clauderipple 0.6.0 → 0.8.0

package/dist/router/src/providers/google/login.js

@@ -0,0 +1,249 @@
+// Google Antigravity (Cloud Code Assist) sign-in: the OAuth authorization-code flow with PKCE, the
+// project discovery that follows it, and the account it leaves in the store.
+//
+// The loopback listener is preferred on port 51121 (the Antigravity desktop client's), falling back
+// to any free port — Google's installed-app clients accept an arbitrary loopback port, and the
+// redirect_uri in the token exchange is the one actually bound. state and PKCE verifier are per
+// attempt; a callback with the wrong state is refused without ending the attempt; an attempt expires
+// after 5 minutes.
+//
+// Wire facts (authorize params, token body, the userinfo call, project discovery) are taken from the
+// reference implementation opencodex as a behavioral spec (src/oauth/google-antigravity.ts) and are
+// **not measured live** — see docs/ARCHITECTURE.md §4d.
+import crypto from "node:crypto";
+import http from "node:http";
+import net from "node:net";
+import { redactErrorText } from "../../redact.js";
+import { saveGoogleAccount } from "./accounts.js";
+import { discoverProject, fetchUserEmail, GOOGLE_OAUTH } from "./antigravity.js";
+function base64url(buffer) {
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+ * Exchange an authorization code for a grant. The token endpoint is Google's, form-encoded, with the
+ * public client id and secret. Exported so the refresh path and tests can reuse it without a browser.
+ */
+export async function exchangeGoogleCode(opts) {
+    const res = await (opts.fetch ?? fetch)(GOOGLE_OAUTH.tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: GOOGLE_OAUTH.clientId,
+            client_secret: GOOGLE_OAUTH.clientSecret,
+            code: opts.code,
+            redirect_uri: opts.redirectUri,
+            code_verifier: opts.codeVerifier,
+        }).toString(),
+        signal: AbortSignal.timeout(GOOGLE_OAUTH.requestTimeoutMs),
+    });
+    const text = await res.text().catch(() => "");
+    if (!res.ok)
+        throw new Error(`Google sign-in was refused by the token endpoint: HTTP ${res.status} ${redactErrorText(text, [opts.code], 300)}`);
+    let j;
+    try {
+        j = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Google sign-in answered with something other than JSON");
+    }
+    if (typeof j.access_token !== "string" || j.access_token.length === 0)
+        throw new Error("Google sign-in returned no access token");
+    if (typeof j.refresh_token !== "string" || j.refresh_token.length === 0) {
+        // Without a refresh token every request would work until this one expires and then fail closed.
+        throw new Error("Google sign-in returned no refresh token (re-consent with access_type=offline and prompt=consent)");
+    }
+    const expiresIn = typeof j.expires_in === "number" && Number.isFinite(j.expires_in) && j.expires_in > 0 ? j.expires_in : 3600;
+    const now = (opts.now ?? Date.now)();
+    const [email, projectId] = await Promise.all([
+        fetchUserEmail(j.access_token, opts.fetch ?? fetch),
+        discoverProject(j.access_token, opts.fetch ?? fetch),
+    ]);
+    if (!projectId) {
+        // A credential with no Cloud Code Assist project would answer every request with an error while
+        // the dashboard reads "signed in". Fail the sign-in instead.
+        throw new Error("could not discover a Cloud Code Assist project for this account; make sure it has Antigravity/Cloud Code Assist access and try again");
+    }
+    return {
+        accessToken: j.access_token,
+        refreshToken: j.refresh_token,
+        projectId,
+        ...(email ? { email } : {}),
+        expiresAt: now + expiresIn * 1000,
+    };
+}
+/**
+ * One sign-in attempt. `start()` returns the authorize URL; the grant arrives through the loopback
+ * callback or `submitCode()`, whichever comes first; `result` resolves when the credential file is
+ * written or the attempt failed. A session is single-use.
+ */
+export class GoogleOAuthSession {
+    result;
+    options;
+    verifier = base64url(crypto.randomBytes(32));
+    state = crypto.randomBytes(16).toString("hex");
+    redirectUri = "";
+    server = null;
+    server6 = null;
+    settle;
+    grant;
+    timer = null;
+    exchanging = false;
+    finished = false;
+    stateSnapshot;
+    constructor(options, warning) {
+        this.options = options;
+        this.stateSnapshot = { running: false, url: null, startedAt: null, finishedAt: null, ok: null, error: null, account: null, termsWarning: warning };
+        this.grant = new Promise((resolve, reject) => {
+            this.settle = { resolve, reject };
+        });
+        this.result = this.grant.then((grant) => {
+            const account = saveGoogleAccount(options.home, grant);
+            this.stateSnapshot = { ...this.stateSnapshot, running: false, finishedAt: new Date().toISOString(), ok: true, account };
+        }, (error) => {
+            this.stateSnapshot = { ...this.stateSnapshot, running: false, finishedAt: new Date().toISOString(), ok: false, error: error.message };
+            throw error;
+        });
+        // Nobody may be awaiting `result` (the GUI polls state instead); do not surface it as unhandled.
+        this.result.catch(() => { });
+    }
+    get snapshot() {
+        return this.stateSnapshot;
+    }
+    /** The loopback port in use, once started. */
+    port = null;
+    /** Starts the loopback listener and returns the URL to open. */
+    async start() {
+        if (!(await this.listen(this.options.port ?? GOOGLE_OAUTH.port)) && !(await this.listen(0))) {
+            throw new Error(`could not open a loopback callback port (tried ${this.options.port ?? GOOGLE_OAUTH.port}); close whatever is using it and try again`);
+        }
+        this.redirectUri = `http://127.0.0.1:${this.port}${GOOGLE_OAUTH.callbackPath}`;
+        const url = new URL(GOOGLE_OAUTH.authorizeUrl);
+        url.search = new URLSearchParams({
+            response_type: "code",
+            client_id: GOOGLE_OAUTH.clientId,
+            redirect_uri: this.redirectUri,
+            scope: GOOGLE_OAUTH.scopes.join(" "),
+            code_challenge: base64url(crypto.createHash("sha256").update(this.verifier).digest()),
+            code_challenge_method: "S256",
+            access_type: "offline",
+            // select_account lets the user pick a different Google account when adding a second one.
+            prompt: "consent select_account",
+            state: this.state,
+        }).toString();
+        this.timer = setTimeout(() => this.fail(new Error("Google sign-in timed out; start it again")), GOOGLE_OAUTH.timeoutMs);
+        this.timer.unref();
+        this.stateSnapshot = { ...this.stateSnapshot, running: true, url: url.toString(), startedAt: new Date().toISOString(), finishedAt: null, ok: null, error: null, account: null };
+        return { url: url.toString(), port: this.port };
+    }
+    /** Accepts `code`, `code#state`, or the full redirect URL the browser landed on. */
+    async submitCode(input) {
+        if (this.finished || this.exchanging)
+            return;
+        let code = input.trim();
+        let state = null;
+        try {
+            const u = new URL(code);
+            code = u.searchParams.get("code") ?? "";
+            state = u.searchParams.get("state");
+        }
+        catch {
+            const hash = code.indexOf("#");
+            if (hash >= 0) {
+                state = code.slice(hash + 1) || null;
+                code = code.slice(0, hash);
+            }
+        }
+        if (!code) {
+            this.fail(new Error("no authorization code in what was pasted"));
+            return;
+        }
+        if (state !== null && state !== this.state) {
+            this.fail(new Error("the pasted code belongs to a different sign-in attempt"));
+            return;
+        }
+        await this.exchange(code);
+    }
+    /** Abandons the attempt (a new one may start). */
+    cancel() {
+        this.fail(new Error("Google sign-in cancelled"));
+    }
+    listen(port) {
+        return new Promise((resolve) => {
+            const handler = (req, res) => {
+                const u = new URL(req.url ?? "/", "http://localhost");
+                if (u.pathname !== GOOGLE_OAUTH.callbackPath) {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const error = u.searchParams.get("error");
+                const code = u.searchParams.get("code");
+                // A request that is not for this attempt (wrong or missing state) is refused but does not end
+                // the attempt: anything on the machine can hit a loopback port, and the real redirect may
+                // still be on its way.
+                if (u.searchParams.get("state") !== this.state || (!error && !code)) {
+                    res.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("Google sign-in: this is not the sign-in ClaudeRipple is waiting for. You can close this tab.");
+                    return;
+                }
+                if (error || !code) {
+                    const detail = redactErrorText(error ?? "missing authorization code", [], 200);
+                    res.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end(`Google sign-in failed: ${detail}. You can close this tab.`);
+                    this.fail(new Error(`Google refused the sign-in: ${detail}`));
+                    return;
+                }
+                res.writeHead(200, { "content-type": "text/plain; charset=utf-8" }).end("ClaudeRipple: Google account connected. You can close this tab.");
+                void this.exchange(code);
+            };
+            const server = http.createServer(handler);
+            server.once("error", () => resolve(false));
+            server.listen(port, "127.0.0.1", () => {
+                this.server = server;
+                this.port = server.address().port;
+                // The browser resolves "localhost" to ::1 or 127.0.0.1 as it likes; answer on both when IPv6
+                // loopback is available. Best effort.
+                const six = http.createServer(handler);
+                six.once("error", () => { });
+                six.listen(this.port, "::1", () => {
+                    if (this.finished) {
+                        six.close();
+                        return;
+                    }
+                    this.server6 = six;
+                });
+                resolve(true);
+            });
+        });
+    }
+    async exchange(code) {
+        if (this.finished || this.exchanging)
+            return;
+        this.exchanging = true;
+        try {
+            const grant = await exchangeGoogleCode({ code, codeVerifier: this.verifier, redirectUri: this.redirectUri, ...(this.options.fetch ? { fetch: this.options.fetch } : {}), ...(this.options.now ? { now: this.options.now } : {}) });
+            this.finish();
+            this.settle.resolve(grant);
+        }
+        catch (error) {
+            this.fail(error);
+        }
+    }
+    fail(error) {
+        if (this.finished)
+            return;
+        this.finish();
+        this.settle.reject(error);
+    }
+    finish() {
+        this.finished = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        for (const server of [this.server, this.server6]) {
+            if (!server)
+                continue;
+            server.close();
+            server.closeAllConnections?.();
+        }
+        this.server = null;
+        this.server6 = null;
+    }
+}

package/dist/router/src/providers/google/thoughtSignatures.js

@@ -0,0 +1,47 @@
+// thoughtSignature memory for the Google adapter (Gemini 3).
+//
+// Gemini 3 refuses a turn whose replayed functionCall part does not carry the `thoughtSignature`
+// the model attached to that call: the request comes back 400 "Function call is missing a
+// thought_signature in functionCall parts" (measured against Google's OpenAI-compatible endpoint,
+// microsoft/vscode#296713, 2026-10). Claude Code's history carries tool_use blocks, not Gemini
+// parts, so the signature has nowhere to live except here: the adapter stores it when the answer
+// arrives and puts it back on the matching functionCall when the same call is replayed.
+//
+// Keyed by the tool_use id we minted. That is stable for one tool call within a conversation, and
+// two conversations never share an id (the ids are random), so the store needs no further scoping.
+//
+// Bounded LRU: thought signatures are large opaque strings, and an unbounded map would grow for the
+// life of the process.
+/** Upper bound on remembered signatures. Far more than a conversation holds; small enough to forget. */
+const DEFAULT_LIMIT = 10_000;
+export class ThoughtSignatureStore {
+    // Insertion order is the LRU order: a get re-inserts, a set past the limit drops the oldest.
+    map = new Map();
+    limit;
+    constructor(limit = DEFAULT_LIMIT) {
+        this.limit = limit;
+    }
+    get(id) {
+        const value = this.map.get(id);
+        if (value === undefined)
+            return undefined;
+        // Refresh recency so a signature that keeps being replayed is not evicted under a busy store.
+        this.map.delete(id);
+        this.map.set(id, value);
+        return value;
+    }
+    set(id, signature) {
+        if (!id || !signature)
+            return;
+        if (this.map.has(id))
+            this.map.delete(id);
+        this.map.set(id, signature);
+        while (this.map.size > this.limit) {
+            const oldest = this.map.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.map.delete(oldest);
+        }
+    }
+    get size() { return this.map.size; }
+}