src/dashboard/windsurf-login.js
Rama master · réplica de lectura del repositorio original.
/**
* Windsurf direct login — Auth1/Firebase auth + Codeium registration.
* Supports proxy tunneling and fingerprint randomization.
*/
import http from 'http';
import https from 'https';
import { randomBytes } from 'crypto';
import { config, log } from '../config.js';
import { resolveProxyConnectHost } from '../net-safety.js';
import { safeEmailRef, safeKeyRef, logHash, sliceRedactedJson } from '../log-safety.js';
import { isSocks, createSocksTunnel } from '../socks.js';
import { getEmailLockThreshold, getEmailLockMs, getBackendSwitch } from '../runtime-config.js';
import { parseFields, getField, getAllFields } from '../proto.js';
// R-1 (RATE-RETRY audit): bounded response-body reads, shared with the
// devin-connect readers — one ceiling, one truncation contract.
import { createBoundedBodyAccumulator, MAX_ERROR_BODY_BYTES } from '../devin-connect.js';
const FIREBASE_API_KEY = 'AIzaSyDsOl-1XpT5err0Tcnx8FFod1H8gVGIycY';
const FIREBASE_AUTH_URL = `https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${FIREBASE_API_KEY}`;
const FIREBASE_REFRESH_URL = `https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`;
const CODEIUM_REGISTER_URL = 'https://api.codeium.com/register_user/';
const AUTH1_CONNECTIONS_URL = 'https://windsurf.com/_devin-auth/connections';
const AUTH1_PASSWORD_LOGIN_URL = 'https://windsurf.com/_devin-auth/password/login';
const AUTH1_EMAIL_START_URL = 'https://windsurf.com/_devin-auth/email/start';
const AUTH1_EMAIL_COMPLETE_URL = 'https://windsurf.com/_devin-auth/email/complete';
// 2026-04-26: Windsurf added a Connect-RPC email-method probe under
// `_backend/...SeatManagementService/CheckUserLoginMethod` (`{userExists,
// hasPassword}`). It is NOT reliable: for a real, existing account it returns
// an EMPTY `{}` (live recon 2026-10-22), and treating that as "no password"
// or as "password-capable" both misclassify the account. `/_devin-auth/
// connections` is the authoritative probe — its `auth_method.has_password` is
// what windsurf.com's own login page reads. CheckUserLoginMethod is kept only
// as enrichment for the case where connections is unreachable.
const WINDSURF_CHECK_LOGIN_METHOD_URL = 'https://windsurf.com/_backend/exa.seat_management_pb.SeatManagementService/CheckUserLoginMethod';
const WINDSURF_SEAT_SERVICE_BASE = 'https://server.self-serve.windsurf.com/exa.seat_management_pb.SeatManagementService';
const WINDSURF_POST_AUTH_URL = `${WINDSURF_SEAT_SERVICE_BASE}/WindsurfPostAuth`;
const WINDSURF_ONE_TIME_TOKEN_URL = `${WINDSURF_SEAT_SERVICE_BASE}/GetOneTimeAuthToken`;
// v2.0.57 (Fix 2): Windsurf migrated PostAuth into the website _backend
// path. Wam-bundle and the official 2.0.67 IDE talk to the new host;
// keep the old self-serve endpoint as fallback so a regional outage on
// either side doesn't break login. Same for GetOneTimeAuthToken which
// shares the SeatManagementService surface.
const WINDSURF_BACKEND_SEAT_BASE = 'https://windsurf.com/_backend/exa.seat_management_pb.SeatManagementService';
const WINDSURF_POST_AUTH_URL_NEW = `${WINDSURF_BACKEND_SEAT_BASE}/WindsurfPostAuth`;
const WINDSURF_ONE_TIME_TOKEN_URL_NEW = `${WINDSURF_BACKEND_SEAT_BASE}/GetOneTimeAuthToken`;
// ─── Second-host fallback: app.devin.ai (opt-in, OFF by default) ──────────
// The OAuth feasibility study (docs-internal/workflow-results/oauth-relogin-study/
// FEASIBILITY-BLUEPRINT.md §6 + tool-github-oauth-totp.md §1.1) found the
// leaked Windsurf account-switcher drives app.devin.ai/api/auth1/{connections,
// password/login} as the SAME Auth1 mechanism we hit on windsurf.com/_devin-auth,
// differing only by host. windsurf.com runs on Vercel functions that 504/503
// intermittently and has migrated endpoints under us before; pointing a fallback
// at a second host (app.devin.ai) spreads that single-host availability risk
// without touching GitHub OAuth / TOTP / form-scraping.
//
// Gated behind DEVIN_CONNECT_LOGIN_HOST_FALLBACK=1. When the env var is unset
// (default), windsurfLogin behaves EXACTLY as before — only the windsurf.com
// primary path runs and this code is never reached.
const DEVIN_HOST_BASE = 'https://app.devin.ai';
const DEVIN_AUTH1_CONNECTIONS_URL = `${DEVIN_HOST_BASE}/api/auth1/connections`;
const DEVIN_AUTH1_PASSWORD_LOGIN_URL = `${DEVIN_HOST_BASE}/api/auth1/password/login`;
// Same Auth1 email-code flow, same two payloads — only the host and the
// optional `product` field differ (Devin's own bundle sends `{email, mode}`).
const DEVIN_AUTH1_EMAIL_START_URL = `${DEVIN_HOST_BASE}/api/auth1/email/start`;
const DEVIN_AUTH1_EMAIL_COMPLETE_URL = `${DEVIN_HOST_BASE}/api/auth1/email/complete`;
function isLoginHostFallbackEnabled() {
return getBackendSwitch('loginHostFallback');
}
// Test-only transport seam: when set, every httpsRequest in this module is
// routed through the injected fn (same (url, opts, postData, proxy) signature,
// must resolve { status, data } — data is a Buffer when opts.raw is set). Lets
// the host-fallback tests drive the full login flow deterministically with zero
// real network. Mirrors the __set*ForTests convention used elsewhere (auth.js
// __setReloginDeps, _resetEmailLockoutForTests below).
let _transportOverride = null;
export function __setLoginTransportForTests(fn) { _transportOverride = fn; }
export function parsePostAuthResponseData(payload) {
const raw = Buffer.isBuffer(payload) ? payload.toString('utf8') : String(payload || '');
try {
const parsed = JSON.parse(raw);
if (parsed && typeof parsed === 'object') return parsed;
} catch {}
// The wire response is application/proto — decode it directly (binary-safe)
// instead of scanning the bytes as text: session_token = #1, orgs = #2,
// auth1_token = #3 (optional, possibly ROTATED by this exchange),
// account_id = #4, primary_org_id = #5.
if (Buffer.isBuffer(payload)) {
try {
const fields = parseFields(payload);
const sessionToken = getField(fields, 1, 2)?.value?.toString('utf8');
if (sessionToken) {
return {
sessionToken,
accountId: getField(fields, 4, 2)?.value?.toString('utf8'),
primaryOrgId: getField(fields, 5, 2)?.value?.toString('utf8'),
// Field #3 exists in WindsurfPostAuthResponse and the decoder used to
// skip it. Absent → undefined (no behaviour change); present → the
// token that can mint the NEXT session, so callers can re-store it.
auth1Token: getField(fields, 3, 2)?.value?.toString('utf8'),
orgs: getAllFields(fields, 2).filter(f => f.wireType === 2).map(f => decodePostAuthOrg(f.value)),
};
}
} catch {}
}
// Regex fallback for non-protobuf responses (plain-text bodies etc.).
const sessionToken = raw.match(/devin-session-token\$[a-zA-Z0-9._-]+/)?.[0];
const accountId = raw.match(/account-[a-f0-9]+/)?.[0];
const primaryOrgId = raw.match(/org-[a-f0-9]+/)?.[0];
if (sessionToken) return { sessionToken, accountId, primaryOrgId };
return { error: raw.slice(0, 200) || 'empty response' };
}
/** Decode one WindsurfPostAuthOrg sub-message (#2 of WindsurfPostAuthResponse). */
function decodePostAuthOrg(buf) {
const f = parseFields(buf);
const str = (n) => getField(f, n, 2)?.value?.toString('utf8');
const bool = (n) => { const v = getField(f, n, 0); return v ? v.value !== 0 : undefined; };
return {
id: str(1), name: str(2), isAdmin: bool(3), canUseCli: bool(4),
canUseCascade: bool(5), planSlug: str(6), subscriptionStatus: str(7),
webappHost: str(8), ssoLoginRequired: bool(9),
};
}
async function postAuthDualPath(auth1Token, fingerprint, proxy, preferredHost = null) {
// v2.0.91 (#144 by @Await-d): upstream PostAuth now expects:
// - empty application/proto body (not the old JSON bridge)
// - X-Devin-Auth1-Token header (not in body)
// - Referer from windsurf.com
// - Raw response that may be binary proto or JSON
const body = Buffer.alloc(0);
const headers = {
...fingerprint,
'Content-Type': 'application/proto',
'Content-Length': 0,
'Connect-Protocol-Version': '1',
'X-Devin-Auth1-Token': auth1Token,
'Referer': 'https://windsurf.com/account/login',
};
const orderedHosts = preferredHost === 'legacy'
? [[WINDSURF_POST_AUTH_URL, 'legacy'], [WINDSURF_POST_AUTH_URL_NEW, 'new']]
: [[WINDSURF_POST_AUTH_URL_NEW, 'new'], [WINDSURF_POST_AUTH_URL, 'legacy']];
let lastErr;
for (const [url, label] of orderedHosts) {
try {
const rawRes = await httpsRequest(url, { method: 'POST', headers, raw: true }, body, proxy);
const res = { ...rawRes, data: parsePostAuthResponseData(rawRes.data) };
if (res.status >= 400 && res.status < 500) return { res, label };
if (res.status >= 200 && res.status < 300 && res.data?.sessionToken) {
return { res, label };
}
lastErr = new Error(`PostAuth ${label} HTTP ${res.status}: ${sliceRedactedJson(res.data)}`);
} catch (e) {
lastErr = new Error(`PostAuth ${label}: ${e.message}`);
}
}
throw lastErr || new Error('PostAuth: both endpoints failed');
}
async function oneTimeTokenDualPath(body, fingerprint, proxy, preferredHost = null) {
// v2.0.61 (#114): pin OneTimeAuthToken to whichever host PostAuth used.
// The session token gateways aren't symmetric — a token minted by
// windsurf.com/_backend may be rejected as "invalid token" on
// server.self-serve.windsurf.com (and vice versa). When we know which
// host PostAuth just talked to, retry order is forced to put it first
// so we don't accidentally replay the token across host boundaries.
const headers = buildJsonHeaders(fingerprint, body, { 'Connect-Protocol-Version': '1' });
const orderedHosts = preferredHost === 'legacy'
? [[WINDSURF_ONE_TIME_TOKEN_URL, 'legacy'], [WINDSURF_ONE_TIME_TOKEN_URL_NEW, 'new']]
: [[WINDSURF_ONE_TIME_TOKEN_URL_NEW, 'new'], [WINDSURF_ONE_TIME_TOKEN_URL, 'legacy']];
let lastErr;
let firstRes = null;
let firstLabel = null;
for (const [url, label] of orderedHosts) {
try {
const res = await httpsRequest(url, { method: 'POST', headers }, body, proxy);
if (res.status >= 200 && res.status < 300 && res.data?.authToken) {
return { res, label };
}
// v2.0.61: 4xx from the preferred host is meaningful — used to
// return immediately so caller saw the real auth error.
//
// v2.0.79 (audit M-3): widened to keep trying the other host
// ONLY when the preferred host returned an "invalid token"
// 401 — that signal is exactly the cross-host symmetry failure
// we want to fall through. Other 4xx codes (400 bad request,
// 403 forbidden, 410 gone) still short-circuit because they're
// genuine permanent errors and trying the other host won't help.
if (res.status >= 400 && res.status < 500) {
const blob = JSON.stringify(res.data || '').toLowerCase();
const isInvalidToken = res.status === 401 && /invalid\s*token|unauthenticated/i.test(blob);
if (label === orderedHosts[0][1] && !isInvalidToken) {
return { res, label };
}
// Either non-preferred 4xx OR preferred-but-invalid-token: keep
// the response around in case the other host also fails — we
// surface the FIRST 4xx (preferred host) so the caller sees the
// primary auth error not whatever the fallback produced.
if (firstRes === null) {
firstRes = res;
firstLabel = label;
}
lastErr = new Error(`OneTimeToken ${label} HTTP ${res.status}: ${sliceRedactedJson(res.data)}`);
continue;
}
lastErr = new Error(`OneTimeToken ${label} HTTP ${res.status}: ${sliceRedactedJson(res.data)}`);
} catch (e) {
lastErr = new Error(`OneTimeToken ${label}: ${e.message}`);
}
}
// Both hosts failed — return the preferred-host 4xx if we have one
// (more useful to the caller than the fallback's error).
if (firstRes) return { res: firstRes, label: firstLabel };
throw lastErr || new Error('OneTimeToken: both endpoints failed');
}
// ─── Fingerprint randomization ────────────────────────────
const OS_VERSIONS = [
'Windows NT 10.0; Win64; x64',
'Windows NT 10.0; WOW64',
'Macintosh; Intel Mac OS X 10_15_7',
'Macintosh; Intel Mac OS X 11_6_0',
'Macintosh; Intel Mac OS X 12_3_1',
'Macintosh; Intel Mac OS X 13_4_1',
'Macintosh; Intel Mac OS X 14_2_1',
'X11; Linux x86_64',
'X11; Ubuntu; Linux x86_64',
];
const CHROME_VERSIONS = [
'120.0.0.0', '121.0.0.0', '122.0.0.0', '123.0.0.0', '124.0.0.0',
'125.0.0.0', '126.0.0.0', '127.0.0.0', '128.0.0.0', '129.0.0.0',
'130.0.0.0', '131.0.0.0', '132.0.0.0', '133.0.0.0', '134.0.0.0',
];
// Same version the official IDE reports (src/windsurf.js DEFAULT_CLIENT_VERSION),
// sent as x-client-version on the Auth1/check-login-method hops. Mirror the
// upstream browser/desktop client header set so referrer-based firewall rules
// see the same fingerprint as a real Windsurf client.
const CLIENT_VERSION = process.env.WINDSURF_CLIENT_VERSION || '2.0.67';
const ACCEPT_LANGUAGES = [
'en-US,en;q=0.9', 'en-GB,en;q=0.9', 'zh-TW,zh;q=0.9,en;q=0.8',
'zh-CN,zh;q=0.9,en;q=0.8', 'ja,en-US;q=0.9,en;q=0.8',
'ko,en-US;q=0.9,en;q=0.8', 'de,en-US;q=0.9,en;q=0.8',
'fr,en-US;q=0.9,en;q=0.8', 'es,en-US;q=0.9,en;q=0.8',
'pt-BR,pt;q=0.9,en;q=0.8',
];
function pick(arr) { return arr[Math.floor(Math.random() * arr.length)]; }
function generateFingerprint() {
const os = pick(OS_VERSIONS);
const chromeVer = pick(CHROME_VERSIONS);
const major = chromeVer.split('.')[0];
const ua = `Mozilla/5.0 (${os}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeVer} Safari/537.36`;
// Auth1/PostAuth routes are gated on a desktop-browser referrer; a desktop
// User-Agent + Origin/Referer pair keeps this proxy indistinguishable from
// the real Windsurf website client (mirrors cubezhao/ai-tools-mng auth.rs).
return {
'User-Agent': ua,
'Accept-Language': pick(ACCEPT_LANGUAGES),
'Accept': 'application/json, text/plain, */*',
'Accept-Encoding': 'identity',
'sec-ch-ua': `"Chromium";v="${major}", "Google Chrome";v="${major}", "Not-A.Brand";v="99"`,
'sec-ch-ua-mobile': '?0',
'sec-ch-ua-platform': os.includes('Windows') ? '"Windows"' : os.includes('Mac') ? '"macOS"' : '"Linux"',
'Sec-Fetch-Dest': 'empty',
'Sec-Fetch-Mode': 'cors',
'Sec-Fetch-Site': 'cross-site',
'Origin': 'https://windsurf.com',
'Referer': 'https://windsurf.com/',
};
}
function buildJsonHeaders(fingerprint, body, extra = {}) {
return {
...fingerprint,
'Content-Type': 'application/json',
'Content-Length': Buffer.byteLength(body),
'x-client-version': CLIENT_VERSION,
...extra,
};
}
// ─── Proxy tunnel (HTTP CONNECT or SOCKS5) ───────────────
async function createProxyTunnel(proxy, targetHost, targetPort) {
if (isSocks(proxy)) return createSocksTunnel(proxy, targetHost, targetPort);
// #11: pin the proxy host to a vetted IP literal (no second rebindable lookup).
const rawHost = proxy.host.replace(/:\d+$/, '');
const proxyHost = await resolveProxyConnectHost(rawHost, { allowPrivate: config.allowPrivateProxyHosts });
return new Promise((resolve, reject) => {
const proxyPort = proxy.port || 8080;
const connectReq = http.request({
host: proxyHost,
port: proxyPort,
method: 'CONNECT',
path: `${targetHost}:${targetPort}`,
headers: {
Host: `${targetHost}:${targetPort}`,
...(proxy.username ? { 'Proxy-Authorization': `Basic ${Buffer.from(`${proxy.username}:${proxy.password || ''}`).toString('base64')}` } : {}),
},
});
connectReq.on('connect', (res, socket) => {
if (res.statusCode === 200) {
resolve(socket);
} else {
socket.destroy();
reject(new Error(`Proxy CONNECT failed: ${res.statusCode}`));
}
});
connectReq.on('error', (err) => reject(new Error(`Proxy connection error: ${err.message}`)));
connectReq.setTimeout(15000, () => { connectReq.destroy(); reject(new Error('Proxy connection timeout')); });
connectReq.end();
});
}
// ─── HTTPS request with optional proxy ────────────────────
function httpsRequest(url, opts, postData, proxy) {
if (_transportOverride) return _transportOverride(url, opts, postData, proxy);
return new Promise(async (resolve, reject) => {
const parsed = new URL(url);
const requestOpts = {
hostname: parsed.hostname,
port: 443,
path: parsed.pathname + parsed.search,
method: opts.method || 'POST',
headers: opts.headers || {},
};
const handleResponse = (res) => {
// R-1 (RATE-RETRY audit): bounded read — see createBoundedBodyAccumulator
// (shared ceiling). Over the cap → reject; never parse a truncated prefix.
const buffer = createBoundedBodyAccumulator();
res.on('data', buffer.onData);
res.on('end', () => {
const { raw: rawBuffer, truncated } = buffer.finish();
if (truncated) {
reject(new Error(`Response body exceeded ${MAX_ERROR_BODY_BYTES} bytes; truncated`));
return;
}
if (opts.raw) {
resolve({ status: res.statusCode, data: rawBuffer });
return;
}
const raw = rawBuffer.toString('utf8');
try {
resolve({ status: res.statusCode, data: JSON.parse(raw) });
} catch {
reject(new Error(`Parse error (status ${res.statusCode}, encoding ${res.headers['content-encoding'] || 'identity'}): ${raw.slice(0, 200)}`));
}
});
res.on('error', reject);
};
try {
let req;
if (proxy && proxy.host) {
const socket = await createProxyTunnel(proxy, parsed.hostname, 443);
requestOpts.socket = socket;
requestOpts.agent = false;
req = https.request(requestOpts, handleResponse);
} else {
req = https.request(requestOpts, handleResponse);
}
req.on('error', (err) => reject(new Error(`Request error: ${err.message}`)));
req.setTimeout(30000, () => { req.destroy(); reject(new Error('Request timeout')); });
if (postData) req.write(postData);
req.end();
} catch (err) {
reject(err);
}
});
}
// ─── Login flow ───────────────────────────────────────────
function createFriendlyAuthError(prefix, detail, fallback = 'ERR_LOGIN_FAILED') {
const normalized = String(detail || '').trim();
// Map Firebase/Auth1 error codes to our error codes
const errorCodeMap = {
'EMAIL_NOT_FOUND': 'ERR_EMAIL_NOT_FOUND',
'INVALID_PASSWORD': 'ERR_INVALID_PASSWORD',
'INVALID_LOGIN_CREDENTIALS': 'ERR_INVALID_CREDENTIALS',
'Invalid email or password': 'ERR_INVALID_CREDENTIALS',
'No password set. Please log in with Google or GitHub.': 'ERR_NO_PASSWORD_SET',
'No password set': 'ERR_NO_PASSWORD_SET',
'USER_DISABLED': 'ERR_USER_DISABLED',
'TOO_MANY_ATTEMPTS_TRY_LATER': 'ERR_TOO_MANY_ATTEMPTS',
'INVALID_EMAIL': 'ERR_INVALID_EMAIL',
// Firebase API-key referrer restriction (403). Not a credential failure —
// our egress is what upstream rejected, so it must read as a deployment
// problem, not "wrong password", and must never feed the email lockout.
'API_KEY_HTTP_REFERRER_BLOCKED': 'ERR_HTTP_REFERRER_BLOCKED',
};
const errorCode = errorCodeMap[normalized] || normalized || fallback;
const err = new Error(errorCode);
err.isAuthFail = [
'EMAIL_NOT_FOUND',
'INVALID_PASSWORD',
'INVALID_LOGIN_CREDENTIALS',
'Invalid email or password',
'No password set. Please log in with Google or GitHub.',
'No password set',
].includes(normalized);
err.firebaseCode = normalized || undefined;
err.code = errorCode;
return err;
}
// 5xx retry helper: Windsurf 的 _devin-auth/* 端点跑在 Vercel functions
// 上，时不时 504 / 503 (FUNCTION_INVOCATION_TIMEOUT)。一次 dispatch 的
// 暂时失败不该让用户看到 "登录失败"，所以对 5xx 加退避重试 (max 3 次)。
// 4xx 和 200 直接返回不重试。
async function httpsRequestRetrying(url, opts, postData, proxy, label = 'request') {
let lastErr = null;
const delays = [0, 2000, 5000];
for (let i = 0; i < delays.length; i++) {
if (delays[i]) await new Promise(r => setTimeout(r, delays[i]));
try {
const res = await httpsRequest(url, opts, postData, proxy);
if (res.status >= 500 && res.status < 600) {
log.warn(`${label} upstream ${res.status} (attempt ${i + 1}/${delays.length})`);
lastErr = new Error(`Windsurf upstream ${res.status}: ${sliceRedactedJson(res.data || '')}`);
continue;
}
return res;
} catch (e) {
log.warn(`${label} threw: ${e.message} (attempt ${i + 1}/${delays.length})`);
lastErr = e;
}
}
throw lastErr || new Error(`${label} failed after retries`);
}
// Windsurf serves two shapes on /_devin-auth/connections:
// { auth_method: { method, has_password, enterprise_sso_domain }, connections: [...] }
// { auth_method: { method: 'auth1', has_password: bool } } (older)
//
// `auth_method.has_password` is the ONLY authoritative password signal — it is
// what windsurf.com's own login page branches on (`if (has_password) password
// step; else send email code`).
//
// `connections[type=email].enabled` does NOT mean "has a password": the live
// OAuth-only account returns `email.enabled:true` alongside
// `has_password:false`, because the email connection is what carries the
// email CODE. Reading `enabled` as "password-capable" (what this function used
// to do) sent that account to password/login, and the resulting 401 was
// reported as ERR_INVALID_CREDENTIALS instead of "no password". Never infer a
// password from the connection list; when `auth_method` is absent the answer
// is `null` (unknown), not `true`.
function interpretConnections(data) {
if (!data || typeof data !== 'object' || Array.isArray(data)) {
return { method: null, hasPassword: null, userExists: null, emailCode: false, oauth: [], raw: {} };
}
const authMethod = data.auth_method && typeof data.auth_method === 'object' ? data.auth_method : null;
const conns = Array.isArray(data.connections)
? data.connections.filter(c => c && typeof c === 'object')
: null;
const emailConn = conns ? conns.find(c => c.type === 'email') : null;
const emailOffered = !!(emailConn && emailConn.enabled !== false);
const oauth = conns
? conns.filter(c => c.enabled !== false && (c.type === 'google' || c.type === 'github')).map(c => c.type)
: [];
const hasPassword = authMethod && typeof authMethod.has_password === 'boolean'
? authMethod.has_password
: null;
// `method:null` on a present auth_method is upstream's "no such account", and
// so is the LITERAL string "not_found": measured live 2026-10-22, an unknown
// address returns
// auth_method: { method: "not_found", has_password: false, enterprise_sso_domain: false }
// and windsurf.com's own login bundle branches on exactly that value
// (`method === 'not_found'` → "No account found. Sign up?"). Reading it as a
// method made `userExists` true and offered an email code for a typo (F1).
// It is a sentinel, never a login method — do not return it to callers.
const rawMethod = authMethod && typeof authMethod.method === 'string'
? authMethod.method.trim()
: '';
const method = rawMethod && rawMethod !== 'not_found' ? rawMethod : null;
// With `auth_method` present, `method:null`/`not_found` is upstream's "no
// such account". WITHOUT it, an empty `connections: []` is not evidence of
// anything — the body may simply be partial — so the answer is "unknown"
// (null), never "no account". Returning false there made a probe reply of
// `{"connections":[]}` (a real shape from app.devin.ai) abort the login as
// ERR_EMAIL_NOT_FOUND.
const userExists = authMethod
? method !== null
: (conns && conns.length > 0 ? true : null);
// Email-code login is the alternative whenever there is no password. With
// `hasPassword:true` the email connection is the password form, not a code.
// A missing account gets neither: upstream's has_password:false describes a
// method with no account behind it, so it must not become an offer to send
// mail (F1).
const emailCode = userExists === false
? false
: hasPassword === false
? (conns ? emailOffered : true)
: (hasPassword === null ? emailOffered : false);
// The connection list is global, not account-scoped: upstream returns the
// same email/google/github entries for an address that does not exist. Do
// not hand a caller a provider list for a missing account.
return { method, hasPassword, userExists, emailCode, oauth: userExists === false ? [] : oauth, raw: data };
}
// Which host answered the method probe for an address. The email-code flow
// starts on the SAME host: a probe that only app.devin.ai could answer is
// evidence that windsurf.com is not reachable from this deployment, and
// guessing again would send the operator's code request into the outage.
const PROBE_HOST_TTL_MS = 5 * 60 * 1000;
const _probeHost = new Map();
export function _resetProbeHostForTests() { _probeHost.clear(); }
function rememberProbeHost(email, host) {
const key = String(email || '').toLowerCase();
if (!key || (host !== 'windsurf' && host !== 'devin')) return;
_probeHost.set(key, { host, at: Date.now() });
if (_probeHost.size <= 200) return;
const oldest = [..._probeHost.entries()].sort((a, b) => a[1].at - b[1].at)
.slice(0, _probeHost.size - 200);
for (const [k] of oldest) _probeHost.delete(k);
}
function preferredEmailHost(email) {
const key = String(email || '').toLowerCase();
const entry = _probeHost.get(key);
if (!entry) return null;
if (Date.now() - entry.at > PROBE_HOST_TTL_MS) {
_probeHost.delete(key);
return null;
}
return entry.host;
}
async function fetchAuth1Connections(email, fingerprint, proxy, host = 'windsurf') {
const body = JSON.stringify({ product: 'windsurf', email });
const headers = buildJsonHeaders(fingerprint, body);
const url = host === 'devin' ? DEVIN_AUTH1_CONNECTIONS_URL : AUTH1_CONNECTIONS_URL;
const res = await httpsRequestRetrying(
url, { method: 'POST', headers }, body, proxy, `Auth1 connections (${host})`
);
// 400/422 is upstream answering about the REQUEST (measured: a malformed
// address returns `value is not a valid email address`). Retrying it on the
// other host or on the secondary probe cannot change that answer, so it is
// terminal instead of "unknown".
if (res.status === 400 || res.status === 422) {
const detail = upstreamDetail(res.data);
const invalidEmail = /email/i.test(detail);
const err = new Error(invalidEmail ? 'ERR_INVALID_EMAIL' : 'ERR_LOGIN_PROBE_FAILED');
err.code = err.message;
err.statusCode = 400;
err.detail = detail || `upstream ${res.status}`;
throw err;
}
if (res.status >= 400) {
const err = new Error(`connections ${res.status}`);
err.statusCode = res.status;
throw err;
}
return res.data || {};
}
// Secondary probe (Windsurf 2026-04-26 Connect-RPC surface). Only consulted
// when /_devin-auth/connections is unreachable — it returns `{}` for real
// accounts, so an empty body is "unknown" (null), never "no password" and
// never "password-capable".
// Returns the uniform { method, hasPassword, userExists, emailCode, oauth, raw }
// shape, or null when it learned nothing.
async function fetchCheckUserLoginMethod(email, fingerprint, proxy) {
const body = JSON.stringify({ email });
const headers = buildJsonHeaders(fingerprint, body, { 'Connect-Protocol-Version': '1' });
try {
const res = await httpsRequest(
WINDSURF_CHECK_LOGIN_METHOD_URL, { method: 'POST', headers }, body, proxy
);
if (res.status !== 200 || !res.data || typeof res.data !== 'object') {
log.warn(`CheckUserLoginMethod non-200 (${res.status}): ${sliceRedactedJson(res.data || '')}`);
return null;
}
// Empirically (2026-04-29) the Vercel function will sometimes serve
// an empty `{}` for valid emails — likely a cache miss / cold-start
// edge or geo-routing fallback. Treating `userExists`/`hasPassword`
// as false in that case wrongly funnels every account into the
// "no password set" branch and aborts before any login attempt.
// When neither field is present, the answer is "unknown".
const hasUserField = Object.prototype.hasOwnProperty.call(res.data, 'userExists');
const hasPwField = Object.prototype.hasOwnProperty.call(res.data, 'hasPassword');
if (!hasUserField && !hasPwField) {
log.warn(`CheckUserLoginMethod empty body for ${safeEmailRef(email)}; login method unknown`);
return null;
}
if (res.data.userExists === false) {
return { method: null, hasPassword: null, userExists: false, emailCode: false, oauth: [], raw: res.data };
}
const hasPassword = hasPwField ? !!res.data.hasPassword : null;
return {
method: 'auth1',
hasPassword,
userExists: true,
// This endpoint says nothing about connections, so email-code availability
// is only implied when it positively reports "no password".
emailCode: hasPassword === false,
oauth: [],
raw: res.data,
};
} catch (e) {
log.warn(`CheckUserLoginMethod unreachable: ${e.message}`);
return null;
}
}
// Authoritative login-method probe.
//
// Order matters: /_devin-auth/connections FIRST (its auth_method.has_password
// is what the website itself branches on), CheckUserLoginMethod only as
// enrichment when connections cannot answer. A probe that learns nothing
// yields hasPassword:null — callers must treat that as "unknown", not as
// either "password-capable" or "no password".
//
// When the login-host fallback is enabled, the SAME read-only probe is asked
// on app.devin.ai before giving up: both hosts were measured to return the
// identical shape (2026-10-22), and a probe outage on the Vercel host is the
// one input that used to turn "this account has no password" into
// "wrong password" (see the recheck in windsurfLoginPrimaryHost). With the
// fallback off, only windsurf.com is contacted — the default contract.
export async function probeLoginMethod(email, proxy = null, fingerprint = null) {
const fp = fingerprint || generateFingerprint();
const hosts = isLoginHostFallbackEnabled() ? ['windsurf', 'devin'] : ['windsurf'];
let lastRaw = null;
for (const host of hosts) {
try {
const connections = await fetchAuth1Connections(email, fp, proxy, host);
lastRaw = connections;
const interpreted = interpretConnections(connections);
// A known non-auth1 method (firebase/oauth) is a routing answer, not noise:
// returning it lets windsurfLoginPrimaryHost reach the legacy Firebase path
// instead of guessing Auth1. Only a bare/empty body stays "unknown".
if (interpreted.hasPassword !== null || interpreted.userExists === false
|| (interpreted.method && interpreted.method !== 'auth1')) {
rememberProbeHost(email, host);
return { ...interpreted, source: 'connections', host };
}
} catch (err) {
// A definitive answer about the address is not an availability failure.
if (err?.code === 'ERR_INVALID_EMAIL') throw err;
log.warn(`Auth1 connections probe failed on ${host} for ${safeEmailRef(email)}: ${err.message}`);
}
}
const check = await fetchCheckUserLoginMethod(email, fp, proxy);
if (check) return { ...check, source: 'check_user_login_method', host: null };
return {
method: null,
hasPassword: null,
userExists: null,
emailCode: false,
oauth: [],
raw: lastRaw || {},
source: 'unknown',
host: null,
};
}
async function registerWithCodeium(token, fingerprint, proxy) {
// v2.0.57 (Fix 1): try register.windsurf.com first, fall back to
// api.codeium.com. Both go through our fingerprint+proxy-aware
// httpsRequest so the egress IP / UA stays consistent with the rest of
// this login flow.
const { registerWithFirebaseToken } = await import('../windsurf-api.js');
const requestFn = async (url, opts, body) => {
// buildJsonHeaders adds fingerprint headers; preserve any explicit
// Connect-Protocol-Version / Accept the helper provided.
const merged = buildJsonHeaders(fingerprint, body, {
'Connect-Protocol-Version': '1',
'Accept': 'application/json',
});
const r = await httpsRequest(url, { method: opts.method || 'POST', headers: merged }, body, proxy);
return { status: r.status, data: r.data, raw: typeof r.data === 'string' ? r.data : JSON.stringify(r.data || {}) };
};
try {
const r = await registerWithFirebaseToken(token, { requestFn, proxy });
// Preserve the snake_case shape downstream callers consume.
return {
api_key: r.apiKey,
name: r.name,
api_server_url: r.apiServerUrl,
};
} catch (e) {
throw new Error(`ERR_CODEIUM_REGISTER_FAILED:${e.message}`);
}
}
async function windsurfLoginViaAuth1(email, password, fingerprint, proxy) {
const loginBody = JSON.stringify({ email, password });
const loginHeaders = buildJsonHeaders(fingerprint, loginBody);
const loginRes = await httpsRequestRetrying(
AUTH1_PASSWORD_LOGIN_URL, { method: 'POST', headers: loginHeaders }, loginBody, proxy, 'Auth1 password/login'
);
// Pydantic v2 returns `detail: [...]` for validation errors; the older
// shape was `detail: 'message'`. Normalize both for the friendly-error
// mapper so we don't blow up trying to .toLowerCase an array.
const rawDetail = loginRes.data?.detail;
const detailMsg = Array.isArray(rawDetail)
? rawDetail.map(d => d?.msg || d?.type || JSON.stringify(d)).join('; ')
: (typeof rawDetail === 'string' ? rawDetail : '');
if (loginRes.status >= 400 || detailMsg) {
throw createFriendlyAuthError('Auth1', detailMsg, 'ERR_LOGIN_FAILED');
}
const auth1Token = loginRes.data?.token;
if (!auth1Token) {
throw new Error(`ERR_AUTH1_TOKEN_MISSING:${sliceRedactedJson(loginRes.data, 200)}`);
}
log.info(`Auth1 login OK: ${safeEmailRef(email)}`);
// v2.0.90 (#114 lnqdev / CharwinYAO): drop OneTimeAuthToken + Codeium
// register_user step entirely. Upstream GetOneTimeAuthToken started
// returning 401 invalid_token for ALL sessionTokens — matrix probe
// (scripts/probes/v2089-ott-host-matrix.mjs) confirmed 12/12 fail
// across 3 accounts × {sToken_new, sToken_legacy} × {OTT_new,
// OTT_legacy}. Cross-host retry can't save it; the OTT endpoint is
// gone for good (Cognition migrated to the Devin auth flow).
//
// Reverse-engineering windsurf-assistant v17.42.20 (2026-04-27, the
// upstream-tracked Windsurf account-switcher) confirms its production
// path is Devin-only:
// Auth1 password/login → WindsurfPostAuth → sessionToken
// and uses sessionToken directly as the IDE auth credential. No OTT,
// no RegisterUser, no codeium register_user.
//
// Probe scripts/probes/v2089-sessiontoken-as-apikey.mjs verified the
// Cascade gRPC backend (server.codeium.com /
// server.self-serve.windsurf.com) accepts the raw sessionToken
// (devin-session-token$xxx) as metadata.apiKey on GetUserStatus
// → 4/4 200 OK with valid planName. The downstream protocol treats
// it identically to the codeium register_user-issued sk-ws-01-... key.
//
// So the chain collapses from
// Auth1 → PostAuth → OTT → registerWithCodeium → apiKey
// to
// Auth1 → PostAuth → apiKey = sessionToken.
// RegisterUser only accepts firebase_id_token (won't take sessionToken)
// and Firebase signInWithPassword now demands App Check tokens that
// server-side callers can't produce — so the firebase path is dead
// too. Devin path is the only one that works post-2026-05-04.
const { res: br, label: bl } = await postAuthDualPath(auth1Token, fingerprint, proxy);
if (br.status >= 400 || !br.data?.sessionToken) {
throw new Error(`ERR_POSTAUTH_FAILED:${sliceRedactedJson(br.data, 200)}`);
}
const sessionToken = br.data.sessionToken;
const accountId = br.data.accountId || 'unknown';
log.info(`Windsurf PostAuth OK (${bl}): ${safeEmailRef(email)} accountHash=${logHash(accountId)} → using sessionToken as apiKey`);
return {
apiKey: sessionToken,
name: email,
email,
// V-24: the address upstream just authenticated. A bound re-auth compares
// this with the account row before the token may replace anything.
identityEmail: normalizeLoginIdentity(email),
apiServerUrl: '',
sessionToken,
auth1Token,
};
}
// ─── Second-host fallback chain: app.devin.ai ─────────────────────────────
//
// A COMPLETE, INDEPENDENT login attempt against app.devin.ai instead of
// windsurf.com. Only reached when DEVIN_CONNECT_LOGIN_HOST_FALLBACK=1 AND the
// windsurf.com primary path already failed. Same email+password, no GitHub,
// no TOTP, no form-scraping.
//
// Chain: app.devin.ai/api/auth1/connections (probe) →
// app.devin.ai/api/auth1/password/login ({email,password}) → {token} →
// postAuthDualPath(token) [REUSED from the primary path] → sessionToken.
//
// TODO(unverified): the final hop — feeding an Auth1 token minted on
// app.devin.ai into OUR WindsurfPostAuth (windsurf.com/_backend or
// server.self-serve.windsurf.com) and getting a usable `devin-session-token$`
// back — has NOT been exercised against a live account. The study
// (docs-internal/workflow-results/oauth-relogin-study/FEASIBILITY-BLUEPRINT.md §1.2/§5.3,
// tool-github-oauth-totp.md §1.1) establishes only that both hosts share the
// SAME Auth1 family statically; "same family" does NOT prove our PostAuth
// exchanger accepts a token sourced from the other host. This must be
// confirmed with a real account before relying on the fallback as live-effective.
async function windsurfLoginViaDevinHost(email, password, fingerprint, proxy) {
// Step 1 — connections probe (app.devin.ai uses product:"devin").
// Best-effort: a probe FAILURE must NOT abort — we still try the login,
// exactly like the primary path tolerates a flaky connections endpoint.
// A probe that SUCCEEDS and reports `has_password:false` is different: that
// is the same terminal wrong-method answer as on windsurf.com, so the
// password login is skipped instead of burning a guaranteed 401.
try {
const connBody = JSON.stringify({ product: 'devin', email });
const connHeaders = buildJsonHeaders(fingerprint, connBody);
const connRes = await httpsRequestRetrying(
DEVIN_AUTH1_CONNECTIONS_URL, { method: 'POST', headers: connHeaders }, connBody, proxy,
'Devin-host Auth1 connections'
);
const probed = interpretConnections(connRes.data);
if (probed.hasPassword === false) {
const err = new Error('ERR_NO_PASSWORD_OAUTH_ACCOUNT');
err.code = 'ERR_NO_PASSWORD_OAUTH_ACCOUNT';
err.method = probed.emailCode ? 'email_code' : 'oauth';
err.oauthProviders = probed.oauth || [];
err.detail = 'app.devin.ai reports this account has no password.';
err.isAuthFail = false;
throw err;
}
} catch (err) {
if (err?.code === 'ERR_NO_PASSWORD_OAUTH_ACCOUNT') throw err;
log.warn(`Devin-host connections probe failed for ${safeEmailRef(email)}: ${err.message}`);
}
// Step 2 — Auth1 password/login on app.devin.ai → auth1 bearer token.
const loginBody = JSON.stringify({ email, password });
const loginHeaders = buildJsonHeaders(fingerprint, loginBody);
const loginRes = await httpsRequestRetrying(
DEVIN_AUTH1_PASSWORD_LOGIN_URL, { method: 'POST', headers: loginHeaders }, loginBody, proxy,
'Devin-host Auth1 password/login'
);
const rawDetail = loginRes.data?.detail;
const detailMsg = Array.isArray(rawDetail)
? rawDetail.map(d => d?.msg || d?.type || JSON.stringify(d)).join('; ')
: (typeof rawDetail === 'string' ? rawDetail : '');
if (loginRes.status >= 400 || detailMsg) {
throw createFriendlyAuthError('DevinHost', detailMsg, 'ERR_LOGIN_FAILED');
}
const auth1Token = loginRes.data?.token;
if (!auth1Token) {
throw new Error(`ERR_AUTH1_TOKEN_MISSING:${sliceRedactedJson(loginRes.data, 200)}`);
}
log.info(`Devin-host Auth1 login OK: ${safeEmailRef(email)}`);
// Step 3 — REUSE the existing PostAuth dual-path exchanger. See the
// TODO(unverified) above: this is the hop whose cross-host acceptance is
// not yet live-confirmed.
const { res: br, label: bl } = await postAuthDualPath(auth1Token, fingerprint, proxy);
if (br.status >= 400 || !br.data?.sessionToken) {
throw new Error(`ERR_POSTAUTH_FAILED:${sliceRedactedJson(br.data, 200)}`);
}
const sessionToken = br.data.sessionToken;
const accountId = br.data.accountId || 'unknown';
log.info(`Devin-host PostAuth OK (${bl}): ${safeEmailRef(email)} accountHash=${logHash(accountId)} → using sessionToken as apiKey`);
return {
apiKey: sessionToken,
name: email,
email,
identityEmail: normalizeLoginIdentity(email),
apiServerUrl: '',
sessionToken,
auth1Token,
viaHost: 'app.devin.ai',
};
}
async function windsurfLoginViaFirebase(email, password, fingerprint, proxy) {
const firebaseBody = JSON.stringify({
email,
password,
returnSecureToken: true,
});
const fbHeaders = buildJsonHeaders(fingerprint, firebaseBody);
const fbRes = await httpsRequest(FIREBASE_AUTH_URL, { method: 'POST', headers: fbHeaders }, firebaseBody, proxy);
if (fbRes.data.error) {
// 403s from identitytoolkit carry just `{error:{message}}`; a Referer/
// API-key restriction arrives as API_KEY_HTTP_REFERRER_BLOCKED, which the
// friendly-error mapper (createFriendlyAuthError) resolves to a clear
// ERR_HTTP_REFERRER_BLOCKED instead of the raw code.
// The referrer restriction does NOT arrive as `error.message`. Google's real
// envelope is `{error:{code:403, status:'PERMISSION_DENIED', message:'Requests
// from referer <x> are blocked.', details:[{reason:'API_KEY_HTTP_REFERRER_BLOCKED'}]}}`
// — a numeric code and a prose message, with the machine-readable reason buried in
// details[]. Reading only message/code (as this did) means the mapping fires only
// for a shape Google never sends, and the operator still gets the prose string as
// their error "code". So prefer the structured reason, then fall back.
const err = fbRes.data.error;
const reason = Array.isArray(err.details)
? err.details.find((d) => d && typeof d.reason === 'string')?.reason
: null;
const msg = reason || err.message || err.code || 'Unknown Firebase error';
// Keep the prose as the human detail when the reason carried the code, so the log
// still says WHICH referer was rejected.
throw createFriendlyAuthError('Firebase', msg, err.message || msg);
}
const idToken = fbRes.data.idToken;
if (!idToken) throw new Error('ERR_FIREBASE_TOKEN_MISSING');
log.info(`Firebase login OK: ${safeEmailRef(email)}, uidHash=${logHash(fbRes.data.localId)}`);
const reg = await registerWithCodeium(idToken, fingerprint, proxy);
log.info(`Codeium register OK: ${safeEmailRef(email)} → ${safeKeyRef(reg.api_key, 'apiKey')}`);
return {
apiKey: reg.api_key,
name: reg.name || email,
email,
identityEmail: normalizeLoginIdentity(email),
idToken,
refreshToken: fbRes.data.refreshToken || '',
apiServerUrl: reg.api_server_url || '',
};
}
/**
* Full Windsurf login:
* - Auth1 password login → bridge session → one-time auth token → Codeium register
* - or legacy Firebase auth → Codeium register
* @param {string} email
* @param {string} password
* @param {object} [proxy] - { host, port, username, password }
* @returns {{ apiKey, name, email, idToken }}
*/
// v2.0.57 Fix 6 — per-email brute-force lockout. Inspiration:
// windsurf-assistant-pub `_bumpFailure` (3 strikes / 15 min ban). Without
// this, a dashboard-authenticated operator hammering bad credentials
// against /auth/login burns through Firebase/Windsurf upstream rate
// limits per account and risks getting the *real* email flagged. Lock
// the email locally so we never forward more than 3 fresh attempts in
// any 15-minute window.
const EMAIL_LOCK_IDLE_TTL_MS = 2 * 60 * 60 * 1000;
const _emailFailures = new Map();
export function _resetEmailLockoutForTests() { _emailFailures.clear(); }
export function checkEmailLocked(email) {
if (!email || typeof email !== 'string') return null;
const k = email.toLowerCase();
// Operator disabled the email lockout (threshold 0): release any existing
// lock immediately so "0 = off" takes effect now, not at natural expiry.
if (getEmailLockThreshold() <= 0) {
_emailFailures.delete(k);
return null;
}
const e = _emailFailures.get(k);
if (!e) return null;
const now = Date.now();
if (e.lockedUntil > now) return e.lockedUntil - now;
if (e.lockedUntil > 0 && e.lockedUntil <= now) {
e.count = 0;
e.lockedUntil = 0;
}
return null;
}
function recordEmailFailure(email, reason) {
if (!email) return;
// Operator can disable the email lockout entirely (threshold 0) from Settings.
const threshold = getEmailLockThreshold();
if (threshold <= 0) return;
const k = email.toLowerCase();
const now = Date.now();
let e = _emailFailures.get(k);
if (!e) { e = { count: 0, lockedUntil: 0, lastActivity: now }; _emailFailures.set(k, e); }
e.count += 1;
e.lastActivity = now;
e.lastReason = reason ? String(reason).slice(0, 80) : '';
if (e.count >= threshold) {
const durMs = getEmailLockMs();
e.lockedUntil = now + durMs;
e.count = 0;
log.warn(`Email lockout: ${safeEmailRef(k)} banned for ${Math.round(durMs / 60000)}min after ${threshold} failed Windsurf logins (last="${e.lastReason}")`);
}
}
function recordEmailSuccess(email) {
if (!email) return;
_emailFailures.delete(email.toLowerCase());
}
setInterval(() => {
const now = Date.now();
for (const [k, e] of _emailFailures) {
if (e.lockedUntil > now) continue;
if (now - (e.lastActivity || 0) > EMAIL_LOCK_IDLE_TTL_MS) _emailFailures.delete(k);
}
}, 60 * 60 * 1000).unref?.();
export async function windsurfLogin(email, password, proxy = null) {
const lockMs = checkEmailLocked(email);
if (lockMs != null) {
const minutes = Math.ceil(lockMs / 60000);
const err = new Error(`Email ${email} 因连续 ${getEmailLockThreshold()} 次登录失败被本地锁定，请 ${minutes} 分钟后再试。`);
err.code = 'ERR_EMAIL_LOCKED';
err.retryAfterMs = lockMs;
err.isAuthFail = false;
throw err;
}
const fingerprint = generateFingerprint();
log.info(`Windsurf login: ${safeEmailRef(email)} fpHash=${logHash(fingerprint['User-Agent'])} proxy=${proxy?.host || 'none'}`);
try {
return await windsurfLoginPrimaryHost(email, password, fingerprint, proxy);
} catch (primaryErr) {
// A terminal login-method answer is not an availability failure: the
// account has no password, so the second host would be asked to run the
// exact same impossible password login. Never fall back for these.
if (primaryErr?.code === 'ERR_NO_PASSWORD_OAUTH_ACCOUNT' || primaryErr?.code === 'ERR_EMAIL_NOT_FOUND') {
throw primaryErr;
}
// Default (flag unset): preserve the exact pre-existing behavior — only
// windsurf.com runs, so re-throw and never touch app.devin.ai.
if (!isLoginHostFallbackEnabled()) throw primaryErr;
// Second-host fallback (app.devin.ai), opt-in. Same email+password, no
// GitHub/TOTP. Spreads windsurf.com (Vercel) availability / endpoint-
// migration risk across a second host.
log.warn(`Primary windsurf.com login failed for ${safeEmailRef(email)} (${primaryErr.message}); attempting app.devin.ai host fallback`);
try {
const result = await windsurfLoginViaDevinHost(email, password, fingerprint, proxy);
// Genuine success on the second host clears any failure the primary
// path recorded — the credential is provably valid.
recordEmailSuccess(email);
log.info(`Host fallback OK via app.devin.ai for ${safeEmailRef(email)}`);
return result;
} catch (fallbackErr) {
// Both hosts failed. Surface the ORIGINAL primary error so the caller
// (reLoginAccount) sees the real primary signal and runs its existing
// failure path → failover. We NEVER fake success, and we NEVER
// reclassify the account as dead from here — a failed re-login just
// means "re-login failed → false → failover", per the transient-first
// error model. The upstream error classifier and the re-login flow in
// auth.js stay untouched.
log.warn(`Host fallback via app.devin.ai also failed for ${safeEmailRef(email)}: ${fallbackErr.message}`);
throw primaryErr;
}
}
}
// One terminal "no password" answer, used both by the probe's first pass and
// by the post-rejection recheck. `method` lets the dashboard switch the form
// (email code vs OAuth-only) without a second probe, and `isAuthFail:false`
// keeps a wrong-method answer out of the per-email lockout.
function noPasswordError(probe) {
const err = new Error('ERR_NO_PASSWORD_OAUTH_ACCOUNT');
err.code = 'ERR_NO_PASSWORD_OAUTH_ACCOUNT';
err.method = probe.emailCode ? 'email_code' : 'oauth';
err.oauthProviders = probe.oauth || [];
err.detail = probe.emailCode
? 'This account has no password. Log in with the emailed verification code, or with Google/GitHub, or paste an Auth Token from windsurf.com/show-auth-token.'
: 'This account has no password and email-code login is disabled. Log in with Google/GitHub, or paste an Auth Token from windsurf.com/show-auth-token.';
err.isAuthFail = false;
err.statusCode = 400;
return err;
}
// The original windsurf.com login path (login-method probe →
// Auth1 password/login → PostAuth, or legacy Firebase). Extracted from
// windsurfLogin so the public entry can wrap it with the opt-in
// app.devin.ai host fallback without altering this logic.
async function windsurfLoginPrimaryHost(email, password, fingerprint, proxy) {
// Probe: /_devin-auth/connections is authoritative; CheckUserLoginMethod
// only enriches when connections is unreachable. `hasPassword:null` means
// both probes were silent — NOT "password-capable".
const probe = await probeLoginMethod(email, proxy, fingerprint);
if (probe.userExists === false) {
const err = createFriendlyAuthError('Auth1', 'EMAIL_NOT_FOUND');
// A nonexistent address is not a wrong credential; locking it would let a
// typo (or an enumeration probe) ban a real operator for 15 minutes.
throw err;
}
if (probe.hasPassword === false) {
// Terminal wrong-method signal: this account has no password (registered
// via Google/GitHub OAuth, or email-code only). It is NOT a brute-force
// guess, so it must not count toward the email lockout, and it must never
// reach password/login — the upstream 401 for such an account is not
// evidence of a wrong password, only of a wrong method.
throw noPasswordError(probe);
}
if (probe.hasPassword === true) {
try {
const result = await windsurfLoginViaAuth1(email, password, fingerprint, proxy);
recordEmailSuccess(email);
return result;
} catch (e) {
// Auth-shaped failures count toward the lockout. Network / 5xx
// upstream errors don't (those aren't the operator's fault).
if (e?.isAuthFail || /ERR_LOGIN_FAILED|ERR_AUTH1|EMAIL|PASSWORD/i.test(e?.message || '')) {
recordEmailFailure(email, e?.message);
}
// The method WAS confirmed here, so the caller must not offer the
// "this account may have no password" alternatives.
if (e && typeof e === 'object') e.probeUnknown = false;
throw e;
}
}
// A known non-auth1 method (legacy firebase/oauth) is an explicit routing
// answer: go straight to the legacy path instead of guessing Auth1.
if (probe.method && probe.method !== 'auth1') {
const result = await windsurfLoginViaFirebase(email, password, fingerprint, proxy);
recordEmailSuccess(email);
return result;
}
// Probe unknown (both hosts and the secondary probe silent): we have no
// evidence the account lacks a password, so the operator-supplied password
// still gets one attempt. Auth1 FIRST — the legacy Firebase
// signInWithPassword endpoint is App-Check-gated upstream (measured
// 2026-10-22: 401 "Firebase App Check token is invalid" for every
// server-side caller), so leading with it only delays the real attempt.
// Firebase stays as the last resort when Auth1 itself is unavailable.
try {
const result = await windsurfLoginViaAuth1(email, password, fingerprint, proxy);
recordEmailSuccess(email);
return result;
} catch (auth1Err) {
if (!auth1Err?.isAuthFail) {
// Auth1 never judged the credential (network / 5xx / PostAuth). Try the
// legacy path once; if it also fails, surface the Auth1 error, which is
// the meaningful one.
try {
const result = await windsurfLoginViaFirebase(email, password, fingerprint, proxy);
recordEmailSuccess(email);
return result;
} catch {
throw auth1Err;
}
}
// Auth1 positively rejected the credential. Before reporting "wrong
// password", re-ask the method ONCE: a probe outage on the first call is
// exactly how an email-code-only account was reported as
// ERR_INVALID_CREDENTIALS (live 2026-10-21, 3.9.42). This recheck only
// runs after a rejected password, so it costs nothing on the happy path.
let recheck = null;
try {
recheck = await probeLoginMethod(email, proxy, fingerprint);
} catch { /* stays unknown */ }
if (recheck && recheck.hasPassword === false) {
throw noPasswordError(recheck);
}
// One credential guess, counted once (the old Firebase→Auth1 chain could
// have counted two).
recordEmailFailure(email, auth1Err?.message);
// Tell the caller the method was never confirmed: the password really was
// rejected, but if the address is OAuth/email-code-only the operator
// needs the alternative offered, not "wrong password" alone.
auth1Err.probeUnknown = recheck ? recheck.hasPassword === null : true;
auth1Err.alternatives = ['email_code', 'oauth', 'token'];
throw auth1Err;
}
}
// ─── Email-code login (accounts without a password) ───────────────────────
//
// For accounts whose probe says `has_password:false`, the only non-OAuth path
// is the emailed 6-digit code (recon .agent/loginrecon-20261022/LoginRecon.md §4.3):
//
// POST /_devin-auth/email/start {email, mode:'login', product:'Windsurf'}
// → {email_verification_token}
// POST /_devin-auth/email/complete {email_verification_token, code, mode:'login'}
// → {token} (an Auth1 token, same kind password/login mints)
// → postAuthDualPath(token) → session_token, used as the pool API key.
//
// The verification token is a bearer secret for one account. It stays in this
// module's memory keyed by an opaque flowId, never travels to the browser, and
// never appears in a log line. The code is equally secret: it is forwarded
// upstream and dropped.
//
// DESIGN GAP (Q2 F2, deliberately NOT implemented here): the resulting
// `devin-session-token$…` has no refresh path. refreshAllFirebaseTokens skips
// accounts without a refreshToken, reLoginAccount needs a stored password this
// flow never has (storeCredential:false), and the Auth1 token's TTL is
// unmeasured — so a retired session is only recoverable by re-adding the
// account. The design work that remains is an explicit "needs reauth" account
// state (or encrypted Auth1 storage once its TTL is known), not a retry here.
const EMAIL_FLOW_TTL_MS = 10 * 60 * 1000;
const EMAIL_FLOW_MAX_ATTEMPTS = 5;
const EMAIL_FLOW_MAX_ENTRIES = 200;
// Devin's own UI enforces a 30s resend cooldown; mirror it so a double-click
// loop cannot burn the upstream send quota (and the account's sender
// reputation) without an operator decision.
const EMAIL_CODE_RESEND_COOLDOWN_MS = 30 * 1000;
// A successful email/complete mints an Auth1 token that is single-use upstream,
// so it is the only thing that can be replayed when the PostAuth exchange
// fails. Keep it briefly: long enough to ride out a PostAuth blip, short enough
// that a forgotten flow cannot be used as a session minter (F6).
const EMAIL_FLOW_POSTAUTH_RETRY_MS = 2 * 60 * 1000;
const EMAIL_FLOW_POSTAUTH_MAX_ATTEMPTS = 3;
// Upstream `email/complete` failures are NOT all credential guesses (F5).
// Only a positive "the code is wrong" detail may feed the per-email lockout:
// - an expired/consumed verification token (measured: 401
// {"detail":"Invalid verification token"}, 6/6) says nothing about the
// digits the user typed, and the token cannot be retried anyway;
// - a 5xx / transport failure says nothing at all.
// Counting either as a wrong code locked PASSWORD login for 15 minutes after a
// code simply expired.
const EMAIL_CODE_MISMATCH_RE = /invalid verification code|invalid code|incorrect code|wrong code/i;
const EMAIL_FLOW_DEAD_RE = /invalid verification token|verification token|expired|already used|already consumed/i;
// 'expired' → the verification token is dead upstream: drop the flow, retry
// is impossible, no lockout.
// 'code' → upstream positively says the digits are wrong: count the flow
// attempt AND the email lockout.
// 'rejected' → upstream 400/422 without a reason: count the flow attempt
// (one flow must not be an unlimited oracle) but not the lockout.
// 'unavailable' → 403/404/405/429/5xx: availability, retry the same code.
function classifyEmailCompleteFailure(res, detail) {
const text = String(detail || '');
if (res.status === 401 || res.status === 410 || EMAIL_FLOW_DEAD_RE.test(text)) return 'expired';
if (EMAIL_CODE_MISMATCH_RE.test(text)) return 'code';
if (res.status === 400 || res.status === 422) return 'rejected';
return 'unavailable';
}
const _emailFlows = new Map();
const _emailCodeSentAt = new Map();
export function _resetEmailFlowsForTests() {
_emailFlows.clear();
_emailCodeSentAt.clear();
}
function emailFlowError(code, detail, statusCode, extra = null) {
const err = new Error(code);
err.code = code;
err.detail = detail;
err.statusCode = statusCode;
err.isAuthFail = false;
if (extra) Object.assign(err, extra);
return err;
}
// Same per-email lockout the password path uses, so a code-guessing loop is
// bounded by the operator's configured strike count. 400, not 429: the
// dashboard UI renders a 429 as an IP-wide ban overlay, and this lock is
// per-email.
function emailLockedError(lockMs) {
return emailFlowError(
'ERR_EMAIL_LOCKED',
`Email temporarily locked after repeated failed logins; retry in ${Math.ceil(lockMs / 60000)} min.`,
400,
{ retryAfterMs: lockMs },
);
}
// ─── Login identity (V-24 / audit A23) ────────────────────────────────────
//
// A login result proves ONE thing about identity: the address that upstream
// authenticated. A bound re-auth (`accountId`) replaces the token on an
// existing row, so a result for a different address would install person B's
// session on person A's row and clear A's error/ban state on the way. The
// identity is therefore part of the login result and is compared before any
// token/status mutation; case and surrounding whitespace are not identity.
//
// Upstream reports `accountId` too, but the pool rows do not carry it, so it
// is not a comparable key here — the authenticated address is.
/** Case/whitespace-insensitive identity key. '' means "no identity proof". */
function normalizeLoginIdentity(email) {
return String(email ?? '').trim().toLowerCase();
}
/** The identity a login result proves, or '' when it proves none. */
function loginResultIdentity(result) {
return normalizeLoginIdentity(result?.identityEmail || result?.email);
}
/** Operator-facing masked address; never echoes the full identity. */
function maskIdentityEmail(email) {
const s = String(email ?? '').trim();
const at = s.indexOf('@');
if (at <= 0) return s ? `${s[0]}***` : '';
return `${s[0]}***${s.slice(at)}`;
}
/**
* Throw unless `result` proves it belongs to `expectedEmail`.
*
* Called with the bound account's address BEFORE markAccountReauthenticated()
* (api.js) and, for the email-code flow, before the single-use code is spent.
* A result that carries no identity at all is refused on a bound path: the
* token would replace a live credential on nothing but hope.
*/
export function assertLoginIdentity(result, expectedEmail) {
const expected = normalizeLoginIdentity(expectedEmail);
if (!expected) return;
const actual = loginResultIdentity(result);
if (actual && actual === expected) return;
const err = new Error('ERR_LOGIN_IDENTITY_MISMATCH');
err.code = 'ERR_LOGIN_IDENTITY_MISMATCH';
err.statusCode = 409;
err.detail = actual
? `This login belongs to ${maskIdentityEmail(actual)}, not to the selected account (${maskIdentityEmail(expected)}).`
: `The login did not report which account it belongs to, so it cannot be bound to ${maskIdentityEmail(expected)}.`;
throw err;
}
function pruneEmailFlows(now) {
for (const [id, flow] of _emailFlows) {
if (now > flow.expiresAt) _emailFlows.delete(id);
}
// The resend-cooldown map is keyed by email and would otherwise keep one
// entry per address forever on a long-lived process.
for (const [email, sentAt] of _emailCodeSentAt) {
if (now - sentAt > EMAIL_FLOW_TTL_MS) _emailCodeSentAt.delete(email);
}
if (_emailFlows.size < EMAIL_FLOW_MAX_ENTRIES) return;
const oldest = [..._emailFlows.entries()]
.sort((a, b) => a[1].createdAt - b[1].createdAt)
.slice(0, _emailFlows.size - EMAIL_FLOW_MAX_ENTRIES + 1);
for (const [id] of oldest) _emailFlows.delete(id);
}
setInterval(() => pruneEmailFlows(Date.now()), 10 * 60 * 1000).unref?.();
function emailEndpointUrl(kind, host) {
if (kind === 'start') return host === 'devin' ? DEVIN_AUTH1_EMAIL_START_URL : AUTH1_EMAIL_START_URL;
return host === 'devin' ? DEVIN_AUTH1_EMAIL_COMPLETE_URL : AUTH1_EMAIL_COMPLETE_URL;
}
function emailEndpointBody(kind, host, { email, token, code }) {
if (kind === 'start') {
// Devin's bundle sends `{email, mode}`; windsurf.com adds `product`.
return host === 'devin' ? { email, mode: 'login' } : { email, mode: 'login', product: 'Windsurf' };
}
return { email_verification_token: token, code, mode: 'login' };
}
function upstreamDetail(data) {
const raw = data?.detail ?? data?.error ?? data?.message;
if (Array.isArray(raw)) return raw.map(d => d?.msg || d?.type || JSON.stringify(d)).join('; ');
if (typeof raw === 'string') return raw;
if (raw && typeof raw === 'object') return String(raw.message || raw.code || '');
return '';
}
// POST one email endpoint, moving to the other login host only on an
// AVAILABILITY failure (network / 5xx / endpoint gone) and only when the
// existing DEVIN_CONNECT_LOGIN_HOST_FALLBACK switch is on. A 4xx is upstream
// answering (wrong code, expired token, rate limit) — retrying it on a second
// host would just double-spend the attempt, so it is returned as-is.
//
// `kind === 'start'` sends mail, so it is EXACTLY ONCE (F8): no 5xx backoff and
// no second host after a transport error. A 504 can arrive after the message
// was queued and a transport error leaves delivery unknown, so either retry
// sends a second code (measured: 3 sends / 7.0 s for one request). Only an
// explicit 404/405 — proof that host has no such endpoint — falls through.
async function requestEmailEndpoint(kind, preferredHost, payload, fingerprint, proxy) {
const first = preferredHost || 'windsurf';
const second = first === 'windsurf' ? 'devin' : 'windsurf';
const hosts = isLoginHostFallbackEnabled() ? [first, second] : [first];
const exactlyOnce = kind === 'start';
let lastErr = null;
for (let i = 0; i < hosts.length; i++) {
const host = hosts[i];
const url = emailEndpointUrl(kind, host);
const body = JSON.stringify(emailEndpointBody(kind, host, payload));
const headers = buildJsonHeaders(fingerprint, body);
const label = `Auth1 email/${kind} (${host})`;
try {
const res = exactlyOnce
? await httpsRequest(url, { method: 'POST', headers }, body, proxy)
: await httpsRequestRetrying(url, { method: 'POST', headers }, body, proxy, label);
const endpointGone = res.status === 404 || res.status === 405;
if (endpointGone && i < hosts.length - 1) {
log.warn(`${label} unavailable (${res.status}); trying the other login host`);
lastErr = new Error(`${label} upstream ${res.status}`);
continue;
}
return { res, host };
} catch (err) {
lastErr = err;
if (exactlyOnce || i === hosts.length - 1) throw err;
log.warn(`${label} failed (${err.message}); trying the other login host`);
continue;
}
}
throw lastErr || new Error('ERR_EMAIL_ENDPOINT_UNREACHABLE');
}
/**
* Ask Windsurf to email a login code.
*
* The upstream `email_verification_token` is stored server-side under a fresh
* opaque flowId (TTL 10 min, single successful use) and is NOT part of the
* returned object — only `{ flowId, sent: true }` reaches the browser.
*
* @param {string} email
* @param {object} [proxy]
* @returns {Promise<{flowId: string, sent: true, expiresInMs: number}>}
*/
export async function emailLoginStart(email, proxy = null, opts = {}) {
const normalizedEmail = String(email || '').trim();
if (!normalizedEmail) throw emailFlowError('ERR_EMAIL_REQUIRED', 'email is required', 400);
const lockMs = checkEmailLocked(normalizedEmail);
if (lockMs != null) throw emailLockedError(lockMs);
// Send the code on the host that answered the method probe (or the one the
// operator explicitly picked). A probe that only app.devin.ai could answer
// is evidence windsurf.com is unreachable from this deployment; re-guessing
// would push the request straight back into the outage. `opts.host` is an
// explicit operator choice from the dashboard, not a blind fallback.
const explicitHost = opts?.host === 'devin' ? 'devin' : (opts?.host === 'windsurf' ? 'windsurf' : null);
const preferredHost = explicitHost || preferredEmailHost(normalizedEmail) || 'windsurf';
const now = Date.now();
const sendKey = normalizedEmail.toLowerCase();
const sentAt = _emailCodeSentAt.get(sendKey);
if (sentAt != null && now - sentAt < EMAIL_CODE_RESEND_COOLDOWN_MS) {
throw emailFlowError(
'ERR_EMAIL_CODE_COOLDOWN',
'A verification code was just sent; wait before requesting another.',
400,
{ retryAfterMs: EMAIL_CODE_RESEND_COOLDOWN_MS - (now - sentAt) },
);
}
// Stamp the ATTEMPT, before the upstream call. A send that fails upstream
// (throw / 4xx / 5xx) must not reset the window, otherwise a failing sender
// can be hammered in a loop — every retry would reach an upstream that is
// already refusing. The success path re-stamps on completion so the 30 s
// window still measures from the send that actually went out.
_emailCodeSentAt.set(sendKey, now);
const fingerprint = generateFingerprint();
let started;
try {
started = await requestEmailEndpoint('start', preferredHost, { email: normalizedEmail }, fingerprint, proxy);
} catch (err) {
// The transport layer rejects with a bare Error (no code), which used to
// reach the route as HTTP 400 + a raw English message, breaking the
// stable-code contract (F8). One send was attempted; whether the mail went
// out is unknowable, so say so instead of inviting an immediate resend.
if (err && typeof err.code === 'string' && err.code.startsWith('ERR_EMAIL_') && err.statusCode) throw err;
log.warn(`Auth1 email/start transport failure: ${err?.message || err}`);
throw emailFlowError(
'ERR_EMAIL_START_FAILED',
'The email endpoint failed before confirming the send — check the inbox before retrying.',
502,
);
}
const { res, host } = started;
const detail = upstreamDetail(res.data);
if (res.status >= 400 || detail) {
throw emailFlowError(
'ERR_EMAIL_START_FAILED',
detail || `upstream ${res.status}`,
res.status >= 500 ? 502 : 400,
);
}
const token = res.data?.email_verification_token;
if (typeof token !== 'string' || !token) {
throw emailFlowError('ERR_EMAIL_START_NO_TOKEN', 'upstream did not return a verification token', 502);
}
pruneEmailFlows(now);
const flowId = randomBytes(16).toString('hex');
_emailFlows.set(flowId, {
email: normalizedEmail,
// V-24: the identity the code was sent to, bound at start so the exchange
// can be refused before the single-use code is spent.
identityEmail: normalizeLoginIdentity(normalizedEmail),
token,
host,
createdAt: now,
expiresAt: now + EMAIL_FLOW_TTL_MS,
attempts: 0,
used: false,
inFlight: false,
// Set only after upstream accepts the code; the sole retryable state when
// the PostAuth exchange fails (F6). Never the verification token.
auth1Token: null,
verifiedAt: 0,
postAuthAttempts: 0,
});
_emailCodeSentAt.set(sendKey, Date.now());
log.info(`Email login code requested: ${safeEmailRef(normalizedEmail)} host=${host} flowHash=${logHash(flowId)}`);
return { flowId, sent: true, expiresInMs: EMAIL_FLOW_TTL_MS, host };
}
/**
* Verify the emailed code and finish the login.
*
* The code is single-use upstream, but the *exchange* is not the code: a
* successful email/complete mints an Auth1 token that is kept on the flow for
* EMAIL_FLOW_POSTAUTH_RETRY_MS, so a PostAuth failure can be retried without
* asking the user for another email (F6). The flow is marked used only once the
* session token exists.
*
* @param {string} flowId - opaque id returned by emailLoginStart
* @param {string} code - the 6-digit code from the inbox
* @param {object} [proxy]
* @param {object} [opts]
* @param {string} [opts.expectedIdentityEmail] - address of the account the
* caller is about to install this session on. A mismatch is refused HERE,
* before the upstream exchange, because the code cannot be replayed.
*/
export async function emailLoginComplete(flowId, code, proxy = null, opts = {}) {
const id = String(flowId || '');
const flow = _emailFlows.get(id);
if (!flow) {
throw emailFlowError('ERR_EMAIL_FLOW_NOT_FOUND', 'Verification flow not found — request a new code.', 404);
}
if (flow.used) {
throw emailFlowError('ERR_EMAIL_FLOW_USED', 'This verification code was already used — request a new one.', 409);
}
const now = Date.now();
if (now > flow.expiresAt) {
_emailFlows.delete(id);
throw emailFlowError('ERR_EMAIL_FLOW_EXPIRED', 'The verification code expired — request a new one.', 410);
}
if (flow.inFlight) {
throw emailFlowError('ERR_EMAIL_FLOW_IN_USE', 'This verification code is already being checked.', 409);
}
// V-24: the flow's identity was bound at start. A caller binding the
// exchange to a different account is refused before the code is spent —
// after the exchange the code is gone, so a late check would cost the
// operator another email for nothing.
const expectedIdentity = normalizeLoginIdentity(opts?.expectedIdentityEmail);
if (expectedIdentity && expectedIdentity !== (flow.identityEmail || normalizeLoginIdentity(flow.email))) {
throw emailFlowError(
'ERR_LOGIN_IDENTITY_MISMATCH',
`This verification code was sent to ${maskIdentityEmail(flow.email)}, not to the selected account (${maskIdentityEmail(expectedIdentity)}). Request a code for the account you are re-authenticating.`,
409,
);
}
const normalizedCode = String(code ?? '').replace(/\s+/g, '');
// 6 digits upstream; the bounds are wide on purpose so an upstream policy
// change does not reject a valid code here.
if (!/^\d{4,10}$/.test(normalizedCode)) {
throw emailFlowError('ERR_EMAIL_CODE_INVALID', 'Enter the numeric verification code from the email.', 400);
}
const lockMs = checkEmailLocked(flow.email);
if (lockMs != null) throw emailLockedError(lockMs);
const fingerprint = generateFingerprint();
let auth1Token = null;
let completedHost = flow.host;
flow.inFlight = true;
try {
// A code that upstream already accepted is spent: replaying its verification
// token would only earn a 401. Retry the exchange with the stored Auth1
// token instead, and only inside the short window.
const reusable = typeof flow.auth1Token === 'string' && flow.auth1Token
&& flow.verifiedAt && now - flow.verifiedAt <= EMAIL_FLOW_POSTAUTH_RETRY_MS;
if (reusable) {
auth1Token = flow.auth1Token;
log.info(`Email code already verified; retrying the session exchange: ${safeEmailRef(flow.email)} flowHash=${logHash(id)}`);
} else {
if (!flow.token) {
// Spent verification token, retry window closed: nothing left to send.
_emailFlows.delete(id);
throw emailFlowError('ERR_EMAIL_FLOW_EXPIRED', 'The verification code was already used — request a new one.', 410);
}
let exchange;
try {
exchange = await requestEmailEndpoint(
'complete', flow.host, { email: flow.email, token: flow.token, code: normalizedCode }, fingerprint, proxy,
);
} catch (err) {
// Transport layer gave up (plain Error, no code). Upstream never judged
// the digits: keep the flow and its attempt count, and say so with a
// stable code (F5) instead of leaking a raw message as HTTP 400.
if (err && typeof err.code === 'string' && err.code.startsWith('ERR_EMAIL_') && err.statusCode) throw err;
log.warn(`Auth1 email/complete transport failure for ${safeEmailRef(flow.email)}: ${err?.message || err}`);
throw emailFlowError(
'ERR_EMAIL_VERIFY_UNAVAILABLE',
'The verification service did not answer — the code was not checked. Try again.',
502,
{ retryable: true },
);
}
const { res, host } = exchange;
completedHost = host;
const detail = upstreamDetail(res.data);
if (res.status >= 400 || detail) {
const kind = classifyEmailCompleteFailure(res, detail);
if (kind === 'expired') {
// The verification token is dead upstream — a retry can only 401
// again. Drop the flow and count NOTHING: this is not a code guess
// and must never feed the 900 s lockout (F5).
_emailFlows.delete(id);
throw emailFlowError(
'ERR_EMAIL_FLOW_EXPIRED',
'The verification code expired or was already used — request a new one.',
410,
);
}
if (kind === 'unavailable') {
// 5xx / transport / 429 / 403: upstream never judged the digits.
// Keep the flow and its attempt count exactly as they were.
log.warn(`Auth1 email/complete unavailable (${res.status}) for ${safeEmailRef(flow.email)}`);
throw emailFlowError(
'ERR_EMAIL_VERIFY_UNAVAILABLE',
'The verification service did not answer — the code was not checked. Try again.',
502,
{ retryable: true },
);
}
flow.attempts += 1;
// Only a positive "wrong code" answer is a credential guess and feeds
// the per-email lockout the password path uses. An ambiguous 400/422
// still burns a flow attempt so one flow cannot be an unlimited oracle.
if (kind === 'code') recordEmailFailure(flow.email, 'email_code_rejected');
if (flow.attempts >= EMAIL_FLOW_MAX_ATTEMPTS) {
flow.used = true;
flow.token = null;
}
throw emailFlowError(
'ERR_EMAIL_CODE_REJECTED',
detail || `upstream ${res.status}`,
400,
{ isAuthFail: kind === 'code', attemptsRemaining: Math.max(0, EMAIL_FLOW_MAX_ATTEMPTS - flow.attempts) },
);
}
auth1Token = res.data?.token;
if (typeof auth1Token !== 'string' || !auth1Token) {
throw emailFlowError(
'ERR_EMAIL_VERIFY_UNAVAILABLE',
'The verification service accepted the code but returned no session token. Try again.',
502,
{ retryable: true },
);
}
// The verification token is spent; the Auth1 token is the only thing a
// retry may replay, and only for the exchange window.
flow.token = null;
flow.auth1Token = auth1Token;
flow.verifiedAt = Date.now();
flow.host = host;
log.info(`Email code accepted: ${safeEmailRef(flow.email)} host=${host} flowHash=${logHash(id)}`);
}
flow.postAuthAttempts += 1;
const postAuthAttempt = flow.postAuthAttempts;
const remaining = Math.max(0, EMAIL_FLOW_POSTAUTH_MAX_ATTEMPTS - postAuthAttempt);
const giveUp = () => {
flow.used = true;
flow.auth1Token = null;
};
let br;
let label;
try {
({ res: br, label } = await postAuthDualPath(auth1Token, fingerprint, proxy));
} catch (e) {
// Both PostAuth hosts failed at the transport/5xx layer. The code stays
// valid for the retry window (F6).
log.warn(`PostAuth unavailable after an accepted code (${safeEmailRef(flow.email)}): ${e.message}`);
if (remaining === 0) giveUp();
throw emailFlowError(
'ERR_POSTAUTH_FAILED',
'Windsurf accepted the code but the session exchange did not answer — retry the same code.',
502,
{ retryable: remaining > 0, attemptsRemaining: remaining },
);
}
if (br.status >= 400 || !br.data?.sessionToken) {
log.warn(`PostAuth refused after an accepted code (${safeEmailRef(flow.email)}): HTTP ${br.status}`);
if (remaining === 0) giveUp();
throw emailFlowError(
'ERR_POSTAUTH_FAILED',
'Windsurf accepted the code but the session exchange was refused — retry the same code.',
502,
{ retryable: remaining > 0, attemptsRemaining: remaining },
);
}
// Only a real session token consumes the flow.
flow.used = true;
flow.auth1Token = null;
recordEmailSuccess(flow.email);
const accountId = br.data.accountId || 'unknown';
log.info(`Email-code login OK (${label}): ${safeEmailRef(flow.email)} accountHash=${logHash(accountId)} → using sessionToken as apiKey`);
return {
apiKey: br.data.sessionToken,
name: flow.email,
email: flow.email,
// V-24: the identity bound to this flow at start — the address the code
// was mailed to, not whatever the caller claims at completion.
identityEmail: flow.identityEmail || normalizeLoginIdentity(flow.email),
apiServerUrl: '',
sessionToken: br.data.sessionToken,
auth1Token,
viaEmailCode: true,
...(completedHost === 'devin' ? { viaHost: 'app.devin.ai' } : {}),
};
} finally {
flow.inFlight = false;
}
}
/**
* Refresh a Firebase ID token using a stored refresh token.
* Returns a new { idToken, refreshToken, expiresIn } or throws.
*
* @param {string} refreshToken
* @param {object} [proxy]
* @returns {Promise<{idToken: string, refreshToken: string, expiresIn: number}>}
*/
export async function refreshFirebaseToken(refreshToken, proxy = null) {
if (!refreshToken) throw new Error('No refresh token available');
const postBody = `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`;
const headers = {
'Content-Type': 'application/x-www-form-urlencoded',
'Content-Length': Buffer.byteLength(postBody),
'Referer': 'https://windsurf.com/',
'Origin': 'https://windsurf.com',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/130.0.0.0 Safari/537.36',
};
const res = await httpsRequest(FIREBASE_REFRESH_URL, { method: 'POST', headers }, postBody, proxy);
if (res.data?.error) {
const msg = res.data.error.message || res.data.error.code || 'Unknown error';
throw new Error(`Firebase token refresh failed: ${msg}`);
}
const newIdToken = res.data?.id_token || res.data?.idToken;
const newRefreshToken = res.data?.refresh_token || res.data?.refreshToken || refreshToken;
const expiresIn = parseInt(res.data?.expires_in || res.data?.expiresIn || '3600', 10);
if (!newIdToken) {
throw new Error(`Firebase token refresh: no idToken in response: ${sliceRedactedJson(res.data, 200)}`);
}
log.info(`Firebase token refreshed, expires in ${expiresIn}s`);
return { idToken: newIdToken, refreshToken: newRefreshToken, expiresIn };
}
/**
* Re-register with Codeium using a refreshed Firebase token.
* Returns a fresh API key (may be the same key if unchanged).
*
* @param {string} idToken - fresh Firebase ID token
* @param {object} [proxy]
* @returns {Promise<{apiKey: string, name: string}>}
*/
export async function reRegisterWithCodeium(idToken, proxy = null) {
const fingerprint = generateFingerprint();
const regRes = await registerWithCodeium(idToken, fingerprint, proxy);
return {
apiKey: regRes.api_key,
name: regRes.name || '',
};
}