@sayknow-cli/ai 0.2.2

package/src/utils/oauth/alibaba-coding-plan.ts

@@ -0,0 +1,59 @@
+/**
+ * Alibaba Coding Plan login flow.
+ *
+ * Alibaba Coding Plan provides OpenAI-compatible models via https://coding-intl.dashscope.aliyuncs.com/v1.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to Alibaba Cloud DashScope API key settings
+ * 2. User copies their API key
+ * 3. User pastes the API key into the CLI
+ */
+
+import { validateOpenAICompatibleApiKey } from "./api-key-validation";
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://modelstudio.console.alibabacloud.com/";
+const API_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
+const VALIDATION_MODEL = "qwen3.5-plus";
+
+/**
+ * Login to Alibaba Coding Plan.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginAlibabaCodingPlan(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Alibaba Coding Plan login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your API key from the Alibaba Cloud DashScope console",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Alibaba Coding Plan API key",
+		placeholder: "sk-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	options.onProgress?.("Validating API key...");
+	await validateOpenAICompatibleApiKey({
+		provider: "Alibaba Coding Plan",
+		apiKey: trimmed,
+		baseUrl: API_BASE_URL,
+		model: VALIDATION_MODEL,
+		signal: options.signal,
+	});
+
+	return trimmed;
+}

package/src/utils/oauth/anthropic.ts

@@ -0,0 +1,200 @@
+/**
+ * Anthropic OAuth flow (Anthropic model Pro/Max)
+ */
+import { OAuthCallbackFlow } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const decode = (s: string) => atob(s);
+const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+const CALLBACK_PORT = 54545;
+const CALLBACK_PATH = "/callback";
+const SCOPES = "org:create_api_key user:profile user:inference";
+
+function formatErrorDetails(error: unknown): string {
+	if (error instanceof Error) {
+		const details: string[] = [`${error.name}: ${error.message}`];
+		const errorWithCode = error as Error & { code?: string; errno?: number | string; cause?: unknown };
+		if (errorWithCode.code) details.push(`code=${errorWithCode.code}`);
+		if (typeof errorWithCode.errno !== "undefined") details.push(`errno=${String(errorWithCode.errno)}`);
+		if (typeof error.cause !== "undefined") {
+			details.push(`cause=${formatErrorDetails(error.cause)}`);
+		}
+		if (error.stack) {
+			details.push(`stack=${error.stack}`);
+		}
+		return details.join("; ");
+	}
+	return String(error);
+}
+
+async function postJson(url: string, body: Record<string, string | number>): Promise<string> {
+	const response = await fetch(url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Accept: "application/json",
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(30_000),
+	});
+
+	const responseBody = await response.text();
+	if (!response.ok) {
+		throw new Error(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`);
+	}
+	return responseBody;
+}
+
+/**
+ * Decoded shape of Anthropic's `/v1/oauth/token` response (both
+ * `authorization_code` exchange and `refresh_token` refresh return the same
+ * envelope). The `account` block is inlined alongside the tokens, so we can
+ * surface `accountId` / `email` on {@link OAuthCredentials} without a separate
+ * `/api/oauth/profile` round-trip.
+ */
+interface AnthropicTokenResponse {
+	access_token: string;
+	refresh_token: string;
+	expires_in: number;
+	account?: { uuid?: string; email_address?: string };
+}
+
+function parseOAuthTokenResponse(responseBody: string, operation: string): AnthropicTokenResponse {
+	try {
+		return JSON.parse(responseBody) as AnthropicTokenResponse;
+	} catch (error) {
+		throw new Error(
+			`Anthropic ${operation} returned invalid JSON. url=${TOKEN_URL}; body=${responseBody}; details=${formatErrorDetails(error)}`,
+		);
+	}
+}
+
+/**
+ * Lift the OAuth response's `account: { uuid, email_address }` block onto
+ * {@link OAuthCredentials} so downstream identity propagation (e.g.
+ * `metadata.user_id.account_uuid`, usage tracking) works without a separate
+ * `/api/oauth/profile` round-trip. Returns `undefined` for either field when
+ * the response omits it or carries a non-string / empty value.
+ */
+function extractAccountFromTokenResponse(data: AnthropicTokenResponse): {
+	accountId?: string;
+	email?: string;
+} {
+	const accountUuid = data.account?.uuid;
+	const emailAddress = data.account?.email_address;
+	return {
+		accountId: typeof accountUuid === "string" && accountUuid.length > 0 ? accountUuid : undefined,
+		email: typeof emailAddress === "string" && emailAddress.length > 0 ? emailAddress : undefined,
+	};
+}
+
+export class AnthropicOAuthFlow extends OAuthCallbackFlow {
+	#verifier: string = "";
+	#challenge: string = "";
+
+	constructor(ctrl: OAuthController) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const pkce = await generatePKCE();
+		this.#verifier = pkce.verifier;
+		this.#challenge = pkce.challenge;
+
+		const authParams = new URLSearchParams({
+			code: "true",
+			client_id: CLIENT_ID,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: SCOPES,
+			code_challenge: this.#challenge,
+			code_challenge_method: "S256",
+			state,
+		});
+		const url = `${AUTHORIZE_URL}?${authParams.toString()}`;
+
+		return {
+			url,
+			instructions:
+				"Complete login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+		};
+	}
+
+	async exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials> {
+		let exchangeCode = code;
+		let exchangeState = state;
+		const codeFragmentIndex = code.indexOf("#");
+		if (codeFragmentIndex >= 0) {
+			exchangeCode = code.slice(0, codeFragmentIndex);
+			const codeFragmentState = code.slice(codeFragmentIndex + 1);
+			if (codeFragmentState.length > 0) {
+				exchangeState = codeFragmentState;
+			}
+		}
+
+		let responseBody: string;
+		try {
+			responseBody = await postJson(TOKEN_URL, {
+				grant_type: "authorization_code",
+				client_id: CLIENT_ID,
+				code: exchangeCode,
+				state: exchangeState,
+				redirect_uri: redirectUri,
+				code_verifier: this.#verifier,
+			});
+		} catch (error) {
+			throw new Error(
+				`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; response_type=authorization_code; details=${formatErrorDetails(error)}`,
+			);
+		}
+
+		const tokenData = parseOAuthTokenResponse(responseBody, "token exchange");
+		const { accountId, email } = extractAccountFromTokenResponse(tokenData);
+
+		return {
+			refresh: tokenData.refresh_token,
+			access: tokenData.access_token,
+			expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000,
+			accountId,
+			email,
+		};
+	}
+}
+
+/**
+ * Login with Anthropic OAuth
+ */
+export async function loginAnthropic(ctrl: OAuthController): Promise<OAuthCredentials> {
+	const flow = new AnthropicOAuthFlow(ctrl);
+	return flow.login();
+}
+
+/**
+ * Refresh Anthropic OAuth token
+ */
+export async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {
+	let responseBody: string;
+	try {
+		responseBody = await postJson(TOKEN_URL, {
+			grant_type: "refresh_token",
+			client_id: CLIENT_ID,
+			refresh_token: refreshToken,
+		});
+	} catch (error) {
+		throw new Error(`Anthropic token refresh request failed. url=${TOKEN_URL}; details=${formatErrorDetails(error)}`);
+	}
+
+	const data = parseOAuthTokenResponse(responseBody, "token refresh");
+	const { accountId, email } = extractAccountFromTokenResponse(data);
+
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+		accountId,
+		email,
+	};
+}

package/src/utils/oauth/api-key-login.ts

@@ -0,0 +1,87 @@
+/**
+ * Shared factory for API-key-paste "login" flows.
+ *
+ * Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
+ * don't actually implement OAuth — they just ask the user to paste an API key,
+ * optionally validate it, and return the trimmed key.
+ */
+
+import { validateApiKeyAgainstModelsEndpoint, validateOpenAICompatibleApiKey } from "./api-key-validation";
+import type { OAuthController } from "./types";
+
+type ChatCompletionsValidation = {
+	kind: "chat-completions";
+	provider: string;
+	baseUrl: string;
+	model: string;
+};
+
+type ModelsEndpointValidation = {
+	kind: "models-endpoint";
+	provider: string;
+	modelsUrl: string;
+};
+
+export type ApiKeyLoginConfig = {
+	/** Display name used in error messages, e.g. "Cerebras", "NanoGPT". */
+	providerLabel: string;
+	/** URL opened in browser for the user to grab their key. */
+	authUrl: string;
+	/** Instructions shown with the onAuth callback. */
+	instructions: string;
+	/** Prompt message shown when asking for the key paste. */
+	promptMessage: string;
+	/** Placeholder string for the prompt (e.g. "sk-...", "csk-..."). */
+	placeholder: string;
+	/** Validation strategy, or `null` to skip validation. */
+	validation: ChatCompletionsValidation | ModelsEndpointValidation | null;
+};
+
+export function createApiKeyLogin(config: ApiKeyLoginConfig): (options: OAuthController) => Promise<string> {
+	return async function login(options: OAuthController): Promise<string> {
+		if (!options.onPrompt) {
+			throw new Error(`${config.providerLabel} login requires onPrompt callback`);
+		}
+
+		options.onAuth?.({
+			url: config.authUrl,
+			instructions: config.instructions,
+		});
+
+		const apiKey = await options.onPrompt({
+			message: config.promptMessage,
+			placeholder: config.placeholder,
+		});
+
+		if (options.signal?.aborted) {
+			throw new Error("Login cancelled");
+		}
+
+		const trimmed = apiKey.trim();
+		if (!trimmed) {
+			throw new Error("API key is required");
+		}
+
+		if (config.validation) {
+			options.onProgress?.("Validating API key...");
+			if (config.validation.kind === "chat-completions") {
+				await validateOpenAICompatibleApiKey({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					baseUrl: config.validation.baseUrl,
+					model: config.validation.model,
+					signal: options.signal,
+				});
+			} else {
+				await validateApiKeyAgainstModelsEndpoint({
+					provider: config.validation.provider,
+					apiKey: trimmed,
+					modelsUrl: config.validation.modelsUrl,
+					signal: options.signal,
+				});
+			}
+		}
+
+		return trimmed;
+	};
+}

package/src/utils/oauth/api-key-validation.ts

@@ -0,0 +1,92 @@
+type OpenAICompatibleValidationOptions = {
+	provider: string;
+	apiKey: string;
+	baseUrl: string;
+	model: string;
+	signal?: AbortSignal;
+};
+
+type ModelListValidationOptions = {
+	provider: string;
+	apiKey: string;
+	modelsUrl: string;
+	signal?: AbortSignal;
+};
+
+const VALIDATION_TIMEOUT_MS = 15_000;
+
+/**
+ * Validate an API key against an OpenAI-compatible chat completions endpoint.
+ *
+ * Performs a minimal request to verify credentials and endpoint access.
+ */
+export async function validateOpenAICompatibleApiKey(options: OpenAICompatibleValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+
+	const response = await fetch(`${options.baseUrl}/chat/completions`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${options.apiKey}`,
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{ role: "user", content: "ping" }],
+			max_tokens: 1,
+			temperature: 0,
+		}),
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {
+		// ignore body parse errors, status is enough
+	}
+
+	const message = details
+		? `${options.provider} API key validation failed (${response.status}): ${details}`
+		: `${options.provider} API key validation failed (${response.status})`;
+	throw new Error(message);
+}
+
+/**
+ * Validate an API key against a provider models endpoint.
+ *
+ * Useful for providers where access to specific models may vary by plan and
+ * should not block key validation.
+ */
+export async function validateApiKeyAgainstModelsEndpoint(options: ModelListValidationOptions): Promise<void> {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+
+	const response = await fetch(options.modelsUrl, {
+		method: "GET",
+		headers: {
+			Authorization: `Bearer ${options.apiKey}`,
+		},
+		signal,
+	});
+
+	if (response.ok) {
+		return;
+	}
+
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {
+		// ignore body parse errors, status is enough
+	}
+
+	const message = details
+		? `${options.provider} API key validation failed (${response.status}): ${details}`
+		: `${options.provider} API key validation failed (${response.status})`;
+	throw new Error(message);
+}