@inventec/dsh-copilot-auth 1.2.18 → 1.2.19

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@inventec/dsh-copilot-auth",
-  "version": "1.2.18",
-  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.18：授权失败附网络失败码＋人性化提示（检查网络/代理/DNS/TLS 检查）。v1.2.17：保留模型逐项列出。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。",
+  "version": "1.2.19",
+  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.19：管理模型列表 v3 目标状态编辑（分组全表/挽留/对齐/清空语义告知）＋单次确认＋移除请求撤回＋退出残影修复。v1.2.18：授权失败附网络失败码＋人性化提示。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。",
   "type": "module",
   "license": "MIT",
   "author": "iasi",

package/src/auth-flow.mjs

@@ -1,9 +1,9 @@
-// auth-flow.mjs — 浏览器授权状态机（T5）：串行请求、代次保护、轮询退避、卸载停止。
-// 契约：createAuthFlow({fetchImpl, clock, onState}) -> {init, start, cancel, refresh, dispose}
+// auth-flow.mjs — 浏览器授权状态机（T5；Q38 起「请求撤回」已移除）：串行请求、代次保护、轮询退避、卸载停止。
+// 契约：createAuthFlow({fetchImpl, clock, onState}) -> {init, start, logout, refresh, dispose}
 //  - 单一 init 聚合 /status；start 202 → 轮询；409 → attempt.shared 并转入对现有 attempt 的轮询
 //  - 请求代次（generation）保护：慢响应不得覆盖新操作；dispose 仅停止本页请求
 //  - 轮询 1 秒；连续读取失败退避 1/2/4/8/15 秒封顶；累计失败 60 秒转手动（connectivity=manual）
-//  - 写操作（start/cancel）绝不自动重发
+//  - 写操作（start）绝不自动重发
 import { requestJson } from "./client-http.mjs";
 
 const POLL_INTERVAL_MS = 1000;
@@ -61,7 +61,7 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
       emit({ phase: "failed", error: s?.error ?? "authorization-failed" });
       return;
     }
-    if (s?.status === "withdrawal-pending-unverified" || s?.status === "timed-out-unverified") {
+    if (s?.status === "timed-out-unverified") {
       emit({ phase: "risk", riskKind: s.status });
       return;
     }
@@ -149,6 +149,12 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
       emit({ phase: "idle", error: r.error?.messageKey, connectivity: "manual" });
       return;
     }
+    // Q38 追加修复（真机验证发现）：凭据已不在（configured:false）时，attempt 记录里的
+    // 「authorized」是退出前的历史残影而非登录态——如实回到未登录，不得翻转已登录视图
+    if (r.body?.status === "authorized" && body.configured !== true) {
+      emit({ phase: "idle" });
+      return;
+    }
     applySnapshot(gen, r.body);
   }
 
@@ -189,16 +195,6 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
     emit({ phase: "failed", error: errorCode ?? r.error?.messageKey });
   }
 
-  async function cancel() {
-    // 写操作：单次调用，绝不自动重发
-    const r = await requestJson(fetchImpl, "/copilot-auth/cancel", { method: "POST" });
-    if (r.ok) {
-      emit({ withdrawalDelivery: r.body?.withdrawalDelivery ?? "unavailable" });
-      return;
-    }
-    emit({ withdrawalDelivery: "failed", error: r.error?.details?.errorCode ?? r.error?.messageKey });
-  }
-
   async function logout() {
     // 退出登录（写操作，单次调用）：pending 态 → 成功后完整重跑 init 恢复真实
     // 状态（若晚到写把凭据写了回来，init 会如实显示 authorized，绝不伪报已退出）；
@@ -230,5 +226,5 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
     clearTimer();
   }
 
-  return { init, start, cancel, logout, refresh, dispose };
+  return { init, start, logout, refresh, dispose };
 }

package/src/auth-host.mjs

@@ -1,12 +1,13 @@
-// auth-host.mjs — 授权控制器（T3）：单实例尝试、软撤回＋风险锁存、禁用退出/重授权、
-// intentVersion 与首次填充 handoff。
+// auth-host.mjs — 授权控制器（T3；Q38 起软撤回已移除）：单实例尝试、等待超时风险锁存、
+// 禁用退出、intentVersion 与首次填充 handoff。
 // 契约见 docs/plans/2026-10-04-copilot-auth-models-unified-implementation-plan.md：
 //  - start：先 intentIO.bump() 持久 intentVersion+1（失败不发 begin），再 begin；202 先行语义保留
-//  - cancel：先 bump，再调用宿主撤销（invoked/unavailable/failed），设进程内 riskLatch
 //  - logout：静止态（无 LIVE attempt＋无 riskLatch）deleteRecord＋删后核实；
 //    尝试进行中/风险锁存期拒绝。「重新授权」概念随 v1.2.11 移除（退出＋登录分步即可）
-//  - onAuthorized(handoff) 仅在 outcome=authorized 且 originIntentVersion 仍当前且无撤回/超时标记时触发
+//  - onAuthorized(handoff) 仅在 outcome=authorized 且 originIntentVersion 仍当前且无超时标记时触发
 //  - riskLatch 进程级：重挂/dispose 不清；15 分钟等待超时由 snapshot 以注入 clock 惰性判定
+//  - Q38（2026-10-05）：「请求撤回」按钮与 /cancel 路由移除——撤销本地轮询的价值自限
+//    （15 分钟超时自然收敛），而其进程级锁存会把用户锁进「登录成功却不能退出」的死局
 import { randomUUID } from "node:crypto";
 import { CREDENTIAL_KEY } from "./shared.mjs";
 
@@ -74,9 +75,7 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
       startedAt: clock.now(),
       notices: [],
       originIntentVersion,
-      withdrawalRequested: false,
       timedOut: false,
-      withdrawalDelivery: undefined,
       error: undefined,
       staleIntent: false,
     };
@@ -107,7 +106,7 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
         if (attempt !== a) return;
         if (outcome && outcome.status === "authorized") {
           const versionStillCurrent = a.originIntentVersion === intentIO.read();
-          const intact = versionStillCurrent && !a.withdrawalRequested && !a.timedOut;
+          const intact = versionStillCurrent && !a.timedOut;
           a.status = "authorized";
           a.staleIntent = !intact;
           if (intact && typeof onAuthorized === "function") {
@@ -119,9 +118,9 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
             });
           }
         } else {
-          // 宿主 cancelled 只是源结果：晚写不可排除，转待核实并锁存风险（D-01 软撤回）
-          a.status = "withdrawal-pending-unverified";
-          setRiskLatch("withdrawal-unverified");
+          // Q38：撤回通道已移除，cancelled 结局防御性映射为 failed（无晚写风险源，不设锁存）
+          a.status = "failed";
+          a.error = outcome?.status === "cancelled" ? "authorization-cancelled" : "authorization-failed";
         }
       })
       .catch((err) => {
@@ -132,34 +131,9 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
     return { attemptId: a.attemptId };
   }
 
-  async function cancel() {
-    requireScope();
-    // 先持久失效本地旧意图，再发撤回调用
-    intentIO.bump();
-    let withdrawalDelivery = "unavailable";
-    if (attempt) {
-      attempt.withdrawalRequested = true;
-      if (LIVE_STATUSES.includes(attempt.status)) attempt.status = "withdrawal-pending-unverified";
-    }
-    const cancelFn = ctx.authorization?.cancel;
-    if (typeof cancelFn === "function") {
-      try {
-        await cancelFn(CREDENTIAL_KEY);
-        withdrawalDelivery = "invoked";
-      } catch {
-        withdrawalDelivery = "failed";
-      }
-    }
-    // delivery 写入 attempt：刷新页面后 /state 恢复仍如实展示「已请求撤回」事实
-    if (attempt) attempt.withdrawalDelivery = withdrawalDelivery;
-    // 任何响应都不承诺晚写停止：风险锁存待核实
-    setRiskLatch("withdrawal-requested");
-    return { withdrawalDelivery };
-  }
-
   async function logout() {
     // 退出安全条件（v1.2.10 起，经主人裁决替代 D-01 全禁策略）：
-    // ① 无进行中的授权尝试（begin 晚写窗口）② 无风险锁存（撤回/超时未核实）。
+    // ① 无进行中的授权尝试（begin 晚写窗口）② 无风险锁存（Q38 起仅剩等待超时未核实）。
     // 满足后凭据库视为静止：deleteRecord＋删除后 describe 复核；晚到写无法绝对
     // 排除，以复核与状态页如实展示兜底——退出未核实成功绝不伪报成功。
     requireScope();
@@ -183,6 +157,9 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
       if (err?.code === "LOGOUT_FAILED") throw err;
       throw authError("LOGOUT_FAILED", "logout-failed");
     }
+    // Q38 追加修复（真机验证发现）：退出成功后清掉 attempt 残影——否则 /state 继续报告
+    // 历史「authorized」，客户端会把残影误当登录态，UI 翻回已登录，表现为「退出没作用」
+    attempt = null;
     return { ok: true };
   }
 
@@ -204,7 +181,6 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
       url: attempt.url,
       expiresAt: attempt.expiresAt,
       waitDeadline: attempt.startedAt + WAIT_LIMIT_MS,
-      withdrawalDelivery: attempt.withdrawalDelivery,
       riskLatch,
       staleIntent: attempt.staleIntent,
       notices: [...attempt.notices],
@@ -212,15 +188,14 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
     };
   }
 
-  // T4 消费：handoff 是否仍完好（同 attempt、版本仍当前、无撤回/超时标记）
+  // T4 消费：handoff 是否仍完好（同 attempt、版本仍当前、无超时标记）
   function handoffIntact(handoff) {
     if (!attempt || !handoff) return false;
     return attempt.attemptId === handoff.attemptId
       && attempt.originIntentVersion === handoff.originIntentVersion
       && attempt.originIntentVersion === intentIO.read()
-      && !attempt.withdrawalRequested
       && !attempt.timedOut;
   }
 
-  return { start, cancel, logout, snapshot, handoffIntact };
+  return { start, logout, snapshot, handoffIntact };
 }

package/src/host.mjs

@@ -528,24 +528,6 @@ export function apply(ctx, opts = {}) {
     },
   });
 
-  ctx.webServer.register({
-    kind: "exact",
-    path: r.cancel,
-    handler: async (req, res) => {
-      if (!guard(req, res, "POST")) return;
-      if (!scope.known) {
-        json(res, 503, { ok: false, error: "scope-unavailable" });
-        return;
-      }
-      try {
-        const { withdrawalDelivery } = await controller.cancel();
-        json(res, 200, { ok: true, withdrawalDelivery });
-      } catch (err) {
-        json(res, 500, { ok: false, error: sanitizeAuthError(err) });
-      }
-    },
-  });
-
   ctx.webServer.register({
     kind: "exact",
     path: r.state,

package/src/model-update.mjs

@@ -1,11 +1,16 @@
-// model-update.mjs — 纯模型变更策略（T6）：补充/重建的目标视图、增删保留与原因、writeSet。
+// model-update.mjs — 纯模型变更策略（v3）：管理模型列表＝目标状态编辑（ADR 0005）。
 // 纯函数，不触碰网络/磁盘/settings；视图形状与 host.mjs viewFromUserLayer 同构：
 //   {modelsPresent, models, modelOverridesPresent, modelOverrides}
-// 语义（设计§4.1 / Q1/Q5/Q6/Q8/Q15）：
-//  - 补充：保留全部现有对象/顺序/modelOverrides，仅追加勾选且可解析去重后的候选；默认空选择
-//  - 重建：目标＝账号∩可解析 的纯 {id} 列表，清空本路由 modelOverrides；空交集需 confirmEmpty
-//  - 继承限制：base 继承的 modelOverrides（raw 缺失而 effective 存在）无法经用户层 unset 清除 → 受限
-//  - 不可解析现有项保留＋warning，不暗删
+// 语义（设计§4.1/§4.2 2026-10-05 修订 / Q32–Q36）：
+//  - 单一操作 manage：勾选集合即期望终态；selectedIds 缺省 → 在列∩(账号∩可解析)（与 UI 初始态一致）
+//  - 被保留模型维持原对象/顺序/定制；被移除模型定制随模型消失（overrides 按 kept 过滤，
+//    唯一定制模型被移除时 present:false → unset，防重加复活定制）
+//  - rows：addable（账号∩可解析−在列）/ listed（在列∩(账号∩可解析)）/ removal-proposal
+//    （在列−(账号∩可解析)，reason 优先级：不在账号→not-in-account，否则 unresolvable）
+//  - removed：raw 在列全表−勾选；reason：not-in-account → unresolvable → unchecked（用户主动取消健康行）
+//  - 空目标确认仅约束用户显式提交的空选择（selectedIds!==undefined）；确认后落显式空列表
+//    （modelsPresent:true, models:[]，防 unset 后首次填充静默回填）
+//  - clearOverrides：清除可清除定制（present:false）；仅继承覆盖（raw 缺失而 effective 有）→ 阻止该项
 export function buildModelChange({
   operation,
   rawView,
@@ -13,11 +18,17 @@ export function buildModelChange({
   accountIds,
   resolvableIds,
   selectedIds,
+  clearOverrides = false,
   confirmEmpty = false,
   catalogNewEntryCount = 0,
 }) {
-  if (operation !== "supplement" && operation !== "rebuild") {
-    return { allowed: false, reason: "invalid-operation", targetView: null, added: [], removed: [], kept: [], warnings: [{ reason: "invalid-operation" }], writeSet: { catalogEntries: false, models: false, modelOverrides: false } };
+  if (operation !== "manage") {
+    return {
+      allowed: false, reason: "invalid-operation", targetView: null, rows: [], selectedIds: [],
+      added: [], removed: [], kept: [], warnings: [], removalClass: false,
+      overridesMeta: { rawPresent: false, clearable: false, inheritedOnly: false },
+      writeSet: { catalogEntries: false, models: false, modelOverrides: false, overridesUnclearable: false },
+    };
   }
   const accounts = [...new Set((Array.isArray(accountIds) ? accountIds : []).filter((x) => typeof x === "string"))];
   const resolvable = new Set((Array.isArray(resolvableIds) ? resolvableIds : []).filter((x) => typeof x === "string"));
@@ -25,94 +36,108 @@ export function buildModelChange({
   const eff = effectiveView ?? raw;
   const rawModels = raw.modelsPresent && Array.isArray(raw.models) ? raw.models : [];
   const rawIds = rawModels.map((m) => m?.id).filter((x) => typeof x === "string");
-  const effModels = eff.modelsPresent && Array.isArray(eff.models) ? eff.models : [];
-  const effIds = effModels.map((m) => m?.id).filter((x) => typeof x === "string");
+  const rawIdSet = new Set(rawIds);
+  const accountSet = new Set(accounts);
+
+  const overridesKeys = raw.modelOverridesPresent && raw.modelOverrides && typeof raw.modelOverrides === "object"
+    ? Object.keys(raw.modelOverrides) : [];
+  const rawPresent = overridesKeys.length > 0;
+  const effOverrides = eff.modelOverridesPresent && eff.modelOverrides && typeof eff.modelOverrides === "object"
+    ? Object.keys(eff.modelOverrides) : [];
+  const inheritedOnly = !rawPresent && effOverrides.length > 0;
+  const overridesMeta = { rawPresent, clearable: rawPresent, inheritedOnly };
+
+  const inUniverse = (id) => accountSet.has(id) && resolvable.has(id);
+  const addable = accounts.filter((id) => resolvable.has(id) && !rawIdSet.has(id));
+  const addableSet = new Set(addable);
+  const rows = [
+    ...addable.map((id) => ({ id, status: "addable", customized: false })),
+    ...rawIds.filter((id) => inUniverse(id)).map((id) => ({ id, status: "listed", customized: overridesKeys.includes(id) })),
+    ...rawIds.filter((id) => !inUniverse(id)).map((id) => ({
+      id,
+      status: "removal-proposal",
+      reason: accountSet.has(id) ? "unresolvable" : "not-in-account",
+      customized: overridesKeys.includes(id),
+    })),
+  ];
+
+  // 选择规范化：缺省 → listed（与 UI 初始勾选态一致）；显式（含 []）→ 用户意图
+  const explicitSelection = selectedIds !== undefined;
+  const requested = explicitSelection
+    ? [...new Set((Array.isArray(selectedIds) ? selectedIds : []).filter((x) => typeof x === "string"))]
+    : rawIds.filter((id) => inUniverse(id));
+  const selectedSet = new Set(requested);
+  // warnings：manage 语义下只产 invalid-selection/unresolvable（already-configured 仅保留在契约枚举中，不可达）
   const warnings = [];
-  for (const id of rawIds) {
-    if (!resolvable.has(id)) warnings.push({ id, reason: "unresolvable" });
+  for (const id of requested) {
+    if (addableSet.has(id) || rawIdSet.has(id)) continue;
+    warnings.push({ id, reason: accountSet.has(id) && !resolvable.has(id) ? "unresolvable" : "invalid-selection" });
   }
-  const catalogEntries = catalogNewEntryCount > 0;
 
-  if (operation === "supplement") {
-    const existing = new Set(rawIds);
-    const candidates = accounts.filter((id) => resolvable.has(id) && !existing.has(id));
-    const candidateSet = new Set(candidates);
-    const seen = new Set();
-    const added = [];
-    for (const id of Array.isArray(selectedIds) ? selectedIds : []) {
-      if (typeof id !== "string" || seen.has(id)) continue;
-      seen.add(id);
-      if (candidateSet.has(id)) {
-        added.push(id);
-      } else if (existing.has(id)) {
-        warnings.push({ id, reason: "already-configured" });
-      } else if (accounts.includes(id) && !resolvable.has(id)) {
-        warnings.push({ id, reason: "unresolvable" });
-      } else {
-        warnings.push({ id, reason: "invalid-selection" });
-      }
-    }
-    const models = added.length > 0 ? [...rawModels, ...added.map((id) => ({ id }))] : rawModels;
-    const modelsPresent = raw.modelsPresent || added.length > 0;
-    const overridesUnclearable = false;
-    return {
-      allowed: true,
-      reason: null,
-      candidates, // 候选＝账号∩可解析−已有（Q5：默认全不勾选，勾选后 materialize 新预览）
-      targetView: {
-        modelsPresent,
-        models: modelsPresent ? models : null,
-        modelOverridesPresent: raw.modelOverridesPresent,
-        modelOverrides: raw.modelOverrides,
-      },
-      added,
-      removed: [],
-      kept: effIds.filter((id) => existing.has(id)),
-      warnings,
-      writeSet: { catalogEntries, models: added.length > 0, modelOverrides: false, overridesUnclearable },
-    };
-  }
+  const kept = rawIds.filter((id) => selectedSet.has(id));
+  const keptSet = new Set(kept);
+  const added = addable.filter((id) => selectedSet.has(id));
+  const removed = rawIds
+    .filter((id) => !selectedSet.has(id))
+    .map((id) => ({
+      id,
+      reason: !accountSet.has(id) ? "not-in-account" : !resolvable.has(id) ? "unresolvable" : "unchecked",
+    }));
+  const removalClass = removed.length > 0;
 
-  // rebuild
-  const effOverrides = eff.modelOverridesPresent && eff.modelOverrides && typeof eff.modelOverrides === "object"
-    ? Object.keys(eff.modelOverrides) : [];
-  if (!raw.modelOverridesPresent && effOverrides.length > 0) {
+  if (clearOverrides && inheritedOnly) {
     return {
-      allowed: false,
-      reason: "inherited-overrides-unclearable",
-      targetView: null, added: [], removed: [], kept: [], warnings,
-      writeSet: { catalogEntries, models: false, modelOverrides: false, overridesUnclearable: true },
+      allowed: false, reason: "inherited-overrides-unclearable", targetView: null, rows, selectedIds: requested,
+      added, removed, kept, warnings, removalClass,
+      overridesMeta,
+      writeSet: { catalogEntries: catalogNewEntryCount > 0, models: false, modelOverrides: false, overridesUnclearable: true },
     };
   }
-  const intersection = accounts.filter((id) => resolvable.has(id));
-  if (intersection.length === 0 && !confirmEmpty) {
+  if (explicitSelection && rawIds.length > 0 && requested.length === 0 && !confirmEmpty) {
     return {
-      allowed: false,
-      reason: "empty-intersection-unconfirmed",
-      targetView: null, added: [], removed: [], kept: [], warnings,
-      writeSet: { catalogEntries, models: false, modelOverrides: false, overridesUnclearable: false },
+      allowed: false, reason: "empty-target-unconfirmed", targetView: null, rows, selectedIds: requested,
+      added, removed, kept, warnings, removalClass,
+      overridesMeta,
+      writeSet: { catalogEntries: catalogNewEntryCount > 0, models: false, modelOverrides: false, overridesUnclearable: false },
     };
   }
-  const target = new Set(intersection);
-  const accountSet = new Set(accounts);
-  const removed = effIds
-    .filter((id) => !target.has(id))
-    .map((id) => ({ id, reason: accountSet.has(id) ? "unresolvable" : "not-in-account" }));
-  const rawOverridesPresent = raw.modelOverridesPresent && raw.modelOverrides && Object.keys(raw.modelOverrides).length > 0;
+
+  const keptRawModels = rawModels.filter((m) => keptSet.has(m?.id));
+  const modelsPresent = raw.modelsPresent || requested.length > 0;
+  const models = modelsPresent ? [...keptRawModels, ...added.map((id) => ({ id }))] : null;
+  const clearable = rawPresent;
+  let modelOverridesPresent;
+  let modelOverrides;
+  if (clearOverrides && clearable) {
+    modelOverridesPresent = false;
+    modelOverrides = null;
+  } else if (rawPresent) {
+    const filtered = {};
+    for (const key of overridesKeys) if (keptSet.has(key)) filtered[key] = raw.modelOverrides[key];
+    modelOverridesPresent = Object.keys(filtered).length > 0;
+    modelOverrides = modelOverridesPresent ? filtered : null;
+  } else {
+    modelOverridesPresent = raw.modelOverridesPresent;
+    modelOverrides = raw.modelOverrides;
+  }
+
   return {
     allowed: true,
     reason: null,
-    candidates: null, // 重建目标固定为账号∩可解析交集，无逐项勾选
-    targetView: {
-      modelsPresent: true,
-      models: intersection.map((id) => ({ id })),
-      modelOverridesPresent: false,
-      modelOverrides: null,
-    },
-    added: intersection.filter((id) => !new Set(effIds).has(id)),
+    rows,
+    selectedIds: requested,
+    added,
     removed,
-    kept: intersection.filter((id) => new Set(effIds).has(id)),
+    kept,
     warnings,
-    writeSet: { catalogEntries, models: true, modelOverrides: rawOverridesPresent, overridesUnclearable: false },
+    removalClass,
+    overridesMeta,
+    targetView: { modelsPresent, models, modelOverridesPresent, modelOverrides },
+    writeSet: {
+      catalogEntries: catalogNewEntryCount > 0,
+      models: added.length > 0 || removalClass || (!raw.modelsPresent && requested.length > 0),
+      modelOverrides: clearOverrides && clearable,
+      overridesUnclearable: false,
+    },
   };
 }