@vib-rato/ai 0.16.0

package/src/utils/oauth/opengateway.ts

@@ -0,0 +1,15 @@
+/** OpenGateway (by Sionic AI) login flow (API key paste, validated via /v1/models). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginOpenGateway = createApiKeyLogin({
+	providerLabel: "OpenGateway by Sionic AI",
+	authUrl: "https://opengateway.ai/dashboard",
+	instructions: "Create or copy your OpenGateway API key",
+	promptMessage: "Paste your OpenGateway API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "OpenGateway by Sionic AI",
+		modelsUrl: "https://apis.opengateway.ai/v1/models",
+	},
+});

package/src/utils/oauth/openrouter.ts

@@ -0,0 +1,16 @@
+/** OpenRouter login flow (API key paste against https://openrouter.ai/api/v1). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginOpenRouter = createApiKeyLogin({
+	providerLabel: "OpenRouter",
+	authUrl: "https://openrouter.ai/keys",
+	instructions: "Copy your API key from the OpenRouter dashboard",
+	promptMessage: "Paste your OpenRouter API key",
+	placeholder: "sk-or-v1-...",
+	validation: {
+		kind: "chat-completions",
+		provider: "OpenRouter",
+		baseUrl: "https://openrouter.ai/api/v1",
+		model: "openrouter/auto",
+	},
+});

package/src/utils/oauth/parallel.ts

@@ -0,0 +1,46 @@
+/**
+ * Parallel login flow.
+ *
+ * Parallel uses an API key from the account settings page.
+ * This is an API key flow:
+ * 1. Open browser to Parallel API key settings
+ * 2. User copies API key
+ * 3. User pastes key into the CLI/TUI
+ */
+
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://platform.parallel.ai/settings?tab=api-keys";
+
+/**
+ * Login to Parallel.
+ *
+ * Opens browser to the API keys page, prompts the user to paste their API key,
+ * and returns the API key directly.
+ */
+export async function loginParallel(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Parallel login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your Parallel API key from the Parallel settings page.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Parallel API key",
+		placeholder: "sk_...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	return trimmed;
+}

package/src/utils/oauth/perplexity.ts

@@ -0,0 +1,225 @@
+/**
+ * Perplexity login and token refresh.
+ *
+ * Login paths (in priority order):
+ * 1. macOS native app: reads JWT from NSUserDefaults (`defaults read ai.perplexity.mac authToken`)
+ * 2. HTTP email OTP: `GET /api/auth/csrf` → `POST /api/auth/signin-email` → `POST /api/auth/signin-otp`
+ *
+ * No browser or manual cookie paste required.
+ * Refresh: Socket.IO `refreshJWT` RPC over authenticated WebSocket connection.
+ *
+ * Protocol: Engine.IO v4 + Socket.IO v4 over WebSocket (bypasses Cloudflare managed challenge).
+ * Architecture reverse-engineered from Perplexity macOS app (ai.perplexity.mac).
+ */
+import * as os from "node:os";
+import { $env } from "@vib-rato/utils";
+import { $ } from "bun";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const API_VERSION = "2.18";
+const NATIVE_APP_BUNDLE = "ai.perplexity.mac";
+const APP_USER_AGENT = "Perplexity/641 CFNetwork/1568 Darwin/25.2.0";
+
+// ---------------------------------------------------------------------------
+// JWT helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Extract expiry from a JWT. Perplexity tokens generally lack an `exp` claim
+ * (their sessions are server-side and effectively non-expiring from the client's
+ * point of view), so we return a far-future sentinel when no `exp` is present.
+ * When `exp` IS present, subtract a 5-minute safety margin.
+ */
+const NEVER_EXPIRES = 8.64e15; // max safe Date value
+function getJwtExpiry(token: string): number {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return NEVER_EXPIRES;
+		const payload = parts[1] ?? "";
+		const decoded = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+		if (typeof decoded?.exp === "number" && Number.isFinite(decoded.exp)) {
+			return decoded.exp * 1000 - 5 * 60_000;
+		}
+	} catch {
+		// Ignore decode errors
+	}
+	return NEVER_EXPIRES;
+}
+
+/** Build OAuthCredentials from a Perplexity JWT string. */
+function jwtToCredentials(jwt: string, email?: string): OAuthCredentials {
+	return {
+		access: jwt,
+		refresh: jwt,
+		expires: getJwtExpiry(jwt),
+		email,
+	};
+}
+
+// ---------------------------------------------------------------------------
+// Desktop app extraction
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the Perplexity JWT from the native macOS Catalyst app's UserDefaults.
+ * Tokens are stored in NSUserDefaults (not Keychain), readable by any same-UID process.
+ */
+async function extractFromNativeApp(): Promise<string | null> {
+	if (os.platform() !== "darwin") return null;
+
+	try {
+		const result = await $`defaults read ${NATIVE_APP_BUNDLE} authToken`.quiet().nothrow();
+		if (result.exitCode !== 0) return null;
+		const token = result.text().trim();
+		if (!token || token === "(null)") return null;
+		return token;
+	} catch {
+		return null;
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Socket.IO email OTP login
+// ---------------------------------------------------------------------------
+
+/**
+ * Send email OTP and exchange it for a Perplexity JWT via HTTP endpoints.
+ */
+async function httpEmailLogin(ctrl: OAuthController): Promise<OAuthCredentials> {
+	if (!ctrl.onPrompt) {
+		throw new Error("Perplexity login requires onPrompt callback");
+	}
+	const email = await ctrl.onPrompt({
+		message: "Enter your Perplexity email address",
+		placeholder: "user@example.com",
+	});
+	const trimmedEmail = email.trim();
+	if (!trimmedEmail) throw new Error("Email is required for Perplexity login");
+	if (ctrl.signal?.aborted) throw new Error("Login cancelled");
+
+	ctrl.onProgress?.("Fetching Perplexity CSRF token...");
+	const csrfResponse = await fetch("https://www.perplexity.ai/api/auth/csrf", {
+		headers: {
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION,
+		},
+		signal: ctrl.signal,
+	});
+
+	if (!csrfResponse.ok) {
+		throw new Error(`Perplexity CSRF request failed: ${csrfResponse.status}`);
+	}
+
+	const csrfData = (await csrfResponse.json()) as { csrfToken?: string };
+	if (!csrfData.csrfToken) {
+		throw new Error("Perplexity CSRF response missing csrfToken");
+	}
+	ctrl.onProgress?.("Sending login code to your email...");
+	const sendResponse = await fetch("https://www.perplexity.ai/api/auth/signin-email", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION,
+		},
+		body: JSON.stringify({
+			email: trimmedEmail,
+			csrfToken: csrfData.csrfToken,
+		}),
+		signal: ctrl.signal,
+	});
+
+	if (!sendResponse.ok) {
+		const body = await sendResponse.text();
+		throw new Error(`Perplexity send login code failed (${sendResponse.status}): ${body}`);
+	}
+	const otp = await ctrl.onPrompt({
+		message: "Enter the code sent to your email",
+		placeholder: "123456",
+	});
+	const trimmedOtp = otp.trim();
+	if (!trimmedOtp) throw new Error("OTP code is required");
+	if (ctrl.signal?.aborted) throw new Error("Login cancelled");
+	ctrl.onProgress?.("Verifying login code...");
+	const verifyResponse = await fetch("https://www.perplexity.ai/api/auth/signin-otp", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION,
+		},
+		body: JSON.stringify({
+			email: trimmedEmail,
+			otp: trimmedOtp,
+			csrfToken: csrfData.csrfToken,
+		}),
+		signal: ctrl.signal,
+	});
+
+	const verifyData = (await verifyResponse.json()) as {
+		token?: string;
+		status?: string;
+		error_code?: string;
+		text?: string;
+	};
+
+	if (!verifyResponse.ok) {
+		const reason = verifyData.text ?? verifyData.error_code ?? verifyData.status ?? "OTP verification failed";
+		throw new Error(`Perplexity OTP verification failed: ${reason}`);
+	}
+
+	if (!verifyData.token) {
+		throw new Error("Perplexity OTP verification response missing token");
+	}
+
+	return jwtToCredentials(verifyData.token, trimmedEmail);
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Login to Perplexity.
+ *
+ * Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
+ *
+ * No browser/manual token paste fallback is used.
+ */
+/**
+ * Whether the operator disabled borrowing a token from the native macOS app.
+ *
+ * `VIB_AUTH_NO_BORROW` is the documented name; `PI_AUTH_NO_BORROW` is the legacy
+ * one that was the only name actually read.
+ */
+function authBorrowDisabled(): boolean {
+	return Boolean($env.VIB_AUTH_NO_BORROW || $env.PI_AUTH_NO_BORROW);
+}
+
+/** Test seam: the resolved native-app borrowing opt-out. */
+export function authBorrowDisabledForTest(): boolean {
+	return authBorrowDisabled();
+}
+
+export async function loginPerplexity(ctrl: OAuthController): Promise<OAuthCredentials> {
+	if (!ctrl.onPrompt) {
+		throw new Error("Perplexity login requires onPrompt callback");
+	}
+
+	// Path 1: Native macOS app JWT, skipped when the operator opts out.
+	//
+	// Presence-based on purpose: this is a privacy opt-out, so any set value must
+	// disable borrowing. A boolean contract would let `VIB_AUTH_NO_BORROW=0`
+	// silently re-enable reading a token out of another application.
+	if (!authBorrowDisabled()) {
+		ctrl.onProgress?.("Checking for Perplexity desktop app...");
+		const nativeJwt = await extractFromNativeApp();
+		if (nativeJwt) {
+			ctrl.onProgress?.("Found Perplexity JWT from native app");
+			return jwtToCredentials(nativeJwt);
+		}
+	}
+
+	// Path 2: HTTP email OTP
+	return httpEmailLogin(ctrl);
+}

package/src/utils/oauth/pkce.ts

@@ -0,0 +1,18 @@
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {
+	// Generate random verifier
+	const verifierBytes = new Uint8Array(96);
+	crypto.getRandomValues(verifierBytes);
+	const verifier = Buffer.from(verifierBytes).toString("base64url");
+
+	// Compute SHA-256 challenge
+	const encoder = new TextEncoder();
+	const data = encoder.encode(verifier);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+	const challenge = Buffer.from(hashBuffer).toString("base64url");
+
+	return { verifier, challenge };
+}

package/src/utils/oauth/qianfan.ts

@@ -0,0 +1,58 @@
+/**
+ * Qianfan login flow.
+ *
+ * Qianfan provides an OpenAI-compatible API endpoint.
+ * Login is API-key based:
+ * 1. Open browser to Qianfan API key console
+ * 2. User copies API key
+ * 3. User pastes key into CLI prompt
+ */
+
+import { validateOpenAICompatibleApiKey } from "./api-key-validation";
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://console.bce.baidu.com/qianfan/ais/console/apiKey";
+const API_BASE_URL = "https://qianfan.baidubce.com/v2";
+const VALIDATION_MODEL = "deepseek-v3.2";
+
+/**
+ * Login to Qianfan.
+ *
+ * Opens browser to API key page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginQianfan(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Qianfan login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your Qianfan API key from the console",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Qianfan API key",
+		placeholder: "bce-v3/ALTAK-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	options.onProgress?.("Validating API key...");
+	await validateOpenAICompatibleApiKey({
+		provider: "qianfan",
+		apiKey: trimmed,
+		baseUrl: API_BASE_URL,
+		model: VALIDATION_MODEL,
+		signal: options.signal,
+	});
+
+	return trimmed;
+}

package/src/utils/oauth/qwen-portal.ts

@@ -0,0 +1,60 @@
+/**
+ * Qwen Portal login flow.
+ *
+ * Qwen Portal exposes an OpenAI-compatible endpoint at https://portal.qwen.ai/v1
+ * and accepts OAuth bearer tokens or API keys.
+ *
+ * This is a token/API-key flow:
+ * 1. Open Qwen Portal
+ * 2. Copy either your OAuth token or API key
+ * 3. Paste it into the CLI
+ */
+
+import { validateOpenAICompatibleApiKey } from "./api-key-validation";
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://chat.qwen.ai";
+const API_BASE_URL = "https://portal.qwen.ai/v1";
+const VALIDATION_MODEL = "coder-model";
+
+/**
+ * Login to Qwen Portal.
+ *
+ * Prompts for either `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY` value.
+ * Returns the value directly (stored as api_key credential in auth storage).
+ */
+export async function loginQwenPortal(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Qwen Portal login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your Qwen OAuth token or API key",
+	});
+
+	const token = await options.onPrompt({
+		message: "Paste your Qwen OAuth token or API key",
+		placeholder: "sk-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = token.trim();
+	if (!trimmed) {
+		throw new Error("Qwen token/API key is required");
+	}
+
+	options.onProgress?.("Validating credentials...");
+	await validateOpenAICompatibleApiKey({
+		provider: "qwen-portal",
+		apiKey: trimmed,
+		baseUrl: API_BASE_URL,
+		model: VALIDATION_MODEL,
+		signal: options.signal,
+	});
+
+	return trimmed;
+}

package/src/utils/oauth/sglang.ts

@@ -0,0 +1,42 @@
+/**
+ * SGLang login flow.
+ *
+ * SGLang is commonly self-hosted with an OpenAI-compatible API at a local base URL.
+ * Some deployments require a bearer token, others allow unauthenticated access.
+ *
+ * This flow stores an API-key-style credential used by `/login` and auth storage.
+ */
+
+import type { OAuthController, OAuthProvider } from "./types";
+
+const PROVIDER_ID: OAuthProvider = "sglang";
+const AUTH_URL = "https://docs.sglang.io/docs/advanced_features/server_arguments.html";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:30000/v1";
+/**
+ * Login to SGLang.
+ *
+ * Opens SGLang OpenAI-compatible auth docs, prompts for a bearer token,
+ * and returns a stored key value. Local no-auth servers need no login.
+ */
+export async function loginSglang(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error(`${PROVIDER_ID} login requires onPrompt callback`);
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: `Paste the API key configured with SGLang's --api-key option. Local no-auth servers at ${DEFAULT_LOCAL_BASE_URL} are discovered automatically and do not need /login.`,
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your SGLang API key",
+		placeholder: "SGLang API key",
+		allowEmpty: false,
+	});
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("SGLang API key is required; local no-auth servers are discovered automatically");
+	}
+	return trimmed;
+}

package/src/utils/oauth/synthetic.ts

@@ -0,0 +1,15 @@
+/** Synthetic login flow (API key paste against https://api.synthetic.new/openai/v1). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginSynthetic = createApiKeyLogin({
+	providerLabel: "Synthetic",
+	authUrl: "https://dev.synthetic.new/docs/api/overview",
+	instructions: "Copy your API key from the Synthetic dashboard",
+	promptMessage: "Paste your Synthetic API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "Synthetic",
+		modelsUrl: "https://api.synthetic.new/openai/v1/models",
+	},
+});

package/src/utils/oauth/tavily.ts

@@ -0,0 +1,46 @@
+/**
+ * Tavily login flow.
+ *
+ * Tavily web search uses an API key from the account settings page.
+ * This is an API key flow:
+ * 1. Open browser to Tavily settings
+ * 2. User copies API key
+ * 3. User pastes key into CLI
+ */
+
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://app.tavily.com/home";
+
+/**
+ * Login to Tavily.
+ *
+ * Opens browser to API keys page and prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginTavily(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Tavily login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your Tavily API key from the API Keys page.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Tavily API key",
+		placeholder: "tvly-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	return trimmed;
+}

package/src/utils/oauth/together.ts

@@ -0,0 +1,16 @@
+/** Together login flow (API key paste against https://api.together.xyz/v1). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginTogether = createApiKeyLogin({
+	providerLabel: "Together",
+	authUrl: "https://api.together.xyz/settings/api-keys",
+	instructions: "Copy your API key from the Together dashboard",
+	promptMessage: "Paste your Together API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "chat-completions",
+		provider: "together",
+		baseUrl: "https://api.together.xyz/v1",
+		model: "moonshotai/Kimi-K2.5",
+	},
+});

package/src/utils/oauth/types.d.ts

@@ -0,0 +1,56 @@
+export type OAuthCredentials = {
+    refresh: string;
+    access: string;
+    expires: number;
+    enterpriseUrl?: string;
+    projectId?: string;
+    email?: string;
+    accountId?: string;
+};
+export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "commandcode-goat" | "opengateway" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sglang" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
+export type OAuthProviderId = OAuthProvider | (string & {});
+export type OAuthPrompt = {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+};
+export type OAuthAuthInfo = {
+    url: string;
+    instructions?: string;
+};
+export interface OAuthProviderInfo {
+    id: OAuthProviderId;
+    name: string;
+    available: boolean;
+}
+/** Per-login switches that change how the authorization code is delivered. */
+export interface OAuthLoginOptions {
+    /**
+     * Pair by pasting the authorization code the provider displays instead of
+     * waiting on a local loopback callback. Set when the browser completing the
+     * login has no network route back to the machine running vib (SSH, remote
+     * container, headless host). Providers without a paste-a-code redirect
+     * ignore it.
+     */
+    manualCode?: boolean;
+}
+export interface OAuthController {
+    onAuth?(info: OAuthAuthInfo): void;
+    onProgress?(message: string): void;
+    onManualCodeInput?(): Promise<string>;
+    onPrompt?(prompt: OAuthPrompt): Promise<string>;
+    signal?: AbortSignal;
+    fetch?: typeof globalThis.fetch;
+}
+export interface OAuthLoginCallbacks extends OAuthController {
+    onAuth: (info: OAuthAuthInfo) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+}
+export interface OAuthProviderInterface {
+    readonly id: OAuthProviderId;
+    readonly name: string;
+    readonly sourceId?: string;
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials | string>;
+    refreshToken?(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    getApiKey?(credentials: OAuthCredentials): string;
+}