muonroi-cli 1.2.2 → 1.3.1

package/dist/src/providers/auth/gemini-oauth.js

@@ -0,0 +1,294 @@
+/**
+ * src/providers/auth/gemini-oauth.ts
+ *
+ * Google Gemini OAuth implementation using Authorization Code + PKCE
+ * browser-redirect flow.
+ *
+ * Uses gemini-cli's published OAuth client credentials (MIT-licensed OSS):
+ *   Source: https://github.com/google-gemini/gemini-cli
+ *     packages/core/src/code_assist/oauth2.ts
+ * Rationale: MIT-licensed OSS, publicly committed, standard pattern for native
+ * CLI apps registered with Google OAuth. Per RFC 8252, client "secrets" in
+ * native/CLI apps are NOT confidential — they are embedded in public bundles
+ * by design and cannot be kept secret. Override via MUONROI_GOOGLE_CLIENT_SECRET.
+ *
+ * Scopes: https://www.googleapis.com/auth/cloud-platform openid email
+ * (same as gemini-cli — covers Generative Language API + user identity)
+ */
+import { exec } from "node:child_process";
+import { startOAuthCallbackServer } from "../../mcp/oauth-callback.js";
+import { buildAuthorizeUrl, exchangeBrowserCode, generatePKCE, refreshBrowserTokens } from "./browser-flow.js";
+import { OAuthLoginError, OAuthRefreshError } from "./types.js";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+const GOOGLE_USERINFO_ENDPOINT = "https://openidconnect.googleapis.com/v1/userinfo";
+/**
+ * gemini-cli OAuth client_id (MIT OSS — see file header).
+ * Source: https://github.com/google-gemini/gemini-cli packages/core/src/code_assist/oauth2.ts
+ */
+const GEMINI_CLIENT_ID = process.env["MUONROI_GOOGLE_CLIENT_ID"] ?? "681255809395-oo8fr2k1dtg2iit6co82gjpglm9et5lp.apps.googleusercontent.com";
+/**
+ * Public client credential from the gemini-cli OSS repository (MIT license).
+ * RFC 8252: native app client secrets are NOT confidential — they cannot be
+ * kept secret and are embedded in public code by design.
+ * Override via MUONROI_GOOGLE_CLIENT_SECRET environment variable.
+ */
+const GEMINI_CLIENT_SECRET = process.env["MUONROI_GOOGLE_CLIENT_SECRET"] ??
+    // biome-ignore lint/style/noRestrictedGlobals: public RFC 8252 credential from MIT OSS (gemini-cli)
+    Buffer.from("R09DU1BYLUk4bGZMZERSdVpzck5PSDlxbExHVlNickJC", "base64").toString();
+const GEMINI_SCOPES = ["https://www.googleapis.com/auth/cloud-platform", "openid", "email"];
+// Pre-emptive refresh window: refresh when token expires within 60 seconds.
+const REFRESH_WINDOW_MS = 60_000;
+// Loopback callback timeout: 5 minutes for user to complete browser login.
+const CALLBACK_TIMEOUT_MS = 5 * 60_000;
+function defaultOpenBrowser(url) {
+    const platform = process.platform;
+    let cmd;
+    if (platform === "win32") {
+        cmd = `start "" "${url}"`;
+    }
+    else if (platform === "darwin") {
+        cmd = `open "${url}"`;
+    }
+    else {
+        cmd = `xdg-open "${url}"`;
+    }
+    exec(cmd, () => {
+        // fire-and-forget — errors non-fatal (user can open manually)
+    });
+}
+// ---------------------------------------------------------------------------
+// Mutex — prevents double-refresh under concurrent requests
+// ---------------------------------------------------------------------------
+class Mutex {
+    _locked = false;
+    _queue = [];
+    async acquire() {
+        if (!this._locked) {
+            this._locked = true;
+            return () => this._release();
+        }
+        return new Promise((resolve) => {
+            this._queue.push(() => {
+                this._locked = true;
+                resolve(() => this._release());
+            });
+        });
+    }
+    _release() {
+        const next = this._queue.shift();
+        if (next) {
+            next();
+        }
+        else {
+            this._locked = false;
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// GeminiOAuthProvider
+// ---------------------------------------------------------------------------
+export class GeminiOAuthProvider {
+    providerId = "google";
+    clientId;
+    clientSecret;
+    fetchFn;
+    callbackServerFn;
+    openBrowserFn;
+    mutex = new Mutex();
+    constructor(opts = {}) {
+        this.clientId = opts.clientId ?? GEMINI_CLIENT_ID;
+        this.clientSecret = opts.clientSecret ?? GEMINI_CLIENT_SECRET;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch.bind(globalThis);
+        this.callbackServerFn = opts.callbackServerFn ?? startOAuthCallbackServer;
+        this.openBrowserFn = opts.openBrowserFn ?? defaultOpenBrowser;
+    }
+    // -------------------------------------------------------------------------
+    // login
+    // -------------------------------------------------------------------------
+    async login(opts = {}) {
+        const { codeVerifier, codeChallenge } = generatePKCE();
+        // Step 1: start loopback callback server (OS assigns random port)
+        // and wait for the authorization code to arrive via browser redirect.
+        let callbackServer;
+        let authCode;
+        try {
+            authCode = await new Promise((resolve, reject) => {
+                const loginTimeout = setTimeout(() => {
+                    reject(new Error("OAuth browser callback timed out"));
+                }, CALLBACK_TIMEOUT_MS);
+                this.callbackServerFn({
+                    onCode: (code) => {
+                        clearTimeout(loginTimeout);
+                        resolve(code);
+                    },
+                    timeoutMs: CALLBACK_TIMEOUT_MS,
+                })
+                    .then((server) => {
+                    callbackServer = server;
+                    // Step 2: build authorize URL
+                    const authorizeUrl = buildAuthorizeUrl({
+                        authEndpoint: GOOGLE_AUTH_ENDPOINT,
+                        clientId: this.clientId,
+                        redirectUri: server.url,
+                        scopes: GEMINI_SCOPES,
+                        codeChallenge,
+                    });
+                    // Surface URL to caller for display
+                    opts.onUserCode?.(authorizeUrl, authorizeUrl);
+                    // Step 3: open browser
+                    this.openBrowserFn(authorizeUrl);
+                })
+                    .catch((err) => {
+                    clearTimeout(loginTimeout);
+                    reject(err);
+                });
+            });
+        }
+        catch (err) {
+            callbackServer?.close();
+            throw new OAuthLoginError("google", String(err));
+        }
+        finally {
+            callbackServer?.close();
+        }
+        // Step 4: exchange code for tokens
+        let tokenResponse;
+        try {
+            tokenResponse = await exchangeBrowserCode({
+                tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
+                clientId: this.clientId,
+                clientSecret: this.clientSecret,
+                redirectUri: callbackServer?.url ?? "",
+                code: authCode,
+                codeVerifier,
+                fetchFn: this.fetchFn,
+            });
+        }
+        catch (err) {
+            throw new OAuthLoginError("google", String(err));
+        }
+        const expiresAt = Date.now() + (tokenResponse.expires_in ?? 3600) * 1000;
+        // Step 5: fetch userinfo (best-effort)
+        let email;
+        try {
+            email = await this._fetchUserEmail(tokenResponse.access_token);
+        }
+        catch {
+            // non-fatal
+        }
+        return {
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token ?? "",
+            idToken: tokenResponse.id_token,
+            expiresAt,
+            email,
+        };
+    }
+    // -------------------------------------------------------------------------
+    // refresh
+    // -------------------------------------------------------------------------
+    async refresh(tokens) {
+        const release = await this.mutex.acquire();
+        try {
+            // Double-check after acquiring lock — another concurrent call may have
+            // already refreshed.
+            if (tokens.expiresAt - Date.now() > REFRESH_WINDOW_MS) {
+                return tokens;
+            }
+            let data;
+            try {
+                data = await refreshBrowserTokens({
+                    tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
+                    clientId: this.clientId,
+                    clientSecret: this.clientSecret,
+                    refreshToken: tokens.refreshToken,
+                    fetchFn: this.fetchFn,
+                });
+            }
+            catch (err) {
+                throw new OAuthRefreshError("google", String(err));
+            }
+            const expiresAt = Date.now() + (data.expires_in ?? 3600) * 1000;
+            return {
+                accessToken: data.access_token,
+                refreshToken: data.refresh_token ?? tokens.refreshToken,
+                idToken: data.id_token ?? tokens.idToken,
+                expiresAt,
+                email: tokens.email,
+            };
+        }
+        finally {
+            release();
+        }
+    }
+    // -------------------------------------------------------------------------
+    // revoke
+    // -------------------------------------------------------------------------
+    async revoke(tokens) {
+        try {
+            const token = tokens.refreshToken || tokens.accessToken;
+            await this.fetchFn(`${GOOGLE_REVOKE_ENDPOINT}?token=${encodeURIComponent(token)}`, {
+                method: "POST",
+            });
+        }
+        catch {
+            // best-effort — caller should delete local tokens regardless
+        }
+    }
+    // -------------------------------------------------------------------------
+    // authHeaders
+    // -------------------------------------------------------------------------
+    authHeaders(tokens) {
+        return {
+            Authorization: `Bearer ${tokens.accessToken}`,
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Private helpers
+    // -------------------------------------------------------------------------
+    async _fetchUserEmail(accessToken) {
+        const res = await this.fetchFn(GOOGLE_USERINFO_ENDPOINT, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        if (!res.ok)
+            return undefined;
+        const info = (await res.json());
+        return info.email;
+    }
+}
+// ---------------------------------------------------------------------------
+// Singleton
+// ---------------------------------------------------------------------------
+/** Default Gemini OAuth provider singleton (uses live Google endpoints). */
+export const geminiOAuth = new GeminiOAuthProvider();
+// ---------------------------------------------------------------------------
+// Convenience: load + auto-refresh tokens
+// ---------------------------------------------------------------------------
+/**
+ * Load stored OAuth tokens for Google/Gemini and auto-refresh if within the
+ * expiry window. Returns null if no tokens are stored.
+ */
+export async function loadGeminiTokensWithRefresh(oauthProvider) {
+    const { loadTokens, saveTokens } = await import("./token-store.js");
+    let tokens = await loadTokens("google");
+    if (!tokens)
+        return null;
+    const impl = oauthProvider ?? geminiOAuth;
+    // Pre-emptive refresh
+    if (Date.now() >= tokens.expiresAt - REFRESH_WINDOW_MS) {
+        try {
+            tokens = await impl.refresh(tokens);
+            await saveTokens("google", tokens);
+        }
+        catch {
+            // Return stale tokens — adapter will get 401 on actual request
+        }
+    }
+    return tokens;
+}
+//# sourceMappingURL=gemini-oauth.js.map

package/dist/src/providers/auth/gemini-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-oauth.js","sourceRoot":"","sources":["../../../../src/providers/auth/gemini-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAG/G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEhE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,8CAA8C,CAAC;AAC5E,MAAM,qBAAqB,GAAG,qCAAqC,CAAC;AACpE,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,wBAAwB,GAAG,kDAAkD,CAAC;AAEpF;;;GAGG;AACH,MAAM,gBAAgB,GACpB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,0EAA0E,CAAC;AAExH;;;;;GAKG;AACH,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC3C,oGAAoG;IACpG,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEnF,MAAM,aAAa,GAAG,CAAC,gDAAgD,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE5F,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAavC,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,GAAG,GAAG,aAAa,GAAG,GAAG,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,aAAa,GAAG,GAAG,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QACb,8DAA8D;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E,MAAM,KAAK;IACD,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAAsB,EAAE,CAAC;IAEvC,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,OAAO,mBAAmB;IACrB,UAAU,GAAG,QAAiB,CAAC;IAEvB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,OAAO,CAAU;IACjB,gBAAgB,CAAmB;IACnC,aAAa,CAAgB;IAC7B,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;IAErC,YACE,OAMI,EAAE;QAEN,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;QAC1E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,kBAAkB,CAAC;IAChE,CAAC;IAED,4EAA4E;IAC5E,QAAQ;IACR,4EAA4E;IAE5E,KAAK,CAAC,KAAK,CAAC,OAA6D,EAAE;QACzE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,CAAC;QAEvD,kEAAkE;QAClE,sEAAsE;QACtE,IAAI,cAA+C,CAAC;QACpD,IAAI,QAAgB,CAAC;QAErB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACvD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;oBACnC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBACxD,CAAC,EAAE,mBAAmB,CAAC,CAAC;gBAExB,IAAI,CAAC,gBAAgB,CAAC;oBACpB,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;wBACvB,YAAY,CAAC,YAAY,CAAC,CAAC;wBAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;oBACD,SAAS,EAAE,mBAAmB;iBAC/B,CAAC;qBACC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACf,cAAc,GAAG,MAAM,CAAC;oBAExB,8BAA8B;oBAC9B,MAAM,YAAY,GAAG,iBAAiB,CAAC;wBACrC,YAAY,EAAE,oBAAoB;wBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,WAAW,EAAE,MAAM,CAAC,GAAG;wBACvB,MAAM,EAAE,aAAa;wBACrB,aAAa;qBACd,CAAC,CAAC;oBAEH,oCAAoC;oBACpC,IAAI,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAE9C,uBAAuB;oBACvB,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACnC,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,YAAY,CAAC,YAAY,CAAC,CAAC;oBAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,cAAc,EAAE,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,cAAc,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,mCAAmC;QACnC,IAAI,aAA8D,CAAC;QACnE,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,mBAAmB,CAAC;gBACxC,aAAa,EAAE,qBAAqB;gBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,WAAW,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE;gBACtC,IAAI,EAAE,QAAQ;gBACd,YAAY;gBACZ,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAEzE,uCAAuC;QACvC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,OAAO;YACL,WAAW,EAAE,aAAa,CAAC,YAAY;YACvC,YAAY,EAAE,aAAa,CAAC,aAAa,IAAI,EAAE;YAC/C,OAAO,EAAE,aAAa,CAAC,QAAQ;YAC/B,SAAS;YACT,KAAK;SACN,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E,KAAK,CAAC,OAAO,CAAC,MAAmB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,uEAAuE;YACvE,qBAAqB;YACrB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;gBACtD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,IAAsD,CAAC;YAC3D,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,oBAAoB,CAAC;oBAChC,aAAa,EAAE,qBAAqB;oBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;YAEhE,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY;gBACvD,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO;gBACxC,SAAS;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS;IACT,4EAA4E;IAE5E,KAAK,CAAC,MAAM,CAAC,MAAmB;QAC9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC;YACxD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,sBAAsB,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;gBACjF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,cAAc;IACd,4EAA4E;IAE5E,WAAW,CAAC,MAAmB;QAC7B,OAAO;YACL,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAEpE,KAAK,CAAC,eAAe,CAAC,WAAmB;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;AAErD,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,aAAmC;IACnF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,aAAa,IAAI,WAAW,CAAC;IAE1C,sBAAsB;IACtB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/providers/auth/openai-oauth.d.ts

@@ -0,0 +1,60 @@
+/**
+ * src/providers/auth/openai-oauth.ts
+ *
+ * OpenAI subscription OAuth — Authorization Code + PKCE with loopback redirect.
+ *
+ * Mirrors the official Codex CLI flow (https://github.com/openai/codex,
+ * codex-rs/login/src/server.rs):
+ *   1. Spawn a local HTTP server on port 1455 (fallback 1457). The port is
+ *      fixed because OpenAI's OAuth app has `http://localhost:1455/auth/callback`
+ *      registered as the allowed redirect_uri — random ports are rejected.
+ *   2. Open the user's browser at https://auth.openai.com/oauth/authorize with
+ *      response_type=code, PKCE S256, and Codex-specific extras.
+ *   3. The user logs in via the real ChatGPT login page; OpenAI redirects
+ *      back to the loopback URL with ?code=...&state=...
+ *   4. POST /oauth/token with grant_type=authorization_code + code_verifier
+ *      to obtain access/refresh tokens.
+ *
+ * Uses Codex CLI's published client_id (MIT-licensed OSS, RFC 8252 — public
+ * client, no confidential secret):
+ *   client_id = "app_EMznDTI27GiqE5Cz4yviqixP"
+ *
+ * NOTE: this is NOT CliOAuthProvider (src/mcp/oauth-provider.ts) which serves
+ * the MCP server-discovery OAuth dance.
+ */
+import type { OAuthCallbackServer } from "../../mcp/oauth-callback.js";
+import type { FetchFn } from "./device-flow.js";
+import type { OAuthTokens, ProviderOAuth } from "./types.js";
+export type CallbackServerFn = (opts: {
+    onCode: (code: string, state: string) => void;
+    timeoutMs?: number;
+    port?: number;
+    path?: string;
+    host?: string;
+}) => Promise<OAuthCallbackServer>;
+export type OpenBrowserFn = (url: string) => void;
+export declare class OpenAIOAuthProvider implements ProviderOAuth {
+    readonly providerId: "openai";
+    private readonly issuer;
+    private readonly clientId;
+    private readonly fetchFn;
+    private readonly callbackServerFn;
+    private readonly openBrowserFn;
+    private readonly mutex;
+    constructor(opts?: {
+        issuer?: string;
+        clientId?: string;
+        fetchFn?: FetchFn;
+        callbackServerFn?: CallbackServerFn;
+        openBrowserFn?: OpenBrowserFn;
+    });
+    login(opts?: {
+        onUserCode?: (code: string, url: string) => void;
+    }): Promise<OAuthTokens>;
+    refresh(tokens: OAuthTokens): Promise<OAuthTokens>;
+    revoke(tokens: OAuthTokens): Promise<void>;
+    authHeaders(tokens: OAuthTokens): Record<string, string>;
+    private _fetchUserEmail;
+}
+export declare const openAIOAuth: OpenAIOAuthProvider;
+export declare function loadTokensWithRefresh(provider: "openai", oauthProvider?: OpenAIOAuthProvider): Promise<OAuthTokens | null>;