@inventec/dsh-copilot-auth 1.2.8 → 1.2.10

package/README.md

@@ -17,7 +17,7 @@
 ## 特性
 
 - 🔐 **设备码登录**：网页 + user code，免 API Token；SSO 组织授权友好
-- 🛑 **诚实的授权语义（v2）**：登录进行中可「**请求撤回**」——请求发出后状态如实显示「结果待核实」，不再伪装成已取消；「退出登录/重新授权」在当前宿主无法证明安全结束前**默认禁用并说明**（绝不静默删除凭据）；同一实例只有一个授权尝试，409 时恢复展示共同进度
+- 🛑 **诚实的授权语义（v2）**：登录进行中可「**请求撤回**」——请求发出后状态如实显示「结果待核实」，不再伪装成已取消；**「退出登录」在静止状态可用**（确认弹窗 → 清除凭据 → 删后核实；尝试进行中/风险锁存期拒绝），「重新授权」禁用（等价退出＋登录，请分步执行）；同一实例只有一个授权尝试，409 时恢复展示共同进度
 - 🧩 **预置提供方路由**：安装即出现在 Models 页，无需手动配置
 - 📦 **模型目录兜底填充**：登录成功时，若 GitHub Copilot 路由还没有模型目录，自动填入账号全部可用模型；你已精简/定制过的目录**永不覆盖**（重启、重新登录均不重置）；已请求撤回后晚到的授权成功**不会**再写你的配置
 - ➕➖ **补充模型 / 重建模型列表（v2 双入口）**：「补充」默认非破坏——候选模型默认全不勾选，勾选后才加入，现有对象/顺序/modelOverrides 全部保留；「重建」显式确认后按「账号可用 ∩ 目录可解析」重建纯 ID 列表并清空本路由 modelOverrides（二次确认 + 空目标单独确认）。预览快照 10 分钟有效、绑定选择；同一操作幂等可查；配置并发编辑优先受保护
@@ -33,7 +33,9 @@
 
 | 本插件 | DSH 实测版本 | authorization 服务 | 说明 |
 |---|---|---|---|
-| v1.2.8+ | `0.1.7-rc.2`+（`0.2.0-rc.1` web 与 `0.2.0-rc.2` desktop 已实测） | runtime 内置，插件不挂载 | **协议 v2：诚实的授权语义＋补充/重建双入口**。授权侧：等待中可「请求撤回」（结果如实显示待核实）、退出/重新授权在宿主可证明安全前禁用并说明、单实例 attempt、15 分钟等待上限、晚到授权成功不再写配置；模型侧：旧「刷新」拆为「补充模型」（候选默认不勾选、非破坏）与「重建模型列表」（二次确认＋清 modelOverrides），预览 10 分钟绑定选择、operationId 幂等、配置并发编辑优先、崩溃可恢复（「结束旧配置意图」显式闭环），状态按 profile 隔离（旧全局状态只读提示）；模型路由要求 `protocolVersion:2`，GET `/status` 零写探针；v1 函数族已从 state.mjs 移除 |
+| v1.2.10+ | `0.1.7-rc.2`+ | runtime 内置，插件不挂载 | **退出登录正式可用**：无进行中授权尝试且无未核实风险（风险锁存）时，经确认弹窗清除凭据并**删除后立即复核**（凭据未消失则如实报「退出未完成」）；授权尝试进行中（begin 晚写窗口）与撤回/超时未核实期一律拒绝退出。`/status` 的 `authorization.capabilities.logout` 按可用性动态返回；**重新授权仍禁用**（等价退出＋登录，请分步执行）。经主人 2026-10-05 裁决替代 v1.2.8 D-01「退出全禁」策略 |
+| v1.2.9 | `0.1.7-rc.2`+（`0.2.0-rc.1` web 与 `0.2.0-rc.2` desktop 已实测） | runtime 内置，插件不挂载 | **修复 v1.2.8 授权页显示回归**：授权状态机漏接 `fetch`，页面恒显「未登录」、点「授权登录」恒「失败」且请求根本不发出（2026-10-04 实机实证，nginx 全量零 `POST /copilot-auth/start`）。另加：/status 加载失败退避自愈重试（60 秒转手动＋「查询状态」）、失败原因分层展示（网络/网关/响应，不再裸「失败」）、已登录时服务端拒绝替换性授权（409 `already-configured`）且客户端自动恢复已登录视图 |
+| v1.2.8 | `0.1.7-rc.2`+（`0.2.0-rc.1` web 与 `0.2.0-rc.2` desktop 已实测） | runtime 内置，插件不挂载 | **协议 v2：诚实的授权语义＋补充/重建双入口**。授权侧：等待中可「请求撤回」（结果如实显示待核实）、退出/重新授权在宿主可证明安全前禁用并说明、单实例 attempt、15 分钟等待上限、晚到授权成功不再写配置；模型侧：旧「刷新」拆为「补充模型」（候选默认不勾选、非破坏）与「重建模型列表」（二次确认＋清 modelOverrides），预览 10 分钟绑定选择、operationId 幂等、配置并发编辑优先、崩溃可恢复（「结束旧配置意图」显式闭环），状态按 profile 隔离（旧全局状态只读提示）；模型路由要求 `protocolVersion:2`，GET `/status` 零写探针；v1 函数族已从 state.mjs 移除。**已知缺陷**：授权状态机漏接 fetchImpl → 授权页恒「未登录/失败」（v1.2.9 修复） |
 | v1.2.7+ | `0.1.7-rc.2`+（`0.2.0-rc.1` web 与 `0.2.0-rc.2` desktop 已实测） | runtime 内置，插件不挂载 | **重启后自动恢复**：注入后以宿主 `listModels` 复核，未端出即**净零切换**（`displayName` 改后复原；两次真内容变化 ⇒ 宿主必然重建快照，用户配置逐字节不变）触发重建；另加双路取实例 + `registryInstanceMismatch`/`registryVia` 诊断。修复 v1.2.6 的"同值写不改变配置身份 ⇒ 快照不重建" |
 | v1.2.6 | `0.1.7-rc.2`+ | runtime 内置，插件不挂载 | 首次引入宿主侧复核与 `settingsNotServed` 诊断；重启自愈用的"同值触碰"**实测不足**（同值写不改变配置对象身份），重启后模型可能仍不出现——请用 v1.2.7 |
 | v1.2.5 | `0.1.7-rc.2`+（`0.2.0-rc.1` web 与 `0.2.0-rc.2` desktop 已实测） | runtime 内置，插件不挂载 | **desktop 只读形态可刷新**：进程内目录注册表注入（ADR 0003），无需重启、不碰官方产物；`0.2.0-rc.2` desktop **实机端到端已验**（注入条目完成真实推理请求）；同批修复 pi-ai ≥0.99.0 的 `chat:` 目录键格式。**已知缺陷**：重启后若宿主快照先于注入定稿，注入条目会被丢弃（v1.2.6 修复） |
@@ -75,7 +77,7 @@ dsh plugin --profile web add @inventec/dsh-copilot-auth
 ## 撤回、退出与卸载
 
 - **请求撤回**：授权等待期间可点「请求撤回」——插件先使本地旧意图失效，再尝试调用宿主撤销接口；无论请求是否送达，状态都如实显示「结果仍待核实」，在结果核实前不能发起新的授权尝试。
-- **退出登录 / 重新授权**：当前宿主桥接无法证明授权流程已安全结束（晚写不可排除），两项操作**默认禁用并说明原因**，插件也绝不调用凭据删除；待宿主提供可信安全路径后再启用。
+- **退出登录（v1.2.10）**：无进行中授权尝试且无未核实风险时可退出——确认弹窗（将清除同一凭据库中所有实例共享的 Copilot 授权，不注销 GitHub 账号）→ 删除凭据 → **删除后立即复核**，凭据仍在则如实显示「退出未完成，授权凭据仍可能存在」；授权尝试进行中（设备码等待期，begin 晚写窗口）与撤回/超时未核实的风险锁存期一律拒绝退出。**重新授权**仍禁用：等价于退出＋登录，请先「退出登录」再「授权登录」。
 - 卸载：`dsh plugin --profile web remove @inventec/dsh-copilot-auth` 后重启 dsh web
 
 ## 补充模型 / 重建模型列表

package/lib/client.js

@@ -374,12 +374,12 @@ function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = () => {
       timer = null;
     }
   };
-  const schedule = (gen, delayMs) => {
+  const schedule = (gen, delayMs, fn = () => pollTick(gen)) => {
     if (stale(gen)) return;
     clearTimer();
     timer = clock.setTimeout(() => {
       timer = null;
-      void pollTick(gen);
+      void fn();
     }, delayMs);
   };
   function applySnapshot(gen, s) {
@@ -433,12 +433,32 @@ function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = () => {
   async function init() {
     const gen = ++generation;
     clearTimer();
+    failures = 0;
+    backoffIdx = 0;
+    failureWindowStart = null;
+    await initAttempt(gen);
+  }
+  async function initAttempt(gen) {
     const status = await requestJson(fetchImpl, "/copilot-auth/status", { method: "GET" });
     if (stale(gen)) return;
     if (!status.ok) {
-      emit({ phase: "idle", error: status.error?.messageKey });
+      failures += 1;
+      if (failureWindowStart === null) failureWindowStart = clock.now();
+      const cumulative = clock.now() - failureWindowStart;
+      if (cumulative >= AUTO_RETRY_LIMIT_MS) {
+        emit({ phase: "idle", error: status.error?.messageKey, connectivity: "manual" });
+        return;
+      }
+      emit({ phase: "loading", connectivity: "retrying", error: status.error?.messageKey });
+      const delayS = BACKOFF_STEPS_S[Math.min(backoffIdx, BACKOFF_STEPS_S.length - 1)];
+      backoffIdx += 1;
+      schedule(gen, delayS * 1e3, () => initAttempt(gen));
       return;
     }
+    failures = 0;
+    backoffIdx = 0;
+    failureWindowStart = null;
+    emit({ connectivity: "online" });
     const body = status.body ?? {};
     if (body.refresh?.scopeAvailable === false) {
       emit({ phase: "unavailable" });
@@ -449,13 +469,13 @@ function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = () => {
       emit({ riskLatch: body.authorization.riskLatch });
     }
     if (body.configured === true) {
-      emit({ phase: "authorized" });
+      emit({ phase: "authorized", error: void 0 });
       return;
     }
     const r = await requestJson(fetchImpl, "/copilot-auth/state", { method: "GET" });
     if (stale(gen)) return;
     if (!r.ok) {
-      emit({ phase: "idle" });
+      emit({ phase: "idle", error: r.error?.messageKey, connectivity: "manual" });
       return;
     }
     applySnapshot(gen, r.body);
@@ -474,6 +494,10 @@ function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = () => {
       return;
     }
     const errorCode = r.error?.details?.errorCode;
+    if (errorCode === "already-configured") {
+      emit({ phase: "authorized", error: void 0, shared: false });
+      return;
+    }
     if (r.httpStatus === 409) {
       emit({ shared: true });
       beginPolling(gen);
@@ -497,20 +521,31 @@ function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = () => {
     }
     emit({ withdrawalDelivery: "failed", error: r.error?.details?.errorCode ?? r.error?.messageKey });
   }
-  function refresh() {
+  async function logout() {
     const gen = ++generation;
     clearTimer();
     failures = 0;
     backoffIdx = 0;
     failureWindowStart = null;
-    emit({ connectivity: "online" });
-    void pollTick(gen);
+    emit({ phase: "loading", logoutError: void 0 });
+    const r = await requestJson(fetchImpl, "/copilot-auth/logout", { method: "POST" });
+    if (stale(gen)) return;
+    if (!r.ok) {
+      const code = r.error?.details?.errorCode;
+      emit({ phase: "authorized", logoutError: code ?? r.error?.messageKey ?? "logout-failed" });
+      return;
+    }
+    emit({ logoutError: void 0 });
+    await initAttempt(gen);
+  }
+  function refresh() {
+    void init();
   }
   function dispose() {
     generation += 1;
     clearTimer();
   }
-  return { init, start, cancel, refresh, dispose };
+  return { init, start, cancel, logout, refresh, dispose };
 }
 
 // src/client.jsx
@@ -545,6 +580,14 @@ var DICTS = {
     copy: "Copy",
     copied: "Copied \u2713",
     unknown: "Unknown error",
+    statusUnknown: "Status unknown",
+    errNetwork: "Network error: cannot reach the authorization service. Retrying automatically.",
+    errGateway: "Gateway error: the DSH service may be restarting. Retrying automatically.",
+    errBadResponse: "Unexpected response from the authorization service.",
+    errHttp: "The authorization request failed. Check status and retry.",
+    logoutScope: "This removes Copilot authorization from this credential store and affects other instances using it. It does not delete your GitHub account.",
+    logoutFailed: "Sign-out did not complete; authorization credentials may remain. Please retry.",
+    reauthHint: "Reauthorize is unavailable. Sign out first, then sign in again.",
     // ---- Model management (protocol v2, design §5) ----
     supplement: "Add models",
     rebuild: "Rebuild model list",
@@ -622,6 +665,14 @@ var DICTS = {
     copy: "\u590D\u5236",
     copied: "\u5DF2\u590D\u5236 \u2713",
     unknown: "\u672A\u77E5\u9519\u8BEF",
+    statusUnknown: "\u72B6\u6001\u672A\u77E5",
+    errNetwork: "\u7F51\u7EDC\u5F02\u5E38\uFF1A\u65E0\u6CD5\u8FDE\u63A5\u6388\u6743\u670D\u52A1\uFF0C\u6B63\u5728\u81EA\u52A8\u91CD\u8BD5\u3002",
+    errGateway: "\u7F51\u5173\u9519\u8BEF\uFF1ADSH \u670D\u52A1\u53EF\u80FD\u6B63\u5728\u91CD\u542F\uFF0C\u6B63\u5728\u81EA\u52A8\u91CD\u8BD5\u3002",
+    errBadResponse: "\u6388\u6743\u670D\u52A1\u8FD4\u56DE\u5F02\u5E38\u54CD\u5E94\u3002",
+    errHttp: "\u6388\u6743\u8BF7\u6C42\u5931\u8D25\u3002\u8BF7\u67E5\u8BE2\u72B6\u6001\u540E\u91CD\u8BD5\u3002",
+    logoutScope: "\u5C06\u6E05\u9664\u6B64\u51ED\u636E\u5E93\u4E2D\u7684 Copilot \u6388\u6743\uFF0C\u4F7F\u7528\u540C\u4E00\u51ED\u636E\u5E93\u7684\u5176\u4ED6\u5B9E\u4F8B\u4E5F\u4F1A\u53D7\u5230\u5F71\u54CD\u3002\u6B64\u64CD\u4F5C\u4E0D\u6CE8\u9500 GitHub \u8D26\u53F7\u3002",
+    logoutFailed: "\u9000\u51FA\u767B\u5F55\u672A\u5B8C\u6210\uFF0C\u6388\u6743\u51ED\u636E\u4ECD\u53EF\u80FD\u5B58\u5728\u3002\u8BF7\u91CD\u8BD5\u3002",
+    reauthHint: "\u91CD\u65B0\u6388\u6743\u6682\u4E0D\u53EF\u7528\uFF1A\u8BF7\u5148\u9000\u51FA\u767B\u5F55\uFF0C\u518D\u91CD\u65B0\u6388\u6743\u3002",
     // ---- 模型管理（协议 v2，设计§5） ----
     supplement: "\u8865\u5145\u6A21\u578B",
     rebuild: "\u91CD\u5EFA\u6A21\u578B\u5217\u8868",
@@ -681,6 +732,14 @@ function blockedReasonText(t, flags) {
   if (reason && t("blockedReasons")?.[reason]) return t("blockedReasons")[reason];
   return t("unavailable");
 }
+function httpErrorText(t, key) {
+  return {
+    "network-error": t("errNetwork"),
+    "bad-gateway": t("errGateway"),
+    "bad-response": t("errBadResponse"),
+    "http-error": t("errHttp")
+  }[key];
+}
 var COPILOT_ICON_SVG = '<svg aria-hidden="true" width="16" height="16" viewBox="0 0 16 16" fill="currentColor" style="flex:none"><path d="M7.998 15.035c-4.562 0-7.873-2.914-7.998-3.749V9.338c.085-.628.677-1.686 1.588-2.065.013-.07.024-.143.036-.218.029-.183.06-.384.126-.612-.201-.508-.254-1.084-.254-1.656 0-.87.128-1.769.693-2.484.579-.733 1.494-1.124 2.724-1.261 1.206-.134 2.262.034 2.944.765.05.053.096.108.139.165.044-.057.094-.112.143-.165.682-.731 1.738-.899 2.944-.765 1.23.137 2.145.528 2.724 1.261.566.715.693 1.614.693 2.484 0 .572-.053 1.148-.254 1.656.066.228.098.429.126.612.924.385 1.522 1.471 1.591 2.095v1.872c0 .766-3.351 3.795-8.002 3.795Zm0-1.485c2.28 0 4.584-1.11 5.002-1.433V7.862l-.023-.116c-.49.21-1.075.291-1.727.291-1.146 0-2.059-.327-2.71-.991A3.222 3.222 0 0 1 8 6.303a3.24 3.24 0 0 1-.544.743c-.65.664-1.563.991-2.71.991-.652 0-1.236-.081-1.727-.291l-.023.116v4.255c.419.323 2.722 1.433 5.002 1.433ZM6.762 2.83c-.193-.206-.637-.413-1.682-.297-1.019.113-1.479.404-1.713.7-.247.312-.369.789-.369 1.554 0 .793.129 1.171.308 1.371.162.181.519.379 1.442.379.853 0 1.339-.235 1.638-.54.315-.322.527-.827.617-1.553.117-.935-.037-1.395-.241-1.614Zm4.155-.297c-1.044-.116-1.488.091-1.681.297-.204.219-.359.679-.242 1.614.091.726.303 1.231.618 1.553.299.305.784.54 1.638.54.922 0 1.28-.198 1.442-.379.179-.2.308-.578.308-1.371 0-.765-.123-1.242-.37-1.554-.233-.296-.693-.587-1.713-.7Z"/><path d="M6.25 9.037a.75.75 0 0 1 .75.75v1.501a.75.75 0 0 1-1.5 0V9.787a.75.75 0 0 1 .75-.75Zm4.25.75v1.501a.75.75 0 0 1-1.5 0V9.787a.75.75 0 0 1 1.5 0Z"/></svg>';
 function enforceNavIcon(labelText) {
   if (!labelText) return;
@@ -962,15 +1021,34 @@ function RetireDialog({ t, onConfirm, onCancel }) {
     ] })
   ] }) });
 }
+function ConfirmDialog({ title, body, confirmText, cancelText, onConfirm, onCancel }) {
+  const cancelRef = (0, import_react.useRef)(null);
+  const surface = (0, import_react.useRef)(null);
+  if (!surface.current) surface.current = sampleThemeSurface();
+  (0, import_react.useEffect)(() => {
+    cancelRef.current?.focus();
+  }, []);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: styles.modalMask, role: "dialog", "aria-modal": "true", onKeyDown: (e) => {
+    if (e.key === "Escape") onCancel();
+  }, children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { ...styles.modal, background: surface.current.bg, color: surface.current.fg, maxWidth: 460 }, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h4", { style: styles.modalTitle, children: title }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.modalText, children: body }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.modalActions, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { ref: cancelRef, type: "button", style: { ...styles.button, ...styles.secondary }, onClick: onCancel, children: cancelText }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.primary }, onClick: onConfirm, children: confirmText })
+    ] })
+  ] }) });
+}
 function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
   const [auth, setAuth] = (0, import_react.useState)({ phase: "loading", connectivity: "online", shared: false });
   const [copied, setCopied] = (0, import_react.useState)(false);
   const [copyFail, setCopyFail] = (0, import_react.useState)(false);
+  const [logoutConfirm, setLogoutConfirm] = (0, import_react.useState)(false);
   const [flow, setFlow] = (0, import_react.useState)(initial);
   const flowRef = (0, import_react.useRef)(flow);
   const authFlowRef = (0, import_react.useRef)(null);
   if (!authFlowRef.current && typeof fetch === "function") {
-    authFlowRef.current = createAuthFlow({ onState: (s) => setAuth(s) });
+    authFlowRef.current = createAuthFlow({ fetchImpl: fetch, onState: (s) => setAuth(s) });
   }
   const drive = (event) => advance(flowRef.current, event, fetch, (next) => {
     flowRef.current = next;
@@ -995,6 +1073,10 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
   const checkStatus = () => {
     void authFlowRef.current?.refresh();
   };
+  const doLogout = () => {
+    setLogoutConfirm(false);
+    void authFlowRef.current?.logout();
+  };
   const copyCode = async (code) => {
     try {
       await navigator.clipboard.writeText(code);
@@ -1012,7 +1094,7 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
     const n = notices.find((x) => x && typeof x.code === "string" && x.code !== "");
     return n ? { code: n.code, url: n.url } : null;
   })();
-  const badgeText = t(phase === "risk" ? "riskBadge" : phase === "loading" ? "loading" : phase);
+  const badgeText = phase === "risk" ? t("riskBadge") : phase === "loading" ? t("loading") : phase === "idle" && auth.error ? t("statusUnknown") : t(phase);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.section, children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { style: styles.title, children: t("title") }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.intro, children: t("intro") }),
@@ -1055,10 +1137,34 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
       t("unavailable")
     ] }),
     phase === "failed" && attempt?.error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.error, children: attempt.error }),
+    phase === "failed" && !attempt?.error && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
+        "\u26A0 ",
+        httpErrorText(t, auth.error) ?? t("unknown")
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary }, onClick: checkStatus, children: t("retryNow") }) })
+    ] }),
+    phase === "idle" && auth.error && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
+      "\u26A0 ",
+      httpErrorText(t, auth.error) ?? t("unknown")
+    ] }),
     phase === "authorized" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.card, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 10, alignItems: "center", flexWrap: "wrap" }, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary, opacity: 0.5, cursor: "not-allowed" }, disabled: true, title: t("authUnsafe"), children: t("logout") }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary, opacity: 0.5, cursor: "not-allowed" }, disabled: true, title: t("authUnsafe"), children: t("reauthorize") }),
+        (() => {
+          const logoutAvailable = auth.status?.authorization?.capabilities?.logout === true;
+          return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              style: { ...styles.button, ...styles.secondary, ...logoutAvailable ? null : { opacity: 0.5, cursor: "not-allowed" } },
+              disabled: !logoutAvailable,
+              title: logoutAvailable ? t("logoutScope") : t("authUnsafe"),
+              onClick: () => setLogoutConfirm(true),
+              children: t("logout")
+            }
+          );
+        })(),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.secondary, opacity: 0.5, cursor: "not-allowed" }, disabled: true, title: t("reauthHint"), children: t("reauthorize") }),
         ["previewing", "applying", "checking", "retiring"].includes(flow.name) ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.primary, opacity: 0.5 }, disabled: true, children: flow.name === "applying" ? t("applying") : t("refreshing") }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
             "button",
@@ -1084,7 +1190,11 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
         "\u24D8 ",
-        t("authUnsafe")
+        t("reauthHint")
+      ] }),
+      auth.logoutError && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.error, children: [
+        "\u26A0 ",
+        auth.logoutError === "logout-unsafe" ? t("authUnsafe") : t("logoutFailed")
       ] }),
       refreshBlocked(flow.flags) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { style: styles.banner, children: [
         "\u26A0 ",
@@ -1157,6 +1267,17 @@ function CopilotSection({ t = (key) => DICTS.en[key] ?? key }) {
         onCancel: () => drive({ type: "cancel" })
       }
     ),
+    logoutConfirm && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      ConfirmDialog,
+      {
+        title: t("logout"),
+        body: t("logoutScope"),
+        confirmText: t("logout"),
+        cancelText: t("cancel"),
+        onCancel: () => setLogoutConfirm(false),
+        onConfirm: doLogout
+      }
+    ),
     (phase === "idle" || phase === "failed") && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", style: { ...styles.button, ...styles.primary }, onClick: login, children: t("login") }) })
   ] });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@inventec/dsh-copilot-auth",
-  "version": "1.2.8",
-  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.8：请求撤回/禁用不安全退出、补充模型/重建模型列表双入口（协议 v2）。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。",
+  "version": "1.2.10",
+  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.10：退出登录正式可用（静止态删凭据＋删后核实，尝试期/风险锁存期拒绝），失败原因分层展示（协议 v2）。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。",
   "type": "module",
   "license": "MIT",
   "author": "iasi",

package/src/auth-flow.mjs

@@ -36,12 +36,12 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
       timer = null;
     }
   };
-  const schedule = (gen, delayMs) => {
+  const schedule = (gen, delayMs, fn = () => pollTick(gen)) => {
     if (stale(gen)) return;
     clearTimer();
     timer = clock.setTimeout(() => {
       timer = null;
-      void pollTick(gen);
+      void fn();
     }, delayMs);
   };
 
@@ -100,12 +100,35 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
   async function init() {
     const gen = ++generation;
     clearTimer();
+    failures = 0;
+    backoffIdx = 0;
+    failureWindowStart = null;
+    await initAttempt(gen);
+  }
+
+  // init 内核：/status 失败时按 1/2/4/8/15 秒退避自动重试，累计 60 秒转手动；
+  // 不把加载失败伪装成「未登录」（历史缺陷：502 窗口期打开页面会显示未登录＋授权按钮）。
+  async function initAttempt(gen) {
     const status = await requestJson(fetchImpl, "/copilot-auth/status", { method: "GET" });
     if (stale(gen)) return;
     if (!status.ok) {
-      emit({ phase: "idle", error: status.error?.messageKey });
+      failures += 1;
+      if (failureWindowStart === null) failureWindowStart = clock.now();
+      const cumulative = clock.now() - failureWindowStart;
+      if (cumulative >= AUTO_RETRY_LIMIT_MS) {
+        emit({ phase: "idle", error: status.error?.messageKey, connectivity: "manual" });
+        return;
+      }
+      emit({ phase: "loading", connectivity: "retrying", error: status.error?.messageKey });
+      const delayS = BACKOFF_STEPS_S[Math.min(backoffIdx, BACKOFF_STEPS_S.length - 1)];
+      backoffIdx += 1;
+      schedule(gen, delayS * 1000, () => initAttempt(gen));
       return;
     }
+    failures = 0;
+    backoffIdx = 0;
+    failureWindowStart = null;
+    emit({ connectivity: "online" });
     const body = status.body ?? {};
     if (body.refresh?.scopeAvailable === false) {
       emit({ phase: "unavailable" });
@@ -116,14 +139,14 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
       emit({ riskLatch: body.authorization.riskLatch });
     }
     if (body.configured === true) {
-      emit({ phase: "authorized" });
+      emit({ phase: "authorized", error: undefined });
       return;
     }
     // 未配置时回查最近一次 attempt：恢复轮询或如实呈现终态
     const r = await requestJson(fetchImpl, "/copilot-auth/state", { method: "GET" });
     if (stale(gen)) return;
     if (!r.ok) {
-      emit({ phase: "idle" });
+      emit({ phase: "idle", error: r.error?.messageKey, connectivity: "manual" });
       return;
     }
     applySnapshot(gen, r.body);
@@ -143,6 +166,12 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
       return;
     }
     const errorCode = r.error?.details?.errorCode;
+    if (errorCode === "already-configured") {
+      // 后端确认已有凭据：本页是过期的未登录视图（如短暂 read-error 窗口），
+      // 直接恢复已登录视图，不发起注定失败的替换性授权
+      emit({ phase: "authorized", error: undefined, shared: false });
+      return;
+    }
     if (r.httpStatus === 409) {
       // 共同尝试：不是失败——展示 shared 并转入对现有 attempt 的轮询
       emit({ shared: true });
@@ -170,15 +199,30 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
     emit({ withdrawalDelivery: "failed", error: r.error?.details?.errorCode ?? r.error?.messageKey });
   }
 
-  function refresh() {
-    // 手动重试（60 秒上限后）：恢复自动轮询并重置失败窗口
+  async function logout() {
+    // 退出登录（写操作，单次调用）：pending 态 → 成功后完整重跑 init 恢复真实
+    // 状态（若晚到写把凭据写了回来，init 会如实显示 authorized，绝不伪报已退出）；
+    // 失败回到 authorized 并保留 logoutError 供 UI 分层展示。
     const gen = ++generation;
     clearTimer();
     failures = 0;
     backoffIdx = 0;
     failureWindowStart = null;
-    emit({ connectivity: "online" });
-    void pollTick(gen);
+    emit({ phase: "loading", logoutError: undefined });
+    const r = await requestJson(fetchImpl, "/copilot-auth/logout", { method: "POST" });
+    if (stale(gen)) return;
+    if (!r.ok) {
+      const code = r.error?.details?.errorCode;
+      emit({ phase: "authorized", logoutError: code ?? r.error?.messageKey ?? "logout-failed" });
+      return;
+    }
+    emit({ logoutError: undefined });
+    await initAttempt(gen);
+  }
+
+  function refresh() {
+    // 手动「查询状态」：完整重跑 init（status→state），可从过期的未登录/失败视图恢复
+    void init();
   }
 
   function dispose() {
@@ -186,5 +230,5 @@ export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = ()
     clearTimer();
   }
 
-  return { init, start, cancel, refresh, dispose };
+  return { init, start, cancel, logout, refresh, dispose };
 }

package/src/auth-host.mjs

@@ -10,7 +10,8 @@ import { randomUUID } from "node:crypto";
 import { CREDENTIAL_KEY } from "./shared.mjs";
 
 export const WAIT_LIMIT_MS = 15 * 60 * 1000;
-const LIVE_STATUSES = ["starting", "waiting", "finishing"];
+// 进行中的授权尝试状态：begin 的晚写窗口，期间退出/撤回类操作一律拒绝
+export const LIVE_STATUSES = ["starting", "waiting", "finishing"];
 
 // 授权错误脱敏：仅保留安全字符集（字母/数字/空格/点/冒号/逗号/连字符），
 // 阻断上游异常文本或疑似 token（含 = ; / + _ 等的串）进入状态面。
@@ -40,12 +41,22 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
     if (!scope?.known) throw authError("SCOPE_UNAVAILABLE", "scope-unavailable");
   };
 
-  function start() {
+  async function start() {
     requireScope();
     if (riskLatch) throw authError("AUTH_UNSAFE", "auth-unsafe", { riskLatch });
     if (attempt && LIVE_STATUSES.includes(attempt.status)) {
       throw authError("ATTEMPT_RUNNING", "already running", { attemptId: attempt.attemptId });
     }
+    // 初始授权条件（设计 Q21）：已有凭据时禁止新的授权尝试——那是对既有授权的
+    // 隐式替换（历史实证：已登录状态下点「授权登录」，begin 带着已存在的凭据发起
+    // 设备流，attempt 永远停在 starting，最终以「失败」收场）。「重新授权」在宿主
+    // 可证明安全前默认禁用。describeRecord 自身失败不阻断（读不到≠存在）。
+    try {
+      const info = await ctx.credentials.describeRecord(CREDENTIAL_KEY);
+      if (info?.configured === true) throw authError("ALREADY_CONFIGURED", "already-configured");
+    } catch (err) {
+      if (err?.code === "ALREADY_CONFIGURED") throw err;
+    }
     // 先持久意图版本，失败不发 begin（安全门拒绝动作不产生副作用）
     const originIntentVersion = intentIO.bump();
     const a = {
@@ -137,9 +148,33 @@ export function createAuthorizationController(ctx, { scope, intentIO, clock = {
     return { withdrawalDelivery };
   }
 
-  function logout() {
-    // 当前宿主无法证明安全退出（D-01）：统一拒绝，不调用 deleteRecord
-    throw authError("LOGOUT_UNAVAILABLE", "logout-safety-unavailable");
+  async function logout() {
+    // 退出安全条件（v1.2.10 起，经主人裁决替代 D-01 全禁策略）：
+    // ① 无进行中的授权尝试（begin 晚写窗口）② 无风险锁存（撤回/超时未核实）。
+    // 满足后凭据库视为静止：deleteRecord＋删除后 describe 复核；晚到写无法绝对
+    // 排除，以复核与状态页如实展示兜底——退出未核实成功绝不伪报成功。
+    requireScope();
+    if (attempt && LIVE_STATUSES.includes(attempt.status)) {
+      throw authError("ATTEMPT_RUNNING", "already running", { attemptId: attempt.attemptId });
+    }
+    if (riskLatch) throw authError("LOGOUT_UNSAFE", "logout-unsafe");
+    // 本 profile 显式操作：旧预览/模型配置意图先行失效（失败则不动凭据）
+    intentIO.bump();
+    try {
+      const deleted = await ctx.credentials.deleteRecord(CREDENTIAL_KEY);
+      if (deleted === false) throw authError("LOGOUT_FAILED", "logout-failed");
+    } catch (err) {
+      if (err?.code === "LOGOUT_FAILED") throw err;
+      throw authError("LOGOUT_FAILED", "logout-failed");
+    }
+    try {
+      const info = await ctx.credentials.describeRecord(CREDENTIAL_KEY);
+      if (info?.configured === true) throw authError("LOGOUT_FAILED", "logout-failed");
+    } catch (err) {
+      if (err?.code === "LOGOUT_FAILED") throw err;
+      throw authError("LOGOUT_FAILED", "logout-failed");
+    }
+    return { ok: true };
   }
 
   function snapshot() {

package/src/host.mjs

@@ -9,7 +9,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { CREDENTIAL_KEY, PROTOCOL_VERSION, routes } from "./shared.mjs";
 import { readJson, writeJsonAtomic, createMutex } from "./atomic-json.mjs";
-import { createAuthorizationController, sanitizeAuthError } from "./auth-host.mjs";
+import { createAuthorizationController, sanitizeAuthError, LIVE_STATUSES } from "./auth-host.mjs";
 import { resolveRuntimeScope } from "./runtime-scope.mjs";
 import { mergeCatalog, digest, findPiAiInstallation, classifyCatalogTarget, normalizeRemoteCatalog, catalogShapeKeys } from "./catalog.mjs";
 import { fetchLatestCatalog } from "./catalog-fetch.mjs";
@@ -501,14 +501,14 @@ export function apply(ctx, opts = {}) {
   ctx.webServer.register({
     kind: "exact",
     path: r.start,
-    handler: (req, res) => {
+    handler: async (req, res) => {
       if (!guard(req, res, "POST")) return;
       if (!scope.known) {
         json(res, 503, { ok: false, error: "scope-unavailable" });
         return;
       }
       try {
-        const { attemptId } = controller.start();
+        const { attemptId } = await controller.start();
         json(res, 202, { ok: true, attemptId });
       } catch (err) {
         if (err?.code === "ATTEMPT_RUNNING") {
@@ -519,6 +519,10 @@ export function apply(ctx, opts = {}) {
           json(res, 409, { ok: false, error: "auth-unsafe" });
           return;
         }
+        if (err?.code === "ALREADY_CONFIGURED") {
+          json(res, 409, { ok: false, error: "already-configured" });
+          return;
+        }
         json(res, 500, { ok: false, error: sanitizeAuthError(err) });
       }
     },
@@ -565,6 +569,12 @@ export function apply(ctx, opts = {}) {
         credential = "read-error";
       }
       const authSnapshot = controller.snapshot();
+      // 退出可用性（v1.2.10）：无进行中尝试且无风险锁存才可安全删除凭据；
+      // 重新授权恒不可用（等价于退出＋登录，请分步执行）
+      const logoutAvailable = !authSnapshot.riskLatch
+        && !LIVE_STATUSES.includes(authSnapshot.status)
+        && authSnapshot.status !== "withdrawal-pending-unverified"
+        && authSnapshot.status !== "timed-out-unverified";
       // refresh 块：只读聚合（通道分类来自启动期缓存；GET 不执行写探针，Q23）
       const loaded = loadRefreshState(scope, { legacyPath });
       const st = loaded.flags.unknownVersion ? null : loaded.state;
@@ -619,7 +629,7 @@ export function apply(ctx, opts = {}) {
           credential,
           attempt: authSnapshot,
           riskLatch: authSnapshot.riskLatch,
-          capabilities: { logout: false, reauthorize: false },
+          capabilities: { logout: logoutAvailable, reauthorize: false },
         },
         refresh,
         ...(operation ? { operation } : {}),
@@ -627,13 +637,35 @@ export function apply(ctx, opts = {}) {
     },
   });
 
-  // 退出登录：当前宿主桥接无法证明安全退出（D-01），统一拒绝且绝不 deleteRecord。
+  // 退出登录（v1.2.10）：无进行中尝试且无风险锁存时执行凭据删除＋删后核实；
+  // 进行中尝试（begin 晚写窗口）与风险锁存期（撤回/超时未核实）一律拒绝。
   ctx.webServer.register({
     kind: "exact",
     path: r.logout,
-    handler: (req, res) => {
+    handler: async (req, res) => {
       if (!guard(req, res, "POST")) return;
-      json(res, 403, { ok: false, error: "logout-safety-unavailable" });
+      if (!scope.known) {
+        json(res, 503, { ok: false, error: "scope-unavailable" });
+        return;
+      }
+      try {
+        await controller.logout();
+        json(res, 200, { ok: true });
+      } catch (err) {
+        if (err?.code === "ATTEMPT_RUNNING") {
+          json(res, 409, { ok: false, error: "already running", attemptId: err.attemptId });
+          return;
+        }
+        if (err?.code === "LOGOUT_UNSAFE") {
+          json(res, 409, { ok: false, error: "logout-unsafe" });
+          return;
+        }
+        if (err?.code === "LOGOUT_FAILED") {
+          json(res, 409, { ok: false, error: "logout-failed" });
+          return;
+        }
+        json(res, 500, { ok: false, error: sanitizeAuthError(err) });
+      }
     },
   });