jeopi-ai 16.2.13

package/src/registry/oauth/gitlab-duo.ts

@@ -0,0 +1,222 @@
+import * as AIError from "../../error";
+import { clearGitLabDuoDirectAccessCache } from "../../providers/gitlab-duo";
+import type { FetchImpl } from "../../types";
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+
+const GITLAB_COM_URL = "https://gitlab.com";
+/**
+ * Default OAuth client id baked into the bundled GitLab Duo login flow. GitLab
+ * authorize requests are rejected outright (`The redirect URI included is not
+ * valid`) whenever this client id's registered redirect URI list drifts from
+ * `http://localhost:8080/callback`. Users hitting that case can either:
+ *
+ * - register their own GitLab OAuth application and override the bundled
+ *   credentials with `GITLAB_CLIENT_ID` + `GITLAB_REDIRECT_URI`, or
+ * - skip OAuth entirely and supply a Personal Access Token via `GITLAB_TOKEN`.
+ *
+ * @see https://github.com/can1357/oh-my-pi/issues/2424
+ */
+const DEFAULT_CLIENT_ID = "da4edff2e6ebd2bc3208611e2768bc1c1dd7be791dc5ff26ca34ca9ee44f7d4b";
+const OAUTH_SCOPES = ["api"];
+const DEFAULT_CALLBACK_PORT = 8080;
+const DEFAULT_CALLBACK_PATH = "/callback";
+const DEFAULT_CALLBACK_HOSTNAME = "localhost";
+
+interface PKCEPair {
+	verifier: string;
+	challenge: string;
+}
+
+/**
+ * Resolve the OAuth client id, preferring `GITLAB_CLIENT_ID` when set so users
+ * with their own GitLab OAuth application can bypass the bundled credentials.
+ */
+function resolveClientId(): string {
+	const env = process.env.GITLAB_CLIENT_ID?.trim();
+	return env && env.length > 0 ? env : DEFAULT_CLIENT_ID;
+}
+
+/**
+ * Resolve callback-server options from `GITLAB_REDIRECT_URI`. When set, the
+ * exact string is advertised to GitLab (strict matching), random-port fallback
+ * is disabled, and HTTP loopback URIs bind the listener to the URI's host/port
+ * so the browser callback lands on us. HTTPS loopback URIs are rejected because
+ * the local callback server is plaintext HTTP. Non-loopback URIs bind a random
+ * local port — only the paste-code path can complete in that case.
+ */
+function resolveCallbackOptions(): OAuthCallbackFlowOptions {
+	const raw = process.env.GITLAB_REDIRECT_URI?.trim();
+	if (!raw) {
+		return {
+			preferredPort: DEFAULT_CALLBACK_PORT,
+			callbackPath: DEFAULT_CALLBACK_PATH,
+			callbackHostname: DEFAULT_CALLBACK_HOSTNAME,
+		};
+	}
+
+	let parsed: URL;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new AIError.OAuthError(`Invalid GITLAB_REDIRECT_URI: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI must use http:// or https://, got: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
+	}
+
+	const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+	if (isLoopback && parsed.protocol !== "http:") {
+		throw new AIError.OAuthError(`GITLAB_REDIRECT_URI loopback callbacks must use http://, got: ${raw}`, {
+			kind: "configuration",
+			provider: "gitlab-duo",
+		});
+	}
+
+	const port = parsed.port ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
+
+	return {
+		preferredPort: isLoopback ? port : 0,
+		callbackPath: parsed.pathname || DEFAULT_CALLBACK_PATH,
+		callbackHostname: isLoopback ? parsed.hostname : DEFAULT_CALLBACK_HOSTNAME,
+		redirectUri: raw,
+	};
+}
+
+function mapTokenResponse(payload: {
+	access_token?: string;
+	refresh_token?: string;
+	expires_in?: number;
+	created_at?: number;
+}): OAuthCredentials {
+	if (!payload.access_token || !payload.refresh_token || typeof payload.expires_in !== "number") {
+		throw new AIError.OAuthError("GitLab OAuth token response missing required fields", {
+			kind: "validation",
+			provider: "gitlab-duo",
+		});
+	}
+
+	const createdAtMs =
+		typeof payload.created_at === "number" && Number.isFinite(payload.created_at)
+			? payload.created_at * 1000
+			: Date.now();
+
+	return {
+		access: payload.access_token,
+		refresh: payload.refresh_token,
+		expires: createdAtMs + payload.expires_in * 1000 - 5 * 60 * 1000,
+	};
+}
+
+class GitLabDuoOAuthFlow extends OAuthCallbackFlow {
+	#pkce: PKCEPair;
+	#clientId: string;
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthLoginCallbacks, pkce: PKCEPair, clientId: string, options: OAuthCallbackFlowOptions) {
+		super(ctrl, options);
+		this.#pkce = pkce;
+		this.#clientId = clientId;
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+
+	override async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const authParams = new URLSearchParams({
+			client_id: this.#clientId,
+			redirect_uri: redirectUri,
+			response_type: "code",
+			scope: OAUTH_SCOPES.join(" "),
+			code_challenge: this.#pkce.challenge,
+			code_challenge_method: "S256",
+			state,
+		});
+
+		return {
+			url: `${GITLAB_COM_URL}/oauth/authorize?${authParams.toString()}`,
+			instructions:
+				'Complete GitLab login in browser. If GitLab responds with "The redirect URI included is not valid", ' +
+				"register your own GitLab OAuth application and set GITLAB_CLIENT_ID + GITLAB_REDIRECT_URI, or use a " +
+				"Personal Access Token via GITLAB_TOKEN.",
+		};
+	}
+
+	override async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		const response = await this.#fetch(`${GITLAB_COM_URL}/oauth/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: this.#clientId,
+				grant_type: "authorization_code",
+				code,
+				code_verifier: this.#pkce.verifier,
+				redirect_uri: redirectUri,
+			}).toString(),
+		});
+
+		if (!response.ok) {
+			throw new AIError.OAuthError(
+				`GitLab OAuth token exchange failed: ${response.status} ${await response.text()}`,
+				{
+					kind: "token-exchange",
+					provider: "gitlab-duo",
+					status: response.status,
+				},
+			);
+		}
+
+		clearGitLabDuoDirectAccessCache();
+		return mapTokenResponse(
+			(await response.json()) as {
+				access_token?: string;
+				refresh_token?: string;
+				expires_in?: number;
+				created_at?: number;
+			},
+		);
+	}
+}
+
+export async function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+	const pkce = await generatePKCE();
+	const clientId = resolveClientId();
+	const options = resolveCallbackOptions();
+	const flow = new GitLabDuoOAuthFlow(callbacks, pkce, clientId, options);
+	return flow.login();
+}
+
+export async function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
+	const response = await fetch(`${GITLAB_COM_URL}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: resolveClientId(),
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh,
+		}).toString(),
+	});
+
+	if (!response.ok) {
+		throw new AIError.OAuthError(`GitLab OAuth refresh failed: ${response.status} ${await response.text()}`, {
+			kind: "token-refresh",
+			provider: "gitlab-duo",
+			status: response.status,
+		});
+	}
+
+	clearGitLabDuoDirectAccessCache();
+	return mapTokenResponse(
+		(await response.json()) as {
+			access_token?: string;
+			refresh_token?: string;
+			expires_in?: number;
+			created_at?: number;
+		},
+	);
+}

package/src/registry/oauth/google-antigravity.ts

@@ -0,0 +1,209 @@
+/**
+ * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
+ * Uses different OAuth credentials than google-gemini-cli for access to additional models.
+ */
+import { getAntigravityUserAgent } from "jeopi-catalog/wire/gemini-headers";
+import * as AIError from "../../error";
+import { runGoogleOAuthLogin } from "./google-oauth-shared";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const decode = (s: string) => atob(s);
+const CLIENT_ID = decode(
+	"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==",
+);
+const CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+const CALLBACK_PORT = 51121;
+const CALLBACK_PATH = "/oauth-callback";
+
+const SCOPES = [
+	"https://www.googleapis.com/auth/cloud-platform",
+	"https://www.googleapis.com/auth/userinfo.email",
+	"https://www.googleapis.com/auth/userinfo.profile",
+	"https://www.googleapis.com/auth/cclog",
+	"https://www.googleapis.com/auth/experimentsandconfigs",
+];
+
+const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const CLOUD_CODE_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+const TIER_LEGACY = "legacy-tier";
+const PROJECT_ONBOARD_MAX_ATTEMPTS = 5;
+const PROJECT_ONBOARD_INTERVAL_MS = 2000;
+
+interface LoadCodeAssistPayload {
+	cloudaicompanionProject?: string | { id?: string };
+	currentTier?: { id?: string };
+	allowedTiers?: Array<{ id?: string; isDefault?: boolean }>;
+}
+
+interface LongRunningOperationResponse {
+	done?: boolean;
+	response?: {
+		cloudaicompanionProject?: string | { id?: string };
+	};
+}
+
+export const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
+	ideType: "ANTIGRAVITY",
+	platform: "PLATFORM_UNSPECIFIED",
+	pluginType: "GEMINI",
+});
+
+function readProjectId(value: string | { id?: string } | undefined): string | undefined {
+	if (typeof value === "string" && value.length > 0) {
+		return value;
+	}
+	if (value && typeof value === "object" && typeof value.id === "string" && value.id.length > 0) {
+		return value.id;
+	}
+	return undefined;
+}
+
+function getDefaultTierId(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): string {
+	if (!allowedTiers || allowedTiers.length === 0) {
+		return TIER_LEGACY;
+	}
+	const defaultTier = allowedTiers.find(tier => tier.isDefault && typeof tier.id === "string" && tier.id.length > 0);
+	if (defaultTier?.id) {
+		return defaultTier.id;
+	}
+	return TIER_LEGACY;
+}
+
+async function onboardProjectWithRetries(
+	endpoint: string,
+	headers: Record<string, string>,
+	onboardBody: { tierId: string; metadata: typeof ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA },
+	onProgress?: (message: string) => void,
+): Promise<string> {
+	for (let attempt = 1; attempt <= PROJECT_ONBOARD_MAX_ATTEMPTS; attempt += 1) {
+		if (attempt > 1) {
+			onProgress?.(`Waiting for project provisioning (attempt ${attempt}/${PROJECT_ONBOARD_MAX_ATTEMPTS})...`);
+			await Bun.sleep(PROJECT_ONBOARD_INTERVAL_MS);
+		}
+
+		const onboardResponse = await fetch(`${endpoint}/v1internal:onboardUser`, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(onboardBody),
+		});
+
+		if (!onboardResponse.ok) {
+			const errorText = await onboardResponse.text();
+			throw new AIError.OAuthError(
+				`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`,
+				{ kind: "provisioning", status: onboardResponse.status },
+			);
+		}
+
+		const operation = (await onboardResponse.json()) as LongRunningOperationResponse;
+		if (!operation.done) {
+			continue;
+		}
+
+		const projectId = readProjectId(operation.response?.cloudaicompanionProject);
+		if (projectId) {
+			return projectId;
+		}
+	}
+
+	throw new AIError.OAuthError(
+		`onboardUser did not return a provisioned project id after ${PROJECT_ONBOARD_MAX_ATTEMPTS} attempts`,
+		{ kind: "provisioning" },
+	);
+}
+
+async function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {
+	const headers = {
+		Authorization: `Bearer ${accessToken}`,
+		"Content-Type": "application/json",
+		"User-Agent": getAntigravityUserAgent(),
+	};
+
+	onProgress?.("Checking for existing project...");
+	const endpoint = CLOUD_CODE_ENDPOINT;
+	try {
+		const loadResponse = await fetch(`${endpoint}/v1internal:loadCodeAssist`, {
+			method: "POST",
+			headers,
+			body: JSON.stringify({
+				metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+			}),
+		});
+
+		if (!loadResponse.ok) {
+			const errorText = await loadResponse.text();
+			throw new AIError.OAuthError(
+				`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`,
+				{ kind: "discovery", status: loadResponse.status },
+			);
+		}
+
+		const loadPayload = (await loadResponse.json()) as LoadCodeAssistPayload;
+		const existingProject = readProjectId(loadPayload.cloudaicompanionProject);
+		if (existingProject) {
+			return existingProject;
+		}
+
+		const tierId = getDefaultTierId(loadPayload.allowedTiers);
+		onProgress?.("Provisioning project...");
+		const onboardBody = {
+			tierId,
+			metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+		};
+		const provisionedProject = await onboardProjectWithRetries(endpoint, headers, onboardBody, onProgress);
+		return provisionedProject;
+	} catch (error) {
+		throw new AIError.OAuthError(
+			`Could not discover or provision an Antigravity project. ${error instanceof Error ? error.message : String(error)}`,
+			{ kind: "discovery", cause: error },
+		);
+	}
+}
+
+export async function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials> {
+	return runGoogleOAuthLogin(ctrl, {
+		clientId: CLIENT_ID,
+		clientSecret: CLIENT_SECRET,
+		authUrl: AUTH_URL,
+		tokenUrl: TOKEN_URL,
+		scopes: SCOPES,
+		callbackPort: CALLBACK_PORT,
+		callbackPath: CALLBACK_PATH,
+		discoverProject,
+	});
+}
+
+/**
+ * Refresh Antigravity token
+ */
+export async function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			client_secret: CLIENT_SECRET,
+			refresh_token: refreshToken,
+			grant_type: "refresh_token",
+		}),
+	});
+
+	if (!response.ok) {
+		const error = await response.text();
+		throw new AIError.OAuthError(`Antigravity token refresh failed: ${error}`, { kind: "token-refresh" });
+	}
+
+	const data = (await response.json()) as {
+		access_token: string;
+		expires_in: number;
+		refresh_token?: string;
+	};
+
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+		projectId,
+	};
+}

package/src/registry/oauth/google-gemini-cli.ts

@@ -0,0 +1,273 @@
+/**
+ * Gemini CLI OAuth flow (Google Cloud Code Assist)
+ * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)
+ */
+
+import { getGeminiCliHeaders } from "jeopi-catalog/wire/gemini-headers";
+import { $env } from "jeopi-utils";
+import * as AIError from "../../error";
+import { runGoogleOAuthLogin } from "./google-oauth-shared";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const decode = (s: string) => atob(s);
+const CLIENT_ID = decode(
+	"NjgxMjU1ODA5Mzk1LW9vOGZ0Mm9wcmRybnA5ZTNhcWY2YXYzaG1kaWIxMzVqLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29t",
+);
+const CLIENT_SECRET = decode("R09DU1BYLTR1SGdNUG0tMW83U2stZ2VWNkN1NWNsWEZzeGw=");
+const CALLBACK_PORT = 8085;
+const CALLBACK_PATH = "/oauth2callback";
+const SCOPES = [
+	"https://www.googleapis.com/auth/cloud-platform",
+	"https://www.googleapis.com/auth/userinfo.email",
+	"https://www.googleapis.com/auth/userinfo.profile",
+];
+const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+
+interface LoadCodeAssistPayload {
+	cloudaicompanionProject?: string;
+	currentTier?: { id?: string };
+	allowedTiers?: Array<{ id?: string; isDefault?: boolean }>;
+}
+
+interface LongRunningOperationResponse {
+	name?: string;
+	done?: boolean;
+	response?: {
+		cloudaicompanionProject?: { id?: string };
+	};
+}
+
+const TIER_FREE = "free-tier";
+const TIER_LEGACY = "legacy-tier";
+const TIER_STANDARD = "standard-tier";
+
+interface GoogleRpcErrorResponse {
+	error?: {
+		details?: Array<{ reason?: string }>;
+	};
+}
+
+function getDefaultTier(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): { id?: string } {
+	if (!allowedTiers || allowedTiers.length === 0) return { id: TIER_LEGACY };
+	const defaultTier = allowedTiers.find(t => t.isDefault);
+	return defaultTier ?? { id: TIER_LEGACY };
+}
+
+function isVpcScAffectedUser(payload: unknown): boolean {
+	if (!payload || typeof payload !== "object") return false;
+	if (!("error" in payload)) return false;
+	const error = (payload as GoogleRpcErrorResponse).error;
+	if (!error?.details || !Array.isArray(error.details)) return false;
+	return error.details.some(detail => detail.reason === "SECURITY_POLICY_VIOLATED");
+}
+
+async function pollOperation(
+	operationName: string,
+	headers: Record<string, string>,
+	onProgress?: (message: string) => void,
+): Promise<LongRunningOperationResponse> {
+	let attempt = 0;
+	while (true) {
+		if (attempt > 0) {
+			onProgress?.(`Waiting for project provisioning (attempt ${attempt + 1})...`);
+			await Bun.sleep(5000);
+		}
+
+		const response = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal/${operationName}`, {
+			method: "GET",
+			headers,
+		});
+
+		if (!response.ok) {
+			throw new AIError.OAuthError(`Failed to poll operation: ${response.status} ${response.statusText}`, {
+				kind: "polling",
+				provider: "google-gemini-cli",
+				status: response.status,
+			});
+		}
+
+		const data = (await response.json()) as LongRunningOperationResponse;
+		if (data.done) {
+			return data;
+		}
+
+		attempt += 1;
+	}
+}
+
+async function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {
+	const envProjectId = $env.GOOGLE_CLOUD_PROJECT || $env.GOOGLE_CLOUD_PROJECT_ID;
+
+	const headers = {
+		Authorization: `Bearer ${accessToken}`,
+		"Content-Type": "application/json",
+		...getGeminiCliHeaders(),
+	};
+
+	onProgress?.("Checking for existing Cloud Code Assist project...");
+	const loadResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:loadCodeAssist`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify({
+			cloudaicompanionProject: envProjectId,
+			metadata: {
+				ideType: "IDE_UNSPECIFIED",
+				platform: "PLATFORM_UNSPECIFIED",
+				pluginType: "GEMINI",
+				duetProject: envProjectId,
+			},
+		}),
+	});
+
+	let data: LoadCodeAssistPayload;
+
+	if (!loadResponse.ok) {
+		let errorPayload: unknown;
+		try {
+			errorPayload = await loadResponse.clone().json();
+		} catch {
+			errorPayload = undefined;
+		}
+
+		if (isVpcScAffectedUser(errorPayload)) {
+			data = { currentTier: { id: TIER_STANDARD } };
+		} else {
+			const errorText = await loadResponse.text();
+			throw new AIError.OAuthError(
+				`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`,
+				{ kind: "discovery", provider: "google-gemini-cli", status: loadResponse.status },
+			);
+		}
+	} else {
+		data = (await loadResponse.json()) as LoadCodeAssistPayload;
+	}
+
+	if (data.currentTier) {
+		if (data.cloudaicompanionProject) {
+			return data.cloudaicompanionProject;
+		}
+		if (envProjectId) {
+			return envProjectId;
+		}
+		throw new AIError.OAuthError(
+			"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
+				"See https://goo.gle/gemini-cli-auth-docs#workspace-gca",
+			{ kind: "configuration", provider: "google-gemini-cli" },
+		);
+	}
+
+	const tier = getDefaultTier(data.allowedTiers);
+	const tierId = tier?.id ?? TIER_FREE;
+
+	if (tierId !== TIER_FREE && !envProjectId) {
+		throw new AIError.OAuthError(
+			"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
+				"See https://goo.gle/gemini-cli-auth-docs#workspace-gca",
+			{ kind: "configuration", provider: "google-gemini-cli" },
+		);
+	}
+
+	onProgress?.("Provisioning Cloud Code Assist project (this may take a moment)...");
+
+	const onboardBody: Record<string, unknown> = {
+		tierId,
+		metadata: {
+			ideType: "IDE_UNSPECIFIED",
+			platform: "PLATFORM_UNSPECIFIED",
+			pluginType: "GEMINI",
+		},
+	};
+
+	if (tierId !== TIER_FREE && envProjectId) {
+		onboardBody.cloudaicompanionProject = envProjectId;
+		(onboardBody.metadata as Record<string, unknown>).duetProject = envProjectId;
+	}
+
+	const onboardResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:onboardUser`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(onboardBody),
+	});
+
+	if (!onboardResponse.ok) {
+		const errorText = await onboardResponse.text();
+		throw new AIError.OAuthError(
+			`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`,
+			{ kind: "provisioning", provider: "google-gemini-cli", status: onboardResponse.status },
+		);
+	}
+
+	let lroData = (await onboardResponse.json()) as LongRunningOperationResponse;
+
+	if (!lroData.done && lroData.name) {
+		lroData = await pollOperation(lroData.name, headers, onProgress);
+	}
+
+	const projectId = lroData.response?.cloudaicompanionProject?.id;
+	if (projectId) {
+		return projectId;
+	}
+
+	if (envProjectId) {
+		return envProjectId;
+	}
+
+	throw new AIError.OAuthError(
+		"Could not discover or provision a Google Cloud project. " +
+			"Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. " +
+			"See https://goo.gle/gemini-cli-auth-docs#workspace-gca",
+		{ kind: "validation", provider: "google-gemini-cli" },
+	);
+}
+
+export async function loginGeminiCli(ctrl: OAuthController): Promise<OAuthCredentials> {
+	return runGoogleOAuthLogin(ctrl, {
+		clientId: CLIENT_ID,
+		clientSecret: CLIENT_SECRET,
+		authUrl: AUTH_URL,
+		tokenUrl: TOKEN_URL,
+		scopes: SCOPES,
+		callbackPort: CALLBACK_PORT,
+		callbackPath: CALLBACK_PATH,
+		discoverProject,
+	});
+}
+
+/**
+ * Refresh Google Cloud Code Assist token
+ */
+export async function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			client_secret: CLIENT_SECRET,
+			refresh_token: refreshToken,
+			grant_type: "refresh_token",
+		}),
+	});
+
+	if (!response.ok) {
+		const error = await response.text();
+		throw new AIError.OAuthError(`Google Cloud token refresh failed: ${error}`, {
+			kind: "token-refresh",
+			provider: "google-gemini-cli",
+		});
+	}
+
+	const data = (await response.json()) as {
+		access_token: string;
+		expires_in: number;
+		refresh_token?: string;
+	};
+
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+		projectId,
+	};
+}