@kenkaiiii/gg-core 5.39.3 → 5.40.0

package/dist/{chunk-XDE6VUI4.js → chunk-JH7OVHH5.js}

@@ -256,6 +256,7 @@ import path2 from "path";
 import { randomBytes } from "crypto";
 import { environmentSecrets, redactText, redactValue } from "@kenkaiiii/gg-ai";
 var MAX_BYTES = 10 * 1024 * 1024;
+var MIN_HEADROOM_BYTES = 64 * 1024;
 var fd = null;
 var bytesWritten = 0;
 var capped = false;
@@ -266,7 +267,7 @@ var exactSecrets = [];
 function rotateIfNeeded(filePath) {
   try {
     const st = fs.statSync(filePath);
-    if (st.size < MAX_BYTES) return;
+    if (st.size <= MAX_BYTES - MIN_HEADROOM_BYTES) return;
     const rotated = `${filePath}.1`;
     try {
       fs.unlinkSync(rotated);
@@ -561,6 +562,9 @@ var TOKEN_URL = "https://auth.openai.com/oauth/token";
 var REDIRECT_URI2 = "http://localhost:1455/auth/callback";
 var SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
 var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+var CALLBACK_TIMEOUT_MS = 12e4;
+var MAX_PASTE_ATTEMPTS = 3;
+var MIN_RAW_CODE_LENGTH = 10;
 async function loginOpenAI(callbacks) {
   const { verifier, challenge } = await generatePKCE();
   const state = crypto3.randomBytes(16).toString("hex");
@@ -576,20 +580,7 @@ async function loginOpenAI(callbacks) {
   url.searchParams.set("id_token_add_organizations", "true");
   url.searchParams.set("codex_cli_simplified_flow", "true");
   url.searchParams.set("originator", "ggcoder");
-  let code;
-  try {
-    code = await loginWithServer(url.toString(), state, callbacks);
-  } catch {
-    callbacks.onOpenUrl(url.toString());
-    const raw = await callbacks.onPromptCode(
-      "Could not start local server. Paste the callback URL or code from the browser:"
-    );
-    const parsed = parseAuthorizationInput(raw);
-    if (!parsed.code) {
-      throw new Error("No authorization code found in input.");
-    }
-    code = parsed.code;
-  }
+  const code = await acquireAuthorizationCode(url.toString(), state, callbacks);
   const creds = await exchangeOpenAICode(code, verifier);
   const accountId = getAccountId(creds.accessToken);
   if (!accountId) {
@@ -620,6 +611,7 @@ function parseAuthorizationInput(input) {
       state: params.get("state") ?? void 0
     };
   }
+  if (/\s/.test(value) || value.length < MIN_RAW_CODE_LENGTH) return {};
   return { code: value };
 }
 function decodeJwt(token) {
@@ -638,7 +630,55 @@ function getAccountId(accessToken) {
   const accountId = auth?.chatgpt_account_id;
   return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
 }
-async function loginWithServer(authUrl, expectedState, callbacks) {
+async function acquireAuthorizationCode(authUrl, expectedState, callbacks) {
+  callbacks.onOpenUrl(authUrl);
+  callbacks.onStatus("Waiting for browser callback...");
+  const done = new AbortController();
+  try {
+    return await new Promise((resolve, reject) => {
+      let serverFailed = false;
+      let pasteError;
+      const failIfExhausted = () => {
+        if (!serverFailed || pasteError === void 0) return;
+        reject(
+          pasteError instanceof Error ? pasteError : new Error("Could not obtain an authorization code.")
+        );
+      };
+      listenForCallback(expectedState, done.signal).then(resolve, () => {
+        serverFailed = true;
+        failIfExhausted();
+      });
+      promptForCode(expectedState, callbacks, done.signal).then(resolve, (err) => {
+        if (err instanceof FatalLoginError) {
+          reject(err);
+          return;
+        }
+        pasteError = err;
+        failIfExhausted();
+      });
+    });
+  } finally {
+    done.abort();
+  }
+}
+var FatalLoginError = class extends Error {
+};
+async function promptForCode(expectedState, callbacks, signal) {
+  let message = "If the browser is on another machine (SSH/headless), paste the callback URL or code here:";
+  for (let attempt = 0; attempt < MAX_PASTE_ATTEMPTS; attempt++) {
+    if (signal.aborted) throw new Error("Authorization code already received.");
+    const raw = await callbacks.onPromptCode(message, signal);
+    if (signal.aborted) throw new Error("Authorization code already received.");
+    const parsed = parseAuthorizationInput(raw);
+    if (parsed.code && parsed.state && parsed.state !== expectedState) {
+      throw new FatalLoginError("Authorization state mismatch \u2014 start the login again.");
+    }
+    if (parsed.code) return parsed.code;
+    message = "That didn't contain an authorization code. Paste the full callback URL:";
+  }
+  throw new Error("No authorization code found in input.");
+}
+async function listenForCallback(expectedState, signal) {
   return new Promise((resolve, reject) => {
     let receivedCode = null;
     const server = http.createServer((req, res) => {
@@ -661,18 +701,18 @@ async function loginWithServer(authUrl, expectedState, callbacks) {
     server.on("error", (err) => {
       reject(err);
     });
-    server.listen(1455, "127.0.0.1", () => {
-      callbacks.onOpenUrl(authUrl);
-      callbacks.onStatus("Waiting for browser callback...");
-    });
+    server.listen(1455, "127.0.0.1");
     const timeout = setTimeout(() => {
-      if (!receivedCode) {
-        server.close();
-      }
-    }, 12e4);
+      if (!receivedCode) server.close();
+    }, CALLBACK_TIMEOUT_MS);
     timeout.unref();
+    const onAbort = () => {
+      server.close();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
     server.on("close", () => {
       clearTimeout(timeout);
+      signal.removeEventListener("abort", onAbort);
       if (receivedCode) {
         resolve(receivedCode);
       } else {
@@ -781,7 +821,7 @@ async function loginGemini(callbacks) {
   url.searchParams.set("state", state);
   let code;
   try {
-    code = await loginWithServer2(url.toString(), redirectUri, state, callbacks);
+    code = await loginWithServer(url.toString(), redirectUri, state, callbacks);
   } catch {
     callbacks.onOpenUrl(url.toString());
     const raw = await callbacks.onPromptCode(
@@ -859,7 +899,7 @@ function parseAuthorizationInput2(input) {
   }
   return { code: value };
 }
-async function loginWithServer2(authUrl, redirectUri, expectedState, callbacks) {
+async function loginWithServer(authUrl, redirectUri, expectedState, callbacks) {
   const redirect = new URL(redirectUri);
   const port = Number(redirect.port);
   return new Promise((resolve, reject) => {
@@ -1685,12 +1725,20 @@ var AuthStorage = class {
   }
   /**
    * Returns valid credentials, auto-refreshing if expired.
+   *
    * If `forceRefresh` is true, refreshes even if the token hasn't expired
-   * (useful when the provider rejects a token with 401 before its stored expiry).
+   * (useful when the provider rejects a token with 401 before its stored
+   * expiry). Callers recovering from a rejection should also pass
+   * `rejectedToken` — see the stampede guard below.
+   *
    * Throws if not logged in.
    */
   async resolveCredentials(provider, opts) {
-    await this.ensureLoaded();
+    if (opts?.forceRefresh) {
+      await this.ensureLoaded();
+    } else {
+      await this.ensureFresh();
+    }
     const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
     if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
       await this.reloadLatest();
@@ -1716,7 +1764,8 @@ var AuthStorage = class {
       }
       try {
         return await this.resolveCredentials(dual.oauthKey, {
-          ...opts?.forceRefresh ? { forceRefresh: true } : {}
+          ...opts?.forceRefresh ? { forceRefresh: true } : {},
+          ...opts?.rejectedToken !== void 0 ? { rejectedToken: opts.rejectedToken } : {}
         });
       } catch (err) {
         if (err instanceof NotLoggedInError && this.data[dual.provider]) {
@@ -1750,7 +1799,15 @@ var AuthStorage = class {
         throw new NotLoggedInError(provider);
       }
       const credentialWasReplaced = latestCreds.accessToken !== creds.accessToken || latestCreds.refreshToken !== creds.refreshToken || latestCreds.expiresAt !== creds.expiresAt;
-      if (credentialWasReplaced || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - refreshThresholdMs(latestCreds)) {
+      const rotatedBySibling = opts?.rejectedToken !== void 0 && latestCreds.accessToken !== opts.rejectedToken;
+      if (credentialWasReplaced || rotatedBySibling || !opts?.forceRefresh && Date.now() < latestCreds.expiresAt - refreshThresholdMs(latestCreds)) {
+        if (rotatedBySibling && !credentialWasReplaced) {
+          log(
+            "INFO",
+            "auth",
+            `${provider} token was rotated by another gg process \u2014 adopting it instead of refreshing again`
+          );
+        }
         this.data = latest;
         return latestCreds;
       }
@@ -1788,6 +1845,7 @@ var AuthStorage = class {
       return await refreshPromise;
     } finally {
       this.refreshLocks.delete(provider);
+      await this.rememberSnapshot();
     }
   }
   /**
@@ -2410,4 +2468,4 @@ export {
   getSummaryModel,
   getFastModel
 };
-//# sourceMappingURL=chunk-XDE6VUI4.js.map
+//# sourceMappingURL=chunk-JH7OVHH5.js.map