@vib-rato/ai 0.16.0

package/src/utils/oauth/kiro.ts

@@ -0,0 +1,448 @@
+/**
+ * Kiro (Amazon Q Developer / CodeWhisperer) OAuth flow via AWS SSO OIDC.
+ *
+ * Implements the device-code authorization flow and token refresh using the
+ * published AWS SSO OIDC service model (botocore sso-oidc/2019-06-10).
+ *
+ * Clean-room: derived from the published Amazon SSO OIDC service model shapes
+ * and AWS public documentation, not from any third-party reference.
+ */
+import { scheduler } from "node:timers/promises";
+import type { OAuthCredentials } from "./types";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Published SSO OIDC endpoints and constants
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** Builder ID start URL for device authorization. */
+const BUILDER_ID_START_URL = "https://view.awsapps.com/start";
+
+/** Default AWS region for SSO OIDC. */
+const DEFAULT_REGION = "us-east-1";
+
+/** Client registration metadata for the Vibrato application. */
+const CLIENT_NAME = "vib-rato";
+const CLIENT_TYPE = "public";
+
+/**
+ * Scopes requested for CodeWhisperer / Amazon Q access. These are the published
+ * scopes from the AWS SSO OIDC model for the CodeWhisperer service.
+ */
+const CODEWHISPERER_SCOPES = [
+	"codewhisperer:completions",
+	"codewhisperer:analysis",
+	"codewhisperer:conversations",
+	"codewhisperer:transformations",
+	"codewhisperer:taskassist",
+	"sso:account:access",
+];
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Wire types (matching published SSO OIDC service model)
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface RegisterClientResponse {
+	clientId: string;
+	clientSecret: string;
+	clientIdIssuedAt: number;
+	clientSecretExpiresAt: number;
+	authorizationEndpoint?: string;
+	tokenEndpoint?: string;
+}
+
+interface StartDeviceAuthorizationResponse {
+	deviceCode: string;
+	userCode: string;
+	verificationUri: string;
+	verificationUriComplete?: string;
+	interval: number;
+	expiresIn: number;
+}
+
+interface CreateTokenSuccess {
+	accessToken: string;
+	tokenType: string;
+	expiresIn: number;
+	refreshToken?: string;
+}
+
+interface CreateTokenError {
+	error: string;
+	error_description?: string;
+	error_uri?: string;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Typed SSO OIDC error names from the published service model
+// ─────────────────────────────────────────────────────────────────────────────
+
+const SSO_OIDC_FATAL_ERRORS = new Set([
+	"access_denied_exception",
+	"expired_token_exception",
+	"internal_server_exception",
+	"invalid_client_exception",
+	"invalid_client_metadata_exception",
+	"invalid_grant_exception",
+	"invalid_redirect_uri_exception",
+	"invalid_request_exception",
+	"invalid_request_region_exception",
+	"invalid_scope_exception",
+	"unauthorized_client_exception",
+	"unsupported_grant_type_exception",
+]);
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Registration cache (client registration is reusable until expiry)
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface ClientRegistration {
+	clientId: string;
+	clientSecret: string;
+	expiresAt: number; // epoch ms
+}
+
+let cachedRegistration: ClientRegistration | undefined;
+
+/**
+ * Register a public SSO OIDC client. Registration responses include an expiry
+ * timestamp (`clientSecretExpiresAt`); we cache until then to avoid re-registering
+ * on every login attempt.
+ *
+ * The SSO OIDC `RegisterClient` endpoint is public (no authentication required).
+ */
+export async function registerClient(
+	region: string,
+	startUrl: string,
+	signal?: AbortSignal,
+): Promise<ClientRegistration> {
+	if (cachedRegistration && Date.now() < cachedRegistration.expiresAt - 60_000) {
+		return cachedRegistration;
+	}
+
+	const url = ssoOidcEndpoint(region, "/client/register");
+	const body = {
+		clientName: CLIENT_NAME,
+		clientType: CLIENT_TYPE,
+		scopes: CODEWHISPERER_SCOPES,
+		grantTypes: ["urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
+		redirectUris: [],
+		issuerUrl: startUrl,
+	};
+
+	const response = await fetchOidc(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		signal,
+	});
+
+	const data = (await response.json()) as RegisterClientResponse;
+	if (!data.clientId || !data.clientSecret) {
+		throw new Error("SSO OIDC RegisterClient: missing clientId or clientSecret");
+	}
+
+	cachedRegistration = {
+		clientId: data.clientId,
+		clientSecret: data.clientSecret,
+		// `clientSecretExpiresAt` is epoch seconds in the published model
+		expiresAt: data.clientSecretExpiresAt * 1000,
+	};
+	return cachedRegistration;
+}
+
+/** Drop cached client registration — used by tests. */
+export function clearClientRegistrationCache(): void {
+	cachedRegistration = undefined;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Device authorization flow
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Start device authorization. The SSO OIDC `StartDeviceAuthorization` endpoint
+ * is public (requires registered clientId/clientSecret, not SigV4).
+ */
+export async function startDeviceAuthorization(
+	region: string,
+	startUrl: string,
+	registration: ClientRegistration,
+	signal?: AbortSignal,
+): Promise<StartDeviceAuthorizationResponse> {
+	const url = ssoOidcEndpoint(region, "/device_authorization");
+	const body = {
+		clientId: registration.clientId,
+		clientSecret: registration.clientSecret,
+		startUrl,
+	};
+
+	const response = await fetchOidc(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		signal,
+	});
+
+	const data = (await response.json()) as StartDeviceAuthorizationResponse;
+	if (!data.deviceCode || !data.userCode || !data.verificationUri) {
+		throw new Error("SSO OIDC StartDeviceAuthorization: missing required fields");
+	}
+	return data;
+}
+
+/**
+ * Poll `CreateToken` until the user completes authorization or the device code
+ * expires. Handles `authorization_pending` (continue polling) and `slow_down`
+ * (increase interval) per the published SSO OIDC model.
+ */
+export async function pollForToken(
+	region: string,
+	registration: ClientRegistration,
+	deviceCode: string,
+	intervalSeconds: number,
+	expiresInSeconds: number,
+	signal?: AbortSignal,
+): Promise<CreateTokenSuccess> {
+	const url = ssoOidcEndpoint(region, "/token");
+	const deadline = Date.now() + expiresInSeconds * 1000;
+	let currentInterval = Math.max(intervalSeconds, 1) * 1000;
+
+	while (Date.now() < deadline) {
+		if (signal?.aborted) throw new Error("Login cancelled");
+
+		const remainingMs = deadline - Date.now();
+		const waitMs = Math.min(currentInterval, remainingMs);
+		try {
+			await scheduler.wait(waitMs, { signal });
+		} catch {
+			throw new Error("Login cancelled");
+		}
+
+		if (signal?.aborted) throw new Error("Login cancelled");
+
+		const body = {
+			clientId: registration.clientId,
+			clientSecret: registration.clientSecret,
+			grantType: "urn:ietf:params:oauth:grant-type:device_code",
+			deviceCode,
+		};
+
+		const response = await fetchOidc(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body),
+			signal,
+		});
+
+		const data = (await response.json()) as CreateTokenSuccess | CreateTokenError;
+
+		if ("accessToken" in data && typeof data.accessToken === "string") {
+			return data;
+		}
+
+		if ("error" in data) {
+			const errorCode = data.error;
+			if (errorCode === "authorization_pending") continue;
+			if (errorCode === "slow_down") {
+				currentInterval = Math.ceil(currentInterval * 1.5);
+				continue;
+			}
+			if (SSO_OIDC_FATAL_ERRORS.has(errorCode)) {
+				const desc = data.error_description ? `: ${data.error_description}` : "";
+				throw new Error(`SSO OIDC token error: ${errorCode}${desc}`);
+			}
+			// Unknown error — fail closed
+			const desc = data.error_description ? `: ${data.error_description}` : "";
+			throw new Error(`SSO OIDC unrecognized token error: ${errorCode}${desc}`);
+		}
+
+		throw new Error("SSO OIDC CreateToken: unrecognized response shape");
+	}
+
+	throw new Error("SSO OIDC device authorization timed out");
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Token refresh
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Refresh an expired access token using the stored refresh token via
+ * `CreateToken` with `grantType: "refresh_token"`.
+ *
+ * Rotation is published behavior: the response includes a new `refreshToken`.
+ * If the server does not return a new one, the old refresh token is retained.
+ */
+export async function refreshKiroToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
+	const region = DEFAULT_REGION;
+
+	// We need client registration to refresh. If we have a cached one, use it;
+	// otherwise re-register.
+	const registration = cachedRegistration ?? (await registerClient(region, BUILDER_ID_START_URL));
+
+	const url = ssoOidcEndpoint(region, "/token");
+	const body = {
+		clientId: registration.clientId,
+		clientSecret: registration.clientSecret,
+		grantType: "refresh_token",
+		refreshToken: credentials.refresh,
+	};
+
+	const response = await fetchOidc(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+	});
+
+	const data = (await response.json()) as CreateTokenSuccess | CreateTokenError;
+
+	if ("accessToken" in data && typeof data.accessToken === "string") {
+		const expiresAt = Date.now() + data.expiresIn * 1000;
+		return {
+			access: data.accessToken,
+			refresh: data.refreshToken ?? credentials.refresh,
+			expires: expiresAt,
+			enterpriseUrl: credentials.enterpriseUrl,
+			projectId: credentials.projectId,
+			email: credentials.email,
+			accountId: credentials.accountId,
+		};
+	}
+
+	if ("error" in data) {
+		const errorCode = data.error;
+		const desc = data.error_description ? `: ${data.error_description}` : "";
+		if (errorCode === "invalid_grant_exception" || errorCode === "invalid_grant") {
+			throw new Error(
+				`Kiro refresh token is invalid or expired. Run 'vib auth-broker login kiro' to re-authenticate. (${errorCode}${desc})`,
+			);
+		}
+		if (errorCode === "expired_token_exception") {
+			throw new Error(
+				`Kiro client registration has expired. Run 'vib auth-broker login kiro' to re-authenticate. (${errorCode}${desc})`,
+			);
+		}
+		throw new Error(`Kiro token refresh failed: ${errorCode}${desc}`);
+	}
+
+	throw new Error("Kiro token refresh: unrecognized response");
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Full login flow (device code)
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface KiroLoginOptions {
+	onAuth: (url: string, instructions?: string) => void;
+	onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;
+	onProgress?: (message: string) => void;
+	signal?: AbortSignal;
+	/** Override for tests. */
+	fetchImpl?: typeof globalThis.fetch;
+}
+
+export async function loginKiro(options: KiroLoginOptions): Promise<OAuthCredentials> {
+	const region = DEFAULT_REGION;
+	const startUrl = BUILDER_ID_START_URL;
+
+	if (options.signal?.aborted) throw new Error("Login cancelled");
+
+	options.onProgress?.("Registering client with AWS SSO OIDC...");
+	const registration = await registerClient(region, startUrl, options.signal);
+
+	if (options.signal?.aborted) throw new Error("Login cancelled");
+
+	options.onProgress?.("Requesting device authorization...");
+	const deviceAuth = await startDeviceAuthorization(region, startUrl, registration, options.signal);
+
+	const verificationUrl = deviceAuth.verificationUriComplete ?? deviceAuth.verificationUri;
+	options.onAuth(verificationUrl, `Enter code: ${deviceAuth.userCode}`);
+
+	options.onProgress?.("Waiting for authorization...");
+	const token = await pollForToken(
+		region,
+		registration,
+		deviceAuth.deviceCode,
+		deviceAuth.interval,
+		deviceAuth.expiresIn,
+		options.signal,
+	);
+
+	const expiresAt = Date.now() + token.expiresIn * 1000;
+	return {
+		access: token.accessToken,
+		refresh: token.refreshToken ?? "",
+		expires: expiresAt,
+	};
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// SSO cache import (reuse existing ~/.aws/sso/cache/*.json pattern)
+// ─────────────────────────────────────────────────────────────────────────────
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getTrustedHomeDir } from "@vib-rato/utils";
+
+interface SsoCachedAccessToken {
+	accessToken: string;
+	expiresAt?: number;
+	startUrl?: string;
+	region?: string;
+}
+
+/**
+ * Attempt to import a cached SSO access token from `~/.aws/sso/cache/`.
+ * Returns the token if a valid (non-expired) one exists, otherwise undefined.
+ *
+ * This reuses the documented AWS CLI SSO cache location, not any third-party
+ * credential store.
+ */
+export function importSsoCacheToken(): OAuthCredentials | undefined {
+	const homeDir = getTrustedHomeDir();
+	const cacheDir = path.join(homeDir, ".aws", "sso", "cache");
+
+	let files: string[];
+	try {
+		files = fs.readdirSync(cacheDir).filter(f => f.endsWith(".json"));
+	} catch {
+		return undefined;
+	}
+
+	for (const file of files) {
+		try {
+			const raw = fs.readFileSync(path.join(cacheDir, file), "utf8");
+			const cached = JSON.parse(raw) as SsoCachedAccessToken;
+			if (!cached.accessToken) continue;
+			if (cached.expiresAt && cached.expiresAt * 1000 < Date.now()) continue;
+			return {
+				access: cached.accessToken,
+				refresh: "",
+				expires: cached.expiresAt ? cached.expiresAt * 1000 : Date.now() + 3600_000,
+			};
+		} catch {}
+	}
+	return undefined;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+function ssoOidcEndpoint(region: string, pathSuffix: string): string {
+	return `https://oidc.${region}.amazonaws.com${pathSuffix}`;
+}
+
+async function fetchOidc(url: string, init: RequestInit & { signal?: AbortSignal }): Promise<Response> {
+	const response = await fetch(url, init);
+	if (!response.ok) {
+		let errorBody = "";
+		try {
+			errorBody = await response.text();
+		} catch {}
+		throw new Error(
+			`SSO OIDC request to ${url} failed: ${response.status} ${response.statusText}: ${errorBody.slice(0, 500)}`,
+		);
+	}
+	return response;
+}

package/src/utils/oauth/litellm.ts

@@ -0,0 +1,47 @@
+/**
+ * LiteLLM login flow.
+ *
+ * LiteLLM is an OpenAI-compatible proxy that routes requests to many upstream providers.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to LiteLLM docs/dashboard
+ * 2. User copies their LiteLLM API key
+ * 3. User pastes the API key into the CLI
+ */
+
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://docs.litellm.ai/docs/proxy/deploy";
+
+/**
+ * Login to LiteLLM.
+ *
+ * Opens browser to LiteLLM setup docs, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginLiteLLM(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("LiteLLM login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Run LiteLLM proxy (default http://localhost:4000/v1), then copy your master key or virtual key",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your LiteLLM API key (master key or virtual key)",
+		placeholder: "sk-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	return trimmed;
+}

package/src/utils/oauth/lm-studio.ts

@@ -0,0 +1,38 @@
+/**
+ * LM Studio login flow.
+ *
+ * LM Studio provides an OpenAI-compatible API at a local base URL.
+ * It usually runs unauthenticated but can be configured to require a bearer token.
+ *
+ * This flow stores an API-key-style credential used by `/login` and auth storage.
+ */
+
+import type { OAuthController, OAuthProvider } from "./types";
+
+const PROVIDER_ID: OAuthProvider = "lm-studio";
+export const DEFAULT_LOCAL_TOKEN = "lm-studio-local";
+
+/**
+ * Login to LM Studio.
+ *
+ * Opens LM Studio API docs, prompts for an optional token,
+ * and returns a stored key value.
+ */
+export async function loginLmStudio(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error(`${PROVIDER_ID} login requires onPrompt callback`);
+	}
+
+	const apiKey = await options.onPrompt({
+		message: "Optional: Paste LM Studio API key (to customize endpoint URL, set LM_STUDIO_BASE_URL env var)",
+		placeholder: DEFAULT_LOCAL_TOKEN,
+		allowEmpty: true,
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	return trimmed || DEFAULT_LOCAL_TOKEN;
+}

package/src/utils/oauth/mara.ts

@@ -0,0 +1,16 @@
+/** Mara Cloud login flow (API key paste, validated via chat completions). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginMara = createApiKeyLogin({
+	providerLabel: "Mara Cloud",
+	authUrl: "https://cloud.mara.com/apis",
+	instructions: "Create or copy your Mara Cloud API key",
+	promptMessage: "Paste your Mara Cloud API key",
+	placeholder: "<your-mara-api-key>",
+	validation: {
+		kind: "chat-completions",
+		provider: "Mara Cloud",
+		baseUrl: "https://api.cloud.mara.com/v1",
+		model: "DeepSeek-V3.1",
+	},
+});

package/src/utils/oauth/minimax-code.ts

@@ -0,0 +1,78 @@
+/**
+ * MiniMax Coding Plan login flow.
+ *
+ * MiniMax Coding Plan is a subscription service that provides access to
+ * MiniMax models (M2, M2.1) through an OpenAI-compatible API.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to https://platform.minimax.io/subscribe/coding-plan
+ * 2. User subscribes and copies their API key
+ * 3. User pastes the API key back into the CLI
+ *
+ * International: https://api.minimax.io/v1
+ * China: https://api.minimaxi.com/v1
+ */
+
+import { validateOpenAICompatibleApiKey } from "./api-key-validation";
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://platform.minimax.io/subscribe/coding-plan";
+const API_BASE_URL_INTL = "https://api.minimax.io/v1";
+const API_BASE_URL_CN = "https://api.minimaxi.com/v1";
+const VALIDATION_MODEL = "MiniMax-M2";
+
+/**
+ * Login to MiniMax Coding Plan (international).
+ *
+ * Opens browser to subscription page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginMiniMaxCode(options: OAuthController): Promise<string> {
+	return loginMiniMaxCodeWithBaseUrl(options, API_BASE_URL_INTL, "MiniMax Coding Plan");
+}
+
+async function loginMiniMaxCodeWithBaseUrl(
+	options: OAuthController,
+	baseUrl: string,
+	providerName: string,
+): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("MiniMax Coding Plan login requires onPrompt callback");
+	}
+	// Open browser to subscription page
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Subscribe to Coding Plan and copy your API key",
+	});
+	// Prompt user to paste their API key
+	const apiKey = await options.onPrompt({
+		message: "Paste your MiniMax Coding Plan API key",
+		placeholder: "sk-...",
+	});
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	options.onProgress?.("Validating API key...");
+	await validateOpenAICompatibleApiKey({
+		provider: providerName,
+		apiKey: trimmed,
+		baseUrl,
+		model: VALIDATION_MODEL,
+		signal: options.signal,
+	});
+	return trimmed;
+}
+
+/**
+ * Login to MiniMax Coding Plan (China).
+ *
+ * Same flow as international but uses China endpoint.
+ */
+export async function loginMiniMaxCodeCn(options: OAuthController): Promise<string> {
+	return loginMiniMaxCodeWithBaseUrl(options, API_BASE_URL_CN, "MiniMax Coding Plan (China)");
+}

package/src/utils/oauth/moonshot.ts

@@ -0,0 +1,16 @@
+/** Moonshot login flow (API key paste against https://api.moonshot.ai/v1). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginMoonshot = createApiKeyLogin({
+	providerLabel: "Moonshot",
+	authUrl: "https://platform.moonshot.ai/console/api-keys",
+	instructions: "Copy your API key from the Moonshot dashboard",
+	promptMessage: "Paste your Moonshot API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "chat-completions",
+		provider: "moonshot",
+		baseUrl: "https://api.moonshot.ai/v1",
+		model: "kimi-k2.5",
+	},
+});

package/src/utils/oauth/nanogpt.ts

@@ -0,0 +1,15 @@
+/** NanoGPT login flow (API key paste, validated via /models). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginNanoGPT = createApiKeyLogin({
+	providerLabel: "NanoGPT",
+	authUrl: "https://nano-gpt.com/api",
+	instructions: "Create or copy your NanoGPT API key",
+	promptMessage: "Paste your NanoGPT API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "NanoGPT",
+		modelsUrl: "https://nano-gpt.com/api/v1/models",
+	},
+});