vforclaude2 0.3.87

package/src/lib/oauth/services/cursor.js

@@ -0,0 +1,179 @@
+import { CURSOR_CONFIG } from "../constants/oauth.js";
+
+/**
+ * Cursor IDE OAuth Service
+ * Supports Import Token method from Cursor IDE's local SQLite database
+ *
+ * Token Location:
+ * - Linux: ~/.config/Cursor/User/globalStorage/state.vscdb
+ * - macOS: /Users/<user>/Library/Application Support/Cursor/User/globalStorage/state.vscdb
+ * - Windows: %APPDATA%\Cursor\User\globalStorage\state.vscdb
+ *
+ * Database Keys:
+ * - cursorAuth/accessToken: The access token
+ * - storage.serviceMachineId: Machine ID for checksum
+ */
+
+export class CursorService {
+  constructor() {
+    this.config = CURSOR_CONFIG;
+  }
+
+  /**
+   * Generate Cursor checksum (jyh cipher)
+   * Algorithm: XOR timestamp bytes with rolling key (initial 165), then base64 encode
+   * Format: {encoded_timestamp},{machineId}
+   */
+  generateChecksum(machineId) {
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    let key = 165;
+    const encoded = [];
+
+    for (let i = 0; i < timestamp.length; i++) {
+      const charCode = timestamp.charCodeAt(i);
+      encoded.push(charCode ^ key);
+      key = (key + charCode) & 0xff; // Rolling key update
+    }
+
+    const base64Encoded = Buffer.from(encoded).toString("base64");
+    return `${base64Encoded},${machineId}`;
+  }
+
+  /**
+   * Build request headers for Cursor API
+   */
+  buildHeaders(accessToken, machineId, ghostMode = false) {
+    const checksum = this.generateChecksum(machineId);
+
+    return {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/connect+proto",
+      "Connect-Protocol-Version": "1",
+      "x-cursor-client-version": this.config.clientVersion,
+      "x-cursor-client-type": this.config.clientType,
+      "x-cursor-client-os": this.detectOS(),
+      "x-cursor-client-arch": this.detectArch(),
+      "x-cursor-client-device-type": "desktop",
+      "x-cursor-checksum": checksum,
+      "x-ghost-mode": ghostMode ? "true" : "false",
+    };
+  }
+
+  /**
+   * Detect OS for headers
+   */
+  detectOS() {
+    if (typeof process !== "undefined") {
+      const platform = process.platform;
+      if (platform === "win32") return "windows";
+      if (platform === "darwin") return "macos";
+      return "linux";
+    }
+    return "linux";
+  }
+
+  /**
+   * Detect architecture for headers
+   */
+  detectArch() {
+    if (typeof process !== "undefined") {
+      const arch = process.arch;
+      if (arch === "x64") return "x86_64";
+      if (arch === "arm64") return "aarch64";
+      return arch;
+    }
+    return "x86_64";
+  }
+
+  /**
+   * Validate and import token from Cursor IDE
+   * Note: We skip API validation because Cursor API uses complex protobuf format.
+   * Token will be validated when actually used for requests.
+   * @param {string} accessToken - Access token from state.vscdb
+   * @param {string} machineId - Machine ID from state.vscdb
+   */
+  async validateImportToken(accessToken, machineId) {
+    // Basic validation
+    if (!accessToken || typeof accessToken !== "string") {
+      throw new Error("Access token is required");
+    }
+
+    if (!machineId || typeof machineId !== "string") {
+      throw new Error("Machine ID is required");
+    }
+
+    // Token format validation (Cursor tokens are typically long strings)
+    if (accessToken.length < 50) {
+      throw new Error("Invalid token format. Token appears too short.");
+    }
+
+    // Machine ID format validation (should be UUID-like)
+    const uuidRegex = /^[a-f0-9-]{32,}$/i;
+    if (!uuidRegex.test(machineId.replace(/-/g, ""))) {
+      throw new Error("Invalid machine ID format. Expected UUID format.");
+    }
+
+    // Note: We don't validate against API because Cursor uses complex protobuf.
+    // Token will be validated when used for actual requests.
+
+    return {
+      accessToken,
+      machineId,
+      expiresIn: 86400, // Cursor tokens typically last 24 hours
+      authMethod: "imported",
+    };
+  }
+
+  /**
+   * Extract user info from token if possible
+   * Cursor tokens may contain encoded user info
+   */
+  extractUserInfo(accessToken) {
+    try {
+      // Try to decode as JWT
+      const parts = accessToken.split(".");
+      if (parts.length === 3) {
+        let payload = parts[1];
+        while (payload.length % 4) {
+          payload += "=";
+        }
+        const decoded = JSON.parse(
+          Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString()
+        );
+        return {
+          email: decoded.email || decoded.sub,
+          userId: decoded.sub || decoded.user_id,
+        };
+      }
+    } catch {
+      // Token is not a JWT, that's okay
+    }
+
+    return null;
+  }
+
+  /**
+   * Get token storage path instructions for user
+   */
+  getTokenStorageInstructions() {
+    return {
+      title: "How to get your Cursor token",
+      steps: [
+        "1. Open Cursor IDE and make sure you're logged in",
+        "2. Find the state.vscdb file:",
+        `   - Linux: ${this.config.tokenStoragePaths.linux}`,
+        `   - macOS: ${this.config.tokenStoragePaths.macos}`,
+        `   - Windows: ${this.config.tokenStoragePaths.windows}`,
+        "3. Open the database with SQLite browser or CLI:",
+        "   sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='cursorAuth/accessToken'\"",
+        "4. Also get the machine ID:",
+        "   sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='storage.serviceMachineId'\"",
+        "5. Paste both values in the form below",
+      ],
+      alternativeMethod: [
+        "Or use this one-liner to get both values:",
+        "sqlite3 state.vscdb \"SELECT key, value FROM itemTable WHERE key IN ('cursorAuth/accessToken', 'storage.serviceMachineId')\"",
+      ],
+    };
+  }
+}

package/src/lib/oauth/services/gemini.js

@@ -0,0 +1,240 @@
+import crypto from "crypto";
+import open from "open";
+import { GEMINI_CONFIG, getOAuthClientMetadata } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { startLocalServer } from "../utils/server.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * Gemini CLI (Google Cloud Code Assist) OAuth Service
+ * Uses standard OAuth2 Authorization Code flow (no PKCE)
+ */
+export class GeminiCLIService {
+  constructor() {
+    this.config = GEMINI_CONFIG;
+  }
+
+  /**
+   * Build Gemini CLI authorization URL
+   */
+  buildAuthUrl(redirectUri, state) {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      scope: this.config.scopes.join(" "),
+      state: state,
+      access_type: "offline",
+      prompt: "consent",
+    });
+
+    return `${this.config.authorizeUrl}?${params.toString()}`;
+  }
+
+  /**
+   * Exchange authorization code for tokens
+   */
+  async exchangeCode(code, redirectUri) {
+    const response = await fetch(this.config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret,
+        code: code,
+        redirect_uri: redirectUri,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Fetch project ID from Google Cloud Code Assist
+   */
+  async fetchProjectId(accessToken) {
+    const response = await fetch(
+      "https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist",
+      {
+        method: "POST",
+        headers: {
+          "Authorization": `Bearer ${accessToken}`,
+          "Content-Type": "application/json",
+          "User-Agent": "google-api-nodejs-client/9.15.1",
+          "X-Goog-Api-Client": "google-cloud-sdk vscode_cloudshelleditor/0.1",
+          "Client-Metadata": JSON.stringify(getOAuthClientMetadata())
+        },
+        body: JSON.stringify({
+          metadata: getOAuthClientMetadata(),
+          mode: 1
+        })
+      }
+    );
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to fetch project ID: ${error}`);
+    }
+
+    const data = await response.json();
+
+    // Extract project ID
+    let projectId = "";
+    if (typeof data.cloudaicompanionProject === "string") {
+      projectId = data.cloudaicompanionProject.trim();
+    } else if (data.cloudaicompanionProject?.id) {
+      projectId = data.cloudaicompanionProject.id.trim();
+    }
+
+    if (!projectId) {
+      throw new Error("No project ID found in response");
+    }
+
+    return projectId;
+  }
+
+  /**
+   * Get user info from Google
+   */
+  async getUserInfo(accessToken) {
+    const response = await fetch(`${this.config.userInfoUrl}?alt=json`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get user info: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Save Gemini CLI tokens to server
+   */
+  async saveTokens(tokens, userInfo, projectId) {
+    const { server, token, userId } = getServerCredentials();
+
+    const response = await fetch(`${server}/api/cli/providers/gemini-cli`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        scope: tokens.scope,
+        email: userInfo.email,
+        projectId: projectId,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete Gemini OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting Gemini OAuth...").start();
+
+    try {
+      spinner.text = "Starting local server...";
+
+      // Start local server for callback
+      let callbackParams = null;
+      const { port, close } = await startLocalServer((params) => {
+        callbackParams = params;
+      });
+
+      const redirectUri = `http://localhost:${port}/callback`;
+      spinner.succeed(`Local server started on port ${port}`);
+
+      // Generate state
+      const state = crypto.randomBytes(32).toString("base64url");
+
+      // Build authorization URL
+      const authUrl = this.buildAuthUrl(redirectUri, state);
+
+      console.log("\nOpening browser for Google authentication...");
+      console.log(`If browser doesn't open, visit:\n${authUrl}\n`);
+
+      // Open browser
+      await open(authUrl);
+
+      // Wait for callback
+      spinner.start("Waiting for Google authorization...");
+
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          reject(new Error("Authentication timeout (5 minutes)"));
+        }, 300000);
+
+        const checkInterval = setInterval(() => {
+          if (callbackParams) {
+            clearInterval(checkInterval);
+            clearTimeout(timeout);
+            resolve();
+          }
+        }, 100);
+      });
+
+      close();
+
+      if (callbackParams.error) {
+        throw new Error(callbackParams.error_description || callbackParams.error);
+      }
+
+      if (!callbackParams.code) {
+        throw new Error("No authorization code received");
+      }
+
+      spinner.start("Exchanging code for tokens...");
+
+      // Exchange code for tokens
+      const tokens = await this.exchangeCode(callbackParams.code, redirectUri);
+
+      spinner.text = "Fetching user info...";
+
+      // Get user info
+      const userInfo = await this.getUserInfo(tokens.access_token);
+
+      spinner.text = "Fetching project ID...";
+
+      // Fetch project ID
+      const projectId = await this.fetchProjectId(tokens.access_token);
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens, userInfo, projectId);
+
+      spinner.succeed(`Gemini CLI connected successfully! (${userInfo.email}, Project: ${projectId})`);
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}
+

package/src/lib/oauth/services/github.js

@@ -0,0 +1,225 @@
+import { OAuthService } from "./oauth.js";
+import { GITHUB_CONFIG } from "../constants/oauth.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * GitHub Copilot OAuth Service
+ * Uses Device Code Flow for authentication
+ */
+export class GitHubService extends OAuthService {
+  constructor() {
+    super(GITHUB_CONFIG);
+  }
+
+  /**
+   * Get device code for GitHub authentication
+   */
+  async getDeviceCode() {
+    const response = await fetch(`${GITHUB_CONFIG.deviceCodeUrl}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: GITHUB_CONFIG.clientId,
+        scope: GITHUB_CONFIG.scopes,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get device code: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Poll for access token using device code
+   */
+  async pollAccessToken(deviceCode, verificationUri, userCode, interval = 5000) {
+    const spinner = createSpinner("Waiting for GitHub authentication...").start();
+    
+    // Show user code and verification URL
+    console.log(`\nPlease visit: ${verificationUri}`);
+    console.log(`Enter code: ${userCode}\n`);
+    
+    // Open browser automatically
+    try {
+      const open = (await import("open")).default;
+      await open(verificationUri);
+    } catch (error) {
+      console.log("Could not open browser automatically. Please visit the URL above manually.");
+    }
+
+    // Poll for access token
+    while (true) {
+      await new Promise(resolve => setTimeout(resolve, interval));
+
+      const response = await fetch(`${GITHUB_CONFIG.tokenUrl}`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body: new URLSearchParams({
+          client_id: GITHUB_CONFIG.clientId,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+      });
+
+      const data = await response.json();
+
+      if (data.access_token) {
+        spinner.succeed("GitHub authentication successful!");
+        return {
+          access_token: data.access_token,
+          token_type: data.token_type,
+          scope: data.scope,
+        };
+      } else if (data.error === "authorization_pending") {
+        // Continue polling
+        continue;
+      } else if (data.error === "slow_down") {
+        // Increase polling interval
+        interval += 5000;
+        continue;
+      } else if (data.error === "expired_token") {
+        spinner.fail("Device code expired. Please try again.");
+        throw new Error("Device code expired");
+      } else if (data.error === "access_denied") {
+        spinner.fail("Access denied by user.");
+        throw new Error("Access denied");
+      } else {
+        spinner.fail("Failed to get access token.");
+        throw new Error(data.error_description || data.error);
+      }
+    }
+  }
+
+  /**
+   * Get Copilot token using GitHub access token
+   */
+  async getCopilotToken(accessToken) {
+    const response = await fetch(`${GITHUB_CONFIG.copilotTokenUrl}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`, // GitHub API typically uses Bearer
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get Copilot token: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Get user info using GitHub access token
+   */
+  async getUserInfo(accessToken) {
+    const response = await fetch(`${GITHUB_CONFIG.userInfoUrl}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`, // GitHub API typically uses Bearer
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get user info: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete GitHub Copilot authentication flow
+   */
+  async authenticate() {
+    try {
+      // Get device code
+      const deviceResponse = await this.getDeviceCode();
+      
+      // Poll for access token
+      const tokenResponse = await this.pollAccessToken(
+        deviceResponse.device_code, 
+        deviceResponse.verification_uri, 
+        deviceResponse.user_code
+      );
+      
+      // Get Copilot token
+      const copilotToken = await this.getCopilotToken(tokenResponse.access_token);
+      
+      // Get user info
+      const userInfo = await this.getUserInfo(tokenResponse.access_token);
+      
+      console.log(`\n✅ Successfully authenticated as ${userInfo.login}`);
+      
+      return {
+        accessToken: tokenResponse.access_token,
+        copilotToken: copilotToken.token,
+        refreshToken: null, // GitHub device flow doesn't return refresh token
+        expiresIn: copilotToken.expires_at,
+        userInfo: {
+          id: userInfo.id,
+          login: userInfo.login,
+          name: userInfo.name,
+          email: userInfo.email,
+        },
+        copilotTokenInfo: copilotToken,
+      };
+    } catch (error) {
+      throw new Error(`GitHub authentication failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Connect to server with GitHub credentials
+   */
+  async connect() {
+    try {
+      // Authenticate with GitHub
+      const authResult = await this.authenticate();
+      
+      // Send credentials to server
+      const { server, token, userId } = await import("../config/index.js").then(m => m.getServerCredentials());
+      const spinner = (await import("../utils/ui.js")).spinner("Connecting to server...").start();
+      
+      const response = await fetch(`${server}/api/cli/providers/github`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`,
+          "X-User-Id": userId,
+        },
+        body: JSON.stringify({
+          accessToken: authResult.accessToken,
+          copilotToken: authResult.copilotToken,
+          userInfo: authResult.userInfo,
+          copilotTokenInfo: authResult.copilotTokenInfo,
+        }),
+      });
+      
+      if (!response.ok) {
+        const errorData = await response.json();
+        throw new Error(errorData.error || "Failed to connect to server");
+      }
+      
+      spinner.succeed("GitHub Copilot connected successfully!");
+      console.log(`\nConnected as: ${authResult.userInfo.login}`);
+    } catch (error) {
+      const { error: showError } = await import("../utils/ui.js");
+      showError(`GitHub connection failed: ${error.message}`);
+      throw error;
+    }
+  }
+}