swayrouter 1.0.0

package/src/lib/oauth/providers/gemini-cli.js

@@ -0,0 +1,84 @@
+import { GEMINI_CONFIG, getOAuthClientMetadata } from "../constants/oauth.js";
+
+const geminiCli = {
+  config: GEMINI_CONFIG,
+  flowType: "authorization_code",
+  buildAuthUrl: (config, redirectUri, state) => {
+    const params = new URLSearchParams({
+      client_id: config.clientId,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      scope: config.scopes.join(" "),
+      state: state,
+      access_type: "offline",
+      prompt: "consent",
+    });
+    return `${config.authorizeUrl}?${params.toString()}`;
+  },
+  exchangeToken: async (config, code, redirectUri) => {
+    const response = await fetch(config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: code,
+        redirect_uri: redirectUri,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    return await response.json();
+  },
+  postExchange: async (tokens) => {
+
+    const userInfoRes = await fetch(`${GEMINI_CONFIG.userInfoUrl}?alt=json`, {
+      headers: { Authorization: `Bearer ${tokens.access_token}` },
+    });
+    const userInfo = userInfoRes.ok ? await userInfoRes.json() : {};
+
+    let projectId = "";
+    try {
+      const projectRes = await fetch(
+        "https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist",
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${tokens.access_token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({
+            metadata: getOAuthClientMetadata(),
+            mode: 1,
+          }),
+        }
+      );
+      if (projectRes.ok) {
+        const data = await projectRes.json();
+        projectId = data.cloudaicompanionProject?.id || data.cloudaicompanionProject || "";
+      }
+    } catch (e) {
+      console.log("Failed to fetch project ID:", e);
+    }
+
+    return { userInfo, projectId };
+  },
+  mapTokens: (tokens, extra) => ({
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresIn: tokens.expires_in,
+    scope: tokens.scope,
+    email: extra?.userInfo?.email,
+    projectId: extra?.projectId,
+  }),
+};
+
+export default geminiCli;

package/src/lib/oauth/providers/github.js

@@ -0,0 +1,96 @@
+import { GITHUB_CONFIG } from "../constants/oauth.js";
+
+const github = {
+  config: GITHUB_CONFIG,
+  flowType: "device_code",
+  requestDeviceCode: async (config) => {
+    const response = await fetch(config.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        scope: config.scopes,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Device code request failed: ${error}`);
+    }
+
+    return await response.json();
+  },
+  pollToken: async (config, deviceCode) => {
+    const response = await fetch(config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+
+    let data;
+    try {
+      data = await response.json();
+    } catch (e) {
+
+      const text = await response.text();
+      data = { error: "invalid_response", error_description: text };
+    }
+
+    return {
+      ok: response.ok,
+      data: data,
+    };
+  },
+  postExchange: async (tokens) => {
+
+    const copilotRes = await fetch(GITHUB_CONFIG.copilotTokenUrl, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`,
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+    const copilotToken = copilotRes.ok ? await copilotRes.json() : {};
+
+    const userRes = await fetch(GITHUB_CONFIG.userInfoUrl, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`,
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+    const userInfo = userRes.ok ? await userRes.json() : {};
+
+    return { copilotToken, userInfo };
+  },
+  mapTokens: (tokens, extra) => ({
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresIn: tokens.expires_in,
+    name: extra?.userInfo?.login || extra?.userInfo?.name,
+    displayName: extra?.userInfo?.name || extra?.userInfo?.login,
+    email: extra?.userInfo?.email || null,
+    providerSpecificData: {
+      copilotToken: extra?.copilotToken?.token,
+      copilotTokenExpiresAt: extra?.copilotToken?.expires_at,
+      githubUserId: extra?.userInfo?.id,
+      githubLogin: extra?.userInfo?.login,
+      githubName: extra?.userInfo?.name,
+      githubEmail: extra?.userInfo?.email,
+    },
+  }),
+};
+
+export default github;

package/src/lib/oauth/providers/grok-cli.js

@@ -0,0 +1,123 @@
+import { GROK_CLI_CONFIG } from "../constants/oauth.js";
+import { decodeXaiIdTokenEmail, extractEmailFromAccessToken } from "../providerHelpers.js";
+
+const grokCli = {
+  config: GROK_CLI_CONFIG,
+  flowType: "device_code",
+  requestDeviceCode: async (config) => {
+    const body = new URLSearchParams({
+      client_id: config.clientId,
+      scope: config.scope,
+    });
+
+    if (config.referrer) body.set("referrer", config.referrer);
+
+    const response = await fetch(config.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        "User-Agent": "grok-pager/0.2.93 grok-shell/0.2.93 (linux; x86_64)",
+      },
+      body,
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Grok CLI device code request failed: ${error}`);
+    }
+
+    return await response.json();
+  },
+  pollToken: async (config, deviceCode) => {
+    const response = await fetch(config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        "User-Agent": "grok-pager/0.2.93 grok-shell/0.2.93 (linux; x86_64)",
+      },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: deviceCode,
+        client_id: config.clientId,
+      }),
+    });
+
+    let data;
+    try {
+      data = await response.json();
+    } catch {
+      const text = await response.text();
+      data = { error: "invalid_response", error_description: text };
+    }
+
+    const pending =
+      data?.error === "authorization_pending" ||
+      data?.error === "slow_down";
+    return {
+      ok: response.ok || pending,
+      data,
+    };
+  },
+  postExchange: async (tokens) => {
+
+    try {
+      const res = await fetch("https://cli-chat-proxy.grok.com/v1/user", {
+        headers: {
+          Authorization: `Bearer ${tokens.access_token}`,
+          Accept: "application/json",
+          "User-Agent": "grok-pager/0.2.93 grok-shell/0.2.93 (linux; x86_64)",
+          "x-xai-token-auth": "xai-grok-cli",
+          "x-grok-client-version": "0.2.93",
+        },
+      });
+      if (res.ok) return { user: await res.json() };
+    } catch {
+
+    }
+    return { user: null };
+  },
+  mapTokens: (tokens, extra) => {
+    const email =
+      decodeXaiIdTokenEmail(tokens.id_token) ||
+      extractEmailFromAccessToken(tokens.access_token) ||
+      extra?.user?.email ||
+      null;
+    const userId =
+      extra?.user?.userId ||
+      extra?.user?.principalId ||
+      null;
+    const displayName = [extra?.user?.firstName, extra?.user?.lastName]
+      .filter(Boolean)
+      .join(" ")
+      .trim() || null;
+
+    const expiresAt = tokens.expires_in
+      ? new Date(Date.now() + tokens.expires_in * 1000).toISOString()
+      : null;
+
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token || null,
+      expiresIn: tokens.expires_in,
+
+      expiresAt,
+      scope: tokens.scope,
+
+      email: email || undefined,
+      displayName: displayName || undefined,
+
+      providerSpecificData: {
+        authMethod: "device_code",
+        idToken: tokens.id_token || null,
+        email: email || null,
+        userId,
+        hasGrokCodeAccess: extra?.user?.hasGrokCodeAccess ?? null,
+        subscriptionTier: extra?.user?.subscriptionTier ?? null,
+      },
+    };
+  },
+};
+
+export default grokCli;

package/src/lib/oauth/providers/index.js

@@ -0,0 +1,233 @@
+import "../../../open-sse-index.js";
+
+import { generatePKCE } from "../utils/pkce.js";
+import { extractCodexAccountInfo, fetchKiroProfileArn } from "../providerHelpers.js";
+
+import claude from "./claude.js";
+import codex from "./codex.js";
+import xai from "./xai.js";
+import grokCli from "./grok-cli.js";
+import geminiCli from "./gemini-cli.js";
+import antigravity from "./antigravity.js";
+import qoder from "./qoder.js";
+import github from "./github.js";
+import kiro from "./kiro.js";
+import cursor from "./cursor.js";
+import kimi from "./kimi.js";
+import kilocode from "./kilocode.js";
+import cline from "./cline.js";
+import clinepass from "./clinepass.js";
+import codebuddyCn from "./codebuddy-cn.js";
+import codebuddyIntl from "./codebuddy-intl.js";
+import kimchi from "./kimchi.js";
+import trae from "./trae.js";
+import windsurf from "./windsurf.js";
+
+const PROVIDERS = {
+  claude,
+  codex,
+  xai,
+  "grok-cli": grokCli,
+  "gemini-cli": geminiCli,
+  antigravity,
+  qoder,
+  github,
+  kiro,
+  cursor,
+  kimi,
+  kilocode,
+  cline,
+  clinepass,
+  "codebuddy-cn": codebuddyCn,
+  "codebuddy-intl": codebuddyIntl,
+  kimchi,
+  trae,
+  windsurf,
+};
+
+const PROVIDER_ALIASES = {
+  "kimi-coding": "kimi",
+  "grok-build": "grok-cli",
+  gb: "grok-cli",
+};
+
+function metadataOrEmpty(meta) {
+  return meta || {};
+}
+
+async function resolveProviderConfig(provider, meta) {
+  const context = metadataOrEmpty(meta);
+  return provider.prepareConfig
+    ? provider.prepareConfig(provider.config, context)
+    : provider.config;
+}
+
+function createAuthorizationUrl(provider, config, redirectUri, state, codeChallenge, meta) {
+  if (provider.flowType === "device_code") return null;
+  const context = metadataOrEmpty(meta);
+  if (provider.flowType === "authorization_code_pkce") {
+    return provider.buildAuthUrl(config, redirectUri, state, codeChallenge, context);
+  }
+  return provider.buildAuthUrl(config, redirectUri, state, undefined, context);
+}
+
+export function resolveProviderName(name) {
+  return PROVIDER_ALIASES[name] || name;
+}
+
+export function getProviderFlowType(name) {
+  return getProvider(name).flowType;
+}
+
+export function providerUsesPkce(name) {
+  return getProviderFlowType(name) === "authorization_code_pkce";
+}
+
+export function providerRequiresDeviceCodeVerifier(name) {
+  return getProvider(name).deviceCodePkce === true;
+}
+
+export { PROVIDERS };
+
+export { extractCodexAccountInfo, fetchKiroProfileArn };
+
+export function getProvider(name) {
+  const key = resolveProviderName(name);
+  const provider = PROVIDERS[key];
+  if (!provider) {
+    throw new Error(`Unknown provider: ${name}`);
+  }
+  return provider;
+}
+
+export function getProviderNames() {
+  return Object.keys(PROVIDERS);
+}
+
+export async function generateAuthData(providerName, redirectUri, meta) {
+  const provider = getProvider(providerName);
+  const config = await resolveProviderConfig(provider, meta);
+  const { codeVerifier: pkceVerifier, codeChallenge, state: pkceState } = generatePKCE(provider.pkceVerifierBytes);
+
+  const state = config.loginTraceID || pkceState;
+  const codeVerifier =
+    provider.flowType === "authorization_code_pkce" || provider.deviceCodePkce
+      ? pkceVerifier
+      : undefined;
+
+  const authUrl = createAuthorizationUrl(provider, config, redirectUri, state, codeChallenge, meta);
+
+  return {
+    authUrl,
+    state,
+    codeVerifier,
+    codeChallenge,
+    redirectUri,
+    flowType: provider.flowType,
+    fixedPort: provider.fixedPort,
+    callbackPath: provider.callbackPath || "/callback",
+  };
+}
+
+export async function exchangeTokens(providerName, code, redirectUri, codeVerifier, state, meta) {
+  const provider = getProvider(providerName);
+  const config = await resolveProviderConfig(provider, meta);
+
+  const tokens = await provider.exchangeToken(
+    config,
+    code,
+    redirectUri,
+    codeVerifier,
+    state,
+    metadataOrEmpty(meta),
+  );
+
+  let extra = null;
+  if (provider.postExchange) {
+    extra = await provider.postExchange(tokens);
+  }
+
+  return provider.mapTokens(tokens, extra);
+}
+
+export async function requestDeviceCode(providerName, codeChallenge, options) {
+  const provider = getProvider(providerName);
+  if (provider.flowType !== "device_code") {
+    throw new Error(`Provider ${providerName} does not support device code flow`);
+  }
+  return provider.requestDeviceCode(provider.config, codeChallenge, options || {});
+}
+
+export async function pollForToken(providerName, deviceCode, codeVerifier, extraData) {
+  const provider = getProvider(providerName);
+  if (provider.flowType !== "device_code") {
+    throw new Error(`Provider ${providerName} does not support device code flow`);
+  }
+
+  const result = await provider.pollToken(provider.config, deviceCode, codeVerifier, extraData);
+
+  if (!result.ok) {
+    return { success: false, error: result.data.error, errorDescription: result.data.error_description };
+  }
+
+  const data = result.data;
+  if (!data.access_token) {
+    const pending = data.error === "authorization_pending" || data.error === "slow_down";
+    return pending
+      ? {
+          success: false,
+          error: data.error,
+          errorDescription: data.error_description || data.message,
+          pending: data.error === "authorization_pending",
+        }
+      : {
+          success: false,
+          error: data.error || "no_access_token",
+          errorDescription: data.error_description || data.message || "No access token received",
+        };
+  }
+
+  const extra = provider.postExchange ? await provider.postExchange(data) : null;
+  const tokens = provider.mapTokens(data, extra);
+  if (resolveProviderName(providerName) === "kiro" && !tokens.providerSpecificData?.profileArn) {
+    const profileArn = await fetchKiroProfileArn(tokens.accessToken);
+    if (profileArn) tokens.providerSpecificData.profileArn = profileArn;
+  }
+  return { success: true, tokens };
+}
+
+let codexBackfillDone = false;
+
+export async function backfillCodexEmails() {
+  if (codexBackfillDone) return;
+  codexBackfillDone = true;
+  try {
+    const { getProviderConnections, updateProviderConnection } = await import("@/lib/localDb");
+    const connections = await getProviderConnections();
+    const targets = connections.filter((c) => {
+      if (c.provider !== "codex" || c.authType !== "oauth" || !c.idToken) return false;
+      const hasEmail = !!c.email;
+      const hasAccountInfo = !!c.providerSpecificData?.chatgptAccountId;
+      return !hasEmail || !hasAccountInfo;
+    });
+    for (const conn of targets) {
+      const info = extractCodexAccountInfo(conn.idToken);
+      if (!info.email && !info.chatgptAccountId) continue;
+      const patch = {};
+      if (!conn.email && info.email) patch.email = info.email;
+      if (info.chatgptAccountId || info.chatgptPlanType) {
+        patch.providerSpecificData = {
+          ...(conn.providerSpecificData || {}),
+          chatgptAccountId: info.chatgptAccountId,
+          chatgptPlanType: info.chatgptPlanType,
+        };
+      }
+      if (Object.keys(patch).length) {
+        await updateProviderConnection(conn.id, patch);
+      }
+    }
+  } catch (err) {
+    codexBackfillDone = false;
+    console.log("backfillCodexEmails failed:", err?.message || err);
+  }
+}

package/src/lib/oauth/providers/kilocode.js

@@ -0,0 +1,60 @@
+import { KILOCODE_CONFIG } from "../constants/oauth.js";
+
+const kilocode = {
+  config: KILOCODE_CONFIG,
+  flowType: "device_code",
+  requestDeviceCode: async (config) => {
+    const response = await fetch(config.initiateUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+    });
+    if (!response.ok) {
+      if (response.status === 429) {
+        throw new Error("Too many pending authorization requests. Please try again later.");
+      }
+      const error = await response.text();
+      throw new Error(`Device auth initiation failed: ${error}`);
+    }
+    const data = await response.json();
+    return {
+      device_code: data.code,
+      user_code: data.code,
+      verification_uri: data.verificationUrl,
+      verification_uri_complete: data.verificationUrl,
+      expires_in: data.expiresIn || 300,
+      interval: 3,
+    };
+  },
+  pollToken: async (config, deviceCode) => {
+    const response = await fetch(`${config.pollUrlBase}/${deviceCode}`);
+    if (response.status === 202) return { ok: false, data: { error: "authorization_pending" } };
+    if (response.status === 403) return { ok: false, data: { error: "access_denied", error_description: "Authorization denied by user" } };
+    if (response.status === 410) return { ok: false, data: { error: "expired_token", error_description: "Authorization code expired" } };
+    if (!response.ok) return { ok: false, data: { error: "poll_failed", error_description: `Poll failed: ${response.status}` } };
+    const data = await response.json();
+    if (data.status === "approved" && data.token) {
+
+      let orgId = null;
+      try {
+        const profileRes = await fetch(`${config.apiBaseUrl}/api/profile`, {
+          headers: { "Authorization": `Bearer ${data.token}` }
+        });
+        if (profileRes.ok) {
+          const profile = await profileRes.json();
+          orgId = profile.organizations?.[0]?.id || null;
+        }
+      } catch {}
+      return { ok: true, data: { access_token: data.token, _userEmail: data.userEmail, _orgId: orgId } };
+    }
+    return { ok: false, data: { error: "authorization_pending" } };
+  },
+  mapTokens: (tokens) => ({
+    accessToken: tokens.access_token,
+    refreshToken: null,
+    expiresIn: null,
+    email: tokens._userEmail,
+    ...(tokens._orgId ? { providerSpecificData: { orgId: tokens._orgId } } : {}),
+  }),
+};
+
+export default kilocode;

package/src/lib/oauth/providers/kimchi.js

@@ -0,0 +1,79 @@
+import { KIMCHI_CONFIG } from "../constants/oauth.js";
+
+function trimBaseUrl(value) {
+  return (value || "https://app.kimchi.dev").replace(/\/+$/, "");
+}
+
+const kimchi = {
+  config: KIMCHI_CONFIG,
+  flowType: "browser_token",
+  buildAuthUrl: (config, redirectUri, state) => {
+    const baseUrl = trimBaseUrl(config.webAppUrl);
+    const params = new URLSearchParams({
+      callback: redirectUri,
+      state,
+    });
+    return `${baseUrl}/cli-auth?${params.toString()}`;
+  },
+  exchangeToken: async (config, token) => {
+    const accessToken = String(token || "").trim();
+    if (!accessToken) {
+      throw new Error("Missing Kimchi token");
+    }
+
+    const validationUrl = config.validationUrl || "https://api.cast.ai/v1/llm/openai/supported-providers";
+    const validationRes = await fetch(validationUrl, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`,
+      },
+    });
+    if (!validationRes.ok) {
+      throw new Error(`Kimchi token validation failed: ${validationRes.status}`);
+    }
+
+    let userInfo = {};
+    if (config.userInfoUrl) {
+      try {
+        const userRes = await fetch(config.userInfoUrl, {
+          method: "GET",
+          headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${accessToken}`,
+          },
+        });
+        if (userRes.ok) {
+          userInfo = await userRes.json();
+        }
+      } catch {
+        userInfo = {};
+      }
+    }
+
+    return {
+      access_token: accessToken,
+      token_type: "Bearer",
+      _kimchiUser: userInfo,
+    };
+  },
+  mapTokens: (tokens) => {
+    const user = tokens._kimchiUser || {};
+    const userId = user.id ? String(user.id) : "";
+    const username = user.username || "";
+    const email = user.email || (userId ? `kimchi-user-${userId}` : null);
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: null,
+      email,
+      displayName: user.name || username || null,
+      providerSpecificData: {
+        authMethod: "browser_token",
+        userId,
+        username,
+      },
+    };
+  },
+};
+
+export default kimchi;