@omnicross/daemon 0.1.3 → 0.1.5

package/dist/cli.js

@@ -911,7 +911,7 @@ async function keysRevoke(db, id) {
 // src/commands/launch.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync15 } from "fs";
-import { delimiter as delimiter2, join as join10 } from "path";
+import { delimiter as delimiter2, join as join11 } from "path";
 import { parseArgs as parseArgs3 } from "util";
 import {
   buildChatCliLaunchConfig as buildChatCliLaunchConfig2,
@@ -960,6 +960,7 @@ var CodexOAuthSessionStore = class {
   ttlMs;
   sessions = /* @__PURE__ */ new Map();
   activeSessionId = null;
+  aborters = /* @__PURE__ */ new Map();
   /** Whether a codex sign-in is currently in flight (port 1455 held). */
   isBusy() {
     this.sweep();
@@ -971,13 +972,22 @@ var CodexOAuthSessionStore = class {
     const sessionId = crypto.randomBytes(24).toString("base64url");
     this.sessions.set(sessionId, { status: "pending", createdAt: Date.now() });
     this.activeSessionId = sessionId;
-    return sessionId;
+    const controller = new AbortController();
+    this.aborters.set(sessionId, controller);
+    return { sessionId, signal: controller.signal };
   }
   /** Settle a flow (done/error) + free the active slot. */
   settle(sessionId, status, error) {
     const prior = this.sessions.get(sessionId);
     this.sessions.set(sessionId, { status, error, createdAt: prior?.createdAt ?? Date.now() });
     if (this.activeSessionId === sessionId) this.activeSessionId = null;
+    this.aborters.delete(sessionId);
+  }
+  cancel(sessionId) {
+    if (!this.sessions.has(sessionId)) return false;
+    this.aborters.get(sessionId)?.abort();
+    this.settle(sessionId, "error", "login: cancelled");
+    return true;
   }
   /** Read a flow's status (token-free), or null when unknown/expired. */
   get(sessionId) {
@@ -1006,13 +1016,13 @@ function handleCodexOAuthStart(deps) {
     );
   }
   const { authUrl, codeVerifier, state } = codexOAuth.generateAuthParams();
-  const sessionId = deps.codexSessions.begin();
-  void runCodexLoopback(sessionId, codeVerifier, state, deps);
+  const { sessionId, signal } = deps.codexSessions.begin();
+  void runCodexLoopback(sessionId, codeVerifier, state, signal, deps);
   return { status: 200, body: { authUrl, sessionId } };
 }
-async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
+async function runCodexLoopback(sessionId, codeVerifier, state, signal, deps) {
   try {
-    const code = await deps.codexAwaitLoopback(state);
+    const code = await deps.codexAwaitLoopback(state, void 0, signal);
     const result = await codexOAuth.exchangeCodeForTokens(
       { authorizationCode: code, codeVerifier, state },
       deps.oauthExchangeFetch
@@ -1034,6 +1044,10 @@ async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
     deps.codexSessions.settle(sessionId, "error", reason);
   }
 }
+function handleCodexOAuthCancel(sessionId, deps) {
+  if (!deps.codexSessions.cancel(sessionId)) return err(404, "unknown or expired codex sign-in session");
+  return { status: 200, body: { ok: true } };
+}
 function handleCodexOAuthStatus(sessionId, deps) {
   const s = deps.codexSessions.get(sessionId);
   if (!s) return err(404, "unknown or expired codex sign-in session");
@@ -2220,12 +2234,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+import { join as join4 } from "path";
 import { setAuditCaptureConfig, setAuditSink } from "@omnicross/core/pipeline/auditSink";
+import { setUpstreamTracePath } from "@omnicross/core/pipeline/upstreamTrace";
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -2237,9 +2255,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    setUpstreamTracePath(config.captureBodies ? join4(auditDir, "upstream-trace.jsonl") : null);
   } else {
     setAuditCaptureConfig(null);
     setAuditSink(null);
+    setUpstreamTracePath(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -3852,6 +3872,10 @@ async function handleAccounts(req, res, method, rest, deps) {
     const result = handleCodexOAuthStatus(rest[2], deps);
     return writeJson2(res, result.status, result.body);
   }
+  if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
+    const result = handleCodexOAuthCancel(rest[2], deps);
+    return writeJson2(res, result.status, result.body);
+  }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) {
@@ -4191,7 +4215,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.3" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -4446,7 +4470,7 @@ var DEFAULT_TIMEOUT_MS = 5 * 6e4;
 function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
-function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
+function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
@@ -4480,6 +4504,12 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
       res.end(pageHtml("Login complete."));
       finish(server, () => resolve(code));
     });
+    const abort = () => finish(server, () => reject(new Error("login: cancelled")));
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+    signal?.addEventListener("abort", abort, { once: true });
     server.on("error", (err5) => {
       if (settled) return;
       settled = true;
@@ -5527,9 +5557,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function externalStorePath(provider, home = homedir2()) {
-  return provider === "claude" ? join4(home, ".claude", ".credentials.json") : join4(home, ".codex", "auth.json");
+  return provider === "claude" ? join5(home, ".claude", ".credentials.json") : join5(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -6648,7 +6678,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 import { existsSync as existsSync11, readdirSync, unlinkSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6674,8 +6704,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6731,7 +6761,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          unlinkSync(join5(this.auditDir, file));
+          unlinkSync(join6(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6755,14 +6785,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!existsSync12(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!existsSync12(auditDir2)) return [];
   let files;
   try {
-    files = readdirSync2(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = readdirSync2(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6773,7 +6803,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = readFileSync12(join6(auditDir, file), "utf8");
+      raw = readFileSync12(join7(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6803,10 +6833,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6839,7 +6869,7 @@ var AuditWriter = class {
       mkdirSync4(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = join7(this.auditDir, auditFileName(record.ts));
+    const file = join8(this.auditDir, auditFileName(record.ts));
     appendFileSync2(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6847,7 +6877,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync5 } from "fs";
 import { createHmac } from "crypto";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -6918,7 +6948,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join8(this.billingDir, billingFileName(event.ts));
+    const file = join9(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6968,7 +6998,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join8(this.billingDir, deliveredFileName(event.ts));
+      const file = join9(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6985,7 +7015,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync13 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!existsSync13(billingDir)) return view;
@@ -7022,7 +7052,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync13(join9(dir, file), "utf8");
+    raw = readFileSync13(join10(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7463,7 +7493,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7504,7 +7534,7 @@ function buildDaemon(config, paths) {
     // the app polls the token-free status. A test seam (`paths.codexAwaitLoopback`)
     // can inject a mock so no real port is bound.
     codexSessions: new CodexOAuthSessionStore(),
-    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs) => awaitLoopbackCode(state, timeoutMs)),
+    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs, signal) => awaitLoopbackCode(state, timeoutMs, signal)),
     // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
     // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
@@ -7539,7 +7569,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7549,9 +7579,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => fetchUpstream6(url, init)
   });
   setWebhookRuntime(webhookDispatcher, getSharedAccountHealth2());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,
@@ -7642,7 +7672,7 @@ function buildCliSpawnPlan(opts) {
 function resolveInPathDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean);
   for (const seg of segments) {
-    const full = join10(seg, candidate);
+    const full = join11(seg, candidate);
     if (existsSync15(full)) return full;
   }
   return null;