@gatemux/dsh-gatemux-login 1.0.0 → 1.0.1

package/README.md

@@ -64,7 +64,9 @@ Model requests are billed to your own GateMux balance.
 ```
 
 Sign in from the app's account settings. Authorization opens in your browser and
-returns to the app.
+returns to the app. The tab itself is left on a confirmation page — GateMux
+serves no hosted completion page, so there is nothing else to show there — and it
+never auto-closes; you can close it once the app is signed in.
 
 ## Models
 

package/account.js

@@ -277,6 +277,12 @@ export class GateMuxAccount extends DeepSeekAccount {
       this.update(attempt, { phase: outcome.status === 'authorized' ? 'succeeded' : 'cancelled' })
       if (outcome.status === 'authorized' && attempt.completionUrl !== undefined) {
         attempt.callback?.writeHead(302, { location: attempt.completionUrl, 'cache-control': 'no-store' }).end()
+      } else if (outcome.status === 'authorized') {
+        // GateMux serves no hosted completion page, so this tab is the only place
+        // the result is visible; answering 204 would leave it blank.
+        this.writeCallbackPage(attempt, 'Signed in', attempt.loginSource === 'web'
+          ? 'Signed in to GateMux. Close this tab and continue in the original tab.'
+          : 'Signed in to GateMux. Close this tab and continue in DeepSeek Harness.')
       } else {
         attempt.callback?.writeHead(204, { 'cache-control': 'no-store' }).end()
       }
@@ -650,21 +656,30 @@ export class GateMuxAccount extends DeepSeekAccount {
   }
 
 
+  /**
+   * Answer the browser tab the flow was authorized in with a short page. The
+   * application opens that tab outside itself and never reads this response, so
+   * the page exists only for the person looking at it; text is static, which is
+   * why no script is needed and the policy can forbid every source.
+   * @param attempt - in-flight attempt whose callback is being answered.
+   * @param title - page title and heading.
+   * @param message - what the person should do next.
+   */
+  writeCallbackPage(attempt, title, message) {
+    attempt.callback?.writeHead(200, {
+      'content-type': 'text/html; charset=utf-8',
+      'cache-control': 'no-store',
+      'content-security-policy': `default-src 'none'; frame-ancestors 'none'`,
+      'referrer-policy': 'no-referrer',
+    }).end(`<!doctype html><html lang="en"><meta charset="utf-8"><title>${title}</title>`
+      + `<body><p>${message}</p></body></html>`)
+  }
+
   /** Return the browser to the application after a failed exchange. */
   finishFailedCallback(attempt) {
-    if (attempt.loginSource === 'web') {
-      const nonce = randomBytes(16).toString('base64url')
-      const message = 'Sign-in failed. Close this tab and try again in the original tab.'
-      attempt.callback?.writeHead(200, {
-        'content-type': 'text/html; charset=utf-8',
-        'cache-control': 'no-store',
-        'content-security-policy': `default-src 'none'; frame-ancestors 'none'`,
-        'referrer-policy': 'no-referrer',
-      }).end(`<!doctype html><html lang="en"><meta charset="utf-8"><title>${message}</title>`
-        + `<body><p>${message}</p></body></html>`)
-    } else {
-      attempt.callback?.writeHead(204, { 'cache-control': 'no-store' }).end()
-    }
+    this.writeCallbackPage(attempt, 'Sign-in failed', attempt.loginSource === 'web'
+      ? 'Sign-in failed. Close this tab and try again in the original tab.'
+      : 'Sign-in failed. Close this tab and try again in DeepSeek Harness.')
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatemux/dsh-gatemux-login",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "description": "Sign in with GateMux for DeepSeek Harness: users pay from their own GateMux balance.",
   "publishConfig": {