gsd-pi 2.76.0 → 2.77.0

package/packages/pi-ai/src/utils/oauth/github-copilot.test.ts

@@ -1,28 +1,46 @@
+import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import test from "node:test";
-
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { Api, Model } from "../../types.js";
-import type { OAuthCredentials } from "./index.js";
-import { githubCopilotOAuthProvider } from "./github-copilot.js";
+import type { OAuthCredentials } from "./types.js";
+import {
+	getGitHubCopilotBaseUrl,
+	githubCopilotOAuthProvider,
+	normalizeDomain,
+} from "./github-copilot.js";
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url));
+const packageRoot = join(__dirname, "..", "..", "..");
+const sourceDir = existsSync(join(__dirname, "github-copilot.ts"))
+	? __dirname
+	: join(packageRoot, "src", "utils", "oauth");
+
+function readSourceFile(name: string): string {
+	return readFileSync(join(sourceDir, name), "utf-8");
+}
 
-function makeModel(provider: string, id: string): Model<Api> {
+function createModel(overrides: Partial<Model<Api>> = {}): Model<Api> {
 	return {
-		id,
-		name: id,
+		id: "test-model",
+		name: "Test Model",
 		api: "openai-completions",
-		provider,
-		baseUrl: `${provider}:`,
+		provider: "test-provider",
+		baseUrl: "https://example.com",
 		reasoning: false,
 		input: ["text"],
 		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
 		contextWindow: 128000,
-		maxTokens: 16384,
-	};
+		maxTokens: 8192,
+		...overrides,
+	} as Model<Api>;
 }
 
-function makeCredentials(overrides: Partial<OAuthCredentials & { modelLimits?: Record<string, { contextWindow: number; maxTokens: number }> }> = {}) {
+function makeCredentials(
+	overrides: Partial<OAuthCredentials & { modelLimits?: Record<string, { contextWindow: number; maxTokens: number }> }> = {},
+) {
 	return {
-		type: "oauth" as const,
 		access: "copilot-token",
 		refresh: "refresh-token",
 		expires: Date.now() + 60_000,
@@ -30,19 +48,178 @@ function makeCredentials(overrides: Partial<OAuthCredentials & { modelLimits?: R
 	};
 }
 
+describe("GitHub Copilot OAuth — normalizeDomain", () => {
+	test("returns null for empty input", () => {
+		assert.equal(normalizeDomain(""), null);
+		assert.equal(normalizeDomain("   "), null);
+	});
+
+	test("returns null for invalid domain", () => {
+		assert.equal(normalizeDomain("not a domain!@#"), null);
+	});
+
+	test("extracts hostname from full URL", () => {
+		assert.equal(normalizeDomain("https://github.com"), "github.com");
+		assert.equal(normalizeDomain("https://company.ghe.com"), "company.ghe.com");
+		assert.equal(normalizeDomain("http://example.com/path"), "example.com");
+	});
+
+	test("returns domain as-is when no protocol", () => {
+		assert.equal(normalizeDomain("github.com"), "github.com");
+		assert.equal(normalizeDomain("company.ghe.com"), "company.ghe.com");
+	});
+
+	test("trims whitespace", () => {
+		assert.equal(normalizeDomain("  github.com  "), "github.com");
+	});
+});
+
+describe("GitHub Copilot OAuth — getBaseUrlFromToken", () => {
+	test("extracts API URL from token with proxy-ep", () => {
+		const token = "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token);
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("extracts API URL from enterprise proxy-ep", () => {
+		const token = "tid=123;exp=1234567890;proxy-ep=proxy.company.ghe.com;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token);
+		assert.equal(baseUrl, "https://api.company.ghe.com");
+	});
+
+	test("falls back to default when no token provided", () => {
+		const baseUrl = getGitHubCopilotBaseUrl();
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("falls back to default when token has no proxy-ep", () => {
+		const token = "tid=123;exp=1234567890;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token);
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("uses enterprise domain when provided", () => {
+		const baseUrl = getGitHubCopilotBaseUrl(undefined, "company.ghe.com");
+		assert.equal(baseUrl, "https://copilot-api.company.ghe.com");
+	});
+
+	test("prioritizes token proxy-ep over enterprise domain", () => {
+		const token = "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;other=value";
+		const baseUrl = getGitHubCopilotBaseUrl(token, "company.ghe.com");
+		assert.equal(baseUrl, "https://api.individual.githubcopilot.com");
+	});
+});
+
+describe("GitHub Copilot OAuth — provider structure", () => {
+	test("has correct id and name", () => {
+		assert.equal(githubCopilotOAuthProvider.id, "github-copilot");
+		assert.equal(githubCopilotOAuthProvider.name, "GitHub Copilot");
+	});
+
+	test("has required methods", () => {
+		assert.equal(typeof githubCopilotOAuthProvider.login, "function");
+		assert.equal(typeof githubCopilotOAuthProvider.refreshToken, "function");
+		assert.equal(typeof githubCopilotOAuthProvider.getApiKey, "function");
+		assert.equal(typeof githubCopilotOAuthProvider.modifyModels, "function");
+	});
+
+	test("getApiKey returns access token", () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+		};
+		const apiKey = githubCopilotOAuthProvider.getApiKey(credentials);
+		assert.equal(apiKey, "test-access-token");
+	});
+
+	test("modifyModels preserves non-Copilot models", () => {
+		if (!githubCopilotOAuthProvider.modifyModels) return;
+		const models = [createModel({ id: "gpt-4", provider: "openai" })];
+		const credentials: OAuthCredentials = {
+			access: "test-token",
+			refresh: "test-refresh",
+			expires: Date.now() + 3600000,
+		};
+		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
+		assert.deepEqual(result, models);
+	});
+
+	test("modifyModels updates Copilot model baseUrl when token has proxy-ep", () => {
+		if (!githubCopilotOAuthProvider.modifyModels) return;
+		const models = [
+			createModel({
+				id: "claude-3.5-sonnet",
+				provider: "github-copilot",
+				baseUrl: "https://api.default.com",
+			}),
+		];
+		const credentials: OAuthCredentials = {
+			access: "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;",
+			refresh: "test-refresh",
+			expires: Date.now() + 3600000,
+		};
+		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
+		assert.equal(result[0].baseUrl, "https://api.individual.githubcopilot.com");
+	});
+
+	test("modifyModels applies model limits when available", () => {
+		if (!githubCopilotOAuthProvider.modifyModels) return;
+		const models = [
+			createModel({
+				id: "claude-3.5-sonnet",
+				provider: "github-copilot",
+				baseUrl: "https://api.default.com",
+			}),
+		];
+		const credentials = {
+			access: "test-token",
+			refresh: "test-refresh",
+			expires: Date.now() + 3600000,
+			modelLimits: {
+				"claude-3.5-sonnet": { contextWindow: 123456, maxTokens: 4096 },
+			},
+		};
+		const result = githubCopilotOAuthProvider.modifyModels(models, credentials);
+		assert.equal(result[0].contextWindow, 123456);
+		assert.equal(result[0].maxTokens, 4096);
+	});
+});
+
+describe("GitHub Copilot OAuth — credential regression", () => {
+	test("module imports successfully", () => {
+		assert.ok(githubCopilotOAuthProvider);
+	});
+
+	test("CLIENT_ID is plaintext (not base64)", () => {
+		const content = readSourceFile("github-copilot.ts");
+		assert.ok(content.includes('CLIENT_ID = "Iv1.b507a08c87ecfe98"'));
+		assert.ok(!content.includes("atob("));
+	});
+
+	test("security explanation comments are present", () => {
+		const content = readSourceFile("github-copilot.ts");
+		assert.ok(content.includes("NOTE: This credential is public"));
+		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+	});
+});
+
 test("githubCopilotOAuthProvider.modifyModels filters unavailable copilot models (#3849)", () => {
 	const models = [
-		makeModel("github-copilot", "gpt-5"),
-		makeModel("github-copilot", "claude-sonnet-4"),
-		makeModel("openai", "gpt-4.1"),
+		createModel({ provider: "github-copilot", id: "gpt-5", name: "gpt-5", baseUrl: "github-copilot:" }),
+		createModel({ provider: "github-copilot", id: "claude-sonnet-4", name: "claude-sonnet-4", baseUrl: "github-copilot:" }),
+		createModel({ provider: "openai", id: "gpt-4.1", name: "gpt-4.1", baseUrl: "openai:" }),
 	];
 
 	assert.ok(githubCopilotOAuthProvider.modifyModels, "github copilot provider should expose modifyModels");
-	const modified = githubCopilotOAuthProvider.modifyModels(models, makeCredentials({
-		modelLimits: {
-			"gpt-5": { contextWindow: 256000, maxTokens: 32000 },
-		},
-	}));
+	const modified = githubCopilotOAuthProvider.modifyModels(
+		models,
+		makeCredentials({
+			modelLimits: {
+				"gpt-5": { contextWindow: 256000, maxTokens: 32000 },
+			},
+		}),
+	);
 
 	assert.deepEqual(
 		modified.map((model) => `${model.provider}/${model.id}`),
@@ -58,8 +235,8 @@ test("githubCopilotOAuthProvider.modifyModels filters unavailable copilot models
 
 test("githubCopilotOAuthProvider.modifyModels keeps all copilot models when limits are unavailable", () => {
 	const models = [
-		makeModel("github-copilot", "gpt-5"),
-		makeModel("github-copilot", "claude-sonnet-4"),
+		createModel({ provider: "github-copilot", id: "gpt-5", name: "gpt-5", baseUrl: "github-copilot:" }),
+		createModel({ provider: "github-copilot", id: "claude-sonnet-4", name: "claude-sonnet-4", baseUrl: "github-copilot:" }),
 	];
 
 	assert.ok(githubCopilotOAuthProvider.modifyModels, "github copilot provider should expose modifyModels");

package/packages/pi-ai/src/utils/oauth/github-copilot.ts

@@ -12,8 +12,18 @@ type CopilotCredentials = OAuthCredentials & {
 	modelLimits?: Record<string, { contextWindow: number; maxTokens: number }>;
 };
 
-const decode = (s: string) => atob(s);
-const CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+// GitHub Copilot OAuth Client ID
+//
+// NOTE: This credential is public in the source code. It should NOT be
+// obfuscated because security scanners flag obfuscated data as potentially
+// malicious (see: https://socket.dev/npm/package/gsd-pi/alerts/2.70.1?alert_name=obfuscatedFile)
+//
+// GitHub's device flow for public clients (CLI/desktop apps) does not use
+// a client secret - only the client ID is required. This is standard OAuth
+// for public clients and is intentionally public.
+//
+// See: https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps
+const CLIENT_ID = "Iv1.b507a08c87ecfe98";
 
 const COPILOT_HEADERS = {
 	"User-Agent": "GitHubCopilotChat/0.35.0",

package/packages/pi-ai/src/utils/oauth/google-antigravity.test.ts

@@ -0,0 +1,84 @@
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { OAuthCredentials } from "./types.js";
+import { antigravityOAuthProvider } from "./google-antigravity.js";
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url));
+const packageRoot = join(__dirname, "..", "..", "..");
+const sourceDir = existsSync(join(__dirname, "google-antigravity.ts"))
+	? __dirname
+	: join(packageRoot, "src", "utils", "oauth");
+
+function readSourceFile(name: string): string {
+	return readFileSync(join(sourceDir, name), "utf-8");
+}
+
+describe("Antigravity OAuth — provider structure", () => {
+	test("has correct id and name", () => {
+		assert.equal(antigravityOAuthProvider.id, "google-antigravity");
+		assert.equal(antigravityOAuthProvider.name, "Antigravity (Gemini 3, Claude, GPT-OSS)");
+	});
+
+	test("uses callback server", () => {
+		assert.equal(antigravityOAuthProvider.usesCallbackServer, true);
+	});
+
+	test("has required methods", () => {
+		assert.equal(typeof antigravityOAuthProvider.login, "function");
+		assert.equal(typeof antigravityOAuthProvider.refreshToken, "function");
+		assert.equal(typeof antigravityOAuthProvider.getApiKey, "function");
+	});
+
+	test("getApiKey returns JSON with token and projectId", () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+			projectId: "test-project-123",
+			email: "test@example.com",
+		};
+		const apiKey = antigravityOAuthProvider.getApiKey(credentials);
+		assert.equal(typeof apiKey, "string");
+		const parsed = JSON.parse(apiKey);
+		assert.equal(parsed.token, "test-access-token");
+		assert.equal(parsed.projectId, "test-project-123");
+	});
+
+	test("refreshToken throws when projectId is missing", async () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+		};
+		await assert.rejects(
+			antigravityOAuthProvider.refreshToken(credentials),
+			/Antigravity credentials missing projectId/,
+		);
+	});
+});
+
+describe("Antigravity OAuth — credential regression", () => {
+	test("module imports successfully", () => {
+		assert.ok(antigravityOAuthProvider);
+	});
+
+	test("CLIENT_ID and CLIENT_SECRET are plaintext", () => {
+		const content = readSourceFile("google-antigravity.ts");
+		assert.ok(
+			content.includes(
+				'CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"',
+			),
+		);
+		assert.ok(content.includes('CLIENT_SECRET = "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"'));
+		assert.ok(!content.includes("atob("));
+	});
+
+	test("security explanation comments are present", () => {
+		const content = readSourceFile("google-antigravity.ts");
+		assert.ok(content.includes("NOTE: These credentials are public"));
+		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+	});
+});

package/packages/pi-ai/src/utils/oauth/google-antigravity.ts

@@ -21,11 +21,21 @@ type AntigravityCredentials = OAuthCredentials & {
 };
 
 // Antigravity OAuth credentials (different from Gemini CLI)
-const decode = (s: string) => atob(s);
-const CLIENT_ID = decode(
-	"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==",
-);
-const CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+//
+// NOTE: These credentials are public in the source code. They should NOT be
+// obfuscated because security scanners flag obfuscated data as potentially
+// malicious (see: https://socket.dev/npm/package/gsd-pi/alerts/2.70.1?alert_name=obfuscatedFile)
+//
+// Google's OAuth implementation requires client_secret for Desktop App OAuth
+// clients even though it cannot be kept secret in distributed applications.
+// The actual security relies on:
+// - PKCE (Proof Key for Code Exchange) via code_verifier
+// - Redirect URI validation (localhost only)
+// - User consent and token scope limits
+//
+// See: https://developers.google.com/identity/protocols/oauth2/native-app
+const CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+const CLIENT_SECRET = "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";
 const REDIRECT_URI = "http://localhost:51121/oauth-callback";
 
 // Antigravity requires additional scopes

package/packages/pi-ai/src/utils/oauth/google-gemini-cli.test.ts

@@ -0,0 +1,84 @@
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { OAuthCredentials } from "./types.js";
+import { geminiCliOAuthProvider } from "./google-gemini-cli.js";
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url));
+const packageRoot = join(__dirname, "..", "..", "..");
+const sourceDir = existsSync(join(__dirname, "google-gemini-cli.ts"))
+	? __dirname
+	: join(packageRoot, "src", "utils", "oauth");
+
+function readSourceFile(name: string): string {
+	return readFileSync(join(sourceDir, name), "utf-8");
+}
+
+describe("Gemini CLI OAuth — provider structure", () => {
+	test("has correct id and name", () => {
+		assert.equal(geminiCliOAuthProvider.id, "google-gemini-cli");
+		assert.equal(geminiCliOAuthProvider.name, "Google Cloud Code Assist (Gemini CLI)");
+	});
+
+	test("uses callback server", () => {
+		assert.equal(geminiCliOAuthProvider.usesCallbackServer, true);
+	});
+
+	test("has required methods", () => {
+		assert.equal(typeof geminiCliOAuthProvider.login, "function");
+		assert.equal(typeof geminiCliOAuthProvider.refreshToken, "function");
+		assert.equal(typeof geminiCliOAuthProvider.getApiKey, "function");
+	});
+
+	test("getApiKey returns JSON with token and projectId", () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+			projectId: "test-project-456",
+			email: "test@example.com",
+		};
+		const apiKey = geminiCliOAuthProvider.getApiKey(credentials);
+		assert.equal(typeof apiKey, "string");
+		const parsed = JSON.parse(apiKey);
+		assert.equal(parsed.token, "test-access-token");
+		assert.equal(parsed.projectId, "test-project-456");
+	});
+
+	test("refreshToken throws when projectId is missing", async () => {
+		const credentials: OAuthCredentials = {
+			access: "test-access-token",
+			refresh: "test-refresh-token",
+			expires: Date.now() + 3600000,
+		};
+		await assert.rejects(
+			geminiCliOAuthProvider.refreshToken(credentials),
+			/Google Cloud credentials missing projectId/,
+		);
+	});
+});
+
+describe("Gemini CLI OAuth — credential regression", () => {
+	test("module imports successfully", () => {
+		assert.ok(geminiCliOAuthProvider);
+	});
+
+	test("CLIENT_ID and CLIENT_SECRET are plaintext", () => {
+		const content = readSourceFile("google-gemini-cli.ts");
+		assert.ok(
+			content.includes(
+				'CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"',
+			),
+		);
+		assert.ok(content.includes('CLIENT_SECRET = "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"'));
+		assert.ok(!content.includes("atob("));
+	});
+
+	test("security explanation comments are present", () => {
+		const content = readSourceFile("google-gemini-cli.ts");
+		assert.ok(content.includes("NOTE: These credentials are public"));
+		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+	});
+});

package/packages/pi-ai/src/utils/oauth/google-gemini-cli.ts

@@ -20,11 +20,22 @@ type GeminiCredentials = OAuthCredentials & {
 	projectId: string;
 };
 
-const decode = (s: string) => atob(s);
-const CLIENT_ID = decode(
-	"NjgxMjU1ODA5Mzk1LW9vOGZ0Mm9wcmRybnA5ZTNhcWY2YXYzaG1kaWIxMzVqLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29t",
-);
-const CLIENT_SECRET = decode("R09DU1BYLTR1SGdNUG0tMW83U2stZ2VWNkN1NWNsWEZzeGw=");
+// Gemini CLI OAuth credentials (Google Cloud Code Assist)
+//
+// NOTE: These credentials are public in the source code. They should NOT be
+// obfuscated because security scanners flag obfuscated data as potentially
+// malicious (see: https://socket.dev/npm/package/gsd-pi/alerts/2.70.1?alert_name=obfuscatedFile)
+//
+// Google's OAuth implementation requires client_secret for Desktop App OAuth
+// clients even though it cannot be kept secret in distributed applications.
+// The actual security relies on:
+// - PKCE (Proof Key for Code Exchange) via code_verifier
+// - Redirect URI validation (localhost only)
+// - User consent and token scope limits
+//
+// See: https://developers.google.com/identity/protocols/oauth2/native-app
+const CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
+const CLIENT_SECRET = "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";
 const REDIRECT_URI = "http://localhost:8085/oauth2callback";
 const SCOPES = [
 	"https://www.googleapis.com/auth/cloud-platform",