gsd-pi 2.76.0 → 2.77.0-dev.2daa994b6

package/packages/pi-ai/src/providers/openai-completions.ts

@@ -39,6 +39,7 @@ import {
 	finalizeStream,
 	handleStreamError,
 } from "./openai-shared.js";
+import { ThinkTagParser } from "./think-tag-parser.js";
 import { transformMessagesWithReport } from "./transform-messages.js";
 
 /**
@@ -91,6 +92,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions", OpenA
 			stream.push({ type: "start", partial: output });
 
 			let currentBlock: TextContent | ThinkingContent | (ToolCall & { partialArgs?: string }) | null = null;
+			const thinkTagParser = new ThinkTagParser();
 			const blocks = output.content;
 			const blockIndex = () => blocks.length - 1;
 			const finishCurrentBlock = (block?: typeof currentBlock) => {
@@ -121,6 +123,55 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions", OpenA
 					}
 				}
 			};
+			const appendTextDelta = (delta: string) => {
+				if (!delta) return;
+				if (!currentBlock || currentBlock.type !== "text") {
+					finishCurrentBlock(currentBlock);
+					currentBlock = { type: "text", text: "" };
+					output.content.push(currentBlock);
+					stream.push({ type: "text_start", contentIndex: blockIndex(), partial: output });
+				}
+
+				if (currentBlock.type === "text") {
+					currentBlock.text += delta;
+					stream.push({
+						type: "text_delta",
+						contentIndex: blockIndex(),
+						delta,
+						partial: output,
+					});
+				}
+			};
+			const appendThinkingDelta = (delta: string) => {
+				if (!delta) return;
+				if (!currentBlock || currentBlock.type !== "thinking") {
+					finishCurrentBlock(currentBlock);
+					currentBlock = {
+						type: "thinking",
+						thinking: "",
+						thinkingSignature: "think-tag",
+					};
+					output.content.push(currentBlock);
+					stream.push({ type: "thinking_start", contentIndex: blockIndex(), partial: output });
+				}
+
+				if (currentBlock.type === "thinking") {
+					currentBlock.thinking += delta;
+					stream.push({
+						type: "thinking_delta",
+						contentIndex: blockIndex(),
+						delta,
+						partial: output,
+					});
+				}
+			};
+			const appendContentDelta = (delta: string) => {
+				const segments = thinkTagParser.consume(delta);
+				for (const segment of segments) {
+					if (segment.type === "thinking") appendThinkingDelta(segment.text);
+					else appendTextDelta(segment.text);
+				}
+			};
 
 			for await (const chunk of openaiStream) {
 				if (chunk.usage) {
@@ -161,22 +212,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions", OpenA
 						choice.delta.content !== undefined &&
 						choice.delta.content.length > 0
 					) {
-						if (!currentBlock || currentBlock.type !== "text") {
-							finishCurrentBlock(currentBlock);
-							currentBlock = { type: "text", text: "" };
-							output.content.push(currentBlock);
-							stream.push({ type: "text_start", contentIndex: blockIndex(), partial: output });
-						}
-
-						if (currentBlock.type === "text") {
-							currentBlock.text += choice.delta.content;
-							stream.push({
-								type: "text_delta",
-								contentIndex: blockIndex(),
-								delta: choice.delta.content,
-								partial: output,
-							});
-						}
+						appendContentDelta(choice.delta.content);
 					}
 
 					// Some endpoints return reasoning in reasoning_content (llama.cpp),
@@ -276,6 +312,11 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions", OpenA
 				}
 			}
 
+			for (const segment of thinkTagParser.flush()) {
+				if (segment.type === "thinking") appendThinkingDelta(segment.text);
+				else appendTextDelta(segment.text);
+			}
+
 			finishCurrentBlock(currentBlock);
 			assertStreamSuccess(output, options?.signal);
 			finalizeStream(stream, output);

package/packages/pi-ai/src/providers/simple-options.ts

@@ -1,9 +1,25 @@
 import type { Api, Model, SimpleStreamOptions, StreamOptions, ThinkingBudgets, ThinkingLevel } from "../types.js";
 
+/**
+ * Compute the default maxTokens for a model when no explicit value is provided.
+ *
+ * The 32 k cap is retained only for native Anthropic models (api === "anthropic-messages")
+ * where the Anthropic API historically rejected higher values. Custom and
+ * Anthropic-compatible models (e.g. OpenAI-completions, Vertex, etc.) use their
+ * declared model.maxTokens directly so that providers with larger output windows
+ * (131 072 tokens, etc.) are not silently capped.
+ */
+export function defaultMaxTokens(model: Model<Api>): number {
+	if (model.api === "anthropic-messages") {
+		return Math.min(model.maxTokens, 32000);
+	}
+	return model.maxTokens;
+}
+
 export function buildBaseOptions(model: Model<Api>, options?: SimpleStreamOptions, apiKey?: string): StreamOptions {
 	return {
 		temperature: options?.temperature,
-		maxTokens: options?.maxTokens || Math.min(model.maxTokens, 32000),
+		maxTokens: options?.maxTokens || defaultMaxTokens(model),
 		signal: options?.signal,
 		apiKey: apiKey || options?.apiKey,
 		cacheRetention: options?.cacheRetention,

package/packages/pi-ai/src/providers/think-tag-parser.test.ts

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { ThinkTagParser } from "./think-tag-parser.js";
+
+describe("ThinkTagParser", () => {
+	it("keeps plain text untouched", () => {
+		const parser = new ThinkTagParser();
+		assert.deepEqual(parser.consume("hello world"), [{ type: "text", text: "hello world" }]);
+		assert.deepEqual(parser.flush(), []);
+	});
+
+	it("splits inline think tags into thinking segments", () => {
+		const parser = new ThinkTagParser();
+		const out = parser.consume("A<think>B</think>C");
+		assert.deepEqual(out, [
+			{ type: "text", text: "A" },
+			{ type: "thinking", text: "B" },
+			{ type: "text", text: "C" },
+		]);
+	});
+
+	it("handles tag boundaries across deltas", () => {
+		const parser = new ThinkTagParser();
+		const out1 = parser.consume("A<th");
+		const out2 = parser.consume("ink>B</thi");
+		const out3 = parser.consume("nk>C");
+		const out4 = parser.flush();
+		assert.deepEqual([...out1, ...out2, ...out3, ...out4], [
+			{ type: "text", text: "A" },
+			{ type: "thinking", text: "B" },
+			{ type: "text", text: "C" },
+		]);
+	});
+
+	it("flushes unclosed think blocks as thinking", () => {
+		const parser = new ThinkTagParser();
+		const out1 = parser.consume("A<think>partial");
+		const out2 = parser.flush();
+		assert.deepEqual([...out1, ...out2], [
+			{ type: "text", text: "A" },
+			{ type: "thinking", text: "partial" },
+		]);
+	});
+});

package/packages/pi-ai/src/providers/think-tag-parser.ts

@@ -0,0 +1,94 @@
+export type ThinkSegmentType = "text" | "thinking";
+
+export interface ThinkSegment {
+	type: ThinkSegmentType;
+	text: string;
+}
+
+interface ThinkTagParserState {
+	mode: ThinkSegmentType;
+	pending: string;
+}
+
+const OPEN_TAG = "<think>";
+const CLOSE_TAG = "</think>";
+
+function trailingPartialLength(text: string, token: string): number {
+	const max = Math.min(text.length, token.length - 1);
+	for (let len = max; len > 0; len--) {
+		if (token.startsWith(text.slice(-len))) return len;
+	}
+	return 0;
+}
+
+/**
+ * Stateful parser for streaming `<think>...</think>` wrappers emitted by some
+ * OpenAI-compatible providers. Converts tagged sections into logical
+ * text/thinking segments while handling chunk boundaries safely.
+ */
+export class ThinkTagParser {
+	private state: ThinkTagParserState = { mode: "text", pending: "" };
+
+	consume(delta: string): ThinkSegment[] {
+		this.state.pending += delta;
+		return this.drain(false);
+	}
+
+	flush(): ThinkSegment[] {
+		return this.drain(true);
+	}
+
+	private drain(flushAll: boolean): ThinkSegment[] {
+		const out: ThinkSegment[] = [];
+		const push = (type: ThinkSegmentType, text: string) => {
+			if (!text) return;
+			out.push({ type, text });
+		};
+
+		while (this.state.pending.length > 0) {
+			if (this.state.mode === "text") {
+				const openIdx = this.state.pending.indexOf(OPEN_TAG);
+				if (openIdx >= 0) {
+					push("text", this.state.pending.slice(0, openIdx));
+					this.state.pending = this.state.pending.slice(openIdx + OPEN_TAG.length);
+					this.state.mode = "thinking";
+					continue;
+				}
+
+				if (flushAll) {
+					push("text", this.state.pending);
+					this.state.pending = "";
+					break;
+				}
+
+				const keep = trailingPartialLength(this.state.pending, OPEN_TAG);
+				const safeEnd = Math.max(0, this.state.pending.length - keep);
+				push("text", this.state.pending.slice(0, safeEnd));
+				this.state.pending = this.state.pending.slice(safeEnd);
+				break;
+			}
+
+			const closeIdx = this.state.pending.indexOf(CLOSE_TAG);
+			if (closeIdx >= 0) {
+				push("thinking", this.state.pending.slice(0, closeIdx));
+				this.state.pending = this.state.pending.slice(closeIdx + CLOSE_TAG.length);
+				this.state.mode = "text";
+				continue;
+			}
+
+			if (flushAll) {
+				push("thinking", this.state.pending);
+				this.state.pending = "";
+				break;
+			}
+
+			const keep = trailingPartialLength(this.state.pending, CLOSE_TAG);
+			const safeEnd = Math.max(0, this.state.pending.length - keep);
+			push("thinking", this.state.pending.slice(0, safeEnd));
+			this.state.pending = this.state.pending.slice(safeEnd);
+			break;
+		}
+
+		return out;
+	}
+}

package/packages/pi-ai/src/utils/oauth/github-copilot.test.ts

@@ -1,28 +1,46 @@
+import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import test from "node:test";
-
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { Api, Model } from "../../types.js";
-import type { OAuthCredentials } from "./index.js";
-import { githubCopilotOAuthProvider } from "./github-copilot.js";
+import type { OAuthCredentials } from "./types.js";
+import {
+	getGitHubCopilotBaseUrl,
+	githubCopilotOAuthProvider,
+	normalizeDomain,
+} from "./github-copilot.js";
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url));
+const packageRoot = join(__dirname, "..", "..", "..");
+const sourceDir = existsSync(join(__dirname, "github-copilot.ts"))
+	? __dirname
+	: join(packageRoot, "src", "utils", "oauth");
+
+function readSourceFile(name: string): string {
+	return readFileSync(join(sourceDir, name), "utf-8");
+}
 
-function makeModel(provider: string, id: string): Model<Api> {
+function createModel(overrides: Partial<Model<Api>> = {}): Model<Api> {
 	return {
-		id,
-		name: id,
+		id: "test-model",
+		name: "Test Model",
 		api: "openai-completions",
-		provider,
-		baseUrl: `${provider}:`,
+		provider: "test-provider",
+		baseUrl: "https://example.com",
 		reasoning: false,
 		input: ["text"],
 		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
 		contextWindow: 128000,
-		maxTokens: 16384,
-	};
+		maxTokens: 8192,
+		...overrides,
+	} as Model<Api>;
 }
 
-function makeCredentials(overrides: Partial<OAuthCredentials & { modelLimits?: Record<string, { contextWindow: number; maxTokens: number }> }> = {}) {
+function makeCredentials(
+	overrides: Partial<OAuthCredentials & { modelLimits?: Record<string, { contextWindow: number; maxTokens: number }> }> = {},
+) {
 	return {
-		type: "oauth" as const,
 		access: "copilot-token",
 		refresh: "refresh-token",
 		expires: Date.now() + 60_000,
@@ -30,19 +48,178 @@ function makeCredentials(overrides: Partial<OAuthCredentials & { modelLimits?: R
 	};
 }
 
+describe("GitHub Copilot OAuth — normalizeDomain", () => {
+	test("returns null for empty input", () => {
+		assert.equal(normalizeDomain(""), null);
+		assert.equal(normalizeDomain("   "), null);
+	});
+
+	test("returns null for invalid domain", () => {
+		assert.equal(normalizeDomain("not a domain!@#"), null);
+	});
+
+	test("extracts hostname from full URL", () => {
+		assert.equal(normalizeDomain("https://github.com"), "github.com");
+		assert.equal(normalizeDomain("https://company.ghe.com"), "company.ghe.com");
+		assert.equal(normalizeDomain("http://example.com/path"), "example.com");
+	});
+
+	test("returns domain as-is when no protocol", () => {
+		assert.equal(normalizeDomain("github.com"), "github.com");
+		assert.equal(normalizeDomain("company.ghe.com"), "company.ghe.com");
+	});
+
+	test("trims whitespace", () => {
+		assert.equal(normalizeDomain("  github.com  "), "github.com");
+	});
+});
+
+describe("GitHub Copilot OAuth — getBaseUrlFromToken", () => {
+	test("extracts API URL from token with proxy-ep", () => {
+		const token = "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token);
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("extracts API URL from enterprise proxy-ep", () => {
+		const token = "tid=123;exp=1234567890;proxy-ep=proxy.company.ghe.com;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token);
+		assert.equal(baseUrl, "https://api.company.ghe.com");
+	});
+
+	test("falls back to default when no token provided", () => {
+		const baseUrl = getGitHubCopilotBaseUrl();
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("falls back to default when token has no proxy-ep", () => {
+		const token = "tid=123;exp=1234567890;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token);
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("uses enterprise domain when provided", () => {
+		const baseUrl = getGitHubCopilotBaseUrl(undefined, "company.ghe.com");
+		assert.equal(baseUrl, "https://copilot-api.company.ghe.com");
+	});
+
+	test("prioritizes token proxy-ep over enterprise domain", () => {
+		const token = "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token, "company.ghe.com");
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+});
+
+describe("GitHub Copilot OAuth — provider structure", () => {
+	test("has correct id and name", () => {
+		assert.equal(githubCopilotOAuthProvider.id, "github-copilot");
+		assert.equal(githubCopilotOAuthProvider.name, "GitHub Copilot");
+	});
+
+	test("has required methods", () => {
+		assert.equal(typeof githubCopilotOAuthProvider.login, "function");
+		assert.equal(typeof githubCopilotOAuthProvider.refreshToken, "function");
+		assert.equal(typeof githubCopilotOAuthProvider.getApiKey, "function");
+		assert.equal(typeof githubCopilotOAuthProvider.modifyModels, "function");
+	});
+
+	test("getApiKey returns access token", () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+		};
+		const apiKey = githubCopilotOAuthProvider.getApiKey(credentials);
+		assert.equal(apiKey, "test-access-token");
+	});
+
+	test("modifyModels preserves non-Copilot models", () => {
+		if (!githubCopilotOAuthProvider.modifyModels) return;
+		const models = [createModel({ id: "gpt-4", provider: "openai" })];
+		const credentials: OAuthCredentials = {
+			access: "test-token",
+			refresh: "test-refresh",
+			expires: Date.now() + 3600000,
+		};
+		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
+		assert.deepEqual(result, models);
+	});
+
+	test("modifyModels updates Copilot model baseUrl when token has proxy-ep", () => {
+		if (!githubCopilotOAuthProvider.modifyModels) return;
+		const models = [
+			createModel({
+				id: "claude-3.5-sonnet",
+				provider: "github-copilot",
+				baseUrl: "https://api.default.com",
+			}),
+		];
+		const credentials: OAuthCredentials = {
+			access: "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;",
+			refresh: "test-refresh",
+			expires: Date.now() + 3600000,
+		};
+		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
+		assert.equal(result[0].baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("modifyModels applies model limits when available", () => {
+		if (!githubCopilotOAuthProvider.modifyModels) return;
+		const models = [
+			createModel({
+				id: "claude-3.5-sonnet",
+				provider: "github-copilot",
+				baseUrl: "https://api.default.com",
+			}),
+		];
+		const credentials = {
+			access: "test-token",
+			refresh: "test-refresh",
+			expires: Date.now() + 3600000,
+			modelLimits: {
+				"claude-3.5-sonnet": { contextWindow: 123456, maxTokens: 4096 },
+			},
+		};
+		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
+		assert.equal(result[0].contextWindow, 123456);
+		assert.equal(result[0].maxTokens, 4096);
+	});
+});
+
+describe("GitHub Copilot OAuth — credential regression", () => {
+	test("module imports successfully", () => {
+		assert.ok(githubCopilotOAuthProvider);
+	});
+
+	test("CLIENT_ID is plaintext (not base64)", () => {
+		const content = readSourceFile("github-copilot.ts");
+		assert.ok(content.includes('CLIENT_ID = "Iv1.b507a08c87ecfe98"'));
+		assert.ok(!content.includes("atob("));
+	});
+
+	test("security explanation comments are present", () => {
+		const content = readSourceFile("github-copilot.ts");
+		assert.ok(content.includes("NOTE: This credential is public"));
+		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+	});
+});
+
 test("githubCopilotOAuthProvider.modifyModels filters unavailable copilot models (#3849)", () => {
 	const models = [
-		makeModel("github-copilot", "gpt-5"),
-		makeModel("github-copilot", "claude-sonnet-4"),
-		makeModel("openai", "gpt-4.1"),
+		createModel({ provider: "github-copilot", id: "gpt-5", name: "gpt-5", baseUrl: "github-copilot:" }),
+		createModel({ provider: "github-copilot", id: "claude-sonnet-4", name: "claude-sonnet-4", baseUrl: "github-copilot:" }),
+		createModel({ provider: "openai", id: "gpt-4.1", name: "gpt-4.1", baseUrl: "openai:" }),
 	];
 
 	assert.ok(githubCopilotOAuthProvider.modifyModels, "github copilot provider should expose modifyModels");
-	const modified = githubCopilotOAuthProvider.modifyModels(models, makeCredentials({
-		modelLimits: {
-			"gpt-5": { contextWindow: 256000, maxTokens: 32000 },
-		},
-	}));
+	const modified = githubCopilotOAuthProvider.modifyModels(
+		models,
+		makeCredentials({
+			modelLimits: {
+				"gpt-5": { contextWindow: 256000, maxTokens: 32000 },
+			},
+		}),
+	);
 
 	assert.deepEqual(
 		modified.map((model) => `${model.provider}/${model.id}`),
@@ -58,8 +235,8 @@ test("githubCopilotOAuthProvider.modifyModels filters unavailable copilot models
 
 test("githubCopilotOAuthProvider.modifyModels keeps all copilot models when limits are unavailable", () => {
 	const models = [
-		makeModel("github-copilot", "gpt-5"),
-		makeModel("github-copilot", "claude-sonnet-4"),
+		createModel({ provider: "github-copilot", id: "gpt-5", name: "gpt-5", baseUrl: "github-copilot:" }),
+		createModel({ provider: "github-copilot", id: "claude-sonnet-4", name: "claude-sonnet-4", baseUrl: "github-copilot:" }),
 	];
 
 	assert.ok(githubCopilotOAuthProvider.modifyModels, "github copilot provider should expose modifyModels");

package/packages/pi-ai/src/utils/oauth/github-copilot.ts

@@ -12,8 +12,18 @@ type CopilotCredentials = OAuthCredentials & {
 	modelLimits?: Record<string, { contextWindow: number; maxTokens: number }>;
 };
 
-const decode = (s: string) => atob(s);
-const CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+// GitHub Copilot OAuth Client ID
+//
+// NOTE: This credential is public in the source code. It should NOT be
+// obfuscated because security scanners flag obfuscated data as potentially
+// malicious (see: https://socket.dev/npm/package/gsd-pi/alerts/2.70.1?alert_name=obfuscatedFile)
+//
+// GitHub's device flow for public clients (CLI/desktop apps) does not use
+// a client secret - only the client ID is required. This is standard OAuth
+// for public clients and is intentionally public.
+//
+// See: https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps
+const CLIENT_ID = "Iv1.b507a08c87ecfe98";
 
 const COPILOT_HEADERS = {
 	"User-Agent": "GitHubCopilotChat/0.35.0",

package/packages/pi-ai/src/utils/oauth/google-antigravity.test.ts

@@ -0,0 +1,84 @@
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { OAuthCredentials } from "./types.js";
+import { antigravityOAuthProvider } from "./google-antigravity.js";
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url));
+const packageRoot = join(__dirname, "..", "..", "..");
+const sourceDir = existsSync(join(__dirname, "google-antigravity.ts"))
+	? __dirname
+	: join(packageRoot, "src", "utils", "oauth");
+
+function readSourceFile(name: string): string {
+	return readFileSync(join(sourceDir, name), "utf-8");
+}
+
+describe("Antigravity OAuth — provider structure", () => {
+	test("has correct id and name", () => {
+		assert.equal(antigravityOAuthProvider.id, "google-antigravity");
+		assert.equal(antigravityOAuthProvider.name, "Antigravity (Gemini 3, Claude, GPT-OSS)");
+	});
+
+	test("uses callback server", () => {
+		assert.equal(antigravityOAuthProvider.usesCallbackServer, true);
+	});
+
+	test("has required methods", () => {
+		assert.equal(typeof antigravityOAuthProvider.login, "function");
+		assert.equal(typeof antigravityOAuthProvider.refreshToken, "function");
+		assert.equal(typeof antigravityOAuthProvider.getApiKey, "function");
+	});
+
+	test("getApiKey returns JSON with token and projectId", () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+			projectId: "test-project-123",
+			email: "test@example.com",
+		};
+		const apiKey = antigravityOAuthProvider.getApiKey(credentials);
+		assert.equal(typeof apiKey, "string");
+		const parsed = JSON.parse(apiKey);
+		assert.equal(parsed.token, "test-access-token");
+		assert.equal(parsed.projectId, "test-project-123");
+	});
+
+	test("refreshToken throws when projectId is missing", async () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+		};
+		await assert.rejects(
+			antigravityOAuthProvider.refreshToken(credentials),
+			/Antigravity credentials missing projectId/,
+		);
+	});
+});
+
+describe("Antigravity OAuth — credential regression", () => {
+	test("module imports successfully", () => {
+		assert.ok(antigravityOAuthProvider);
+	});
+
+	test("CLIENT_ID and CLIENT_SECRET are plaintext", () => {
+		const content = readSourceFile("google-antigravity.ts");
+		assert.ok(
+			content.includes(
+				'CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"',
+			),
+		);
+		assert.ok(content.includes('CLIENT_SECRET = "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"'));
+		assert.ok(!content.includes("atob("));
+	});
+
+	test("security explanation comments are present", () => {
+		const content = readSourceFile("google-antigravity.ts");
+		assert.ok(content.includes("NOTE: These credentials are public"));
+		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+	});
+});

package/packages/pi-ai/src/utils/oauth/google-antigravity.ts

@@ -21,11 +21,21 @@ type AntigravityCredentials = OAuthCredentials & {
 };
 
 // Antigravity OAuth credentials (different from Gemini CLI)
-const decode = (s: string) => atob(s);
-const CLIENT_ID = decode(
-	"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==",
-);
-const CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+//
+// NOTE: These credentials are public in the source code. They should NOT be
+// obfuscated because security scanners flag obfuscated data as potentially
+// malicious (see: https://socket.dev/npm/package/gsd-pi/alerts/2.70.1?alert_name=obfuscatedFile)
+//
+// Google's OAuth implementation requires client_secret for Desktop App OAuth
+// clients even though it cannot be kept secret in distributed applications.
+// The actual security relies on:
+// - PKCE (Proof Key for Code Exchange) via code_verifier
+// - Redirect URI validation (localhost only)
+// - User consent and token scope limits
+//
+// See: https://developers.google.com/identity/protocols/oauth2/native-app
+const CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+const CLIENT_SECRET = "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";
 const REDIRECT_URI = "http://localhost:51121/oauth-callback";
 
 // Antigravity requires additional scopes