muonroi-cli 1.8.3 → 1.8.5

package/dist/src/providers/auth/gemini-oauth.js

@@ -1,472 +0,0 @@
-/**
- * src/providers/auth/gemini-oauth.ts
- *
- * Agy (Antigravity) Google OAuth implementation.
- * Replaces the old abandoned public gemini-cli OAuth client.
- *
- * Uses client credentials extracted from the local agy.exe binary
- * (registered for agy's "oauth-personal" / Code Assist flow).
- *
- * Agy stores tokens in ~/.gemini/oauth_creds.json (legacy path).
- * We auto-import so existing agy logins continue to work.
- *
- * Override with MUONROI_GOOGLE_* env vars if needed.
- *
- * Note: Even though the provider ID is "google" (for model routing),
- * the OAuth registration and naming is now Agy.
- */
-import { startOAuthCallbackServer } from "../../mcp/oauth-callback.js";
-import { openUrl } from "../../utils/open-url.js";
-import { buildAuthorizeUrl, exchangeBrowserCode, generatePKCE, refreshBrowserTokens } from "./browser-flow.js";
-import { OAuthLoginError, OAuthRefreshError } from "./types.js";
-// ---------------------------------------------------------------------------
-// Constants
-// ---------------------------------------------------------------------------
-const GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
-const GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
-const GOOGLE_USERINFO_ENDPOINT = "https://openidconnect.googleapis.com/v1/userinfo";
-/**
- * Agy Google OAuth client (extracted from local agy.exe binary).
- * This is the client agy uses for its "oauth-personal" / Cloud Code Assist flow.
- *
- * Replaces the old abandoned public gemini-cli client.
- * Pairing: client + secret from strings in agy.exe near cloudcode-pa.
- */
-const AGY_CLIENT_ID = process.env.MUONROI_GOOGLE_CLIENT_ID ??
-    ["884354919052-36trc1jjb3tguiac32ov6cod268c5blh", "apps.googleusercontent.com"].join(".");
-/**
- * Matching secret extracted alongside the client in the agy binary.
- */
-const AGY_CLIENT_SECRET = process.env.MUONROI_GOOGLE_CLIENT_SECRET ??
-    `GOCSPX-${Buffer.from("OVlRV3BGN1JEQzBRVGRqLVl4S013UjBadHNY", "base64").toString()}`;
-// Fallback pairs extracted from agy.exe (try in order until exchange succeeds)
-const AGY_OAUTH_PAIRS = [
-    { clientId: AGY_CLIENT_ID, clientSecret: AGY_CLIENT_SECRET },
-    // second pair from binary
-    {
-        clientId: ["884351071006060591-tmhssin2h21lcre235vtolojh4g403ep", "apps.googleusercontent.com"].join("."),
-        clientSecret: `GOCSPX-${Buffer.from("SzU4RldSNDg2TGRMSjFtTEI4c1hDNHo2cURBZg==", "base64").toString()}`,
-    },
-];
-const AGY_SCOPES = ["https://www.googleapis.com/auth/cloud-platform", "openid", "email"];
-// Pre-emptive refresh window: refresh when token expires within 60 seconds.
-const REFRESH_WINDOW_MS = 60_000;
-// Loopback callback timeout: 5 minutes for user to complete browser login.
-const CALLBACK_TIMEOUT_MS = 5 * 60_000;
-function defaultOpenBrowser(url) {
-    // Delegate to the centralized, injection-safe opener: it validates the scheme
-    // and spawns via execFile (no shell), so metacharacters in the authorization
-    // URL cannot be interpreted as commands. Fire-and-forget — failures are
-    // non-fatal (the user can open the URL manually).
-    openUrl(url);
-}
-// ---------------------------------------------------------------------------
-// Mutex — prevents double-refresh under concurrent requests
-// ---------------------------------------------------------------------------
-class Mutex {
-    _locked = false;
-    _queue = [];
-    async acquire() {
-        if (!this._locked) {
-            this._locked = true;
-            return () => this._release();
-        }
-        return new Promise((resolve) => {
-            this._queue.push(() => {
-                this._locked = true;
-                resolve(() => this._release());
-            });
-        });
-    }
-    _release() {
-        const next = this._queue.shift();
-        if (next) {
-            next();
-        }
-        else {
-            this._locked = false;
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// AgyOAuthProvider (replaces old Gemini OAuth)
-// ---------------------------------------------------------------------------
-export class AgyOAuthProvider {
-    providerId = "google";
-    clientId;
-    clientSecret;
-    fetchFn;
-    callbackServerFn;
-    openBrowserFn;
-    mutex = new Mutex();
-    constructor(opts = {}) {
-        this.clientId = opts.clientId ?? AGY_CLIENT_ID;
-        this.clientSecret = opts.clientSecret ?? AGY_CLIENT_SECRET;
-        this.fetchFn = opts.fetchFn ?? globalThis.fetch.bind(globalThis);
-        this.callbackServerFn = opts.callbackServerFn ?? startOAuthCallbackServer;
-        this.openBrowserFn = opts.openBrowserFn ?? defaultOpenBrowser;
-    }
-    // -------------------------------------------------------------------------
-    // login
-    // -------------------------------------------------------------------------
-    async login(opts = {}) {
-        const { codeVerifier, codeChallenge } = generatePKCE();
-        // Try agy client/secret pairs until we find one that works for token exchange
-        const pairs = process.env.MUONROI_GOOGLE_CLIENT_ID && process.env.MUONROI_GOOGLE_CLIENT_SECRET
-            ? [{ clientId: process.env.MUONROI_GOOGLE_CLIENT_ID, clientSecret: process.env.MUONROI_GOOGLE_CLIENT_SECRET }]
-            : this.clientId !== AGY_CLIENT_ID
-                ? [{ clientId: this.clientId, clientSecret: this.clientSecret }]
-                : AGY_OAUTH_PAIRS;
-        let lastError;
-        for (const pair of pairs) {
-            let callbackServer;
-            let authCode;
-            try {
-                authCode = await new Promise((resolve, reject) => {
-                    const loginTimeout = setTimeout(() => {
-                        reject(new Error("OAuth browser callback timed out"));
-                    }, CALLBACK_TIMEOUT_MS);
-                    this.callbackServerFn({
-                        onCode: (code) => {
-                            clearTimeout(loginTimeout);
-                            resolve(code);
-                        },
-                        timeoutMs: CALLBACK_TIMEOUT_MS,
-                        host: "localhost",
-                    })
-                        .then((server) => {
-                        callbackServer = server;
-                        const authorizeUrl = buildAuthorizeUrl({
-                            authEndpoint: GOOGLE_AUTH_ENDPOINT,
-                            clientId: pair.clientId,
-                            redirectUri: server.url,
-                            scopes: AGY_SCOPES,
-                            codeChallenge,
-                        });
-                        opts.onUserCode?.(authorizeUrl, authorizeUrl);
-                        this.openBrowserFn(authorizeUrl);
-                    })
-                        .catch((err) => {
-                        clearTimeout(loginTimeout);
-                        reject(err);
-                    });
-                });
-            }
-            catch (err) {
-                callbackServer?.close();
-                lastError = err;
-                continue;
-            }
-            finally {
-                callbackServer?.close();
-            }
-            // exchange
-            try {
-                const tokenResponse = await exchangeBrowserCode({
-                    tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
-                    clientId: pair.clientId,
-                    clientSecret: pair.clientSecret,
-                    redirectUri: callbackServer?.url ?? "",
-                    code: authCode,
-                    codeVerifier,
-                    fetchFn: this.fetchFn,
-                });
-                const expiresAt = Date.now() + (tokenResponse.expires_in ?? 3600) * 1000;
-                let email;
-                try {
-                    email = await this._fetchUserEmail(tokenResponse.access_token);
-                }
-                catch { }
-                // success, update instance for future refresh etc.
-                this.clientId = pair.clientId;
-                this.clientSecret = pair.clientSecret;
-                return {
-                    accessToken: tokenResponse.access_token,
-                    refreshToken: tokenResponse.refresh_token ?? "",
-                    idToken: tokenResponse.id_token,
-                    expiresAt,
-                    email,
-                };
-            }
-            catch (err) {
-                lastError = err;
-                // if secret invalid or client invalid, try next pair
-                if (String(err).includes("invalid_client") || String(err).includes("client secret")) {
-                    continue;
-                }
-                throw new OAuthLoginError("google", String(err));
-            }
-        }
-        throw new OAuthLoginError("google", String(lastError || "All Agy client pairs failed"));
-    }
-    // -------------------------------------------------------------------------
-    // refresh
-    // -------------------------------------------------------------------------
-    async refresh(tokens) {
-        const release = await this.mutex.acquire();
-        try {
-            // Double-check after acquiring lock — another concurrent call may have
-            // already refreshed.
-            if (tokens.expiresAt - Date.now() > REFRESH_WINDOW_MS) {
-                return tokens;
-            }
-            let data;
-            try {
-                data = await refreshBrowserTokens({
-                    tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
-                    clientId: this.clientId,
-                    clientSecret: this.clientSecret,
-                    refreshToken: tokens.refreshToken,
-                    fetchFn: this.fetchFn,
-                });
-            }
-            catch (err) {
-                throw new OAuthRefreshError("google", String(err));
-            }
-            const expiresAt = Date.now() + (data.expires_in ?? 3600) * 1000;
-            return {
-                accessToken: data.access_token,
-                refreshToken: data.refresh_token ?? tokens.refreshToken,
-                idToken: data.id_token ?? tokens.idToken,
-                expiresAt,
-                email: tokens.email,
-            };
-        }
-        finally {
-            release();
-        }
-    }
-    // -------------------------------------------------------------------------
-    // revoke
-    // -------------------------------------------------------------------------
-    async revoke(tokens) {
-        try {
-            const token = tokens.refreshToken || tokens.accessToken;
-            await this.fetchFn(`${GOOGLE_REVOKE_ENDPOINT}?token=${encodeURIComponent(token)}`, {
-                method: "POST",
-            });
-        }
-        catch {
-            // best-effort — caller should delete local tokens regardless
-        }
-    }
-    // -------------------------------------------------------------------------
-    // authHeaders
-    // -------------------------------------------------------------------------
-    authHeaders(tokens) {
-        return {
-            Authorization: `Bearer ${tokens.accessToken}`,
-        };
-    }
-    // -------------------------------------------------------------------------
-    // Private helpers
-    // -------------------------------------------------------------------------
-    async _fetchUserEmail(accessToken) {
-        const res = await this.fetchFn(GOOGLE_USERINFO_ENDPOINT, {
-            headers: { Authorization: `Bearer ${accessToken}` },
-        });
-        if (!res.ok)
-            return undefined;
-        const info = (await res.json());
-        return info.email;
-    }
-}
-/** Back-compat for tests that still reference the old class name. */
-export { AgyOAuthProvider as GeminiOAuthProvider };
-// ---------------------------------------------------------------------------
-// Singleton
-// ---------------------------------------------------------------------------
-/** Default Agy OAuth provider singleton (uses agy's Google client registration). */
-export const agyOAuth = new AgyOAuthProvider();
-/** Back-compat alias (some code still references the old name). */
-export const geminiOAuth = agyOAuth;
-// ---------------------------------------------------------------------------
-// Convenience: load + auto-refresh tokens
-// ---------------------------------------------------------------------------
-/**
- * Load stored OAuth tokens for the Google provider using Agy's registration.
- * - Auto-imports from ~/.gemini/oauth_creds.json (agy storage).
- * - Refreshes using the agy client/secret when near expiry.
- */
-export async function loadAgyTokensWithRefresh(oauthProvider) {
-    const { loadTokens, saveTokens } = await import("./token-store.js");
-    let tokens = await loadTokens("google");
-    // Fallback: import existing tokens from agy local config on this machine.
-    if (!tokens) {
-        const imported = await tryLoadFromAgyCreds();
-        if (imported) {
-            if (Date.now() < imported.expiresAt) {
-                tokens = imported;
-                try {
-                    await saveTokens("google", tokens);
-                }
-                catch {
-                    // best effort
-                }
-            }
-            else {
-                // do not persist stale agy token to our store
-                tokens = imported;
-            }
-        }
-    }
-    if (!tokens)
-        return null;
-    const impl = oauthProvider ?? agyOAuth;
-    // Pre-emptive refresh
-    if (Date.now() >= tokens.expiresAt - REFRESH_WINDOW_MS) {
-        try {
-            // For tokens imported from agy, prefer the original client (azp from id_token)
-            // that issued this refresh_token. This makes refresh work even if the token
-            // was created by an older/newer agy client than our hardcoded one.
-            let refreshImpl = impl;
-            const originalClient = extractAzpFromIdToken(tokens.idToken);
-            if (originalClient && originalClient !== impl.clientId) {
-                // Use the exact client that issued this token (from id_token.azp)
-                // paired with agy secret. This is more reliable than hardcoded.
-                refreshImpl = new AgyOAuthProvider({
-                    clientId: originalClient,
-                    clientSecret: AGY_CLIENT_SECRET,
-                });
-            }
-            tokens = await refreshImpl.refresh(tokens);
-            await saveTokens("google", tokens);
-        }
-        catch {
-            // Return stale tokens — adapter will get 401 on actual request
-        }
-    }
-    return tokens;
-}
-/** Back-compat alias for older call sites. */
-export const loadGeminiTokensWithRefresh = loadAgyTokensWithRefresh;
-// ---------------------------------------------------------------------------
-// Approach C: custom OAuth client from settings
-// ---------------------------------------------------------------------------
-const _GEMINI_SCOPES = [
-    "https://www.googleapis.com/auth/cloud-platform",
-    "https://www.googleapis.com/auth/generativelanguage",
-    "openid",
-    "email",
-];
-/**
- * Load a custom OAuth token using user-provided GCP OAuth client credentials.
- * Users register their own OAuth client in GCP Console → use these credentials
- * to obtain tokens with the `generativelanguage` scope (not restricted to
- * cloudcode-pa like the Agy client).
- *
- * Settings sources (in priority order):
- *   1. settings.json → providers → google → oauthClientId / oauthClientSecret
- *   2. MUONROI_GOOGLE_CLIENT_ID / MUONROI_GOOGLE_CLIENT_SECRET env vars
- *
- * Returns null when no custom client is configured.
- */
-export async function loadCustomOAuthTokens() {
-    const { loadUserSettings } = await import("../../utils/settings.js");
-    const settings = loadUserSettings();
-    const providerSettings = settings?.providers?.google;
-    const clientId = providerSettings?.oauthClientId ?? process.env.MUONROI_GOOGLE_CLIENT_ID;
-    const clientSecret = providerSettings?.oauthClientSecret ?? process.env.MUONROI_GOOGLE_CLIENT_SECRET;
-    if (!clientId || !clientSecret)
-        return null;
-    // Load tokens from the token store using a deterministic key "google-custom"
-    const { loadTokens, saveTokens } = await import("./token-store.js");
-    let tokens = await loadTokens("google-custom");
-    if (!tokens)
-        return null;
-    const customProvider = new AgyOAuthProvider({ clientId, clientSecret });
-    // Pre-emptive refresh
-    if (Date.now() >= tokens.expiresAt - REFRESH_WINDOW_MS) {
-        try {
-            tokens = await customProvider.refresh(tokens);
-            await saveTokens("google-custom", tokens);
-        }
-        catch {
-            // Return stale — will get 401 later
-        }
-    }
-    return tokens;
-}
-/**
- * Perform a full OAuth login with a custom client (Approach C).
- * Users run `keys login google` with their own GCP OAuth client configured
- * in settings → this opens the browser with the right scopes.
- */
-export async function loginWithCustomClient() {
-    const { loadUserSettings } = await import("../../utils/settings.js");
-    const settings = loadUserSettings();
-    const providerSettings = settings?.providers?.google;
-    const clientId = providerSettings?.oauthClientId ?? process.env.MUONROI_GOOGLE_CLIENT_ID;
-    const clientSecret = providerSettings?.oauthClientSecret ?? process.env.MUONROI_GOOGLE_CLIENT_SECRET;
-    if (!clientId || !clientSecret)
-        return null;
-    const customProvider = new AgyOAuthProvider({ clientId, clientSecret });
-    // Override scopes to include generativelanguage
-    // The provider uses the existing login flow which requests AGY_SCOPES.
-    // For custom clients we want GEMINI_SCOPES instead, but the AgyOAuthProvider
-    // hardcodes AGY_SCOPES in the authorize URL. To use new scopes the user
-    // must configure them in their GCP OAuth consent screen.
-    // The client still gets a valid cloud-platform token via the browser flow.
-    const tokens = await customProvider.login();
-    const { saveTokens } = await import("./token-store.js");
-    await saveTokens("google-custom", tokens);
-    return tokens;
-}
-/**
- * Try to load tokens previously obtained by agy (from ~/.gemini/oauth_creds.json).
- */
-async function tryLoadFromAgyCreds() {
-    try {
-        const { readFile } = await import("node:fs/promises");
-        const os = await import("node:os");
-        const path = await import("node:path");
-        const agyPath = path.join(os.homedir(), ".gemini", "oauth_creds.json");
-        const raw = await readFile(agyPath, "utf8");
-        const data = JSON.parse(raw);
-        if (!data.refresh_token || !data.access_token)
-            return null;
-        const expiresAt = typeof data.expiry_date === "number" ? data.expiry_date : Date.now() + 3600_000;
-        const tokens = {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token,
-            idToken: data.id_token,
-            expiresAt,
-        };
-        const email = extractEmailFromGoogleIdToken(data.id_token);
-        if (email)
-            tokens.email = email;
-        const { enrollTokensInRedactor } = await import("./token-store.js");
-        enrollTokensInRedactor(tokens);
-        return tokens;
-    }
-    catch {
-        return null;
-    }
-}
-function extractEmailFromGoogleIdToken(idToken) {
-    const payload = parseGoogleIdToken(idToken);
-    return payload?.email;
-}
-function extractAzpFromIdToken(idToken) {
-    const payload = parseGoogleIdToken(idToken);
-    return payload?.azp;
-}
-function parseGoogleIdToken(idToken) {
-    if (!idToken)
-        return null;
-    try {
-        const parts = idToken.split(".");
-        if (parts.length < 2)
-            return null;
-        let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-        while (b64.length % 4)
-            b64 += "=";
-        const json = Buffer.from(b64, "base64").toString("utf8");
-        return JSON.parse(json);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=gemini-oauth.js.map

package/dist/src/providers/gemini.d.ts

@@ -1,11 +0,0 @@
-/**
- * src/providers/gemini.ts
- *
- * Gemini/Agy adapter implementation behind the Adapter interface.
- * Uses @ai-sdk/google + AI SDK v6 streamText/fullStream.
- */
-import type { Adapter, ProviderConfig } from "./types.js";
-/**
- * Create a Gemini (Google) adapter.
- */
-export declare function createGeminiAdapter(config: ProviderConfig): Adapter;

package/dist/src/providers/gemini.js

@@ -1,45 +0,0 @@
-/**
- * src/providers/gemini.ts
- *
- * Gemini/Agy adapter implementation behind the Adapter interface.
- * Uses @ai-sdk/google + AI SDK v6 streamText/fullStream.
- */
-import { createGoogleGenerativeAI } from "@ai-sdk/google";
-import { streamText } from "ai";
-import { redactor } from "../utils/redactor.js";
-import { streamFromFullStream } from "./stream-loop.js";
-/**
- * Create a Gemini (Google) adapter.
- */
-export function createGeminiAdapter(config) {
-    if (config.apiKey && !config.oauthHeaders) {
-        redactor.enrollSecret(config.apiKey);
-    }
-    // When OAuth headers are present, route auth through extraHeaders. The Gemini
-    // SDK still wants a non-empty apiKey for config validation; the Authorization
-    // header takes precedence on the wire.
-    const provider = config.oauthHeaders
-        ? createGoogleGenerativeAI({
-            apiKey: "oauth",
-            baseURL: config.baseURL,
-            headers: config.oauthHeaders,
-        })
-        : createGoogleGenerativeAI({
-            apiKey: config.apiKey,
-            baseURL: config.baseURL,
-        });
-    return {
-        id: "google",
-        async *stream(req) {
-            const result = streamText({
-                model: provider(config.model),
-                messages: req.messages,
-                tools: req.tools,
-                toolChoice: req.toolChoice,
-                abortSignal: req.abortSignal,
-            });
-            yield* streamFromFullStream(result.fullStream);
-        },
-    };
-}
-//# sourceMappingURL=gemini.js.map

package/dist/src/providers/siliconflow-sse-repair.d.ts

@@ -1,58 +0,0 @@
-/**
- * src/providers/siliconflow-sse-repair.ts
- *
- * SiliconFlow streaming returns OpenAI-compatible SSE, but on Qwen3-30B
- * tool-calling turns the FIRST `tool_calls` delta for a given index can
- * arrive without `id` and/or `function.name` — those fields are pushed
- * into a later chunk while the first chunk carries partial arguments.
- *
- * `@ai-sdk/openai-compatible@2.0.42` throws
- * `InvalidResponseDataError("Expected 'id' to be a string.")` at
- * `openai-compatible-chat-language-model.ts:537-541` the moment that
- * first malformed delta lands. The user-visible failure: session
- * 44db9105b119 (2026-05-26) crashed mid-stream right after the first
- * grep tool call returned, with no recoverable state.
- *
- * Evidence chain:
- *   - DB row `routing|Qwen/Qwen3-30B-A3B-Instruct-2507` ts=12:30:33
- *   - DB row `tool_result|grep` ts=12:31:05.753 (last persisted event)
- *   - TUI scrollback shows `Expected 'id' to be a string.` ts=12:31:10
- *   - AI SDK source at the cited line confirms this is the ONLY path
- *     to that exact error message
- *
- * The fix is a `fetch` interceptor for SiliconFlow streaming responses:
- *
- *   1. Per index, buffer (id, name, args) until BOTH id+name are seen.
- *   2. The moment both arrive, emit ONE synthesized "first chunk" with
- *      the accumulated arguments string.
- *   3. After that, every subsequent delta for that index passes through
- *      unmodified.
- *
- * Well-formed streams (id+name on the first chunk) hit only the
- * pass-through path — the repairer is a no-op for them.
- *
- * Tests in `__tests__/siliconflow-sse-repair.test.ts` pin both the
- * malformed and well-formed cases, plus non-SSE pass-through, [DONE]
- * sentinel, and multi-index streams.
- */
-export declare class SiliconflowSseRepairer {
-    private states;
-    /**
-     * Process one SSE event. Returns the repaired event text (possibly
-     * empty string to suppress the event entirely).
-     *
-     * The event text MUST include the trailing blank-line terminator
-     * (`\n\n` or `\r\n\r\n`); the caller is responsible for splitting on
-     * event boundaries.
-     */
-    repairEvent(eventText: string): string;
-}
-/**
- * Wrap a `fetch` implementation so SiliconFlow SSE responses are
- * repaired before reaching `@ai-sdk/openai-compatible`. Non-SSE
- * responses are passed through untouched.
- */
-export declare function createSiliconflowRepairFetch(base?: typeof fetch): typeof fetch;
-export declare const _internals: {
-    SiliconflowSseRepairer: typeof SiliconflowSseRepairer;
-};