[v3.8.50] feat(cli): deliver the Antigravity credential straight to the remote install

bin/cli/commands/login.mjs

@@ -19,6 +19,19 @@ import { randomUUID } from "node:crypto";
  *
  * It talks ONLY to Google (no OmniRoute server needed locally), so it works even
  * if the remote VPS is firewalled from the user's machine.
+ *
+ * Push mode: when an active remote context exists (`omniroute connect <host>`), the
+ * blob is POSTed straight to that install instead of being printed for a manual
+ * copy-paste — every piece was already in place:
+ *
+ *   - the context carries an admin-scoped token, and `apiFetch()` injects it;
+ *   - `/api/oauth` requires admin scope (src/server/authz/accessScopes.ts) and stays
+ *     remote-reachable — routeGuard.ts loopback-gates only `/api/oauth/cursor/auto-import`;
+ *   - `/api/oauth/<provider>/paste-credentials` already decodes the blob and persists.
+ *
+ * The push NEVER becomes a hard requirement: this helper exists precisely because it
+ * needs no route to the VPS, so a failed push falls back to printing the blob rather
+ * than losing an authorization the operator just completed in their browser.
  */
 
 const PROVIDER = "antigravity";
@@ -54,7 +67,7 @@ function defaultStartServer(preferredPort) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
       res.end(
         "<!doctype html><meta charset=utf-8><title>OmniRoute</title>" +
-          "<body style=\"font-family:system-ui;padding:2rem\">" +
+          '<body style="font-family:system-ui;padding:2rem">' +
           "<h2>✅ Authorization received</h2>" +
           "<p>Return to your terminal — you can close this tab.</p></body>"
       );
@@ -73,6 +86,51 @@ function defaultStartServer(preferredPort) {
   });
 }
 
+/**
+ * Is this context pointing at another machine? Loopback (and an unresolvable value)
+ * counts as local, so we never auto-push somewhere we cannot reason about.
+ */
+export function isRemoteBaseUrl(baseUrl) {
+  if (!baseUrl) return false;
+  try {
+    const { hostname } = new URL(baseUrl);
+    const host = hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
+    return host !== "localhost" && host !== "127.0.0.1" && host !== "::1";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * POST a credential blob to the active context's install. Never throws: the caller
+ * decides whether a failure is fatal (it is not — it falls back to printing).
+ */
+export async function pushCredentialBlob(provider, blob, deps = {}) {
+  try {
+    const fetchImpl = deps.fetchImpl ?? (await import("../api.mjs")).apiFetch;
+    const res = await fetchImpl(`/api/oauth/${provider}/paste-credentials`, {
+      method: "POST",
+      body: { blob },
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || data?.success === false) {
+      const message =
+        (typeof data?.error === "string" ? data.error : data?.error?.message) ||
+        `HTTP ${res.status}`;
+      return { ok: false, error: message };
+    }
+    return { ok: true, connectionId: data?.connection?.id };
+  } catch (err) {
+    return { ok: false, error: err?.message || String(err) };
+  }
+}
+
+/** Read the active CLI context (baseUrl + scoped token) written by `omniroute connect`. */
+async function defaultResolveContext(overrideName) {
+  const { resolveActiveContext } = await import("../contexts.mjs");
+  return resolveActiveContext(overrideName);
+}
+
 /** Lazy-load the antigravity provider + blob codec (TS source via tsx). */
 async function loadDeps() {
   const { antigravity } = await import("../../../src/lib/oauth/providers/antigravity.ts");
@@ -153,10 +211,41 @@ export async function runAntigravityLogin(opts = {}, deps = {}) {
   const tokens = await exchange(params.code, redirectUri);
   const blob = encodeCredentialBlob({ provider: PROVIDER, tokens });
 
+  // Push when the operator explicitly asked, or when the active context already points
+  // at another machine — that is exactly the situation this helper was built for.
+  const resolveContext = deps.resolveContext ?? defaultResolveContext;
+  const push = deps.push ?? pushCredentialBlob;
+  let context = null;
+  try {
+    context = await resolveContext(opts.context);
+  } catch {
+    // No usable context store — fall through to printing.
+  }
+  const wantsPush =
+    opts.push === true || (opts.push !== false && isRemoteBaseUrl(context?.baseUrl));
+
+  if (wantsPush) {
+    log(`\nSending the credential to ${context?.baseUrl || "the active context"}...\n`);
+    const result = await push(PROVIDER, blob, { context });
+    if (result?.ok) {
+      log(
+        `Antigravity connected on ${context?.baseUrl || "the remote install"}` +
+          `${result.connectionId ? ` (connection ${result.connectionId})` : ""}.\n` +
+          "Nothing to paste — you can close this terminal.\n"
+      );
+      // Deliberately NOT printed: the blob wraps a refresh token and it already landed.
+      return blob;
+    }
+    log(
+      `\nCould not deliver the credential automatically: ${result?.error || "unknown error"}\n` +
+        "Falling back to manual paste — the authorization itself is still valid.\n"
+    );
+  }
+
   print(
     "\n" +
       "Antigravity authorized. Copy the line below and paste it into your remote\n" +
-      "OmniRoute dashboard: Providers → Antigravity → Connect → \"Paste credentials\".\n" +
+      'OmniRoute dashboard: Providers → Antigravity → Connect → "Paste credentials".\n' +
       "(This contains a refresh token — treat it like a password.)\n\n" +
       blob +
       "\n\n"
@@ -170,6 +259,8 @@ async function runLoginAntigravity(opts) {
       browser: opts.browser,
       timeout: opts.timeout,
       port: opts.port,
+      push: opts.push,
+      context: opts.context,
     });
   } catch (err) {
     process.stderr.write(`\nLogin failed: ${err?.message || err}\n`);
@@ -188,5 +279,11 @@ export function registerLogin(program) {
     .option("--no-browser", "Do not auto-open the browser; print the URL instead")
     .option("--port <n>", "Fixed loopback port (default: OS-assigned)", (v) => parseInt(v, 10))
     .option("--timeout <ms>", "How long to wait for the callback", (v) => parseInt(v, 10), 300000)
+    .option(
+      "--push",
+      "Send the credential to the active context instead of printing it (default when that context is remote)"
+    )
+    .option("--no-push", "Always print the blob, never contact the server")
+    .option("--context <name>", "Push to this context instead of the active one")
     .action(runLoginAntigravity);
 }

docs/guides/REMOTE-MODE.md

@@ -121,29 +121,51 @@ There are two supported ways to connect Antigravity to a remote OmniRoute.
 
 ### Option A — local login helper (recommended)
 
-Run the OAuth on **your own computer**, where `127.0.0.1` is reachable, and paste
-the result into the remote dashboard. The helper talks only to Google — it does
-**not** need network access to your VPS, so it works even behind firewalls.
+Run the OAuth on **your own computer**, where `127.0.0.1` is reachable. The helper
+talks to Google directly, so the consent completes where the dashboard's version
+cannot.
+
+**If you are already connected** (`omniroute connect <host>`), there is nothing to
+copy — the helper delivers the credential to that install for you:
 
 ```bash
 # On your LOCAL machine (needs Node.js + a browser):
+omniroute connect 192.168.0.15        # once — mints an admin-scoped context token
 npx omniroute login antigravity
-#   ↳ opens the Google consent in your browser, captures the callback on a local
-#     loopback port, exchanges it, and prints a one-line credential blob:
+#   ↳ opens the Google consent, captures the callback on a local loopback port,
+#     exchanges it, and POSTs the credential to the active context:
 #
+#   Antigravity connected on http://192.168.0.15:20128 (connection abc123).
+#   Nothing to paste — you can close this terminal.
+```
+
+The push happens automatically whenever the active context points at another
+machine. Force it either way with `--push` / `--no-push`, or aim at a specific
+context with `--context <name>`.
+
+**If your machine cannot reach the VPS** (firewalled, no SSH, air-gapped desk), the
+helper still works — it only ever _needs_ Google. Use `--no-push`, or just let the
+push fail: it falls back to printing the blob rather than discarding an
+authorization you already completed.
+
+```bash
+npx omniroute login antigravity --no-push
 #   omniroute-cred-v1.eyJ2IjoxLCJ...
 ```
 
-Then, in the **remote** dashboard: **Providers → Antigravity → Connect**, and
-paste the `omniroute-cred-v1.…` blob into the **Step 2** field (it accepts either
-a callback URL or a credential blob). OmniRoute decodes it, runs the Cloud Code
+Then, in the **remote** dashboard: **Providers → Antigravity → Connect**, and paste
+the `omniroute-cred-v1.…` blob into the **Step 2** field (it accepts either a
+callback URL or a credential blob). OmniRoute decodes it, runs the Cloud Code
 onboarding server-side, and persists the connection.
 
-> The blob contains a refresh token — treat it like a password. It is sent once
-> over your dashboard connection and stored encrypted at rest.
+> The blob contains a refresh token — treat it like a password. On the push path it
+> is sent once over your context's authenticated connection; on the paste path, over
+> your dashboard connection. Either way it is stored encrypted at rest, and a
+> successful push never prints it to your terminal.
 
 Flags: `--no-browser` (print the URL instead of auto-opening), `--port <n>`
-(pin the loopback port), `--timeout <ms>`.
+(pin the loopback port), `--timeout <ms>`, `--push` / `--no-push` (override the
+automatic delivery), `--context <name>` (target a specific context).
 
 ### Option B — SSH local-forward tunnel