@stage-labs/metro 0.1.0-beta.308 → 0.1.0-beta.309

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.308"
+  "version": "0.1.0-beta.309"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.308",
+  "version": "0.1.0-beta.309",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -1,219 +0,0 @@
-import { randomBytes, randomUUID } from 'node:crypto';
-import { join } from 'node:path';
-import { isRecord } from '@metro-labs/core/is-record';
-import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
-import { ticketStore } from '@metro-labs/core/tickets';
-import { agentsDir } from '../agents/files.js';
-import { newPkce } from './pkce.js';
-import { nonEmpty } from './text.js';
-
-export const CODEX_ISSUER = 'https://auth.openai.com';
-export const CODEX_REDIRECT = 'http://127.0.0.1:1455/auth/callback';
-export const OPENAI_API = 'https://api.openai.com/v1';
-export const NEW_CLIENT = 'dynamic_agent_client';
-export const APP_NAME = 'Metro';
-export const PLAN_SCOPE = 'chatgpt.tokens.use.direct';
-export const CODEX_SIGN_IN = 'Codex is not signed in: sign in with ChatGPT on the Model page.';
-const SCOPE = `openid profile email offline_access resource.invoke ${PLAN_SCOPE}`;
-const PROFILE_CLAIM = 'https://api.openai.com/profile';
-const HOST_FILE = 'chatgpt-host.json';
-const HOST_RE = /^urn:uuid:[0-9a-f-]{36}$/;
-const PENDING_TTL_MS = 10 * 60_000;
-const DEFAULT_TTL_MS = 60 * 60_000;
-const RENEW_BEFORE_MS = 2 * 60_000;
-const AGAIN = 'press Continue with ChatGPT again';
-
-export type CodexMethod = 'chatgpt' | 'code';
-
-export interface CodexCredential {
-  email: string | null;
-  accessToken: string;
-  refreshToken: string;
-  expiresAt: number;
-  savedAt: string;
-}
-
-export interface ChatgptTokens extends CodexCredential {
-  method: 'chatgpt';
-  clientId: string;
-  subject: string;
-}
-
-export interface CodeTokens extends CodexCredential {
-  method: 'code';
-  accountId: string;
-  plan: string | null;
-}
-
-export type CodexTokens = ChatgptTokens | CodeTokens;
-
-export class CodexAuthError extends Error {}
-
-interface Pending {
-  verifier: string;
-  nonce: string;
-  clientId: string | null;
-  subject: string | null;
-}
-
-const pending = ticketStore<Pending>(PENDING_TTL_MS, 24);
-
-export function chatgptHostId(dir = agentsDir()): string {
-  const path = join(dir, HOST_FILE);
-  const saved = readJson<unknown>(path, null);
-  if (isRecord(saved) && typeof saved.hostId === 'string' && HOST_RE.test(saved.hostId)) return saved.hostId;
-  const made = `urn:uuid:${randomUUID()}`;
-  writeSecure(path, JSON.stringify({ hostId: made }));
-  return made;
-}
-
-function returning(previous: ChatgptTokens | null): Record<string, string> {
-  if (previous === null) return { client_id: NEW_CLIENT, agent_name_hint: APP_NAME };
-  return { client_id: previous.clientId, ...(previous.email === null ? {} : { login_hint: previous.email }) };
-}
-
-export function beginLogin(previous: ChatgptTokens | null, hostId: string, issuer = CODEX_ISSUER, now = Date.now()): string {
-  const { verifier, challenge } = newPkce();
-  const nonce = randomBytes(32).toString('base64url');
-  const { ticket: state } = pending.mint({ verifier, nonce, clientId: previous?.clientId ?? null, subject: previous?.subject ?? null }, now);
-  const query = new URLSearchParams({
-    ...returning(previous),
-    ext_agent_host_id: hostId,
-    response_type: 'code',
-    redirect_uri: CODEX_REDIRECT,
-    scope: SCOPE,
-    resource: OPENAI_API,
-    state,
-    nonce,
-    code_challenge_method: 'S256',
-    code_challenge: challenge,
-  });
-  return `${issuer}/api/accounts/authorize?${query.toString()}`;
-}
-
-function queryOf(raw: string): URLSearchParams {
-  const text = raw.trim();
-  try {
-    return new URL(text).searchParams;
-  } catch {
-    return new URLSearchParams(text.replace(/^\?/, ''));
-  }
-}
-
-const param = (query: URLSearchParams, name: string): string => query.get(name)?.trim() ?? '';
-
-function assertAllowed(query: URLSearchParams): void {
-  const error = param(query, 'error');
-  if (error === 'access_denied') throw new CodexAuthError('you did not allow Metro to use your ChatGPT plan, so nothing was saved');
-  if (error !== '') throw new CodexAuthError(`ChatGPT stopped the sign-in (${query.get('error_description') ?? error}); ${AGAIN}`);
-}
-
-export function parseCallback(raw: string): { code: string; state: string; clientId: string | null } {
-  const query = queryOf(raw);
-  assertAllowed(query);
-  const code = param(query, 'code');
-  const state = param(query, 'state');
-  if (code === '' || state === '') throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
-  return { code, state, clientId: nonEmpty(param(query, 'client_id')) };
-}
-
-export function decodeJwtPayload(jwt: string): Record<string, unknown> {
-  const part = jwt.split('.')[1] ?? '';
-  try {
-    const parsed: unknown = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
-    return isRecord(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-
-export function emailOf(claims: Record<string, unknown>): string | null {
-  const profile = isRecord(claims[PROFILE_CLAIM]) ? claims[PROFILE_CLAIM] : {};
-  return nonEmpty(claims.email) ?? nonEmpty(profile.email);
-}
-
-function identityOf(idToken: unknown, expected: { issuer: string; clientId: string; nonce: string }): { subject: string; email: string | null } {
-  const claims = decodeJwtPayload(typeof idToken === 'string' ? idToken : '');
-  const audience: unknown[] = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
-  const subject = nonEmpty(claims.sub);
-  if (subject === null || claims.iss !== expected.issuer || !audience.includes(expected.clientId) || claims.nonce !== expected.nonce)
-    throw new CodexAuthError(`OpenAI sent back an identity that does not match this sign-in; ${AGAIN}`);
-  return { subject, email: emailOf(claims) };
-}
-
-interface Encoded {
-  type: string;
-  body: string;
-}
-
-export const asForm = (fields: Record<string, string>): Encoded => ({ type: 'application/x-www-form-urlencoded', body: new URLSearchParams(fields).toString() });
-
-export const asJson = (fields: Record<string, string>): Encoded => ({ type: 'application/json', body: JSON.stringify(fields) });
-
-export async function tokenCall(url: string, sent: Encoded, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
-  const res = await fetchImpl(url, { method: 'POST', headers: { 'content-type': sent.type, accept: 'application/json' }, body: sent.body });
-  const raw = await res.text();
-  let parsed: unknown = null;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    parsed = null;
-  }
-  const body = isRecord(parsed) ? parsed : {};
-  if (!res.ok) throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? raw.slice(0, 300)}`);
-  return body;
-}
-
-export function grantOf(body: Record<string, unknown>, keptRefresh: string, now: number): Omit<CodexCredential, 'email'> {
-  const accessToken = nonEmpty(body.access_token) ?? '';
-  const refreshToken = nonEmpty(body.refresh_token) ?? keptRefresh;
-  if (accessToken === '' || refreshToken === '') throw new CodexAuthError('OpenAI returned no usable tokens; sign in again');
-  const ttl = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in * 1000 : DEFAULT_TTL_MS;
-  return { accessToken, refreshToken, expiresAt: now + ttl, savedAt: new Date(now).toISOString() };
-}
-
-const tokensFrom = (body: Record<string, unknown>, who: Pick<ChatgptTokens, 'clientId' | 'subject' | 'email'>, keptRefresh: string, now: number): ChatgptTokens => ({
-  method: 'chatgpt',
-  clientId: who.clientId,
-  subject: who.subject,
-  email: who.email,
-  ...grantOf(body, keptRefresh, now),
-});
-
-const officialToken = (issuer: string): string => `${issuer}/api/accounts/oauth/token`;
-
-function clientOf(started: Pending, returned: string | null): string {
-  const clientId = started.clientId ?? returned;
-  if (clientId === null || clientId === NEW_CLIENT) throw new CodexAuthError(`ChatGPT did not finish registering Metro; ${AGAIN}`);
-  if (returned !== null && returned !== clientId) throw new CodexAuthError(`ChatGPT answered for another Metro registration; ${AGAIN}`);
-  return clientId;
-}
-
-export async function finishLogin(callback: string, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<ChatgptTokens> {
-  const { code, state, clientId: returned } = parseCallback(callback);
-  const started = pending.take(state, now);
-  if (started === undefined) throw new CodexAuthError(`this sign-in link has expired or was started elsewhere; ${AGAIN}`);
-  const clientId = clientOf(started, returned);
-  const body = await tokenCall(
-    officialToken(issuer),
-    asForm({ grant_type: 'authorization_code', client_id: clientId, code, code_verifier: started.verifier, redirect_uri: CODEX_REDIRECT, resource: OPENAI_API }),
-    fetchImpl,
-  );
-  const who = identityOf(body.id_token, { issuer, clientId, nonce: started.nonce });
-  if (started.subject !== null && who.subject !== started.subject)
-    throw new CodexAuthError('this is another ChatGPT account than the one this connection signed in with; add a new connection for it');
-  const scopes = (nonEmpty(body.scope) ?? '').split(/\s+/);
-  if (!scopes.includes(PLAN_SCOPE)) throw new CodexAuthError('ChatGPT did not allow Metro to use your plan: sign in again and allow it (it needs ChatGPT Plus or Pro)');
-  return tokensFrom(body, { clientId, ...who }, '', now);
-}
-
-export async function refreshTokens(previous: ChatgptTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<ChatgptTokens> {
-  const body = await tokenCall(
-    officialToken(issuer),
-    asForm({ grant_type: 'refresh_token', client_id: previous.clientId, refresh_token: previous.refreshToken, resource: OPENAI_API }),
-    fetchImpl,
-  );
-  return tokensFrom(body, previous, previous.refreshToken, now);
-}
-
-export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean => now >= tokens.expiresAt - RENEW_BEFORE_MS;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-device.ts

@@ -1,119 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg } from '@metro-labs/core/log';
-import { stringOf } from '@metro-labs/http/api-http';
-import { asForm, asJson, CODEX_ISSUER, CodexAuthError, decodeJwtPayload, emailOf, grantOf, tokenCall, type CodeTokens } from './codex-auth.js';
-import { nonEmpty } from './text.js';
-
-const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
-const AUTH_CLAIM = 'https://api.openai.com/auth';
-const VERIFY_PATH = '/codex/device';
-const DEVICE_TTL_MS = 15 * 60_000;
-const DEFAULT_INTERVAL_S = 5;
-const ID_BYTES = 18;
-const AGAIN = 'press Sign in with a code again';
-
-export interface DeviceLogin {
-  id: string;
-  userCode: string;
-  verifyUrl: string;
-  interval: number;
-}
-
-export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodeTokens } | { status: 'failed'; error: string };
-
-interface Entry {
-  deviceAuthId: string;
-  userCode: string;
-  interval: number;
-  issuer: string;
-  startedAt: number;
-  polledAt: number | null;
-}
-
-const logins = new Map<string, Entry>();
-
-function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
-  const payload = decodeJwtPayload(idToken);
-  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
-  return { accountId: nonEmpty(auth.chatgpt_account_id), email: emailOf(payload), plan: nonEmpty(auth.chatgpt_plan_type) };
-}
-
-function codeTokensFrom(body: Record<string, unknown>, previous: CodeTokens | null, now: number): CodeTokens {
-  const fresh = claimsOf(nonEmpty(body.id_token) ?? '');
-  const kept = previous ?? { accountId: null, email: null, plan: null, refreshToken: '' };
-  const accountId = fresh.accountId ?? kept.accountId ?? '';
-  if (accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
-  return { method: 'code', accountId, email: fresh.email ?? kept.email, plan: fresh.plan ?? kept.plan, ...grantOf(body, kept.refreshToken, now) };
-}
-
-const cliToken = (issuer: string): string => `${issuer}/oauth/token`;
-
-export async function refreshCodeTokens(previous: CodeTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodeTokens> {
-  const body = await tokenCall(cliToken(issuer), asJson({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }), fetchImpl);
-  return codeTokensFrom(body, previous, now);
-}
-
-function intervalOf(value: unknown): number {
-  const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
-  return Number.isFinite(n) && n >= 1 ? Math.round(n) : DEFAULT_INTERVAL_S;
-}
-
-function sweep(now: number): void {
-  for (const [id, entry] of logins) if (now - entry.startedAt > DEVICE_TTL_MS) logins.delete(id);
-}
-
-const post = (url: string, body: unknown, fetchImpl: typeof fetch): Promise<Response> =>
-  fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
-
-export async function beginDeviceLogin(issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceLogin> {
-  sweep(now);
-  const res = await post(`${issuer}/api/accounts/deviceauth/usercode`, { client_id: CODEX_CLIENT_ID }, fetchImpl);
-  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the code sign-in right now; use Continue with ChatGPT instead');
-  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the code sign-in (${String(res.status)})`);
-  const body: unknown = await res.json();
-  const parsed = isRecord(body) ? body : {};
-  const deviceAuthId = stringOf(parsed.device_auth_id);
-  const userCode = stringOf(parsed.user_code) || stringOf(parsed.usercode);
-  if (deviceAuthId === '' || userCode === '') throw new CodexAuthError('OpenAI answered without a device code');
-  const id = randomBytes(ID_BYTES).toString('base64url');
-  const interval = intervalOf(parsed.interval);
-  logins.set(id, { deviceAuthId, userCode, interval, issuer, startedAt: now, polledAt: null });
-  return { id, userCode, verifyUrl: `${issuer}${VERIFY_PATH}`, interval };
-}
-
-async function claim(entry: Entry, fetchImpl: typeof fetch, now: number): Promise<DeviceStatus> {
-  const res = await post(`${entry.issuer}/api/accounts/deviceauth/token`, { device_auth_id: entry.deviceAuthId, user_code: entry.userCode }, fetchImpl);
-  if (res.status === 403 || res.status === 404) {
-    await res.body?.cancel();
-    return { status: 'pending' };
-  }
-  if (!res.ok) return { status: 'failed', error: `OpenAI ended the code sign-in (${String(res.status)})` };
-  const body: unknown = await res.json();
-  const parsed = isRecord(body) ? body : {};
-  const code = stringOf(parsed.authorization_code);
-  const verifier = stringOf(parsed.code_verifier);
-  if (code === '' || verifier === '') return { status: 'failed', error: 'OpenAI approved the sign-in but sent no code back' };
-  const granted = await tokenCall(
-    cliToken(entry.issuer),
-    asForm({ grant_type: 'authorization_code', code, redirect_uri: `${entry.issuer}/deviceauth/callback`, client_id: CODEX_CLIENT_ID, code_verifier: verifier }),
-    fetchImpl,
-  );
-  return { status: 'done', tokens: codeTokensFrom(granted, null, now) };
-}
-
-export async function pollDeviceLogin(id: string, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceStatus> {
-  sweep(now);
-  const entry = logins.get(id);
-  if (entry === undefined) throw new CodexAuthError(`this sign-in has expired or already finished; ${AGAIN}`);
-  if (entry.polledAt !== null && now - entry.polledAt < entry.interval * 1000) return { status: 'pending' };
-  entry.polledAt = now;
-  let result: DeviceStatus;
-  try {
-    result = await claim(entry, fetchImpl, now);
-  } catch (err) {
-    result = { status: 'failed', error: errMsg(err) };
-  }
-  if (result.status !== 'pending') logins.delete(id);
-  return result;
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-auth.ts

@@ -1,160 +0,0 @@
-import { isRecord } from '@metro-labs/core/is-record';
-import { PendingLogins } from './pkce.js';
-import { nonEmpty } from './text.js';
-
-const GEMINI_CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
-const GEMINI_CLIENT_SECRET = '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';
-const GEMINI_AUTH_BASE = 'https://accounts.google.com';
-const GEMINI_TOKEN_BASE = 'https://oauth2.googleapis.com';
-const GEMINI_REDIRECT = 'http://localhost:51121/oauth-callback';
-const SCOPE = [
-  'https://www.googleapis.com/auth/cloud-platform',
-  'https://www.googleapis.com/auth/userinfo.email',
-  'https://www.googleapis.com/auth/userinfo.profile',
-  'https://www.googleapis.com/auth/cclog',
-  'https://www.googleapis.com/auth/experimentsandconfigs',
-].join(' ');
-const EXPIRY_MARGIN_MS = 5 * 60_000;
-const DEFAULT_TTL_MS = 55 * 60_000;
-
-export interface GeminiTokens {
-  accessToken: string;
-  refreshToken: string;
-  expiresAt: number;
-  email: string | null;
-  project: string;
-  tier: string | null;
-  savedAt: string;
-}
-
-export class GeminiAuthError extends Error {}
-
-const pending = new PendingLogins(16);
-
-export function authorizeUrl(state: string, challenge: string, base = GEMINI_AUTH_BASE): string {
-  const params = new URLSearchParams({
-    client_id: GEMINI_CLIENT_ID,
-    redirect_uri: GEMINI_REDIRECT,
-    response_type: 'code',
-    scope: SCOPE,
-    access_type: 'offline',
-    prompt: 'consent',
-    code_challenge: challenge,
-    code_challenge_method: 'S256',
-    state,
-  });
-  return `${base}/o/oauth2/v2/auth?${params.toString()}`;
-}
-
-export function beginLogin(base = GEMINI_AUTH_BASE, now = Date.now()): { url: string; state: string } {
-  const { state, challenge } = pending.begin(now);
-  return { url: authorizeUrl(state, challenge, base), state };
-}
-
-
-const refusalIn = (body: Record<string, unknown>): string => nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? 'Google answered without an access token';
-
-function grantedTokens(body: unknown, previous: GeminiTokens | null): { accessToken: string; refreshToken: string; ttl: number } {
-  if (!isRecord(body)) throw new GeminiAuthError('Google answered without tokens');
-  const accessToken = nonEmpty(body.access_token);
-  if (accessToken === null) throw new GeminiAuthError(refusalIn(body));
-  const refreshToken = nonEmpty(body.refresh_token) ?? previous?.refreshToken ?? '';
-  if (refreshToken === '') throw new GeminiAuthError('Google issued no refresh token; sign in again');
-  return { accessToken, refreshToken, ttl: typeof body.expires_in === 'number' ? body.expires_in * 1000 : DEFAULT_TTL_MS };
-}
-
-function tokensOf(body: unknown, previous: GeminiTokens | null, now: number): GeminiTokens {
-  const granted = grantedTokens(body, previous);
-  return {
-    accessToken: granted.accessToken,
-    refreshToken: granted.refreshToken,
-    expiresAt: now + granted.ttl,
-    email: previous?.email ?? null,
-    project: previous?.project ?? '',
-    tier: previous?.tier ?? null,
-    savedAt: new Date(now).toISOString(),
-  };
-}
-
-async function tokenCall(form: Record<string, string>, base: string, fetchImpl: typeof fetch): Promise<unknown> {
-  let res: Response;
-  try {
-    res = await fetchImpl(`${base}/token`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams(form).toString(),
-      signal: AbortSignal.timeout(30_000),
-    });
-  } catch (err) {
-    throw new GeminiAuthError(`could not reach Google: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const body: unknown = await res.json().catch(() => null);
-  if (!res.ok) throw new GeminiAuthError(isRecord(body) ? (nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? `Google answered ${String(res.status)}`) : `Google answered ${String(res.status)}`);
-  return body;
-}
-
-function codeIn(pasted: string, state: string): string {
-  const trimmed = pasted.trim();
-  if (trimmed === '') throw new GeminiAuthError('paste the address the browser landed on, or the code in it');
-  if (!/^https?:\/\//i.test(trimmed)) return trimmed;
-  let url: URL;
-  try {
-    url = new URL(trimmed);
-  } catch {
-    throw new GeminiAuthError('that is not a full address');
-  }
-  const code = url.searchParams.get('code') ?? '';
-  const carried = url.searchParams.get('state');
-  if (code === '') throw new GeminiAuthError(`that address carries no code${url.searchParams.get('error') === null ? '' : ` (Google said ${url.searchParams.get('error') ?? ''})`}`);
-  if (carried !== null && carried !== state) throw new GeminiAuthError('that address belongs to another sign-in; start again and paste the new one');
-  return code;
-}
-
-export async function exchangeCode(pasted: string, state: string, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
-  const verifier = pending.take(state, now);
-  if (verifier === null) throw new GeminiAuthError('that sign-in has expired; start it again');
-  const code = codeIn(pasted, state);
-  const body = await tokenCall(
-    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: GEMINI_REDIRECT },
-    base,
-    fetchImpl,
-  );
-  return tokensOf(body, null, now);
-}
-
-export async function refreshTokens(previous: GeminiTokens, base = GEMINI_TOKEN_BASE, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<GeminiTokens> {
-  const body = await tokenCall(
-    { client_id: GEMINI_CLIENT_ID, client_secret: GEMINI_CLIENT_SECRET, grant_type: 'refresh_token', refresh_token: previous.refreshToken },
-    base,
-    fetchImpl,
-  );
-  return tokensOf(body, previous, now);
-}
-
-export const tokensStale = (tokens: GeminiTokens, now = Date.now()): boolean => tokens.expiresAt - EXPIRY_MARGIN_MS <= now;
-
-export async function userEmail(tokens: GeminiTokens, base = 'https://www.googleapis.com', fetchImpl: typeof fetch = fetch): Promise<string | null> {
-  try {
-    const res = await fetchImpl(`${base}/oauth2/v2/userinfo`, { headers: { authorization: `Bearer ${tokens.accessToken}` }, signal: AbortSignal.timeout(15_000) });
-    const body: unknown = await res.json().catch(() => null);
-    return res.ok && isRecord(body) ? nonEmpty(body.email) : null;
-  } catch {
-    return null;
-  }
-}
-
-export function tokensFromDisk(raw: unknown): GeminiTokens | null {
-  if (!isRecord(raw)) return null;
-  const accessToken = nonEmpty(raw.accessToken);
-  const refreshToken = nonEmpty(raw.refreshToken);
-  if (accessToken === null || refreshToken === null) return null;
-  return {
-    accessToken,
-    refreshToken,
-    expiresAt: typeof raw.expiresAt === 'number' ? raw.expiresAt : 0,
-    email: nonEmpty(raw.email),
-    project: nonEmpty(raw.project) ?? '',
-    tier: nonEmpty(raw.tier),
-    savedAt: nonEmpty(raw.savedAt) ?? '',
-  };
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gemini-client.ts

@@ -1,46 +0,0 @@
-import { randomUUID } from 'node:crypto';
-
-const CODE_ASSIST_BASE = 'https://cloudcode-pa.googleapis.com';
-const CODE_ASSIST_DAILY = 'https://daily-cloudcode-pa.googleapis.com';
-export const API = 'v1internal';
-const APP_VERSION = '2.0.3';
-const CLIENT_VERSION = '1.110.0';
-export const CLIENT_NAME = 'antigravity';
-const IDE_TYPE = 9;
-const PLUGIN_TYPE = 2;
-export const SYSTEM_PREFIX =
-  'You are Antigravity, a powerful agentic AI coding assistant designed by the Google Deepmind team working on Advanced Agentic Coding.You are pair programming with a USER to solve their coding task. The task may require creating a new codebase, modifying or debugging an existing codebase, or simply answering a question.**Absolute paths only****Proactiveness**';
-
-const PLATFORMS: Record<string, number> = { 'darwin-x64': 1, 'darwin-arm64': 2, 'linux-x64': 3, 'linux-arm64': 4, 'win32-x64': 5 };
-
-const osName = (): string => (process.platform === 'darwin' ? 'darwin' : process.platform === 'win32' ? 'win32' : 'linux');
-
-const platformCode = (): number => PLATFORMS[`${process.platform}-${process.arch}`] ?? 0;
-
-export const clientMetadata = (project: string | null): Record<string, unknown> => ({
-  ideType: IDE_TYPE,
-  platform: platformCode(),
-  pluginType: PLUGIN_TYPE,
-  ...(project === null ? {} : { duetProject: project }),
-});
-
-export const clientHeaders = (): Record<string, string> => ({
-  'user-agent': `${CLIENT_NAME}/${APP_VERSION} ${osName()}/${process.arch}`,
-  'x-client-name': CLIENT_NAME,
-  'x-client-version': CLIENT_VERSION,
-  'x-goog-api-client': 'gl-node/18.18.2 fire/0.8.6 grpc/1.10.x',
-});
-
-export type Bases = string | string[];
-
-const listed = (override: Bases): string[] => (typeof override === 'string' ? [override] : override);
-
-export const generateBases = (override?: Bases): string[] => (override === undefined ? [CODE_ASSIST_DAILY, CODE_ASSIST_BASE] : listed(override));
-
-export const setupBases = (override?: Bases): string[] => (override === undefined ? [CODE_ASSIST_BASE, CODE_ASSIST_DAILY] : listed(override));
-
-export const requestId = (): string => `agent-${randomUUID()}`;
-
-const sessionId = randomUUID();
-
-export const machineSessionId = (): string => sessionId;