@stage-labs/metro 0.1.0-beta.3 → 0.1.0-beta.300

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -0,0 +1,396 @@
+import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { cameThroughProxy } from '@metro-labs/http/api-http';
+import { agentIdForKey } from '../agents/keys.js';
+import { sdkAllowed, sdkConnectionAllowed, SDK_NEEDS_KEY } from '../claude/runner.js';
+import {
+  assertBedrockReady,
+  bedrockBase,
+  bedrockCount,
+  bedrockMessages,
+  freshAdaptations,
+  type Adaptations,
+} from './bedrock.js';
+import {
+  addBeta,
+  anthropicHeaders,
+  forwardedHeaders,
+  GatewayError,
+  holdLimitRefusal,
+  loginHeaders,
+  parseJson,
+  pipeResponse,
+  readBody,
+  sendError,
+  upstreamMessage,
+  watchUpstream,
+} from './forward.js';
+import { chainOf, forgetFallbackState, noteChoice, noteRefused, routesToTry } from './fallback.js';
+import {
+  BINDING_BETA,
+  cappedEffort,
+  effortToApply,
+  forgetLearnedThinking,
+  learnAlwaysThinks,
+  plannedEffort,
+  thinkingOff,
+  withBlockBinding,
+  withEffort,
+  withThinkingFor,
+} from './effort.js';
+import { notReady, PASSTHROUGH_ID, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
+import { codexMessages, sharedCodexState } from './codex.js';
+import { geminiMessages, sharedGeminiState } from './gemini.js';
+import { countTokens } from './subscription.js';
+import type { GeminiDeps } from './gemini.js';
+import type { CodexDeps } from './codex.js';
+import type { GeminiTokens } from './gemini-auth.js';
+import { OPENROUTER_BASE } from './openrouter.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import { forgetServed, noteServed } from './served.js';
+import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
+import { fitToolSearch } from './tool-search.js';
+import { ANTHROPIC_API, refreshLoginModels } from './provider-models.js';
+import type { CodexTokens } from './codex-auth.js';
+import { forgetClaudeTokens, withClaudeLogin, type ClaudeLoginDeps } from './claude-logins.js';
+
+const GATEWAY_PREFIX = '/gateway';
+const MESSAGES = '/v1/messages';
+const COUNT = '/v1/messages/count_tokens';
+const MODELS = '/v1/models';
+const HELLO = '/api/hello';
+
+export interface GatewayDeps {
+  config: () => ModelConfig;
+  identify?: (key: string) => boolean;
+  anthropicBase?: string;
+  bedrockBase?: string;
+  openrouterBase?: string;
+  codex?: Partial<CodexDeps>;
+  gemini?: Partial<GeminiDeps>;
+  claudeLogins?: ClaudeLoginDeps;
+}
+
+const learned: Adaptations = freshAdaptations();
+
+export function resetGatewayState(): void {
+  forgetServed();
+  forgetFallbackState();
+  forgetUsage();
+  learned.fields.clear();
+  learned.dropBetas = false;
+  forgetLearnedThinking();
+  sharedCodexState.clear();
+  sharedGeminiState.clear();
+  forgetClaudeTokens();
+}
+
+const saveCodexTokens = (id: string, tokens: CodexTokens): void => {
+  writeModelConfig(setCodexAuth(readModelConfig(), id, tokens));
+};
+
+const saveGeminiTokens = (id: string, tokens: GeminiTokens): void => {
+  writeModelConfig(setGeminiAuth(readModelConfig(), id, tokens));
+};
+
+const keyOf = (req: IncomingMessage): string => {
+  const raw = req.headers['x-metro-key'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+};
+
+const fromSdkRunner = (req: IncomingMessage): boolean => {
+  const raw = req.headers['x-metro-runner'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() === 'sdk';
+};
+
+const defaultIdentify = (key: string): boolean => key !== '' && agentIdForKey(key) !== undefined;
+
+function modelsBody(cfg: ModelConfig): Record<string, unknown> {
+  const data = cfg.connections
+    .filter((c) => c.provider !== 'anthropic' && c.model !== '')
+    .map((c) => ({ id: `${c.provider}:${c.model}`, display_name: `${c.label} · ${c.model}`, description: 'Through metro' }));
+  return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
+}
+
+const PASSTHROUGH: Connection = {
+  id: PASSTHROUGH_ID,
+  provider: 'anthropic',
+  label: 'Claude Code login',
+  model: '',
+  apiKey: '',
+  region: '',
+  zdr: false,
+  codex: null,
+  gemini: null,
+  claude: null,
+};
+
+const passthrough = (body: Record<string, unknown>): Route => ({ connection: PASSTHROUGH, model: requestedModel(body) });
+
+function requestedModel(body: Record<string, unknown>): string {
+  const model = body.model;
+  if (typeof model !== 'string' || model === '') throw new GatewayError(400, 'invalid_request_error', 'model is required');
+  return model;
+}
+
+const standsInFor = (req: IncomingMessage): boolean => {
+  const metroKey = req.headers['x-metro-key'];
+  return typeof metroKey === 'string' && metroKey !== '' && req.headers.authorization === `Bearer ${metroKey}`;
+};
+
+interface Payloads {
+  metro: Buffer;
+  asSent: Buffer | null;
+  bound: boolean;
+}
+
+function anthropicPayloads(raw: Buffer, sent: Record<string, unknown>, shaped: Record<string, unknown>, model: string): Payloads {
+  const runnable = withThinkingFor(sent, model);
+  const rewrite = runnable !== sent || (typeof sent.model === 'string' && sent.model !== model);
+  const asSent = rewrite ? Buffer.from(JSON.stringify({ ...runnable, model })) : raw;
+  const bound = withBlockBinding(withThinkingFor(shaped, model));
+  if (bound === sent) return { metro: asSent, asSent: null, bound: false };
+  return { metro: Buffer.from(JSON.stringify(rewrite ? { ...bound, model } : bound)), asSent, bound: bound !== shaped };
+}
+
+type Send = (payload: Buffer, headers: Record<string, string>) => Promise<Response>;
+
+async function asAnthropicWants(send: Send, base: Record<string, string>, payloads: Payloads, connection: string, model: string): Promise<Response> {
+  const { metro, asSent, bound } = payloads;
+  const upstream = await send(metro, bound ? addBeta(base, BINDING_BETA) : base);
+  if (upstream.status !== 400 || asSent === null) return upstream;
+  await upstream.body?.cancel();
+  log.warn({ connection, model }, 'gateway: Anthropic refused the request metro shaped, so it was sent again as Claude Code wrote it');
+  return send(asSent, base);
+}
+
+async function refusedThinkingOff(upstream: Response, shaped: Record<string, unknown>, model: string): Promise<boolean> {
+  if (upstream.status !== 400 || !thinkingOff(shaped)) return false;
+  if (!learnAlwaysThinks(model, upstreamMessage(await upstream.clone().text(), ''))) return false;
+  await upstream.body?.cancel();
+  log.info({ model }, 'gateway: this model cannot run with thinking off, so metro leaves that setting out for it from now on');
+  return true;
+}
+
+function listLoginModels(headers: IncomingHttpHeaders, anthropicBase: string): void {
+  refreshLoginModels(headers, anthropicBase).catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'gateway: could not list the models of the Claude Code login');
+  });
+}
+
+function sendAnthropic(req: IncomingMessage, conn: Connection, anthropicBase: string, attempt: (base: Record<string, string>) => Promise<Response>, deps: GatewayDeps): Promise<Response> {
+  if (conn.apiKey !== '') return attempt(anthropicHeaders(req, conn.apiKey));
+  if (conn.claude === null) return attempt(forwardedHeaders(req));
+  return withClaudeLogin(conn.claude.id, deps.claudeLogins ?? {}, (token) => {
+    listLoginModels({ authorization: `Bearer ${token}` }, anthropicBase);
+    return attempt(loginHeaders(req, token));
+  });
+}
+
+async function refusedLogin(conn: Connection, upstream: Response): Promise<void> {
+  if (conn.apiKey !== '' || conn.claude === null || upstream.status !== 401) return;
+  await upstream.body?.cancel();
+  throw new GatewayError(403, 'permission_error', `Anthropic refused the Claude login of ${conn.label}: sign in again on the Model page`);
+}
+
+async function toAnthropic(
+  req: IncomingMessage,
+  res: ServerResponse,
+  raw: Buffer,
+  sent: Record<string, unknown>,
+  shaped: Record<string, unknown>,
+  route: Route,
+  deps: GatewayDeps,
+): Promise<void> {
+  const conn = route.connection;
+  const anthropicBase = deps.anthropicBase ?? ANTHROPIC_API;
+  const url = `${anthropicBase}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
+  const passthrough = conn.apiKey === '' && conn.claude === null;
+  if (passthrough && standsInFor(req))
+    throw new GatewayError(
+      403,
+      'permission_error',
+      'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter, Codex or Gemini on the Model page, or sign in on the Claude tab',
+    );
+  const watch = watchUpstream(res);
+  if (passthrough) listLoginModels(req.headers, anthropicBase);
+  const send = (payload: Buffer, headers: Record<string, string>): Promise<Response> =>
+    fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
+  const attempt = async (base: Record<string, string>): Promise<Response> => {
+    const shape = (): Promise<Response> => asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
+    const first = await shape();
+    return (await refusedThinkingOff(first, shaped, route.model)) ? shape() : first;
+  };
+  const upstream = await sendAnthropic(req, conn, anthropicBase, attempt, deps);
+  await refusedLogin(conn, upstream);
+  noteRefusal(conn.label, route.model, upstream);
+  noteUsageHeaders('anthropic', conn.id, upstream.headers);
+  const scanner = new UsageScanner(conn.id);
+  await pipeResponse(upstream, res, watch, passthrough ? { scanner } : { ownCredential: true, scanner });
+}
+
+async function toOpenRouter(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  route: Route,
+  cfg: ModelConfig,
+  deps: GatewayDeps,
+): Promise<void> {
+  const conn = route.connection;
+  const reason = notReady(cfg, conn);
+  if (reason !== null) throw new GatewayError(400, 'invalid_request_error', reason);
+  const headers: Record<string, string> = {
+    'content-type': 'application/json',
+    accept: req.headers.accept ?? 'application/json',
+    authorization: `Bearer ${conn.apiKey}`,
+    'anthropic-version': typeof req.headers['anthropic-version'] === 'string' ? req.headers['anthropic-version'] : '2023-06-01',
+    'http-referer': 'https://metro.box',
+    'x-title': 'metro',
+  };
+  const beta = req.headers['anthropic-beta'];
+  if (typeof beta === 'string' && beta !== '') headers['anthropic-beta'] = beta;
+  const watch = watchUpstream(res);
+  const upstream = await fetch(`${deps.openrouterBase ?? OPENROUTER_BASE}${MESSAGES}`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify(openrouterBody(body, route.model, conn.zdr)),
+    signal: watch.signal,
+    redirect: 'manual',
+  });
+  noteRefusal(conn.label, route.model, upstream);
+  await pipeResponse(upstream, res, watch, { keepalive: true, ownCredential: true, scanner: new UsageScanner(conn.id) });
+}
+
+function openrouterBody(body: Record<string, unknown>, model: string, zdr: boolean): Record<string, unknown> {
+  const sent: Record<string, unknown> = { ...body, model };
+  if (thinkingOff(body)) delete sent.thinking;
+  const effort = effortToApply(body);
+  if (effort !== null) sent.reasoning = { ...(isRecord(body.reasoning) ? body.reasoning : {}), effort: cappedEffort(effort) };
+  if (!zdr) return sent;
+  const provider = isRecord(body.provider) ? body.provider : {};
+  return { ...sent, provider: { ...provider, zdr: true } };
+}
+
+function noteRefusal(connection: string, model: string, upstream: Response): void {
+  if (!upstream.ok) log.warn({ connection, model, status: upstream.status }, 'gateway: the provider refused the request');
+}
+
+async function toSubscription(req: IncomingMessage, res: ServerResponse, path: string, body: Record<string, unknown>, route: Route, deps: GatewayDeps): Promise<void> {
+  const conn = route.connection;
+  if (path === COUNT) countTokens(res, body);
+  else if (conn.provider === 'gemini') await geminiMessages(req, res, body, route.model, conn, { save: saveGeminiTokens, ...deps.gemini }, sharedGeminiState, watchUpstream(res));
+  else await codexMessages(req, res, body, route.model, conn, { save: saveCodexTokens, ...deps.codex }, sharedCodexState, watchUpstream(res));
+}
+
+function shapedFor(req: IncomingMessage, sent: Record<string, unknown>): Record<string, unknown> {
+  const effort = plannedEffort(req, sent);
+  return effort === null ? sent : withEffort(sent, effort);
+}
+
+const bytesOf = (raw: Buffer, parsed: Record<string, unknown>, sent: Record<string, unknown>): Buffer => (sent === parsed ? raw : Buffer.from(JSON.stringify(sent)));
+
+interface Request {
+  path: string;
+  raw: Buffer;
+  parsed: Record<string, unknown>;
+  sent: Record<string, unknown>;
+  body: Record<string, unknown>;
+  cfg: ModelConfig;
+}
+
+function checkSdkRoute(req: IncomingMessage, route: Route, deps: GatewayDeps): void {
+  if (fromSdkRunner(req) && (!sdkAllowed(undefined, deps.config()) || !sdkConnectionAllowed(route.connection)))
+    throw new GatewayError(403, 'permission_error', SDK_NEEDS_KEY);
+}
+
+async function attempt(req: IncomingMessage, res: ServerResponse, ask: Request, route: Route, deps: GatewayDeps): Promise<void> {
+  const { path, body } = ask;
+  const conn = route.connection;
+  checkSdkRoute(req, route, deps);
+  log.info({ route: routeLabel(route), connection: conn.label, path }, 'gateway: routing');
+  if (path === MESSAGES) noteServed({ connection: conn.id, provider: conn.provider, model: route.model, at: new Date().toISOString() });
+  if (conn.provider === 'bedrock') {
+    assertBedrockReady(conn);
+    const up = { settings: conn, base: deps.bedrockBase ?? bedrockBase(conn.region), learned, watch: watchUpstream(res) };
+    if (path === COUNT) await bedrockCount(req, res, body, route.model, up);
+    else await bedrockMessages(req, res, body, route.model, up);
+    return;
+  }
+  if (conn.provider === 'openrouter') {
+    if (path === COUNT) throw new GatewayError(404, 'not_found_error', 'OpenRouter does not count tokens');
+    await toOpenRouter(req, res, body, route, ask.cfg, deps);
+    return;
+  }
+  if (conn.provider === 'codex' || conn.provider === 'gemini') {
+    await toSubscription(req, res, path, body, route, deps);
+    return;
+  }
+  await toAnthropic(req, res, bytesOf(ask.raw, ask.parsed, ask.sent), ask.sent, body, route, deps);
+}
+
+async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
+  const cfg = deps.config();
+  const raw = await readBody(req);
+  const parsed = parseJson(raw);
+  const sent = fitToolSearch(req, parsed);
+  const requested = requestedModel(sent);
+  const primary = resolveRoute(requested, cfg) ?? passthrough(sent);
+  const ask: Request = { path, raw, parsed, sent, body: shapedFor(req, sent), cfg };
+  const routes = routesToTry(chainOf(primary, cfg, requested));
+  for (const [at, route] of routes.entries()) {
+    const next = routes[at + 1];
+    if (path === MESSAGES) noteChoice(primary, route);
+    if (next === undefined) {
+      await attempt(req, res, ask, route, deps);
+      return;
+    }
+    const held = holdLimitRefusal(res);
+    await attempt(req, held.res, ask, route, deps);
+    const refusal = held.refusal();
+    if (refusal === null) return;
+    noteRefused(route, refusal.status, refusal.headers, next);
+  }
+}
+
+function failed(res: ServerResponse, err: unknown): void {
+  if (res.headersSent) {
+    res.end();
+    return;
+  }
+  if (err instanceof GatewayError) {
+    sendError(res, err.status, err.kind, err.message);
+    return;
+  }
+  log.warn({ err: errMsg(err) }, 'gateway: request failed');
+  sendError(res, 502, 'api_error', `metro gateway: ${errMsg(err)}`);
+}
+
+function answer(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): void {
+  if (req.method === 'GET' && path === MODELS) {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(modelsBody(deps.config())));
+    return;
+  }
+  if (req.method === 'POST' && (path === MESSAGES || path === COUNT)) {
+    dispatch(req, res, path, deps).catch((err: unknown) => {
+      failed(res, err);
+    });
+    return;
+  }
+  sendError(res, 404, 'not_found_error', 'not found');
+}
+
+export function handleGatewayRequest(req: IncomingMessage, res: ServerResponse, deps: GatewayDeps): boolean {
+  const full = req.url ?? '';
+  if (full !== GATEWAY_PREFIX && !full.startsWith(`${GATEWAY_PREFIX}/`)) return false;
+  const path = (full.split('?')[0] ?? '').slice(GATEWAY_PREFIX.length);
+  if (req.method === 'HEAD' && path === HELLO) {
+    res.writeHead(200).end();
+    return true;
+  }
+  if (cameThroughProxy(req)) sendError(res, 401, 'authentication_error', 'metro gateway: the agent key works only on this machine, not through its public address');
+  else if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
+  else sendError(res, 401, 'authentication_error', 'metro gateway: no agent key (x-metro-key); start Claude Code with metro claude');
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-auth.ts

@@ -0,0 +1,160 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { PendingLogins } from './pkce.js';
+import { nonEmpty } from './text.js';
+
+const GEMINI_CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
+const GEMINI_CLIENT_SECRET = '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';
+const GEMINI_AUTH_BASE = 'https://accounts.google.com';
+const GEMINI_TOKEN_BASE = 'https://oauth2.googleapis.com';
+const GEMINI_REDIRECT = 'http://localhost:51121/oauth-callback';
+const SCOPE = [
+  'https://www.googleapis.com/auth/cloud-platform',
+  'https://www.googleapis.com/auth/userinfo.email',
+  'https://www.googleapis.com/auth/userinfo.profile',
+  'https://www.googleapis.com/auth/cclog',
+  'https://www.googleapis.com/auth/experimentsandconfigs',
+].join(' ');
+const EXPIRY_MARGIN_MS = 5 * 60_000;
+const DEFAULT_TTL_MS = 55 * 60_000;
+
+export interface GeminiTokens {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  email: string | null;
+  project: string;
+  tier: string | null;
+  savedAt: string;
+}
+
+export class GeminiAuthError extends Error {}
+
+const pending = new PendingLogins(16);
+
+export function authorizeUrl(state: string, challenge: string, base = GEMINI_AUTH_BASE): string {
+  const params = new URLSearchParams({
+    client_id: GEMINI_CLIENT_ID,
+    redirect_uri: GEMINI_REDIRECT,
+    response_type: 'code',
+    scope: SCOPE,
+    access_type: 'offline',
+    prompt: 'consent',
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+  });
+  return `${base}/o/oauth2/v2/auth?${params.toString()}`;
+}
+
+export function beginLogin(base = GEMINI_AUTH_BASE, now = Date.now()): { url: string; state: string } {
+  const { state, challenge } = pending.begin(now);
+  return { url: authorizeUrl(state, challenge, base), state };
+}
+
+
+const refusalIn = (body: Record<string, unknown>): string => nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? 'Google answered without an access token';
+
+function grantedTokens(body: unknown, previous: GeminiTokens | null): { accessToken: string; refreshToken: string; ttl: number } {
+  if (!isRecord(body)) throw new GeminiAuthError('Google answered without tokens');
+  const accessToken = nonEmpty(body.access_token);
+  if (accessToken === null) throw new GeminiAuthError(refusalIn(body));
+  const refreshToken = nonEmpty(body.refresh_token) ?? previous?.refreshToken ?? '';
+  if (refreshToken === '') throw new GeminiAuthError('Google issued no refresh token; sign in again');
+  return { accessToken, refreshToken, ttl: typeof body.expires_in === 'number' ? body.expires_in * 1000 : DEFAULT_TTL_MS };
+}
+
+function tokensOf(body: unknown, previous: GeminiTokens | null, now: number): GeminiTokens {
+  const granted = grantedTokens(body, previous);
+  return {
+    accessToken: granted.accessToken,
+    refreshToken: granted.refreshToken,
+    expiresAt: now + granted.ttl,
+    email: previous?.email ?? null,
+    project: previous?.project ?? '',
+    tier: previous?.tier ?? null,
+    savedAt: new Date(now).toISOString(),
+  };
+}
+
+async function tokenCall(form: Record<string, string>, base: string, fetchImpl: typeof fetch): Promise<unknown> {
+  let res: Response;
+  try {
+    res = await fetchImpl(`${base}/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new GeminiAuthError(`could not reach Google: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const body: unknown = await res.json().catch(() => null);
+  if (!res.ok) throw new GeminiAuthError(isRecord(body) ? (nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? `Google answered ${String(res.status)}`) : `Google answered ${String(res.status)}`);
+  return body;
+}
+
+function codeIn(pasted: string, state: string): string {
+  const trimmed = pasted.trim();
+  if (trimmed === '') throw new GeminiAuthError('paste the address the browser landed on, or the code in it');
+  if (!/^https?:\/\//i.test(trimmed)) return trimmed;
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw new GeminiAuthError('that is not a full address');
+  }
+  const code = url.searchParams.get('code') ?? '';
+  const carried = url.searchParams.get('state');
+  if (code === '') throw new GeminiAuthError(`that address carries no code${url.searchParams.get('error') === null ? '' : ` (Google said ${url.searchParams.get('error') ?? ''})`}`);
+  if (carried !== null && carried !== state) throw new GeminiAuthError('that address belongs to another sign-in; start again and paste the new one');
+  return code;
+}
+
+export async function exchangeCode(pasted: string, state: string, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  const verifier = pending.take(state, now);
+  if (verifier === null) throw new GeminiAuthError('that sign-in has expired; start it again');
+  const code = codeIn(pasted, state);
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: GEMINI_REDIRECT },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, null, now);
+}
+
+export async function refreshTokens(previous: GeminiTokens, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
+  const body = await tokenCall(
+    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'refresh_token', refresh_token: previous.refreshToken },
+    base,
+    fetchImpl,
+  );
+  return tokensOf(body, previous, now);
+}
+
+export const tokensStale = (tokens: GeminiTokens, now = Date.now()): boolean => tokens.expiresAt - EXPIRY_MARGIN_MS <= now;
+
+export async function userEmail(tokens: GeminiTokens, base = 'https://www.googleapis.com', fetchImpl: typeof fetch = fetch): Promise<string | null> {
+  try {
+    const res = await fetchImpl(`${base}/oauth2/v2/userinfo`, { headers: { authorization: `Bearer ${tokens.accessToken}` }, signal: AbortSignal.timeout(15_000) });
+    const body: unknown = await res.json().catch(() => null);
+    return res.ok && isRecord(body) ? nonEmpty(body.email) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function tokensFromDisk(raw: unknown): GeminiTokens | null {
+  if (!isRecord(raw)) return null;
+  const accessToken = nonEmpty(raw.accessToken);
+  const refreshToken = nonEmpty(raw.refreshToken);
+  if (accessToken === null || refreshToken === null) return null;
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: typeof raw.expiresAt === 'number' ? raw.expiresAt : 0,
+    email: nonEmpty(raw.email),
+    project: nonEmpty(raw.project) ?? '',
+    tier: nonEmpty(raw.tier),
+    savedAt: nonEmpty(raw.savedAt) ?? '',
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-client.ts

@@ -0,0 +1,46 @@
+import { randomUUID } from 'node:crypto';
+
+const CODE_ASSIST_BASE = 'https://cloudcode-pa.googleapis.com';
+const CODE_ASSIST_DAILY = 'https://daily-cloudcode-pa.googleapis.com';
+export const API = 'v1internal';
+const APP_VERSION = '2.0.3';
+const CLIENT_VERSION = '1.110.0';
+export const CLIENT_NAME = 'antigravity';
+const IDE_TYPE = 9;
+const PLUGIN_TYPE = 2;
+export const SYSTEM_PREFIX =
+  'You are Antigravity, a powerful agentic AI coding assistant designed by the Google Deepmind team working on Advanced Agentic Coding.You are pair programming with a USER to solve their coding task. The task may require creating a new codebase, modifying or debugging an existing codebase, or simply answering a question.**Absolute paths only****Proactiveness**';
+
+const PLATFORMS: Record<string, number> = { 'darwin-x64': 1, 'darwin-arm64': 2, 'linux-x64': 3, 'linux-arm64': 4, 'win32-x64': 5 };
+
+const osName = (): string => (process.platform === 'darwin' ? 'darwin' : process.platform === 'win32' ? 'win32' : 'linux');
+
+const platformCode = (): number => PLATFORMS[`${process.platform}-${process.arch}`] ?? 0;
+
+export const clientMetadata = (project: string | null): Record<string, unknown> => ({
+  ideType: IDE_TYPE,
+  platform: platformCode(),
+  pluginType: PLUGIN_TYPE,
+  ...(project === null ? {} : { duetProject: project }),
+});
+
+export const clientHeaders = (): Record<string, string> => ({
+  'user-agent': `${CLIENT_NAME}/${APP_VERSION} ${osName()}/${process.arch}`,
+  'x-client-name': CLIENT_NAME,
+  'x-client-version': CLIENT_VERSION,
+  'x-goog-api-client': 'gl-node/18.18.2 fire/0.8.6 grpc/1.10.x',
+});
+
+export type Bases = string | string[];
+
+const listed = (override: Bases): string[] => (typeof override === 'string' ? [override] : override);
+
+export const generateBases = (override?: Bases): string[] => (override === undefined ? [CODE_ASSIST_DAILY, CODE_ASSIST_BASE] : listed(override));
+
+export const setupBases = (override?: Bases): string[] => (override === undefined ? [CODE_ASSIST_BASE, CODE_ASSIST_DAILY] : listed(override));
+
+export const requestId = (): string => `agent-${randomUUID()}`;
+
+const sessionId = randomUUID();
+
+export const machineSessionId = (): string => sessionId;