opencode-gemini-auth 1.3.6 → 1.3.7

package/README.md

@@ -37,7 +37,7 @@ Add the plugin to your Opencode configuration file
    - A browser window will open for you to approve the access.
    - The plugin spins up a temporary local server to capture the callback.
    - If the local server fails (e.g., port in use or headless environment),
-     you can manually copy/paste the callback URL as instructed.
+     you can manually paste the callback URL or just the authorization code.
 
 Once authenticated, Opencode will use your Google account for Gemini requests.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opencode-gemini-auth",
   "module": "index.ts",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "author": "jenslys",
   "repository": "https://github.com/jenslys/opencode-gemini-auth",
   "files": [
@@ -11,7 +11,7 @@
   "license": "MIT",
   "type": "module",
   "devDependencies": {
-    "@opencode-ai/plugin": "^0.15.31",
+    "@opencode-ai/plugin": "^1.0.203",
     "@types/bun": "latest"
   },
   "peerDependencies": {

package/src/gemini/oauth.ts

@@ -107,53 +107,24 @@ export async function exchangeGemini(
   try {
     const { verifier } = decodeState(state);
 
-    const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-      },
-      body: new URLSearchParams({
-        client_id: GEMINI_CLIENT_ID,
-        client_secret: GEMINI_CLIENT_SECRET,
-        code,
-        grant_type: "authorization_code",
-        redirect_uri: GEMINI_REDIRECT_URI,
-        code_verifier: verifier,
-      }),
-    });
-
-    if (!tokenResponse.ok) {
-      const errorText = await tokenResponse.text();
-      return { type: "failed", error: errorText };
-    }
-
-    const tokenPayload = (await tokenResponse.json()) as GeminiTokenResponse;
-
-    const userInfoResponse = await fetch(
-      "https://www.googleapis.com/oauth2/v1/userinfo?alt=json",
-      {
-        headers: {
-          Authorization: `Bearer ${tokenPayload.access_token}`,
-        },
-      },
-    );
-
-    const userInfo = userInfoResponse.ok
-      ? ((await userInfoResponse.json()) as GeminiUserInfo)
-      : {};
-
-    const refreshToken = tokenPayload.refresh_token;
-    if (!refreshToken) {
-      return { type: "failed", error: "Missing refresh token in response" };
-    }
-
+    return await exchangeGeminiWithVerifierInternal(code, verifier);
+  } catch (error) {
     return {
-      type: "success",
-      refresh: refreshToken,
-      access: tokenPayload.access_token,
-      expires: Date.now() + tokenPayload.expires_in * 1000,
-      email: userInfo.email,
+      type: "failed",
+      error: error instanceof Error ? error.message : "Unknown error",
     };
+  }
+}
+
+/**
+ * Exchange an authorization code using a known PKCE verifier.
+ */
+export async function exchangeGeminiWithVerifier(
+  code: string,
+  verifier: string,
+): Promise<GeminiTokenExchangeResult> {
+  try {
+    return await exchangeGeminiWithVerifierInternal(code, verifier);
   } catch (error) {
     return {
       type: "failed",
@@ -161,3 +132,56 @@ export async function exchangeGemini(
     };
   }
 }
+
+async function exchangeGeminiWithVerifierInternal(
+  code: string,
+  verifier: string,
+): Promise<GeminiTokenExchangeResult> {
+  const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body: new URLSearchParams({
+      client_id: GEMINI_CLIENT_ID,
+      client_secret: GEMINI_CLIENT_SECRET,
+      code,
+      grant_type: "authorization_code",
+      redirect_uri: GEMINI_REDIRECT_URI,
+      code_verifier: verifier,
+    }),
+  });
+
+  if (!tokenResponse.ok) {
+    const errorText = await tokenResponse.text();
+    return { type: "failed", error: errorText };
+  }
+
+  const tokenPayload = (await tokenResponse.json()) as GeminiTokenResponse;
+
+  const userInfoResponse = await fetch(
+    "https://www.googleapis.com/oauth2/v1/userinfo?alt=json",
+    {
+      headers: {
+        Authorization: `Bearer ${tokenPayload.access_token}`,
+      },
+    },
+  );
+
+  const userInfo = userInfoResponse.ok
+    ? ((await userInfoResponse.json()) as GeminiUserInfo)
+    : {};
+
+  const refreshToken = tokenPayload.refresh_token;
+  if (!refreshToken) {
+    return { type: "failed", error: "Missing refresh token in response" };
+  }
+
+  return {
+    type: "success",
+    refresh: refreshToken,
+    access: tokenPayload.access_token,
+    expires: Date.now() + tokenPayload.expires_in * 1000,
+    email: userInfo.email,
+  };
+}

package/src/plugin.ts

@@ -1,7 +1,11 @@
 import { spawn } from "node:child_process";
 
 import { GEMINI_PROVIDER_ID, GEMINI_REDIRECT_URI } from "./constants";
-import { authorizeGemini, exchangeGemini } from "./gemini/oauth";
+import {
+  authorizeGemini,
+  exchangeGemini,
+  exchangeGeminiWithVerifier,
+} from "./gemini/oauth";
 import type { GeminiTokenExchangeResult } from "./gemini/oauth";
 import { accessTokenExpired, isOAuthAuth } from "./plugin/auth";
 import { ensureProjectContext } from "./plugin/project";
@@ -146,16 +150,18 @@ export const GeminiCLIOAuthPlugin = async (
             } catch (error) {
               if (error instanceof Error) {
                 console.log(
-                  `Warning: Couldn't start the local callback listener (${error.message}). You'll need to paste the callback URL.`,
+                  `Warning: Couldn't start the local callback listener (${error.message}). You'll need to paste the callback URL or authorization code.`,
                 );
               } else {
                 console.log(
-                  "Warning: Couldn't start the local callback listener. You'll need to paste the callback URL.",
+                  "Warning: Couldn't start the local callback listener. You'll need to paste the callback URL or authorization code.",
                 );
               }
             }
           } else {
-            console.log("Headless environment detected. You'll need to paste the callback URL.");
+            console.log(
+              "Headless environment detected. You'll need to paste the callback URL or authorization code.",
+            );
           }
 
           const authorization = await authorizeGemini();
@@ -201,22 +207,24 @@ export const GeminiCLIOAuthPlugin = async (
           return {
             url: authorization.url,
             instructions:
-              "Complete OAuth in your browser, then paste the full redirected URL (e.g., http://localhost:8085/oauth2callback?code=...&state=...)",
+              "Complete OAuth in your browser, then paste the full redirected URL (e.g., http://localhost:8085/oauth2callback?code=...&state=...) or just the authorization code.",
             method: "code",
             callback: async (callbackUrl: string): Promise<GeminiTokenExchangeResult> => {
               try {
-                const url = new URL(callbackUrl);
-                const code = url.searchParams.get("code");
-                const state = url.searchParams.get("state");
+                const { code, state } = parseOAuthCallbackInput(callbackUrl);
 
-                if (!code || !state) {
+                if (!code) {
                   return {
                     type: "failed",
-                    error: "Missing code or state in callback URL",
+                    error: "Missing authorization code in callback input",
                   };
                 }
 
-                return exchangeGemini(code, state);
+                if (state) {
+                  return exchangeGemini(code, state);
+                }
+
+                return exchangeGeminiWithVerifier(code, authorization.verifier);
               } catch (error) {
                 return {
                   type: "failed",
@@ -249,6 +257,37 @@ function toUrlString(value: RequestInfo): string {
   return value.toString();
 }
 
+function parseOAuthCallbackInput(input: string): { code?: string; state?: string } {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    return {};
+  }
+
+  if (/^https?:\/\//i.test(trimmed)) {
+    try {
+      const url = new URL(trimmed);
+      return {
+        code: url.searchParams.get("code") || undefined,
+        state: url.searchParams.get("state") || undefined,
+      };
+    } catch {
+      return {};
+    }
+  }
+
+  const candidate = trimmed.startsWith("?") ? trimmed.slice(1) : trimmed;
+  if (candidate.includes("=")) {
+    const params = new URLSearchParams(candidate);
+    const code = params.get("code") || undefined;
+    const state = params.get("state") || undefined;
+    if (code || state) {
+      return { code, state };
+    }
+  }
+
+  return { code: trimmed };
+}
+
 function openBrowserUrl(url: string): void {
   try {
     // Best-effort: don't block auth flow if spawning fails.