@xkei/openclaude 0.30.0-antigravity

package/vendor/openclaude-antigravity-provider/src/auth.ts

@@ -0,0 +1,221 @@
+/**
+ * auth.ts
+ * Google OAuth 2.0 PKCE flow using Bun native crypto and fetch.
+ * No external dependencies — purely Bun built-ins.
+ */
+
+import {
+  GOOGLE_AUTH_URL,
+  GOOGLE_TOKEN_URL,
+  GOOGLE_OAUTH_CLIENT_ID,
+  GOOGLE_OAUTH_CLIENT_SECRET,
+  GOOGLE_OAUTH_REDIRECT_PORT,
+  GOOGLE_OAUTH_SCOPES,
+} from "./constants.ts";
+
+const REDIRECT_URI = `http://localhost:${GOOGLE_OAUTH_REDIRECT_PORT}/oauth-callback`;
+
+// ── PKCE helpers ──────────────────────────────────────────────────────────────
+
+function generateCodeVerifier(): string {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return btoa(String.fromCharCode(...bytes))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return btoa(String.fromCharCode(...new Uint8Array(digest)))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+// ── Public types ──────────────────────────────────────────────────────────────
+
+export interface AuthorizationUrlResult {
+  url: string;
+  verifier: string;
+  state: string;
+}
+
+export interface OAuthTokens {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  email?: string;
+}
+
+export interface AccessTokenResult {
+  access: string;
+  expires: number;
+}
+
+// ── Build the Google authorization URL ───────────────────────────────────────
+
+export async function buildAuthorizationUrl(): Promise<AuthorizationUrlResult> {
+  const verifier = generateCodeVerifier();
+  const challenge = await generateCodeChallenge(verifier);
+  const stateBytes = new Uint8Array(16);
+  crypto.getRandomValues(stateBytes);
+  const state = Array.from(stateBytes)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+
+  const params = new URLSearchParams({
+    client_id: GOOGLE_OAUTH_CLIENT_ID,
+    redirect_uri: REDIRECT_URI,
+    response_type: "code",
+    scope: GOOGLE_OAUTH_SCOPES,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state,
+    access_type: "offline",
+    prompt: "consent",
+  });
+
+  return { url: `${GOOGLE_AUTH_URL}?${params.toString()}`, verifier, state };
+}
+
+// ── Exchange authorization code for tokens ────────────────────────────────────
+
+export async function exchangeCodeForTokens(
+  code: string,
+  verifier: string,
+): Promise<OAuthTokens> {
+  const params = new URLSearchParams({
+    client_id: GOOGLE_OAUTH_CLIENT_ID,
+    client_secret: GOOGLE_OAUTH_CLIENT_SECRET,
+    code,
+    code_verifier: verifier,
+    grant_type: "authorization_code",
+    redirect_uri: REDIRECT_URI,
+  });
+
+  const res = await fetch(GOOGLE_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString(),
+  });
+
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`Token exchange failed (${res.status}): ${body}`);
+  }
+
+  const data = (await res.json()) as {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    id_token?: string;
+  };
+
+  // Decode email from id_token JWT payload
+  let email: string | undefined;
+  if (data.id_token) {
+    try {
+      const payloadB64 = data.id_token.split(".")[1]!;
+      const payload = JSON.parse(atob(payloadB64)) as { email?: string };
+      email = payload.email;
+    } catch {
+      // ignore decode errors
+    }
+  }
+
+  return {
+    access_token: data.access_token,
+    refresh_token: data.refresh_token,
+    expires_in: data.expires_in,
+    email,
+  };
+}
+
+// ── Refresh an existing access token ──────────────────────────────────────────
+
+export async function refreshAccessToken(
+  refreshToken: string,
+): Promise<AccessTokenResult> {
+  const params = new URLSearchParams({
+    client_id: GOOGLE_OAUTH_CLIENT_ID,
+    client_secret: GOOGLE_OAUTH_CLIENT_SECRET,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+  });
+
+  const res = await fetch(GOOGLE_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString(),
+  });
+
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`Token refresh failed (${res.status}): ${body}`);
+  }
+
+  const data = (await res.json()) as {
+    access_token: string;
+    expires_in: number;
+  };
+
+  return {
+    access: data.access_token,
+    // Subtract 60s buffer so we refresh before actual expiry
+    expires: Date.now() + data.expires_in * 1000 - 60_000,
+  };
+}
+
+export function accessTokenExpired(expires: number): boolean {
+  return Date.now() >= expires;
+}
+
+// ── Local OAuth callback server (Bun.serve) ───────────────────────────────────
+
+export function waitForOAuthCallback(
+  expectedState: string,
+): Promise<{ code: string; state: string }> {
+  return new Promise((resolve, reject) => {
+    let server: ReturnType<typeof Bun.serve> | null = null;
+
+    const timeout = setTimeout(() => {
+      server?.stop(true);
+      reject(new Error("OAuth callback timed out after 5 minutes."));
+    }, 5 * 60 * 1000);
+
+    server = Bun.serve({
+      port: GOOGLE_OAUTH_REDIRECT_PORT,
+      hostname: "localhost",
+      fetch(req) {
+        const url = new URL(req.url);
+        if (url.pathname !== "/oauth-callback") {
+          return new Response("Not found", { status: 404 });
+        }
+
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+
+        if (!code || state !== expectedState) {
+          return new Response("Invalid OAuth callback.", { status: 400 });
+        }
+
+        clearTimeout(timeout);
+        server?.stop(true);
+
+        resolve({ code, state });
+
+        return new Response(
+          `<html><body style="font-family:sans-serif;padding:40px;text-align:center">
+            <h2>Authentication successful!</h2>
+            <p>You can close this tab and return to OpenClaude.</p>
+          </body></html>`,
+          { headers: { "Content-Type": "text/html" } },
+        );
+      },
+    });
+  });
+}

package/vendor/openclaude-antigravity-provider/src/config.ts

@@ -0,0 +1,68 @@
+/**
+ * config.ts
+ * Reads ~/.openclaude.json and extracts the Gemini-CLI provider profile
+ * so the proxy can use its API key as a fallback when all Antigravity
+ * OAuth accounts are rate-limited on a Gemini model request.
+ */
+
+import { OPENCLAUDE_CONFIG_DIR } from "./constants.ts";
+import { join } from "node:path";
+
+export interface GeminiCliProfile {
+  /** The base URL without trailing slash, e.g.
+   *  "https://generativelanguage.googleapis.com/v1beta/openai" */
+  baseUrl: string;
+  /** Gemini API key */
+  apiKey: string;
+}
+
+interface ProviderProfile {
+  id: string;
+  name: string;
+  provider: string;
+  baseUrl: string;
+  model?: string;
+  apiKey?: string;
+}
+
+interface OpenClaudeConfig {
+  providerProfiles?: ProviderProfile[];
+}
+
+const CONFIG_FILE = join(OPENCLAUDE_CONFIG_DIR, "..", ".openclaude.json");
+
+// In-memory cache so we don't stat the file on every request.
+let cached: GeminiCliProfile | null | undefined = undefined; // undefined = not yet loaded
+
+export async function getGeminiCliProfile(): Promise<GeminiCliProfile | null> {
+  if (cached !== undefined) return cached;
+
+  try {
+    const file = Bun.file(CONFIG_FILE);
+    if (!(await file.exists())) {
+      cached = null;
+      return null;
+    }
+    const config = (await file.json()) as OpenClaudeConfig;
+    const profile = (config.providerProfiles ?? []).find(
+      (p) => p.provider === "gemini" && p.apiKey && p.baseUrl,
+    );
+    if (!profile || !profile.apiKey || !profile.baseUrl) {
+      cached = null;
+      return null;
+    }
+    cached = {
+      baseUrl: profile.baseUrl.replace(/\/$/, ""),
+      apiKey: profile.apiKey,
+    };
+    return cached;
+  } catch {
+    cached = null;
+    return null;
+  }
+}
+
+/** Call this after the user edits their provider profiles so the cache refreshes. */
+export function invalidateGeminiCliProfileCache(): void {
+  cached = undefined;
+}

package/vendor/openclaude-antigravity-provider/src/constants.ts

@@ -0,0 +1,139 @@
+/**
+ * constants.ts
+ * Antigravity API endpoints, model map, and storage paths.
+ * All paths anchored to ~/.openclaude/ (OpenClaude's config dir).
+ */
+
+export const PROXY_PORT = 51122;
+export const GOOGLE_OAUTH_REDIRECT_PORT = 51121;
+
+// Antigravity endpoint fallback order (daily → autopush → prod)
+export const ANTIGRAVITY_ENDPOINT_DAILY =
+  "https://daily-cloudcode-pa.sandbox.googleapis.com";
+export const ANTIGRAVITY_ENDPOINT_AUTOPUSH =
+  "https://autopush-cloudcode-pa.sandbox.googleapis.com";
+export const ANTIGRAVITY_ENDPOINT_PROD =
+  "https://cloudcode-pa.googleapis.com";
+
+// Primary endpoint used for requests — daily sandbox mirrors the OpenCode plugin
+// and has no per-account Free Tier quota limits (unlike the prod endpoint).
+export const ANTIGRAVITY_ENDPOINT = ANTIGRAVITY_ENDPOINT_DAILY;
+
+// Ordered fallback chain: try daily first, then autopush, then prod.
+export const ANTIGRAVITY_ENDPOINT_FALLBACKS = [
+  ANTIGRAVITY_ENDPOINT_DAILY,
+  ANTIGRAVITY_ENDPOINT_AUTOPUSH,
+  ANTIGRAVITY_ENDPOINT_PROD,
+] as const;
+
+// NOTE: The opencode-antigravity-auth plugin defaults to project
+// "rising-fact-p41fc", but that shared project is only usable by accounts
+// provisioned through its loadCodeAssist discovery flow. Our accounts have no
+// project IDs, and forcing this one is rejected with USER_PROJECT_DENIED.
+// The correct behavior is to OMIT x-goog-user-project when the account has
+// no project of its own — kept here for documentation only.
+export const ANTIGRAVITY_DEFAULT_PROJECT_ID = "rising-fact-p41fc";
+
+// Real Antigravity OAuth app credentials (from opencode-antigravity-auth)
+export const GOOGLE_OAUTH_CLIENT_ID =
+  "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+
+export const GOOGLE_OAUTH_CLIENT_SECRET = "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";
+
+export const GOOGLE_AUTH_URL =
+  "https://accounts.google.com/o/oauth2/v2/auth";
+
+export const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+
+// OpenClaude config directory (Windows: C:\Users\<user>\.openclaude)
+export const OPENCLAUDE_CONFIG_DIR =
+  `${process.env.USERPROFILE ?? process.env.HOME ?? "~"}/.openclaude`;
+
+export const ACCOUNTS_FILE = `${OPENCLAUDE_CONFIG_DIR}/antigravity-accounts.json`;
+
+export const PROXY_PID_FILE = `${OPENCLAUDE_CONFIG_DIR}/antigravity-proxy.pid`;
+
+// Exact scopes required by the Antigravity OAuth app
+export const GOOGLE_OAUTH_SCOPES = [
+  "https://www.googleapis.com/auth/cloud-platform",
+  "https://www.googleapis.com/auth/userinfo.email",
+  "https://www.googleapis.com/auth/userinfo.profile",
+  "https://www.googleapis.com/auth/cclog",
+  "https://www.googleapis.com/auth/experimentsandconfigs",
+].join(" ");
+
+// Maps OpenAI-style model names to Gemini API model names
+// (used by the generativelanguage Gemini-CLI fallback path)
+export const MODEL_MAP: Record<string, string> = {
+  "antigravity-claude-sonnet-4-6": "claude-sonnet-4-6",
+  "antigravity-claude-opus-4-6-thinking": "claude-opus-4-6",
+  "antigravity-gemini-3-pro": "gemini-3-pro-preview",
+  "antigravity-gemini-3.1-pro": "gemini-3.1-pro-preview",
+  "antigravity-gemini-3-flash": "gemini-3-flash-preview",
+  "gemini-2.5-flash": "gemini-2.5-flash",
+  "gemini-2.5-pro": "gemini-2.5-pro",
+  "gemini-3-flash-preview": "gemini-3-flash-preview",
+  "gemini-3-pro-preview": "gemini-3-pro-preview",
+  "gemini-3.1-pro-preview": "gemini-3.1-pro-preview",
+};
+
+// Maps exposed model IDs to the names served by the Antigravity daily sandbox.
+// Empirically verified (200 OK) against daily-cloudcode-pa.sandbox.googleapis.com:
+//   - Pro models REQUIRE a thinking-tier suffix (-low / -high)
+//   - Flash models use the BARE name (tier suffix -> 404)
+//   - Claude Sonnet uses the bare name; Claude Opus REQUIRES -thinking
+export const ANTIGRAVITY_MODEL_MAP: Record<string, string> = {
+  "antigravity-claude-sonnet-4-6": "claude-sonnet-4-6",
+  "antigravity-claude-opus-4-6-thinking": "claude-opus-4-6-thinking",
+  "antigravity-gemini-3-pro": "gemini-3-pro-low",
+  "antigravity-gemini-3.1-pro": "gemini-3.1-pro-low",
+  "antigravity-gemini-3-flash": "gemini-3-flash",
+  "gemini-2.5-flash": "gemini-2.5-flash",
+  "gemini-2.5-pro": "gemini-2.5-pro",
+  "gemini-3-flash-preview": "gemini-3-flash",
+  "gemini-3-pro-preview": "gemini-3-pro-low",
+  "gemini-3.1-pro-preview": "gemini-3.1-pro-low",
+};
+
+export const AVAILABLE_MODELS = Object.keys(MODEL_MAP);
+
+export function isClaudeModel(model: string): boolean {
+  return model.includes("claude");
+}
+
+export function resolveGeminiModel(model: string): string {
+  return MODEL_MAP[model] ?? model;
+}
+
+export function resolveAntigravityModel(model: string): string {
+  return ANTIGRAVITY_MODEL_MAP[model] ?? model;
+}
+
+// Antigravity-style User-Agent — the Antigravity Manager sends ONLY this
+// header (no X-Goog-Api-Client / Client-Metadata) on content requests.
+export function getAntigravityUserAgent(): string {
+  const platform = process.platform === "win32" ? "windows/amd64" : "darwin/arm64";
+  return `antigravity/1.18.3 ${platform}`;
+}
+
+const SYNTHETIC_PROJECT_ADJECTIVES = ["useful", "bright", "swift", "calm", "bold"];
+const SYNTHETIC_PROJECT_NOUNS = ["fuze", "wave", "spark", "flow", "core"];
+
+// Synthetic project id (same scheme as opencode-antigravity-auth). The daily
+// sandbox accepts arbitrary ids here — the project routes the request into
+// the Antigravity agent quota pool instead of the per-account free tier.
+export function generateSyntheticProjectId(): string {
+  const adj = SYNTHETIC_PROJECT_ADJECTIVES[Math.floor(Math.random() * SYNTHETIC_PROJECT_ADJECTIVES.length)]!;
+  const noun = SYNTHETIC_PROJECT_NOUNS[Math.floor(Math.random() * SYNTHETIC_PROJECT_NOUNS.length)]!;
+  const randomPart = crypto.randomUUID().slice(0, 5).toLowerCase();
+  return `${adj}-${noun}-${randomPart}`;
+}
+
+export function getAntigravityHeaders(): Record<string, string> {
+  const platform = process.platform === "win32" ? "WINDOWS" : "MACOS";
+  return {
+    "User-Agent": `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Antigravity/1.18.3 Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.36`,
+    "X-Goog-Api-Client": "google-cloud-sdk vscode_cloudshelleditor/0.1",
+    "Client-Metadata": `{"ideType":"ANTIGRAVITY","platform":"${platform}","pluginType":"GEMINI"}`,
+  };
+}

package/vendor/openclaude-antigravity-provider/src/gemini-fallback.ts

@@ -0,0 +1,157 @@
+/**
+ * gemini-fallback.ts
+ *
+ * When ALL Antigravity OAuth accounts are rate-limited on a Gemini model
+ * request, this module forwards the request directly to the official
+ * Google Gemini OpenAI-compatible endpoint using the Gemini-CLI API key
+ * stored in ~/.openclaude.json.
+ *
+ * Claude model requests are NOT routed here — they always return the 429
+ * back to OpenClaude so the normal per-provider retry logic applies.
+ *
+ * The Gemini endpoint at generativelanguage.googleapis.com/v1beta/openai
+ * is fully OpenAI-compatible, so no payload translation is needed.
+ * We only swap the model name to the native Gemini model ID.
+ */
+
+import type { OpenAIChatRequest } from "./transform.ts";
+import type { GeminiCliProfile } from "./config.ts";
+import { MODEL_MAP } from "./constants.ts";
+
+// ---------------------------------------------------------------------------
+// Resolve the native Gemini model name for the fallback request.
+// MODEL_MAP already has the mapping (e.g. "antigravity-gemini-3.1-pro" ->
+// "gemini-3.1-pro-preview").  Fall back to the model name as-is if it
+// doesn't appear in the map (e.g. the user already requested a raw model id).
+// ---------------------------------------------------------------------------
+function resolveNativeGeminiModel(model: string): string {
+  return MODEL_MAP[model] ?? model;
+}
+
+// ---------------------------------------------------------------------------
+// Build the fallback OpenAI-compatible payload.
+// We clone the original body and replace the model with the native name.
+// ---------------------------------------------------------------------------
+function buildFallbackPayload(body: OpenAIChatRequest): OpenAIChatRequest {
+  return {
+    ...body,
+    model: resolveNativeGeminiModel(body.model),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Forward a streaming request to the Gemini-CLI endpoint and pipe the
+// SSE stream back.  Returns a Response whose body is the upstream SSE stream.
+// ---------------------------------------------------------------------------
+async function streamFallback(
+  profile: GeminiCliProfile,
+  payload: OpenAIChatRequest,
+): Promise<Response> {
+  const upstream = await fetch(`${profile.baseUrl}/chat/completions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${profile.apiKey}`,
+    },
+    body: JSON.stringify(payload),
+  });
+
+  if (!upstream.ok || !upstream.body) {
+    const errText = await upstream.text().catch(() => "(unreadable)");
+    return new Response(
+      JSON.stringify({
+        error: {
+          message: `Gemini-CLI fallback upstream error (${upstream.status}): ${errText}`,
+          type: "upstream_error",
+        },
+      }),
+      {
+        status: upstream.status,
+        headers: { "Content-Type": "application/json" },
+      },
+    );
+  }
+
+  // Pipe the upstream SSE stream directly — the Gemini OpenAI-compatible
+  // endpoint emits standard "data: {...}\n\n" chunks identical to what
+  // OpenClaude expects, so no translation is required.
+  return new Response(upstream.body, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "Access-Control-Allow-Origin": "*",
+      "X-Antigravity-Fallback": "gemini-cli",
+    },
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Forward a non-streaming request to the Gemini-CLI endpoint.
+// ---------------------------------------------------------------------------
+async function jsonFallback(
+  profile: GeminiCliProfile,
+  payload: OpenAIChatRequest,
+): Promise<Response> {
+  const upstream = await fetch(`${profile.baseUrl}/chat/completions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${profile.apiKey}`,
+    },
+    body: JSON.stringify(payload),
+  });
+
+  const body = await upstream.text();
+
+  if (!upstream.ok) {
+    return new Response(
+      JSON.stringify({
+        error: {
+          message: `Gemini-CLI fallback upstream error (${upstream.status}): ${body}`,
+          type: "upstream_error",
+        },
+      }),
+      {
+        status: upstream.status,
+        headers: {
+          "Content-Type": "application/json",
+          "Access-Control-Allow-Origin": "*",
+        },
+      },
+    );
+  }
+
+  // Pass the JSON response through directly with the fallback header so
+  // logs / health checks can distinguish the path taken.
+  return new Response(body, {
+    status: 200,
+    headers: {
+      "Content-Type": "application/json",
+      "Access-Control-Allow-Origin": "*",
+      "X-Antigravity-Fallback": "gemini-cli",
+    },
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Public entry point called from server.ts when all Antigravity accounts
+// are exhausted on a Gemini model request.
+// ---------------------------------------------------------------------------
+export async function handleGeminiCliFallback(
+  body: OpenAIChatRequest,
+  profile: GeminiCliProfile,
+): Promise<Response> {
+  const payload = buildFallbackPayload(body);
+  const isStream = body.stream !== false;
+
+  console.log(
+    `[antigravity-provider] Gemini-CLI fallback: ${body.model} -> ${payload.model} (stream=${isStream})`,
+  );
+
+  if (isStream) {
+    return streamFallback(profile, payload);
+  }
+  return jsonFallback(profile, payload);
+}