pi-antigravity-rotator 2.3.1 → 2.3.2

package/src/login.ts

@@ -6,7 +6,7 @@
 
 import { createInterface } from "node:readline";
 import { addAccountToConfig, ensurePiAuthConfig, ensurePiModelsConfig, loadOrCreateAccountsConfig } from "./account-store.js";
-import { buildAuthUrl, discoverProject, exchangeAuthorizationCode, generatePkce, getOAuthClientConfig, getUserEmail } from "./oauth.js";
+import { buildAuthUrl, discoverProject, exchangeAuthorizationCode, generatePkce, generateState, getOAuthClientConfig, getUserEmail } from "./oauth.js";
 import type { AccountConfig } from "./types.js";
 import { getAccountsPath } from "./paths.js";
 
@@ -42,7 +42,8 @@ export async function runLogin(): Promise<void> {
 
 	const oauth = getOAuthClientConfig();
 	const { verifier, challenge } = generatePkce();
-	const authUrl = buildAuthUrl(verifier, challenge);
+	const state = generateState();
+	const authUrl = buildAuthUrl(state, challenge);
 
 	console.log("1. Open this URL in your browser:");
 	console.log();
@@ -66,7 +67,7 @@ export async function runLogin(): Promise<void> {
 		process.exit(1);
 	}
 
-	if (parsed.state && parsed.state !== verifier) {
+	if (parsed.state !== state) {
 		console.error("State mismatch - the URL does not match this login session.");
 		process.exit(1);
 	}

package/src/notification-poller.ts

@@ -48,6 +48,7 @@ function getVersion(): string {
 
 // ── Cached notifications ─────────────────────────────────────────────
 let _notifications: AdminNotification[] = [];
+let _initialPollTimer: ReturnType<typeof setTimeout> | null = null;
 let _pollTimer: ReturnType<typeof setInterval> | null = null;
 
 /**
@@ -100,18 +101,26 @@ export function startNotificationPoller(): void {
 	}
 
 	// Initial delayed fetch
-	setTimeout(() => {
-		void fetchNotifications();
-	}, 15_000);
+	if (!_initialPollTimer) {
+		_initialPollTimer = setTimeout(() => {
+			_initialPollTimer = null;
+			void fetchNotifications();
+		}, 15_000);
+		if (_initialPollTimer.unref) {
+			_initialPollTimer.unref();
+		}
+	}
 
 	// Periodic poll
-	_pollTimer = setInterval(() => {
-		void fetchNotifications();
-	}, POLL_INTERVAL_MS);
-
-	// Don't prevent process exit
-	if (_pollTimer.unref) {
-		_pollTimer.unref();
+	if (!_pollTimer) {
+		_pollTimer = setInterval(() => {
+			void fetchNotifications();
+		}, POLL_INTERVAL_MS);
+
+		// Don't prevent process exit
+		if (_pollTimer.unref) {
+			_pollTimer.unref();
+		}
 	}
 }
 
@@ -119,6 +128,10 @@ export function startNotificationPoller(): void {
  * Stop notification polling.
  */
 export function stopNotificationPoller(): void {
+	if (_initialPollTimer) {
+		clearTimeout(_initialPollTimer);
+		_initialPollTimer = null;
+	}
 	if (_pollTimer) {
 		clearInterval(_pollTimer);
 		_pollTimer = null;

package/src/onboarding.ts

@@ -203,6 +203,7 @@ export function startHostedLogin(
 interface CliLoginSession {
   verifier: string;
   challenge: string;
+  oauthState: string;
   authUrl: string;
   createdAt: number;
 }
@@ -221,11 +222,13 @@ function pruneCliSessions(): void {
 export function serveCliLogin(res: ServerResponse): void {
   pruneCliSessions();
   const { verifier, challenge } = generatePkce();
-  const authUrl = buildAuthUrl(verifier, challenge);
+  const oauthState = generateState();
+  const authUrl = buildAuthUrl(oauthState, challenge);
   const sessionId = generateState();
   cliLoginSessions.set(sessionId, {
     verifier,
     challenge,
+    oauthState,
     authUrl,
     createdAt: Date.now(),
   });
@@ -348,9 +351,11 @@ export async function handleCliLoginApi(
 
   // Parse the redirect URL to extract code
   let code: string | undefined;
+  let state: string | null;
   try {
     const url = new URL(redirectUrl.trim());
     code = url.searchParams.get("code") ?? undefined;
+    state = url.searchParams.get("state");
   } catch {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(
@@ -373,6 +378,16 @@ export async function handleCliLoginApi(
     );
     return;
   }
+  if (state !== session.oauthState) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        ok: false,
+        error: "State mismatch - reload the login page and try again.",
+      }),
+    );
+    return;
+  }
 
   cliLoginSessions.delete(sessionId);