 @@ export function withToken<C extends Credential>(
 }
 
 function authOf(credential: Credential): TokenAuth {
+  const headers: Record<string, string> = {
+    ...(credential.chatgptAccountId ? { "ChatGPT-Account-Id": credential.chatgptAccountId } : {}),
+    ...(credential.projectId ? { "x-antigravity-project": credential.projectId } : {}),
+  };
   return {
     apiKey: credential.accessToken,
     ...(credential.baseUrl ? { baseUrl: credential.baseUrl } : {}),
-    ...(credential.chatgptAccountId
-      ? { headers: { "ChatGPT-Account-Id": credential.chatgptAccountId } }
-      : {}),
+    ...(Object.keys(headers).length > 0 ? { headers } : {}),
   };
 }
 

package/src/errors.ts

@@ -349,6 +349,9 @@ const CONTEXT_PATTERNS: readonly RegExp[] = [
   // shipped the same two patterns for the same reason (0.1.51).
   /model_max_prompt_tokens_exceeded/i,
   /prompt token count of \d+ exceeds the limit/i,
+  // Gemini: "The input token count exceeds the maximum number of tokens allowed 1048576."
+  // The generic pattern below stops at "maximum number", so this read as `invalid`.
+  /input token count exceeds the maximum number of tokens/i,
   // Scoped to the thing that overflowed: a bare "exceeds the maximum" also
   // covers image counts and per-minute token rates, which compaction can't fix.
   /exceeds? the (?:model'?s? )?maximum (?:input |prompt |context )?(?:tokens?|length|context)/i,

package/src/presets.ts

@@ -431,6 +431,82 @@ export const PROVIDER_PRESETS = {
     // privacy setting, and answers 500 without it.
     rotation: ["mimo-v2.6-flash", "mimo-v2.5", "glm-5.3-flash", "qwen3.8-flash", "longcat-2.0"],
   },
+  /**
+   * OpenCode Zen: free and pay-as-you-go models on `https://opencode.ai/zen/v1`,
+   * matching cc-proxy's `opencode-zen` provider.
+   *
+   * Free models (`big-pickle` and every `-free` id) lead the list and the default
+   * rotation. Zen's free tier requires the OpenCode CLI headers, a `ses_` session
+   * id and a `read` tool on the request; the factory adds those automatically and
+   * retries a free model anonymously if a stale key answers 401.
+   *
+   * `routes` picks each model's wire from its id: `claude-` and Qwen (except
+   * `qwen3.8-max`) on Anthropic `/v1/messages`, `gpt-`, `grok-` and `muse-` on
+   * `/v1/responses`, `gemini-` on `/v1/models/<id>:streamGenerateContent?alt=sse`,
+   * and everything else on `/v1/chat/completions`.
+   */
+  "opencode-zen": {
+    shape: "openai",
+    baseUrl: "https://opencode.ai/zen/v1",
+    auth: "bearer",
+    defaultModel: "minimax-m3.1-flash-free",
+    models: [
+      "minimax-m3.1-flash-free",
+      "mimo-v2.6-flash-free",
+      "deepseek-v4.1-flash-free",
+      "glm-5.3-flash-free",
+      "big-pickle",
+      "mimo-v2.5-free",
+      "nemotron-3.5-super-vl-free",
+      "nemotron-3.5-lightning-free",
+      "longcat-2.5-preview-free",
+      "beam-free",
+      "ll-alpha-free",
+      "exo-free",
+      "nemotron-3-ultra-free",
+      "claude-sonnet-5-5",
+      "claude-opus-5-5",
+      "claude-fable-5-1",
+      "claude-haiku-5-5",
+      "gpt-6-sol",
+      "gpt-5.6-luna",
+      "gemini-4-argon",
+      "gemini-3.8-flash",
+      "grok-4.7",
+      "glm-5.3-flash",
+      "deepseek-v4.1-flash",
+      "kimi-k3",
+      "minimax-m3",
+      "qwen3.8-flash",
+    ],
+    sessionHeader: "x-opencode-session",
+    routes: [
+      {
+        prefixes: ["claude-", "qwen3.8-flash", "qwen3.7", "qwen3.6", "qwen3.5"],
+        shape: "anthropic",
+        baseUrl: "https://opencode.ai/zen",
+        auth: "key",
+      },
+      {
+        prefixes: ["gpt-", "grok-", "muse-"],
+        shape: "responses",
+        baseUrl: "https://opencode.ai/zen",
+      },
+      {
+        prefixes: ["gemini-"],
+        shape: "gemini",
+        baseUrl: "https://opencode.ai/zen/v1",
+        auth: "key",
+      },
+    ],
+    rotation: [
+      "minimax-m3.1-flash-free",
+      "mimo-v2.6-flash-free",
+      "deepseek-v4.1-flash-free",
+      "big-pickle",
+      "glm-5.3-flash-free",
+    ],
+  },
   kimi: {
     shape: "anthropic",
     baseUrl: "https://api.kimi.ai/coding",
@@ -617,6 +693,30 @@ export const PROVIDER_PRESETS = {
     },
     initiatorHeader: true,
   },
+  /**
+   * Google Antigravity (Cloud Code Assist) OAuth, matching cc-proxy's
+   * `antigravity` provider. Sign in with `createAuthFlow("antigravity", host)`
+   * from `@providerkit/core/auth`, which discovers the Cloud Code Assist
+   * `projectId` and stores it on the credential; `withToken` and `createRegistry`
+   * forward it automatically.
+   */
+  antigravity: {
+    shape: "gemini",
+    baseUrl: "https://daily-cloudcode-pa.googleapis.com",
+    path: "/v1internal:streamGenerateContent?alt=sse",
+    auth: "oauth",
+    defaultModel: "gemini-4-argon",
+    models: [
+      "gemini-4-argon",
+      "gemini-3.8-flash",
+      "gemini-3.7-flash",
+      "gemini-3.1-pro",
+      "claude-opus-5-5",
+      "claude-sonnet-5-5",
+      "claude-sonnet-4-6",
+      "claude-opus-4-6-thinking",
+    ],
+  },
 } as const satisfies Record<string, ProviderPreset>;
 
 export type ProviderPresetId = keyof typeof PROVIDER_PRESETS;